From 73908920caf64a799895e0f5fbe47002fd0a41b8 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 14:07:58 +0200
Subject: [PATCH 01/11] Copy the pipeline leaf and its schema catalogue from
 Epiphany ef956865

Byte-identical blobs of epiphany-pipeline/{Cargo.toml,src/lib.rs},
schemas/README.md and schemas/cultnet/* at Epiphany ef9568655e75, so Soul can
diff the copy against the source. Left out as the spec orders:
epiphany.work_organ_state.v0.schema.json and its index.json entry (no reader
outside Epiphany). Epiphany's schemas/cultnet/README.md is not copied over
Huginn's own README there; the next commit folds its pipeline section in.
The crate is not yet a workspace member and keeps its Epiphany names, so this
commit does not build as a package; nothing else changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/eureka-pipeline/Cargo.toml             |   27 +
 crates/eureka-pipeline/src/lib.rs             | 3187 +++++++++++++++++
 schemas/README.md                             |   47 +
 .../epiphany.pipeline.campaign.v2.schema.json |   89 +
 ...piphany.pipeline.cut_report.v2.schema.json |  375 ++
 .../epiphany.pipeline.cut_spec.v2.schema.json |  412 +++
 .../epiphany.pipeline.finding.v2.schema.json  |  264 ++
 ...epiphany.pipeline.follow_up.v2.schema.json |  132 +
 .../epiphany.pipeline.hand_off.v2.schema.json |   66 +
 .../epiphany.pipeline.instance.v2.schema.json |   44 +
 .../epiphany.pipeline.question.v2.schema.json |  147 +
 ...piphany.pipeline.resolution.v2.schema.json |  234 ++
 .../epiphany.pipeline.ruling.v2.schema.json   |  174 +
 ...iphany.pipeline.stewardship.v2.schema.json |   55 +
 .../epiphany.pipeline.target.v2.schema.json   |  117 +
 .../epiphany.pipeline.verdict.v2.schema.json  |  166 +
 .../gamecult.persona_state.v0.schema.json     | 1024 ++++++
 schemas/cultnet/index.json                    |  159 +
 18 files changed, 6719 insertions(+)
 create mode 100644 crates/eureka-pipeline/Cargo.toml
 create mode 100644 crates/eureka-pipeline/src/lib.rs
 create mode 100644 schemas/README.md
 create mode 100644 schemas/cultnet/epiphany.pipeline.campaign.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.cut_report.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.cut_spec.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.finding.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.follow_up.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.hand_off.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.instance.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.question.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.resolution.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.ruling.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.stewardship.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.target.v2.schema.json
 create mode 100644 schemas/cultnet/epiphany.pipeline.verdict.v2.schema.json
 create mode 100644 schemas/cultnet/gamecult.persona_state.v0.schema.json
 create mode 100644 schemas/cultnet/index.json

diff --git a/crates/eureka-pipeline/Cargo.toml b/crates/eureka-pipeline/Cargo.toml
new file mode 100644
index 0000000..48d2fdd
--- /dev/null
+++ b/crates/eureka-pipeline/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "epiphany-pipeline"
+version = "0.1.0"
+edition = "2024"
+publish = false
+autobins = false
+license-file = "../LICENSE"
+
+[lib]
+name = "epiphany_pipeline"
+path = "src/lib.rs"
+
+# A leaf type library. Every dependency here is one the document types or the
+# write path need in a non-test build: the organ prepares, decodes and
+# validates envelopes through this crate, so `anyhow` (the cache's error type)
+# and `rmp-serde` (the payload decode) are normal dependencies. Only the
+# schema-publication check needs JSON.
+[dependencies]
+anyhow = "1"
+chrono = "0.4.44"
+cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultcache-rs" }
+rmp-serde = "1"
+schemars = "1"
+serde = { version = "1", features = ["derive"] }
+
+[dev-dependencies]
+serde_json = "1"
diff --git a/crates/eureka-pipeline/src/lib.rs b/crates/eureka-pipeline/src/lib.rs
new file mode 100644
index 0000000..c29146e
--- /dev/null
+++ b/crates/eureka-pipeline/src/lib.rs
@@ -0,0 +1,3187 @@
+//! Eureka pipeline documents: the typed shape of a Eureka campaign's state.
+//!
+//! This is a leaf type library, and deliberately nothing else. It owns document
+//! shape, field bounds, formats, key derivation and the JSON schemas published
+//! under `schemas/cultnet`; it owns no storage, no admission, no process and no
+//! network. That is the whole reason it is a package: the organ that will admit
+//! these documents depends on these types without depending on the harness
+//! that used to hold them.
+//!
+//! Every kind is a plain `serde` + `JsonSchema` value inside a one-slot
+//! `DatabaseEntry` wrapper, always prepared with `prepare_entry_named`, so the
+//! stored payload is `[value]` and the value is the named map the published
+//! schema describes. Keys are semantic: `pipeline_key` derives them from the
+//! value, and the write validator refuses any envelope whose key differs.
+//!
+//! Every key is `<root>:<kind>:<local>`, three segments for every kind with
+//! none excused: the root is a `Slug`, the kind is the literal kind name, and
+//! the local is `Label`s joined by `.`, so no local part carries a dot and a
+//! reader recovers the parts by splitting. A root's local is the constant
+//! `self`; a resolution's local is its subject's kind and local. A
+//! resolution's local ends in its per-subject sequence, `n<N>`, and a
+//! stewardship's in its per-repo sequence, so a subject's resolutions and a
+//! repo's assignments each share a prefix.
+//!
+//! **Validation follows the type.** `value_types!` is the single field list: it
+//! emits the struct and its `Bounded` impl from the same tokens, so a field
+//! cannot be declared without being validated. Format rules live in the field's
+//! type (`Label`, `Slug`, `OrgRepo`, `Sha`, `Sha256Hex`, `Date`), never in a
+//! hand-written impl that a later field can slip past. A `Vec` field must carry
+//! a maximum, because `Vec<T>` has no `Bounded` impl of its own.
+//!
+//! The wrappers are crate-private: outside code registers, prepares and
+//! decodes them through `register_pipeline_document_types`,
+//! `PipelineDocument::prepare` and `PipelineDocument::decode`, and validates a
+//! write through `validate_pipeline_write_envelope`.
+
+// `anyhow` is the cache's own error type, which `prepare` and the registrar
+// pass through; every refusal this crate decides is a `PipelineRefusal`.
+use anyhow::Result;
+use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry};
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+/// Typed refusals of the pipeline documents: bounds, formats and key identity
+/// (D2's document half), and `ForeignStore`, raised by `decode` for an
+/// envelope of any other type. This is every refusal the leaf decides; a
+/// store's identity and its schema epoch are not decided here, since this
+/// crate owns no store, and belong to the organ that will admit these
+/// documents.
+///
+/// Serialised externally tagged, serde's default for an enum: each variant is
+/// a one-key map from the variant's name to its named fields, so `field` and
+/// `value` are on the wire under their own names and a reader of a refusal
+/// carried over a wire reads the same parts a local caller matches on. No
+/// attribute buys that, which is why there is none: an internal or adjacent
+/// tag would move the fields under a content key without making any of them
+/// more visible.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum PipelineRefusal {
+    FieldBound { field: String, limit: u32, actual: u32 },
+    InvalidFormat { field: String, value: String },
+    InvalidIdentity { kind: PipelineKind, key: String, expected: String },
+    DuplicateRepo { field: String, repo: String },
+    ForeignStore { r#type: String },
+}
+
+impl std::fmt::Display for PipelineRefusal {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(formatter, "pipeline refusal: {self:?}")
+    }
+}
+
+impl std::error::Error for PipelineRefusal {}
+
+pub(crate) trait Bounded {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal>;
+}
+
+impl<T: Bounded> Bounded for Option<T> {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        self.as_ref().map_or(Ok(()), |value| value.validate(field))
+    }
+}
+
+macro_rules! unbounded_scalars {
+    ($($ty:ty),* $(,)?) => {$(
+        impl Bounded for $ty {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+    )*};
+}
+
+unbounded_scalars!(u32, u64, bool);
+
+fn bound(field: &str, limit: usize, actual: usize) -> Result<(), PipelineRefusal> {
+    if actual > limit {
+        return Err(PipelineRefusal::FieldBound {
+            field: field.into(),
+            limit: limit as u32,
+            actual: actual as u32,
+        });
+    }
+    Ok(())
+}
+
+/// List maximums only. Minimum counts are admission rules with their own
+/// refusals (Cut 3b), so a bounds pass never pre-empts them.
+fn list<T: Bounded>(field: &str, items: &[T], max: usize) -> Result<(), PipelineRefusal> {
+    bound(field, max, items.len())?;
+    for (index, item) in items.iter().enumerate() {
+        item.validate(&format!("{field}[{index}]"))?;
+    }
+    Ok(())
+}
+
+fn format_error(field: &str, value: &str) -> PipelineRefusal {
+    PipelineRefusal::InvalidFormat {
+        field: field.into(),
+        value: value.into(),
+    }
+}
+
+fn hex(field: &str, value: &str, lengths: std::ops::RangeInclusive<usize>) -> Result<(), PipelineRefusal> {
+    let lower_hex = value.bytes().all(|byte| matches!(byte, b'0'..=b'9' | b'a'..=b'f'));
+    if !lengths.contains(&value.len()) || !lower_hex {
+        return Err(format_error(field, value));
+    }
+    Ok(())
+}
+
+/// A key label: `[A-Za-z0-9_-]{1,64}`. Dots are excluded so that a composed key
+/// segments unambiguously; see `local`.
+fn label_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let valid = value
+        .bytes()
+        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'));
+    if !valid || value.is_empty() || value.len() > 64 {
+        return Err(format_error(field, value));
+    }
+    Ok(())
+}
+
+/// A dotted key segment: label parts joined by `.`, at most 64 bytes. Every
+/// part must be a label, so `..`, a leading or trailing dot, and an empty part
+/// are all refused.
+fn dotted_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    dotted_within(field, value, 64)
+}
+
+/// `dotted_text`'s grammar with the bound as a parameter: the one place a
+/// dotted segment is parsed, whoever owns the bound.
+fn dotted_within(field: &str, value: &str, max: usize) -> Result<(), PipelineRefusal> {
+    if value.is_empty() || value.len() > max {
+        return Err(format_error(field, value));
+    }
+    for part in value.split('.') {
+        label_text(field, part)?;
+    }
+    Ok(())
+}
+
+/// GitHub's own grammar for `owner/repo`, exactly one `/`: the owner is
+/// `[A-Za-z0-9-]`, 1 to 39 bytes, with no leading or trailing hyphen; the repo
+/// is `[A-Za-z0-9._-]`, 1 to 100 bytes, is never `.` or `..`, and does not end
+/// in `.git`, ASCII-case-insensitively (`a/b.GIT` is refused exactly as
+/// `a/b.git` is), so the suffix rule cannot be dodged by a case variant whose
+/// `identity()` is refused. The repo's own byte alphabet excludes `/`, so a
+/// second `/` inside it is already refused by the byte check; no separate
+/// `contains('/')` check is needed.
+fn org_repo_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let valid = value.split_once('/').is_some_and(|(owner, repo)| {
+        (1..=39).contains(&owner.len())
+            && owner.bytes().all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+            && !owner.starts_with('-')
+            && !owner.ends_with('-')
+            && (1..=100).contains(&repo.len())
+            && repo.bytes().all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+            && repo != "."
+            && repo != ".."
+            && !(repo.len() >= 4 && repo[repo.len() - 4..].eq_ignore_ascii_case(".git"))
+    });
+    if valid {
+        Ok(())
+    } else {
+        Err(format_error(field, value))
+    }
+}
+
+macro_rules! bounded_text {
+    ($($(#[$doc:meta])* $name:ident = $limit:literal, $check:expr;)*) => {$(
+        #[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        #[serde(transparent)]
+        #[schemars(extend("maxLength" = $limit))]
+        $(#[$doc])*
+        pub struct $name(pub String);
+        impl Bounded for $name {
+            fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+                let check: fn(&str, &str) -> Result<(), PipelineRefusal> = $check;
+                check(field, &self.0)
+            }
+        }
+        impl From<&str> for $name {
+            fn from(value: &str) -> Self {
+                Self(value.into())
+            }
+        }
+    )*};
+}
+
+fn within(limit: usize) -> impl Fn(&str, &str) -> Result<(), PipelineRefusal> {
+    move |field: &str, value: &str| bound(field, limit, value.len())
+}
+
+/// A title holds at least one `char::is_alphanumeric()` character, no
+/// `char::is_control()` character, no U+2028 LINE SEPARATOR or U+2029
+/// PARAGRAPH SEPARATOR (both `Zl`/`Zp`, so `is_control()` does not reach
+/// them, and a one-line field should carry no hard line break), and no bidi
+/// control character: `U+061C`, `U+200E`, `U+200F`, `U+202A`-`U+202E`,
+/// `U+2066`-`U+2069`. No denylist of individual zero-width or format
+/// characters is maintained here; a character not covered by one of these
+/// tests is allowed, so ZWJ and ZWNJ still work.
+fn title_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let alphanumeric = value.chars().any(|character| character.is_alphanumeric());
+    let control = value
+        .chars()
+        .any(|character| character.is_control() || matches!(character, '\u{2028}' | '\u{2029}'));
+    let bidi = value.chars().any(|character| {
+        matches!(
+            character,
+            '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}'
+        )
+    });
+    if !alphanumeric || control || bidi {
+        return Err(format_error(field, value));
+    }
+    within(200)(field, value)
+}
+
+bounded_text! {
+    /// Text of at most 200 UTF-8 bytes.
+    Short = 200, |field, value| within(200)(field, value);
+    /// A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema
+    /// length counts characters. Holds at least one alphanumeric character,
+    /// no control character, and no bidi control character (`U+061C`,
+    /// `U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).
+    #[schemars(extend("minLength" = 1))]
+    Title = 200, title_text;
+    /// Text of at most 1,000 UTF-8 bytes.
+    Line = 1000, |field, value| within(1000)(field, value);
+    /// Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.
+    Para = 4000, |field, value| within(4000)(field, value);
+    /// A key label: `[A-Za-z0-9_-]{1,64}`.
+    Label = 64, label_text;
+    /// A campaign slug or key segment: label parts joined by `.`.
+    Slug = 64, dotted_text;
+    /// A git commit id: 7-40 lowercase hex characters.
+    Sha = 40, |field, value| hex(field, value, 7..=40);
+    /// A full git commit id: exactly 40 lowercase hex characters.
+    FullSha = 40, |field, value| hex(field, value, 40..=40);
+    /// A SHA-256 digest: exactly 64 lowercase hex characters.
+    Sha256Hex = 64, |field, value| hex(field, value, 64..=64);
+}
+
+impl Sha {
+    /// The type's identity rule: two spellings name one commit when one is a
+    /// prefix of the other, so a 7-character abbreviation and the full id of
+    /// the same commit are equal here though not `==`. Both are already 7-40
+    /// lowercase hex. Two distinct commits that share a 7-character prefix are
+    /// git's ambiguity, not the mind's.
+    pub fn names_same_commit(&self, other: &Sha) -> bool {
+        self.0.starts_with(&other.0) || other.0.starts_with(&self.0)
+    }
+}
+
+impl Slug {
+    /// The public door onto the slug grammar, for a caller outside this crate
+    /// that holds a bare `Slug` and no way to reach `Bounded`, which is
+    /// crate-private. On the pattern of `PipelineRef::validate_ref`: it
+    /// delegates so the grammar keeps one owner, and it applies exactly the
+    /// `dotted_text` check that every `Slug` field in this crate is held to,
+    /// so a caller that validates a declared name this way and a document
+    /// field of the same type refuse the same inputs. Named `validate_slug`
+    /// rather than a bare `validate`, because an inherent `validate` would
+    /// shadow `Bounded`'s for every in-crate caller holding a `Slug`.
+    pub fn validate_slug(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "slug")
+    }
+}
+
+/// A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +
+/// 100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or
+/// trailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never
+/// `.` or `..`, and does not end in `.git`, ASCII-case-insensitively.
+/// Identity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`
+/// are the same repository.
+//
+// The raw string is display-only. `OrgRepo` is not generated by
+// `bounded_text!`: that macro derives `PartialEq`, `Eq`, `Hash`, `PartialOrd`
+// and `Ord` on the raw string, with no per-member override, so a type built
+// from it compares and keys on spelling. `OrgRepo` instead carries
+// hand-written impls of those five traits, every one of them over
+// `identity()` (the ASCII-lowercased value), so `==`, a `BTreeMap` key and a
+// `HashMap` key are all case-insensitive by construction: `GameCult/Epiphany`
+// and `gamecult/epiphany` compare equal, hash equal, order together and
+// collapse to one map entry, and a caller cannot reach the case-sensitive
+// behaviour by accident. `Hash` and `Eq` agree because both are defined over
+// the same `identity()` string. Every other bounded type keeps the macro's
+// derives untouched. This reasoning is a source comment, not a doc comment,
+// so it does not enter the published schema description (RS-L closing fix 2):
+// a consumer needs the grammar, the bound and the case-insensitivity, not the
+// Rust-macro justification for how that got built.
+#[derive(Clone, Debug, Default, Serialize, Deserialize, JsonSchema)]
+#[serde(transparent)]
+#[schemars(extend("maxLength" = 140))]
+pub struct OrgRepo(pub String);
+
+impl Bounded for OrgRepo {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        org_repo_text(field, &self.0)
+    }
+}
+
+impl From<&str> for OrgRepo {
+    fn from(value: &str) -> Self {
+        Self(value.into())
+    }
+}
+
+impl PartialEq for OrgRepo {
+    fn eq(&self, other: &Self) -> bool {
+        self.identity() == other.identity()
+    }
+}
+
+impl Eq for OrgRepo {}
+
+impl std::hash::Hash for OrgRepo {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.identity().hash(state);
+    }
+}
+
+impl PartialOrd for OrgRepo {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for OrgRepo {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.identity().cmp(&other.identity())
+    }
+}
+
+impl OrgRepo {
+    /// The public door onto the `org_repo` grammar, for a caller outside this
+    /// crate that holds a bare `OrgRepo` (the organ's `repo` alias, RS-3) and
+    /// no way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
+    /// delegates to `org_repo_text` through `Bounded::validate`, so the
+    /// grammar keeps one owner and a declared name checked this way refuses
+    /// exactly what a document's own `OrgRepo` field refuses.
+    pub fn validate_org_repo(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "org_repo")
+    }
+
+    /// The one canonical key for an `OrgRepo`: the value, ASCII-lowercased.
+    /// Every comparison, hash, ordering and lookup keyed by repository
+    /// identity goes through this — `PartialEq`, `Hash` and `Ord` above are
+    /// all defined in terms of it — so `GameCult/Epiphany` and
+    /// `gamecult/epiphany` are the same repository everywhere, not only where
+    /// a caller remembers to ask.
+    pub fn identity(&self) -> String {
+        self.0.to_ascii_lowercase()
+    }
+}
+
+impl Label {
+    /// The public door onto the label grammar, for a caller outside this
+    /// crate that holds a bare `Label` (the organ's `cut` alias, RS-3) and no
+    /// way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
+    /// delegates to `label_text` through `Bounded::validate`, so the grammar
+    /// keeps one owner and a declared name checked this way refuses exactly
+    /// what a document's own `Label` field refuses.
+    pub fn validate_label(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "label")
+    }
+}
+
+/// A calendar date, `YYYY-MM-DD`.
+#[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+#[serde(transparent)]
+#[schemars(extend("maxLength" = 10))]
+pub struct Date(pub String);
+
+impl Bounded for Date {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        match chrono::NaiveDate::parse_from_str(&self.0, "%Y-%m-%d") {
+            Ok(_) if self.0.len() == 10 => Ok(()),
+            _ => Err(format_error(field, &self.0)),
+        }
+    }
+}
+
+macro_rules! bounded_field {
+    ($value:expr, $field:expr) => {
+        Bounded::validate(&$value, $field)?
+    };
+    ($value:expr, $field:expr, $max:literal) => {
+        list($field, &$value, $max)?
+    };
+}
+
+/// The single field list: one invocation emits the value struct and its
+/// `Bounded` impl, so a field can never be left out of validation.
+macro_rules! value_types {
+    ($($(#[$attr:meta])* pub struct $name:ident { $($field:ident: $ty:ty $([$max:literal])?),* $(,)? } $(=> $extra:path)?)*) => {$(
+        $(#[$attr])*
+        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+        pub struct $name {
+            $(
+                $(#[schemars(extend("maxItems" = $max))])?
+                pub $field: $ty
+            ),*
+        }
+
+        impl Bounded for $name {
+            fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
+                $(bounded_field!(self.$field, &format!("{at}.{}", stringify!($field)) $(, $max)?);)*
+                $($extra(self, at)?;)?
+                Ok(())
+            }
+        }
+    )*};
+}
+
+macro_rules! unit_enums {
+    ($($name:ident { $($variant:ident),* $(,)? })*) => {$(
+        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        pub enum $name { $($variant),* }
+        impl Bounded for $name {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+    )*};
+}
+
+/// RS-L closing fix 4: `campaign.repos` refuses two entries naming the same
+/// repository by identity, not by raw spelling, so `GameCult/Epiphany` and
+/// `gamecult/epiphany` in one list refuse exactly as one entry twice would.
+/// This is a cross-element invariant on `PipelineCampaign` alone, not a
+/// per-type format rule any other `value_types!` struct shares, so it is
+/// wired in as that struct's one `=> extra` hook rather than folded into
+/// `Bounded for OrgRepo` or the list bound in `bounded_field!`.
+fn campaign_repos_are_distinct(campaign: &PipelineCampaign, at: &str) -> Result<(), PipelineRefusal> {
+    let mut seen = std::collections::HashSet::new();
+    for repo in &campaign.repos {
+        if !seen.insert(repo.identity()) {
+            return Err(PipelineRefusal::DuplicateRepo {
+                field: format!("{at}.repos"),
+                repo: repo.0.clone(),
+            });
+        }
+    }
+    Ok(())
+}
+
+unit_enums! {
+    EvidenceKind { Command, Test, Mutation, Probe, SourceRead, Capture }
+    ClaimOutcome { Holds, Falsified, Unproven }
+    FindingConfidence { Confirmed, Plausible }
+    FindingSeverity { Blocker, High, Medium, Low }
+    RulingAuthority { Operator, Standing, Defaulted }
+    FindingOrigin { Introduced, PreExisting }
+}
+
+value_types! {
+    pub struct CodeLocation { path: Short, line: u32, end_line: Option<u32> }
+    pub struct CommitRange { base: Sha, head: Sha }
+    pub struct Evidence { kind: EvidenceKind, locator: Line, result: Line }
+    /// A citation of a document in another repo's pipeline store (D6).
+    pub struct ForeignRef { repo: OrgRepo, commit: FullSha, kind: PipelineKind, id: Short, payload_sha256: Sha256Hex }
+    pub struct DocRef { path: Short, start_line: u32, end_line: u32, commit: Sha }
+    pub struct TargetInvariant { label: Label, statement: Line }
+    pub struct QuestionOption { label: Label, text: Line }
+    pub struct CutDelete { path: Short, lines: u32, note: Line }
+    pub struct FileChange { location: CodeLocation, change: Line }
+    pub struct AuthorityMap {
+        owner: Line, inputs: Vec<Line>[16], outputs: Vec<Line>[16], derived_state: Vec<Line>[16],
+        forbidden_writers: Vec<Line>[16], shared_paths: Vec<Line>[16], deletion_line: Line,
+    }
+    pub struct VerificationTest { name: Short, pins: Line }
+    pub struct NegativeCheck { pattern: Short, scope: Line }
+    pub struct CutVerification {
+        builds: Vec<Line>[64], tests: Vec<VerificationTest>[64],
+        negative: Vec<NegativeCheck>[64], operator: Vec<Line>[64],
+    }
+    pub struct ReportCommit { sha: Sha, subject: Line, builds: bool }
+    /// One mutation a report ran: a key-safe label a verdict claim can name,
+    /// the exact edit, and the tree it was applied to.
+    pub struct MutationRecord { label: Label, rule: Line, location: CodeLocation, before: Line, after: Line, commit: Sha, failed_as_expected: bool }
+    pub struct Deviation { what: Line, why: Line }
+    // D1 tables no maximum for these lists, so they take the shared list
+    // default of 64 rather than a number invented for this field alone.
+    pub struct StructuralDelta {
+        lines_added: u32, lines_removed: u32,
+        dependencies_added: Vec<Short>[64], dependencies_removed: Vec<Short>[64],
+        formats_added: Vec<Short>[64], formats_removed: Vec<Short>[64],
+        targets_added: Vec<Short>[64], targets_removed: Vec<Short>[64],
+    }
+    /// A name the cut landed, and where it lives.
+    pub struct LandedName { name: Short, path: Short }
+    /// A promise a report makes about what it landed. Not a document and not
+    /// resolvable: it is identified by its report's id and its label, as a
+    /// `TargetInvariant` is by its target's. Soul measures every one (ruling
+    /// A), and the rule that every one is measured is admission's.
+    pub struct Promise { label: Label, text: Line }
+    /// The promise this claim measured, and the report's mutations it ran. An
+    /// `Unproven` claim with a promise is one Soul could not reach.
+    pub struct VerdictClaim {
+        claim: Line, outcome: ClaimOutcome, evidence: Vec<Evidence>[8], findings: Vec<Short>[16],
+        promise: Option<Label>, mutations: Vec<Label>[8],
+    }
+
+    pub struct PipelineCampaign { slug: Slug, title: Title, repos: Vec<OrgRepo>[8], working_branch: Short, target_doc: DocRef } => campaign_repos_are_distinct
+    pub struct PipelineTarget {
+        campaign: Slug, revision: u32, invariants: Vec<TargetInvariant>[32], not_in_scope: Vec<Line>[32],
+        canonical_implementations: Vec<Line>[16], doc: DocRef,
+    }
+    pub struct PipelineQuestion {
+        campaign: Slug, label: Label, title: Title, question: Para, options: Vec<QuestionOption>[8], recommended: Label,
+        depends: Vec<Line>[8], raised_in: Option<PipelineRef>, asked_on: Date,
+    }
+    pub struct PipelineRuling {
+        campaign: Slug, label: Label, title: Title, answers: Option<Short>, choice: Option<Label>, ruling: Para,
+        operator_quote: Option<Para>, ruled_on: Date, precedents: Vec<ForeignRef>[8], authority: RulingAuthority,
+    }
+    pub struct PipelineCutSpec {
+        campaign: Slug, cut: Label, revision: u32, title: Title, repo: OrgRepo, branch: Short, base: Sha,
+        depends_on: Vec<Short>[8], first: Vec<Line>[16], deletes: Vec<CutDelete>[64], keeps_moves: Vec<Line>[64],
+        adds: Vec<Line>[64], file_changes: Vec<FileChange>[256], authority_map: Option<AuthorityMap>,
+        verification: CutVerification, estimate: StructuralDelta,
+        rulings: Vec<Short>[32], questions: Vec<Short>[16],
+    }
+    pub struct PipelineCutReport {
+        campaign: Slug, cut_spec: Short, attempt: u32, repo: OrgRepo, branch: Short,
+        commits: Vec<ReportCommit>[128], range: CommitRange, verification: Vec<Evidence>[64],
+        mutations: Vec<MutationRecord>[64], deviations: Vec<Deviation>[32], forks: Vec<Short>[8],
+        structural_delta: StructuralDelta, landed_names: Vec<LandedName>[128], undone: Vec<Line>[32],
+        promises: Vec<Promise>[64],
+    }
+    pub struct PipelineVerdict { campaign: Slug, cut_report: Short, pass: u32, range: CommitRange, claims: Vec<VerdictClaim>[64] }
+    pub struct PipelineFinding {
+        campaign: Slug, verdict: Short, label: Label, range: CommitRange, confidence: FindingConfidence,
+        severity: FindingSeverity, claim: Line, invariants: Vec<Label>[8], locations: Vec<CodeLocation>[16],
+        failure_scenario: Para, evidence: Vec<Evidence>[16], precedents: Vec<ForeignRef>[8], origin: FindingOrigin,
+    }
+    pub struct PipelineFollowUp {
+        campaign: Slug, label: Label, source: PipelineRef, repo: OrgRepo, locations: Vec<CodeLocation>[16],
+        item: Line, why_it_can_wait: Line, owner: Short,
+    }
+    /// The record of how a subject was closed and by what. `sequence` is per
+    /// subject and set by the writer, `1` for the first, and it is the last
+    /// part of the key, so a subject's resolutions share a prefix and a
+    /// withdrawn one is kept under its subject rather than overwritten.
+    /// Whether a sequence is the previous plus one, and whether an earlier
+    /// resolution still stands, are admission's rules: this crate refuses
+    /// neither `0` nor a gap, exactly as it refuses neither `revision: 0` nor
+    /// a `revision` with no predecessor.
+    pub struct PipelineResolution { subject: PipelineRef, sequence: u32, outcome: ResolutionOutcome, rationale: Para, resolved_on: Date }
+
+    /// A mind's identity document. A store is canonical to exactly one
+    /// instance, and this says which; identity lives in the state, not in a
+    /// path.
+    pub struct PipelineInstance { instance: Slug, display_name: Short, created_at: Date, host: Short }
+    /// Stewardship over a repo, as an assignment recorded in a mind. One
+    /// instance may steward several repos, so the repo is part of the key.
+    /// `sequence` is per `(instance, repo)`, set by the writer, `1` for the
+    /// first, so a repo transferred away and back is two records under one
+    /// prefix rather than one document overwriting the other. `assigned_on`
+    /// is a field, not a key part. As on a resolution, whether the sequence
+    /// is the previous plus one, and which assignment is in force, are
+    /// admission's rules and not this crate's.
+    pub struct PipelineStewardship { instance: Slug, repo: OrgRepo, sequence: u32, assigned_on: Date, note: Line }
+    /// A reassignment of stewardship, recorded in both minds. `documents` names
+    /// what travels with it.
+    pub struct PipelineHandOff {
+        from_instance: Slug, to_instance: Slug, repo: OrgRepo, documents: Vec<Short>[256],
+        reason: Para, handed_on: Date,
+    }
+}
+
+/// A reference to another document. The id is parsed as a full pipeline id of
+/// the declared `kind`, so the kind and the id's kind segment cannot disagree.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct PipelineRef {
+    pub kind: PipelineKind,
+    pub id: Short,
+}
+
+impl Bounded for PipelineRef {
+    fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
+        self.id.validate(&format!("{at}.id"))?;
+        pipeline_id(&format!("{at}.id"), &self.id.0, self.kind).map(|_| ())
+    }
+}
+
+impl PipelineRef {
+    /// The grammar's door for a reader holding a bare reference. A read side
+    /// outside this crate is handed a `kind` and an `id` that may disagree, and
+    /// `Bounded` is crate-private, so without this there is no way to ask; a
+    /// reader with no way to ask answers empty, which reads as "no such
+    /// document" rather than "that is not a reference". It delegates, so the
+    /// grammar keeps one owner: this is exactly what a document's own
+    /// `PipelineRef` field is held to, at the field name `ref`. It is kind-deep,
+    /// like every other read of an id: whether the named document exists, and
+    /// whether the local's shape suits the kind, are admission's rules.
+    ///
+    /// A method rather than a free function because it concerns one public
+    /// type, as `prepare` and `decode` do; the two free doors act on a cache or
+    /// an envelope this crate does not own. `validate_ref` rather than a bare
+    /// `validate`, because an inherent `validate` would shadow `Bounded`'s for
+    /// every in-crate caller holding a `PipelineRef`.
+    pub fn validate_ref(&self) -> Result<(), PipelineRefusal> {
+        self.validate("ref")
+    }
+}
+
+/// How a subject was resolved. Every referent is a parsed `PipelineRef`, so a
+/// resolution names its records by ids of the kinds they declare, validated
+/// where every other referent is; a `Fixed` commit is a `Sha` whose referent
+/// is outside the document set (ruling B). Whether a named document exists,
+/// and how many may supersede one subject, are admission's rules.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum ResolutionOutcome {
+    /// Overturned, in whole or in part, by later records. The list is bounded
+    /// here because the enum is outside `value_types!`, the only place a list
+    /// maximum is emitted automatically.
+    Superseded {
+        #[schemars(extend("maxItems" = 8))]
+        by: Vec<PipelineRef>,
+    },
+    Answered { by: PipelineRef },
+    Fixed { commit: Sha, by: Option<PipelineRef> },
+    Deferred { to: PipelineRef },
+    Recorded { reason: Line },
+    Withdrawn { reason: Line },
+}
+
+impl Bounded for ResolutionOutcome {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        match self {
+            Self::Superseded { by } => list(&format!("{field}.by"), by, 8),
+            Self::Answered { by } => by.validate(&format!("{field}.by")),
+            Self::Fixed { commit, by } => {
+                commit.validate(&format!("{field}.commit"))?;
+                by.validate(&format!("{field}.by"))
+            }
+            Self::Deferred { to } => to.validate(&format!("{field}.to")),
+            Self::Recorded { reason } | Self::Withdrawn { reason } => reason.validate(&format!("{field}.reason")),
+        }
+    }
+}
+
+macro_rules! pipeline_kinds {
+    ($($variant:ident($value:ident) => $document:ident, $name:literal, $type_id:tt, $schema:tt;)*) => {
+        $(
+            #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+            #[cultcache(type = $type_id, schema = $schema)]
+            pub(crate) struct $document {
+                #[cultcache(key = 0)]
+                pub(crate) value: $value,
+            }
+        )*
+
+        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        pub enum PipelineKind { $($variant),* }
+
+        impl Bounded for PipelineKind {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+
+        /// The envelope enum, adjacently tagged on the kind name: a document
+        /// on a wire is `{ kind, value }`, and `kind` is exactly what
+        /// `PipelineKind::name()` returns, so a reader dispatches on the kind
+        /// segment it already knows from the key and needs no second registry
+        /// mapping variant spellings to kinds. Adjacent rather than internal
+        /// because a value is a named map of its own and an internal tag would
+        /// have to be merged into it; the tag stays beside the value instead.
+        /// This is not a published schema: `schemas/cultnet` publishes the
+        /// thirteen per-kind value documents, and the envelope is the wire's
+        /// shape, not a document's.
+        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+        #[serde(tag = "kind", content = "value", rename_all = "snake_case")]
+        pub enum PipelineDocument { $($variant($value)),* }
+
+        impl PipelineKind {
+            pub const ALL: &'static [PipelineKind] = &[$(Self::$variant),*];
+
+            /// The kind segment of a document key.
+            pub fn name(self) -> &'static str {
+                match self { $(Self::$variant => $name),* }
+            }
+
+            pub fn type_id(self) -> &'static str {
+                match self { $(Self::$variant => <$document as DatabaseEntry>::TYPE),* }
+            }
+
+            #[cfg(test)]
+            pub(crate) fn derived_schema(self) -> schemars::Schema {
+                match self { $(Self::$variant => schemars::schema_for!($value)),* }
+            }
+        }
+
+        impl PipelineDocument {
+            pub fn kind(&self) -> PipelineKind {
+                match self { $(Self::$variant(_) => PipelineKind::$variant),* }
+            }
+
+            /// Field bounds and formats (D1), in UTF-8 bytes and list maximums.
+            pub fn validate(&self) -> Result<(), PipelineRefusal> {
+                match self { $(Self::$variant(value) => value.validate($name)),* }
+            }
+
+            /// Prepares the envelope to be stored: keyed by `pipeline_key`,
+            /// payload `[value]` through `prepare_entry_named`.
+            pub fn prepare(&self, cache: &CultCache) -> Result<CultCacheEnvelope> {
+                let key = pipeline_key(self)?;
+                Ok(match self {
+                    $(Self::$variant(value) => {
+                        cache.prepare_entry_named(key, &$document { value: value.clone() })?.0
+                    })*
+                })
+            }
+
+            /// Decodes a stored envelope, type-matched both ways: an envelope of
+            /// any other type is `ForeignStore`, never the kind that happens to
+            /// parse its payload. It validates neither bounds nor the key: a
+            /// decoded document is a typed read, and
+            /// `validate_pipeline_write_envelope` is the check before a write.
+            pub fn decode(envelope: &CultCacheEnvelope) -> Result<Self, PipelineRefusal> {
+                let invalid = |error: rmp_serde::decode::Error| format_error("payload", &error.to_string());
+                $(if envelope.r#type == <$document as DatabaseEntry>::TYPE {
+                    let document: $document = rmp_serde::from_slice(&envelope.payload).map_err(invalid)?;
+                    return Ok(Self::$variant(document.value));
+                })*
+                Err(PipelineRefusal::ForeignStore { r#type: envelope.r#type.clone() })
+            }
+        }
+
+        /// Registers every pipeline kind in a cache, and nothing else: the one
+        /// door to the crate-private wrappers, so a caller registers exactly
+        /// what this crate publishes.
+        pub fn register_pipeline_document_types(cache: &mut CultCache) -> Result<()> {
+            $(cache.register_entry_type::<$document>()?;)*
+            Ok(())
+        }
+    };
+}
+
+/// A document that is not a pipeline document, for the decode refusal and the
+/// registrar's count to be pinned against something real. It stands in for
+/// any other document a store may hold beside pipeline documents, a commit
+/// receipt say, which is still not a document this library may decode. The
+/// stand-in carries a receipt-shaped type id and is registered only by the
+/// tests' own cache, never by the live registrar.
+#[cfg(test)]
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "epiphany.mind_commit_receipt.v1", schema = "ForeignDocument")]
+pub(crate) struct ForeignDocument {
+    #[cultcache(key = 0)]
+    pub(crate) marker: Short,
+}
+
+pipeline_kinds! {
+    Campaign(PipelineCampaign) => EpiphanyPipelineCampaignDocument, "campaign",
+        "epiphany.pipeline.campaign.v2", "EpiphanyPipelineCampaignDocument";
+    Target(PipelineTarget) => EpiphanyPipelineTargetDocument, "target",
+        "epiphany.pipeline.target.v2", "EpiphanyPipelineTargetDocument";
+    Question(PipelineQuestion) => EpiphanyPipelineQuestionDocument, "question",
+        "epiphany.pipeline.question.v2", "EpiphanyPipelineQuestionDocument";
+    Ruling(PipelineRuling) => EpiphanyPipelineRulingDocument, "ruling",
+        "epiphany.pipeline.ruling.v2", "EpiphanyPipelineRulingDocument";
+    CutSpec(PipelineCutSpec) => EpiphanyPipelineCutSpecDocument, "cut_spec",
+        "epiphany.pipeline.cut_spec.v2", "EpiphanyPipelineCutSpecDocument";
+    CutReport(PipelineCutReport) => EpiphanyPipelineCutReportDocument, "cut_report",
+        "epiphany.pipeline.cut_report.v2", "EpiphanyPipelineCutReportDocument";
+    Verdict(PipelineVerdict) => EpiphanyPipelineVerdictDocument, "verdict",
+        "epiphany.pipeline.verdict.v2", "EpiphanyPipelineVerdictDocument";
+    Finding(PipelineFinding) => EpiphanyPipelineFindingDocument, "finding",
+        "epiphany.pipeline.finding.v2", "EpiphanyPipelineFindingDocument";
+    FollowUp(PipelineFollowUp) => EpiphanyPipelineFollowUpDocument, "follow_up",
+        "epiphany.pipeline.follow_up.v2", "EpiphanyPipelineFollowUpDocument";
+    Resolution(PipelineResolution) => EpiphanyPipelineResolutionDocument, "resolution",
+        "epiphany.pipeline.resolution.v2", "EpiphanyPipelineResolutionDocument";
+    Instance(PipelineInstance) => EpiphanyPipelineInstanceDocument, "instance",
+        "epiphany.pipeline.instance.v2", "EpiphanyPipelineInstanceDocument";
+    Stewardship(PipelineStewardship) => EpiphanyPipelineStewardshipDocument, "stewardship",
+        "epiphany.pipeline.stewardship.v2", "EpiphanyPipelineStewardshipDocument";
+    HandOff(PipelineHandOff) => EpiphanyPipelineHandOffDocument, "hand_off",
+        "epiphany.pipeline.hand_off.v2", "EpiphanyPipelineHandOffDocument";
+}
+
+/// Parses a full document id: the grammar read backwards. A key and an id are
+/// the same string, so this accepts exactly what `pipeline_key` derives:
+/// `<root>:<kind>:<local>`, three segments for every kind. The kind segment
+/// must equal `kind`'s name, the root is a `Slug`, and the local is `Label`s
+/// joined by `.` and bounded whole by `local_max(kind)`, so `..`, an empty part, spaces and trailing
+/// junk are all refused. Returns the root and the local; nothing is inferred
+/// from either, and no kind is read any other way.
+fn pipeline_id<'a>(
+    field: &str,
+    id: &'a str,
+    kind: PipelineKind,
+) -> Result<(&'a str, &'a str), PipelineRefusal> {
+    let mut segments = id.split(':');
+    let (Some(root), Some(name), Some(local), None) = (
+        segments.next(),
+        segments.next(),
+        segments.next(),
+        segments.next(),
+    ) else {
+        return Err(format_error(field, id));
+    };
+    if name != kind.name() {
+        return Err(format_error(field, id));
+    }
+    dotted_text(field, root)?;
+    dotted_within(field, local, local_max(kind))?;
+    Ok((root, local))
+}
+
+/// The local segment of a parent id in `campaign`, of the expected kind.
+fn parent_local<'a>(
+    field: &str,
+    id: &'a str,
+    campaign: &str,
+    kind: PipelineKind,
+) -> Result<&'a str, PipelineRefusal> {
+    let (owner, local) = pipeline_id(field, id, kind)?;
+    if owner != campaign {
+        return Err(format_error(field, id));
+    }
+    Ok(local)
+}
+
+/// The cut label inside a parent local `cut-<label>.<marker><N>`: exactly two
+/// parts, the label a `Label` and `<N>` a non-empty run of digits.
+fn parent_cut<'a>(field: &str, local: &'a str, marker: char) -> Result<&'a str, PipelineRefusal> {
+    let invalid = || format_error(field, local);
+    let mut parts = local.split('.');
+    let (Some(head), Some(suffix), None) = (parts.next(), parts.next(), parts.next()) else {
+        return Err(invalid());
+    };
+    let cut = head.strip_prefix("cut-").ok_or_else(invalid)?;
+    label_text(field, cut)?;
+    let digits = suffix.strip_prefix(marker).ok_or_else(invalid)?;
+    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(invalid());
+    }
+    Ok(cut)
+}
+
+/// A `Slug` or an `OrgRepo` entering a local, escaped to one label. `/` is not
+/// a `Label` byte, so it cannot survive into a key, and neither may `.`: no
+/// local part carries the separator, or the boundary before it would have two
+/// readings. A dotted slug and a dotted repo name are both ordinary, so both
+/// bytes are escaped rather than refused. The escape has to be injective or two
+/// values claim one key: replacing `/` with `_` alone is not, since
+/// `GameCult_Epiphany/thing` and `GameCult/Epiphany_thing` both give
+/// `GameCult_Epiphany_thing`. So `_` is escaped as well, and every code is two
+/// bytes starting with `_`: `_` becomes `__`, `/` becomes `_-`, and `.` becomes
+/// `_d`. Every other byte is passed through and is never `_`, so a reader going
+/// left to right takes each `_` together with the byte after it and never has a
+/// choice to make; the encoding is therefore reversible, and distinct values
+/// give distinct segments. The caller validates the value as its own type first
+/// and checks the result against the local's rules, which is where an over-long
+/// or otherwise unlabelled value is refused.
+fn key_segment(value: &str) -> String {
+    value.replace('_', "__").replace('/', "_-").replace('.', "_d")
+}
+
+/// The local of a root. A campaign's or an instance's identity is entirely its
+/// root segment, so its local carries none; a reader never consults it.
+const ROOT_LOCAL: &str = "self";
+
+/// The bound on a composed local of every kind but a resolution, whole, in
+/// UTF-8 bytes. Every stored subject key is within it.
+const SUBJECT_LOCAL_MAX: usize = 64;
+
+/// The longest kind name a resolution can name as its subject (`stewardship`),
+/// checked against `PipelineKind::ALL` by a test.
+const LONGEST_KIND_NAME: usize = "stewardship".len();
+
+/// A `.n<sequence>` part at `u32::MAX`.
+const SEQUENCE_PART_MAX: usize = ".n".len() + "4294967295".len();
+
+/// The bound on a resolution's local: a depth-two chain over a maximal
+/// subject, `resolution.<kind>.<subject local>.n<seq>.n<seq>`, at `u32::MAX`
+/// sequences. Depth is capped at two by admission (Q19), and this bound admits
+/// exactly that for every subject, so no subject is born unresolvable. Derived
+/// from `SUBJECT_LOCAL_MAX` and the kind names, never written as a number.
+const RESOLUTION_LOCAL_MAX: usize = "resolution.".len() + LONGEST_KIND_NAME + ".".len() + SUBJECT_LOCAL_MAX + 2 * SEQUENCE_PART_MAX;
+
+// `<root>:<kind>:<local>` must fit a `Short` wherever an id is cited.
+const _: () = assert!(64 + ":".len() + LONGEST_KIND_NAME + ":".len() + RESOLUTION_LOCAL_MAX <= 200);
+
+/// The bound on a kind's composed local, chosen here and nowhere else.
+fn local_max(kind: PipelineKind) -> usize {
+    match kind {
+        PipelineKind::Resolution => RESOLUTION_LOCAL_MAX,
+        _ => SUBJECT_LOCAL_MAX,
+    }
+}
+
+/// The schema epoch every pipeline store is written at, owned here with the
+/// schemas it names. Evolution is additive and keeps it: a new named field
+/// with a serde default, or a widened `PipelineKind`, since each reader ships
+/// with the variants it knows and refuses an unknown kind on the kind, not on
+/// the epoch. A breaking change bumps it, so that a store written at the old
+/// one can be refused by whoever opens it; this crate owns no store and
+/// refuses none.
+pub const PIPELINE_SCHEMA_EPOCH: &str = "epiphany.pipeline.epoch.v2";
+
+/// Composes and validates a local: every part is a `Label`, and the join is
+/// bounded whole by `local_max(kind)`. Both rules live here because this is the only way a local is
+/// built; `pipeline_key` has no other path to a key string. Parts are a slice,
+/// not a builder, so an arm's arity is written at its call site.
+fn local(field: &str, kind: PipelineKind, parts: &[&str]) -> Result<String, PipelineRefusal> {
+    for part in parts {
+        label_text(field, part)?;
+    }
+    let joined = parts.join(".");
+    if joined.len() > local_max(kind) {
+        return Err(format_error(field, &joined));
+    }
+    Ok(joined)
+}
+
+/// Derives a document's identity key (D1, "Keys: identity, not convenience").
+/// Thirteen arms, one exit: every arm names its root and composes its local
+/// through `local`, and the key is formatted here and nowhere else.
+pub fn pipeline_key(document: &PipelineDocument) -> Result<String, PipelineRefusal> {
+    use PipelineDocument as D;
+    let document_kind = document.kind();
+    let kind = document_kind.name();
+    let key_field = format!("{kind}.key");
+    let campaign_field = format!("{kind}.campaign");
+    let (root_field, root, composed) = match document {
+        D::Campaign(value) => ("campaign.slug", value.slug.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
+        D::Instance(value) => ("instance.instance", value.instance.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
+        // A resolution is keyed inside its subject's root, with the subject's
+        // kind and local as its own local and its per-subject sequence last, so
+        // the subject's resolutions and only they share the prefix
+        // `<root>:resolution:<kind>.<local>.n`. A resolution's own key is an
+        // ordinary id, so it composes as a subject like any other; each nesting
+        // prepends `resolution.` (11 bytes) and appends `.n<s>` (3 bytes for
+        // one digit). Depth is capped at two by admission (Q19), and
+        // `RESOLUTION_LOCAL_MAX` admits exactly a depth-two chain over a
+        // maximal subject, so every subject resolves and its resolution can be
+        // withdrawn.
+        D::Resolution(value) => {
+            let field = "resolution.subject.id";
+            let (subject_root, subject_local) = pipeline_id(field, &value.subject.id.0, value.subject.kind)?;
+            let sequence = format!("n{}", value.sequence);
+            let parts = std::iter::once(value.subject.kind.name()).chain(subject_local.split('.')).chain(std::iter::once(sequence.as_str())).collect::<Vec<_>>();
+            (field, subject_root, local(&key_field, document_kind, &parts)?)
+        }
+        // Stewardship and hand-off hang off an instance rather than a campaign.
+        // The root is the whole difference; the key shape is the same.
+        D::Stewardship(value) => {
+            org_repo_text("stewardship.repo", &value.repo.0)?;
+            let sequence = format!("n{}", value.sequence);
+            (
+                "stewardship.instance",
+                value.instance.0.as_str(),
+                local(&key_field, document_kind, &[&key_segment(&value.repo.identity()), &sequence])?,
+            )
+        }
+        D::HandOff(value) => {
+            dotted_text("hand_off.to_instance", &value.to_instance.0)?;
+            org_repo_text("hand_off.repo", &value.repo.0)?;
+            value.handed_on.validate("hand_off.handed_on")?;
+            (
+                "hand_off.from_instance",
+                value.from_instance.0.as_str(),
+                local(
+                    &key_field,
+                    document_kind,
+                    &[&key_segment(&value.to_instance.0), &key_segment(&value.repo.identity()), &value.handed_on.0],
+                )?,
+            )
+        }
+        D::Target(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&format!("r{}", value.revision)])?),
+        D::Question(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::Ruling(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::FollowUp(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::CutSpec(value) => (
+            campaign_field.as_str(),
+            value.campaign.0.as_str(),
+            local(&key_field, document_kind, &[&format!("cut-{}", value.cut.0), &format!("r{}", value.revision)])?,
+        ),
+        D::CutReport(value) => {
+            let spec = parent_local("cut_report.cut_spec", &value.cut_spec.0, &value.campaign.0, PipelineKind::CutSpec)?;
+            let cut = parent_cut("cut_report.cut_spec", spec, 'r')?;
+            (
+                campaign_field.as_str(),
+                value.campaign.0.as_str(),
+                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("h{}", value.attempt)])?,
+            )
+        }
+        D::Verdict(value) => {
+            let report = parent_local("verdict.cut_report", &value.cut_report.0, &value.campaign.0, PipelineKind::CutReport)?;
+            let cut = parent_cut("verdict.cut_report", report, 'h')?;
+            (
+                campaign_field.as_str(),
+                value.campaign.0.as_str(),
+                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("s{}", value.pass)])?,
+            )
+        }
+        D::Finding(value) => {
+            let verdict = parent_local("finding.verdict", &value.verdict.0, &value.campaign.0, PipelineKind::Verdict)?;
+            parent_cut("finding.verdict", verdict, 's')?;
+            let parts = verdict.split('.').chain(std::iter::once(value.label.0.as_str())).collect::<Vec<_>>();
+            (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &parts)?)
+        }
+    };
+    dotted_text(root_field, root)?;
+    Ok(format!("{root}:{kind}:{composed}"))
+}
+
+/// Bounds, formats, then key recomputation, on the envelope that will be
+/// stored, whoever prepared it. It is the whole of what this crate checks
+/// before a write; per-kind and cross-document rules are not decided here and
+/// belong to the admission path of the organ that will admit these documents,
+/// which is expected to call this first rather than re-derive it.
+pub fn validate_pipeline_write_envelope(envelope: &CultCacheEnvelope) -> Result<(), PipelineRefusal> {
+    let document = PipelineDocument::decode(envelope)?;
+    document.validate()?;
+    let expected = pipeline_key(&document)?;
+    if envelope.key != expected {
+        return Err(PipelineRefusal::InvalidIdentity {
+            kind: document.kind(),
+            key: envelope.key.clone(),
+            expected,
+        });
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::BTreeSet;
+    use std::path::Path;
+
+    const CAMPAIGN: &str = "eureka-state";
+    const INSTANCE: &str = "yggdrasil";
+
+    fn s(value: &str) -> Short {
+        value.into()
+    }
+
+    fn t(value: &str) -> Title {
+        value.into()
+    }
+
+    fn l(value: &str) -> Label {
+        value.into()
+    }
+
+    fn slug(value: &str) -> Slug {
+        value.into()
+    }
+
+    fn id(kind: &str, local: &str) -> Short {
+        Short(format!("{CAMPAIGN}:{kind}:{local}"))
+    }
+
+    fn sha() -> Sha {
+        Sha("5f98228d".into())
+    }
+
+    fn date() -> Date {
+        Date("2026-09-15".into())
+    }
+
+    fn range() -> CommitRange {
+        CommitRange { base: sha(), head: sha() }
+    }
+
+    fn location() -> CodeLocation {
+        CodeLocation { path: s("epiphany-pipeline/src/lib.rs"), line: 1, end_line: Some(9) }
+    }
+
+    fn evidence() -> Evidence {
+        Evidence { kind: EvidenceKind::Test, locator: "cargo test".into(), result: "ok".into() }
+    }
+
+    fn doc_ref() -> DocRef {
+        DocRef { path: s("notes/eureka-pipeline-state-target.md"), start_line: 1, end_line: 9, commit: sha() }
+    }
+
+    /// One valid document of every kind, with its expected key.
+    fn samples() -> Vec<(PipelineDocument, String)> {
+        use PipelineDocument as D;
+        let repo = || OrgRepo("GameCult/Epiphany".into());
+        let branch = || s("codex/eureka-pipeline-state");
+        vec![
+            (D::Campaign(PipelineCampaign {
+                slug: slug(CAMPAIGN), title: t("Eureka pipeline state"), repos: vec![repo()],
+                working_branch: branch(), target_doc: doc_ref(),
+            }), format!("{CAMPAIGN}:campaign:self")),
+            (D::Target(PipelineTarget {
+                campaign: slug(CAMPAIGN), revision: 2,
+                invariants: vec![TargetInvariant { label: l("mind-admits"), statement: "Only admission writes.".into() }],
+                not_in_scope: vec!["Eve browsing".into()], canonical_implementations: vec!["CultLib".into()], doc: doc_ref(),
+            }), format!("{CAMPAIGN}:target:r2")),
+            (D::Question(PipelineQuestion {
+                campaign: slug(CAMPAIGN), label: l("Q1"), title: t("Who owns the state?"), question: "Who owns the state?".into(),
+                options: vec![
+                    QuestionOption { label: l("A"), text: "an instance".into() },
+                    QuestionOption { label: l("B"), text: "a repo".into() },
+                ],
+                recommended: l("A"), depends: vec!["Cut 3a".into()],
+                raised_in: Some(PipelineRef { kind: PipelineKind::CutSpec, id: id("cut_spec", "cut-3a.r1") }),
+                asked_on: date(),
+            }), format!("{CAMPAIGN}:question:Q1")),
+            (D::Ruling(PipelineRuling {
+                campaign: slug(CAMPAIGN), label: l("R8"), title: t("An instance owns its mind"), answers: Some(id("question", "Q1")), choice: Some(l("A")),
+                ruling: "An instance owns its mind.".into(), operator_quote: Some("all recommendations, go ahead".into()),
+                ruled_on: date(),
+                precedents: vec![ForeignRef {
+                    repo: OrgRepo("GameCult/Aetheria".into()), commit: FullSha("a".repeat(40)), kind: PipelineKind::Ruling,
+                    id: s("cultcache:ruling:R1"), payload_sha256: Sha256Hex("b".repeat(64)),
+                }],
+                authority: RulingAuthority::Operator,
+            }), format!("{CAMPAIGN}:ruling:R8")),
+            (D::CutSpec(PipelineCutSpec {
+                campaign: slug(CAMPAIGN), cut: l("3a"), revision: 1, title: t("Pipeline documents"), repo: repo(),
+                branch: branch(), base: sha(), depends_on: vec![s("2")], first: vec!["Read the spec.".into()],
+                deletes: vec![CutDelete { path: s("old.rs"), lines: 3, note: "dead".into() }],
+                keeps_moves: vec!["commit owner".into()], adds: vec!["pipeline_documents.rs".into()],
+                file_changes: vec![FileChange { location: location(), change: "add".into() }],
+                authority_map: Some(AuthorityMap {
+                    owner: "core".into(), inputs: vec!["typed documents".into()], outputs: vec!["envelopes".into()],
+                    derived_state: vec!["derived keys".into()], forbidden_writers: vec!["MCP".into()],
+                    shared_paths: vec!["admission".into()], deletion_line: "n/a".into(),
+                }),
+                verification: CutVerification {
+                    builds: vec!["cargo check".into()],
+                    tests: vec![VerificationTest { name: s("keys"), pins: "one derived key".into() }],
+                    negative: vec![NegativeCheck { pattern: s("Vec<u8>"), scope: "documents".into() }],
+                    operator: vec!["none".into()],
+                },
+                // Cut 3a's real numbers, and in this order: the tripwire test
+                // reads them back, so a transposition is a failure, not a typo.
+                estimate: StructuralDelta {
+                    lines_added: 900, lines_removed: 0,
+                    dependencies_added: vec![s("schemars")], dependencies_removed: vec![],
+                    formats_added: vec![s("epiphany.pipeline.*.v1")], formats_removed: vec![],
+                    targets_added: vec![], targets_removed: vec![],
+                },
+                rulings: vec![id("ruling", "R8")], questions: vec![id("question", "Q1")],
+            }), format!("{CAMPAIGN}:cut_spec:cut-3a.r1")),
+            (D::CutReport(PipelineCutReport {
+                campaign: slug(CAMPAIGN), cut_spec: id("cut_spec", "cut-3a.r1"), attempt: 1, repo: repo(), branch: branch(),
+                commits: vec![ReportCommit { sha: sha(), subject: "Add the pipeline documents".into(), builds: true }],
+                range: range(), verification: vec![evidence()],
+                mutations: vec![MutationRecord {
+                    // `.into()` on both, not `l()` and `sha()`: the type-level
+                    // mutations (M19, M20) widen these fields to `Short`, and
+                    // a sample spelled with the narrow constructors would stop
+                    // compiling instead of letting the forgery through.
+                    label: "M1".into(), rule: "key derivation".into(), location: location(),
+                    before: "parent_cut(field, spec, 'r')?".into(), after: "spec".into(), commit: "5f98228d".into(),
+                    failed_as_expected: true,
+                }],
+                deviations: vec![Deviation { what: "names".into(), why: "glob exports".into() }],
+                forks: vec![id("question", "Q1")],
+                structural_delta: StructuralDelta {
+                    lines_added: 900, lines_removed: 0, dependencies_added: vec![s("schemars")],
+                    dependencies_removed: vec![], formats_added: vec![s("epiphany.pipeline.*.v1")],
+                    formats_removed: vec![], targets_added: vec![], targets_removed: vec![],
+                },
+                landed_names: vec![LandedName { name: s("PipelineDocument"), path: s("epiphany-pipeline/src/lib.rs") }],
+                undone: vec!["admission".into()],
+                promises: vec![Promise { label: l("P1"), text: "One derived key per document.".into() }],
+            }), format!("{CAMPAIGN}:cut_report:cut-3a.h1")),
+            (D::Verdict(PipelineVerdict {
+                campaign: slug(CAMPAIGN), cut_report: id("cut_report", "cut-3a.h1"), pass: 2, range: range(),
+                claims: vec![VerdictClaim {
+                    claim: "A composed key has one source.".into(), outcome: ClaimOutcome::Falsified,
+                    evidence: vec![evidence()], findings: vec![id("finding", "cut-3a.s2.F4")],
+                    promise: Some(l("P1")), mutations: vec![l("M1")],
+                }],
+            }), format!("{CAMPAIGN}:verdict:cut-3a.s2")),
+            (D::Finding(PipelineFinding {
+                campaign: slug(CAMPAIGN), verdict: id("verdict", "cut-3a.s2"), label: l("F4"), range: range(),
+                confidence: FindingConfidence::Confirmed, severity: FindingSeverity::High,
+                claim: "A dotted label composes two keys.".into(), invariants: vec![l("mind-admits")],
+                locations: vec![location()], failure_scenario: "Two documents claim one key.".into(),
+                evidence: vec![evidence()], precedents: vec![], origin: FindingOrigin::Introduced,
+            }), format!("{CAMPAIGN}:finding:cut-3a.s2.F4")),
+            (D::FollowUp(PipelineFollowUp {
+                campaign: slug(CAMPAIGN), label: l("FU-4"),
+                source: PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") },
+                repo: repo(), locations: vec![location()], item: "Per-kind admission rules.".into(),
+                why_it_can_wait: "The organ owns admission.".into(), owner: s("Hands"),
+            }), format!("{CAMPAIGN}:follow_up:FU-4")),
+            (D::Resolution(PipelineResolution {
+                subject: PipelineRef { kind: PipelineKind::Question, id: id("question", "Q1") }, sequence: 1,
+                outcome: ResolutionOutcome::Answered { by: PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") } },
+                rationale: "Ruled A.".into(), resolved_on: date(),
+            }), format!("{CAMPAIGN}:resolution:question.Q1.n1")),
+            // The mind's own three kinds. They are appended rather than
+            // inserted because the helpers below index this list by position.
+            (D::Instance(PipelineInstance {
+                instance: slug(INSTANCE), display_name: s("Yggdrasil mind"), created_at: date(),
+                host: s("yggdrasil"),
+            }), format!("{INSTANCE}:instance:self")),
+            (D::Stewardship(PipelineStewardship {
+                instance: slug(INSTANCE), repo: repo(), sequence: 1, assigned_on: date(),
+                note: "The Eureka campaign repo.".into(),
+            }), format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")),
+            (D::HandOff(PipelineHandOff {
+                from_instance: slug(INSTANCE), to_instance: slug("thought-cage"), repo: repo(),
+                documents: vec![s(CAMPAIGN), id("ruling", "R8")],
+                reason: "The workstation mind takes the campaign.".into(), handed_on: date(),
+            }), format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.{}", date().0)),
+        ]
+    }
+
+    fn instance_sample() -> PipelineInstance {
+        let PipelineDocument::Instance(instance) = samples().remove(10).0 else { unreachable!() };
+        instance
+    }
+
+    fn stewardship_sample() -> PipelineStewardship {
+        let PipelineDocument::Stewardship(stewardship) = samples().remove(11).0 else { unreachable!() };
+        stewardship
+    }
+
+    fn hand_off_sample() -> PipelineHandOff {
+        let PipelineDocument::HandOff(hand_off) = samples().remove(12).0 else { unreachable!() };
+        hand_off
+    }
+
+    fn campaign_sample() -> PipelineDocument {
+        samples().remove(0).0
+    }
+
+    fn question_sample() -> PipelineQuestion {
+        let PipelineDocument::Question(question) = samples().remove(2).0 else { unreachable!() };
+        question
+    }
+
+    fn ruling_sample() -> PipelineRuling {
+        let PipelineDocument::Ruling(ruling) = samples().remove(3).0 else { unreachable!() };
+        ruling
+    }
+
+    fn report_sample() -> PipelineCutReport {
+        let PipelineDocument::CutReport(report) = samples().remove(5).0 else { unreachable!() };
+        report
+    }
+
+    fn verdict_sample() -> PipelineVerdict {
+        let PipelineDocument::Verdict(verdict) = samples().remove(6).0 else { unreachable!() };
+        verdict
+    }
+
+    fn finding_sample() -> PipelineFinding {
+        let PipelineDocument::Finding(finding) = samples().remove(7).0 else { unreachable!() };
+        finding
+    }
+
+    fn resolution_sample() -> PipelineResolution {
+        let PipelineDocument::Resolution(resolution) = samples().remove(9).0 else { unreachable!() };
+        resolution
+    }
+
+    /// The live registrar plus the foreign stand-in, which only the tests
+    /// register.
+    fn schema_cache() -> Result<CultCache> {
+        let mut cache = CultCache::new();
+        register_pipeline_document_types(&mut cache)?;
+        cache.register_entry_type::<ForeignDocument>()?;
+        Ok(cache)
+    }
+
+    #[test]
+    fn every_pipeline_kind_round_trips_through_named_slot_zero() -> Result<()> {
+        let cache = schema_cache()?;
+        let samples = samples();
+        let kinds = samples.iter().map(|(document, _)| document.kind()).collect::<BTreeSet<_>>();
+        assert_eq!(kinds.len(), PipelineKind::ALL.len(), "every kind has a sample");
+        for (document, _) in samples {
+            document.validate()?;
+            let envelope = document.prepare(&cache)?;
+            assert_eq!(envelope.r#type, document.kind().type_id());
+            assert_eq!(envelope.payload[0], 0x91, "{:?} payload is a one-element array", document.kind());
+            assert!(
+                matches!(envelope.payload[1], 0x80..=0x8f | 0xde | 0xdf),
+                "{:?} slot 0 is a named map",
+                document.kind()
+            );
+            assert_eq!(PipelineDocument::decode(&envelope)?, document);
+            Ok::<_, anyhow::Error>(())?;
+        }
+        Ok(())
+    }
+
+    /// Soul F2: a decode is type-matched in both directions. The round-trip
+    /// test above pins the positive match; this pins the refusal, so an
+    /// envelope belonging to another kind can never be decoded as whichever
+    /// pipeline kind happens to parse its payload. The commit receipt is the
+    /// sharp case: a mind's store may legitimately hold one, and it is still
+    /// not a document; `ForeignDocument` stands in for it here.
+    #[test]
+    fn decode_refuses_an_envelope_of_a_foreign_type() -> Result<()> {
+        let cache = schema_cache()?;
+        let foreign = <ForeignDocument as DatabaseEntry>::TYPE;
+        assert!(!foreign.starts_with("epiphany.pipeline."), "{foreign} is a foreign type id");
+        let mut envelope = campaign_sample().prepare(&cache)?;
+        envelope.r#type = foreign.into();
+        assert_eq!(
+            PipelineDocument::decode(&envelope),
+            Err(PipelineRefusal::ForeignStore { r#type: foreign.into() })
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn bounds_refuse_in_utf8_bytes() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.title = Title("é".repeat(100));
+        assert_eq!(PipelineDocument::Campaign(campaign.clone()).validate(), Ok(()));
+        campaign.title = Title(format!("{}a", "é".repeat(100)));
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 })
+        );
+        campaign.title = t("ok");
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 9];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign).validate(),
+            Err(PipelineRefusal::FieldBound { field: "campaign.repos".into(), limit: 8, actual: 9 })
+        );
+    }
+
+    /// RS-L closing fix 4: `campaign.repos` refuses two entries naming one
+    /// repository by identity, not only by raw spelling, so `GameCult/Epiphany`
+    /// and `gamecult/epiphany` in one list refuse exactly as the same spelling
+    /// twice would. Two genuinely distinct repos still validate.
+    #[test]
+    fn campaign_repos_refuse_duplicates_by_identity() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("gamecult/epiphany".into())];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::DuplicateRepo {
+                field: "campaign.repos".into(),
+                repo: "gamecult/epiphany".into(),
+            })
+        );
+
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 2];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::DuplicateRepo {
+                field: "campaign.repos".into(),
+                repo: "GameCult/Epiphany".into(),
+            })
+        );
+
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("GameCult/Aetheria".into())];
+        assert_eq!(PipelineDocument::Campaign(campaign).validate(), Ok(()));
+    }
+
+    #[test]
+    fn repo_fields_must_be_org_slash_repo() {
+        let mut report = report_sample();
+        report.repo = OrgRepo("Epiphany".into());
+        assert_eq!(
+            PipelineDocument::CutReport(report).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "cut_report.repo".into(), value: "Epiphany".into() })
+        );
+        let PipelineDocument::CutSpec(mut spec) = samples().remove(4).0 else { unreachable!() };
+        spec.repo = OrgRepo("GameCult/Epiphany/extra".into());
+        assert!(matches!(
+            PipelineDocument::CutSpec(spec).validate(),
+            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_spec.repo"
+        ));
+        let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
+        follow_up.repo = OrgRepo("/Epiphany".into());
+        assert!(matches!(
+            PipelineDocument::FollowUp(follow_up).validate(),
+            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "follow_up.repo"
+        ));
+    }
+
+    #[test]
+    fn keys_are_derived_and_mismatch_refuses() -> Result<()> {
+        let cache = schema_cache()?;
+        for (document, key) in samples() {
+            assert_eq!(pipeline_key(&document), Ok(key.clone()));
+            let mut envelope = document.prepare(&cache)?;
+            envelope.key = format!("{key}-forged");
+            assert_eq!(
+                validate_pipeline_write_envelope(&envelope),
+                Err(PipelineRefusal::InvalidIdentity { kind: document.kind(), key: envelope.key, expected: key })
+            );
+        }
+        let mut resolution = resolution_sample();
+        let answered = pipeline_key(&PipelineDocument::Resolution(resolution.clone()));
+        resolution.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(resolution)),
+            answered,
+            "a subject has one resolution key whatever the outcome"
+        );
+        Ok(())
+    }
+
+    /// F2, and Soul's second pass: a composed local segments one way only. The
+    /// rule -- no local part carries the separator -- is pinned on the composer
+    /// in `no_local_part_carries_the_separator`; the pairs below are the ones
+    /// Soul measured through the documents, and each is a pair only because the
+    /// rule holds.
+    #[test]
+    fn composed_keys_cannot_collide() {
+        let key = |document: PipelineDocument| pipeline_key(&document);
+
+        // Soul's hand-off pair. A dotted slug is ordinary on the receiver side
+        // and a dotted repo name (the part after the mandatory `/`, GitHub's
+        // grammar owns no dot on the owner side) is ordinary on the repo side,
+        // so both are escaped: left unescaped these two both key to
+        // `yggdrasil:hand_off:thought-cage.GameCult.Epiphany_-thing.2026-09-15`.
+        let handed = |to: &str, repo: &str| {
+            let mut hand_off = hand_off_sample();
+            hand_off.to_instance = slug(to);
+            hand_off.repo = OrgRepo(repo.into());
+            key(PipelineDocument::HandOff(hand_off))
+        };
+        let dotted_receiver = handed("thought-cage.GameCult", "Epiphany/thing");
+        let dotted_repo = handed("thought-cage", "GameCult/Epiphany.thing");
+        assert_eq!(
+            dotted_receiver,
+            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.epiphany_-thing.2026-09-15"))
+        );
+        assert_eq!(
+            dotted_repo,
+            Ok(format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany_dthing.2026-09-15"))
+        );
+        assert_ne!(dotted_receiver, dotted_repo, "a dotted repo and a dotted receiver cannot claim one key");
+
+        let mut wide_label = finding_sample();
+        wide_label.label = l("F1.G");
+        assert!(
+            matches!(key(PipelineDocument::Finding(wide_label)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a finding label carrying a dot is refused, not silently composed"
+        );
+        let mut deep_verdict = finding_sample();
+        deep_verdict.verdict = id("verdict", "cut-3a.s1.F1");
+        deep_verdict.label = l("G");
+        assert!(
+            matches!(key(PipelineDocument::Finding(deep_verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a verdict local that is not cut-<label>.s<N> is refused"
+        );
+        let mut plain = finding_sample();
+        plain.verdict = id("verdict", "cut-3a.s1");
+        plain.label = l("F1");
+        assert_eq!(key(PipelineDocument::Finding(plain)), Ok(format!("{CAMPAIGN}:finding:cut-3a.s1.F1")));
+
+        let mut deep_spec = report_sample();
+        deep_spec.cut_spec = id("cut_spec", "cut-3a.h1.r1");
+        deep_spec.attempt = 2;
+        assert!(
+            matches!(key(PipelineDocument::CutReport(deep_spec)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a cut label carrying a dot is refused, so cut-3a.h1.h2 has one source"
+        );
+        let mut attempt_two = report_sample();
+        attempt_two.attempt = 2;
+        assert_eq!(key(PipelineDocument::CutReport(attempt_two)), Ok(format!("{CAMPAIGN}:cut_report:cut-3a.h2")));
+    }
+
+    /// F3: every parent id is parsed strictly. These are the bad parents Soul
+    /// found accepted, plus the wrong-kind and marker rules that mutations S1
+    /// and S3 remove.
+    #[test]
+    fn parent_ids_are_parsed_strictly() {
+        let refused = |parent: &str| {
+            let mut report = report_sample();
+            report.cut_spec = Short(parent.into());
+            let key = pipeline_key(&PipelineDocument::CutReport(report));
+            assert!(
+                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_report.cut_spec"),
+                "parent {parent:?} must be refused, got {key:?}"
+            );
+        };
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:junk"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.rX"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-..r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-.r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1 "));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r"));
+        refused(&format!("{CAMPAIGN}:cut_report:cut-3a.h1"));
+        // Right kind and a well-formed number, but the marker belongs to
+        // another kind: the marker rule is pinned on its own.
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.h1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.s1"));
+        // A well-formed number with no marker at all. Only the marker rule
+        // refuses this one: the digits rule is satisfied either way.
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.1"));
+        refused(&format!("{CAMPAIGN}:CUT_SPEC:cut-3a.r1"));
+        refused(&format!("EUREKA-STATE:cut_spec:cut-3a.r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:"));
+        refused(&format!("{CAMPAIGN}::cut-3a.r1"));
+        refused("cut-3a.r1");
+        let mut other_campaign = report_sample();
+        other_campaign.campaign = slug("other-campaign");
+        assert!(
+            matches!(
+                pipeline_key(&PipelineDocument::CutReport(other_campaign)),
+                Err(PipelineRefusal::InvalidFormat { .. })
+            ),
+            "a parent in another campaign is refused"
+        );
+        let mut verdict = verdict_sample();
+        verdict.cut_report = id("cut_report", "cut-3a.r1");
+        assert!(
+            matches!(pipeline_key(&PipelineDocument::Verdict(verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a verdict's parent must carry the report marker, not the spec marker"
+        );
+    }
+
+    /// F4: a resolution's subject id is a full id of the declared kind.
+    #[test]
+    fn resolution_subject_is_a_full_id_of_its_kind() {
+        let refused = |kind: PipelineKind, subject: &str| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            let document = PipelineDocument::Resolution(resolution);
+            assert!(
+                matches!(document.validate(), Err(PipelineRefusal::InvalidFormat { .. })),
+                "subject {subject:?} must fail validation"
+            );
+            assert!(
+                matches!(pipeline_key(&document), Err(PipelineRefusal::InvalidFormat { .. })),
+                "subject {subject:?} must not compose a key"
+            );
+        };
+        refused(PipelineKind::Question, "");
+        refused(PipelineKind::Question, "not an id: spaces and : colons");
+        refused(PipelineKind::Question, "eureka-state:question:1１");
+        refused(PipelineKind::Question, &format!("{CAMPAIGN}:ruling:R8"));
+        refused(PipelineKind::Ruling, &format!("{CAMPAIGN}:question:Q1"));
+        refused(PipelineKind::Question, &format!("{CAMPAIGN}:question:.."));
+
+        let mut valid = resolution_sample();
+        valid.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(valid)),
+            Ok(format!("{CAMPAIGN}:resolution:ruling.R8.n1"))
+        );
+    }
+
+    /// Soul G2: a resolution is named by the key it has, and a `PipelineRef`
+    /// of kind `Resolution` accepts exactly that id. `PipelineRef` takes any
+    /// kind, so this is reachable; a follow-up sourced from a resolution is the
+    /// live path. The grammar admits `<campaign>:resolution:R8` too: it is
+    /// well-formed, and no resolution derives it, but whether a document with an
+    /// id exists is admission's rule, not the grammar's, so the reader does not
+    /// refuse it and this test does not ask it to.
+    #[test]
+    fn a_resolution_is_named_by_the_key_it_has() {
+        let sourced = |id: &str| {
+            let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
+            follow_up.source = PipelineRef { kind: PipelineKind::Resolution, id: Short(id.into()) };
+            PipelineDocument::FollowUp(follow_up).validate()
+        };
+        let key = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
+        assert_eq!(key, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
+        assert_eq!(sourced(&key), Ok(()), "a resolution is named by the key it has");
+        assert_eq!(sourced(&format!("{CAMPAIGN}:resolution:R8")), Ok(()), "well-formed grammar is not the reader's to refuse");
+
+        for refused in [
+            // The prefix shape the writer used to emit. No resolution carries it.
+            format!("resolution:{CAMPAIGN}:question:Q1"),
+            format!("{CAMPAIGN}:resolution:{CAMPAIGN}:question:Q1"),
+            // No local, a subject local with an empty part, trailing junk, and a
+            // kind segment that is not `resolution`.
+            format!("{CAMPAIGN}:resolution:"),
+            format!("{CAMPAIGN}:resolution:question..Q1"),
+            format!("{CAMPAIGN}:resolution:question.Q1:junk"),
+            format!("{CAMPAIGN}:question:Q1"),
+        ] {
+            assert!(
+                matches!(sourced(&refused), Err(PipelineRefusal::InvalidFormat { .. })),
+                "{refused:?} is not an id any resolution has"
+            );
+        }
+
+        // A root subject reads back too: a resolution of a campaign carries the
+        // campaign's kind and its `self` local.
+        let mut of_campaign = resolution_sample();
+        of_campaign.subject = PipelineRef { kind: PipelineKind::Campaign, id: Short(format!("{CAMPAIGN}:campaign:self")) };
+        let root_key = pipeline_key(&PipelineDocument::Resolution(of_campaign)).expect("a root subject keys");
+        assert_eq!(root_key, format!("{CAMPAIGN}:resolution:campaign.self.n1"));
+        assert_eq!(sourced(&root_key), Ok(()));
+    }
+
+    /// The three kinds a mind is keyed by. The samples above already round-trip
+    /// every kind; this pins the shapes D2 gives these three specifically: an
+    /// instance is a root keyed by its own slug, and the other two hang off an
+    /// instance rather than a campaign, so neither borrows the campaign tail.
+    #[test]
+    fn instance_stewardship_and_hand_off_round_trip() -> Result<()> {
+        let cache = schema_cache()?;
+        let instance = PipelineDocument::Instance(instance_sample());
+        assert_eq!(pipeline_key(&instance), Ok(format!("{INSTANCE}:instance:self")));
+        for document in [
+            instance,
+            PipelineDocument::Stewardship(stewardship_sample()),
+            PipelineDocument::HandOff(hand_off_sample()),
+        ] {
+            document.validate()?;
+            let envelope = document.prepare(&cache)?;
+            assert_eq!(PipelineDocument::decode(&envelope)?, document);
+            let key = pipeline_key(&document)?;
+            assert!(
+                !key.starts_with(&format!("{CAMPAIGN}:")),
+                "{:?} is keyed by its instance, not by a campaign: {key}",
+                document.kind()
+            );
+            validate_pipeline_write_envelope(&envelope)?;
+        }
+        // A bounded list is still bounded: `documents` carries a maximum, as
+        // every `Vec` field must.
+        let mut wide = hand_off_sample();
+        wide.documents = vec![s("x"); 257];
+        assert_eq!(
+            PipelineDocument::HandOff(wide).validate(),
+            Err(PipelineRefusal::FieldBound { field: "hand_off.documents".into(), limit: 256, actual: 257 })
+        );
+        Ok(())
+    }
+
+    /// Soul F3: a key and an id are the same string, so every kind's key reads
+    /// back as an id of that kind. The kinds a mind is keyed by were added to
+    /// the key writer and left out of the id reader, and nothing noticed,
+    /// because the key tests assert strings and never read one back: an
+    /// instance keys to its slug and then fails to parse as an instance id, so
+    /// no `PipelineRef` and no resolution could ever name one. Every kind now
+    /// reads back with no kind excused, a resolution included, and a root kind
+    /// read as the other root kind is refused: the reader checks the kind
+    /// segment for the roots exactly as for every other kind.
+    #[test]
+    fn keys_read_back_as_ids_of_their_kind() -> Result<()> {
+        for (document, expected) in samples() {
+            let kind = document.kind();
+            let key = pipeline_key(&document)?;
+            assert_eq!(key, expected, "{kind:?} keys to its sample's key");
+            assert_eq!(
+                pipeline_id("read_back", &key, kind).map(|_| ()),
+                Ok(()),
+                "{kind:?} key {key} does not read back as an id of its kind"
+            );
+        }
+
+        let campaign_key = pipeline_key(&campaign_sample())?;
+        let instance_key = pipeline_key(&PipelineDocument::Instance(instance_sample()))?;
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
+            Ok((INSTANCE, ROOT_LOCAL)),
+            "an instance key reads back as an instance"
+        );
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Campaign),
+            Err(format_error("read_back", &instance_key)),
+            "an instance key is not a campaign id"
+        );
+        assert_eq!(
+            pipeline_id("read_back", &campaign_key, PipelineKind::Instance),
+            Err(format_error("read_back", &campaign_key)),
+            "a campaign key is not an instance id"
+        );
+
+        // Soul X1 and X11: the reader's root and local are each `dotted_text`
+        // whole, so a trailing dot on either is refused by the reader itself,
+        // not only by the writer that never composes one. A leading dot and
+        // an empty part are the same rule on the local.
+        for malformed in ["c.:target:x", "c:target:x.", "c:target:.x", "c:target:a..b"] {
+            let read = pipeline_id("read_back", malformed, PipelineKind::Target);
+            assert!(
+                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "read_back"),
+                "{malformed:?} is not an id of any kind, got {read:?}"
+            );
+        }
+
+        // The instance root's own key segment is validated, not merely bounded.
+        // Nothing else stands between a `Slug` and a key: a space would compose
+        // a store key carrying a byte no `Label` may hold.
+        let mut spaced = instance_sample();
+        spaced.instance = Slug("thought cage".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Instance(spaced)),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "instance.instance".into(),
+                value: "thought cage".into(),
+            }),
+            "an instance slug is validated where the key is composed"
+        );
+        Ok(())
+    }
+
+    /// The repo is one key segment, so its slash is escaped. Left unescaped it
+    /// would both add a segment the reader cannot tell from a real one and put a
+    /// byte in the key that no `Label` may carry; escaped to a bare `_` it would
+    /// let two repos claim one key, which the colliding pair below pins.
+    #[test]
+    fn stewardship_key_escapes_the_repo_slash() {
+        let stewardship = stewardship_sample();
+        assert_eq!(stewardship.repo, OrgRepo("GameCult/Epiphany".into()));
+        let key = pipeline_key(&PipelineDocument::Stewardship(stewardship.clone()));
+        assert_eq!(key, Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")));
+        assert!(!key.unwrap().contains('/'), "no key segment carries a slash");
+
+        // The escape is not a cosmetic substitution, and the pair that proves
+        // it is a pair: GitHub's grammar keeps `.` and `_` out of the owner,
+        // so both live in the repo half here, and under a naive scheme that
+        // collapsed `/`, `.` and `_` all to a bare `_` both of these key to
+        // `GameCult_Epiphany_thing`, and one of the two documents is lost.
+        let keyed = |repo: &str| {
+            let mut value = stewardship.clone();
+            value.repo = OrgRepo(repo.into());
+            pipeline_key(&PipelineDocument::Stewardship(value))
+        };
+        let dotted_repo = keyed("GameCult/Epiphany.thing");
+        let underscored_repo = keyed("GameCult/Epiphany_thing");
+        assert_eq!(
+            dotted_repo,
+            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany_dthing.n1"))
+        );
+        assert_eq!(
+            underscored_repo,
+            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany__thing.n1"))
+        );
+        assert_ne!(dotted_repo, underscored_repo, "two repos cannot claim one key");
+
+        let mut no_org = stewardship.clone();
+        no_org.repo = OrgRepo("Epiphany".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Stewardship(no_org)),
+            Err(PipelineRefusal::InvalidFormat { field: "stewardship.repo".into(), value: "Epiphany".into() })
+        );
+
+        // S-1: key derivation goes through `identity()`, so a case variant of
+        // the same repository is one store key, not two stewardships of what
+        // is really one repo.
+        let mut upper = stewardship.clone();
+        upper.repo = OrgRepo("gamecult/epiphany".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Stewardship(upper)),
+            pipeline_key(&PipelineDocument::Stewardship(stewardship.clone())),
+            "GameCult/Epiphany and gamecult/epiphany must derive one store key"
+        );
+
+        // An escaped repo is still bound by the key's segment rules.
+        let mut long = stewardship;
+        long.repo = OrgRepo(format!("GameCult/{}", "a".repeat(60)));
+        assert!(
+            matches!(
+                pipeline_key(&PipelineDocument::Stewardship(long)),
+                Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "stewardship.key"
+            ),
+            "a repo segment longer than a key segment is refused"
+        );
+    }
+
+    /// A hand-off is recorded in both minds, so both instances are in the key:
+    /// the sender owns the first segment and the receiver the local. Changing
+    /// either one moves the document.
+    #[test]
+    fn hand_off_names_both_instances() {
+        let key = |hand_off: PipelineHandOff| pipeline_key(&PipelineDocument::HandOff(hand_off));
+        let base = key(hand_off_sample()).expect("the sample keys");
+        assert_eq!(base, format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.2026-09-15"));
+
+        let mut other_sender = hand_off_sample();
+        other_sender.from_instance = slug("thought-cage");
+        assert_ne!(key(other_sender), Ok(base.clone()), "the sender is in the key");
+
+        let mut other_receiver = hand_off_sample();
+        other_receiver.to_instance = slug("mimir");
+        assert_ne!(key(other_receiver), Ok(base.clone()), "the receiver is in the key");
+
+        // Two hand-offs of the same repo between the same pair on different
+        // days are different documents.
+        let mut later = hand_off_sample();
+        later.handed_on = Date("2026-09-16".into());
+        assert_ne!(key(later), Ok(base), "the date is in the key");
+
+        // A dotted receiver is a `Slug` entering a local, so it is escaped to
+        // one label rather than widening the local by a part.
+        let mut dotted_receiver = hand_off_sample();
+        dotted_receiver.to_instance = slug("thought-cage.GameCult");
+        assert_eq!(
+            key(dotted_receiver),
+            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.gamecult_-epiphany.2026-09-15"))
+        );
+
+        // The escape's `_` half is not only for repos: a receiver `a_db` and a
+        // receiver `a.b` would both key to `a_db` if the slug's own `_` passed
+        // through raw, so the slug is escaped as `a__db` and the two differ.
+        let mut underscored_receiver = hand_off_sample();
+        underscored_receiver.to_instance = slug("a_db");
+        let mut dotted_twin = hand_off_sample();
+        dotted_twin.to_instance = slug("a.b");
+        let underscored_receiver = key(underscored_receiver).expect("an underscored receiver keys");
+        assert!(underscored_receiver.contains("a__db"), "{underscored_receiver}: the slug's underscore is escaped");
+        assert_ne!(key(dotted_twin), Ok(underscored_receiver), "`a_db` and `a.b` are two receivers");
+
+        // Both instance slugs are validated as key segments, not merely bounded.
+        let mut bad_receiver = hand_off_sample();
+        bad_receiver.to_instance = Slug("thought cage".into());
+        assert_eq!(
+            key(bad_receiver),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "hand_off.to_instance".into(),
+                value: "thought cage".into(),
+            })
+        );
+        let mut bad_date = hand_off_sample();
+        bad_date.handed_on = Date("2026-9-15".into());
+        assert!(
+            matches!(key(bad_date), Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "hand_off.handed_on"),
+            "a malformed date does not compose a key"
+        );
+    }
+
+    /// A resolution whose subject is the given document, keyed.
+    fn resolution_of(kind: PipelineKind, id: &str) -> Result<String, PipelineRefusal> {
+        let mut resolution = resolution_sample();
+        resolution.subject = PipelineRef { kind, id: Short(id.into()) };
+        pipeline_key(&PipelineDocument::Resolution(resolution))
+    }
+
+    /// R1, the grammar's own test: every key is `<root>:<kind>:<local>`, three
+    /// segments with no kind excused, the root a `Slug`, the kind the literal
+    /// name, and every local part a `Label`. A root that would add a segment is
+    /// refused where the key is composed: `pipeline_key` is `pub` and does not
+    /// validate the document first, so this is reachable without one.
+    #[test]
+    fn every_key_has_exactly_three_segments() {
+        let nested = resolution_of(PipelineKind::Resolution, &format!("{CAMPAIGN}:resolution:question.Q1.n1"))
+            .expect("a resolution of a resolution keys");
+        let keys = samples()
+            .into_iter()
+            .map(|(document, _)| (document.kind(), pipeline_key(&document).expect("every sample keys")))
+            .chain([(PipelineKind::Resolution, nested)]);
+        for (kind, key) in keys {
+            let segments = key.split(':').collect::<Vec<_>>();
+            assert_eq!(segments.len(), 3, "{kind:?} key {key} has three segments");
+            assert_eq!(dotted_text("root", segments[0]), Ok(()), "{key}: the root is a slug");
+            assert_eq!(segments[1], kind.name(), "{key}: the kind segment is the literal kind");
+            assert!(PipelineKind::ALL.iter().any(|known| known.name() == segments[1]));
+            for part in segments[2].split('.') {
+                assert_eq!(label_text("local", part), Ok(()), "{key}: local part {part:?} is a label");
+            }
+        }
+
+        // A root that would add a segment, one that would empty a part, and one
+        // wider than a segment are all refused before a key is formatted. The
+        // refusal names the part that failed, so an empty part reports `""`.
+        let trailing_dot = format!("{CAMPAIGN}.");
+        let leading_dot = format!(".{CAMPAIGN}");
+        let over = "a".repeat(65);
+        for root in ["a:b", trailing_dot.as_str(), leading_dot.as_str(), "a..b", over.as_str()] {
+            let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
+            target.campaign = Slug(root.into());
+            let key = pipeline_key(&PipelineDocument::Target(target));
+            assert!(
+                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "target.campaign"),
+                "root {root:?} does not compose a key, got {key:?}"
+            );
+        }
+    }
+
+    /// Defect 1: the two roots are in distinct namespaces because the kind
+    /// segment distinguishes them, the same mechanism that separates every
+    /// other pair of kinds. Both key; only the pair sees a shared namespace.
+    #[test]
+    fn roots_of_different_kinds_do_not_share_a_key() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.slug = slug(INSTANCE);
+        let campaign = pipeline_key(&PipelineDocument::Campaign(campaign));
+        let instance = pipeline_key(&PipelineDocument::Instance(instance_sample()));
+        assert_eq!(campaign, Ok(format!("{INSTANCE}:campaign:self")));
+        assert_eq!(instance, Ok(format!("{INSTANCE}:instance:self")));
+        assert_ne!(campaign, instance, "a campaign and an instance of one slug are two documents");
+    }
+
+    /// The root is a `Slug`, so a dotted root keys and reads back whole on
+    /// both sides: the writer's root check and the reader's root check are
+    /// each `dotted_text`, not `label_text`. A campaign `game.cult` and an
+    /// instance `ygg.drasil` key, a document under the dotted campaign keys,
+    /// and each reads back through `pipeline_id` recovering the root exactly.
+    #[test]
+    fn dotted_roots_key_and_read_back() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.slug = slug("game.cult");
+        let campaign_key = pipeline_key(&PipelineDocument::Campaign(campaign)).expect("a dotted campaign keys");
+        assert_eq!(campaign_key, "game.cult:campaign:self");
+        assert_eq!(
+            pipeline_id("read_back", &campaign_key, PipelineKind::Campaign),
+            Ok(("game.cult", ROOT_LOCAL)),
+            "the dotted campaign root reads back whole"
+        );
+
+        let mut instance = instance_sample();
+        instance.instance = slug("ygg.drasil");
+        let instance_key = pipeline_key(&PipelineDocument::Instance(instance)).expect("a dotted instance keys");
+        assert_eq!(instance_key, "ygg.drasil:instance:self");
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
+            Ok(("ygg.drasil", ROOT_LOCAL)),
+            "the dotted instance root reads back whole"
+        );
+
+        let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
+        target.campaign = slug("game.cult");
+        let target_key = pipeline_key(&PipelineDocument::Target(target)).expect("a target under a dotted campaign keys");
+        assert_eq!(target_key, "game.cult:target:r2");
+        assert_eq!(
+            pipeline_id("read_back", &target_key, PipelineKind::Target),
+            Ok(("game.cult", "r2")),
+            "the dotted root and the local both read back"
+        );
+
+        let resolution = resolution_of(PipelineKind::Campaign, &campaign_key).expect("a resolution of a dotted campaign keys");
+        assert_eq!(resolution, "game.cult:resolution:campaign.self.n1");
+        assert_eq!(
+            pipeline_id("read_back", &resolution, PipelineKind::Resolution),
+            Ok(("game.cult", "campaign.self.n1")),
+            "a resolution under a dotted root reads back"
+        );
+    }
+
+    /// Cut 6c: a resolution's referent is a full id of the kind it declares,
+    /// validated through `PipelineRef` like every other referent, so a
+    /// well-formed id of the wrong kind is refused and the refusal names the
+    /// entry. The positive case is Ghostlight's own: a ruling partly
+    /// overturned by two later records, one of them a resolution named by the
+    /// key it has, which only the 6b grammar made nameable. An id no
+    /// resolution derives, `eureka-state:resolution:R8`, still validates:
+    /// whether a document with an id exists is admission's rule.
+    #[test]
+    fn resolution_outcome_referents_are_parsed_ids_of_their_kind() {
+        let resolved = |subject: PipelineRef, outcome: ResolutionOutcome| {
+            let mut resolution = resolution_sample();
+            resolution.subject = subject;
+            resolution.outcome = outcome;
+            PipelineDocument::Resolution(resolution).validate()
+        };
+        let refused = |field: &str, result: Result<(), PipelineRefusal>| {
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field: at, .. }) if at == field),
+                "expected InvalidFormat at {field}, got {result:?}"
+            );
+        };
+        let ruling = |label: &str| PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", label) };
+        let question = |label: &str| PipelineRef { kind: PipelineKind::Question, id: id("question", label) };
+        let inner = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
+        let resolution = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
+
+        let superseded = |second: PipelineRef| ResolutionOutcome::Superseded { by: vec![ruling("R9"), second] };
+        assert_eq!(resolved(ruling("R8"), superseded(resolution)), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Ruling, id: Short(inner) };
+        refused("resolution.outcome.by[1].id", resolved(ruling("R8"), superseded(forged)));
+        let underived = PipelineRef { kind: PipelineKind::Resolution, id: Short(format!("{CAMPAIGN}:resolution:R8")) };
+        assert_eq!(resolved(ruling("R8"), superseded(underived)), Ok(()), "well-formed grammar is not the shape's to refuse");
+
+        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Answered { by: ruling("R8") }), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Question, id: id("ruling", "R8") };
+        refused("resolution.outcome.by.id", resolved(question("Q1"), ResolutionOutcome::Answered { by: forged }));
+
+        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Deferred { to: question("Q2") }), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q2") };
+        refused("resolution.outcome.to.id", resolved(question("Q1"), ResolutionOutcome::Deferred { to: forged }));
+
+        let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+        let fixed = |by: Option<PipelineRef>| ResolutionOutcome::Fixed { commit: sha(), by };
+        assert_eq!(resolved(finding.clone(), fixed(None)), Ok(()));
+        assert_eq!(resolved(finding.clone(), fixed(Some(ruling("R8")))), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Finding, id: id("ruling", "R8") };
+        refused("resolution.outcome.by.id", resolved(finding, fixed(Some(forged))));
+
+        // Soul F2: the validator's bound on a supersession is its own, not
+        // only the schema's. Eight referents are the most a subject names;
+        // nine are refused as a count before any item is read.
+        let rulings = |count: usize| (1..=count).map(|n| ruling(&format!("R{n}"))).collect::<Vec<_>>();
+        assert_eq!(resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(8) }), Ok(()));
+        assert_eq!(
+            resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(9) }),
+            Err(PipelineRefusal::FieldBound { field: "resolution.outcome.by".into(), limit: 8, actual: 9 })
+        );
+
+        // Soul F3: the two reason-carrying outcomes are bounded like every
+        // `Line`; the shared arm is pinned on both so neither can drop out.
+        let wide = Line("a".repeat(1001));
+        for outcome in [
+            ResolutionOutcome::Recorded { reason: wide.clone() },
+            ResolutionOutcome::Withdrawn { reason: wide },
+        ] {
+            let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+            assert_eq!(
+                resolved(finding, outcome),
+                Err(PipelineRefusal::FieldBound { field: "resolution.outcome.reason".into(), limit: 1000, actual: 1001 })
+            );
+        }
+    }
+
+    /// Ruling B: a fix names the tree where the finding stopped being true,
+    /// as a `Sha`. Uppercase hex of a legal length is the forgery a length
+    /// check passes and `hex` refuses.
+    #[test]
+    fn fixed_resolution_requires_a_commit_sha() {
+        let fixed = |commit: &str, by: Option<PipelineRef>| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+            resolution.outcome = ResolutionOutcome::Fixed { commit: Sha(commit.into()), by };
+            PipelineDocument::Resolution(resolution).validate()
+        };
+        assert_eq!(fixed("5f98228d9c", None), Ok(()));
+        for forged in ["5F98228D9C", "5f9822", "dirty-worktree", ""] {
+            assert_eq!(
+                fixed(forged, None),
+                Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: forged.into() }),
+                "{forged:?} is not a commit"
+            );
+        }
+        // Soul F1: naming the record that fixed it does not excuse the commit.
+        let ruling = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
+        assert_eq!(
+            fixed("dirty-worktree", Some(ruling)),
+            Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: "dirty-worktree".into() }),
+            "a fix with a named record still names a commit"
+        );
+    }
+
+    /// A mutation record has a key-safe identity a verdict claim can name,
+    /// and is pinned to a tree: its label is a `Label` and its commit a
+    /// `Sha`, so a dotted label and free text where a sha belongs are refused.
+    #[test]
+    fn mutation_records_carry_a_dot_free_label_and_a_commit() {
+        let recorded = |label: &str, commit: &str| {
+            let mut report = report_sample();
+            // Through `From<&str>`, which every text type has, so the
+            // widened types under M19 and M20 still compile and the
+            // forgeries reach validation.
+            report.mutations[0].label = label.into();
+            report.mutations[0].commit = commit.into();
+            PipelineDocument::CutReport(report).validate()
+        };
+        assert_eq!(recorded("M1", "5f98228d"), Ok(()));
+        assert_eq!(
+            recorded("M1.a", "5f98228d"),
+            Err(PipelineRefusal::InvalidFormat { field: "cut_report.mutations[0].label".into(), value: "M1.a".into() })
+        );
+        assert_eq!(
+            recorded("M1", "dirty-worktree"),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "cut_report.mutations[0].commit".into(),
+                value: "dirty-worktree".into(),
+            })
+        );
+    }
+
+    /// Ruling A's shape half: a claim names the promise it measured and the
+    /// mutations it ran, both as `Label`s, and names at most eight mutations.
+    #[test]
+    fn a_verdict_claim_names_the_promise_and_the_mutation_it_measured() {
+        let sample = verdict_sample();
+        assert_eq!(sample.claims[0].promise, Some(l("P1")));
+        assert_eq!(sample.claims[0].mutations, vec![l("M1")]);
+        assert_eq!(PipelineDocument::Verdict(sample).validate(), Ok(()));
+
+        let claimed = |promise: Option<Label>, mutations: Vec<Label>| {
+            let mut verdict = verdict_sample();
+            verdict.claims[0].promise = promise;
+            verdict.claims[0].mutations = mutations;
+            PipelineDocument::Verdict(verdict).validate()
+        };
+        assert_eq!(claimed(None, vec![]), Ok(()), "a claim need not measure a promise");
+        assert_eq!(
+            claimed(Some(l("P1.a")), vec![]),
+            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].promise".into(), value: "P1.a".into() })
+        );
+        assert_eq!(
+            claimed(None, vec![l("M1.a")]),
+            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].mutations[0]".into(), value: "M1.a".into() })
+        );
+        let labels = |count: usize| (1..=count).map(|n| l(&format!("M{n}"))).collect::<Vec<_>>();
+        assert_eq!(claimed(None, labels(8)), Ok(()));
+        assert_eq!(
+            claimed(None, labels(9)),
+            Err(PipelineRefusal::FieldBound { field: "verdict.claims[0].mutations".into(), limit: 8, actual: 9 })
+        );
+    }
+
+    /// A tripwire on the one hazard of retyping the estimate: the delta's two
+    /// `u32` fields are not interchangeable. The sample spec is Cut 3a's, a
+    /// net addition of 900 lines, and the order is asserted.
+    #[test]
+    fn the_sample_cut_spec_estimates_a_net_addition() {
+        let PipelineDocument::CutSpec(spec) = samples().remove(4).0 else { unreachable!() };
+        assert_eq!(spec.estimate.lines_added, 900);
+        assert_eq!(spec.estimate.lines_removed, 0);
+        assert_eq!(spec.estimate, report_sample().structural_delta, "the estimate and the actual are one shape");
+    }
+
+    /// Defect 2: a resolution's key carries its subject's kind as a literal
+    /// part of the local, so nothing infers it and two subjects of one local
+    /// and different kinds resolve to two keys. Each reads back through the
+    /// reader with the subject kind it was built from.
+    #[test]
+    fn a_resolution_names_its_subjects_kind() {
+        let pairs = [
+            (PipelineKind::Question, id("question", "Q1").0, PipelineKind::Ruling, id("ruling", "Q1").0),
+            (
+                PipelineKind::Campaign,
+                format!("{CAMPAIGN}:campaign:self"),
+                PipelineKind::Instance,
+                format!("{CAMPAIGN}:instance:self"),
+            ),
+        ];
+        for (left_kind, left_id, right_kind, right_id) in pairs {
+            let left = resolution_of(left_kind, &left_id).expect("the left subject keys");
+            let right = resolution_of(right_kind, &right_id).expect("the right subject keys");
+            assert_ne!(left, right, "resolutions of {left_id} and {right_id} are two documents");
+            for (kind, key) in [(left_kind, &left), (right_kind, &right)] {
+                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+                assert_eq!(root, CAMPAIGN);
+                assert_eq!(local.split('.').next(), Some(kind.name()), "{key} names its subject's kind");
+            }
+        }
+    }
+
+    /// Defect 3: a resolution's own key is an ordinary id, so it composes as a
+    /// subject like any other, and the key reads back to the inner key -- the
+    /// whole inner key, sequence included, since the subject is recovered by
+    /// stripping this resolution's own sequence from the end and the kind from
+    /// the front. The depth bound is tested per kind by
+    /// `every_resolvable_kind_resolves_two_deep`.
+    #[test]
+    fn a_resolution_of_a_resolution_reads_back() {
+        let inner = resolution_of(PipelineKind::Question, &id("question", "Q1").0).expect("the inner keys");
+        let mut outer = resolution_sample();
+        outer.subject = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
+        let outer = PipelineDocument::Resolution(outer);
+        assert_eq!(outer.validate(), Ok(()));
+        let key = pipeline_key(&outer).expect("a resolution of a resolution keys");
+        assert_eq!(key, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"));
+        let (root, local) = pipeline_id("read_back", &key, PipelineKind::Resolution).expect("reads back");
+        let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+        let (subject_local, _sequence) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+        assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), inner, "the recovered subject is the inner key");
+    }
+
+    /// Each level of a nesting carries its own sequence, and only its own: the
+    /// part appended is this resolution's `sequence` field, never a copy of the
+    /// sequence the subject already ends in. The fixtures elsewhere all sit at
+    /// `1` at every level, where the two are indistinguishable, so the chain
+    /// here differs at every level and reads back level by level.
+    ///
+    /// On spelling, so silence is not read as coverage: the leaf emits `n<N>`
+    /// with `N` as `u32::to_string` writes it, so `n0` and `n12` are emitted
+    /// and `n01` is not. A hand-built id ending `n01`, `n1x`, or no `n<N>` at
+    /// all is still a well-formed reference -- those are legal labels, and a
+    /// grammar that reads keys may not refuse them on spelling. Nothing in the
+    /// leaf canonicalises them either: such an id simply names a document the
+    /// leaf would never key, which admission's A7 sees as a missing referent.
+    #[test]
+    fn every_level_of_a_nesting_keeps_its_own_sequence() {
+        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
+        };
+        let first = resolved(PipelineKind::Question, &id("question", "Q1").0, 9);
+        let second = resolved(PipelineKind::Resolution, &first, 10);
+        let third = resolved(PipelineKind::Resolution, &second, 0);
+        let fourth = resolved(PipelineKind::Resolution, &third, 12);
+        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n9"));
+        assert_eq!(second, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n9.n10"));
+        assert_eq!(third, format!("{CAMPAIGN}:resolution:resolution.resolution.question.Q1.n9.n10.n0"));
+        assert_eq!(
+            fourth,
+            format!("{CAMPAIGN}:resolution:resolution.resolution.resolution.question.Q1.n9.n10.n0.n12")
+        );
+        for (outer, inner, sequence) in [(&fourth, &third, 12), (&third, &second, 0), (&second, &first, 10)] {
+            let (root, local) = pipeline_id("read_back", outer, PipelineKind::Resolution).expect("reads back");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+            assert_eq!(subject_kind, "resolution", "{outer}: the subject of a nesting is a resolution");
+            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), *inner, "{outer}: the subject is the inner key");
+            assert_eq!(last, format!("n{sequence}"), "{outer}: this level's own sequence, not the subject's");
+        }
+    }
+
+    /// A stewardship is the other sequenced kind, and it composes as a subject
+    /// like any other: the subject's whole local, escaped repo and sequence
+    /// both, is the resolution's local, with the resolution's own sequence
+    /// last. So the two assignments of one repo have two resolutions, and a
+    /// resolution of either is itself resolvable.
+    #[test]
+    fn a_resolution_of_a_stewardship_reads_back() {
+        let stewarded = |sequence: u32| {
+            let mut stewardship = stewardship_sample();
+            stewardship.sequence = sequence;
+            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
+        };
+        let first = stewarded(1);
+        let second = stewarded(2);
+        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
+        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
+
+        let resolved = resolution_of(PipelineKind::Stewardship, &first).expect("a resolution of a stewardship keys");
+        let resolved_second = resolution_of(PipelineKind::Stewardship, &second).expect("the second assignment resolves");
+        assert_eq!(resolved, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n1.n1"));
+        assert_eq!(resolved_second, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n2.n1"));
+        assert_ne!(resolved, resolved_second, "each assignment keeps its own resolution");
+
+        for (key, subject) in [(&resolved, &first), (&resolved_second, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+            assert_eq!(root, INSTANCE, "{key}: a stewardship's resolution lives in the mind's root");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+            assert_eq!(subject_kind, PipelineKind::Stewardship.name(), "{key} names its subject's kind");
+            assert_eq!(
+                format!("{root}:{subject_kind}:{subject_local}"),
+                *subject,
+                "{key}: the subject's own sequence is part of the recovered key"
+            );
+            assert_eq!(last, "n1", "{key}: this resolution's own sequence");
+
+            // A withdrawal of that resolution nests one out, as it does under
+            // any other subject, and reads back to the resolution it withdraws.
+            let withdrawal = resolution_of(PipelineKind::Resolution, key).expect("a withdrawal keys");
+            let subject_local = key.split(':').nth(2).expect("three segments");
+            assert_eq!(withdrawal, format!("{INSTANCE}:resolution:resolution.{subject_local}.n1"));
+            let (root, local) = pipeline_id("read_back", &withdrawal, PipelineKind::Resolution).expect("reads back");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, _) = rest.rsplit_once('.').expect("the local ends in its own sequence");
+            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), **key, "{withdrawal}: the withdrawn resolution");
+        }
+    }
+
+    /// A legal dotted local of exactly `length` bytes (`a.a.a`, each part a
+    /// label), for bounds wider than one label.
+    fn dotted_local(length: usize) -> String {
+        match length % 2 {
+            1 => format!("{}a", "a.".repeat(length / 2)),
+            _ => format!("{}aa", "a.".repeat(length / 2 - 1)),
+        }
+    }
+
+    /// A resolution of `subject`, at `sequence`, keyed.
+    fn resolved_at(kind: PipelineKind, subject: &str, sequence: u32) -> Result<String, PipelineRefusal> {
+        let mut resolution = resolution_sample();
+        resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+        resolution.sequence = sequence;
+        pipeline_key(&PipelineDocument::Resolution(resolution))
+    }
+
+    /// every-subject-resolvable: for each kind that can be a subject, at the
+    /// widest subject local (64) and `u32::MAX` sequences, depth one and depth
+    /// two key and read back through `pipeline_id`; depth three is refused on
+    /// the local bound.
+    #[test]
+    fn every_resolvable_kind_resolves_two_deep() {
+        let wide = "a".repeat(SUBJECT_LOCAL_MAX);
+        let mut widest = 0;
+        for kind in PipelineKind::ALL.iter().copied().filter(|kind| *kind != PipelineKind::Resolution) {
+            let subject = format!("{CAMPAIGN}:{}:{wide}", kind.name());
+            assert_eq!(pipeline_id("subject", &subject, kind), Ok((CAMPAIGN, wide.as_str())), "{kind:?}: the subject parses");
+            let one = resolved_at(kind, &subject, u32::MAX).unwrap_or_else(|error| panic!("{kind:?} depth one: {error}"));
+            let two = resolved_at(PipelineKind::Resolution, &one, u32::MAX)
+                .unwrap_or_else(|error| panic!("{kind:?} depth two: {error}"));
+            for key in [&one, &two] {
+                assert!(key.len() <= 200, "{key}: an id fits a Short");
+                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution)
+                    .unwrap_or_else(|error| panic!("{kind:?}: {key} does not read back: {error}"));
+                assert_eq!(root, CAMPAIGN);
+                assert!(local.len() <= RESOLUTION_LOCAL_MAX);
+            }
+            widest = widest.max(two.len() - format!("{CAMPAIGN}:resolution:").len());
+            assert!(
+                matches!(
+                    resolved_at(PipelineKind::Resolution, &two, u32::MAX),
+                    Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "resolution.key"
+                ),
+                "{kind:?}: depth three is refused on the local bound"
+            );
+        }
+        assert_eq!(widest, RESOLUTION_LOCAL_MAX, "the bound is exactly the widest depth-two chain");
+        assert_eq!(RESOLUTION_LOCAL_MAX, 111);
+    }
+
+    #[test]
+    fn the_longest_kind_name_is_the_longest() {
+        let longest = PipelineKind::ALL.iter().map(|kind| kind.name().len()).max();
+        assert_eq!(longest, Some(LONGEST_KIND_NAME));
+    }
+
+    /// The parser bounds an id's local by kind, exactly where the composer does.
+    #[test]
+    fn an_id_local_is_bounded_by_its_kind() {
+        let at = |kind: PipelineKind, length: usize| {
+            pipeline_id("probe", &format!("{CAMPAIGN}:{}:{}", kind.name(), dotted_local(length)), kind).map(|_| ())
+        };
+        assert_eq!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX), Ok(()));
+        assert!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX + 1).is_err());
+        assert_eq!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX), Ok(()));
+        assert!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX + 1).is_err());
+    }
+
+    #[test]
+    fn sha_names_same_commit() {
+        let full = Sha("5f98228d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a69".into());
+        assert!(full.names_same_commit(&Sha("5f98228".into())));
+        assert!(Sha("5f98228".into()).names_same_commit(&full));
+        assert!(full.names_same_commit(&full));
+        assert!(!full.names_same_commit(&Sha("5f98229".into())));
+        assert!(!Sha("5f98228".into()).names_same_commit(&Sha("5f98229".into())));
+        assert!(!Sha("5f98228a".into()).names_same_commit(&Sha("5f98228b".into())), "equal length, differing");
+    }
+
+    /// stored-documents-valid, on the real mind. `HUGINN_MIND_SNAPSHOT` is a
+    /// writable copy of a state root holding `minds/eureka/mind.redb` (the
+    /// store opens read-write). Read through cultcache-rs's own store.
+    #[test]
+    #[ignore = "needs HUGINN_MIND_SNAPSHOT, a writable copy of a Huginn state root"]
+    fn stored_documents_read_back() {
+        use cultcache_rs::{CacheBackingStore, OwnedRedbMessagePackBackingStore};
+        let root = std::env::var("HUGINN_MIND_SNAPSHOT").expect("HUGINN_MIND_SNAPSHOT names the snapshot state root");
+        let store = OwnedRedbMessagePackBackingStore::new(Path::new(&root).join("minds").join("eureka").join("mind.redb"))
+            .expect("the snapshot opens");
+        let envelopes = store.pull_all().expect("the snapshot reads");
+        let mut stored = Vec::new();
+        for envelope in &envelopes {
+            match PipelineDocument::decode(envelope) {
+                Ok(document) => {
+                    assert_eq!(document.validate(), Ok(()), "{}: valid", envelope.key);
+                    assert_eq!(pipeline_key(&document).as_deref(), Ok(envelope.key.as_str()), "{}: key derives byte for byte", envelope.key);
+                    stored.push((document.kind(), envelope.key.clone()));
+                }
+                Err(PipelineRefusal::ForeignStore { .. }) => {}
+                Err(error) => panic!("{}: does not decode: {error}", envelope.key),
+            }
+        }
+        assert!(stored.len() > 200, "{} pipeline documents read", stored.len());
+        let mut subjects = 0;
+        let resolvable = |kind: &PipelineKind| !matches!(kind, PipelineKind::Resolution | PipelineKind::Campaign | PipelineKind::Instance);
+        for (kind, key) in stored.iter().filter(|(kind, _)| resolvable(kind)) {
+            let one = resolved_at(*kind, key, 1).unwrap_or_else(|error| panic!("{key}: no resolution keys: {error}"));
+            let two = resolved_at(PipelineKind::Resolution, &one, 1).unwrap_or_else(|error| panic!("{key}: no withdrawal keys: {error}"));
+            for derived in [&one, &two] {
+                pipeline_id("read_back", derived, PipelineKind::Resolution).unwrap_or_else(|error| panic!("{derived}: does not parse: {error}"));
+            }
+            subjects += 1;
+        }
+        for (_, key) in stored.iter().filter(|(kind, _)| *kind == PipelineKind::Resolution) {
+            resolved_at(PipelineKind::Resolution, key, 1).unwrap_or_else(|error| panic!("{key}: cannot be withdrawn: {error}"));
+        }
+        // The six findings that could not be resolved before this cut.
+        let stuck = [
+            "cut-bifrost-retire-alarm.s2.verb-default-accepts-malformed",
+            "cut-ops-notice-deploy.s2.pinned-bifrost-predates-retry",
+            "cut-bifrost-notice-retry.s1.unknown-test-ignores-backoff",
+            "cut-bifrost-notice-retry.s2.closed-unknown-retry-unpinned",
+            "cut-bifrost-notice-retry.s2.flapping-clock-retries-every-tick",
+            "cut-idunn-topology-lock.s2.boot-reconcile-skipped-on-contention",
+        ];
+        for label in stuck {
+            let found = stored
+                .iter()
+                .find(|(kind, key)| *kind == PipelineKind::Finding && key.ends_with(label))
+                .unwrap_or_else(|| panic!("{label}: not in the snapshot"));
+            let one = resolved_at(PipelineKind::Finding, &found.1, 1).unwrap_or_else(|error| panic!("{label}: still stuck: {error}"));
+            assert!(one.split(':').nth(2).is_some_and(|local| local.len() > SUBJECT_LOCAL_MAX), "{label}: the old bound refused it");
+        }
+        eprintln!("read back {} pipeline documents, {subjects} subjects", stored.len());
+    }
+
+    /// The total bound, in the one place it lives: parts that are each a legal
+    /// label compose a local wider than 64 bytes and are refused as a whole.
+    #[test]
+    fn a_composed_local_is_bounded_whole() {
+        let mut wide = hand_off_sample();
+        wide.to_instance = Slug("a".repeat(60));
+        assert_eq!(wide.to_instance.validate("hand_off.to_instance"), Ok(()), "the receiver alone is legal");
+        assert_eq!(
+            label_text("part", &key_segment(&wide.repo.0)),
+            Ok(()),
+            "the repo alone is legal"
+        );
+        let key = pipeline_key(&PipelineDocument::HandOff(wide));
+        assert!(
+            matches!(&key, Err(PipelineRefusal::InvalidFormat { field, value }) if field == "hand_off.key" && value.len() > 64),
+            "a local of legal parts is still bounded whole, got {key:?}"
+        );
+
+        // The bound is 64 exactly, on both sides, whether the part that fills
+        // it is a plain label or an escaped repo. A hand-off local is
+        // `<receiver>.<repo>.<date>`, the repo `gamecult_-epiphany` and the
+        // date ten bytes, so the receiver fills the rest; a stewardship local is
+        // `<repo escaped>.n<N>`, so `GameCult_-` and `.n1` bound the name.
+        let hand_off_rest = "gamecult_-epiphany".len() + ".".len() + date().0.len() + ".".len();
+        let stewardship_rest = "GameCult_-".len() + ".n1".len();
+        let received = |receiver: usize| {
+            let mut hand_off = hand_off_sample();
+            hand_off.to_instance = Slug("a".repeat(receiver));
+            pipeline_key(&PipelineDocument::HandOff(hand_off))
+        };
+        let stewarded = |name: usize| {
+            let mut stewardship = stewardship_sample();
+            stewardship.repo = OrgRepo(format!("GameCult/{}", "a".repeat(name)));
+            pipeline_key(&PipelineDocument::Stewardship(stewardship))
+        };
+        for (label, at_64, at_65) in [
+            ("plain label", received(64 - hand_off_rest), received(65 - hand_off_rest)),
+            ("escaped repo", stewarded(64 - stewardship_rest), stewarded(65 - stewardship_rest)),
+        ] {
+            let keyed = at_64.unwrap_or_else(|error| panic!("{label}: a 64-byte local keys: {error}"));
+            assert_eq!(keyed.split(':').nth(2).map(str::len), Some(64), "{label}: {keyed} fills the local exactly");
+            assert!(
+                matches!(&at_65, Err(PipelineRefusal::InvalidFormat { value, .. }) if value.len() == 65),
+                "{label}: a 65-byte local is refused, got {at_65:?}"
+            );
+        }
+    }
+
+    /// The resolution side of the bound: 111 keys and 112 is refused on
+    /// `resolution.key`, filled by a resolution subject (`resolution.<L>.n1`).
+    #[test]
+    fn a_composed_resolution_local_is_bounded_whole() {
+        let overhead = "resolution.".len() + ".n1".len();
+        let subject = |length: usize| format!("{CAMPAIGN}:resolution:{}", dotted_local(length));
+        let at_max = resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead), 1)
+            .expect("a 111-byte resolution local keys");
+        assert_eq!(at_max.split(':').nth(2).map(str::len), Some(RESOLUTION_LOCAL_MAX));
+        assert!(matches!(
+            resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead + 1), 1),
+            Err(PipelineRefusal::InvalidFormat { field, value }) if field == "resolution.key" && value.len() == RESOLUTION_LOCAL_MAX + 1
+        ));
+    }
+
+    /// R2, on the composer every kind goes through: no local part carries the
+    /// separator, the head included. The live case is a hand-off with a dotted
+    /// receiver, which keys to an escaped label rather than a wider local.
+    #[test]
+    fn no_local_part_carries_the_separator() {
+        assert_eq!(
+            local("probe", PipelineKind::Question, &["a.b"]),
+            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "a.b".into() }),
+            "the head may not carry the separator"
+        );
+        assert_eq!(
+            local("probe", PipelineKind::Question, &["a", "b.c"]),
+            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "b.c".into() }),
+            "a tail part may not carry the separator"
+        );
+        assert_eq!(local("probe", PipelineKind::Question, &["a", "b", "c"]), Ok("a.b.c".into()));
+
+        let mut dotted = hand_off_sample();
+        dotted.to_instance = slug("thought-cage.GameCult");
+        let key = pipeline_key(&PipelineDocument::HandOff(dotted)).expect("a dotted receiver keys");
+        let local = key.split(':').nth(2).expect("three segments");
+        assert_eq!(local.split('.').count(), 3, "{key}: the receiver is one part, not two");
+        assert_eq!(local.split('.').next(), Some("thought-cage_dGameCult"));
+    }
+
+    /// Q17 B: a subject's resolutions are distinct records, ordered by a
+    /// per-subject sequence the key carries as its last part, so a withdrawn
+    /// resolution stays under its subject and the next closure is nameable.
+    /// The sequence is a field the writer sets and this crate only composes:
+    /// it bounds nothing beyond `u32` and the local's own width, so `0` and a
+    /// gap both key. Which sequence a document may claim, and whether an
+    /// earlier resolution still stands, are admission's rules, exactly as
+    /// `revision: 0` is.
+    #[test]
+    fn a_subject_keeps_every_resolution_it_had() {
+        let resolved = |sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
+        };
+        let first = resolved(1);
+        let second = resolved(2);
+        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
+        assert_eq!(second, format!("{CAMPAIGN}:resolution:question.Q1.n2"));
+        assert_ne!(first, second, "two resolutions of one subject are two documents");
+        for (sequence, key) in [(1, &first), (2, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+            assert_eq!(root, CAMPAIGN, "{key}: the subject's root");
+            let last = format!("n{sequence}");
+            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
+            assert_eq!(local.split('.').count(), 3, "{key}: subject kind, subject local, sequence");
+        }
+
+        // Outcome-invariance now holds per sequence: one record under two
+        // outcomes is still one key, which is exactly why a second closure of
+        // a subject needs a second sequence and not a second outcome.
+        let mut withdrawn = resolution_sample();
+        withdrawn.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(withdrawn)),
+            Ok(first.clone()),
+            "one sequence is one key whatever the outcome"
+        );
+
+        // Stated limits. Both are admission's to refuse and neither is the
+        // leaf's, so both compose here.
+        assert_eq!(resolved(0), format!("{CAMPAIGN}:resolution:question.Q1.n0"), "the leaf refuses no sequence value");
+        let mut widest = resolution_sample();
+        widest.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "A") };
+        widest.sequence = u32::MAX;
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(widest)),
+            Ok(format!("{CAMPAIGN}:resolution:ruling.A.n4294967295")),
+            "the widest sequence is an eleven-byte label, not a refusal"
+        );
+    }
+
+    /// D2: the sequence is the *last* part, so a subject's resolutions and
+    /// only they share the prefix `<root>:resolution:<kind>.<local>.n`. R2 is
+    /// what makes the prefix exact: no local part carries a dot, so
+    /// `question.Q1.n` cannot match `question.Q10.n1`, and the withdrawal of
+    /// `Q1`'s first resolution is a record of that resolution, one nesting
+    /// out and outside `Q1`'s prefix. Pinned as a string property, which is
+    /// what a prefix query is.
+    #[test]
+    fn a_subjects_resolutions_share_a_prefix_no_other_key_has() {
+        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("the subject keys")
+        };
+        let history = [1, 2, 3].map(|sequence| resolved(PipelineKind::Question, &id("question", "Q1").0, sequence));
+        let others = [
+            resolved(PipelineKind::Question, &id("question", "Q10").0, 1),
+            resolved(PipelineKind::Ruling, &id("ruling", "Q1").0, 1),
+            resolved(PipelineKind::Campaign, &format!("{CAMPAIGN}:campaign:self"), 1),
+            resolved(PipelineKind::Resolution, &history[0], 1),
+        ];
+        assert_eq!(
+            others[3],
+            format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"),
+            "a withdrawal keys under the resolution it withdraws, not under the subject"
+        );
+        let prefix = format!("{CAMPAIGN}:resolution:question.Q1.n");
+        let selected = history
+            .iter()
+            .chain(others.iter())
+            .filter(|key| key.starts_with(&prefix))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            selected,
+            history.iter().collect::<Vec<_>>(),
+            "the prefix selects the subject's resolutions and nothing else"
+        );
+    }
+
+    /// Q18 A and Q20 A: a repo's stewardships on a mind are distinct records,
+    /// ordered by a per-`(instance, repo)` sequence the key carries last, so a
+    /// repo transferred away and later transferred back is two records under
+    /// one prefix rather than one document overwriting the other. The date is
+    /// not in the key: `assigned_on` is validated where every field is, by the
+    /// derived `Bounded` impl, and two assignments differing only in it are
+    /// one document.
+    #[test]
+    fn a_repo_keeps_every_stewardship_it_had() {
+        let stewarded = |repo: &str, sequence: u32, assigned_on: &str| {
+            let mut stewardship = stewardship_sample();
+            stewardship.repo = OrgRepo(repo.into());
+            stewardship.sequence = sequence;
+            stewardship.assigned_on = Date(assigned_on.into());
+            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
+        };
+        let first = stewarded("GameCult/Epiphany", 1, "2026-09-15");
+        let second = stewarded("GameCult/Epiphany", 2, "2026-09-16");
+        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
+        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
+        assert_ne!(first, second, "two assignments of one repo are two documents");
+        for (sequence, key) in [(1, &first), (2, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Stewardship).expect("reads back");
+            assert_eq!(root, INSTANCE, "{key}: the mind's root");
+            let last = format!("n{sequence}");
+            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
+            assert_eq!(local.split('.').count(), 2, "{key}: the escaped repo and the sequence, nothing else");
+        }
+
+        assert_eq!(
+            stewarded("GameCult/Epiphany", 1, "2026-09-16"),
+            first,
+            "assigned_on is a field, not a key part: one sequence is one key whatever the date"
+        );
+
+        let others = [
+            stewarded("GameCult/Epiphany_thing", 1, "2026-09-15"),
+            stewarded("GameCult/Huginn", 1, "2026-09-15"),
+        ];
+        let prefix = format!("{INSTANCE}:stewardship:gamecult_-epiphany.n");
+        let history = [first, second];
+        let selected = history
+            .iter()
+            .chain(others.iter())
+            .filter(|key| key.starts_with(&prefix))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            selected,
+            history.iter().collect::<Vec<_>>(),
+            "the prefix selects the repo's assignments on this mind and nothing else"
+        );
+
+        assert_eq!(
+            stewarded("GameCult/Epiphany", 0, "2026-09-15"),
+            format!("{INSTANCE}:stewardship:gamecult_-epiphany.n0"),
+            "the leaf refuses no sequence value"
+        );
+    }
+
+    /// Cut 8: the leaf owns the serialisation of the shapes it owns, so a wire
+    /// carrying a document or a refusal reads back the same value rather than
+    /// a mirror definition kept in step by hand in the reader's repo. Both
+    /// encodings are pinned: JSON is what a schema describes, MessagePack is
+    /// what a CultCache payload is written in, and an adjacent tag has to
+    /// survive both. The tag is asserted against `name()` rather than against
+    /// a literal, because the point of the tag is that a reader dispatching on
+    /// a key's kind segment finds the same string here.
+    #[test]
+    fn every_document_and_refusal_serialises_and_reads_back() -> Result<()> {
+        for (document, _) in samples() {
+            let json = serde_json::to_value(&document)?;
+            assert_eq!(json["kind"].as_str(), Some(document.kind().name()), "{json} is tagged with its kind name");
+            assert_eq!(serde_json::from_value::<PipelineDocument>(json.clone())?, document, "{json} reads back");
+            let packed = rmp_serde::to_vec_named(&document)?;
+            assert_eq!(
+                rmp_serde::from_slice::<PipelineDocument>(&packed)?,
+                document,
+                "{:?} reads back through MessagePack",
+                document.kind()
+            );
+        }
+
+        // Every variant, and every one of them carrying its named parts: a
+        // refusal read off a wire names the field it refused, as a local one
+        // does.
+        let refusals = [
+            PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 },
+            PipelineRefusal::InvalidFormat { field: "campaign.slug".into(), value: "a b".into() },
+            PipelineRefusal::InvalidIdentity {
+                kind: PipelineKind::Campaign,
+                key: format!("{CAMPAIGN}:campaign:forged"),
+                expected: format!("{CAMPAIGN}:campaign:self"),
+            },
+            PipelineRefusal::DuplicateRepo { field: "campaign.repos".into(), repo: "gamecult/epiphany".into() },
+            PipelineRefusal::ForeignStore { r#type: <ForeignDocument as DatabaseEntry>::TYPE.into() },
+        ];
+        for refusal in &refusals {
+            let json = serde_json::to_value(refusal)?;
+            assert_eq!(&serde_json::from_value::<PipelineRefusal>(json.clone())?, refusal, "{json} reads back");
+            let packed = rmp_serde::to_vec_named(refusal)?;
+            assert_eq!(
+                &rmp_serde::from_slice::<PipelineRefusal>(&packed)?,
+                refusal,
+                "{refusal:?} reads back through MessagePack"
+            );
+        }
+
+        // The derived schemas list the same two sets. A `const` in the tag
+        // position is what a schema reader dispatches on, so it is read as the
+        // schema writes it and compared to `name()`, not to a literal list.
+        let tag = |variant: &serde_json::Value| {
+            variant["properties"]["kind"]["const"]
+                .as_str()
+                .unwrap_or_else(|| panic!("a document variant schema carries a kind const: {variant}"))
+                .to_owned()
+        };
+        let document_schema = serde_json::to_value(schemars::schema_for!(PipelineDocument))?;
+        let variants = document_schema["oneOf"].as_array().expect("the document schema is a oneOf");
+        assert_eq!(PipelineKind::ALL.len(), 13, "thirteen kinds");
+        assert_eq!(
+            variants.iter().map(tag).collect::<Vec<_>>(),
+            PipelineKind::ALL.iter().map(|kind| kind.name().to_owned()).collect::<Vec<_>>(),
+            "the document schema lists exactly the thirteen kinds, by name"
+        );
+
+        let refusal_schema = serde_json::to_value(schemars::schema_for!(PipelineRefusal))?;
+        let refusal_variants = refusal_schema["oneOf"].as_array().expect("the refusal schema is a oneOf");
+        let named = refusal_variants
+            .iter()
+            .map(|variant| {
+                let properties = variant["properties"].as_object().expect("a refusal variant is an object");
+                assert_eq!(properties.len(), 1, "{variant} is externally tagged");
+                properties.keys().next().expect("one key").to_owned()
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(named, vec!["FieldBound", "InvalidFormat", "InvalidIdentity", "DuplicateRepo", "ForeignStore"]);
+        assert_eq!(named.len(), refusals.len(), "every refusal variant is in the schema and in the round trip");
+        Ok(())
+    }
+
+    #[test]
+    fn pipeline_published_schemas_match_derivation() -> Result<()> {
+        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../schemas/cultnet");
+        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
+        // A directory this run alone writes, so everything in it is what this
+        // run derived. A previous run's leftovers -- a mutation run's
+        // especially, since those deliberately derive schemas no committed type
+        // produces -- are not this derivation, and copying one of those into
+        // `schemas/cultnet` publishes a schema no Rust type produces. A shared
+        // directory cleared first would have to defend that clear against a
+        // held handle; an unshared one has nothing to defend. The cost is that
+        // nothing ever removes one. The directory is only created when
+        // something is stale, so a passing run leaves none -- but a failing run
+        // leaves its copies behind for good, one directory per failing run
+        // where the shared design left one however often it failed. That is the
+        // trade: the copies are the evidence the failure message names, and
+        // they outlive the run that wrote them. Whoever reads the failure is
+        // the one who deletes them.
+        let derived_dir = std::env::temp_dir().join(format!(
+            "epiphany-pipeline-schemas-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_nanos()
+        ));
+        let mut stale = Vec::new();
+        for kind in PipelineKind::ALL {
+            let file = format!("{}.schema.json", kind.type_id());
+            let mut schema = serde_json::to_value(kind.derived_schema())?;
+            schema["$id"] = format!("https://gamecult.dev/epiphany/cultnet/{file}").into();
+            let derived = format!("{}\n", serde_json::to_string_pretty(&schema)?);
+            if std::fs::read(published.join(&file)).ok().as_deref() != Some(derived.as_bytes()) {
+                std::fs::create_dir_all(&derived_dir)?;
+                std::fs::write(derived_dir.join(&file), &derived)?;
+                stale.push(derived_dir.join(&file));
+            }
+            let entry = serde_json::json!({
+                "schemaId": format!("https://gamecult.dev/epiphany/cultnet/{file}"),
+                "kind": "document_payload",
+                "wireContracts": ["cultnet.schema.v0"],
+                "schemaVersion": kind.type_id(),
+                "documentType": kind.type_id(),
+                "title": format!("Epiphany Pipeline {kind:?} v2"),
+                "path": file,
+            });
+            assert!(
+                index["schemas"].as_array().is_some_and(|schemas| schemas.contains(&entry)),
+                "index.json lacks {entry}"
+            );
+        }
+        assert!(stale.is_empty(), "published pipeline schemas differ from the Rust derivation; derived copies: {stale:?}");
+        Ok(())
+    }
+
+    /// The epoch is the version every kind is published at: its version
+    /// segment is read from the constant, not restated, and every type id
+    /// carries the same one, so a bumped epoch fails here until the kinds
+    /// move with it. The live registrar registers the kinds and nothing else,
+    /// so the foreign stand-in is not among them.
+    #[test]
+    fn every_kind_is_at_the_epochs_version() -> Result<()> {
+        let (name, version) = PIPELINE_SCHEMA_EPOCH.rsplit_once('.').expect("the epoch carries a version");
+        assert_eq!(name, "epiphany.pipeline.epoch");
+        assert!(
+            version.len() > 1 && version.starts_with('v') && version[1..].bytes().all(|byte| byte.is_ascii_digit()),
+            "{version:?} is not a version segment"
+        );
+        for kind in PipelineKind::ALL {
+            let type_id = kind.type_id();
+            assert!(type_id.ends_with(&format!(".{version}")), "{type_id} is not at the epoch's version {version}");
+        }
+
+        let mut cache = CultCache::new();
+        register_pipeline_document_types(&mut cache)?;
+        let registered = cache.registered_entry_types();
+        assert_eq!(registered.len(), PipelineKind::ALL.len(), "the live registrar registers exactly the kinds: {registered:?}");
+        for kind in PipelineKind::ALL {
+            assert!(registered.iter().any(|name| name == kind.type_id()), "{kind:?} is registered");
+        }
+        Ok(())
+    }
+
+    /// The public door onto the reference grammar, for the read side that
+    /// holds a `kind` and an `id` and no way to reach `Bounded`. Every sample
+    /// document's own key is a reference of its own kind; a kind that is not
+    /// the id's, and a local no writer composes, are `InvalidFormat` at `ref.id`.
+    #[test]
+    fn a_ref_validates_as_an_id_of_the_kind_it_declares() -> Result<()> {
+        for (document, expected) in samples() {
+            let kind = document.kind();
+            let key = pipeline_key(&document)?;
+            assert_eq!(key, expected);
+            assert_eq!(
+                PipelineRef { kind, id: s(&key) }.validate_ref(),
+                Ok(()),
+                "{kind:?}'s own key is not a reference of its kind"
+            );
+        }
+
+        let refused = |reference: PipelineRef, why: &str| {
+            let read = reference.validate_ref();
+            assert!(
+                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "ref.id"),
+                "{why}: {reference:?} was not refused, got {read:?}"
+            );
+        };
+
+        // The kind and the id's kind segment cannot disagree: the whole reason
+        // the door exists, since a reader that cannot ask would look this up
+        // and report the nothing it found.
+        refused(
+            PipelineRef { kind: PipelineKind::Campaign, id: id("question", "Q1") },
+            "a question id is not a campaign reference",
+        );
+        refused(
+            PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q1") },
+            "a question id is not a ruling reference",
+        );
+        // The local is `dotted_text` whole, so a trailing dot is refused by the
+        // reader and not only by the writer that never composes one.
+        refused(
+            PipelineRef { kind: PipelineKind::Question, id: s(&format!("{CAMPAIGN}:question:Q1.")) },
+            "a trailing dot is no local",
+        );
+
+        // The boundary, pinned rather than assumed: a resolution id missing the
+        // per-subject sequence its writer always composes is still a
+        // well-formed id of its kind here. The leaf's grammar is kind-deep, and
+        // the local's per-kind shape belongs to admission; refusing this would
+        // be a new rule in `pipeline_id`, not a door onto the one that exists.
+        assert_eq!(
+            PipelineRef { kind: PipelineKind::Resolution, id: s(&format!("{CAMPAIGN}:resolution:question.Q1")) }
+                .validate_ref(),
+            Ok(()),
+            "the leaf reads a resolution id kind-deep"
+        );
+        Ok(())
+    }
+
+    /// The public door onto the slug grammar, for a caller outside this crate
+    /// holding a bare declared name (Huginn's `require_instance` and
+    /// `Mind::open`, before either reaches admission or the filesystem). It
+    /// applies exactly `dotted_text`: one valid dotted name, and refusals for
+    /// fullwidth characters, `..`, both path separators, the empty string,
+    /// and an empty label.
+    #[test]
+    fn slug_validate_applies_the_dotted_grammar() {
+        assert_eq!(slug("huginn-yggdrasil").validate_slug(), Ok(()));
+        assert_eq!(slug("outer.inner").validate_slug(), Ok(()));
+
+        let refused = |value: &str, why: &str| {
+            let result = slug(value).validate_slug();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "slug"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+
+        refused("\u{FF41}\u{FF41}", "fullwidth characters are not ascii alphanumeric");
+        refused("..", "a bare .. is an empty label either side of the dot");
+        refused("../escaped", "a forward-slash path separator is not a label byte");
+        refused("..\\escaped", "a backslash path separator is not a label byte");
+        refused("outer\\inner", "a lone backslash inside one label is not a label byte, with no empty label to hide behind");
+        refused("", "the empty string has no label");
+        refused("outer..inner", "an empty label between two dots is refused");
+        refused(".", "a single dot is one empty label");
+
+        // S5: the 64-byte whole-name bound, pinned with a two-label name
+        // whose parts sit far under 64 bytes each (31 and 32, then 32 and
+        // 32), so only `dotted_text`'s own `value.len() > 64` check -- not
+        // `label_text`'s per-part one -- can be the check that refuses 65.
+        let filler = |n: usize| "a".repeat(n);
+        let at_64 = format!("{}.{}", filler(31), filler(32));
+        let at_65 = format!("{}.{}", filler(32), filler(32));
+        assert_eq!(at_64.len(), 64, "a 64-byte whole name, two labels well under 64 each");
+        assert_eq!(at_65.len(), 65, "one byte past the whole-name bound, same two-label shape");
+        assert_eq!(slug(&at_64).validate_slug(), Ok(()));
+        refused(&at_65, "65 bytes overall is refused, even though neither label alone reaches 64");
+
+        // S5: the 64-byte per-label bound, pinned directly against `Label`
+        // (the type `label_text` guards on its own, with no separate
+        // whole-name wrapper), and with a lone label carrying no dot, so only
+        // `label_text`'s own length check can be the one refusing 65.
+        let label_at_64 = Label::from(filler(64).as_str());
+        let label_at_65 = Label::from(filler(65).as_str());
+        assert_eq!(label_at_64.validate("label"), Ok(()));
+        assert!(
+            matches!(
+                label_at_65.validate("label"),
+                Err(PipelineRefusal::InvalidFormat { ref field, .. }) if field == "label"
+            ),
+            "a 65-byte label was not refused, got {:?}",
+            label_at_65.validate("label")
+        );
+
+        // S5: NUL is refused as a label byte, not merely as one more
+        // non-alphanumeric character that happens to be caught by coincidence.
+        refused("a\u{0}b", "NUL is not a label byte");
+    }
+
+    /// The two doors added beside `Slug::validate_slug` (RS-L), on its
+    /// pattern: each delegates to the grammar its own document field already
+    /// carries, so a declared name checked through the door and a field of
+    /// the same type refuse the same inputs. `OrgRepo` is the `repo` alias's
+    /// domain and `Label` is the `cut` alias's (RS-3's vocabulary table).
+    #[test]
+    fn the_org_repo_and_label_doors_are_the_grammar() {
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").validate_org_repo(), Ok(()));
+        assert_eq!(OrgRepo::from("a/b").validate_org_repo(), Ok(()));
+        assert_eq!(OrgRepo::from("a-b/c.d_e").validate_org_repo(), Ok(()));
+        // Consecutive hyphens stay allowed on both sides; only a leading or
+        // trailing owner hyphen is refused.
+        assert_eq!(OrgRepo::from("a--b/c--d").validate_org_repo(), Ok(()));
+        // S4: a 39-byte owner is accepted, a 100-byte repo is accepted.
+        let owner_at_39 = format!("{}/b", "a".repeat(39));
+        assert_eq!(OrgRepo::from(owner_at_39.as_str()).validate_org_repo(), Ok(()));
+        let repo_at_100 = format!("a/{}", "a".repeat(100));
+        assert_eq!(OrgRepo::from(repo_at_100.as_str()).validate_org_repo(), Ok(()));
+        let repo_refused = |value: &str, why: &str| {
+            let result = OrgRepo::from(value).validate_org_repo();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "org_repo"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+        repo_refused("GameCult", "no slash at all");
+        repo_refused("/Repo", "an empty org before the slash");
+        repo_refused("GameCult/", "an empty repo after the slash");
+        repo_refused("a/b/c", "a second slash makes the repo half ambiguous");
+        repo_refused("../..", "an owner of dots is not GitHub's grammar");
+        repo_refused("a/..", "a repo of .. is refused outright");
+        repo_refused("a/.", "a repo of . is refused outright");
+        repo_refused("-a/b", "a leading hyphen is not a valid owner");
+        repo_refused("a-/b", "a trailing hyphen is not a valid owner");
+        repo_refused("a b/c", "a space is not an owner byte");
+        repo_refused("a/b c", "a space is not a repo byte");
+        repo_refused("\u{e9}/\u{fc}", "non-ascii bytes are refused on either side");
+        repo_refused("\0/\0", "NUL is refused on either side");
+        repo_refused("a\n/b", "a newline is not an owner byte");
+        let owner_at_40 = format!("{}/b", "a".repeat(40));
+        repo_refused(&owner_at_40, "40 bytes is past the 39-byte owner bound");
+        let repo_at_101 = format!("a/{}", "a".repeat(101));
+        repo_refused(&repo_at_101, "101 bytes is past the 100-byte repo bound");
+        repo_refused("a//b", "an empty middle segment is still a second slash");
+        repo_refused("/b", "an empty owner is refused");
+        repo_refused("a/", "an empty repo is refused");
+        repo_refused("a.b/c", "a dot is not an owner byte");
+        repo_refused("a_b/c", "an underscore is not an owner byte");
+        // F7 fix batch: a repo name ending in `.git` is refused.
+        repo_refused("a/b.git", "a repo ending in .git is refused");
+        repo_refused("a/.git", "a repo of exactly .git is still a .git suffix");
+        // S-2: the `.git` refusal is ASCII-case-insensitive, so a case variant
+        // cannot dodge it and reach an `identity()` the validator refuses.
+        repo_refused("a/b.GIT", "a repo ending in .GIT is refused like .git");
+        repo_refused("a/.GIT", "a repo of exactly .GIT is still a .git suffix");
+        repo_refused("A/B.GIT", "a mixed-case owner and a .GIT repo both refuse");
+        repo_refused("a/b.GiT", "a mixed-case .git suffix is refused");
+
+        // identity(): the one canonical key, ASCII-lowercased. Every
+        // comparison, hash, ordering and key derivation goes through it.
+        assert_eq!(
+            OrgRepo::from("GameCult/Epiphany").identity(),
+            OrgRepo::from("gamecult/epiphany").identity()
+        );
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").identity(), "gamecult/epiphany");
+
+        // S-1: it is structural, not advisory. `==` on `OrgRepo` compares
+        // identity, not the raw string, so the two spellings are one
+        // repository wherever `OrgRepo` is compared, hashed or ordered.
+        assert_eq!(OrgRepo::from("GameCult/Epiphany"), OrgRepo::from("gamecult/epiphany"));
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany")), std::cmp::Ordering::Equal);
+        assert_eq!(
+            OrgRepo::from("GameCult/Epiphany").partial_cmp(&OrgRepo::from("gamecult/epiphany")),
+            Some(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany"))),
+            "partial_cmp must agree with cmp for an equal pair"
+        );
+
+        // RS-L closing fix 1: every assertion above compares values that
+        // should be equal, so `eq -> true`, `hash -> ()` and `cmp -> Equal`
+        // all survive as mutants. Pin the unequal direction as well: two
+        // different repos must be unequal, hash differently (with
+        // overwhelming probability, not by construction, so this is belt and
+        // suspenders on top of the `!=` and `cmp` checks), and not compare
+        // `Equal`, and `partial_cmp` must agree with `cmp` for an unequal
+        // pair too, per std's own contract that `partial_cmp(a, b) ==
+        // Some(cmp(a, b))`.
+        let a = OrgRepo::from("GameCult/Epiphany");
+        let b = OrgRepo::from("GameCult/Aetheria");
+        assert_ne!(a, b, "two different repos must not compare equal");
+        assert_ne!(
+            a.cmp(&b),
+            std::cmp::Ordering::Equal,
+            "two different repos must not order as Equal"
+        );
+        assert_eq!(
+            a.partial_cmp(&b),
+            Some(a.cmp(&b)),
+            "partial_cmp must agree with cmp for an unequal pair"
+        );
+        let hash_of = |repo: &OrgRepo| {
+            use std::hash::{Hash, Hasher};
+            let mut hasher = std::collections::hash_map::DefaultHasher::new();
+            repo.hash(&mut hasher);
+            hasher.finish()
+        };
+        assert_ne!(
+            hash_of(&a),
+            hash_of(&b),
+            "two different repos must hash differently"
+        );
+
+        let mut hash_map = std::collections::HashMap::new();
+        hash_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
+        hash_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
+        assert_eq!(hash_map.len(), 1, "a HashMap keyed by both spellings holds one entry");
+        assert_eq!(hash_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
+
+        let mut btree_map = std::collections::BTreeMap::new();
+        btree_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
+        btree_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
+        assert_eq!(btree_map.len(), 1, "a BTreeMap keyed by both spellings holds one entry");
+        assert_eq!(btree_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
+
+        // `identity()` is always itself a valid `OrgRepo`: lowercasing never
+        // turns a valid repository into one the grammar refuses, and never
+        // turns a refused one into one it accepts.
+        for value in ["GameCult/Epiphany", "A/B", "a-B/c.D_e", "GameCult/Epiphany.GIT"] {
+            let repo = OrgRepo::from(value);
+            assert_eq!(
+                repo.validate_org_repo().is_ok(),
+                OrgRepo::from(repo.identity().as_str()).validate_org_repo().is_ok(),
+                "identity() of {value:?} disagreed with the value's own validity"
+            );
+        }
+
+        assert_eq!(Label::from("cut-10").validate_label(), Ok(()));
+        let label_refused = |value: &str, why: &str| {
+            let result = Label::from(value).validate_label();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "label"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+        label_refused("", "the empty string has no label");
+        label_refused("a.b", "a dot is not a label byte");
+        label_refused(&"a".repeat(65), "65 bytes is past the 64-byte label bound");
+        label_refused("\u{e9}", "a non-ascii byte is not a label byte");
+    }
+
+    /// Q-RS1, ruled B: `question` and `ruling` gain a required `title`, the
+    /// new `Title` type shared with the two titles that move off `Short`
+    /// (campaign, cut spec). Each kind round-trips through `prepare`/`decode`
+    /// with its title intact, an empty title is refused for both, and the
+    /// bound is pinned at its edge: 200 bytes accepted, 201 refused (L3 dies
+    /// on the removal of the non-empty check, not on the length bound, since
+    /// `Title`'s length bound is shared with every other `bounded_text!`
+    /// member and already covered by `bounds_refuse_in_utf8_bytes`).
+    #[test]
+    fn question_and_ruling_carry_a_title() -> Result<()> {
+        let cache = schema_cache()?;
+
+        let mut question = question_sample();
+        question.title = t("Who owns the state?");
+        let envelope = PipelineDocument::Question(question.clone()).prepare(&cache)?;
+        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Question(question.clone()));
+
+        let mut ruling = ruling_sample();
+        ruling.title = t("An instance owns its mind");
+        let envelope = PipelineDocument::Ruling(ruling.clone()).prepare(&cache)?;
+        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Ruling(ruling.clone()));
+
+        question.title = Title(String::new());
+        assert_eq!(
+            PipelineDocument::Question(question.clone()).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: String::new() })
+        );
+        ruling.title = Title(String::new());
+        assert_eq!(
+            PipelineDocument::Ruling(ruling.clone()).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "ruling.title".into(), value: String::new() })
+        );
+
+        // F2 second fix batch: a title holds at least one
+        // `char::is_alphanumeric()` character, no `char::is_control()`
+        // character, and no bidi control character. No zero-width denylist:
+        // a zero-width joiner/non-joiner inside real text is allowed, and a
+        // string of nothing but invisible characters is refused because it
+        // has no alphanumeric character, not because those characters are
+        // individually denylisted.
+        let refused = |value: &str| {
+            let mut refused_question = question.clone();
+            refused_question.title = Title(value.into());
+            assert_eq!(
+                PipelineDocument::Question(refused_question).validate(),
+                Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: value.into() }),
+                "{value:?} should be refused"
+            );
+        };
+        refused(" ");
+        refused("\u{7f}");
+        refused("a\u{7f}");
+        refused("\u{0}");
+        refused("\u{9f}");
+        refused("\u{2028}");
+        refused("\u{202e}"); // RLO alone
+        refused("\u{202e}text"); // RLO plus text
+        refused("\u{200e}"); // LRM alone
+        refused("\u{0301}"); // a lone combining mark
+        refused("\u{fe0f}"); // a variation selector alone
+        refused("\u{a0}"); // NBSP alone
+        refused("\u{1f680}"); // emoji only
+
+        // S-3: every one of the twelve bidi control code points is pinned
+        // with an embedded fixture (real alphanumeric text on both sides), so
+        // the alphanumeric rule cannot mask a hole in the bidi match arm the
+        // way a lone-character fixture would.
+        refused("a\u{061C}b"); // ALM
+        refused("a\u{200E}b"); // LRM
+        refused("a\u{200F}b"); // RLM
+        refused("a\u{202A}b"); // LRE
+        refused("a\u{202B}b"); // RLE
+        refused("a\u{202C}b"); // PDF
+        refused("a\u{202D}b"); // LRO
+        refused("a\u{202E}b"); // RLO
+        refused("a\u{2066}b"); // LRI
+        refused("a\u{2067}b"); // RLI
+        refused("a\u{2068}b"); // FSI
+        refused("a\u{2069}b"); // PDI
+
+        // S-4: U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR are
+        // refused inside otherwise-alphanumeric text, not only alone, since
+        // `char::is_control()` does not reach `Zl`/`Zp`.
+        refused("a\u{2028}b");
+        refused("a\u{2029}b");
+
+        let accepted = |value: &str| {
+            let mut accepted_question = question.clone();
+            accepted_question.title = Title(value.into());
+            assert_eq!(
+                PipelineDocument::Question(accepted_question).validate(),
+                Ok(()),
+                "{value:?} should validate"
+            );
+        };
+        accepted("a");
+        accepted("\u{e9}");
+        accepted("\u{200c}\u{647}\u{6cc}"); // Persian text containing ZWNJ
+        accepted("a\u{200d}b");
+        accepted("a \u{1f680}");
+        accepted(" a ");
+        // Discrepancy from the fix spec: HANGUL FILLER (U+3164) is Unicode
+        // General_Category Lo, so `char::is_alphanumeric()` is true for it in
+        // this toolchain; it is not a denylist candidate, since the fix
+        // batch deletes the hand-written exclusion list on purpose. A title
+        // of U+3164 alone is therefore accepted, not refused.
+        accepted("\u{3164}");
+
+        question.title = Title("a".repeat(200));
+        assert_eq!(PipelineDocument::Question(question.clone()).validate(), Ok(()));
+        question.title = Title("a".repeat(201));
+        assert_eq!(
+            PipelineDocument::Question(question).validate(),
+            Err(PipelineRefusal::FieldBound { field: "question.title".into(), limit: 200, actual: 201 })
+        );
+        Ok(())
+    }
+}
diff --git a/schemas/README.md b/schemas/README.md
new file mode 100644
index 0000000..eac141b
--- /dev/null
+++ b/schemas/README.md
@@ -0,0 +1,47 @@
+# Schemas
+
+This folder is the canonical paperwork shrine for Epiphany's shared state
+contracts.
+
+If a Persona field or Mind document matters
+enough to steer the machine, it should have a receipt here instead of living
+only in one Rust struct or one developer's damp recollection.
+
+## Canonical surfaces
+
+- [cultnet/gamecult.persona_state.v0.schema.json](./cultnet/gamecult.persona_state.v0.schema.json):
+  portable Persona state contract for Epiphany Persona, VoidBot repo Personas, and
+  Ghostlight characters. It carries explicit provenance, public presentation
+  metadata, typed `candidateActions`, and a non-authoritative extension bag for
+  source-specific fields; social bonds, status reads, and doctrine stances are
+  typed affect records rather than generic thought blobs. Timestamps use JSON
+  Schema `date-time`, `presentation` is required, and `custom` enum values have
+  companion custom-label fields.
+- [cultnet/epiphany.work_organ_state.v0.schema.json](./cultnet/epiphany.work_organ_state.v0.schema.json):
+  light function-shaped state for Epiphany internal work organs.
+- [cultnet/README.md](./cultnet/README.md):
+  JSON Schema publication artifacts for typed CultNet boundaries. Live
+  providers own their schema-catalog responses.
+
+## Source Of Truth
+
+The living implementation is in code:
+
+- [mind_documents.rs](/F:/Projects/Epiphany/epiphany-core/src/mind_documents.rs)
+
+The rule is simple:
+
+- code owns executable truth
+- this folder owns human-readable contract receipts
+- vendored copies are downstream, not the throne
+
+## Update Discipline
+
+When changing any of the following, update this folder in the same pass:
+
+- canonical organ-state or Persona family names
+- standing role trait names
+- schema version identifiers
+
+If a change lands in code without a matching receipt here, assume the machine
+has started whispering to itself in the walls again.
diff --git a/schemas/cultnet/epiphany.pipeline.campaign.v2.schema.json b/schemas/cultnet/epiphany.pipeline.campaign.v2.schema.json
new file mode 100644
index 0000000..d02ba0e
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.campaign.v2.schema.json
@@ -0,0 +1,89 @@
+{
+  "$defs": {
+    "DocRef": {
+      "properties": {
+        "commit": {
+          "$ref": "#/$defs/Sha"
+        },
+        "end_line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "$ref": "#/$defs/Short"
+        },
+        "start_line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "path",
+        "start_line",
+        "end_line",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "OrgRepo": {
+      "description": "A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +\n100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or\ntrailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never\n`.` or `..`, and does not end in `.git`, ASCII-case-insensitively.\nIdentity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`\nare the same repository.",
+      "maxLength": 140,
+      "type": "string"
+    },
+    "Sha": {
+      "description": "A git commit id: 7-40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Title": {
+      "description": "A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema\nlength counts characters. Holds at least one alphanumeric character,\nno control character, and no bidi control character (`U+061C`,\n`U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).",
+      "maxLength": 200,
+      "minLength": 1,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.campaign.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "repos": {
+      "items": {
+        "$ref": "#/$defs/OrgRepo"
+      },
+      "maxItems": 8,
+      "type": "array"
+    },
+    "slug": {
+      "$ref": "#/$defs/Slug"
+    },
+    "target_doc": {
+      "$ref": "#/$defs/DocRef"
+    },
+    "title": {
+      "$ref": "#/$defs/Title"
+    },
+    "working_branch": {
+      "$ref": "#/$defs/Short"
+    }
+  },
+  "required": [
+    "slug",
+    "title",
+    "repos",
+    "working_branch",
+    "target_doc"
+  ],
+  "title": "PipelineCampaign",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.cut_report.v2.schema.json b/schemas/cultnet/epiphany.pipeline.cut_report.v2.schema.json
new file mode 100644
index 0000000..5d4947c
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.cut_report.v2.schema.json
@@ -0,0 +1,375 @@
+{
+  "$defs": {
+    "CodeLocation": {
+      "properties": {
+        "end_line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "$ref": "#/$defs/Short"
+        }
+      },
+      "required": [
+        "path",
+        "line"
+      ],
+      "type": "object"
+    },
+    "CommitRange": {
+      "properties": {
+        "base": {
+          "$ref": "#/$defs/Sha"
+        },
+        "head": {
+          "$ref": "#/$defs/Sha"
+        }
+      },
+      "required": [
+        "base",
+        "head"
+      ],
+      "type": "object"
+    },
+    "Deviation": {
+      "properties": {
+        "what": {
+          "$ref": "#/$defs/Line"
+        },
+        "why": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "what",
+        "why"
+      ],
+      "type": "object"
+    },
+    "Evidence": {
+      "properties": {
+        "kind": {
+          "$ref": "#/$defs/EvidenceKind"
+        },
+        "locator": {
+          "$ref": "#/$defs/Line"
+        },
+        "result": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "kind",
+        "locator",
+        "result"
+      ],
+      "type": "object"
+    },
+    "EvidenceKind": {
+      "enum": [
+        "Command",
+        "Test",
+        "Mutation",
+        "Probe",
+        "SourceRead",
+        "Capture"
+      ],
+      "type": "string"
+    },
+    "Label": {
+      "description": "A key label: `[A-Za-z0-9_-]{1,64}`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "LandedName": {
+      "description": "A name the cut landed, and where it lives.",
+      "properties": {
+        "name": {
+          "$ref": "#/$defs/Short"
+        },
+        "path": {
+          "$ref": "#/$defs/Short"
+        }
+      },
+      "required": [
+        "name",
+        "path"
+      ],
+      "type": "object"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "MutationRecord": {
+      "description": "One mutation a report ran: a key-safe label a verdict claim can name,\nthe exact edit, and the tree it was applied to.",
+      "properties": {
+        "after": {
+          "$ref": "#/$defs/Line"
+        },
+        "before": {
+          "$ref": "#/$defs/Line"
+        },
+        "commit": {
+          "$ref": "#/$defs/Sha"
+        },
+        "failed_as_expected": {
+          "type": "boolean"
+        },
+        "label": {
+          "$ref": "#/$defs/Label"
+        },
+        "location": {
+          "$ref": "#/$defs/CodeLocation"
+        },
+        "rule": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "label",
+        "rule",
+        "location",
+        "before",
+        "after",
+        "commit",
+        "failed_as_expected"
+      ],
+      "type": "object"
+    },
+    "OrgRepo": {
+      "description": "A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +\n100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or\ntrailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never\n`.` or `..`, and does not end in `.git`, ASCII-case-insensitively.\nIdentity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`\nare the same repository.",
+      "maxLength": 140,
+      "type": "string"
+    },
+    "Promise": {
+      "description": "A promise a report makes about what it landed. Not a document and not\nresolvable: it is identified by its report's id and its label, as a\n`TargetInvariant` is by its target's. Soul measures every one (ruling\nA), and the rule that every one is measured is admission's.",
+      "properties": {
+        "label": {
+          "$ref": "#/$defs/Label"
+        },
+        "text": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "label",
+        "text"
+      ],
+      "type": "object"
+    },
+    "ReportCommit": {
+      "properties": {
+        "builds": {
+          "type": "boolean"
+        },
+        "sha": {
+          "$ref": "#/$defs/Sha"
+        },
+        "subject": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "sha",
+        "subject",
+        "builds"
+      ],
+      "type": "object"
+    },
+    "Sha": {
+      "description": "A git commit id: 7-40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "StructuralDelta": {
+      "properties": {
+        "dependencies_added": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "dependencies_removed": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "formats_added": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "formats_removed": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "lines_added": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "lines_removed": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "targets_added": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "targets_removed": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        }
+      },
+      "required": [
+        "lines_added",
+        "lines_removed",
+        "dependencies_added",
+        "dependencies_removed",
+        "formats_added",
+        "formats_removed",
+        "targets_added",
+        "targets_removed"
+      ],
+      "type": "object"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.cut_report.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "attempt": {
+      "format": "uint32",
+      "minimum": 0,
+      "type": "integer"
+    },
+    "branch": {
+      "$ref": "#/$defs/Short"
+    },
+    "campaign": {
+      "$ref": "#/$defs/Slug"
+    },
+    "commits": {
+      "items": {
+        "$ref": "#/$defs/ReportCommit"
+      },
+      "maxItems": 128,
+      "type": "array"
+    },
+    "cut_spec": {
+      "$ref": "#/$defs/Short"
+    },
+    "deviations": {
+      "items": {
+        "$ref": "#/$defs/Deviation"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "forks": {
+      "items": {
+        "$ref": "#/$defs/Short"
+      },
+      "maxItems": 8,
+      "type": "array"
+    },
+    "landed_names": {
+      "items": {
+        "$ref": "#/$defs/LandedName"
+      },
+      "maxItems": 128,
+      "type": "array"
+    },
+    "mutations": {
+      "items": {
+        "$ref": "#/$defs/MutationRecord"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "promises": {
+      "items": {
+        "$ref": "#/$defs/Promise"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "range": {
+      "$ref": "#/$defs/CommitRange"
+    },
+    "repo": {
+      "$ref": "#/$defs/OrgRepo"
+    },
+    "structural_delta": {
+      "$ref": "#/$defs/StructuralDelta"
+    },
+    "undone": {
+      "items": {
+        "$ref": "#/$defs/Line"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "verification": {
+      "items": {
+        "$ref": "#/$defs/Evidence"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "required": [
+    "campaign",
+    "cut_spec",
+    "attempt",
+    "repo",
+    "branch",
+    "commits",
+    "range",
+    "verification",
+    "mutations",
+    "deviations",
+    "forks",
+    "structural_delta",
+    "landed_names",
+    "undone",
+    "promises"
+  ],
+  "title": "PipelineCutReport",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.cut_spec.v2.schema.json b/schemas/cultnet/epiphany.pipeline.cut_spec.v2.schema.json
new file mode 100644
index 0000000..47a0fc1
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.cut_spec.v2.schema.json
@@ -0,0 +1,412 @@
+{
+  "$defs": {
+    "AuthorityMap": {
+      "properties": {
+        "deletion_line": {
+          "$ref": "#/$defs/Line"
+        },
+        "derived_state": {
+          "items": {
+            "$ref": "#/$defs/Line"
+          },
+          "maxItems": 16,
+          "type": "array"
+        },
+        "forbidden_writers": {
+          "items": {
+            "$ref": "#/$defs/Line"
+          },
+          "maxItems": 16,
+          "type": "array"
+        },
+        "inputs": {
+          "items": {
+            "$ref": "#/$defs/Line"
+          },
+          "maxItems": 16,
+          "type": "array"
+        },
+        "outputs": {
+          "items": {
+            "$ref": "#/$defs/Line"
+          },
+          "maxItems": 16,
+          "type": "array"
+        },
+        "owner": {
+          "$ref": "#/$defs/Line"
+        },
+        "shared_paths": {
+          "items": {
+            "$ref": "#/$defs/Line"
+          },
+          "maxItems": 16,
+          "type": "array"
+        }
+      },
+      "required": [
+        "owner",
+        "inputs",
+        "outputs",
+        "derived_state",
+        "forbidden_writers",
+        "shared_paths",
+        "deletion_line"
+      ],
+      "type": "object"
+    },
+    "CodeLocation": {
+      "properties": {
+        "end_line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "$ref": "#/$defs/Short"
+        }
+      },
+      "required": [
+        "path",
+        "line"
+      ],
+      "type": "object"
+    },
+    "CutDelete": {
+      "properties": {
+        "lines": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "note": {
+          "$ref": "#/$defs/Line"
+        },
+        "path": {
+          "$ref": "#/$defs/Short"
+        }
+      },
+      "required": [
+        "path",
+        "lines",
+        "note"
+      ],
+      "type": "object"
+    },
+    "CutVerification": {
+      "properties": {
+        "builds": {
+          "items": {
+            "$ref": "#/$defs/Line"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "negative": {
+          "items": {
+            "$ref": "#/$defs/NegativeCheck"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "operator": {
+          "items": {
+            "$ref": "#/$defs/Line"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "tests": {
+          "items": {
+            "$ref": "#/$defs/VerificationTest"
+          },
+          "maxItems": 64,
+          "type": "array"
+        }
+      },
+      "required": [
+        "builds",
+        "tests",
+        "negative",
+        "operator"
+      ],
+      "type": "object"
+    },
+    "FileChange": {
+      "properties": {
+        "change": {
+          "$ref": "#/$defs/Line"
+        },
+        "location": {
+          "$ref": "#/$defs/CodeLocation"
+        }
+      },
+      "required": [
+        "location",
+        "change"
+      ],
+      "type": "object"
+    },
+    "Label": {
+      "description": "A key label: `[A-Za-z0-9_-]{1,64}`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "NegativeCheck": {
+      "properties": {
+        "pattern": {
+          "$ref": "#/$defs/Short"
+        },
+        "scope": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "pattern",
+        "scope"
+      ],
+      "type": "object"
+    },
+    "OrgRepo": {
+      "description": "A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +\n100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or\ntrailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never\n`.` or `..`, and does not end in `.git`, ASCII-case-insensitively.\nIdentity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`\nare the same repository.",
+      "maxLength": 140,
+      "type": "string"
+    },
+    "Sha": {
+      "description": "A git commit id: 7-40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "StructuralDelta": {
+      "properties": {
+        "dependencies_added": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "dependencies_removed": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "formats_added": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "formats_removed": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "lines_added": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "lines_removed": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "targets_added": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        },
+        "targets_removed": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 64,
+          "type": "array"
+        }
+      },
+      "required": [
+        "lines_added",
+        "lines_removed",
+        "dependencies_added",
+        "dependencies_removed",
+        "formats_added",
+        "formats_removed",
+        "targets_added",
+        "targets_removed"
+      ],
+      "type": "object"
+    },
+    "Title": {
+      "description": "A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema\nlength counts characters. Holds at least one alphanumeric character,\nno control character, and no bidi control character (`U+061C`,\n`U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).",
+      "maxLength": 200,
+      "minLength": 1,
+      "type": "string"
+    },
+    "VerificationTest": {
+      "properties": {
+        "name": {
+          "$ref": "#/$defs/Short"
+        },
+        "pins": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "name",
+        "pins"
+      ],
+      "type": "object"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.cut_spec.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "adds": {
+      "items": {
+        "$ref": "#/$defs/Line"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "authority_map": {
+      "anyOf": [
+        {
+          "$ref": "#/$defs/AuthorityMap"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "base": {
+      "$ref": "#/$defs/Sha"
+    },
+    "branch": {
+      "$ref": "#/$defs/Short"
+    },
+    "campaign": {
+      "$ref": "#/$defs/Slug"
+    },
+    "cut": {
+      "$ref": "#/$defs/Label"
+    },
+    "deletes": {
+      "items": {
+        "$ref": "#/$defs/CutDelete"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "depends_on": {
+      "items": {
+        "$ref": "#/$defs/Short"
+      },
+      "maxItems": 8,
+      "type": "array"
+    },
+    "estimate": {
+      "$ref": "#/$defs/StructuralDelta"
+    },
+    "file_changes": {
+      "items": {
+        "$ref": "#/$defs/FileChange"
+      },
+      "maxItems": 256,
+      "type": "array"
+    },
+    "first": {
+      "items": {
+        "$ref": "#/$defs/Line"
+      },
+      "maxItems": 16,
+      "type": "array"
+    },
+    "keeps_moves": {
+      "items": {
+        "$ref": "#/$defs/Line"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "questions": {
+      "items": {
+        "$ref": "#/$defs/Short"
+      },
+      "maxItems": 16,
+      "type": "array"
+    },
+    "repo": {
+      "$ref": "#/$defs/OrgRepo"
+    },
+    "revision": {
+      "format": "uint32",
+      "minimum": 0,
+      "type": "integer"
+    },
+    "rulings": {
+      "items": {
+        "$ref": "#/$defs/Short"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "title": {
+      "$ref": "#/$defs/Title"
+    },
+    "verification": {
+      "$ref": "#/$defs/CutVerification"
+    }
+  },
+  "required": [
+    "campaign",
+    "cut",
+    "revision",
+    "title",
+    "repo",
+    "branch",
+    "base",
+    "depends_on",
+    "first",
+    "deletes",
+    "keeps_moves",
+    "adds",
+    "file_changes",
+    "verification",
+    "estimate",
+    "rulings",
+    "questions"
+  ],
+  "title": "PipelineCutSpec",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.finding.v2.schema.json b/schemas/cultnet/epiphany.pipeline.finding.v2.schema.json
new file mode 100644
index 0000000..798ce0d
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.finding.v2.schema.json
@@ -0,0 +1,264 @@
+{
+  "$defs": {
+    "CodeLocation": {
+      "properties": {
+        "end_line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "$ref": "#/$defs/Short"
+        }
+      },
+      "required": [
+        "path",
+        "line"
+      ],
+      "type": "object"
+    },
+    "CommitRange": {
+      "properties": {
+        "base": {
+          "$ref": "#/$defs/Sha"
+        },
+        "head": {
+          "$ref": "#/$defs/Sha"
+        }
+      },
+      "required": [
+        "base",
+        "head"
+      ],
+      "type": "object"
+    },
+    "Evidence": {
+      "properties": {
+        "kind": {
+          "$ref": "#/$defs/EvidenceKind"
+        },
+        "locator": {
+          "$ref": "#/$defs/Line"
+        },
+        "result": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "kind",
+        "locator",
+        "result"
+      ],
+      "type": "object"
+    },
+    "EvidenceKind": {
+      "enum": [
+        "Command",
+        "Test",
+        "Mutation",
+        "Probe",
+        "SourceRead",
+        "Capture"
+      ],
+      "type": "string"
+    },
+    "FindingConfidence": {
+      "enum": [
+        "Confirmed",
+        "Plausible"
+      ],
+      "type": "string"
+    },
+    "FindingOrigin": {
+      "enum": [
+        "Introduced",
+        "PreExisting"
+      ],
+      "type": "string"
+    },
+    "FindingSeverity": {
+      "enum": [
+        "Blocker",
+        "High",
+        "Medium",
+        "Low"
+      ],
+      "type": "string"
+    },
+    "ForeignRef": {
+      "description": "A citation of a document in another repo's pipeline store (D6).",
+      "properties": {
+        "commit": {
+          "$ref": "#/$defs/FullSha"
+        },
+        "id": {
+          "$ref": "#/$defs/Short"
+        },
+        "kind": {
+          "$ref": "#/$defs/PipelineKind"
+        },
+        "payload_sha256": {
+          "$ref": "#/$defs/Sha256Hex"
+        },
+        "repo": {
+          "$ref": "#/$defs/OrgRepo"
+        }
+      },
+      "required": [
+        "repo",
+        "commit",
+        "kind",
+        "id",
+        "payload_sha256"
+      ],
+      "type": "object"
+    },
+    "FullSha": {
+      "description": "A full git commit id: exactly 40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Label": {
+      "description": "A key label: `[A-Za-z0-9_-]{1,64}`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "OrgRepo": {
+      "description": "A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +\n100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or\ntrailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never\n`.` or `..`, and does not end in `.git`, ASCII-case-insensitively.\nIdentity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`\nare the same repository.",
+      "maxLength": 140,
+      "type": "string"
+    },
+    "Para": {
+      "description": "Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.",
+      "maxLength": 4000,
+      "type": "string"
+    },
+    "PipelineKind": {
+      "enum": [
+        "Campaign",
+        "Target",
+        "Question",
+        "Ruling",
+        "CutSpec",
+        "CutReport",
+        "Verdict",
+        "Finding",
+        "FollowUp",
+        "Resolution",
+        "Instance",
+        "Stewardship",
+        "HandOff"
+      ],
+      "type": "string"
+    },
+    "Sha": {
+      "description": "A git commit id: 7-40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Sha256Hex": {
+      "description": "A SHA-256 digest: exactly 64 lowercase hex characters.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.finding.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "campaign": {
+      "$ref": "#/$defs/Slug"
+    },
+    "claim": {
+      "$ref": "#/$defs/Line"
+    },
+    "confidence": {
+      "$ref": "#/$defs/FindingConfidence"
+    },
+    "evidence": {
+      "items": {
+        "$ref": "#/$defs/Evidence"
+      },
+      "maxItems": 16,
+      "type": "array"
+    },
+    "failure_scenario": {
+      "$ref": "#/$defs/Para"
+    },
+    "invariants": {
+      "items": {
+        "$ref": "#/$defs/Label"
+      },
+      "maxItems": 8,
+      "type": "array"
+    },
+    "label": {
+      "$ref": "#/$defs/Label"
+    },
+    "locations": {
+      "items": {
+        "$ref": "#/$defs/CodeLocation"
+      },
+      "maxItems": 16,
+      "type": "array"
+    },
+    "origin": {
+      "$ref": "#/$defs/FindingOrigin"
+    },
+    "precedents": {
+      "items": {
+        "$ref": "#/$defs/ForeignRef"
+      },
+      "maxItems": 8,
+      "type": "array"
+    },
+    "range": {
+      "$ref": "#/$defs/CommitRange"
+    },
+    "severity": {
+      "$ref": "#/$defs/FindingSeverity"
+    },
+    "verdict": {
+      "$ref": "#/$defs/Short"
+    }
+  },
+  "required": [
+    "campaign",
+    "verdict",
+    "label",
+    "range",
+    "confidence",
+    "severity",
+    "claim",
+    "invariants",
+    "locations",
+    "failure_scenario",
+    "evidence",
+    "precedents",
+    "origin"
+  ],
+  "title": "PipelineFinding",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.follow_up.v2.schema.json b/schemas/cultnet/epiphany.pipeline.follow_up.v2.schema.json
new file mode 100644
index 0000000..c624c04
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.follow_up.v2.schema.json
@@ -0,0 +1,132 @@
+{
+  "$defs": {
+    "CodeLocation": {
+      "properties": {
+        "end_line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "$ref": "#/$defs/Short"
+        }
+      },
+      "required": [
+        "path",
+        "line"
+      ],
+      "type": "object"
+    },
+    "Label": {
+      "description": "A key label: `[A-Za-z0-9_-]{1,64}`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "OrgRepo": {
+      "description": "A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +\n100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or\ntrailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never\n`.` or `..`, and does not end in `.git`, ASCII-case-insensitively.\nIdentity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`\nare the same repository.",
+      "maxLength": 140,
+      "type": "string"
+    },
+    "PipelineKind": {
+      "enum": [
+        "Campaign",
+        "Target",
+        "Question",
+        "Ruling",
+        "CutSpec",
+        "CutReport",
+        "Verdict",
+        "Finding",
+        "FollowUp",
+        "Resolution",
+        "Instance",
+        "Stewardship",
+        "HandOff"
+      ],
+      "type": "string"
+    },
+    "PipelineRef": {
+      "description": "A reference to another document. The id is parsed as a full pipeline id of\nthe declared `kind`, so the kind and the id's kind segment cannot disagree.",
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Short"
+        },
+        "kind": {
+          "$ref": "#/$defs/PipelineKind"
+        }
+      },
+      "required": [
+        "kind",
+        "id"
+      ],
+      "type": "object"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.follow_up.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "campaign": {
+      "$ref": "#/$defs/Slug"
+    },
+    "item": {
+      "$ref": "#/$defs/Line"
+    },
+    "label": {
+      "$ref": "#/$defs/Label"
+    },
+    "locations": {
+      "items": {
+        "$ref": "#/$defs/CodeLocation"
+      },
+      "maxItems": 16,
+      "type": "array"
+    },
+    "owner": {
+      "$ref": "#/$defs/Short"
+    },
+    "repo": {
+      "$ref": "#/$defs/OrgRepo"
+    },
+    "source": {
+      "$ref": "#/$defs/PipelineRef"
+    },
+    "why_it_can_wait": {
+      "$ref": "#/$defs/Line"
+    }
+  },
+  "required": [
+    "campaign",
+    "label",
+    "source",
+    "repo",
+    "locations",
+    "item",
+    "why_it_can_wait",
+    "owner"
+  ],
+  "title": "PipelineFollowUp",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.hand_off.v2.schema.json b/schemas/cultnet/epiphany.pipeline.hand_off.v2.schema.json
new file mode 100644
index 0000000..8c38df5
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.hand_off.v2.schema.json
@@ -0,0 +1,66 @@
+{
+  "$defs": {
+    "Date": {
+      "description": "A calendar date, `YYYY-MM-DD`.",
+      "maxLength": 10,
+      "type": "string"
+    },
+    "OrgRepo": {
+      "description": "A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +\n100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or\ntrailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never\n`.` or `..`, and does not end in `.git`, ASCII-case-insensitively.\nIdentity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`\nare the same repository.",
+      "maxLength": 140,
+      "type": "string"
+    },
+    "Para": {
+      "description": "Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.",
+      "maxLength": 4000,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.hand_off.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "A reassignment of stewardship, recorded in both minds. `documents` names\nwhat travels with it.",
+  "properties": {
+    "documents": {
+      "items": {
+        "$ref": "#/$defs/Short"
+      },
+      "maxItems": 256,
+      "type": "array"
+    },
+    "from_instance": {
+      "$ref": "#/$defs/Slug"
+    },
+    "handed_on": {
+      "$ref": "#/$defs/Date"
+    },
+    "reason": {
+      "$ref": "#/$defs/Para"
+    },
+    "repo": {
+      "$ref": "#/$defs/OrgRepo"
+    },
+    "to_instance": {
+      "$ref": "#/$defs/Slug"
+    }
+  },
+  "required": [
+    "from_instance",
+    "to_instance",
+    "repo",
+    "documents",
+    "reason",
+    "handed_on"
+  ],
+  "title": "PipelineHandOff",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.instance.v2.schema.json b/schemas/cultnet/epiphany.pipeline.instance.v2.schema.json
new file mode 100644
index 0000000..50905d7
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.instance.v2.schema.json
@@ -0,0 +1,44 @@
+{
+  "$defs": {
+    "Date": {
+      "description": "A calendar date, `YYYY-MM-DD`.",
+      "maxLength": 10,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.instance.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "A mind's identity document. A store is canonical to exactly one\ninstance, and this says which; identity lives in the state, not in a\npath.",
+  "properties": {
+    "created_at": {
+      "$ref": "#/$defs/Date"
+    },
+    "display_name": {
+      "$ref": "#/$defs/Short"
+    },
+    "host": {
+      "$ref": "#/$defs/Short"
+    },
+    "instance": {
+      "$ref": "#/$defs/Slug"
+    }
+  },
+  "required": [
+    "instance",
+    "display_name",
+    "created_at",
+    "host"
+  ],
+  "title": "PipelineInstance",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.question.v2.schema.json b/schemas/cultnet/epiphany.pipeline.question.v2.schema.json
new file mode 100644
index 0000000..1fea941
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.question.v2.schema.json
@@ -0,0 +1,147 @@
+{
+  "$defs": {
+    "Date": {
+      "description": "A calendar date, `YYYY-MM-DD`.",
+      "maxLength": 10,
+      "type": "string"
+    },
+    "Label": {
+      "description": "A key label: `[A-Za-z0-9_-]{1,64}`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "Para": {
+      "description": "Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.",
+      "maxLength": 4000,
+      "type": "string"
+    },
+    "PipelineKind": {
+      "enum": [
+        "Campaign",
+        "Target",
+        "Question",
+        "Ruling",
+        "CutSpec",
+        "CutReport",
+        "Verdict",
+        "Finding",
+        "FollowUp",
+        "Resolution",
+        "Instance",
+        "Stewardship",
+        "HandOff"
+      ],
+      "type": "string"
+    },
+    "PipelineRef": {
+      "description": "A reference to another document. The id is parsed as a full pipeline id of\nthe declared `kind`, so the kind and the id's kind segment cannot disagree.",
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Short"
+        },
+        "kind": {
+          "$ref": "#/$defs/PipelineKind"
+        }
+      },
+      "required": [
+        "kind",
+        "id"
+      ],
+      "type": "object"
+    },
+    "QuestionOption": {
+      "properties": {
+        "label": {
+          "$ref": "#/$defs/Label"
+        },
+        "text": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "label",
+        "text"
+      ],
+      "type": "object"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Title": {
+      "description": "A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema\nlength counts characters. Holds at least one alphanumeric character,\nno control character, and no bidi control character (`U+061C`,\n`U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).",
+      "maxLength": 200,
+      "minLength": 1,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.question.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "asked_on": {
+      "$ref": "#/$defs/Date"
+    },
+    "campaign": {
+      "$ref": "#/$defs/Slug"
+    },
+    "depends": {
+      "items": {
+        "$ref": "#/$defs/Line"
+      },
+      "maxItems": 8,
+      "type": "array"
+    },
+    "label": {
+      "$ref": "#/$defs/Label"
+    },
+    "options": {
+      "items": {
+        "$ref": "#/$defs/QuestionOption"
+      },
+      "maxItems": 8,
+      "type": "array"
+    },
+    "question": {
+      "$ref": "#/$defs/Para"
+    },
+    "raised_in": {
+      "anyOf": [
+        {
+          "$ref": "#/$defs/PipelineRef"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "recommended": {
+      "$ref": "#/$defs/Label"
+    },
+    "title": {
+      "$ref": "#/$defs/Title"
+    }
+  },
+  "required": [
+    "campaign",
+    "label",
+    "title",
+    "question",
+    "options",
+    "recommended",
+    "depends",
+    "asked_on"
+  ],
+  "title": "PipelineQuestion",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.resolution.v2.schema.json b/schemas/cultnet/epiphany.pipeline.resolution.v2.schema.json
new file mode 100644
index 0000000..4d9c9c1
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.resolution.v2.schema.json
@@ -0,0 +1,234 @@
+{
+  "$defs": {
+    "Date": {
+      "description": "A calendar date, `YYYY-MM-DD`.",
+      "maxLength": 10,
+      "type": "string"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "Para": {
+      "description": "Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.",
+      "maxLength": 4000,
+      "type": "string"
+    },
+    "PipelineKind": {
+      "enum": [
+        "Campaign",
+        "Target",
+        "Question",
+        "Ruling",
+        "CutSpec",
+        "CutReport",
+        "Verdict",
+        "Finding",
+        "FollowUp",
+        "Resolution",
+        "Instance",
+        "Stewardship",
+        "HandOff"
+      ],
+      "type": "string"
+    },
+    "PipelineRef": {
+      "description": "A reference to another document. The id is parsed as a full pipeline id of\nthe declared `kind`, so the kind and the id's kind segment cannot disagree.",
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Short"
+        },
+        "kind": {
+          "$ref": "#/$defs/PipelineKind"
+        }
+      },
+      "required": [
+        "kind",
+        "id"
+      ],
+      "type": "object"
+    },
+    "ResolutionOutcome": {
+      "description": "How a subject was resolved. Every referent is a parsed `PipelineRef`, so a\nresolution names its records by ids of the kinds they declare, validated\nwhere every other referent is; a `Fixed` commit is a `Sha` whose referent\nis outside the document set (ruling B). Whether a named document exists,\nand how many may supersede one subject, are admission's rules.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "description": "Overturned, in whole or in part, by later records. The list is bounded\nhere because the enum is outside `value_types!`, the only place a list\nmaximum is emitted automatically.",
+          "properties": {
+            "Superseded": {
+              "properties": {
+                "by": {
+                  "items": {
+                    "$ref": "#/$defs/PipelineRef"
+                  },
+                  "maxItems": 8,
+                  "type": "array"
+                }
+              },
+              "required": [
+                "by"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "Superseded"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "Answered": {
+              "properties": {
+                "by": {
+                  "$ref": "#/$defs/PipelineRef"
+                }
+              },
+              "required": [
+                "by"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "Answered"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "Fixed": {
+              "properties": {
+                "by": {
+                  "anyOf": [
+                    {
+                      "$ref": "#/$defs/PipelineRef"
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ]
+                },
+                "commit": {
+                  "$ref": "#/$defs/Sha"
+                }
+              },
+              "required": [
+                "commit"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "Fixed"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "Deferred": {
+              "properties": {
+                "to": {
+                  "$ref": "#/$defs/PipelineRef"
+                }
+              },
+              "required": [
+                "to"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "Deferred"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "Recorded": {
+              "properties": {
+                "reason": {
+                  "$ref": "#/$defs/Line"
+                }
+              },
+              "required": [
+                "reason"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "Recorded"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "Withdrawn": {
+              "properties": {
+                "reason": {
+                  "$ref": "#/$defs/Line"
+                }
+              },
+              "required": [
+                "reason"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "Withdrawn"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "Sha": {
+      "description": "A git commit id: 7-40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.resolution.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "The record of how a subject was closed and by what. `sequence` is per\nsubject and set by the writer, `1` for the first, and it is the last\npart of the key, so a subject's resolutions share a prefix and a\nwithdrawn one is kept under its subject rather than overwritten.\nWhether a sequence is the previous plus one, and whether an earlier\nresolution still stands, are admission's rules: this crate refuses\nneither `0` nor a gap, exactly as it refuses neither `revision: 0` nor\na `revision` with no predecessor.",
+  "properties": {
+    "outcome": {
+      "$ref": "#/$defs/ResolutionOutcome"
+    },
+    "rationale": {
+      "$ref": "#/$defs/Para"
+    },
+    "resolved_on": {
+      "$ref": "#/$defs/Date"
+    },
+    "sequence": {
+      "format": "uint32",
+      "minimum": 0,
+      "type": "integer"
+    },
+    "subject": {
+      "$ref": "#/$defs/PipelineRef"
+    }
+  },
+  "required": [
+    "subject",
+    "sequence",
+    "outcome",
+    "rationale",
+    "resolved_on"
+  ],
+  "title": "PipelineResolution",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.ruling.v2.schema.json b/schemas/cultnet/epiphany.pipeline.ruling.v2.schema.json
new file mode 100644
index 0000000..ce5720d
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.ruling.v2.schema.json
@@ -0,0 +1,174 @@
+{
+  "$defs": {
+    "Date": {
+      "description": "A calendar date, `YYYY-MM-DD`.",
+      "maxLength": 10,
+      "type": "string"
+    },
+    "ForeignRef": {
+      "description": "A citation of a document in another repo's pipeline store (D6).",
+      "properties": {
+        "commit": {
+          "$ref": "#/$defs/FullSha"
+        },
+        "id": {
+          "$ref": "#/$defs/Short"
+        },
+        "kind": {
+          "$ref": "#/$defs/PipelineKind"
+        },
+        "payload_sha256": {
+          "$ref": "#/$defs/Sha256Hex"
+        },
+        "repo": {
+          "$ref": "#/$defs/OrgRepo"
+        }
+      },
+      "required": [
+        "repo",
+        "commit",
+        "kind",
+        "id",
+        "payload_sha256"
+      ],
+      "type": "object"
+    },
+    "FullSha": {
+      "description": "A full git commit id: exactly 40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Label": {
+      "description": "A key label: `[A-Za-z0-9_-]{1,64}`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "OrgRepo": {
+      "description": "A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +\n100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or\ntrailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never\n`.` or `..`, and does not end in `.git`, ASCII-case-insensitively.\nIdentity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`\nare the same repository.",
+      "maxLength": 140,
+      "type": "string"
+    },
+    "Para": {
+      "description": "Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.",
+      "maxLength": 4000,
+      "type": "string"
+    },
+    "PipelineKind": {
+      "enum": [
+        "Campaign",
+        "Target",
+        "Question",
+        "Ruling",
+        "CutSpec",
+        "CutReport",
+        "Verdict",
+        "Finding",
+        "FollowUp",
+        "Resolution",
+        "Instance",
+        "Stewardship",
+        "HandOff"
+      ],
+      "type": "string"
+    },
+    "RulingAuthority": {
+      "enum": [
+        "Operator",
+        "Standing",
+        "Defaulted"
+      ],
+      "type": "string"
+    },
+    "Sha256Hex": {
+      "description": "A SHA-256 digest: exactly 64 lowercase hex characters.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Title": {
+      "description": "A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema\nlength counts characters. Holds at least one alphanumeric character,\nno control character, and no bidi control character (`U+061C`,\n`U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).",
+      "maxLength": 200,
+      "minLength": 1,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.ruling.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "answers": {
+      "anyOf": [
+        {
+          "$ref": "#/$defs/Short"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "authority": {
+      "$ref": "#/$defs/RulingAuthority"
+    },
+    "campaign": {
+      "$ref": "#/$defs/Slug"
+    },
+    "choice": {
+      "anyOf": [
+        {
+          "$ref": "#/$defs/Label"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "label": {
+      "$ref": "#/$defs/Label"
+    },
+    "operator_quote": {
+      "anyOf": [
+        {
+          "$ref": "#/$defs/Para"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "precedents": {
+      "items": {
+        "$ref": "#/$defs/ForeignRef"
+      },
+      "maxItems": 8,
+      "type": "array"
+    },
+    "ruled_on": {
+      "$ref": "#/$defs/Date"
+    },
+    "ruling": {
+      "$ref": "#/$defs/Para"
+    },
+    "title": {
+      "$ref": "#/$defs/Title"
+    }
+  },
+  "required": [
+    "campaign",
+    "label",
+    "title",
+    "ruling",
+    "ruled_on",
+    "precedents",
+    "authority"
+  ],
+  "title": "PipelineRuling",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.stewardship.v2.schema.json b/schemas/cultnet/epiphany.pipeline.stewardship.v2.schema.json
new file mode 100644
index 0000000..85b7261
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.stewardship.v2.schema.json
@@ -0,0 +1,55 @@
+{
+  "$defs": {
+    "Date": {
+      "description": "A calendar date, `YYYY-MM-DD`.",
+      "maxLength": 10,
+      "type": "string"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "OrgRepo": {
+      "description": "A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +\n100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or\ntrailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never\n`.` or `..`, and does not end in `.git`, ASCII-case-insensitively.\nIdentity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`\nare the same repository.",
+      "maxLength": 140,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.stewardship.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "Stewardship over a repo, as an assignment recorded in a mind. One\ninstance may steward several repos, so the repo is part of the key.\n`sequence` is per `(instance, repo)`, set by the writer, `1` for the\nfirst, so a repo transferred away and back is two records under one\nprefix rather than one document overwriting the other. `assigned_on`\nis a field, not a key part. As on a resolution, whether the sequence\nis the previous plus one, and which assignment is in force, are\nadmission's rules and not this crate's.",
+  "properties": {
+    "assigned_on": {
+      "$ref": "#/$defs/Date"
+    },
+    "instance": {
+      "$ref": "#/$defs/Slug"
+    },
+    "note": {
+      "$ref": "#/$defs/Line"
+    },
+    "repo": {
+      "$ref": "#/$defs/OrgRepo"
+    },
+    "sequence": {
+      "format": "uint32",
+      "minimum": 0,
+      "type": "integer"
+    }
+  },
+  "required": [
+    "instance",
+    "repo",
+    "sequence",
+    "assigned_on",
+    "note"
+  ],
+  "title": "PipelineStewardship",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.target.v2.schema.json b/schemas/cultnet/epiphany.pipeline.target.v2.schema.json
new file mode 100644
index 0000000..32a5ab3
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.target.v2.schema.json
@@ -0,0 +1,117 @@
+{
+  "$defs": {
+    "DocRef": {
+      "properties": {
+        "commit": {
+          "$ref": "#/$defs/Sha"
+        },
+        "end_line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "$ref": "#/$defs/Short"
+        },
+        "start_line": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "path",
+        "start_line",
+        "end_line",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "Label": {
+      "description": "A key label: `[A-Za-z0-9_-]{1,64}`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "Sha": {
+      "description": "A git commit id: 7-40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "TargetInvariant": {
+      "properties": {
+        "label": {
+          "$ref": "#/$defs/Label"
+        },
+        "statement": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "label",
+        "statement"
+      ],
+      "type": "object"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.target.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "campaign": {
+      "$ref": "#/$defs/Slug"
+    },
+    "canonical_implementations": {
+      "items": {
+        "$ref": "#/$defs/Line"
+      },
+      "maxItems": 16,
+      "type": "array"
+    },
+    "doc": {
+      "$ref": "#/$defs/DocRef"
+    },
+    "invariants": {
+      "items": {
+        "$ref": "#/$defs/TargetInvariant"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "not_in_scope": {
+      "items": {
+        "$ref": "#/$defs/Line"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "revision": {
+      "format": "uint32",
+      "minimum": 0,
+      "type": "integer"
+    }
+  },
+  "required": [
+    "campaign",
+    "revision",
+    "invariants",
+    "not_in_scope",
+    "canonical_implementations",
+    "doc"
+  ],
+  "title": "PipelineTarget",
+  "type": "object"
+}
diff --git a/schemas/cultnet/epiphany.pipeline.verdict.v2.schema.json b/schemas/cultnet/epiphany.pipeline.verdict.v2.schema.json
new file mode 100644
index 0000000..240931e
--- /dev/null
+++ b/schemas/cultnet/epiphany.pipeline.verdict.v2.schema.json
@@ -0,0 +1,166 @@
+{
+  "$defs": {
+    "ClaimOutcome": {
+      "enum": [
+        "Holds",
+        "Falsified",
+        "Unproven"
+      ],
+      "type": "string"
+    },
+    "CommitRange": {
+      "properties": {
+        "base": {
+          "$ref": "#/$defs/Sha"
+        },
+        "head": {
+          "$ref": "#/$defs/Sha"
+        }
+      },
+      "required": [
+        "base",
+        "head"
+      ],
+      "type": "object"
+    },
+    "Evidence": {
+      "properties": {
+        "kind": {
+          "$ref": "#/$defs/EvidenceKind"
+        },
+        "locator": {
+          "$ref": "#/$defs/Line"
+        },
+        "result": {
+          "$ref": "#/$defs/Line"
+        }
+      },
+      "required": [
+        "kind",
+        "locator",
+        "result"
+      ],
+      "type": "object"
+    },
+    "EvidenceKind": {
+      "enum": [
+        "Command",
+        "Test",
+        "Mutation",
+        "Probe",
+        "SourceRead",
+        "Capture"
+      ],
+      "type": "string"
+    },
+    "Label": {
+      "description": "A key label: `[A-Za-z0-9_-]{1,64}`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "Line": {
+      "description": "Text of at most 1,000 UTF-8 bytes.",
+      "maxLength": 1000,
+      "type": "string"
+    },
+    "Sha": {
+      "description": "A git commit id: 7-40 lowercase hex characters.",
+      "maxLength": 40,
+      "type": "string"
+    },
+    "Short": {
+      "description": "Text of at most 200 UTF-8 bytes.",
+      "maxLength": 200,
+      "type": "string"
+    },
+    "Slug": {
+      "description": "A campaign slug or key segment: label parts joined by `.`.",
+      "maxLength": 64,
+      "type": "string"
+    },
+    "VerdictClaim": {
+      "description": "The promise this claim measured, and the report's mutations it ran. An\n`Unproven` claim with a promise is one Soul could not reach.",
+      "properties": {
+        "claim": {
+          "$ref": "#/$defs/Line"
+        },
+        "evidence": {
+          "items": {
+            "$ref": "#/$defs/Evidence"
+          },
+          "maxItems": 8,
+          "type": "array"
+        },
+        "findings": {
+          "items": {
+            "$ref": "#/$defs/Short"
+          },
+          "maxItems": 16,
+          "type": "array"
+        },
+        "mutations": {
+          "items": {
+            "$ref": "#/$defs/Label"
+          },
+          "maxItems": 8,
+          "type": "array"
+        },
+        "outcome": {
+          "$ref": "#/$defs/ClaimOutcome"
+        },
+        "promise": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Label"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "required": [
+        "claim",
+        "outcome",
+        "evidence",
+        "findings",
+        "mutations"
+      ],
+      "type": "object"
+    }
+  },
+  "$id": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.verdict.v2.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "campaign": {
+      "$ref": "#/$defs/Slug"
+    },
+    "claims": {
+      "items": {
+        "$ref": "#/$defs/VerdictClaim"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "cut_report": {
+      "$ref": "#/$defs/Short"
+    },
+    "pass": {
+      "format": "uint32",
+      "minimum": 0,
+      "type": "integer"
+    },
+    "range": {
+      "$ref": "#/$defs/CommitRange"
+    }
+  },
+  "required": [
+    "campaign",
+    "cut_report",
+    "pass",
+    "range",
+    "claims"
+  ],
+  "title": "PipelineVerdict",
+  "type": "object"
+}
diff --git a/schemas/cultnet/gamecult.persona_state.v0.schema.json b/schemas/cultnet/gamecult.persona_state.v0.schema.json
new file mode 100644
index 0000000..8add61a
--- /dev/null
+++ b/schemas/cultnet/gamecult.persona_state.v0.schema.json
@@ -0,0 +1,1024 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://gamecult.dev/cultnet/gamecult.persona_state.v0.schema.json",
+  "title": "GameCult Persona State v0",
+  "description": "Portable person-state contract for Epiphany Persona, VoidBot repo Personas, and Ghostlight characters. Epiphany work organs should not use this unless they are acting as a public Persona.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": {
+      "const": "gamecult.persona_state.v0"
+    },
+    "provenance": {
+      "$ref": "#/definitions/provenance"
+    },
+    "personaId": {
+      "type": "string"
+    },
+    "publicName": {
+      "type": "string"
+    },
+    "publicDescription": {
+      "type": "string"
+    },
+    "presentation": {
+      "$ref": "#/definitions/presentation"
+    },
+    "privateNotes": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "default": []
+    },
+    "values": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/value"
+      },
+      "default": []
+    },
+    "activationProfile": {
+      "$ref": "#/definitions/activationProfile"
+    },
+    "thoughtMemory": {
+      "$ref": "#/definitions/thoughtMemory"
+    },
+    "agencyPressure": {
+      "$ref": "#/definitions/agencyPressure"
+    },
+    "candidateActions": {
+      "$ref": "#/definitions/candidateActions"
+    },
+    "voidbotProjection": {
+      "$ref": "#/definitions/voidbotProjection"
+    },
+    "affect": {
+      "$ref": "#/definitions/personaAffect"
+    },
+    "updatedAt": {
+      "type": "string",
+      "format": "date-time"
+    }
+  },
+  "required": [
+    "schemaVersion",
+    "provenance",
+    "personaId",
+    "publicName",
+    "presentation",
+    "activationProfile",
+    "thoughtMemory",
+    "agencyPressure",
+    "candidateActions",
+    "affect",
+    "updatedAt"
+  ],
+  "definitions": {
+    "provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "sourceSystem": {
+          "type": "string"
+        },
+        "sourceDocumentId": {
+          "type": "string"
+        },
+        "sourceUpdatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "exportedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "authority": {
+          "type": "string",
+          "enum": [
+            "canonical",
+            "projection",
+            "import"
+          ]
+        }
+      },
+      "required": [
+        "sourceSystem",
+        "sourceDocumentId",
+        "sourceUpdatedAt",
+        "exportedAt",
+        "authority"
+      ]
+    },
+    "publicHandle": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "system": {
+          "type": "string"
+        },
+        "handle": {
+          "type": "string"
+        },
+        "uri": {
+          "type": "string",
+          "format": "uri"
+        }
+      },
+      "required": [
+        "system",
+        "handle"
+      ]
+    },
+    "presentation": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "avatarUri": {
+          "type": "string",
+          "format": "uri"
+        },
+        "pronouns": {
+          "type": "string"
+        },
+        "voiceSummary": {
+          "type": "string"
+        },
+        "defaultRenderer": {
+          "type": "string",
+          "enum": [
+            "text",
+            "chat",
+            "avatar",
+            "voice",
+            "scene",
+            "repo_persona",
+            "custom"
+          ]
+        },
+        "customRenderer": {
+          "type": "string"
+        },
+        "homeContext": {
+          "$ref": "#/definitions/target"
+        },
+        "jurisdiction": {
+          "type": "string"
+        },
+        "publicHandles": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/publicHandle"
+          },
+          "default": []
+        }
+      },
+      "required": [
+        "voiceSummary"
+      ],
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "defaultRenderer": {
+                "const": "custom"
+              }
+            },
+            "required": [
+              "defaultRenderer"
+            ]
+          },
+          "then": {
+            "required": [
+              "customRenderer"
+            ]
+          }
+        }
+      ]
+    },
+    "traitVector": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "mean": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "plasticity": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "currentActivation": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        }
+      },
+      "required": [
+        "mean",
+        "plasticity",
+        "currentActivation"
+      ]
+    },
+    "traitMap": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/traitVector"
+      }
+    },
+    "activationProfile": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "underlyingOrganization": {
+          "$ref": "#/definitions/traitMap"
+        },
+        "stableDispositions": {
+          "$ref": "#/definitions/traitMap"
+        },
+        "behavioralDimensions": {
+          "$ref": "#/definitions/traitMap"
+        },
+        "presentationStrategy": {
+          "$ref": "#/definitions/traitMap"
+        },
+        "voiceStyle": {
+          "$ref": "#/definitions/traitMap"
+        },
+        "situationalState": {
+          "$ref": "#/definitions/traitMap"
+        }
+      },
+      "required": [
+        "underlyingOrganization",
+        "stableDispositions",
+        "behavioralDimensions",
+        "presentationStrategy",
+        "voiceStyle",
+        "situationalState"
+      ]
+    },
+    "value": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "label": {
+          "type": "string"
+        },
+        "priority": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "summary": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "id",
+        "label",
+        "priority"
+      ]
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "type": "string",
+          "enum": [
+            "person",
+            "repo",
+            "scene",
+            "system",
+            "room",
+            "artifact",
+            "concept",
+            "relationship",
+            "self",
+            "community",
+            "thread",
+            "document",
+            "runtime",
+            "custom"
+          ]
+        },
+        "id": {
+          "type": "string"
+        },
+        "label": {
+          "type": "string"
+        },
+        "customKind": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind",
+        "id"
+      ],
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "kind": {
+                "const": "custom"
+              }
+            },
+            "required": [
+              "kind"
+            ]
+          },
+          "then": {
+            "required": [
+              "customKind"
+            ]
+          }
+        }
+      ]
+    },
+    "thoughtStatus": {
+      "type": "string",
+      "enum": [
+        "draft",
+        "active",
+        "cooling",
+        "crystallized",
+        "resolved",
+        "retired"
+      ]
+    },
+    "extensions": {
+      "type": "object",
+      "description": "Non-authoritative extension data from source systems. Portable consumers may preserve it, but must not treat it as core PersonaState authority unless they understand the source contract.",
+      "additionalProperties": true
+    },
+    "anchoredThought": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "status": {
+          "$ref": "#/definitions/thoughtStatus"
+        },
+        "target": {
+          "$ref": "#/definitions/target"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "claim": {
+          "type": "string"
+        },
+        "question": {
+          "type": "string"
+        },
+        "tension": {
+          "type": "string"
+        },
+        "actionImplication": {
+          "type": "string"
+        },
+        "intensity": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "valence": {
+          "type": "number",
+          "minimum": -1,
+          "maximum": 1
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "retiredAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "tags": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "extensions": {
+          "$ref": "#/definitions/extensions"
+        }
+      },
+      "required": [
+        "id",
+        "status",
+        "target",
+        "summary",
+        "tension",
+        "actionImplication",
+        "createdAt",
+        "updatedAt"
+      ]
+    },
+    "thoughtMemory": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "shortTerm": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/anchoredThought"
+          },
+          "default": []
+        },
+        "memories": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/anchoredThought"
+          },
+          "default": []
+        },
+        "incubation": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/anchoredThought"
+          },
+          "default": []
+        }
+      },
+      "required": [
+        "shortTerm",
+        "memories",
+        "incubation"
+      ]
+    },
+    "agencyPressure": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "pressures": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/anchoredThought"
+          },
+          "default": []
+        }
+      },
+      "required": [
+        "pressures"
+      ]
+    },
+    "candidateActions": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "actions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/candidateAction"
+          },
+          "default": []
+        }
+      },
+      "required": [
+        "actions"
+      ]
+    },
+    "candidateAction": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "status": {
+          "$ref": "#/definitions/thoughtStatus"
+        },
+        "actionType": {
+          "type": "string",
+          "enum": [
+            "speak",
+            "draft",
+            "ask",
+            "propose",
+            "inspect",
+            "notify",
+            "wait",
+            "remember",
+            "handoff",
+            "render",
+            "external_action",
+            "custom"
+          ]
+        },
+        "customActionType": {
+          "type": "string"
+        },
+        "readiness": {
+          "type": "string",
+          "enum": [
+            "draft",
+            "ready",
+            "blocked",
+            "waiting",
+            "expired"
+          ]
+        },
+        "riskLevel": {
+          "type": "string",
+          "enum": [
+            "none",
+            "low",
+            "medium",
+            "high",
+            "severe",
+            "unknown"
+          ]
+        },
+        "target": {
+          "$ref": "#/definitions/target"
+        },
+        "deliveryTarget": {
+          "$ref": "#/definitions/target"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "rationale": {
+          "type": "string"
+        },
+        "urgency": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "confidence": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "constraints": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "default": []
+        },
+        "evidence": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/anchoredThought"
+          },
+          "default": []
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "extensions": {
+          "$ref": "#/definitions/extensions"
+        }
+      },
+      "required": [
+        "id",
+        "status",
+        "actionType",
+        "readiness",
+        "riskLevel",
+        "target",
+        "summary",
+        "createdAt",
+        "updatedAt"
+      ],
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "actionType": {
+                "const": "custom"
+              }
+            },
+            "required": [
+              "actionType"
+            ]
+          },
+          "then": {
+            "required": [
+              "customActionType"
+            ]
+          }
+        }
+      ]
+    },
+    "voidbotProjection": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "candidateInterventions": {
+          "type": "array",
+          "description": "VoidBot-flavored projection of candidateActions for repo Persona routines. This is not the generic PersonaState action authority.",
+          "items": {
+            "$ref": "#/definitions/candidateAction"
+          },
+          "default": []
+        }
+      },
+      "required": [
+        "candidateInterventions"
+      ]
+    },
+    "moodDimension": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "value": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "source": {
+          "type": "string"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      },
+      "required": [
+        "name",
+        "value",
+        "updatedAt"
+      ]
+    },
+    "socialBias": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "value": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "summary": {
+          "type": "string"
+        },
+        "behavioralPull": {
+          "type": "string"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      },
+      "required": [
+        "name",
+        "value",
+        "summary",
+        "behavioralPull",
+        "updatedAt"
+      ]
+    },
+    "socialBond": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "status": {
+          "$ref": "#/definitions/thoughtStatus"
+        },
+        "subject": {
+          "$ref": "#/definitions/target"
+        },
+        "object": {
+          "$ref": "#/definitions/target"
+        },
+        "relationshipKind": {
+          "type": "string",
+          "enum": [
+            "ally",
+            "friend",
+            "collaborator",
+            "mentor",
+            "ward",
+            "rival",
+            "audience",
+            "community_member",
+            "self_relation",
+            "unknown",
+            "custom"
+          ]
+        },
+        "customRelationshipKind": {
+          "type": "string"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "trust": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "tension": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "intensity": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "lastEvidence": {
+          "$ref": "#/definitions/anchoredThought"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "extensions": {
+          "$ref": "#/definitions/extensions"
+        }
+      },
+      "required": [
+        "id",
+        "status",
+        "subject",
+        "object",
+        "relationshipKind",
+        "summary",
+        "trust",
+        "tension",
+        "updatedAt"
+      ],
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "relationshipKind": {
+                "const": "custom"
+              }
+            },
+            "required": [
+              "relationshipKind"
+            ]
+          },
+          "then": {
+            "required": [
+              "customRelationshipKind"
+            ]
+          }
+        }
+      ]
+    },
+    "statusRead": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "status": {
+          "$ref": "#/definitions/thoughtStatus"
+        },
+        "target": {
+          "$ref": "#/definitions/target"
+        },
+        "statusKind": {
+          "type": "string",
+          "enum": [
+            "attention",
+            "authority",
+            "risk",
+            "trust",
+            "need",
+            "conflict",
+            "mood",
+            "opportunity",
+            "uncertainty",
+            "custom"
+          ]
+        },
+        "customStatusKind": {
+          "type": "string"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "confidence": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "intensity": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "valence": {
+          "type": "number",
+          "minimum": -1,
+          "maximum": 1
+        },
+        "lastEvidence": {
+          "$ref": "#/definitions/anchoredThought"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "extensions": {
+          "$ref": "#/definitions/extensions"
+        }
+      },
+      "required": [
+        "id",
+        "status",
+        "target",
+        "statusKind",
+        "summary",
+        "confidence",
+        "updatedAt"
+      ],
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "statusKind": {
+                "const": "custom"
+              }
+            },
+            "required": [
+              "statusKind"
+            ]
+          },
+          "then": {
+            "required": [
+              "customStatusKind"
+            ]
+          }
+        }
+      ]
+    },
+    "doctrineStance": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "status": {
+          "$ref": "#/definitions/thoughtStatus"
+        },
+        "target": {
+          "$ref": "#/definitions/target"
+        },
+        "stanceKind": {
+          "type": "string",
+          "enum": [
+            "aligned",
+            "tension",
+            "rejected",
+            "uncertain",
+            "contextual",
+            "custom"
+          ]
+        },
+        "customStanceKind": {
+          "type": "string"
+        },
+        "principle": {
+          "type": "string"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "actionImplication": {
+          "type": "string"
+        },
+        "intensity": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "extensions": {
+          "$ref": "#/definitions/extensions"
+        }
+      },
+      "required": [
+        "id",
+        "status",
+        "target",
+        "stanceKind",
+        "principle",
+        "summary",
+        "actionImplication",
+        "updatedAt"
+      ],
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "stanceKind": {
+                "const": "custom"
+              }
+            },
+            "required": [
+              "stanceKind"
+            ]
+          },
+          "then": {
+            "required": [
+              "customStanceKind"
+            ]
+          }
+        }
+      ]
+    },
+    "personaAffect": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "needs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/anchoredThought"
+          },
+          "default": []
+        },
+        "socialBonds": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/socialBond"
+          },
+          "default": []
+        },
+        "statusReads": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/statusRead"
+          },
+          "default": []
+        },
+        "moodDimensions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/moodDimension"
+          },
+          "default": []
+        },
+        "socialBiases": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/socialBias"
+          },
+          "default": []
+        },
+        "doctrineStances": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/doctrineStance"
+          },
+          "default": []
+        }
+      },
+      "required": [
+        "needs",
+        "socialBonds",
+        "statusReads",
+        "moodDimensions",
+        "socialBiases",
+        "doctrineStances"
+      ]
+    }
+  }
+}
diff --git a/schemas/cultnet/index.json b/schemas/cultnet/index.json
new file mode 100644
index 0000000..6c2b992
--- /dev/null
+++ b/schemas/cultnet/index.json
@@ -0,0 +1,159 @@
+{
+  "schemaVersion": "epiphany.cultnet_catalog.v0",
+  "schemas": [
+    {
+      "schemaId": "https://gamecult.dev/cultnet/gamecult.persona_state.v0.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "gamecult.persona_state.v0",
+      "documentType": "gamecult.persona_state.v0",
+      "title": "GameCult Persona State v0",
+      "path": "gamecult.persona_state.v0.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.campaign.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.campaign.v2",
+      "documentType": "epiphany.pipeline.campaign.v2",
+      "title": "Epiphany Pipeline Campaign v2",
+      "path": "epiphany.pipeline.campaign.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.target.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.target.v2",
+      "documentType": "epiphany.pipeline.target.v2",
+      "title": "Epiphany Pipeline Target v2",
+      "path": "epiphany.pipeline.target.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.question.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.question.v2",
+      "documentType": "epiphany.pipeline.question.v2",
+      "title": "Epiphany Pipeline Question v2",
+      "path": "epiphany.pipeline.question.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.ruling.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.ruling.v2",
+      "documentType": "epiphany.pipeline.ruling.v2",
+      "title": "Epiphany Pipeline Ruling v2",
+      "path": "epiphany.pipeline.ruling.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.cut_spec.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.cut_spec.v2",
+      "documentType": "epiphany.pipeline.cut_spec.v2",
+      "title": "Epiphany Pipeline CutSpec v2",
+      "path": "epiphany.pipeline.cut_spec.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.cut_report.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.cut_report.v2",
+      "documentType": "epiphany.pipeline.cut_report.v2",
+      "title": "Epiphany Pipeline CutReport v2",
+      "path": "epiphany.pipeline.cut_report.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.verdict.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.verdict.v2",
+      "documentType": "epiphany.pipeline.verdict.v2",
+      "title": "Epiphany Pipeline Verdict v2",
+      "path": "epiphany.pipeline.verdict.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.finding.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.finding.v2",
+      "documentType": "epiphany.pipeline.finding.v2",
+      "title": "Epiphany Pipeline Finding v2",
+      "path": "epiphany.pipeline.finding.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.follow_up.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.follow_up.v2",
+      "documentType": "epiphany.pipeline.follow_up.v2",
+      "title": "Epiphany Pipeline FollowUp v2",
+      "path": "epiphany.pipeline.follow_up.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.resolution.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.resolution.v2",
+      "documentType": "epiphany.pipeline.resolution.v2",
+      "title": "Epiphany Pipeline Resolution v2",
+      "path": "epiphany.pipeline.resolution.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.instance.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.instance.v2",
+      "documentType": "epiphany.pipeline.instance.v2",
+      "title": "Epiphany Pipeline Instance v2",
+      "path": "epiphany.pipeline.instance.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.stewardship.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.stewardship.v2",
+      "documentType": "epiphany.pipeline.stewardship.v2",
+      "title": "Epiphany Pipeline Stewardship v2",
+      "path": "epiphany.pipeline.stewardship.v2.schema.json"
+    },
+    {
+      "schemaId": "https://gamecult.dev/epiphany/cultnet/epiphany.pipeline.hand_off.v2.schema.json",
+      "kind": "document_payload",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "epiphany.pipeline.hand_off.v2",
+      "documentType": "epiphany.pipeline.hand_off.v2",
+      "title": "Epiphany Pipeline HandOff v2",
+      "path": "epiphany.pipeline.hand_off.v2.schema.json"
+    }
+  ]
+}

From c46b0ec183e732a8504ffb990e9d61c9d5cfb092 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 14:09:16 +0200
Subject: [PATCH 02/11] Rename the pipeline leaf to eureka-pipeline and take it
 as a path dependency

Package and lib become eureka-pipeline / eureka_pipeline; the crate joins the
workspace; huginn-mind's git dependency on GameCult/Epiphany is replaced by
the path, and Cargo.lock is regenerated (the Epiphany source entry is gone).
Every epiphany_pipeline mention in huginn-mind, huginn-daemon and eureka-state
is renamed. The schema-publication test reads ../../schemas/cultnet. The
leaf's license-file key (../LICENSE, which Huginn has no file for) is dropped.
Type ids, the epoch and every schema_id string are untouched. Schemas README
and the pipeline section of schemas/cultnet/README.md are rewritten for the
new home; README and AGENTS no longer say the leaf is pinned by git. New test:
the catalogue lists exactly the schema files beside it.

Not yet built or tested; verification follows on Yggdrasil.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 AGENTS.md                                  | 20 +++++----
 Cargo.lock                                 | 28 ++++++------
 Cargo.toml                                 |  1 +
 README.md                                  |  2 +-
 crates/eureka-pipeline/Cargo.toml          |  5 +--
 crates/eureka-pipeline/src/lib.rs          | 38 ++++++++++++++--
 crates/eureka-state/src/lib.rs             |  2 +-
 crates/eureka-state/src/main.rs            |  2 +-
 crates/eureka-state/tests/client.rs        |  2 +-
 crates/eureka-state/tests/common/mod.rs    |  2 +-
 crates/eureka-state/tests/mcp.rs           |  4 +-
 crates/huginn-daemon/src/daemon.rs         | 10 ++---
 crates/huginn-daemon/src/index/mod.rs      |  2 +-
 crates/huginn-daemon/src/semantic_tests.rs |  2 +-
 crates/huginn-daemon/src/serve.rs          |  4 +-
 crates/huginn-mind/Cargo.toml              |  9 ++--
 crates/huginn-mind/src/admission.rs        | 52 +++++++++++-----------
 crates/huginn-mind/src/docs.rs             |  2 +-
 crates/huginn-mind/src/fixtures.rs         |  4 +-
 crates/huginn-mind/src/index.rs            |  4 +-
 crates/huginn-mind/src/lib.rs              |  4 +-
 crates/huginn-mind/src/mind.rs             | 18 ++++----
 crates/huginn-mind/src/query.rs            |  4 +-
 crates/huginn-mind/src/receipt.rs          | 10 ++---
 crates/huginn-mind/src/refusal.rs          |  2 +-
 crates/huginn-mind/src/rows.rs             |  2 +-
 crates/huginn-mind/src/wire.rs             |  2 +-
 schemas/README.md                          | 10 ++---
 schemas/cultnet/README.md                  | 12 +++++
 29 files changed, 151 insertions(+), 108 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index bfa7ee0..e217d3f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,15 +11,17 @@ Studio's job, not Huginn's.
 
 - Project root: `F:\Projects\Huginn`
 - Upstream: `https://github.com/GameCult/Huginn.git`
-- Body: a Rust workspace of `huginn-mind`, `huginn-daemon`, and
-  `eureka-state` under `crates/`. Canonical CultCache, CultNet, and CultMesh
-  runtimes come from `F:\Projects\CultLib\packages`. `huginn-mind` is live:
-  it persists, admits and reads back an instance's mind, queries and derived
-  status included, over `cultcache-rs` and `epiphany-pipeline` pinned by git
-  rev. `huginn-daemon` serves one mind over CultNet RUDP through `cultnet-rs`
-  at the same rev, and reaches the leaf and the store type through
-  `huginn-mind` so one crate pins each revision. `eureka-state` is the client
-  core: one call to a daemon over CultNet, holding no state.
+- Body: a Rust workspace of `eureka-pipeline`, `huginn-mind`, `huginn-daemon`,
+  and `eureka-state` under `crates/`. Canonical CultCache, CultNet, and
+  CultMesh runtimes come from `F:\Projects\CultLib\packages`.
+  `eureka-pipeline` is the pipeline leaf: document shapes, bounds, formats,
+  keys and the schemas published under `schemas/cultnet`. `huginn-mind` is
+  live: it persists, admits and reads back an instance's mind, queries and
+  derived status included, over `cultcache-rs` and `eureka-pipeline`.
+  `huginn-daemon` serves one mind over CultNet RUDP through `cultnet-rs` at
+  the same rev, and reaches the leaf and the store type through `huginn-mind`
+  so one crate pins each revision. `eureka-state` is the client core: one call
+  to a daemon over CultNet, holding no state.
 - Owned: an instance's memory documents, their admission and the read side
   that derives their status, in `huginn-mind`,
   over a redb CultCache store at `<state_root>/minds/<instance>/mind.redb`;
diff --git a/Cargo.lock b/Cargo.lock
index 25c9d81..4fcc88d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -372,19 +372,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "epiphany-pipeline"
-version = "0.1.0"
-source = "git+https://github.com/GameCult/Epiphany.git?rev=ef9568655e75bb6cb362a038e2739a5ac5e777ee#ef9568655e75bb6cb362a038e2739a5ac5e777ee"
-dependencies = [
- "anyhow",
- "chrono",
- "cultcache-rs",
- "rmp-serde",
- "schemars",
- "serde",
-]
-
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -395,6 +382,19 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "eureka-pipeline"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "cultcache-rs",
+ "rmp-serde",
+ "schemars",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "eureka-state"
 version = "0.1.0"
@@ -644,7 +644,7 @@ dependencies = [
  "chrono",
  "cultcache-rs",
  "cultnet-rs",
- "epiphany-pipeline",
+ "eureka-pipeline",
  "rmp-serde",
  "schemars",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index 9522717..1f717e1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,6 @@
 [workspace]
 members = [
+    "crates/eureka-pipeline",
     "crates/huginn-mind",
     "crates/huginn-daemon",
     "crates/eureka-state",
diff --git a/README.md b/README.md
index b6a4bd6..9110adc 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ It reads them back the same way: a document with the facts of its admission
 joined from that receipt and its status derived at read time, and typed
 queries over one mind. Status is never stored, and the views derive it
 through the same rules admission does. Document shape and keys come from
-`epiphany-pipeline`; the store is CultLib's Rust CultCache.
+`eureka-pipeline` (`crates/eureka-pipeline`); the store is CultLib's Rust CultCache.
 
 `huginn-daemon` opens one mind, binds one UDP socket in that order, and
 answers every frame on the session it arrived on: one operation per `Mind`
diff --git a/crates/eureka-pipeline/Cargo.toml b/crates/eureka-pipeline/Cargo.toml
index 48d2fdd..1b077a7 100644
--- a/crates/eureka-pipeline/Cargo.toml
+++ b/crates/eureka-pipeline/Cargo.toml
@@ -1,13 +1,12 @@
 [package]
-name = "epiphany-pipeline"
+name = "eureka-pipeline"
 version = "0.1.0"
 edition = "2024"
 publish = false
 autobins = false
-license-file = "../LICENSE"
 
 [lib]
-name = "epiphany_pipeline"
+name = "eureka_pipeline"
 path = "src/lib.rs"
 
 # A leaf type library. Every dependency here is one the document types or the
diff --git a/crates/eureka-pipeline/src/lib.rs b/crates/eureka-pipeline/src/lib.rs
index c29146e..7bd75f3 100644
--- a/crates/eureka-pipeline/src/lib.rs
+++ b/crates/eureka-pipeline/src/lib.rs
@@ -1094,7 +1094,7 @@ mod tests {
     }
 
     fn location() -> CodeLocation {
-        CodeLocation { path: s("epiphany-pipeline/src/lib.rs"), line: 1, end_line: Some(9) }
+        CodeLocation { path: s("crates/eureka-pipeline/src/lib.rs"), line: 1, end_line: Some(9) }
     }
 
     fn evidence() -> Evidence {
@@ -1187,7 +1187,7 @@ mod tests {
                     dependencies_removed: vec![], formats_added: vec![s("epiphany.pipeline.*.v1")],
                     formats_removed: vec![], targets_added: vec![], targets_removed: vec![],
                 },
-                landed_names: vec![LandedName { name: s("PipelineDocument"), path: s("epiphany-pipeline/src/lib.rs") }],
+                landed_names: vec![LandedName { name: s("PipelineDocument"), path: s("crates/eureka-pipeline/src/lib.rs") }],
                 undone: vec!["admission".into()],
                 promises: vec![Promise { label: l("P1"), text: "One derived key per document.".into() }],
             }), format!("{CAMPAIGN}:cut_report:cut-3a.h1")),
@@ -2722,7 +2722,7 @@ mod tests {
 
     #[test]
     fn pipeline_published_schemas_match_derivation() -> Result<()> {
-        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../schemas/cultnet");
+        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
         let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
         // A directory this run alone writes, so everything in it is what this
         // run derived. A previous run's leftovers -- a mutation run's
@@ -2739,7 +2739,7 @@ mod tests {
         // they outlive the run that wrote them. Whoever reads the failure is
         // the one who deletes them.
         let derived_dir = std::env::temp_dir().join(format!(
-            "epiphany-pipeline-schemas-{}-{}",
+            "eureka-pipeline-schemas-{}-{}",
             std::process::id(),
             std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_nanos()
         ));
@@ -2772,6 +2772,36 @@ mod tests {
         Ok(())
     }
 
+    /// The catalogue is exactly the files beside it: every entry's `path` is a
+    /// schema file in the directory, and every schema file in the directory
+    /// has an entry, so a schema removed from the catalogue (or a file left
+    /// behind by a move) fails here instead of publishing a dangling or
+    /// unlisted contract. Schemas whose owner is another crate (`huginn.*`)
+    /// are published by that crate, not listed here.
+    #[test]
+    fn the_catalogue_lists_exactly_the_schema_files_it_publishes() -> Result<()> {
+        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
+        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
+        let listed = index["schemas"]
+            .as_array()
+            .expect("index.json carries a schemas array")
+            .iter()
+            .map(|entry| entry["path"].as_str().expect("every entry names its file").to_owned())
+            .collect::<std::collections::BTreeSet<_>>();
+        for path in &listed {
+            assert!(published.join(path).is_file(), "index.json lists {path}, which is not in the directory");
+        }
+        let mut files = std::collections::BTreeSet::new();
+        for entry in std::fs::read_dir(&published)? {
+            let name = entry?.file_name().to_string_lossy().into_owned();
+            if name.ends_with(".schema.json") && !name.starts_with("huginn.") {
+                files.insert(name);
+            }
+        }
+        assert_eq!(listed, files, "the catalogue and the schema files beside it disagree");
+        Ok(())
+    }
+
     /// The epoch is the version every kind is published at: its version
     /// segment is read from the constant, not restated, and every type id
     /// carries the same one, so a bumped epoch fails here until the kinds
diff --git a/crates/eureka-state/src/lib.rs b/crates/eureka-state/src/lib.rs
index b6208e8..5d0d502 100644
--- a/crates/eureka-state/src/lib.rs
+++ b/crates/eureka-state/src/lib.rs
@@ -26,7 +26,7 @@ use cultnet_rs::{
     CultNetRudpSocketTransportConnection, CultNetWireContract, encode_cultnet_message_to_vec, fetch_content,
 };
 use huginn_mind::envelope::{OperationFailure, decode_response, encode_request};
-use huginn_mind::epiphany_pipeline::Slug;
+use huginn_mind::eureka_pipeline::Slug;
 use huginn_mind::{HuginnMindRequest, HuginnMindResponse, MAX_DEFERRED_BODY_BYTES};
 
 /// The correlation key of the one request a session carries.
diff --git a/crates/eureka-state/src/main.rs b/crates/eureka-state/src/main.rs
index d368a23..f48b8a0 100644
--- a/crates/eureka-state/src/main.rs
+++ b/crates/eureka-state/src/main.rs
@@ -22,7 +22,7 @@ use std::time::Duration;
 
 use cultnet_rs::Selection;
 use eureka_state::{ClientError, HuginnClient};
-use huginn_mind::epiphany_pipeline::{PipelineDocument, PipelineRef, Short, Slug};
+use huginn_mind::eureka_pipeline::{PipelineDocument, PipelineRef, Short, Slug};
 use huginn_mind::{
     Faculty, HuginnMindRequest, HuginnMindResponse, PipelineAdmissionBatch, PipelineProvenance, SemanticQuery,
 };
diff --git a/crates/eureka-state/tests/client.rs b/crates/eureka-state/tests/client.rs
index 3f34512..ce9decb 100644
--- a/crates/eureka-state/tests/client.rs
+++ b/crates/eureka-state/tests/client.rs
@@ -14,7 +14,7 @@ use cultnet_rs::{
 use eureka_state::{ClientError, HuginnClient, MAX_REQUEST_BYTES};
 use huginn_daemon::serve::MAX_RESPONSE_BYTES;
 use huginn_mind::envelope::{OperationFailure, encode_failure, encode_request, encode_response};
-use huginn_mind::epiphany_pipeline::{
+use huginn_mind::eureka_pipeline::{
     AuthorityMap, CodeLocation, CutDelete, CutVerification, FileChange, Line, NegativeCheck, OrgRepo,
     PipelineCutSpec, PipelineDocument, PipelineKind, PipelineRef, Short, StructuralDelta, Title,
     VerificationTest,
diff --git a/crates/eureka-state/tests/common/mod.rs b/crates/eureka-state/tests/common/mod.rs
index 27a0705..ca0e19b 100644
--- a/crates/eureka-state/tests/common/mod.rs
+++ b/crates/eureka-state/tests/common/mod.rs
@@ -13,7 +13,7 @@ use chrono::Utc;
 use cultnet_rs::{CultNetMessage, CultNetRudpServerEvent, CultNetWireContract, decode_cultnet_message_from_slice};
 use huginn_daemon::serve::{bind, run, schema_registry};
 use huginn_daemon::{Daemon, Handled, Hits, IndexSink, SearchTicket, ServeOptions};
-use huginn_mind::epiphany_pipeline::{
+use huginn_mind::eureka_pipeline::{
     Date, DocRef, OrgRepo, PipelineCampaign, PipelineDocument, PipelineInstance, PipelineRef, PipelineStewardship, Sha, Short, Slug,
     Title,
 };
diff --git a/crates/eureka-state/tests/mcp.rs b/crates/eureka-state/tests/mcp.rs
index 969ad55..adfc2f8 100644
--- a/crates/eureka-state/tests/mcp.rs
+++ b/crates/eureka-state/tests/mcp.rs
@@ -11,7 +11,7 @@ use std::time::Duration;
 
 use huginn_mind::envelope::{OperationFailure, encode_failure, encode_response};
 use huginn_mind::{HuginnMindRequest, HuginnMindResponse};
-use huginn_mind::epiphany_pipeline::{Date, PipelineDocument, PipelineKind, PipelineRef, Short};
+use huginn_mind::eureka_pipeline::{Date, PipelineDocument, PipelineKind, PipelineRef, Short};
 use serde_json::{Value, json};
 
 mod common;
@@ -536,7 +536,7 @@ fn initialize_advertises_tools() {
 /// value `pipeline_key` computes for that document, never a re-built one.
 #[test]
 fn admit_carries_the_leaf_key_refusal_with_its_field_and_value() {
-    use huginn_mind::epiphany_pipeline::{PipelineResolution, ResolutionOutcome, pipeline_key};
+    use huginn_mind::eureka_pipeline::{PipelineResolution, ResolutionOutcome, pipeline_key};
 
     let (root, daemon) = mind(vec![vec![stewardship()]]);
     let server = serve(root, daemon);
diff --git a/crates/huginn-daemon/src/daemon.rs b/crates/huginn-daemon/src/daemon.rs
index ffbf813..8e54d34 100644
--- a/crates/huginn-daemon/src/daemon.rs
+++ b/crates/huginn-daemon/src/daemon.rs
@@ -4,7 +4,7 @@
 
 use chrono::{DateTime, Utc};
 use cultnet_rs::Selection;
-use huginn_mind::epiphany_pipeline::{PipelineRef, Slug};
+use huginn_mind::eureka_pipeline::{PipelineRef, Slug};
 use huginn_mind::wire::{HuginnMindRequest, HuginnMindResponse, IndexStatus};
 use huginn_mind::{Mind, MindRefusal, MindStore, PipelineAdmissionOutcome, SemanticQuery};
 
@@ -217,7 +217,7 @@ impl<S: MindStore, I: IndexSink<S>> Daemon<S, I> {
 pub(crate) mod tests {
     use super::*;
     use chrono::TimeZone;
-    use huginn_mind::epiphany_pipeline::{
+    use huginn_mind::eureka_pipeline::{
         AuthorityMap, CodeLocation, CutDelete, CutVerification, Date, DocRef, FileChange, Line, NegativeCheck,
         OrgRepo, PipelineCampaign, PipelineCutSpec, PipelineDocument, PipelineInstance, PipelineKind,
         PipelineQuestion, PipelineRuling, PipelineStewardship, QuestionOption, RulingAuthority, Sha, Short,
@@ -685,7 +685,7 @@ pub(crate) mod tests {
         assert_ne!(fullwidth, INSTANCE, "not the mind's own bytes");
         assert!(!fullwidth.is_ascii(), "outside the grammar: a Slug is dot-joined ASCII labels");
 
-        let expected = MindRefusal::Document(huginn_mind::epiphany_pipeline::PipelineRefusal::InvalidFormat {
+        let expected = MindRefusal::Document(huginn_mind::eureka_pipeline::PipelineRefusal::InvalidFormat {
             field: "declared".into(),
             value: fullwidth.into(),
         });
@@ -715,7 +715,7 @@ pub(crate) mod tests {
         let (_root, mut daemon) = seeded();
         let fullwidth = "\u{FF59}ggdrasil";
 
-        let expected = MindRefusal::Document(huginn_mind::epiphany_pipeline::PipelineRefusal::InvalidFormat {
+        let expected = MindRefusal::Document(huginn_mind::eureka_pipeline::PipelineRefusal::InvalidFormat {
             field: "declared".into(),
             value: fullwidth.into(),
         });
@@ -744,7 +744,7 @@ pub(crate) mod tests {
         // A reference whose kind and id disagree names no document any writer
         // could have composed; the leaf's own refusal says so.
         let invalid = PipelineRef { kind: PipelineKind::Question, id: "not a reference".into() };
-        let malformed = MindRefusal::Document(huginn_mind::epiphany_pipeline::PipelineRefusal::InvalidFormat {
+        let malformed = MindRefusal::Document(huginn_mind::eureka_pipeline::PipelineRefusal::InvalidFormat {
             field: "ref.id".into(),
             value: "not a reference".into(),
         });
diff --git a/crates/huginn-daemon/src/index/mod.rs b/crates/huginn-daemon/src/index/mod.rs
index 30a7b4c..fef9ebb 100644
--- a/crates/huginn-daemon/src/index/mod.rs
+++ b/crates/huginn-daemon/src/index/mod.rs
@@ -99,7 +99,7 @@ use std::sync::{Arc, Condvar, Mutex, MutexGuard};
 use std::time::{Duration, Instant};
 
 use anyhow::{Context, Result, bail, ensure};
-use huginn_mind::epiphany_pipeline::{PipelineKind, PipelineRef, Short, Slug};
+use huginn_mind::eureka_pipeline::{PipelineKind, PipelineRef, Short, Slug};
 use huginn_mind::wire::IndexStatus;
 use huginn_mind::{INDEX_TEXT_VERSION, IndexEntry, Mind, MindStore};
 use sha2::{Digest, Sha256};
diff --git a/crates/huginn-daemon/src/semantic_tests.rs b/crates/huginn-daemon/src/semantic_tests.rs
index f72c5b4..11da3f5 100644
--- a/crates/huginn-daemon/src/semantic_tests.rs
+++ b/crates/huginn-daemon/src/semantic_tests.rs
@@ -10,7 +10,7 @@ use std::time::Duration;
 
 use anyhow::Result;
 use cultnet_rs::{CULTNET_OPERATION_CONNECTION_ID, CultMesh, CultMeshRudpSocketOptions, FieldPredicate, Selection};
-use huginn_mind::epiphany_pipeline::{
+use huginn_mind::eureka_pipeline::{
     Date, PipelineDocument, PipelineKind, PipelineQuestion, PipelineResolution, PipelineRef, PipelineRuling,
     QuestionOption, ResolutionOutcome, RulingAuthority, Short, Title,
 };
diff --git a/crates/huginn-daemon/src/serve.rs b/crates/huginn-daemon/src/serve.rs
index bb9fb8e..561ad1b 100644
--- a/crates/huginn-daemon/src/serve.rs
+++ b/crates/huginn-daemon/src/serve.rs
@@ -68,7 +68,7 @@ use cultnet_rs::{
     CultNetWireContract, answer_content_chunk_request, decode_cultnet_message_from_slice,
     encode_cultnet_message_to_vec, pack_content,
 };
-use huginn_mind::epiphany_pipeline::Slug;
+use huginn_mind::eureka_pipeline::Slug;
 use huginn_mind::wire::{
     DeferredAnswer, HuginnMindResponse, MIND_REQUEST_SCHEMA, MIND_REQUEST_SCHEMA_JSON, MIND_RESPONSE_SCHEMA,
     MIND_RESPONSE_SCHEMA_JSON, MIND_SERVICE_ID,
@@ -548,7 +548,7 @@ mod tests {
         FITTING_CHANGES, FITTING_CUT, INSTANCE, NoIndex, OTHER, WIDE_CHANGES, WIDE_CUT, batch, identity, now,
         open_unindexed, seeded_wide, slug,
     };
-    use huginn_mind::epiphany_pipeline::{PipelineKind, PipelineRef};
+    use huginn_mind::eureka_pipeline::{PipelineKind, PipelineRef};
     use huginn_mind::envelope::{FAILURE_SCHEMA, decode_response, encode_request};
     use crate::index::Backoff;
     use base64::Engine;
diff --git a/crates/huginn-mind/Cargo.toml b/crates/huginn-mind/Cargo.toml
index c5f3953..999a7b2 100644
--- a/crates/huginn-mind/Cargo.toml
+++ b/crates/huginn-mind/Cargo.toml
@@ -6,9 +6,10 @@ license.workspace = true
 publish.workspace = true
 
 # The organ's rule engine: storage, identity and admission of one instance's
-# mind. Document shape, bounds, formats and keys come from `epiphany-pipeline`;
-# the store comes from CultLib's Rust CultCache at the same rev Epiphany pins,
-# so the leaf's wrappers and this crate's cache are one `cultcache-rs`. The
+# mind. Document shape, bounds, formats and keys come from this workspace's
+# `eureka-pipeline` (crates/eureka-pipeline, copied once from Epiphany ef956865);
+# the store comes from CultLib's Rust CultCache at the rev `eureka-pipeline`
+# also uses, so the leaf's wrappers and this crate's cache are one `cultcache-rs`. The
 # read side selects through CultNet's typed selection (`cultnet-rs`, the same
 # rev the daemon pins): the selection's vocabulary and evaluator are the
 # substrate's, this crate supplies the rows. No socket, no index: those are the
@@ -19,7 +20,7 @@ base64 = "0.22"
 chrono = "0.4.44"
 cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultcache-rs" }
 cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultnet-rs" }
-epiphany-pipeline = { git = "https://github.com/GameCult/Epiphany.git", rev = "ef9568655e75bb6cb362a038e2739a5ac5e777ee", package = "epiphany-pipeline" }
+eureka-pipeline = { path = "../eureka-pipeline" }
 rmp-serde = "1"
 schemars = "1"
 serde = { version = "1", features = ["derive"] }
diff --git a/crates/huginn-mind/src/admission.rs b/crates/huginn-mind/src/admission.rs
index 62380a7..fddb88d 100644
--- a/crates/huginn-mind/src/admission.rs
+++ b/crates/huginn-mind/src/admission.rs
@@ -30,7 +30,7 @@ use std::collections::BTreeSet;
 
 use chrono::{DateTime, Utc};
 use cultcache_rs::{CultCache, CultCacheEnvelope};
-use epiphany_pipeline::{
+use eureka_pipeline::{
     ClaimOutcome, FindingConfidence, Line, PipelineDocument, PipelineKind, PipelineRef, PipelineRefusal,
     PipelineResolution, PipelineStewardship, ResolutionOutcome, RulingAuthority, Short, Slug, pipeline_key,
     validate_pipeline_write_envelope,
@@ -180,7 +180,7 @@ impl<S: MindStore> Mind<S> {
     }
 }
 
-/// The bound `epiphany_pipeline::Short` declares, in UTF-8 bytes. The leaf
+/// The bound `eureka_pipeline::Short` declares, in UTF-8 bytes. The leaf
 /// exposes no validator for it, so `short_bound_is_the_leafs_own` pins this to
 /// the `maxLength` its schema publishes.
 const SHORT_MAX: usize = 200;
@@ -371,7 +371,7 @@ fn check(docs: &Docs, staged: &Staged, mind: &Slug) -> Result<(), MindRefusal> {
             Ok(())
         }
         D::Target(target) => {
-            let predecessor = D::Target(epiphany_pipeline::PipelineTarget { revision: target.revision.wrapping_sub(1), ..target.clone() });
+            let predecessor = D::Target(eureka_pipeline::PipelineTarget { revision: target.revision.wrapping_sub(1), ..target.clone() });
             revision_rule(docs, K::Target, key, target.revision, &predecessor)?;
             unique_labels("target.invariants", target.invariants.iter().map(|invariant| invariant.label.0.as_str()))
         }
@@ -429,7 +429,7 @@ fn check(docs: &Docs, staged: &Staged, mind: &Slug) -> Result<(), MindRefusal> {
                     return Err(MindRefusal::UnknownDependency { cut: dependency.0.clone() });
                 }
             }
-            let predecessor = D::CutSpec(epiphany_pipeline::PipelineCutSpec { revision: spec.revision.wrapping_sub(1), ..spec.clone() });
+            let predecessor = D::CutSpec(eureka_pipeline::PipelineCutSpec { revision: spec.revision.wrapping_sub(1), ..spec.clone() });
             revision_rule(docs, K::CutSpec, key, spec.revision, &predecessor)
         }
         D::CutReport(report) => {
@@ -704,7 +704,7 @@ mod tests {
     use crate::receipt::{DocumentVersion, Faculty, HuginnCommitReceipt};
     use crate::store::test_stores::{MemoryStore, RefusingStore, SwapCommand};
     use cultcache_rs::DatabaseEntry;
-    use epiphany_pipeline::{PIPELINE_SCHEMA_EPOCH, PipelineDocument as D, PipelineKind as K};
+    use eureka_pipeline::{PIPELINE_SCHEMA_EPOCH, PipelineDocument as D, PipelineKind as K};
     use sha2::{Digest, Sha256};
 
     fn receipt_count<S: MindStore>(mind: &Mind<S>) -> usize {
@@ -833,7 +833,7 @@ mod tests {
     fn provenance_text_is_the_leafs_title_rule() {
         let leaf_accepts = |text: &str| {
             let D::Campaign(mut campaign) = campaign(&[REPO]) else { unreachable!() };
-            campaign.title = epiphany_pipeline::Title(text.into());
+            campaign.title = eureka_pipeline::Title(text.into());
             D::Campaign(campaign).validate().is_ok()
         };
         let mine_accepts = |text: &str| {
@@ -1280,7 +1280,7 @@ mod tests {
         let mut steward = seeded();
         committed(admit(&mut steward, vec![hand_off(INSTANCE, OTHER_INSTANCE, REPO, &[])]));
         let D::HandOff(mut back) = hand_off(OTHER_INSTANCE, INSTANCE, REPO, &[]) else { panic!() };
-        back.handed_on = epiphany_pipeline::Date("2026-09-17".into());
+        back.handed_on = eureka_pipeline::Date("2026-09-17".into());
         committed(admit(&mut steward, vec![D::HandOff(back)]));
         assert_eq!(
             refusal(admit(&mut steward, vec![stewardship_n(INSTANCE, REPO, 4)])),
@@ -1366,7 +1366,7 @@ mod tests {
         // Handed back, the mind stewards it again, as `n2`. No field names a
         // return: this is the same hand-off shape with the instances swapped.
         let D::HandOff(mut back) = hand_off(OTHER_INSTANCE, INSTANCE, REPO, &[]) else { panic!() };
-        back.handed_on = epiphany_pipeline::Date("2026-09-17".into());
+        back.handed_on = eureka_pipeline::Date("2026-09-17".into());
         let (_, writes) = committed(admit(&mut mind, vec![D::HandOff(back)]));
         let again = format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2");
         assert_eq!(writes, vec![
@@ -1375,7 +1375,7 @@ mod tests {
         ]);
         let Some(D::Stewardship(taken)) = mind.get(K::Stewardship, &again).unwrap() else { panic!() };
         assert_eq!(taken.sequence, 2);
-        assert_eq!(taken.assigned_on, epiphany_pipeline::Date("2026-09-17".into()));
+        assert_eq!(taken.assigned_on, eureka_pipeline::Date("2026-09-17".into()));
         assert!(mind.envelope(K::Stewardship, &first).is_some(), "the first assignment is still readable by key");
     }
 
@@ -1388,7 +1388,7 @@ mod tests {
         let mut mind = seeded();
         committed(admit(&mut mind, vec![hand_off(INSTANCE, OTHER_INSTANCE, REPO, &[])]));
         let D::HandOff(mut back) = hand_off(OTHER_INSTANCE, INSTANCE, REPO, &[]) else { panic!() };
-        back.handed_on = epiphany_pipeline::Date("2026-09-17".into());
+        back.handed_on = eureka_pipeline::Date("2026-09-17".into());
         committed(admit(&mut mind, vec![D::HandOff(back)]));
         let first = format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1");
         let again = format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2");
@@ -1434,7 +1434,7 @@ mod tests {
         let withdrawal = format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n1.n1");
         committed(admit(&mut mind, vec![resolution(r(K::Resolution, &withdrawal), withdrawn())]));
         let D::HandOff(mut again) = hand_off(INSTANCE, OTHER_INSTANCE, REPO, &[]) else { panic!() };
-        again.handed_on = epiphany_pipeline::Date("2026-09-17".into());
+        again.handed_on = eureka_pipeline::Date("2026-09-17".into());
         let (_, writes) = committed(admit(&mut mind, vec![D::HandOff(again)]));
         assert_eq!(writes, vec![
             r(K::HandOff, &format!("{INSTANCE}:hand_off:{OTHER_INSTANCE}.gamecult_-epiphany.2026-09-17")),
@@ -1444,7 +1444,7 @@ mod tests {
 
     fn hand_off_on(from: &str, to: &str, day: &str) -> D {
         let D::HandOff(mut hand_off) = hand_off(from, to, REPO, &[]) else { panic!() };
-        hand_off.handed_on = epiphany_pipeline::Date(day.into());
+        hand_off.handed_on = eureka_pipeline::Date(day.into());
         D::HandOff(hand_off)
     }
 
@@ -1905,7 +1905,7 @@ mod tests {
         report.repo = repo(OTHER_REPO);
         assert_eq!(refusal(admit(&mut mind, vec![D::CutReport(report)])), MindRefusal::SpecMismatch { field: "repo".into() });
         let mut report = cut_report("1", 1);
-        report.range.head = epiphany_pipeline::Sha("abcdef0".into());
+        report.range.head = eureka_pipeline::Sha("abcdef0".into());
         assert_eq!(refusal(admit(&mut mind, vec![D::CutReport(report)])), MindRefusal::RangeOutsideCommits { head: "abcdef0".into() });
         committed(admit(&mut mind, vec![resolution(r(K::CutSpec, &id("cut_spec", "cut-1.r1")), withdrawn())]));
         assert_eq!(
@@ -2008,18 +2008,18 @@ mod tests {
         committed(admit(&mut mind, vec![D::CutSpec(cut_spec("1", 1))]));
         // The commit is spelled short and the head full, and the reverse.
         let mut report = cut_report("1", 1);
-        report.range.head = epiphany_pipeline::Sha(full.into());
+        report.range.head = eureka_pipeline::Sha(full.into());
         committed(admit(&mut mind, vec![D::CutReport(report)]));
         let mut report = cut_report("1", 2);
-        report.commits[0].sha = epiphany_pipeline::Sha(full.into());
+        report.commits[0].sha = eureka_pipeline::Sha(full.into());
         committed(admit(&mut mind, vec![D::CutReport(report)]));
         // A head that is no commit's prefix, long or short, is outside.
         let mut report = cut_report("1", 3);
-        report.range.head = epiphany_pipeline::Sha("5f98229d0123456789abcdef0123456789abcdef".into());
+        report.range.head = eureka_pipeline::Sha("5f98229d0123456789abcdef0123456789abcdef".into());
         assert!(matches!(refusal(admit(&mut mind, vec![D::CutReport(report)])), MindRefusal::RangeOutsideCommits { .. }));
         let mut report = cut_report("1", 3);
-        report.commits[0].sha = epiphany_pipeline::Sha(full.into());
-        report.range.head = epiphany_pipeline::Sha("5f98229".into());
+        report.commits[0].sha = eureka_pipeline::Sha(full.into());
+        report.range.head = eureka_pipeline::Sha("5f98229".into());
         assert!(matches!(refusal(admit(&mut mind, vec![D::CutReport(report)])), MindRefusal::RangeOutsideCommits { .. }));
     }
 
@@ -2115,16 +2115,16 @@ mod tests {
         struct Rangeless {
             campaign: Slug,
             verdict: Short,
-            label: epiphany_pipeline::Label,
+            label: eureka_pipeline::Label,
             confidence: FindingConfidence,
-            severity: epiphany_pipeline::FindingSeverity,
+            severity: eureka_pipeline::FindingSeverity,
             claim: Line,
-            invariants: Vec<epiphany_pipeline::Label>,
-            locations: Vec<epiphany_pipeline::CodeLocation>,
-            failure_scenario: epiphany_pipeline::Para,
-            evidence: Vec<epiphany_pipeline::Evidence>,
-            precedents: Vec<epiphany_pipeline::ForeignRef>,
-            origin: epiphany_pipeline::FindingOrigin,
+            invariants: Vec<eureka_pipeline::Label>,
+            locations: Vec<eureka_pipeline::CodeLocation>,
+            failure_scenario: eureka_pipeline::Para,
+            evidence: Vec<eureka_pipeline::Evidence>,
+            precedents: Vec<eureka_pipeline::ForeignRef>,
+            origin: eureka_pipeline::FindingOrigin,
         }
         let whole = finding("1", 1, "F1", FindingConfidence::Plausible);
         let rangeless = Rangeless {
diff --git a/crates/huginn-mind/src/docs.rs b/crates/huginn-mind/src/docs.rs
index ef4d723..e338154 100644
--- a/crates/huginn-mind/src/docs.rs
+++ b/crates/huginn-mind/src/docs.rs
@@ -6,7 +6,7 @@
 //! `stored_at`.
 
 use cultcache_rs::CultCacheEnvelope;
-use epiphany_pipeline::{
+use eureka_pipeline::{
     OrgRepo, PipelineDocument, PipelineKind, PipelineRef, PipelineResolution, PipelineStewardship, ResolutionOutcome,
     Short, Slug,
 };
diff --git a/crates/huginn-mind/src/fixtures.rs b/crates/huginn-mind/src/fixtures.rs
index 0f0f59f..34e44c3 100644
--- a/crates/huginn-mind/src/fixtures.rs
+++ b/crates/huginn-mind/src/fixtures.rs
@@ -4,7 +4,7 @@
 
 use chrono::{DateTime, TimeZone, Utc};
 use cultcache_rs::CultCacheEnvelope;
-use epiphany_pipeline::{
+use eureka_pipeline::{
     AuthorityMap, ClaimOutcome, CodeLocation, CommitRange, CutVerification, Date, DocRef, Evidence, EvidenceKind,
     FindingConfidence, FindingOrigin, FindingSeverity, Label, Line, MutationRecord, OrgRepo, PipelineCampaign,
     PipelineCutReport, PipelineCutSpec, PipelineDocument, PipelineFinding, PipelineFollowUp, PipelineHandOff,
@@ -32,7 +32,7 @@ pub(crate) const NEAR_INSTANCE: &str = "yggdrasix";
 pub(crate) const PREFIXED_INSTANCE: &str = "yggdrasil-two";
 /// A foreign instance differing from `INSTANCE` in case alone. A `Slug` is
 /// dot-joined labels, each `[A-Za-z0-9_-]{1,64}`, bounded to 64 bytes whole
-/// (`epiphany_pipeline::dotted_text`), so this is a name a client may declare
+/// (`eureka_pipeline::dotted_text`), so this is a name a client may declare
 /// and a mind may hold: two minds whose names differ only in case are two
 /// minds, and a comparison that folds case answers one of them for the other.
 pub(crate) const CASED_INSTANCE: &str = "Yggdrasil";
diff --git a/crates/huginn-mind/src/index.rs b/crates/huginn-mind/src/index.rs
index 7ac4869..5719684 100644
--- a/crates/huginn-mind/src/index.rs
+++ b/crates/huginn-mind/src/index.rs
@@ -7,7 +7,7 @@
 //! how a change to it makes every projection rebuild. No network, no JSON, no
 //! store handle: the daemon owns the vector store and the embedder.
 
-use epiphany_pipeline::{PipelineDocument, PipelineKind, PipelineRef};
+use eureka_pipeline::{PipelineDocument, PipelineKind, PipelineRef};
 use sha2::{Digest, Sha256};
 
 use crate::docs::Docs;
@@ -154,7 +154,7 @@ mod tests {
     use crate::fixtures::*;
     use crate::receipt::Faculty;
     use crate::store::test_stores::MemoryStore;
-    use epiphany_pipeline::{
+    use eureka_pipeline::{
         ClaimOutcome, Deviation, FindingConfidence, PipelineDocument as D, PipelineKind as K, RulingAuthority,
     };
     use std::collections::BTreeMap;
diff --git a/crates/huginn-mind/src/lib.rs b/crates/huginn-mind/src/lib.rs
index 29da386..5aa59f7 100644
--- a/crates/huginn-mind/src/lib.rs
+++ b/crates/huginn-mind/src/lib.rs
@@ -18,7 +18,7 @@
 //! so the daemon and the client share one set
 //! of types.
 //!
-//! Document shape, bounds, formats and keys are `epiphany-pipeline`'s; the
+//! Document shape, bounds, formats and keys are `eureka-pipeline`'s; the
 //! organ registers, prepares, decodes and validates through the leaf's four
 //! doors and never re-derives a key. The store is CultLib's owned redb
 //! CultCache, whose lifetime-long exclusive lock is the single-writer
@@ -59,4 +59,4 @@ pub use wire::{
 /// The leaf, whole, through the one crate that pins its rev: the daemon and
 /// the client name `Slug`, `PipelineRef` and the document types from here, so
 /// one `[dependencies]` entry decides which revision the workspace speaks.
-pub use epiphany_pipeline;
+pub use eureka_pipeline;
diff --git a/crates/huginn-mind/src/mind.rs b/crates/huginn-mind/src/mind.rs
index 619471e..a557ff4 100644
--- a/crates/huginn-mind/src/mind.rs
+++ b/crates/huginn-mind/src/mind.rs
@@ -13,7 +13,7 @@ use std::path::{Path, PathBuf};
 
 use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry, OwnedRedbMessagePackBackingStore};
 use cultnet_rs::CursorKey;
-use epiphany_pipeline::{PIPELINE_SCHEMA_EPOCH, PipelineDocument, PipelineKind, Slug, register_pipeline_document_types};
+use eureka_pipeline::{PIPELINE_SCHEMA_EPOCH, PipelineDocument, PipelineKind, Slug, register_pipeline_document_types};
 
 use crate::receipt::HuginnCommitReceipt;
 use crate::refusal::MindRefusal;
@@ -48,7 +48,7 @@ pub(crate) fn unavailable(error: anyhow::Error) -> MindRefusal {
 }
 
 /// A declared name's grammar, checked before its bytes are compared to
-/// anything or reach the filesystem. `Slug` is `epiphany_pipeline`'s,
+/// anything or reach the filesystem. `Slug` is `eureka_pipeline`'s,
 /// dot-joined ASCII labels, and the leaf now opens a public door onto its own
 /// check, `Slug::validate_slug`, on the pattern of `PipelineRef::validate_ref`
 /// (Self's ruling on the F6 fork): the grammar is the leaf's, never
@@ -64,7 +64,7 @@ pub(crate) fn unavailable(error: anyhow::Error) -> MindRefusal {
 /// old wrapper's field, a client never sent) and not a label fragment.
 fn require_grammatical_slug(field: &str, declared: &Slug) -> Result<(), MindRefusal> {
     declared.validate_slug().map_err(|_| {
-        MindRefusal::Document(epiphany_pipeline::PipelineRefusal::InvalidFormat {
+        MindRefusal::Document(eureka_pipeline::PipelineRefusal::InvalidFormat {
             field: field.into(),
             value: declared.0.clone(),
         })
@@ -712,7 +712,7 @@ mod tests {
         let escaping = Slug("..\\..\\escaped".into());
         assert_eq!(
             Mind::open(&inner, &escaping).err(),
-            Some(MindRefusal::Document(epiphany_pipeline::PipelineRefusal::InvalidFormat {
+            Some(MindRefusal::Document(eureka_pipeline::PipelineRefusal::InvalidFormat {
                 field: "instance".into(),
                 value: escaping.0.clone(),
             }))
@@ -734,7 +734,7 @@ mod tests {
         let bad = Slug("not a slug!".into());
         assert_eq!(
             Mind::open_with(store.clone(), &bad).err(),
-            Some(MindRefusal::Document(epiphany_pipeline::PipelineRefusal::InvalidFormat {
+            Some(MindRefusal::Document(eureka_pipeline::PipelineRefusal::InvalidFormat {
                 field: "instance".into(),
                 value: bad.0.clone(),
             }))
@@ -753,7 +753,7 @@ mod tests {
         let bad = Slug("not a slug!".into());
         assert_eq!(
             mind.require_instance(&bad).err(),
-            Some(MindRefusal::Document(epiphany_pipeline::PipelineRefusal::InvalidFormat {
+            Some(MindRefusal::Document(eureka_pipeline::PipelineRefusal::InvalidFormat {
                 field: "declared".into(),
                 value: bad.0.clone(),
             }))
@@ -773,7 +773,7 @@ mod tests {
         assert!(!declared.0.is_ascii(), "U+2010 is not ASCII, unlike plain '-'");
         assert_eq!(
             Mind::open_with(MemoryStore::new(), &declared).err(),
-            Some(MindRefusal::Document(epiphany_pipeline::PipelineRefusal::InvalidFormat {
+            Some(MindRefusal::Document(eureka_pipeline::PipelineRefusal::InvalidFormat {
                 field: "instance".into(),
                 value: declared.0.clone(),
             }))
@@ -789,7 +789,7 @@ mod tests {
     #[ignore = "reads and writes the scratch copy of a live state root named by HUGINN_MIND_SNAPSHOT"]
     fn snapshot_admits_and_reads_back() {
         use crate::fixtures::{admit, r, resolution, withdrawn};
-        use epiphany_pipeline::{PipelineRef, ResolutionOutcome, Short, pipeline_key};
+        use eureka_pipeline::{PipelineRef, ResolutionOutcome, Short, pipeline_key};
 
         let root = std::env::var("HUGINN_MIND_SNAPSHOT").expect("HUGINN_MIND_SNAPSHOT names a scratch copy of the state root");
         let mut mind = Mind::open(Path::new(&root), &slug("eureka")).unwrap();
@@ -816,7 +816,7 @@ mod tests {
                 .unwrap_or_else(|| panic!("{} does not view", envelope.key));
             assert_eq!(view.document, stored, "{}", envelope.key);
             if let PipelineDocument::Resolution(held) = &stored
-                && !matches!(held.outcome, epiphany_pipeline::ResolutionOutcome::Withdrawn { .. })
+                && !matches!(held.outcome, eureka_pipeline::ResolutionOutcome::Withdrawn { .. })
                 && !envelope.key.contains(":resolution:resolution.")
             {
                 resolutions.push(envelope.key.clone());
diff --git a/crates/huginn-mind/src/query.rs b/crates/huginn-mind/src/query.rs
index 7f9d4ca..c71afd8 100644
--- a/crates/huginn-mind/src/query.rs
+++ b/crates/huginn-mind/src/query.rs
@@ -25,7 +25,7 @@ use std::collections::BTreeMap;
 use cultnet_rs::{
     Cursor, EdgeAnchor, EdgeMatch, Evaluation, LIMIT_MAX, LIMIT_MIN, PROJECTION_DOCUMENT, Row, Selection, select, validate,
 };
-use epiphany_pipeline::{
+use eureka_pipeline::{
     ClaimOutcome, CommitRange, Date, FindingConfidence, FindingOrigin, FindingSeverity, Label, Line, OrgRepo,
     PipelineDocument, PipelineKind, PipelineRef, PipelineResolution, ResolutionOutcome, RulingAuthority, Sha, Short,
     Slug, Title,
@@ -621,7 +621,7 @@ mod tests {
     use crate::mind::schema_cache;
     use crate::store::test_stores::MemoryStore;
     use chrono::{TimeZone, Utc};
-    use epiphany_pipeline::{
+    use eureka_pipeline::{
         ClaimOutcome, FindingConfidence, PipelineDocument as D, PipelineKind as K, PipelineRefusal, ResolutionOutcome,
     };
 
diff --git a/crates/huginn-mind/src/receipt.rs b/crates/huginn-mind/src/receipt.rs
index 3abbf16..37b042a 100644
--- a/crates/huginn-mind/src/receipt.rs
+++ b/crates/huginn-mind/src/receipt.rs
@@ -16,7 +16,7 @@
 
 use chrono::{DateTime, SecondsFormat, Utc};
 use cultcache_rs::{CultCacheEnvelope, DatabaseEntry};
-use epiphany_pipeline::{PipelineKind, PipelineRef, Short, Slug};
+use eureka_pipeline::{PipelineKind, PipelineRef, Short, Slug};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
@@ -47,9 +47,9 @@ pub enum Faculty {
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 pub struct PipelineProvenance {
     pub faculty: Faculty,
-    pub agent: epiphany_pipeline::Short,
-    pub session: epiphany_pipeline::Short,
-    pub tool: epiphany_pipeline::Short,
+    pub agent: eureka_pipeline::Short,
+    pub session: eureka_pipeline::Short,
+    pub tool: eureka_pipeline::Short,
 }
 
 /// The exact bytes of one stored document, as read or as written.
@@ -311,7 +311,7 @@ mod tests {
     use crate::mind::schema_cache;
     use crate::store::test_stores::MemoryStore;
     use cultcache_rs::{CacheBackingStore, PushAllOptions};
-    use epiphany_pipeline::{PipelineDocument, PipelineKind, PipelineRefusal};
+    use eureka_pipeline::{PipelineDocument, PipelineKind, PipelineRefusal};
 
     /// A memory store that keeps the replacement set of every swap it was
     /// asked for, so a test can count the commit's calls as well as read
diff --git a/crates/huginn-mind/src/refusal.rs b/crates/huginn-mind/src/refusal.rs
index 1a33ac7..7236184 100644
--- a/crates/huginn-mind/src/refusal.rs
+++ b/crates/huginn-mind/src/refusal.rs
@@ -3,7 +3,7 @@
 //! serialises it, the tools (Cut 13) show it.
 
 use cultnet_rs::SelectionRefusal;
-use epiphany_pipeline::{PipelineKind, PipelineRefusal};
+use eureka_pipeline::{PipelineKind, PipelineRefusal};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
diff --git a/crates/huginn-mind/src/rows.rs b/crates/huginn-mind/src/rows.rs
index 108cc9c..e34623f 100644
--- a/crates/huginn-mind/src/rows.rs
+++ b/crates/huginn-mind/src/rows.rs
@@ -12,7 +12,7 @@
 use std::collections::BTreeMap;
 
 use cultnet_rs::{Row, RowSet, Selection};
-use epiphany_pipeline::{OrgRepo, Label, PipelineDocument, PipelineKind, PipelineRef, ResolutionOutcome, Slug};
+use eureka_pipeline::{OrgRepo, Label, PipelineDocument, PipelineKind, PipelineRef, ResolutionOutcome, Slug};
 
 use crate::docs::{CitationRole, Held, kind_of_id, kind_of_type};
 use crate::query::PipelineDocumentView;
diff --git a/crates/huginn-mind/src/wire.rs b/crates/huginn-mind/src/wire.rs
index 54bce78..a8df61f 100644
--- a/crates/huginn-mind/src/wire.rs
+++ b/crates/huginn-mind/src/wire.rs
@@ -6,7 +6,7 @@
 
 use cultcache_rs::DatabaseEntry;
 use cultnet_rs::{CultMeshCdnArtifactManifest, Selection};
-use epiphany_pipeline::{PIPELINE_SCHEMA_EPOCH, PipelineKind, PipelineRef, Slug};
+use eureka_pipeline::{PIPELINE_SCHEMA_EPOCH, PipelineKind, PipelineRef, Slug};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
diff --git a/schemas/README.md b/schemas/README.md
index eac141b..b871e43 100644
--- a/schemas/README.md
+++ b/schemas/README.md
@@ -1,7 +1,7 @@
 # Schemas
 
-This folder is the canonical paperwork shrine for Epiphany's shared state
-contracts.
+This folder is the canonical paperwork shrine for the state contracts Huginn
+publishes and the pipeline leaf derives.
 
 If a Persona field or Mind document matters
 enough to steer the machine, it should have a receipt here instead of living
@@ -10,15 +10,13 @@ only in one Rust struct or one developer's damp recollection.
 ## Canonical surfaces
 
 - [cultnet/gamecult.persona_state.v0.schema.json](./cultnet/gamecult.persona_state.v0.schema.json):
-  portable Persona state contract for Epiphany Persona, VoidBot repo Personas, and
+  portable Persona state contract for Eureka's Persona, VoidBot repo Personas, and
   Ghostlight characters. It carries explicit provenance, public presentation
   metadata, typed `candidateActions`, and a non-authoritative extension bag for
   source-specific fields; social bonds, status reads, and doctrine stances are
   typed affect records rather than generic thought blobs. Timestamps use JSON
   Schema `date-time`, `presentation` is required, and `custom` enum values have
   companion custom-label fields.
-- [cultnet/epiphany.work_organ_state.v0.schema.json](./cultnet/epiphany.work_organ_state.v0.schema.json):
-  light function-shaped state for Epiphany internal work organs.
 - [cultnet/README.md](./cultnet/README.md):
   JSON Schema publication artifacts for typed CultNet boundaries. Live
   providers own their schema-catalog responses.
@@ -27,7 +25,7 @@ only in one Rust struct or one developer's damp recollection.
 
 The living implementation is in code:
 
-- [mind_documents.rs](/F:/Projects/Epiphany/epiphany-core/src/mind_documents.rs)
+- [eureka-pipeline](../crates/eureka-pipeline/src/lib.rs): the pipeline document types and their derived schemas
 
 The rule is simple:
 
diff --git a/schemas/cultnet/README.md b/schemas/cultnet/README.md
index f6a34a5..3a83839 100644
--- a/schemas/cultnet/README.md
+++ b/schemas/cultnet/README.md
@@ -9,3 +9,15 @@ type of the same name in `crates/huginn-mind/src/wire.rs`. Regenerate by hand
 and the test refuses it:
 `cargo test -p huginn-mind --lib -- --exact wire::tests::published_wire_schemas_match_derivation`
 compares file to derivation byte for byte.
+
+## The pipeline catalogue
+
+`index.json` is the publication manifest for the thirteen
+`epiphany.pipeline.*.v2` schemas and `gamecult.persona_state.v0`. The pipeline
+schemas are derived from the value types in `crates/eureka-pipeline` and checked
+byte for byte by its `pipeline_published_schemas_match_derivation` test. Each
+document payload is `[value]`, a one-element MessagePack array whose element is
+the named map the schema describes. Text bounds are UTF-8 bytes and enforced by
+admission, not by the schema. A new named field with a serde default keeps
+`epiphany.pipeline.epoch.v2`; a breaking change bumps the epoch, and the new
+binary refuses the old store.

From b8bba0950ab08ee6965dfa86d7a41b5125bdeffc Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 14:09:33 +0200
Subject: [PATCH 03/11] Add the mind's design record from Epiphany notes
 (docs/history)

Seven notes copied verbatim from GameCult/Epiphany ef956865 notes/, each with
a one-line provenance comment on top: huginn-organ-cut and the eureka-* and
postmortem notes. Prose only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/history/eureka-body-plane-cut.md         |  902 +++
 docs/history/eureka-pipeline-state-cut.md     | 6465 +++++++++++++++++
 docs/history/eureka-pipeline-state-target.md  |  171 +
 docs/history/eureka-query-prior-art.md        |  524 ++
 docs/history/eureka-read-side-cut.md          | 1246 ++++
 docs/history/huginn-organ-cut.md              |  659 ++
 .../history/postmortem-eureka-schema-phase.md |  226 +
 7 files changed, 10193 insertions(+)
 create mode 100644 docs/history/eureka-body-plane-cut.md
 create mode 100644 docs/history/eureka-pipeline-state-cut.md
 create mode 100644 docs/history/eureka-pipeline-state-target.md
 create mode 100644 docs/history/eureka-query-prior-art.md
 create mode 100644 docs/history/eureka-read-side-cut.md
 create mode 100644 docs/history/huginn-organ-cut.md
 create mode 100644 docs/history/postmortem-eureka-schema-phase.md

diff --git a/docs/history/eureka-body-plane-cut.md b/docs/history/eureka-body-plane-cut.md
new file mode 100644
index 0000000..1731495
--- /dev/null
+++ b/docs/history/eureka-body-plane-cut.md
@@ -0,0 +1,902 @@
+<!-- Provenance: copied verbatim from GameCult/Epiphany ef956865 notes/eureka-body-plane-cut.md; text below this line is unchanged. -->
+# The body plane for oversize answers: cut map
+
+Date: 2026-09-22. Imagination output (Opus). Nothing here is committed and no
+repository was edited. Self places and commits this file; the natural homes
+are a section of `F:\Projects\Epiphany\notes\eureka-pipeline-state-cut.md`
+(the campaign that owns the ruling) with the CultLib half copied or linked
+into `F:\Projects\CultLib\docs\`, because the cut spans the organ and
+CultMesh.
+
+Status: cut map for three cuts, **BP-1** (CultLib: the content plane in the
+Rust runtime), **BP-2** (the pin move that lets Huginn see it) and **BP-3**
+(Huginn: an oversize answer is deferred to the body plane).
+
+**2026-09-29 (Self):** both questions in section 8 are ruled (Q-BP1 A,
+Q-BP2 A, 2026-09-22). Selection Cut 1 merged to CultLib `main` at `dbee044`,
+so section 6's collision is gone. **BP-1 is in Hands** (Sonnet) on CultLib
+`cultmesh/rust-content-plane`, based on `268e0ef`, with two overrides to
+section 3: no committed mutation entries (the operator retired hand-written
+harnesses on 2026-09-22; each rule's test is shown red once by a scratch
+mutant instead), and verification on Yggdrasil through the stopgap rather
+than on the workstation. The Pins table below is as of 2026-09-22.
+
+**BP-1 landed** (Sonnet, 2026-09-29) on `cultmesh/rust-content-plane` at
+`29c3e4c`, `11485fb` and `8a66b1d`. `cultnet-rs` went from 264 to 279 tests,
+plus 3 C# vector tests, and all 22 listed mutants went red. Size: +486 source
+lines against ~330 estimated, and +778 test lines against ~350.
+**Soul (Opus) will merge it after a fix batch, now in Hands:**
+- F1: a flood of zero-size chunks makes the client send unbounded requests;
+- F2: malformed requests are refused at decode, so a Rust server answers
+  nothing where the reference answers `found:false`. **This was the map's
+  defect**: section 3 ordered decode-time request validation, which
+  contradicts "a failure is an answer, never silence". Refusals belong to the
+  answer function;
+- F3: `BTreeMap` metadata breaks byte identity for keys that are not sorted;
+- F4: hashes are normalised only after requests have gone out;
+- F5: one error spelling differs from the reference;
+- F6: 8 surviving mutants.
+Held: byte identity in both directions beyond the fixture, verification,
+serving, validation order, and one path. The empty-body deviation (one
+zero-length chunk) is the reference's behaviour, so the spec was wrong there too.
+
+**The ruling this map is written under** (operator, 2026-09-17, recorded in
+the Epiphany map at about line 368): an answer too large for the control
+plane travels over CultMesh's content/body transfer. The control plane
+carries a summary and a reference to the body. Raising the window
+(1,228,800 bytes) and bounding documents smaller were both rejected. **The
+typed oversize refusal stays as the backstop.** The ruling says the cut "spans
+the organ and CultMesh", and nothing about it was in Cut 10 except the refusal.
+
+## Pins
+
+| Repo | Branch | HEAD | State |
+|---|---|---|---|
+| CultLib | `main` (checked out; the operator's shell is on `main`, and the gitStatus snapshot's `cultnet/selection-cut1` is the locked worktree `.claude/worktrees/agent-af580008561975a4c`, also at `b3d9cf7`) | `b3d9cf7` | Dirty in `native/GameCult.Mesh.Quic.Native/*` and `scripts/mutate-cultmesh.mjs` from the QUIC campaign. **Not touched.** `git diff --stat a0813c6 b3d9cf7 -- packages/cultcache-rs packages/cultnet-rs packages/cultmesh-rs` is **empty**, so every Rust anchor below holds at Huginn's pin as well. |
+| CultLib selection Cut 1 | `cultnet/selection-cut1` | `b3d9cf7` + uncommitted work in the locked worktree | In Hands (another agent). The collision is in section 6. |
+| Huginn | `eureka/memory-organ` | `202e5e3` | Clean. Cut 10 and its two fix batches have landed. |
+| Epiphany | `codex/eureka-pipeline-state` | `2876a827` | Map read only. The leaf `epiphany-pipeline` is pinned by Huginn at `5cda0886` and pins `cultcache-rs` at `a0813c6`. |
+
+## 0b. Model page: identity, lifecycle and authority
+
+This table was written before any cut was mapped. Every persistent or
+long-lived kind the cut touches has a row, and no cell is empty.
+
+| Kind | Identity (what names it) | Lifecycle (what happens to it over time) | Authority (who decides) |
+|---|---|---|---|
+| **Deferred body**: the encoded bytes of one `HuginnMindResponse` that did not fit one send | The SHA-256 of those bytes, lowercase hex: the manifest's `contentHash`. Two identical answers are one body. | Created when an answer's encoded envelope exceeds the window and the body is within the deferral bound. A second deferral of the same bytes refreshes it; it is never duplicated. Every chunk served also refreshes it (sliding expiry). It expires when it has been untouched for the TTL, and it is evicted least-recently-touched first when the retained total exceeds the budget. It is lost when the process exits, and the client asks again. It is never written to the mind, a file or any `.cc` store. | The daemon's serve module (`huginn-daemon`) decides to defer and holds the retention store. The mind decides what the answer *is* and knows nothing about deferral. |
+| **Chunk** | The SHA-256 of the chunk's bytes. Its record key is `mesh:cdn:chunk:<hash>`, which is the C# reference's spelling (`CultMeshCdnArtifactChunk.CreateRecordKey`, `CultMeshCdn.cs:120`). | It lives exactly as long as some retained body references it. A chunk shared by two bodies is stored once and stays until both are gone. | Chunking (the boundaries and the hash) belongs to `cultnet-rs` `pack_content`. Retention belongs to the daemon's store. |
+| **Reference (manifest)** | `gamecult.mesh.cdn_artifact_manifest.v1`, the reference's type, reused and not reinvented. `contentHash` identifies the body; `artifactId` and the other fields describe it and never identify it. | Transient: minted with the body, carried once inside the deferred response, and never stored by the daemon or the client. It stays valid while the body is retained. After that a chunk request answers `found: false` and the client re-asks the operation. | `cultnet-rs` owns the shape and the validation rules, with parity to `CultMeshCdn.ValidateManifestShape` (`CultMeshCdn.cs:499-526`). The daemon fills it in. |
+| **Deferred response**: the control-plane answer that stands in for an oversize one | Correlated by the operation envelope's `messageId`, exactly like every other answer. | One per request, sent once, and never deferred itself. It always fits: at the deferral bound it is about 41 KB, far under the window. | Only the daemon's serve module produces it. `Mind` never does. |
+| **Content chunk wire messages** `cultmesh.content_chunk_request.v1` / `.response.v1` | Their `schemaVersion` strings, both already defined by the reference (`CultNetSchemaMessages.cs:153,157`, classes `:1414-1446`). | Stateless: one request, one response. | The C# reference owns the spelling. `cultnet-rs` gains it with byte identity, pinned by vectors in both directions. |
+| **Vector fixtures** `contracts/cultmesh/content-vectors.cs-written.json` and `.rs-written.json` | File path plus the `label` of each vector. | Committed. Each writer regenerates its own file under `CULTNET_WRITE_VECTORS=1`. The file is expected to grow and is not pinned as final. | Each runtime owns its written file. Both runtimes' tests read both files. |
+| **Mind documents and receipts** | Unchanged: leaf keys and receipt ids. | Unchanged. **No body-plane state enters the mind.** | Unchanged: `huginn-mind` admission. |
+
+Forks this page surfaced, which are sections 8's Q-BP1 and Q-BP2:
+
+- **Authority over the physical path.** CultMesh's own doctrine forbids
+  schema messages carrying bulk bodies and names the RUDP content path as
+  legacy. That is Q-BP1.
+- **What the summary is.** The ruling says "a summary". Whether that means the
+  reference's own facts or a per-operation typed summary decides whether
+  `huginn-mind` grows new types. That is Q-BP2.
+
+**Identity cannot be the request.** Re-deriving a body per chunk request from
+the mind would need no retention at all. But a chunk request names only a
+hash, so the daemon could not know which answer to recompute without a
+Huginn-specific request shape, and that would give up wire reuse with the
+reference. Rejected for that reason, not asked.
+
+## 1. Body facts
+
+Each fact is backed by a source read at the pins above or by a probe that
+ran code. The probes are in the scratchpad and nothing was committed:
+
+- `bodyplane-cs/`: a net10.0 console against the built reference DLLs
+  `bin/GameCult.{Networking,Mesh}/Debug/netstandard2.1/*.dll`, dated
+  2026-09-16. The sources it depends on last moved at `f622ee1` (2026-08-18),
+  so the DLLs match `b3d9cf7`. It emitted real reference bytes to
+  `bodyplane-cs/out/`.
+- `bodyplane-rs/`: a crate against `packages/cultnet-rs` by path, release
+  build. `src/main.rs` is the transport probe and `src/bin/parity.rs` the
+  byte-parity probe.
+- `pinprobe/`: `cargo tree -d` over mixed CultLib git revisions.
+
+### F1. Only the C# reference implements body or content transfer. The Rust client Huginn uses has no path today.
+
+- **Source.** Across `packages/` there is no occurrence of
+  `content_chunk_request`, `body_read_request`, `cdn_artifact_manifest`,
+  `ContentChunk*` or `BodyRead*`, and no `cdn`, `chunkHash` or
+  `artifact_manifest` in any `.rs`, `.ts`, `.py` or `.kt` source.
+  `cultnet-rs` does not contain the word "body". What the other runtimes have
+  is the *local* stream-body negotiation enum (`SharedMemory`,
+  `CultCachePage`, `InlineBytes`, and so on): `cultmesh-rs/src/lib.rs:191-200`,
+  `cultnet-py/.../cultmesh_contracts.py:434`, and in `cultmesh-ts` and
+  `cultmesh-kotlin`. That is same-machine body mapping, not network transfer.
+- **Probe A (decode).** `cultnet_rs::decode_cultnet_message_from_slice` over
+  bytes the C# reference emitted:
+  - `content_chunk_request` gives *unknown variant
+    `cultmesh.content_chunk_request.v1`*, because the closed enum
+    (`contracts.rs:252-392`) lists 20 `cultnet.*` variants.
+  - `content_chunk_response`, `body_read_response` and a real 256 KiB chunk
+    response give *invalid type: byte array, expected any valid JSON value*.
+    The non-raw decode path converts through `serde_json::Value`
+    (`contracts.rs:404-411`), which cannot hold MessagePack `bin`. So adding
+    the variants alone is not enough: both must ride the raw path that
+    `document_put_raw` uses (`contracts.rs:771-854`).
+- **Probe E (on the wire).** A Rust hub sent the reference's own 262,357-byte
+  chunk response raw on the `schema` channel. The transport delivered it, and
+  the Rust client refused it in `receive_schema_message_once` with the same
+  byte-array error.
+
+**Conclusion:** no Rust runtime can request, answer, decode or verify a body
+or a content chunk today. Rust gets its first content-plane code in BP-1.
+
+### F2. The reference has two planes, and only one of them fits this class of content.
+
+- **The content plane.** It carries large immutable artifacts
+  (`src/GameCult.Mesh/docs/content-sessions.md:1-3`). The reference is a
+  `CultMeshCdnArtifactManifest` (`CultMeshCdn.cs:127-190`) listing
+  content-addressed chunks (default 4 MiB, `CultMeshCdnPackOptions`
+  `:44`). The chunk protocol is one bounded response per chunk
+  (`content-sessions.md:44-46`). The transfer owner
+  (`CultMeshContentTransferService`, `CultMeshContentTransfer.cs:115`) is the
+  only owner of chunk verification, whole-body SHA-256 verification, resume
+  and promotion. The preferred connector is TCP: a typed header, then raw
+  bytes outside the envelope (`transport-planes.md:22-26`). It is plaintext
+  and **restricted to explicit loopback development**
+  (`transport-planes.md:103-106`). The RUDP content server
+  (`CultMeshLegacyRudpContentServer`, `CultMeshContentSessions.cs:14-87`) is
+  "basement priority and exists for compatibility and parity measurement"
+  (`transport-planes.md:93-96`), and its connector is never installed by
+  default (`CultMeshContentSessions.cs:97-116`, priority 10,000).
+- **The body plane proper.** It carries live, lease-bound generations of
+  mutable bodies: `CultMeshNetworkBodyStore` (`CultMeshBodySessions.cs:19-219`,
+  a 16 MiB default bound, 8 retained generations, HMAC capability tokens,
+  expiry by lease). It is served **whole in one response**
+  (`CultMeshBodyServer.HandleAsync`, `:241-272`, payload inline). There is no
+  chunking.
+- **Why that decides it.** A pipeline answer is an immutable artifact, which
+  is the content plane's stated class. The body plane's single response meets
+  exactly the wall the ruling is routing around: probe B's whole-body send
+  failed with `RUDP reliable send queue is full`. The operator's phrase
+  "content/body transfer" covers both planes, and the source says which one
+  this is. **This map uses the content plane's chunk protocol and manifest.**
+  It is recorded as a reading of the source, not asked, because the body
+  plane cannot carry this answer on any transport Huginn has.
+
+### F3. What the wire carries. Decoded from real bytes and pinned at byte level.
+
+| Message | Reference encoding (probe, hex prefix) | Fields in order |
+|---|---|---|
+| `cultmesh.content_chunk_request.v1` | named map `0x85`, 169 bytes for the sample | `schemaVersion`, `messageId`, `chunkHash` (64 hex), `recordKey` (may be empty), `expectedSizeBytes` (int32) |
+| `cultmesh.content_chunk_response.v1` | named map `0x87`, 179 bytes for a 4-byte payload | `schemaVersion`, `messageId`, `found`, `chunkHash`, `sizeBytes` (int32), `payload` (**MessagePack `bin`**), `error` (string, empty on success) |
+| `gamecult.mesh.cdn_artifact_manifest.v1` | **array** `0x9A` (10 integer-keyed fields), 1,097 bytes for 6 chunks | `[artifactId, kind, version, contentHash, sizeBytes(int64), mimeType, createdAtUtc, chunks[[chunkHash, offset(int64), sizeBytes(int32), recordKey]], tags[], metadata{}]` |
+| `cultmesh.body_read_response.v1` (not used) | named map `0x8B`, 11 fields | whole generation in `payload` |
+
+Measured:
+
+- A 256 KiB chunk response encodes to **262,357 bytes**, 213 bytes of
+  overhead, so four fit in Huginn's 1,228,800-byte window.
+- The manifest for the real 1,315,551-byte case at 256 KiB chunks is 6 refs
+  and 1,097 bytes.
+- **Probe parity:**
+  - A Rust `rmpv` map written in the reference's key order is **byte-identical**
+    to the reference's request (169 = 169) and response (179 = 179).
+  - A Rust tuple-shaped manifest decodes the reference's bytes and re-encodes
+    them **byte-identically**.
+  - A Rust re-pack of the same body with SHA-256 at 256 KiB reproduces every
+    chunk reference (hash, offset, size, record key) and the content hash.
+  - `rmp_serde::to_vec_named`, the encoder Huginn uses for responses, still
+    writes a tuple-shaped type as an array (`0x9A`). So the reference's array
+    form survives inside Huginn's named-map payload **only if** the Rust type
+    serialises as a tuple.
+
+### F4. Chunked delivery works on Huginn's exact transport. Pipelining past the window does not.
+
+Probes B, C and D used a hub configured exactly as Huginn's `serve::bind`
+(`serve.rs:135-143`: fragment 1200, pending 1024, one settled session) and the
+real 1,315,551-byte body, with chunks carried as base64 inside operation
+responses, the only bytes-bearing message Rust has today.
+
+- **One reply carrying the whole body** (a 1,754,254-byte envelope):
+  `RUDP reliable send queue is full`, returned to the sender only.
+- **Sequential request, then reply, one chunk at a time** at 256, 512 and 768
+  KiB: delivered whole and SHA-equal, in 1.56 s, 1.54 s and 1.45 s on loopback
+  (about 0.85 MB/s, paced by the 32-packet send window,
+  `rudp.rs:34`). **Chunk size barely moves throughput.**
+- **900 KiB** as base64 is a 1,228,983-byte envelope, which exceeds the window,
+  so the send fails.
+- **Six 256 KiB chunks sent without waiting:** four accepted, two refused
+  immediately, and all four accepted ones were delivered. This is Cut 10's F2
+  (pipelined reads) reproduced at chunk scale. The window is per session and
+  counts unacknowledged packets.
+
+**Consequence for the design:** the fetch is sequential, one chunk in
+flight, at 256 KiB. With `bin` payloads, as opposed to this probe's base64,
+one chunk reply is 262,357 bytes, which leaves room for a control-plane
+answer on the same session.
+
+### F5. Moving one CultLib pin duplicates `cultcache-rs` even when its content is identical.
+
+`pinprobe` (`cultcache-rs` at `a0813c6` beside `cultnet-rs` at `b3d9cf7`,
+whose `cultcache-rs` content is byte-identical) reports **two**
+`cultcache-rs v0.2.0` and two `cultcache-rs-derive` in `cargo tree -d`,
+because Cargo keys a git source by revision.
+
+Huginn has three pins at `a0813c6`: `huginn-mind`'s `cultcache-rs`,
+`huginn-daemon`'s `cultnet-rs`, and the Epiphany leaf `epiphany-pipeline`'s
+`cultcache-rs` (at leaf `5cda0886`). All three must move together, or "one
+crate pins one revision" breaks (see `huginn-daemon/Cargo.toml` and the Cut 8
+build check `cargo tree -p huginn-mind -e normal -d` with zero duplicates).
+That is BP-2.
+
+### F6. Huginn today.
+
+The anchors in `huginn-daemon/src/serve.rs` at `202e5e3`:
+
+- The module doc's stated limit is at `:10-17`, and the pipelined-read
+  paragraphs are at `:32-44`.
+- `MAX_FRAGMENT_BYTES`, `MAX_PENDING_RELIABLE_PACKETS` and `MAX_RESPONSE_BYTES`
+  are at `:124-131`, and `bind` is at `:135-143`.
+- `answer` (`:165-194`) routes `OperationRequest` and `SchemaCatalogRequest`,
+  and answers every other family with `Error` (`:188-192`).
+- **`within_window` (`:217-251`) is the single owner of the size decision
+  today.** It encodes the envelope, admits it at `<= MAX_RESPONSE_BYTES`, and
+  otherwise answers `Refused(ResponseTooLarge { bytes, limit })`.
+- `run` (`:257-305`) reads the clock once per frame, at `:294`.
+
+Elsewhere in the organ:
+
+- `MindRefusal::ResponseTooLarge` is at `huginn-mind/src/refusal.rs:57-65`, and
+  its doc names the daemon as owner.
+- `HuginnMindResponse` is at `huginn-mind/src/wire.rs:81-90`, and `status` is
+  at `:97-102`.
+- The published schema is `schemas/cultnet/huginn.mind_response.v1.schema.json`,
+  pinned byte for byte by `published_wire_schemas_match_derivation`
+  (`wire.rs:210-216`).
+- The tests that pin the gate are
+  `an_answer_too_large_for_one_send_is_a_typed_refusal_that_reaches_the_client`
+  (`serve.rs:548-656`) and
+  `the_gates_boundary_is_the_transports_boundary_byte_for_byte`
+  (`serve.rs:749-777`).
+- The mutation entries D20, D20L through D20L5, D21 and D21L are in
+  `tools/eureka-cut10-mutations.psd1:250-330`.
+- `huginn-mind` has **no** `cultnet-rs` dependency today. The selection
+  consumer cut adds one, because `Query { instance, selection }` carries the
+  substrate's type (`docs/cultnet-selection-cut.md` §12).
+- `eureka-state/src/lib.rs` is empty. Cut 13 has not been built.
+
+## 2. The cut order
+
+```
+[selection Cut 1, Rust commit 3 lands on CultLib main]   (in Hands now, not this map)
+        │
+        ▼
+BP-1  CultLib   the content plane in cultnet-rs (wire, manifest, pack, answer, verified fetch) + vectors both ways
+        │
+        ▼
+BP-2  Epiphany leaf + Huginn   one pin move to a CultLib rev carrying selection Cut 1 and BP-1
+        │
+        ├──► [Huginn selection consumer cut]   (Epiphany map, unnumbered, not this map)
+        ▼
+BP-3  Huginn    an oversize answer is deferred to the body plane; the refusal becomes the backstop
+        │
+        ▼
+Cut 11 / Cut 13 (Cut 13's spec gains: resolve a Deferred answer)
+```
+
+BP-3 comes **after** the Huginn selection consumer cut by default, for two
+reasons. That cut already adds `cultnet-rs` to `huginn-mind`, which BP-3's
+response variant needs. It also deletes `open_items` and `history`, so BP-3
+tests fewer read operations. If the operator orders BP-3 first, BP-3 adds
+that dependency itself (section 7, BP-3 "Adds") and nothing else changes.
+
+## 3. Cut BP-1. The content plane in `cultnet-rs`
+
+- **Repo and branch:** CultLib, `cultmesh/rust-content-plane`, from `main`
+  **after selection Cut 1's Rust commit (its commit 3) has landed on `main`**.
+  It depends on nothing else. See section 6 for why it cannot branch now.
+- **First:**
+  - Record `packages/cultnet-rs` baseline tests (51 in `tests/cultnet.rs`
+    and 7 in `tests/rudp_server_hub.rs` at `b3d9cf7`; recount at the actual
+    base).
+  - Record the target-dir path count and size.
+  - Capture the reference's bytes for every vector with the C# writer
+    before writing any Rust.
+- **Deletes first:** none. This cut fills an absence. No Rust code carries a
+  body today, so nothing is stood beside, and there is no compensator to cut.
+  This is stated rather than padded.
+- **Keeps (untouched):**
+  - Every C# source file. The reference does not change: its chunk classes,
+    serializer arms (`CultNetSchemaMessageSerialization.cs:79-80`), CDN pack
+    and validation, and servers stay as they are.
+  - `CultNetDatabaseSubscribeMessage` and its `bodyIds`/`supportedBodyTransports`.
+  - `CultMeshBodyDemand.cs` and `CultMesh.cs`.
+  - `contracts/cultnet/*.schema.json` and `CultNetSchemaRegistry.cs`.
+  - `cultmesh-rs` (Huginn does not depend on it, and this cut does not make it).
+  - `rudp.rs` (the transport carries these as ordinary schema frames).
+- **Adds:**
+
+| Add | Owner | Live consumer | Protected invariant | Why an existing owner cannot serve |
+|---|---|---|---|---|
+| `contracts.rs`: `CultNetMessage::ContentChunkRequest { message_id, chunk_hash, record_key, expected_size_bytes: i32 }` and `ContentChunkResponse { message_id, found, chunk_hash, size_bytes: i32, payload: Vec<u8>, error }`, renamed to the reference's `schemaVersion`s, **both on the raw path** | `cultnet-rs` | Huginn's daemon (BP-3), `fetch_content` | **byte identity with the reference in both directions** | The closed enum cannot carry them (F1). The JSON-value path cannot carry `bin` (F1). |
+| `src/content.rs`: `CultMeshCdnArtifactManifest` and `CultMeshCdnChunkRef` (the reference's names; named Rust fields; serde `into`/`from` a private tuple mirror, so every encoder writes the reference's array, F3) | `cultnet-rs` | BP-3's deferred response, the fetch | one reference vocabulary across runtimes; the array form survives `to_vec_named` | A Huginn-local reference type would be a second vocabulary for one thing |
+| `normalize_hash` (mirrors `CultMeshCdn.NormalizeHash`, `CultMeshCdn.cs:549-560`: an optional case-insensitive `sha256:` prefix is stripped, then trimmed, then lowercased; empty is refused) | `cultnet-rs` | answer, fetch | one hash spelling | — |
+| `pack_content(artifact_id, kind, version, mime_type, created_at_utc, bytes, chunk_size) -> (CultMeshCdnArtifactManifest, Vec<CultMeshCdnChunk>)` (mirrors `CultMeshCdn.PackArtifact`, `:232-310`) | `cultnet-rs` | BP-3's store | **the same bytes and options produce the reference's manifest byte for byte** | — |
+| `validate_manifest` (mirrors `ValidateManifestShape`, `:499-526`, **including its sort by offset before the contiguity check**) and a caller-supplied `max_bytes` refused **before any fetch** | `cultnet-rs` | `fetch_content` | a hostile or corrupt manifest never makes a client allocate or ask | — |
+| `answer_content_chunk_request(request, lookup: impl Fn(&str) -> Option<&[u8]>) -> CultNetMessage` (mirrors `CultMeshLegacyRudpContentServer.HandleAsync`, `CultMeshContentSessions.cs:43-86`, **in its validation order**: message id, hash normalisation, record-key agreement with `mesh:cdn:chunk:<hash>`, lookup, size and hash of what is served; a failure is `found: false`, an empty payload, and `error` = `<ExceptionKind>: <message>` in the reference's spelling) | `cultnet-rs` | BP-3's `serve::answer` | a server never serves bytes whose hash is not the requested one, and never answers a failure as silence | Rust has no `ICultNetSchemaServer`, so a pure function is the whole server |
+| `fetch_content(manifest, max_bytes, ask: impl FnMut(CultNetMessage) -> Result<CultNetMessage>) -> Result<Vec<u8>>`: sequential, one chunk in flight, in manifest-offset order; verifies each response's correlation id, `found`, size and SHA-256 against the reference, then the whole body's size and SHA-256 against `contentHash` | `cultnet-rs` | Huginn's tests now, `eureka-state` (Cut 13) later | **one owner of verification on the receiving side**, as `CultMeshContentTransferService` is in the reference; no caller re-derives a check | The reference's transfer service is durable and file-promoting, and a C# owner does not serve Rust. This is its in-memory subset, with no resume, no failover and no files |
+| `lib.rs:21-39`: `mod content; pub use content::*;` | `cultnet-rs` | — | — | — |
+| `tests/content.rs` (new) | `cultnet-rs` | CI | the rules below | — |
+| `contracts/cultmesh/content-vectors.cs-written.json` and `content-vectors.rs-written.json`: request, response found, response not found, and manifest vectors. A **deterministic** body (`byte[i] = i % 251`, 1,315,551 bytes, the real oversize case) at 256 KiB. **The fixture must carry:** a hash given with an uppercase `SHA256:` prefix; a manifest whose chunk list is **out of offset order**, which the reference accepts; a final chunk shorter than the rest; a zero-length body (0 chunks); and a chunk response whose `chunkHash` differs from its payload's hash in the **last** hex digit only. Otherwise a loosening that compares prefixes cannot fail. | each runtime writes its own | `tests/content.rs`, the C# test below | **vectors the reference writes decode and re-encode identically in Rust, and the other way round** | — |
+| `tests/GameCult.Mesh.Tests/CultMeshContentVectorTests.cs` (**a new file**, not `NetworkingTests.cs`, which the selection cut is rewriting): writes the cs vectors under `CULTNET_WRITE_VECTORS=1`; asserts the committed cs vectors equal a fresh encode; decodes the rs-written vectors, asserts field equality and byte-identical re-encode; asserts `CultMeshCdn.PackArtifact` of the fixture body equals the fixture manifest | C# tests | CI | parity from the reference's side | — |
+| Docs: `src/GameCult.Mesh/docs/transport-planes.md` cut line (`:93-101`) and `content-sessions.md` gain one paragraph each naming the Rust runtime's content path and its transport (the wording depends on **Q-BP1**); `docs/runtime-parity-scope.md` gets one row | docs | — | describe the live system | — |
+
+No new dependency: `sha2`, `serde_bytes` and `rmpv` are already in
+`cultnet-rs/Cargo.toml:14-31`. No new package, binary, transport, store
+format or JSON schema file (see section 5).
+
+- **Per-file changes** in `packages/cultnet-rs/src/contracts.rs` at `b3d9cf7`.
+  Re-anchor at the base, because selection Cut 1 moves this file.
+  - **`:252-392`**, the enum: two variants after `OperationResponse`.
+    `payload` is `#[serde(with = "serde_bytes")]`, although the raw path
+    never serialises it through serde.
+  - **`:398-418`**, `parse_cultnet_message`: both `schemaVersion`s join the
+    raw arm at `:405`.
+  - **`:420-436`**, `encode_cultnet_message_for_wire`: both join the raw arm
+    at `:427`.
+  - **`:458-643`**, `validate_message`: two arms.
+    - Request: `messageId` non-empty; `chunkHash` non-empty after
+      normalisation; `expectedSizeBytes >= 0`.
+    - Response: `messageId` non-empty. `found` implies
+      `payload.len() == sizeBytes` and an empty `error`. Not `found` implies
+      an empty payload.
+    - These are the reference's own invariants, as its constructors and
+      `HandleAsync` produce them. They are not new policy.
+  - **`:771-810`**, `parse_raw_cultnet_schema_message`: two arms, reading
+    `bin` via `as_slice` and ints via `as_i64` range-checked to `i32`.
+  - **`:812-854`**, `encode_raw_cultnet_schema_message`: two arms writing keys
+    **in the reference's declaration order** (F3), with the payload as
+    `rmpv::Value::Binary`.
+  - **`:964-1138`**, the `gamecult.networking.v0` path: unchanged. Its `_`
+    arms already refuse. A test pins that refusal.
+- **Authority map:**
+  - **Owner:** `cultnet-rs::content` owns chunking, hashing, manifest shape,
+    manifest validation, answering a chunk request and verifying a fetched
+    body, for every Rust runtime. `contracts.rs` owns the two messages'
+    spelling.
+  - **Inputs:** bytes plus pack options (packing); a chunk request plus a
+    lookup (answering); a manifest, a size cap and a transport closure
+    (fetching).
+  - **Outputs:** a manifest and chunks; a chunk response message; verified
+    bytes or a typed error.
+  - **Derived state:** `recordKey` is derived from the hash and is never an
+    independent identity. `sizeBytes` and `contentHash` are derived from the
+    bytes.
+  - **Forbidden writers:** no consumer (Huginn, `eureka-state`) hashes,
+    chunks, validates a manifest or checks a chunk itself. No consumer
+    re-orders or retries chunks behind `fetch_content`.
+  - **Shared paths:** the daemon's answer and the client's fetch both call
+    `normalize_hash`. `pack_content` and `validate_manifest` share the one
+    contiguity rule.
+  - **Deletion line:** none. This is the first owner.
+- **Verification:**
+  - **Builds** (PowerShell, `$env:CARGO_TARGET_DIR='C:\Users\Meta\.cargo-target-codex'`):
+    `cargo test -p cultnet-rs --tests` from `packages/cultnet-rs`; then
+    `dotnet test tests/GameCult.Mesh.Tests --filter CultMeshContentVectorTests`.
+  - **Tests, each with the rule it pins and the mutants that must kill it**
+    (committed in `scripts/mutate-cultmesh.mjs`, CultLib's own runner, which
+    owes the Eureka harness contract by name, **once the QUIC campaign has
+    released that file**; see section 6):
+    - `reference_vectors_encode_byte_identically` pins byte identity of the
+      two messages and the manifest.
+      Mutants:
+      - swap two keys in `encode_raw`'s request arm (revert-shaped);
+      - write `payload` as a `str` or an array of ints (loosening);
+      - encode the manifest through a named-field struct, i.e. drop the tuple
+        mirror (loosening, killed because `to_vec_named` then writes a map).
+    - `rust_vectors_decode_in_the_reference` (C#) pins the direction the
+      reference reads.
+      Mutant: Rust writes `sizeBytes` as a `u64`, which MessagePack-CSharp
+      rejects into `int`.
+    - `a_chunk_response_carries_bin_through_the_raw_path` pins F1's failure
+      mode.
+      Mutant: remove the response from the raw arm at `:405`. It must fail
+      with the byte-array error.
+    - `normalize_hash_matches_the_reference` pins the reference's
+      normalisation.
+      Mutants:
+      - case-sensitive prefix strip;
+      - no lowercasing;
+      - no trim (each killed by the fixture's `SHA256:` uppercase vector).
+    - `a_manifest_out_of_offset_order_is_accepted_as_the_reference_accepts_it`
+      pins parity of the sort.
+      Mutant: drop the sort. It must fail, because the fixture's chunk list
+      is shuffled.
+    - `a_manifest_over_the_cap_is_refused_before_any_request` pins that the
+      cap precedes fetching.
+      Mutants:
+      - check the cap after the first chunk (the test counts closure calls,
+        expecting 0);
+      - compare `>` instead of `>=` at the boundary.
+      The cap's boundary vector is exactly `max_bytes` accepted and one byte
+      over refused. **At least one mutant must be a function of the input**:
+      `max_bytes * 2`. The probe sizes sit where doubling would admit them.
+    - `a_chunk_whose_hash_differs_in_the_last_digit_is_refused` pins whole-hash
+      comparison.
+      Mutants:
+      - compare the first 63 characters;
+      - compare lengths;
+      - compare prefixes.
+      All are killed only because the fixture pair differs in the last digit.
+    - `a_body_whose_chunks_verify_but_whole_hash_does_not_is_refused` pins the
+      whole-body check.
+      Mutant: skip the final `contentHash` comparison. The fixture substitutes
+      a manifest whose chunk refs are valid but whose `contentHash` is another
+      body's.
+    - `a_response_for_another_message_id_is_refused` pins correlation.
+      Mutant: skip the id check.
+    - `answer_refuses_a_record_key_that_disagrees_with_its_hash` pins parity
+      with `HandleAsync`'s third check.
+      Mutant: delete the record-key check.
+    - `answer_serves_found_false_with_the_reference_error_spelling` pins that a
+      failure is an answer.
+      Mutant: return `Error` instead.
+    - `gamecult_networking_contract_refuses_content_messages` pins that the
+      legacy contract does not grow them.
+      Mutant: add them to its encoder.
+    - A **no-op control** rewrites each target through the runner's I/O path
+      and must leave everything green.
+  - **Negative checks:**
+    - `git diff --stat main -- src/GameCult.Networking src/GameCult.Mesh/*.cs contracts/cultnet packages/cultmesh-rs packages/cultnet-rs/src/rudp.rs`
+      is empty.
+    - `rg -n "untagged" packages/cultnet-rs/src/content.rs` is empty.
+  - **Operator:** nothing to click. This cut's evidence is the two vector files.
+- **Subtraction estimate:** removes 0 lines. Adds about 330: `content.rs`
+  about 190, `contracts.rs` about 90, `lib.rs` 2, and docs about 20. Tests add
+  about 260 Rust and 90 C#, plus two vector files. There are no dependencies,
+  targets or formats to remove or add. **The delta is net positive because it
+  buys an explicitly ruled capability with the smallest surface that carries
+  it: the reference's own wire and reference type, not a new one.**
+- **Build budget:**
+  - Host and target are both the Windows workstation, debug.
+  - Rust: `cultnet-rs` library and tests only, in the warm codex target dir.
+    The probe's release build of the same crate by path added 945 files and
+    0.32 GiB (12.31 to 12.63 GiB) cold. The expected debug delta is up to
+    +1,000 paths and about +0.4 GiB. Nothing is cleaned.
+  - C#: `GameCult.Mesh.Tests`, which rebuilds Networking, Mesh and Caching as
+    dependencies with no source change in them.
+  - No native build, no TypeScript, no Python, no workspace-wide build.
+  - C: had 258 GB free.
+  - The Linux target (Yggdrasil) is not exercised here. Nothing in this cut
+    is platform-specific, and Cut 14 builds on Yggdrasil.
+
+## 4. Cut BP-2. One pin move
+
+- **Repo and branch:** Epiphany `codex/eureka-pipeline-state` and Huginn
+  `eureka/memory-organ`. It depends on BP-1 **and** selection Cut 1 being on
+  CultLib `main`, pushed.
+- **Why it is its own cut:** F5. Moving `cultnet-rs` alone duplicates
+  `cultcache-rs`. The selection consumer cut needs the same move, so **one**
+  move to one revision carrying both CultLib changes serves both Huginn cuts.
+  That saves a second leaf release and a second Huginn bump. Self schedules
+  it once, whichever Huginn cut runs first.
+- **Changes:**
+  - Epiphany `epiphany-pipeline/Cargo.toml` `cultcache-rs` rev: from
+    `a0813c6…` to the new CultLib SHA. This is one commit. The leaf's own
+    tests must stay green. `cultcache-rs` content is unchanged across
+    `a0813c6..b3d9cf7`, so any change after that is itself a finding.
+  - Huginn: `crates/huginn-mind/Cargo.toml` `cultcache-rs` rev and
+    `epiphany-pipeline` rev to the new leaf SHA, and
+    `crates/huginn-daemon/Cargo.toml` `cultnet-rs` rev. This is one commit.
+- **Verification:**
+  - `cargo tree -p huginn-daemon -e normal -d` shows zero `cultcache-rs` or
+    `cultnet-rs` duplicates.
+  - The full Huginn suite is green: 74 tests at `202e5e3`.
+  - The cut8, cut9 and cut10 mutation suites rerun clean.
+  - `rg "a0813c6" F:\Projects\Huginn\crates F:\Projects\Epiphany\epiphany-pipeline`
+    is empty.
+- **Subtraction:** 0 or 0. Only four revision strings change.
+- **Build budget:** Huginn workspace check and tests, and `epiphany-pipeline`
+  library tests. Each is a cold compile of three CultLib crates at a new
+  revision, about +300 to +600 paths. The same host as before.
+
+## 5. Cut BP-3. Huginn defers an oversize answer to the body plane
+
+- **Repo and branch:** Huginn `eureka/memory-organ`. It depends on BP-2 and,
+  by default, on the Huginn selection consumer cut (section 2). It needs
+  **Q-BP2** answered, and **Q-BP1** decides one paragraph of its module
+  documentation.
+- **First:** rerun
+  `an_answer_too_large_for_one_send_is_a_typed_refusal_that_reaches_the_client`
+  and record the two sizes it prints. At `202e5e3` they are 1,315,551 bytes
+  for the wide view and 1,189,495 for the fitting one. They are the
+  before-and-after witness.
+- **Deletes first:**
+  - `serve.rs:217-251` `within_window` is **deleted whole**. It is the one
+    owner of the size decision, and it is replaced by `deliver` (below), not
+    wrapped. A gate that refuses and a second gate that defers would be two
+    owners of one decision.
+  - `serve.rs:10-17`, the stated limit ("This is the current bound and not a
+    design target… expect the number to move"), is deleted. The number no
+    longer moves, because the window stops being the organ's delivery limit.
+  - In `tools/eureka-cut10-mutations.psd1:250-330`, entries D20, D20L, D20L2,
+    D20L3, D20L4, D20L5, D21 and D21L are **deleted from the cut10 suite and
+    re-authored in BP-3's suite** against the new spelling. Their `Old`
+    anchors name `within_window`'s lines, which no longer exist, so leaving
+    them would make the cut10 runner fail on anchor-not-found rather than on
+    a rule.
+- **Keeps:**
+  - `MAX_FRAGMENT_BYTES`, `MAX_PENDING_RELIABLE_PACKETS` and
+    `MAX_RESPONSE_BYTES` (`:124-131`): the window is still what one send
+    carries.
+  - `MindRefusal::ResponseTooLarge { bytes, limit }` keeps its name and
+    shape; **its doc is re-scoped** (below).
+  - The pipelined-read paragraphs `:32-44`, unchanged and still true:
+    deferral does not fix F2.
+  - `encode_or_fail` (`:197-215`).
+  - The `Daemon` dispatch. `daemon.rs` is untouched: **the mind and the pure
+    dispatch know nothing about deferral.**
+- **Adds:**
+
+| Add | Owner | Live consumer | Protected invariant | Why an existing owner cannot serve |
+|---|---|---|---|---|
+| `huginn-mind/src/wire.rs:81-90`: `HuginnMindResponse::Deferred(DeferredAnswer)` with `DeferredAnswer { manifest: CultMeshCdnArtifactManifest }` under Q-BP2 A, or plus the typed summary under B; `status()` (`:97-102`) answers `accepted` for it. The manifest's schema is embedded through a `#[schemars(schema_with)]` field attribute returning a `$ref` to its published schema, as the selection consumer cut now does for `Selection` (corrected 2026-09-22: a hand-written `impl JsonSchema` for a foreign type is `E0117`, the orphan rule). `schemas/cultnet/huginn.mind_response.v1.schema.json` is regenerated. **The schema id stays `v1`**, because no client of it exists (Cut 13 is unbuilt) | `huginn-mind` (types only) | the daemon, Cut 13 | the reference rides the response schema, so there is no second vocabulary for a client | `HuginnMindResponse` is the only response a client decodes |
+| `huginn-daemon/src/bodies.rs` (new), `DeferredBodies`: a map from chunk hash to bytes with reference counts, and a map from content hash to `(chunk hashes, bytes, last_touched)`. `retain(manifest, chunks, now)`, which is idempotent on the content hash and refreshes it; `chunk(hash, now) -> Option<&[u8]>`, which refreshes the owning bodies; `expire(now)`; eviction least-recently-touched first when the total is over budget. Constants: `DEFERRED_CHUNK_BYTES = 256 * 1024`; `MAX_DEFERRED_BODY_BYTES = 64 MiB`; `DEFERRED_BUDGET_BYTES = 256 MiB`; `DEFERRED_TTL = 60 s`, which is twice `session_timeout`, and is a field of `ServeOptions` (`:70-79`) with that default | `huginn-daemon::serve` | `deliver`, `answer` | retention is bounded in bytes and time, and a body is never evicted while its chunks are being served within the TTL | The mind must not hold transport artifacts. `cultnet-rs` owns no retention policy, and should not, because the policy is this service's memory budget |
+| `serve.rs`: `deliver(reply, message_id, operation, runtime_id, bodies, now)` replaces `within_window`. It encodes the envelope. If the envelope is `<= MAX_RESPONSE_BYTES`, the reply is sent unchanged. Otherwise it takes the **payload bytes**, the named MessagePack of the response. If they are `<= MAX_DEFERRED_BODY_BYTES`, it calls `pack_content("huginn.mind_response", "package", "", "application/vnd.gamecult.huginn.mind-response+msgpack", now, payload, DEFERRED_CHUNK_BYTES)`, then `bodies.retain`, and answers `Deferred`. Otherwise it answers `Refused(ResponseTooLarge { bytes: payload_len, limit: MAX_DEFERRED_BODY_BYTES })` | `huginn-daemon::serve` | `answer` | **the one owner of how an answer is delivered.** Three outcomes, in that order, and nothing else decides | — |
+| `serve.rs:165-194`, `answer`: a new `CultNetMessage::ContentChunkRequest` arm calls `cultnet_rs::answer_content_chunk_request(request, \|h\| bodies.chunk(h, now))`. The error text at `:188-192` names the third family. The signature gains `bodies: &mut DeferredBodies`, and `run` (`:257-305`) owns one and passes it | `huginn-daemon::serve` | the client's fetch | a chunk is answered on the requester's own session, like every other frame | — |
+| `refusal.rs:57-65`, doc only: `ResponseTooLarge` is now "the answer exceeds the largest body the organ will deliver by any plane", `limit` is `MAX_DEFERRED_BODY_BYTES`, and `bytes` is the encoded answer (the payload, not the envelope). It is still the daemon's, and still never raised by the mind | `huginn-mind` | clients | **the backstop stays, per the ruling** | — |
+
+- **Authority map:**
+  - **Owner:** `huginn-daemon::serve::deliver` decides, per answer, between
+    delivering it whole, deferring it, or refusing it. `DeferredBodies` owns
+    retention. `cultnet-rs::content` owns chunking, hashing, the manifest and
+    chunk answering.
+  - **Inputs:** the encoded reply, the window constants, the deferral bound,
+    the store's state and the per-frame clock read (`serve.rs:294`, still the
+    crate's only one).
+  - **Outputs:**
+    - The reply, unchanged.
+    - `Deferred { manifest }` plus retained chunks.
+    - `Refused(ResponseTooLarge)`.
+    - `ContentChunkResponse` for each chunk request.
+  - **Derived state:**
+    - The manifest and the chunk hashes are derived from the payload bytes.
+    - The deferred body is **cache-only** (ephemeral transport state, like
+      the reference's `CultMeshNetworkBodyStore`, `CultMeshBodySessions.cs:15-18`,
+      "not a CultCache document store and not world truth").
+    - The mind is not a writer or a reader of any of it.
+  - **Forbidden writers:**
+    - `Daemon::handle` and `Mind` never produce `Deferred` and never read the
+      window.
+    - No second gate: `within_window` is gone, and nothing else compares
+      against `MAX_RESPONSE_BYTES`.
+    - The client never re-derives a check: it calls `fetch_content`.
+    - No pagination or truncation behind the caller's back (the Cut 10 F1
+      ruling still holds).
+  - **Shared paths:** every operation's reply passes through `deliver`,
+    including `Whoami` and `Admit`. There is no per-operation path to
+    deferral. Direct replies and chunk replies leave through the same
+    `hub.send_schema_message` at `:295`.
+  - **Deletion line:** `within_window` and the stated-limit paragraph are
+    deleted before `deliver` is added, and the cut10 entries that anchored
+    on them are removed in the same commit.
+- **Verification:**
+  - **Builds** (PowerShell, the codex target dir):
+    - `cargo test -p huginn-mind --lib`;
+    - `cargo test -p huginn-daemon --lib`;
+    - `cargo check --workspace`;
+    - `cargo tree -p huginn-daemon -e normal -d`, which must show no
+      `cultcache-rs` or `cultnet-rs` duplicate.
+  - **Tests, each with its rule and mutants.** They are committed in a new
+    `tools/eureka-bodyplane-mutations.psd1` and run by the Eureka harness
+    `C:\Users\Meta\.claude\skills\eureka\tools\eureka-mutations.ps1 -Repo F:\Projects\Huginn`,
+    with a no-op control.
+    - `an_oversize_answer_arrives_deferred_and_fetches_to_the_same_answer`
+      rewrites `serve.rs:548-656` over a real loopback hub and a real mind.
+      The wide view, at 1,315,551 bytes, comes back `Deferred`. The client
+      runs `cultnet_rs::fetch_content` over the **same session**, one chunk
+      in flight, and decodes the bytes as `HuginnMindResponse`. The result
+      **equals** `daemon.handle` of the same request, and is `View(Some)` and
+      not `Deferred`. The fitting view and `Whoami` still arrive directly.
+      This pins the ruling.
+      Mutants:
+      - `deliver` refuses instead of deferring (revert to Cut 10's
+        behaviour);
+      - `deliver` defers at `MAX_RESPONSE_BYTES * 2` (a function of the input:
+        the wide answer sits between 1x and 2x, so doubling lets it through
+        whole and the send fails silently, and the test times out with no
+        reply).
+    - `the_delivery_boundary_is_the_transports_boundary_byte_for_byte`
+      rewrites `serve.rs:749-777`. An envelope of exactly `MAX_RESPONSE_BYTES`
+      goes direct; one byte more is `Deferred`, **not** refused. This pins
+      that the threshold is the window.
+      Mutants:
+      - `<` for `<=` (off by one);
+      - measure the payload and not the envelope (the old D20L5, re-authored);
+      - `MAX_RESPONSE_BYTES - MAX_FRAGMENT_BYTES` (a function of the constant
+        that a "safety margin" edit would produce).
+    - `an_answer_over_the_deferral_bound_is_refused_by_name` uses a synthetic
+      response sized exactly `MAX_DEFERRED_BODY_BYTES` (deferred) and one
+      byte more (refused, with `bytes` = payload length and `limit` =
+      `MAX_DEFERRED_BODY_BYTES`). This pins that the backstop stays and is
+      measured against the deferral bound.
+      Mutants:
+      - `if true` (never refuse);
+      - `limit: MAX_RESPONSE_BYTES` (the old limit leaking through);
+      - `bytes: envelope_len` (the wrong measure);
+      - `MAX_DEFERRED_BODY_BYTES * 4` (a function of the input).
+    - `a_deferred_answer_is_never_itself_deferred` pins a rule written
+      *inside* `deliver`: the deferred reply is always under the window, and
+      a body never decodes to `Deferred`. Encode the `Deferred` reply at the
+      bound (about 256 manifest refs) and assert it is `<= MAX_RESPONSE_BYTES`.
+      Mutant: recurse `deliver` on the deferred reply.
+    - `retention_is_idempotent_and_sliding` exercises `DeferredBodies` alone
+      with an injected `now`. The same body deferred twice is stored once, and
+      its budget use is counted once. A chunk served at `t = TTL - 1`
+      refreshes the body, so it survives to `2 * TTL - 2`. An untouched body
+      is gone at `TTL`.
+      Mutants:
+      - expiry from creation rather than last touch;
+      - `>` rather than `>=` at the TTL boundary;
+      - a TTL that is a function of the input (`ttl / 2`);
+      - count bytes per retain instead of per body.
+    - `eviction_is_least_recently_touched_and_bounded_in_bytes` uses three
+      bodies over the budget. The one touched longest ago goes first, and a
+      shared chunk survives while any owner lives.
+      Mutants:
+      - evict the newest;
+      - evict by insertion order (killed because the fixture touches the
+        oldest-inserted body last);
+      - free a shared chunk with its first owner.
+    - `an_evicted_body_answers_found_false_and_the_client_can_ask_again`
+      pins lifecycle end to end.
+      Mutant: `chunk()` returns stale bytes after eviction. That is
+      impossible by construction, so the mutant used is "do not refresh on
+      serve" at a TTL shorter than a fetch.
+    - `the_mind_never_sees_a_deferral` is a negative test:
+      `rg -n "Deferred|DeferredBodies|MAX_RESPONSE_BYTES" F:\Projects\Huginn\crates\huginn-mind\src`
+      matches only the `wire.rs` variant and its schema test.
+    - `published_wire_schemas_match_derivation` (`wire.rs:210-216`, kept)
+      pins that the regenerated schema equals the derivation.
+    - **Scenario sited at the decision:** the loopback test holds its client
+      on the `Deferred` reply **before** fetching and asserts the manifest's
+      `sizeBytes` equals the direct `daemon.handle` payload's length. That
+      observation is at the decision, not downstream of the fetch (the
+      skill's "put the observation where the rule is decided").
+  - **Negative checks:**
+    - `rg -n "fn within_window" F:\Projects\Huginn\crates` is empty.
+    - `rg -n "sha2|Sha256" F:\Projects\Huginn\crates\huginn-daemon\src` is
+      empty, because hashing belongs to `cultnet-rs`.
+    - Verified to not collide: `huginn-mind`'s `sha2` is for receipts, in
+      another crate.
+  - **Operator:** none until Cut 14. The real-network check (WireGuard to
+    Yggdrasil, an oversize read end to end) is Cut 14's runbook step and is
+    recorded there.
+- **Subtraction estimate:**
+  - Removes about 35 lines (`within_window` 35, the stated-limit doc 8) and
+    8 mutation entries.
+  - Adds about 190 lines: `bodies.rs` about 110, `deliver` about 35, the
+    `answer` arm 8, the wire variant with its `schema_with` `$ref` about
+    35.
+  - Tests are about +220 net over the rewritten two.
+  - Entries: 8 removed, about 20 added.
+  - No dependency is added: `cultnet-rs` is already a daemon dependency, and
+    `huginn-mind` already has it after the selection consumer cut. If BP-3
+    runs first, it adds that dependency to `huginn-mind`, and that is the one
+    listed cost.
+- **Build budget:**
+  - `huginn-mind` and `huginn-daemon` library and tests, warm after BP-2.
+  - Expected +50 to +200 paths.
+  - Host and target are both the workstation. The unix arm is not exercised,
+    and Cut 14 builds on Yggdrasil.
+
+## 6. Interaction with CultNet selection Cut 1, and sequencing
+
+Selection Cut 1 is in Hands on `cultnet/selection-cut1` in the locked worktree
+`.claude/worktrees/agent-af580008561975a4c`, based at `b3d9cf7`.
+
+**What it touches, from its own map:**
+
+- `CultNetDatabaseSubscribeMessage`: v1 classes beside v0. It **keeps** the
+  body-plane demand fields `bodyIds` and `supportedBodyTransports`, which its
+  §5 lists as not selection.
+- `CultMeshBodyDemand.cs:177-221` and `CultMesh.cs` body and snapshot
+  selector construction.
+- `CultNetSchemaRegistry.cs:360-385`.
+- `CultNetSchemaMessageSerialization.cs:9-85`.
+- `NetworkingTests.cs`.
+- In Rust: `packages/cultnet-rs/src/contracts.rs:314-331`, which gains
+  `SnapshotRequestV1`, `DatabaseSubscribeV1` and `SnapshotResponseRawV1`. The
+  last is a **raw** message, so it edits the same `parse_raw` and
+  `encode_raw` dispatch this map edits.
+- `lib.rs` re-exports, the new `selection.rs`, and the vector writer pattern
+  under `CULTNET_WRITE_VECTORS=1`.
+
+**Semantic interaction: none.** `bodyIds` and `supportedBodyTransports` on the
+subscribe message are demand for *live* bodies, the reference's body plane
+proper (F2). This cut uses the content plane and never touches that message,
+its schema, the body-demand code or the database subscription server and
+client. A Huginn read is an operation request and not a subscription, so the
+two cuts share no rule.
+
+**Textual collision: certain, in five places:**
+
+- the `CultNetMessage` enum;
+- `parse_cultnet_message`'s raw arm;
+- `encode_cultnet_message_for_wire`'s raw arm;
+- `parse_raw` and `encode_raw`;
+- `validate_message`;
+- and `lib.rs`.
+
+Two Hands in one working tree is forbidden, and two branches editing one
+dispatch list is a merge that falls to whoever lands second.
+
+**Sequence:**
+
+1. Selection Cut 1 lands its Rust commit (its commit 3) on `main`.
+2. BP-1 branches from that `main`. The anchors in section 3 are re-taken at
+   that base, and the discrepancy is reported.
+3. BP-1 lands.
+4. BP-2 moves the pins once to a revision carrying both.
+5. Then the Huginn selection consumer cut and BP-3, in that order by
+   default.
+
+BP-1 does **not** add JSON schema files or registry entries, so it does not
+touch `CultNetSchemaRegistry.cs` or `contracts/cultnet/`, which selection
+Cut 1 is editing. The absence of published schemas for the content messages
+predates both cuts and is a follow-up (section 7).
+
+**The mutation runner:** `scripts/mutate-cultmesh.mjs` is modified in the
+working tree by the live QUIC campaign. BP-1 adds its entries only after that
+file is committed or released, and never onto someone else's uncommitted
+edit. If the QUIC campaign still holds it when BP-1 is ready, BP-1 carries
+its entries in a new `scripts/mutate-cultnet-content.mjs` under the same
+contract, and Self collapses the two later. That is a default, not a
+question.
+
+## 7. Deliberately not in scope
+
+- **Pipelined chunk fetch, and Cut 10's F2 (pipelined reads).** The fetch is
+  sequential. F4 shows the throughput barely depends on chunk size, and
+  pipelining is the known way to lose a reply silently. A window-aware sender
+  is a transport change in `rudp.rs`, not this cut.
+- **Throughput.** About 0.85 MB/s on loopback (F4), set by the 32-packet
+  pacing window. A 64 MiB body takes about 75 s. Recorded, not addressed.
+- **A TCP or QUIC content connector in Rust, and Rust session identity with
+  Odin-signed route certificates.** These are the reference's
+  `CultMeshSessionIdentityClient` and `transport-planes.md:73-86`. Huginn's
+  control plane has none of that today, and the body rides the same session
+  with the same (absent) trust. **Trust for both planes is Cut 14's** (D8, the
+  trust boundary).
+- **Durable, resumable or file-promoted fetch** (the reference transfer
+  service's resume state and `<content-hash>.body` promotion). An answer is
+  re-asked, not resumed.
+- **Publishing JSON schemas for `cultmesh.content_chunk_*`.** The reference
+  never published them: there is no file in `contracts/cultnet/` and no entry
+  at `CultNetSchemaRegistry.cs:360-385`. Follow-up: a CultLib parity fill for
+  every runtime, after selection Cut 1 has released the registry.
+- **The TypeScript, Python and Kotlin content plane.** It follows when one of
+  them has a caller, the same rule the selection cut ruled.
+- **The live body plane** (`body_read_*`, `CultMeshNetworkBodyStore`, body
+  demand) in Rust.
+- **Persisting deferred bodies across a daemon restart.**
+- **Per-operation summaries,** unless Q-BP2 B is ruled. Row-level summaries
+  are the selection vocabulary's projections.
+- **Cut 13's client handling of `Deferred`.** Consequence for Cut 13's spec,
+  to be carried into its refresh: every read tool resolves `Deferred` through
+  `cultnet_rs::fetch_content` with a cap no larger than
+  `MAX_DEFERRED_BODY_BYTES`, and treats `ResponseTooLarge` as "narrow the
+  selection".
+- **Consequence for Cut 14's spec:** the daemon's memory budget on Yggdrasil
+  grows by up to `DEFERRED_BUDGET_BYTES` (256 MiB).
+
+## 8. Operator questions
+
+Two real forks. Every other choice above (the content plane over the body
+plane per F2, the reference's manifest, the ephemeral store, the constants,
+the order) is a default with its reason stated. It is recorded, not asked.
+
+**Q-BP1: RULED A by the operator, 2026-09-22 ("A is fine here").**
+- Chunk requests and responses travel on the session the client already
+  holds, byte-identical on the wire to the reference's
+  `CultMeshLegacyRudpContentServer`.
+- BP-1 amends `transport-planes.md` to name this as Rust's *explicit* content
+  path, never an implicit default.
+- It lasts until Rust has an authenticated content connector, TCP+TLS or
+  QUIC. That later move sits behind the same `fetch_content` owner and needs
+  no change to the reference type.
+
+*History, the question as asked:* **Q-BP1. Which physical path carries the body?**
+
+CultMesh's own transport doctrine says "Schema messages must not carry bulk
+bodies" and that the RUDP content path is legacy, "compatibility and parity
+measurement" only (`transport-planes.md:90-96`). But the only session
+Huginn and its client share is CultNet RUDP, and the doctrine's preferred
+content plane (TCP byte stream) is plaintext and loopback-only until TLS
+(`:103-106`), while Huginn serves remote clients over WireGuard.
+
+- **A. Chunk request and response on the session the client already holds.**
+  This is wire-identical to the reference's `CultMeshLegacyRudpContentServer`.
+  `transport-planes.md` is amended to name it as the Rust runtime's
+  *explicit* content path, never an implicit default, until Rust has an
+  authenticated content connector. Cost: it re-legitimises, for Rust, a path
+  the C# doctrine retired, and it inherits RUDP's pacing (F4).
+- **B. Port the TCP content plane to Rust** (`cultmesh-content+tcp://`, a
+  typed header and raw bytes). Faster, and outside the envelope. It is
+  blocked for Huginn by the doctrine's own loopback-only gate until TLS
+  exists, so it needs a TLS content connector as well: a much larger cut, and
+  Huginn waits on it.
+- **C. Wait for authenticated QUIC in Rust**, which does not exist. Huginn's
+  oversize answers stay refused until then.
+
+**Recommended: A.** It is the only option that delivers what the ruling
+asked for on the substrate Huginn has. It reuses the reference's wire byte
+for byte, and the amendment keeps the doctrine honest rather than quietly
+contradicted. B and C are where the body moves later, behind the same
+`fetch_content` owner and without changing the wire's reference type.
+
+**What depends on it:** BP-1's documentation paragraph, whether BP-1 grows a
+TCP connector (B), and whether BP-3 can land before a TLS campaign (B and C
+block it).
+
+**Q-BP2: RULED A by the operator, 2026-09-22 ("I accept your
+recommendations").** The deferred answer carries the reference's own facts:
+the manifest (`sizeBytes`, `contentHash`, the chunk list) and the operation.
+It carries no per-operation summary. Row-level facts come from asking again
+with a header projection. `huginn-mind` gains no summary types. B can be added
+later on the selection projection if Cut 13's tools show the need.
+
+*History, the question as asked:* **Q-BP2. What is "the summary" the control plane carries?**
+
+- **A. The reference's own facts.** The manifest carries `sizeBytes`,
+  `contentHash` and the chunk list, and the envelope carries the operation.
+  A caller decides whether to fetch on size alone. Anything row-level (ids,
+  statuses, `matched`) comes from asking again with a selection projection,
+  which the selection cut already provides.
+- **B. A typed per-operation summary produced by the mind:** for a view, the
+  id, kind, status and admission facts without the document; for a page,
+  `matched` and row references. The caller can act without fetching at all.
+  Cost: new summary types and derivations in `huginn-mind`, one per read
+  operation, re-specified whenever the selection consumer cut reshapes the
+  reads, plus schema growth.
+
+**Recommended: A.** It keeps deferral a pure transport decision owned by one
+function that knows nothing about operations. A per-operation summary is a
+second projection vocabulary beside the one the operator just ruled into
+CultNet. If Cut 13's tools show that agents need to decide without fetching,
+B can be added then, on the selection projection rather than beside it.
+
+**What depends on it:** `DeferredAnswer`'s shape, whether `huginn-mind`
+gains types, BP-3's size (B adds about 120 lines and a test per operation),
+and Cut 13's tool output.
+
+## 9. What was probed, what was only read, and what is not settled
+
+- **Probed by running code:** F1 (decode refusals, plus the on-wire refusal),
+  F3 (real reference bytes, byte identity of both messages and the manifest
+  in Rust, the Rust re-pack equal to the reference's), F4 (whole-body send
+  failure; sequential delivery at three chunk sizes with SHA equality and
+  timings; the 900 KiB failure; the pipelining loss), and F5 (duplicate
+  `cultcache-rs` under mixed revisions).
+- **Read only, not run:**
+  - C# `ValidateManifestShape` sorting and contiguity, `NormalizeHash`, and
+    the legacy server's validation order. These are the rules the vectors
+    will pin in BP-1.
+  - The reference's TCP connector behaviour and the loopback-only gate, from
+    `transport-planes.md`, not from running `CultMeshTcpContentTransport`.
+  - Selection Cut 1's exact edit sites in the worktree. I read its map, not
+    its uncommitted diff, and did not open the locked worktree's changes, to
+    avoid reading another agent's working tree mid-edit.
+- **Not probed:**
+  - Throughput over WireGuard or to Yggdrasil (loopback only).
+  - The 60 s TTL against a real slow link.
+  - C# decoding **Rust-written** bytes. Byte identity makes it follow, but
+    BP-1's C# test is the first thing that will actually run it.
+  - Whether a hostile chunk flood can starve the control plane on one
+    session (the window is per session, so the likely answer is that it can
+    starve only the flooding session). Recorded for Cut 14's trust pass.
+- **Substrate missing, recorded per the skill:** typed pipeline state. This
+  map, its model page and its questions live in markdown because Huginn,
+  which would hold them, is the thing being built.
diff --git a/docs/history/eureka-pipeline-state-cut.md b/docs/history/eureka-pipeline-state-cut.md
new file mode 100644
index 0000000..a0b21c9
--- /dev/null
+++ b/docs/history/eureka-pipeline-state-cut.md
@@ -0,0 +1,6465 @@
+<!-- Provenance: copied verbatim from GameCult/Epiphany ef956865 notes/eureka-pipeline-state-cut.md; text below this line is unchanged. -->
+# Eureka pipeline state: cut map
+
+Date: 2026-09-15 (first Imagination pass), remapped 2026-09-16 after the
+operator rejected the repo-owned store.
+
+Status: cut map. The ends are owned by `notes/eureka-pipeline-state-target.md`;
+this document owns the means. Self updates this header in every landing commit.
+
+**Cuts 1-6, 6b, 6c and 6d are landed and closed inside Epiphany, and Cuts 7,
+8 and 9 are landed and closed inside Huginn. Cut 10 is mapped and in Hands.
+Cuts 11-16 are unbuilt, and none of them is in this repo.** The old Cuts 3b-7
+described a repo-owned store and are dead; they are
+kept, clearly marked, under "History" at the end of this file. Nothing above
+that section describes the old model.
+
+**Ordering against the other campaigns.** Operator rulings, 2026-09-16:
+
+- First ruling: the StreamPixels rescue is the portfolio piece, so CultLib's
+  TypeScript QUIC realtime plane goes ahead of Huginn, and the schema work
+  here stops at Cut 6c so that `epiphany-pipeline` is a clean leaf with
+  published schemas and no half-built service.
+- Correction, same day, in the operator's words: "I'm fine with doing the
+  CultLib cut without Huginn, but I want the StreamPixels migration to run
+  with it. If it's to be our portfolio piece, we want full Eureka capabilities
+  demonstrated." So this campaign does **not** pause after Cut 6c. The QUIC
+  cut runs without Huginn; Huginn (Cuts 7-16) lands before the StreamPixels
+  migration starts, so that migration runs on typed pipeline state end to end.
+  Sequence: Cut 6c → QUIC (CultLib) and Cuts 7-16 (Huginn, a different repo,
+  may run alongside) → StreamPixels on Eureka with `eureka-state`.
+
+Self still writes a postmortem at the Cut 6c boundary, because it closes the
+schema-ownership phase inside Epiphany, not because the campaign stops.
+
+- **Cut 1 landed** at `2b76c2e7`, `df82992c`. CultLib re-pinned to `a0813c6`.
+- **Cut 2 landed** at `00991c1b`, `46460efc`, `cb6ef5d2`. One commit owner,
+  parameterised by a `TypedCommitStore` profile.
+- **Cut 3a landed** at `a1473c45`, `ad18c385`, then fixes at `b4f88d29`,
+  `187e01e7`, `a317d4cf`. Ten document kinds, ten derived schemas, plus the
+  store opener, writer lease and git preconditions that **Cut 4 deleted**.
+- **Cut 4 landed** at `ca275c7b`, `a9f06c2a`, fixes at `43a08baa`, `8a598ebb`,
+  `186dbc62`. The repo-owned store died whole.
+- **Cut 5 landed** at `1758ad50`, `4c091f57`, fixes at `617c397d`. One commit
+  owner, no profile.
+- **Cut 6 landed** at `7ab838f1`, `d17cc441`, `08c1c9d9`, fixes at `eb55efe9`,
+  `b6f6e802`, `80db5db6`, `3ee78e05`, second fix batch at `9b68d83c`,
+  `4cccb45c`, `4a654351`. `epiphany-pipeline` is a leaf library Huginn can
+  depend on without `epiphany-core`.
+- **Cut 6b landed and closed** at `602ffd9f` (deletes), `1bddd2ac`
+  (grammar), `95ee551a` (mutation suite), with three fix batches at
+  `4b85dd2d`, `d03a32df`, `9370aa0f`, `f00062db`, `9d57a460`, `7cd1a38b`.
+  The second fix batch's Soul pass on Cut 6 had found the same invariant
+  open one level up for the third time, so the key grammar was redesigned
+  rather than patched a fourth time; Soul found no collision in 212,450
+  adversarial keys. The shared mutation harness came out of its fix
+  batches.
+- **Cut 6c landed and closed** at `4d6af409`, `13570e84`, `dddf9ede`, fix
+  batch `fcfbda3f`, `3f7d58d1`, harness repairs `b3bd4a82`, `aef0e1bf`.
+- **Cut 6d leaf half landed** at `9699751f` (the sequences) and `b82c76df`
+  (entries M23-M27); 31 tests; exactly two schemas regenerated; every
+  earlier suite still killed. **Soul-closed on every code promise** (303
+  distinct keys over sequences 0, 1, 9, 10 and the maximum, nested at each
+  level, no collision, every key reading back to its kind, subject and
+  sequence; a subject local ending in `n1` cannot be confused with a
+  sequence because the sequence is exactly one part and always present;
+  the prefix selects one subject's history; the bounds as stated; twelve
+  non-revert mutants dead). Two coverage gaps on the paths Cuts 9 and 12
+  lean on, in Hands with the Huginn follow-up: a nested resolution's own
+  sequence was unpinned because every nested fixture used 1 at both
+  levels, and no test resolved a stewardship subject. Stated for the spec:
+  hand-built ids like `…n01` pass the grammar as labels, the leaf never
+  emits them, and admission treats them as missing referents; neither
+  refuses nor canonicalises. Tests delta was +181, not +173. The "additive,
+  no epoch" claim rests on "no store exists yet", not on a serde default;
+  the map records both definitions. The two tests landed at `d5a36c2a`, the
+  new pin. **The Huginn follow-up landed** at `3efc0dc` (pin, sequences,
+  recursive in-force, the four sequence and in-force refusals, the Q19 cap,
+  the collision arm deleted) and `fcb7fdd` (entries H40-H51 including the
+  six Cut 8 test gaps, README stubs); 33 tests each side; H1-H51 killed.
+  **Soul closed the leaf half and did not close the follow-up** (Fable;
+  `soul-cut6dh-*` and `soul_cut6dh_probe.rs` in the session scratchpad,
+  real redb over two stores). Held: every entry on both sides, the pin
+  exact, no `epiphany-core`, the greps, the docs; the reopen path (n1
+  Answered, withdrawal, n2 Answered, n2 again refused out of sequence, n3
+  refused already resolved, withdrawal of the withdrawal refused, in-force
+  n2, all readable after reopening the store); the transfer path over two
+  minds with the numbers Hands gave; the derived sequences after reopens.
+  Found, in a fix batch (Opus): **an exact replay of any batch with a
+  derived write is refused, not `AlreadyAdmitted`** (high; `derive`
+  recomputes `latest + 1` over an image that already holds the first
+  admission's derived record, so the re-derived document differs and A8
+  refuses before A9; a regression from `30daff8`, where derived writes had
+  no sequence, and the replay test used only batches without derivations);
+  **withdrawing a withdrawal on a base kind reinstates an earlier record
+  beside a later one** (medium; two stewardships of one repo in force
+  after away, back, and a withdrawal of the first withdrawal; the same
+  shape for a target's supersession), closed by Self's rule above;
+  "exactly previous plus one" unpinned against gaps; the cap's and
+  `latest_resolution`'s batch scope unpinned; the hand-off's derived
+  withdrawal sequence unpinned. Observations: a reopened question is open
+  and the code agrees; a ruling stays in force after its `Answered`
+  resolution is withdrawn; a byte-identical resubmission after a reopen
+  is `AlreadyAdmitted`.
+
+  **The fix batch landed** (Opus) at `f566fe6` (`derive` reproduces the
+  record it already made when image or batch holds one, found by content:
+  `Answered { by: this ruling }`, a withdrawal whose `reason` is the
+  hand-off key, an assignment whose `note` is; `WouldReinstateOverLater`
+  after the Q19 cap, scoped by `(instance, repo)`, subject, campaign, or
+  `(campaign, cut)` — Hands extended the rule to target and cut-spec bases
+  because Self's own test case had a target base with no scope named, and
+  Self kept it), `564d492` (entries H52-H61) and `7b67730` (H45/H46
+  re-anchored). 41 tests, 61 entries killed. One deviation: Hands ran a
+  scoped `cargo clean` on the shared target dir against its brief, freeing
+  and partly retaking about 400 MB; Soul could not establish that anything
+  of another crate's was evicted, and the next brief forbids it by name.
+  **Soul's scoped second pass** (Fable, under the new brief shape) held the
+  content match between rulings, the receiving-side replay after a hand-on,
+  every F2 scope, and 61 of 61; and found: **the source-side hand-off
+  replay picks its subject by key order** once two stewardships are in
+  force under the replayed hand-off's exclusion, so from the tenth transfer
+  on (`…n10` sorts before `…n2`) the replay derives a withdrawal of the
+  wrong record and dies at A10 (low: refuses, nothing lands; but the
+  "AlreadyAdmitted for all three derived kinds" promise is false past nine
+  transfers); **the resolution-base arm of the reinstatement rule is dead**,
+  since the cap fires first (delete it: dead code with a test that cannot
+  reach it is the failure mode of subtraction); four suite gaps with the
+  code right by probe. Stated, defensible under ruling 20 and recorded as a
+  limit the views must not hide: **a replay refuses once its scope has
+  advanced** (a first hand-off replayed after a later one assigned the next
+  sequence is out of sequence; a first ruling replayed after a second
+  answered the reopened question is already resolved), with a refusal text
+  that reads oddly for a record already in the image, and asymmetric with
+  the source side. **The follow-up closes well enough to map Cut 9**; the
+  subject-selection fix and the dead arm landed at `1bcb7ce` (Opus): the
+  selection sits in `stewardship_of` itself, since `derive` is its only
+  order-sensitive caller; the colliding pair is `n11` before `n2` after
+  ten round trips, not `n10`; ten round trips alone do not expose the
+  loosening, so the test hands `n11` away, withdraws that withdrawal, and
+  replays; the dead arm is gone and Soul's Y7 is unexpressible, said in
+  the entries header; H62-H67 cover the two fixes and the four gaps. 46
+  tests, 67 of 67 killed. **The follow-up is closed.** One tooling scar:
+  `CARGO_TARGET_DIR=C:\…` through the Bash tool collapses the backslashes
+  and cargo starts a from-scratch build into a path that does not exist;
+  nothing landed in the shared dir, and cargo on this host runs through
+  PowerShell only. Cut 9 in Hands.
+- **Cut 8 landed**: the Epiphany half at `a65c6420` (Soul-closed) with the
+  Cut 10 prerequisite at `b4b17fc`; the Huginn half on `eureka/memory-organ`
+  at `946758f`, `a4c5b79`, `0bd7133`, `ca30d3e`, fix batch `1cfa81d`,
+  `acd32f3`, `30daff8`. **Closed as ruled today**; Cut 6d's Huginn
+  follow-up owns the key sequence, in-force ignoring withdrawals, the Q19
+  cap and six test gaps.
+- **Cut 9 landed and closed** at `5ae34f8` (every derivation moved whole
+  into `docs.rs`, one owner for in-force), `49cc6e3` (the read side) and
+  `8fc39b1` (34 entries). 56 tests; 67 + 34 killed. Soul closed it with
+  three bounded follow-ups in Hands (two loosenings the entries file called
+  unfailable are failable; one open-items fixture). D4, D6 and D7 are
+  superseded by the landed read side; each carries a banner naming its false
+  sentences.
+- **The public ref validator landed** across both repos, the last of Cut 9's
+  follow-ups. Epiphany `5cda0886` opens one door onto the reference grammar,
+  `PipelineRef::validate_ref`, as an inherent method rather than a free
+  function, because the check concerns one public type this crate owns; not
+  the bare name `validate`, which would shadow the in-crate `Bounded::validate`
+  its own callers use and break the build. 34 tests, entries R1 (revert) and
+  R2 (loosening), no schema or epoch change. **`5cda0886` is the new leaf
+  pin.** Huginn `5ba7b0c6` moves that pin and validates at both read doors:
+  `view` refuses a malformed ref before answering, and `history` refuses a
+  malformed `Subject` scope. The refusal is the existing
+  `MindRefusal::Document(PipelineRefusal::InvalidFormat)` rather than a new
+  variant, since the grammar it breaks lives in the leaf and a second name
+  for one rule is a second authority; `MissingReference` stays admission's
+  "names a document that is not here", which is a different thing. The
+  `query` filters take `Slug`, `Label` and `OrgRepo`, not refs, so they were
+  untouched. 57 tests, entries V24 and V24L, and **V10L is demoted** out of
+  the suite to a recorded unfailable weakening: with the ref validated at the
+  door, a subject's kind is a function of its id on both sides, so comparing
+  the whole subject and comparing only its id cannot differ. Cut 9's spec
+  text still calls V10L failable and is stale there.
+- **Cut 10 landed** on Huginn at `f7170fa` (the instance check gets one owner
+  and the dead serde mirror goes), `c4b2a0f` (the wire vocabulary and its two
+  published schemas), `6b619d6` (the CultNet surface itself), `a235304`
+  (documentation of the daemon that exists rather than the stub that did not)
+  and `f0fee0b` (31 entries over 16 rules). 60 mind tests and 10 daemon tests,
+  zero warnings, one each of the three GameCult crates in the dependency tree,
+  no Epiphany file touched and the leaf pin unmoved. M0 green on all seven
+  targets and every entry killed; cut8 and cut9 rerun clean against the final
+  spelling. No fork. **Soul in flight.**
+
+  Nine spec discrepancies, all of them the map's fault rather than the Body's:
+  the connection id constant the spec named does not exist in CultLib at
+  `a0813c6`, so the entry uses a literal; the daemon must name the owned store
+  type after all, taken as a re-export through `huginn-mind` rather than a
+  second `cultcache-rs` dependency, so one crate still pins one revision;
+  `serde_json` was specified as a daemon dependency and is not one, and was
+  removed rather than kept unused; one refusal code is unreachable through the
+  door the spec routed it to and is pinned in the envelope tests instead;
+  `Options`, `parse_options` and `startup` live in `serve.rs` because a
+  binary's tests are unreachable, leaving `main.rs` at thirty-three lines that
+  call them; the mutant the spec stated for the bind-order rule could not fail,
+  because a hub bound before the refusal is dropped by `?` and releases the
+  port, so the test now holds the mind lock and the port at once; `std::env`
+  appears once, for process arguments, with no deployment variable read;
+  `Mind::status` had to travel with `wire.rs` rather than the first commit.
+  **Several loosening mutations the brief required could not fail and were
+  replaced with failable ones of the same rules** — that replacement is the
+  first thing Soul was told to attack, since a loosening swapped for an easier
+  target is a hole wearing a green tick. Two rules carry a single mutation with
+  the file saying why: a served connection id is one argument, so "serves more
+  ids" has no expressible shape, and the bind-order rule is an order between
+  two statements whose only weakening short of correctness is already an entry.
+
+  Left for Soul: **the reliable-window limit is asserted nowhere**, so a
+  response larger than the transport carries may fail by truncation or silence
+  rather than by a typed refusal; the termination signal path is pinned only by
+  reading. Build budget missed: +1,743 paths and +1.02 GiB against an estimate
+  of +100 to +300 paths, because the probe's rlibs were cold and this pass
+  built library, binary and tests rather than one library. Lockfile 93 → 139
+  packages.
+
+  **Soul's pass, 2026-09-16 (Fable; probe crate and two client binaries in the
+  session scratchpad, a detached worktree, a real daemon over a real mind).
+  Cut 10 does not close.** Held, and these are the promises the cut exists
+  for: the daemon holds no rule of its own; every typed refusal crossed the
+  wire as itself, including a foreign instance, a batch bound, a missing
+  identity, a field bound, a malformed reference and a semantic
+  unavailability; the instance check cannot be bypassed by a second daemon, a
+  second bind, a copied store or an unwritable root, each exiting before it
+  serves; the published schemas equal derivation byte for byte, live over the
+  wire as well as on disk; a client that vanished mid-request did not disturb
+  a fresh one; two hostile datagrams were served past; the single-writer
+  attribution names CultCache's owned store and not redb. All 31 entries
+  rerun and killed, M0 green on all seven targets. Findings:
+
+  - **F1, confirmed, High: a real-sized read is lost in silence.** The hub
+    window is 1024 packets of 1200 bytes and the send error is logged and
+    served past. Measured: a query returning 833 KB was delivered; every
+    larger one produced no reply at all. The spec's "documents of about 1200
+    bytes" is not the leaf's bound, since one cut spec may carry 256 file
+    changes and the open-items and history queries are uncapped by design, so
+    no limit on document count can guarantee a response fits. Cut 13's tool
+    would ask for open items on a real campaign and hang to a timeout with
+    nothing to act on. The cut's own rule, that a refusal is typed and never a
+    transport failure, does not hold at size.
+  - **F2, confirmed, medium: two reads pipelined on one session lose the
+    second.** Three large queries sent without waiting yielded one reply and
+    two full-queue errors.
+  - **F3, confirmed, medium: the instance check was pinned by luck.** Mutants
+    comparing only the lengths of two names, only their first bytes, or
+    running the gate only when the declared name is longer all survived both
+    suites, because no fixture pair had ever shared a length. This is the
+    replaced loosening the brief predicted, and the rule had no defence while
+    the suite claimed two mutants for it.
+  - **F4, confirmed, medium: read refusals are not pinned as crossing
+    unchanged.** Mutants rewrapping a view refusal as unavailable, swallowing
+    one into an empty answer, and rewrapping a query refusal all survived. The
+    code is honest today and nothing forbids it flattening tomorrow.
+  - **F5, confirmed, low: the operation comparison is pinned by fixture
+    luck**, since the mismatch fixture compares two words that differ under
+    any comparison and both happen to be five letters.
+  - **F6-F9, deferred to stated limits**: an idle session times out at thirty
+    seconds on the daemon side with no disconnect while the client still
+    believes it is connected; an envelope failing the transport's own
+    validation is dropped rather than answered, because its id cannot be
+    echoed; a stop neither drains nor disconnects; one daemon-authored failure
+    code is unreachable in practice.
+
+  **Self's ruling on F1, 2026-09-16.** The daemon compares the encoded
+  response against the window before attempting a send it can already see will
+  fail, and answers a typed refusal carrying the size and the limit, so the
+  caller narrows and retries. The window also rises to the leaf's worst case
+  for a single document, with the bound stated where a client author reads it.
+  Raising the window is not a substitute for the refusal; it only stops
+  ordinary reads from meeting it. No silent truncation, no pagination behind
+  the caller's back, and Cut 13 caps its default limit. F6-F9 land in the
+  module's stated limits rather than blocking.
+
+  **The fix batch landed** at `4fba6cc` (the instance check pinned against
+  names resembling the mind's own: equal length differing in the last byte,
+  and a shared prefix, with the briefed length comparison back as a loosening
+  beside first-byte, gate-only-when-longer and prefix mutants), `25a841d` (a
+  read's refusal pinned as crossing the dispatch unchanged, with mutants that
+  rewrap and mutants that swallow each into the empty answer of its own
+  kind), `9bbe746` (the oversize refusal) and `44ed8a9` (its loosening). 72
+  tests, 53 entries plus the control (recorded as 52 here at first; corrected
+  from the file itself), cut8 and cut9 rerun clean. The window
+  is unchanged at 1,228,800 bytes and documented as the current bound rather
+  than a design target, per the amendment sent mid-flight.
+
+  **The measurement that changes the question.** One cut spec with every list
+  at the leaf's bound encodes to 1,315,551 bytes as a view response, over the
+  limit by 86,751, while a real one at 1,189,495 bytes is delivered whole. So
+  **a document admission accepts cannot be read back through this door**, which
+  is a write-and-read asymmetry rather than a size limit, and is the operator's
+  to rule. The body plane exists in CultMesh for exactly this class of content
+  and is the obvious candidate; nothing is designed for it yet.
+
+  **Pipelined reads remain wrong and are documented as such**: the gate is
+  stateless, measuring one answer against the window rather than against what
+  the session still has room for, so a second large reply sent before the
+  first is acknowledged still fails to send and still only logs.
+
+  **One entry was refused rather than faked.** The open-items dispatch arm
+  raises no refusal of its own and its only failing paths need a corrupt
+  store, so no mutant of it can fail a test here. Stated in the entries header
+  and the test's doc comment instead of substituted with an easier target,
+  which is the discipline the replaced loosenings broke. **Scoped Soul in
+  flight**, told to verify that claim rather than accept it, and to judge one
+  flagged placement: the oversize refusal is the daemon's rule living in the
+  mind's refusal type, because the response schema carries exactly one refusal.
+- **Soul's pass on the Cut 10 fix batch, 2026-09-17** (Fable, banked and its
+  findings acted on directly rather than paying a successor to rewrite the
+  report; probe sources and a pristine detached worktree in the session
+  scratchpad). Held: 72 tests; all three suites green in a clean worktree; the
+  gate's boundary equal to the transport's own, byte for byte, at 1,228,800
+  delivered and 1,228,801 refused; the oversize refusal itself 299 bytes, so
+  it always fits, which was worth checking rather than assuming; the
+  pipelined-read loss exactly as documented.
+  - **Both size measurements reproduced independently**, by the test's own
+    print and by Soul's probe: the wide document 1,315,551 bytes, the fitting
+    one 1,189,495, envelope overhead 231. The transport refused the wide reply
+    and accepted the fitting one. **The write-and-read asymmetry is fact, not
+    inference**: a document admission accepts cannot be read back.
+  - **The honest gap was wrong.** Hands had recorded that the open-items
+    dispatch arm could carry no mutation entry because its only failing paths
+    need a corrupt store. Soul built a store-integrity probe from the daemon
+    crate's public surface that kills both the swallowing and the rewrapping
+    mutant, and both survive the shipped suite. This is the first real
+    application of the rule adopted the same day: the probe gets committed,
+    because a kill living in an agent's scratchpad is not evidence anyone can
+    rerun. An honest gap beats a fabricated kill, and a falsified gap beats
+    both.
+  - Low: mutants measuring the payload rather than the envelope, and
+    off-by-one mutants at the comparison, survive; a case-folding comparison
+    of instance names survives, because the slug type permits uppercase and no
+    fixture pair differs only in case.
+  - Corrections: the suite has 53 entries, not 52. Informational: the window
+    is 1023 packets rather than 1024 until the acceptance is acknowledged,
+    which would make a naive boundary test flaky.
+  - **The second fix batch landed** at `a96c386` (Soul's probe committed as a
+    test, the arm pinned, and the two false paragraphs claiming it could not
+    be pinned deleted from both the code and the entries header), `731b542`
+    (the gate pinned on the boundary rather than near it, with the
+    1023-packet transient documented beside the pipelined-read paragraph) and
+    `202e5e3` (an instance name differing in case alone). 74 tests. Three
+    suites green against the final spelling: 164 kills, none surviving, no
+    sidecars. **All six new entries survived the shipped suite before this
+    batch**, so none of them is a loosening that cannot fail.
+  - Hands declined Soul's route for the probe: Soul had added `cultcache-rs`
+    as a dev-dependency of the daemon, which duplicates the very revision pin
+    the daemon's manifest says it exists to avoid. It re-exported the two
+    traits from `huginn-mind::store` instead, and **named the cost out loud**
+    as a widening of that crate's public surface by two re-exports, bought
+    against no new dependency and no second revision. Correct trade, correctly
+    stated.
+  - **Count correction, Self's to make:** the entry count above was wrong.
+    The suite held **53 entries at `44ed8a9`**, not 52, and holds **59 as of
+    `202e5e3`**.
+- **Soul's pass on the Cut 10 second fix batch, 2026-09-22** (Opus). Held: 164
+  kills with none surviving (Cut 10 59, Cut 9 38, Cut 8 67), every M0 green,
+  every restore verified by hash, 74 tests. The boundary test passed 60 runs
+  out of 60 and is not flaky: `settled_session` absorbs the 1023-packet
+  transient. The open-items pin, the boundary pin and the case pin were each
+  killed here, and each survives the pre-batch suite. No false "unpinnable"
+  prose remains in the range. **Cut 10 does not close.**
+  - **F1, confirmed, medium: the instance check survives separator folding.**
+    `Slug` is dotted labels, so `_`, `-` and `.` are all legal, and
+    `thought-cage` and `thought_cage` are two different minds. Folding `_` or
+    `.` into `-` at `mind.rs:129` passes every suite. The failure: a batch that
+    declares `thought_cage` is admitted by `thought-cage`, which is a write
+    into the wrong mind. The cause is that the fixture instance `yggdrasil`
+    contains no separator.
+  - **F2, confirmed, low-medium: the size gate is pinned for one envelope
+    shape.** "Payload plus a fixed 231" survives, because every synthetic
+    reply uses `message_id` `m-0`. The reply echoes the client's id, so the
+    envelope's overhead is under the client's control. With a 40-byte id, a
+    reply up to about 36 bytes over the limit passes the gate, and the hub
+    then drops it silently.
+  - **F3, confirmed, low: the open-items pin drives one fault, and it sits
+    outside the campaign.** Two loosenings survive. One swallows an
+    `Unavailable` when the fault is inside the campaign asked about. The other
+    swallows every `Unavailable` except a missing receipt, so an undecodable
+    document (`docs.rs:46`) or a document written by two receipts
+    (`query.rs:145`) reads as "nothing open".
+  - **F4, low:** `fixtures.rs:33-34` describes `Label`'s grammar as though it
+    were the slug's grammar. That prose hides exactly the `.` equivalence F1
+    exploits.
+  - **F5, low:** the entries headers for Cuts 8, 9 and 10 still name the
+    deleted Epiphany harness path.
+  - **F6, plausible, low:** a declared name is never checked against the slug
+    grammar on the read path, so a fullwidth fold survives. It aliases a name
+    rather than colliding with one.
+  - **F7, informational: a second writer already existed.** The two
+    re-exports opened nothing new, but only because `MindStore`'s supertrait
+    `CacheBackingStore` and the public `compare_and_swap_batch` already let
+    non-test code outside the crate write rows. The line "No non-test code
+    outside this crate touches a row directly" (`store.rs:18-19`) is prose,
+    not structure. The re-export is also a derive macro as well as two
+    traits, because the macro and the trait share a name. The prose is
+    corrected in the third fix batch. **Follow-up, recorded: seal the store
+    so admission is its only write path.** That is its own cut: it changes
+    the public trait surface, and the Cut 9 header's "no behaviour this Body
+    can reach" rests on the same false premise.
+  - **F8, process, confirmed:** two checkouts sharing
+    `C:\Users\Meta\.cargo-target-codex` produce the same artifact hash. A plain
+    `cargo test` in the checkout whose sources are older does not rebuild, and
+    it ran the other checkout's last mutant binary. The harness is immune,
+    because it bumps the time on every file it writes. Became a rule in the
+    Eureka skill.
+  - **The third fix batch goes to Hands (Sonnet): F1 through F6, plus F7's
+    prose.**
+  - **The third fix batch landed** (Sonnet), `7611d1b..7fc8ed3`, 77 tests.
+    - **F1:** separator-only fixture pairs `UNDERSCORE_INSTANCE` and
+      `DOTTED_INSTANCE`; D1L6/D1L7.
+    - **F2:** the boundary at a second `message_id` length; D20L6.
+    - **F3:** `open_items` refuses on three in-campaign faults: an orphan
+      receipt, an undecodable document, and a document written by two
+      receipts. S1 and S1d first anchored on `.views()?` and could not fail
+      for two of the three faults, because those faults arise in
+      `Reader::new`. Widened, and each now dies on all three.
+    - **F4 and F5:** prose corrected.
+    - **F6:** `require_grammatical_instance` on the read path.
+    - **F7:** prose corrected; the store is not sealed.
+    - Cut 10: 65 entries, 65 killed, M0 green. Cut 8 and Cut 9 were not rerun,
+      since only header text changed.
+    - **Flagged for Soul by Self:** F6's check is not in its owner. The slug
+      grammar (`Bounded`) is private to the `epiphany_pipeline` crate, so the
+      daemon wraps the declared name in a throwaway `PipelineInstance` and
+      calls `validate()` on it. That is a gap filled beside its owner, not in
+      it. It also applies only to the read path, while `require_instance` is
+      shared with admission. **Soul's pass dispatched** (Opus).
+  - **Soul's pass on the third fix batch, 2026-09-22** (Opus). **Held:** 77
+    tests. Cut 10 65/65, Cut 9 38/38, Cut 8 67/67, so 170 killed, every M0
+    green, every restore verified by hash. The Cut 8 and Cut 9 diffs are
+    comments only. The code in the range does what the ledger says.
+    **Nothing blocking in the range**, but it carries an older defect.
+    - **N1, confirmed, medium-low, predates the range: nothing checks the
+      mind's own name, and a name can put the store outside the state root.**
+      `serve.rs:108` builds `Slug` straight from the command line.
+      `Mind::open` and `open_with` (`mind.rs:116,137`) never validate it.
+      `path_for` (`mind.rs:108-110`) joins it as written. A probe:
+      `Daemon::open(outer/inner, Slug("..\\..\\escaped"))` returned `Ok` and
+      created `outer/escaped/mind.redb`. It then refused its own name on every
+      read. Admission's A1 (`admission.rs:109`) never checks the grammar
+      either, so one fullwidth name gets `ForeignInstance` from `Admit` and
+      `InvalidFormat` from `Query`.
+    - **N2, F6 placement:** it is the same grammar, by construction, and
+      neither direction of disagreement can be reached. The refusal still
+      names `instance.instance`, a field the client never sent.
+    - **N3, low-medium:** four separator mutants survive all 77 tests:
+      folding `_` and `.` into each other, a fold on the mind's side only,
+      `trim_matches('-')`, and collapsing `--`. The fixture minds contain
+      neither `_` nor `.`.
+    - **N4, low:** an overhead mutant hard-coded for `view` survives, and so
+      does a coincidental slope. Every fixture pins the operation to `view`
+      and the runtime id to `huginn-yggdrasil`.
+    - **N5, low:** the ledger's claim that S1d "dies on all three" is false.
+      S1d exempts the orphan fault by construction.
+    - **N6, low:** the Cut 9 header contradicts itself at lines 18–25, points
+      the wrong way, and says V1–V23 where the entries run to V24L.
+  - **Self's ruling on the F6 fork, 2026-09-22: fill the gap in its owner.**
+    The leaf gets a public slug check, on the pattern of
+    `PipelineRef::validate_ref`. Huginn moves its pin to that commit and calls
+    the check from `require_instance`, so reads and A1 refuse identically, and
+    from `Mind::open`, before `path_for` touches the filesystem.
+    `require_grammatical_instance` and its daemon-side branch are deleted.
+    This rejects the interim option of moving the probe without a pin move,
+    because that would leave a workaround living beside its owner.
+    **The fourth fix batch landed** (Sonnet): leaf `9d3a3efd`, Huginn
+    `cc71a56` and `4f7e3b5`.
+    - **Leaf.** It gains `Slug::validate_slug`. The name keeps it from
+      shadowing `Bounded::validate` inside the crate, the same reason
+      `validate_ref` is named as it is.
+    - **Huginn, N1.** Huginn moves its pin to the new leaf. `require_instance`,
+      `Mind::open` and `open_with` all go through the leaf's door.
+      `require_grammatical_instance` and its branch on the daemon side are
+      deleted. The escape probe is now refused, and no file is created.
+      `Admit` and `Query` refuse a fullwidth name identically.
+    - **Huginn, N3.** One generated test covers 30 separator variants.
+    - **Huginn, N4.** The size gate is exercised across operation and runtime
+      id.
+    - **N5 and N6.** Prose corrected.
+    - **Graph.** `cargo tree -d` shows one `cultcache-rs` (`a0813c6`).
+    - **Tests.** Leaf 34→35, mind 60→62, daemon 17→19.
+    - **Mutation suites.** Every entry killed, M0 green in each, restores
+      verified by hash:
+
+      | Suite | Killed |
+      |---|---|
+      | leaf | 2/2 |
+      | Cut 8 | 67/67 |
+      | Cut 9 | 38/38 |
+      | Cut 10 | 71/71 |
+
+    - **Correction owed here (N5): the earlier line "S1 and S1d … each now
+      dies on all three" is false.** S1d exempts the orphan fault by
+      construction and dies on the undecodable fault. S1 dies on the orphan.
+    - **A scar reported by Hands.** Hands edited a harness target while a
+      mutation run was in flight. At the end of the run the harness restored
+      the bytes it had captured at the start, which silently threw away the
+      edits. `git status` caught it before commit.
+    - **Soul's pass dispatched** (Opus).
+  - **Soul's pass on the fourth fix batch, 2026-09-22** (Opus). **Cut 10
+    closes on its stated invariants.** Findings:
+    - **N1's escape is closed in every form tried.** Refused names were
+      `../x`, `..`, `..\..\x`, absolute paths, drive-relative paths, UNC and
+      `\\?\` paths, `a/b`, a leading dot, a trailing dot, `a..b`, fullwidth,
+      NUL, empty and overlong. The whole tree was walked after each attempt,
+      and no file or directory was created.
+    - `validate_slug` is `Bounded::validate` itself.
+    - `Admit` and all four reads share `require_instance`.
+    - All separator folds die, including a fold of two separators into a
+      third.
+    - There is one `cultcache-rs`, and the leaf's range touches only the door
+      and its test.
+    - Suites: leaf 2/2, Cut 8 67/67, Cut 9 38/38, Cut 10 71/71. M0 was green
+      in each, and restores were verified by hash.
+  - **Residue, not blocking. The residue batch goes to Hands (Sonnet):**
+    - **S1:** the gate fixtures still fit by coincidence: (3,4,16), (40,4,16)
+      and (3,10,19). A formula that ignores the runtime id survives, and so
+      does one that ignores the operation. Needs a point that varies the two
+      independently.
+    - **S2:** N1 has no mutation entry. Deleting the door in `open_with`
+      (`mind.rs:135`) survives all 81 tests.
+    - **S3:** `Mind::path_for` (`mind.rs:104`) is public and bypasses the
+      door. The daemon's tests construct stores through it. Make it private,
+      or make it fallible.
+    - **S4:** a Unicode hyphen fold placed before the check survives.
+    - **S5:** the leaf's door test does not pin the 64-byte bounds, whole-name
+      or per-label, nor NUL. Those mutants survive all 35 leaf tests. This
+      predates the leaf work.
+    - **S8:** the header of the leaf's entries file names the deleted harness
+      path.
+  - **Recorded, not fixed here:**
+    - **S6:** declared names used only as read filters (`open_items(campaign)`,
+      the `campaign` filter in `query`, `HistoryScope::Repo`) are never checked
+      against the grammar, and read as empty. `OrgRepo`'s doc claims a format
+      it does not enforce. Owner: the read-side consumer cut, which reshapes
+      these reads.
+    - **S7:** the grammar admits Windows device names. `NUL` fails only after
+      the parent directory has been created. This is informational: there is
+      no escape and no aliasing. Revisit if the organ ever runs on Windows in
+      production.
+  - **H1, medium, a harness defect.** The Eureka harness silently discards any
+    edit made to a target while a run is in flight, or between entries. It
+    restores the bytes it captured at M0, and never checks whether the current
+    bytes are the mutant it wrote (`eureka-mutations.ps1:163-175, 393, 415`).
+    Fixed in the Eureka repository in the same batch.
+  - **The residue batch landed** (Sonnet). Commits:
+    - Huginn `65c46aa`: seals `path_for`, adds N1 entries on all three sites
+      (`open_with` now dies), the U+2010 fold, and gate fixtures that vary the
+      operation and runtime id independently.
+    - Huginn `f7e0d02`: moves the leaf pin to `b3ae787b`, which carries S5
+      (64-byte bounds and NUL pinned) and S8. The lockfile also picked up a
+      `getrandom` 0.4.3→0.3.4 change as a side effect.
+    - Eureka `5d2bd3e`, H1: the harness saves a mid-run edit as
+      `.eureka-mutation-overwritten`, prints `EDIT LOST`, and fails the run.
+      Demonstrated before and after.
+
+    Tests: mind 65, daemon 20, leaf 35. Every suite is fully killed:
+
+    | Suite | Killed |
+    |---|---|
+    | leaf | 5/5 |
+    | Cut 8 | 67/67 |
+    | Cut 9 | 38/38 |
+    | Cut 10 | 77/77 |
+
+    There is one `cultcache-rs`. **Soul's check of the residue is
+    dispatched.** It covers two things. First, `path_for` became
+    `store_path_for` behind a test-support feature, and a consumer that turns
+    the feature on might reach the bypass again. Second, the lockfile side
+    effect.
+  - **Soul's check of the residue, 2026-09-22** (Opus). **The residue holds on
+    every invariant it claimed.**
+    - `path_for` is private (probe: `E0624`).
+    - `store_path_for` runs the grammar check in its own body, and refused 10
+      escape forms.
+    - The old escape through `new` and then `open_with` is refused.
+    - `test-support` is not compiled into a release daemon.
+    - `getrandom`: all three versions are present both before and after. Only
+      a dev-only `tempfile` edge moved.
+    - There is one `cultcache-rs`.
+    - Suites, each with M0 green and every restore identical by hash: leaf
+      5/5, Cut 8 67/67, Cut 9 38/38, Cut 10 77/77.
+
+    Recorded, not blocking:
+    - Step-function gate formulas survive a 2×2 grid (F4). The grid proves the
+      two terms are independent, not that each is linear. Production measures
+      real bytes.
+    - `trim()`, a U+2011 fold and a space fold placed inside
+      `require_grammatical_slug` survive (F5). None of them reopens N1.
+    - S5's bound behaves as a byte count (F6).
+    - The `test-support` comment claims more than Cargo enforces, and does no
+      harm (F7).
+
+    **Harness defects in H1, confirmed, and Self's to fix in Eureka:**
+    - **F1, medium.** After H1 fires, the sidecar is kept on purpose. The next
+      run's startup repair treats it as a crash: it writes the M0 original
+      over an operator's hand-cleaned file, calls it "died mid-mutation", and
+      finishes **green**.
+    - **F2, low-medium.** `.eureka-mutation-overwritten` is overwritten without
+      a check.
+
+    Queued behind the RS Hands, which is using the harness now.
+  - **RS-2 and RS-1 landed** (Sonnet).
+    - **RS-2, `92ac16c`.** Removes `open_items`, `history` and the admission
+      window, plus `Reader::views()` and the `Reader` lifetime they alone
+      required. Net −543 against an estimate of about −440. The negative greps
+      are empty. Cut 9 27/27, Cut 10 65/65.
+      - V24L is dropped: with `history`'s door gone, "one door and not the
+        other" has no shape left.
+      - D13L is rewritten as `"queries"`. The harness judged the case-only
+        mutant `"Query"` a no-op, because it compares with PowerShell's
+        case-insensitive `-eq`. **That is a harness defect** and joins the
+        H1 follow-up.
+    - **RS-1, `0d6f9a6`.**
+      - Receipt v2 carries an `ordinal` equal to `head + 1`, left out of
+        the digest.
+      - `head` requires the ordinals to run exactly 1..N.
+      - The opener checks the epoch before the types.
+      - Five new tests.
+      - Readside mutations 9/9 (R1, R1L, R1L2, R3L, and R2/R5 with no
+        loosening, by the "binary rule" reasoning of D9/D12).
+      - H6 is re-anchored on the new gate order.
+      - Suites: Cut 8 67/67, Cut 9 27/27, Cut 10 65/65.
+    - **Soul's pass dispatched** (Opus).
+  - **Operator rulings, 2026-09-22:** Q-RS1 is B (one non-empty `Title` for
+    all four titles), Q-RS2 is A (`huginn-mind` links `cultnet-rs`;
+    FU-SelSplit recorded), Q-BP1 is A (chunks on the held session). Recorded
+    in their maps.
+  - **RS-L landed** (Sonnet) at `d74e36aa`.
+    - `Title`, 1 to 200 bytes and non-empty, is used by campaign, cut spec,
+      question and ruling.
+    - Epoch v2, with 13 type ids and schema files renamed. The negative grep
+      is empty.
+    - `validate_org_repo` and `validate_label` are added as doors.
+    - Leaf tests go from 35 to 37.
+    - Six new entries (L1, L1L, L2, L2L, L3, L3L), all killed.
+    - **Stale:** entry E1 in `tools/eureka-cut8-epiphany-mutations.psd1`
+      still anchors on the v1 epoch string, so that historical suite cannot
+      rerun. **Soul's pass dispatched**, and it includes E1.
+  - **Soul on RS-2 and RS-1, 2026-09-22** (Opus). Both build, and every suite
+    kills every mutant.
+    - **Held for RS-2:** nothing deleted is reachable. `resolutions_of` and
+      `assignments_of` survive and are pinned. Dropping V24L and
+      `Reader::views()` was right. N4 and D13 hold.
+    - **Held for RS-1:** every R2 loosening dies. The opener cases refuse as
+      the spec says.
+    - **Correct counts:** Cut 9 has **26** entries and Cut 10 has **71**.
+      The 27 and 65 in Hands' report were the map's estimate, not a run.
+
+    Findings:
+    - **F1, medium: the read side never checks ordinal density.**
+      `AdmissionIndex::build` (`query.rs:113-130`) copies the ordinal without
+      calling `head`. `head`'s only caller is admission. With planted
+      duplicates, gaps, zeros or out-of-range chains, `query` and `view` both
+      answer `Ok`. The shipped code is exactly the spec's named mutant ("the
+      check runs only in admission"). R3L tests something else, and a test
+      named `…reads_alike` never reads. `head`'s doc claims every reader asks
+      it. The schema publishes `minimum: 0`. RS-3 makes this field the order.
+    - **F2, low-medium: a second in-process owner bricks admission.**
+      `Mind::open_with` is `pub` over a store whose clones share one lock.
+      Two Minds admitting concurrently produced `[1,2,2]`, and after that
+      every admission refuses. Before RS-1, the same misuse landed both
+      batches.
+    - **F3, low-medium: R5 is not binary.** Two loosenings survive:
+      - "types first when there is no epoch record" (R5b);
+      - "epoch first only when the record's key is foreign" (R5c).
+    - **F5, low: stale prose.** The gate step numbering in `mind.rs`, `docs.rs`
+      pointing at `history`, a test named for two doors, and the Cut 9 header.
+  - **Self's rulings, 2026-09-22 (RS fix batch):**
+    - **F1:** density is checked wherever the ordinal is read. The read index
+      is built through `head`, or through the same density function. A test
+      that runs `query` and `view` over a store with a duplicate, a gap, a
+      zero and ordinals above N must refuse. The mutant "check only in
+      admission" is added and must die. The schema says `minimum: 1`.
+    - **F2: the smallest seal.** `Mind::open_with` is gated behind the
+      `test-support` feature, like `store_path_for`. Production opens only
+      through `Mind::open`, which takes the per-path lock. The full store
+      seal stays a recorded follow-up.
+    - **F3:** fixtures pin R5b and R5c. A foreign store with no epoch record
+      must refuse as the spec's epoch-first order says. A store with the epoch
+      at the current key, a foreign value and a foreign type must refuse
+      `ForeignEpoch`.
+    - **F5:** fix the prose.
+  - **Soul on RS-L, 2026-09-22** (Opus). **What held:**
+    - The `Title` bound counts bytes, and the empty title is refused.
+    - Epoch v2 covers all 13 ids.
+    - The two doors delegate to the grammar admission uses, and L1L/L2L are
+      real loosenings.
+    - The `runtime_spine` stand-in is harmless.
+    - Leaf 37 tests. Readside-leaf 6/6. Cut 10 leaf 5/5. Cut 6b 17/17,
+      6c 10/10, 6d 7/7, 6 10/10, 5 7/7. Restores identical by hash.
+
+    **Findings:**
+    - **F1:** a 1-byte title is accepted by no test. `len() < 2` survives.
+    - **F2:** titles of `" "`, `"\0"`, `"\n"`, U+200B and U+FEFF all pass as
+      non-empty. A single space is still a bare placeholder, which is the
+      thing Q-RS1 was ruled to prevent.
+    - **F3:** the published `Title` schema has no `minLength`, and its
+      description ("1 to 200 bytes, never empty") contradicts its own
+      keywords.
+    - **F4:** ruling history is copied into four published schema
+      descriptions.
+    - **F5:** Cut 8's E1 anchors on `epoch.v1`, so that suite aborts. A copy
+      re-anchored runs 7/7.
+    - **F6:** the readside-leaf header names the old harness path.
+    - **F7:** the `OrgRepo` grammar behind the new door accepts `../..`,
+      `a/..`, spaces, control bytes, NUL and non-ASCII. It predates RS-L, and
+      RS-3 reads the organ's `repo` through it.
+    - **F8:** the spec's Huginn anchor has drifted to `daemon.rs:369`,
+      trivially.
+  - **Self's rulings on RS-L, 2026-09-22 (fix batch):**
+    - **F2: a `Title` holds at least one non-whitespace character and no
+      control characters** (C0, C1, U+2028/9, zero-width and BOM). That is
+      what "not a bare placeholder" means. It is free inside epoch v2 and
+      would cost another epoch later. **Accepted by the operator,
+      2026-09-22** ("I accept your recommendations"). Q-BP2 was ruled A in the
+      same message.
+    - **F7: `OrgRepo` becomes GitHub's grammar, in the same epoch v2.** Both
+      the owner and the repo are `[A-Za-z0-9._-]+`. The owner has no dot or
+      underscore, is at most 39 bytes, and has no leading or trailing
+      hyphen. A repo is at most 100 bytes and is never `.` or `..`. Exactly
+      one `/`.
+    - **F1, F3, F4, F5, F6 are fixed as found.** The schema carries
+      `minLength: 1`. The `description` states the byte rule truthfully, and
+      admission remains the enforcer (schemas README). Ruling history moves
+      out of the doc comment.
+  - **The read-side consumer cut is mapped** at `notes/eureka-read-side-cut.md`
+    (Imagination, Opus). Cuts in order:
+    - **P-1 and P-2:** CultLib, before merge. Now folded into selection's
+      R-G and R-M.
+    - **RS-L:** leaf epoch v2, titles, and the `OrgRepo` and `Label` doors.
+    - **RS-2:** subtraction.
+    - **RS-1:** receipt v2 with ordinals, and the epoch gate moved ahead of
+      the type gate.
+    - **BP-2, widened:** one pin move.
+    - **RS-3:** the consumer, including the value door for S6.
+
+    Its appendix carries the summary type, copied from a session scratchpad
+    that will not survive.
+
+    Probed facts:
+    - The seven old relations each equal one selection.
+    - Admission order cannot be recovered from the clock: 31 receipts carry
+      5 distinct seconds.
+    - Today's opener refuses an old store by the wrong gate.
+
+    **Operator questions Q-RS1 (titles) and Q-RS2 (whether `huginn-mind` may
+    link `cultnet-rs`) are open.**
+    - *History:* **Cut 10 stays open until the fourth fix batch lands** (Hands, Sonnet): N1
+    through the leaf check, one generated separator test for N3, fixtures that
+    vary the operation and the runtime id for N4, and the prose fixes for N5
+    and N6.
+- **The harness moved out of this repo, 2026-09-17.** The fourth of the
+  process changes the operator approved on cost review. It now lives in the
+  Eureka repo at `C:\Users\Meta\.claude\skills\eureka\tools\eureka-mutations.ps1`
+  (`GameCult/Eureka`, `9b43747`), and `F:\Projects\Epiphany\tools\eureka-mutations.ps1`
+  is deleted. It was only ever here because Epiphany needed it first, and
+  Huginn had been reaching across a repo boundary for it. It takes `-Repo`, so
+  one copy serves every campaign and a fix to it fixes all of them. **Every
+  brief and every earlier reference in this document that names the Epiphany
+  path is history and no longer resolves.** CultLib keeps its own JavaScript
+  runner, which cannot be this script, and owes the same contract by name.
+- **Operator ruling on the oversize document, 2026-09-17: the body plane.**
+  A body too large for the control plane travels CultMesh's content and body
+  transfer, which exists for exactly this class of content, with the control
+  plane carrying the summary and a reference to it. Rejected: raising the
+  window, which moves a number we would then keep revising until it met the
+  same wall; and bounding documents smaller, which argues with what a cut spec
+  honestly is. **The typed refusal stays** as the backstop, because a caller
+  must still be told by name when an answer cannot be delivered, rather than
+  discovering it as silence. This is a cut of its own, to be mapped: it spans
+  the organ and CultMesh, and nothing about it is in Cut 10 beyond the refusal
+  that made the problem visible.
+- **Operator rulings on the read side, 2026-09-17.** The generic selection
+  vocabulary does **not** land here: it fills the hole in CultNet, mapped at
+  `F:\Projects\CultLib\docs\cultnet-selection-cut.md`, and the organ becomes a
+  consumer. What stays with the organ is a smaller later cut: the row and
+  reference implementations, the roles, in-force, the summary, the snapshot
+  restriction, and the deletions below. Three rulings bind it.
+  - **Receipt ordinals: yes.** Each receipt records its admission ordinal, so
+    the order is exact and a cursor carries a snapshot position rather than a
+    guess. The stored type changes, the store format takes a new version, and
+    an existing store refuses to open rather than being silently misread. The
+    cost is zero today because the only store is ours, and it will not stay
+    zero.
+  - **`open_items` and `history` are deleted**, not kept as presets. Every
+    relation they hardcode maps onto one citation hop, and a preset would be a
+    second spelling of one answer. If a common question deserves a convenient
+    name, Cut 13 is where the name belongs.
+  - **The leaf gains titles**, reversing Self's recommendation. The operator's
+    words: bare leaves in the catalog is crazy. A catalog row that shows only
+    an identifier is not a catalog, so `question` and `ruling` gain a `Short`
+    title in `epiphany-pipeline`. This changes published schemas and the
+    documents already stored, so **it rides the same store version as the
+    receipt ordinal** rather than forcing a second migration.
+- **Self's ruling on the boundary Hands pinned, 2026-09-16.** A resolution id
+  carrying no sequence part is well formed to the leaf and is not refused
+  there. The leaf owns the grammar of ids; per-kind local shape belongs to
+  admission, which is where the sequence rules already live. This costs
+  nothing on the write path, because a resolution's key is derived by
+  `pipeline_key` from the typed record and is never hand-authored, so a
+  sequence-less resolution id cannot reach admission at all. On the read side
+  such an id is well formed and simply names nothing. Recorded as a decision
+  rather than raised as an operator question, because no product meaning
+  turns on it.
+- **Cut 7 landed and closed** on Huginn `eureka/memory-organ` at `1320fc4`,
+  `f63c0f2`, `e20c786`, fix `4094e68`; Eve `main` `e777e4c`, fix `167a2d3`;
+  EveConformance `main` `048ea2f`. Started in parallel on the operator's
+  instruction; it has no dependency on the Epiphany cuts.
+- **Target rewritten** at `5fb4eb22`.
+
+**Cut 6c is the last cut inside Epiphany.** Cuts 7-16 build Huginn's Rust
+workspace and the `eureka-state` MCP client; this repo's remaining stake is
+schema ownership through `epiphany-pipeline`.
+
+Pins for this pass. Code anchors are `file:line` against Epiphany
+`5fb4eb22`, tree clean, branch `codex/eureka-pipeline-state`.
+
+- CultLib `main` `a0813c6`.
+- Huginn `main` `91b7fcf` at `F:\Projects\Huginn` (upstream public, default
+  branch `main`, last pushed 2026-06-21).
+- VoidBot `main`. gamecult-ops `main`.
+- The Eureka skill is now a git repo: `GameCult/Eureka`, public, `main` at
+  `6ca7882`, checked out at `~/.claude/skills/eureka`.
+
+## What the rewrite changed
+
+The first model made a repo own the store. Nothing owned the state, so the
+machinery grew to compensate. The operator's correction is that **an instance
+owns its mind**, a **service owns that state**, and **minds leave git**.
+
+The mechanical consequence, which drives Cut 4: every layer that existed only to
+make a *repo-resident, git-committed, multi-clone* store safe is now dead
+weight. That is the writer lease, the main-work-tree resolution, the committed
+`.gitattributes` / `.gitignore` preconditions, the branch binding, and the merge
+tool that was never built.
+
+## Rulings in force
+
+Numbering follows the target. Rulings 5, 6, 10, 11 and 13's store clauses are
+superseded by 14-17; see History.
+
+1. **Epiphany owns the schemas** for pipeline state.
+2. **Searchable state serves agents first.** Rehydration and precedent checks
+   come before operator browsing.
+3. **Two campaigns.** This one covers schemas, the memory organ, admission, the
+   MCP client and a proof. Epiphany adopting Eureka's habits is the second.
+4. **Re-pin first.** Landed.
+7. **Eureka is published** as `GameCult/Eureka`, MIT.
+8. **Q2 and Q5 survive the rewrite.** Additive schema changes keep the epoch and
+   a breaking bump refuses the old store (Q2). `schemars` is an unconditional
+   dependency and published JSON schemas are derived from the Rust types (Q5).
+
+   **Amended 2026-09-16 by operator ruling: widening a `PipelineKind` enum is
+   additive and keeps the epoch.** Soul was right that a widened enum is additive
+   for a writer and a hard validation refusal for a reader pinned to the old
+   file. The ruling accepts that, because the readers of these schemas are ours:
+   a reader ships with the kinds it knows, and a document of a kind it has never
+   heard of is not addressed to it. The cost of the other answer decided it —
+   every new kind would rev the five schemas that embed `PipelineKind`, and
+   adding kinds is most of what this campaign still does. A reader that must
+   refuse an unknown kind refuses it on the kind, not on the epoch.
+9. **The operator channel is the Claude Code session.** Eureka has no Persona.
+   Blocking questions may be pushed through any notification MCP; Eureka owns no
+   transport and names no provider. Answers come back in the session.
+11. **Numeric attempt and pass.** `attempt` and `pass` are numeric, and attempts
+    count up per cut across spec revisions. (Survives; it is a key rule, not a
+    store rule.)
+14. **An instance owns its mind.** A store is canonical to exactly one instance.
+    Identity lives in the state, not in a path. Admission refuses a write
+    carrying another instance's identity, whatever the transport. Stewardship
+    over repos is an assignment recorded in that mind, and one instance may
+    steward several repos. Reassignment is an explicit typed hand-off recorded
+    in both minds.
+15. **A service owns the state, on Yggdrasil.** The memory organ is a daemon. No
+    per-clone lease, no git-attribute precondition, no divergence between clones.
+16. **The organ depends on Qdrant directly, not on voidbot.** It owns its own
+    collections and indexes at admission time. Embeddings come from Ollama.
+17. **Huginn is the memory organ.** The dormant `.cc`-to-Eve CLI is retired and
+    generic `.cc` inspection belongs to CultCache Studio in CultLib.
+18. **Instance identity is declared, not signed** (Q6 A). On a single-operator
+    LAN this is attribution, not authentication. Hands does not invent a
+    credential system; the trust boundary is the network and the host.
+19. **The workstation reaches the organ over WireGuard** (Q7 A), because the
+    organ speaks RUDP over UDP and the existing SSH forward carries TCP only.
+20. **`TypedCommitStore` collapses** (Q8 A). Its second profile moved to another
+    repo, leaving a one-implementation abstraction. Cut 5 must preserve the Mind
+    path's fail-closed order and validation before replay (finding S6).
+21. **The organ shares voidbot's Qdrant** (Q9 A), with the coupling declared as
+    an Idunn dependency rather than left implicit.
+
+## Landed
+
+**Cut 4 landed** at `ca275c7b` (deletion) and `a9f06c2a` (mutation suite).
+Soul is verifying.
+
+- **Removed 1,302 lines, added 549.** `pipeline_store.rs` died whole (1,251),
+  plus 47 in `pipeline_documents.rs`, two `lib.rs` lines, `.gitattributes:1` and
+  `.gitignore:37`. Retired: one store format, one lease, two git preconditions.
+- **Eight tests moved** into `pipeline_documents.rs` rather than waiting for
+  Cut 6, so no rule sits unpinned between cuts. Tests 168, 0 warnings, and all
+  eight mutations killed.
+- **Orphans removed:** `MissingIdentity` and `Unavailable` lost their last
+  raiser with the opener and lease. The three named helpers all kept live
+  callers.
+
+Spec corrections from this cut, which stand against the sections above:
+
+1. **The local `PipelineRefusal` keeps five variants, not three.**
+   `ForeignStore` is raised by `decode` and `ForeignEpoch` by
+   `validate_pipeline_write_envelope`, so the spec's three-variant line does not
+   compile. Both leave with admission, as D2 already assigns them to
+   `huginn-mind`.
+2. **The deleted module held 20 tests on Windows, not 15,** so the arithmetic is
+   180 − 20 + 8 = 168, not 165.
+3. **Cut 6's estimate must grow.** Its `epiphany-core` −623 should read about
+   −1,060, because the test module now travels with the code.
+4. **`schemas/cultnet/README.md:30`** still describes a per-repo store path.
+   Cut 6 owns that rewrite, so Cut 4's negative grep cannot be empty yet.
+
+**Cut 4's Soul findings are closed** at `43a08baa` and `8a598ebb`. Soul is
+verifying the fix batch.
+
+Soul found that the deletion had taken a live rule's only test with it: the
+epoch guard survived a `if false` mutation, and no test could even construct an
+identity envelope to reach it. Self ruled deletion over testing what nothing can
+construct, since admission, identity and the epoch refusal belong to the organ
+and D2 already assigns those refusals to `huginn-mind`.
+
+- **Deleted:** the epoch branch, `ForeignEpoch`, `EpiphanyPipelineIdentity`,
+  `EpiphanyPipelineProvenance`, `PipelineProvenance`, `Faculty`, and
+  `PIPELINE_SCHEMA_EPOCH`, whose only reader was that branch. Each was confirmed
+  producer-free first. **Cut 8 writes them in the organ, with tests that can
+  reach them.**
+- **Pinned instead:** a foreign-typed envelope is refused on decode with
+  `ForeignStore` specifically, and the runtime spine cache refuses a pipeline
+  store. Both die under their own mutation.
+- **No schema consequence:** identity and provenance were never published, and
+  all ten schemas still derive byte for byte.
+
+Further corrections to the sections above:
+
+5. **Cut 4's Keeps list is wrong in two places.** `PipelineProvenance` and
+   `Faculty` fell under "every value type", and are gone.
+6. **`register_pipeline_document_types` is now `#[cfg(test)]`**, which Cut 6
+   must account for when it moves the module.
+7. **Test arithmetic is 170**, not 168.
+8. **The pipeline write path is test-only, and now says so.** `186dbc62`
+   converted `prepare` and `validate_pipeline_write_envelope` from
+   `expect(dead_code)` waivers to `#[cfg(test)]`, after Soul proved both dead in
+   a non-test build. `decode` and the `CultCache` imports came with them: they
+   had looked live only because dead code mentioned them.
+   - **Cut 6 arithmetic:** it now relocates four `cfg(test)` items plus a gated
+     import, not two live ones. The Keeps list still holds, and
+     `validate_pipeline_write_envelope` still moves.
+   - **Cut 6 must refresh** its Keeps citation for
+     `validate_pipeline_write_envelope`; the line range no longer matches.
+   - **Refusal picture unchanged:** none of the four variants has a reachable
+     non-test raiser. The conversion made the existing state literal rather than
+     waiver-shaped. Cut 8 owns it.
+9. **The mutation suite is runnable and its anchors are exact** (`06100d8e`).
+   It documents the interpreter this host actually has, refuses an unsupported
+   one up front, and asserts each anchor matches exactly once, since a replace
+   hits every match. All ten mutations still die by their own test, including
+   the two that mutate code inside the newly gated functions.
+
+**Cut 5 landed** at `1758ad50` (collapse) and `4c091f57` (mutation suite). Soul
+is verifying.
+
+- **Deleted:** `TypedCommitStore`, `MIND_COMMIT_STORE`, `validate_mind_writes`,
+  the parameter and all five call-site arguments, plus one orphan import. No
+  part of the profile shape survived. One commit owner remains, and two receipt
+  construction sites: the owner's, and a test that plants one on purpose to pin
+  the replay rule.
+- **Unchanged behaviour, proven against the base:** the pinned receipt digest
+  was checked by running the base test in a detached worktree at `cda36541`,
+  not by a value captured from the new code.
+- **Tests 171, 0 warnings.** Two profile tests retired because they tested the
+  profile through the profile; their rules were re-expressed as three new tests.
+- **Five mutations, all killed**, including both halves of S6: uniqueness
+  before validation, and validation before replay.
+
+Cut 5 corrections:
+
+10. **Ruling 20's second half had no named test.** The Keeps list named only
+    validation-before-replay, so the uniqueness-ordering half of S6 was
+    unpinned. Cut 5 added a test for it rather than leaving half the invariant
+    on trust.
+11. **The Deletes table's line anchors were stale by 26 lines**, written against
+    `5fb4eb22`. Matching was done by content. Later cuts should re-anchor before
+    trusting a line number in this map.
+12. **The subtraction estimate was −46/+8; the actual is +172/−122.** The
+    owner-side collapse matched; the overshoot is the test rewrite the ledger
+    never priced, because the Keeps list demanded three rules stay pinned while
+    the tests that pinned them died with the abstraction. Carrying cost still
+    falls: one struct, one const, one fn, one parameter and five arguments gone.
+
+**Soul's Cut 5 pass** confirmed the collapse changed no Mind behaviour: it read
+the full owner diff, including the places the pinned digest is blind to
+(`committed_at`, companions, conflict re-read, replay lookup), and found nothing
+reordered or re-worded. Both renamed tests assert what their names claim, and
+byte-identity on refusal is now asserted in three places rather than base's two.
+
+It found four gaps, which a Hands batch is closing:
+
+- **S7 (medium, a regression from base).** Re-deriving the backing store at the
+  CAS from the same path survives the suite. The replacement test only asserts
+  "one file in this directory", which a re-derivation satisfies; the retired
+  profile test had caught it by putting the store somewhere else. It matters
+  beyond style, because the planned redb store permits one writable handle per
+  path.
+- **S8 (low-medium, pre-existing).** Validating only the first write of a batch
+  survives, because no test commits a batch of two distinct writes.
+- **S9 (low).** The claim of exactly one receipt construction site is false:
+  there are two, the owner's and the planted receipt that makes the replay test
+  work.
+- **S10 (cosmetic).** Profile vocabulary survives in a renamed test's fixture
+  data.
+
+**Cut 5's findings are closed** at `617c397d`. Tests 172, 0 warnings; seven
+mutations, every one killed by its own test.
+
+- **S7:** a `RuntimeSpineBackingStore` carries only its path, so a same-path
+  re-derivation is invisible to any assertion about files, contents or
+  receipts. The test now counts resolutions through a `#[cfg(test)]` log and
+  requires exactly one per commit, with a comment saying why the file
+  assertions below it cannot see this. MS1 dies with `left: 2, right: 1`.
+- **S8:** a new test commits two writes with distinct identities, the second
+  refused, and requires the store byte-identical, so the valid first write
+  lands nowhere. MS2 dies. M2's rule string was corrected: it pins that the
+  batch is validated at all, and MS2 owns "every write".
+- **S9:** corrected above. Two construction sites, one deliberate.
+- **S10:** fixture data renamed; the pinned digest does not depend on it.
+
+**Soul's second pass corrected Self's record.** Self had written that a
+mutation reported a verdict it never earned. The committed script already threw
+on a missing anchor, the affected mutation existed only in a working copy, and
+every committed verdict was real. The Eureka changelog carries the correction.
+
+**Cut 6 landed** at `7ab838f1` (extract), `d17cc441` (docs) and `08c1c9d9`
+(mutation suite). The last cut inside Epiphany.
+
+- **`epiphany-pipeline` exists.** Four direct dependencies, 36 transitive
+  against `epiphany-core`'s 93, and **zero new packages in the workspace lock** —
+  the lock gains exactly one entry, the member itself. `cargo tree` over normal,
+  dev and build finds no path back to `epiphany-core`. The leaf is a leaf.
+- **`epiphany-core` net −1,034**, and lost a dependency: `schemars` left with the
+  code, the module having been its only user in the package.
+- **Tests 12 and 163**, both 0 warnings, the arithmetic exactly 172 − 9 moved.
+  Twelve mutations, all killed.
+- **The move is verbatim in the library code**, confirmed by Soul reading the
+  full base-to-head diff.
+
+Cut 6 corrections:
+
+13. **Cut 4's Keeps list said `schemars` stays. It did not.** The pipeline
+    documents were its only user, so it left with them. The Q5 reason to keep it
+    now lives in `epiphany-pipeline`.
+14. **The add-side estimate was never raised.** Correction 3 raised the removal
+    figure to −1,060 when the test module joined the move, and left the addition
+    figure on its pre-Cut-4 623-line base: spec +700, actual +1,292. The two
+    numbers always move together. Second ledger drift after a correction this
+    campaign; the first was Cut 5's correction 12.
+15. **`rg -n "pipeline" epiphany-core/src` cannot be empty**, and should not be.
+    Sixteen hits remain, all inside one `#[cfg(test)]` spine test that Cut 4's
+    fix batch put there deliberately. The intent holds — `epiphany-core` has no
+    pipeline *surface* — so the negative grep is the narrower one over the type
+    names. Hands refused to weaken the test to satisfy a grep, and Soul
+    confirmed that was the right call.
+16. **Ten schemas changed, not three added.** The five that embed `PipelineKind`
+    gained three variants. Ruling 8's amendment settles that as additive.
+17. **`epiphany-state.exe` "byte-identical" is withdrawn as false**, not merely
+    unverified. It is 94,720 bytes smaller at head, which is what taking ~1,000
+    lines of schemars-derived types and the `schemars` dependency out of
+    `epiphany-core` should do. No receipt for the original claim exists anywhere.
+    Soul also showed the same source hashes three ways from three different
+    roots, so the honest replacement is no hash claim at all: that artifact's
+    hash is not a comparison this branch can make.
+18. **`7ab838f1`'s message says three things changed in the move; the diff
+    carries five.** The two omissions are test fixture path literals, mechanical
+    and harmless. Self's first relay of this was wrong in its other half: the
+    `remove_dir_all` line was introduced by `08c1c9d9`, whose message devotes a
+    paragraph to it.
+
+**Cut 6's Soul findings are closed** at `eb55efe9`, `b6f6e802`, `80db5db6` and
+`3ee78e05`. Tests 13, 0 warnings; the suite is now M1-M15 and every one is
+killed by its own test, including both of Soul's survivors.
+
+- **S1, the escape was not injective.** `GameCult_Epiphany/thing` and
+  `GameCult/Epiphany_thing` both keyed to `GameCult_Epiphany_thing`; an instance
+  stewarding both would silently have lost one document. The test above it
+  claimed the property in a comment and checked one half of the pair. Both
+  special bytes are now escaped to two-byte codes starting with `_`, which is
+  reversible and therefore injective, and the test keys both halves.
+- **S2, the instance key segment was unpinned.** The validation call was in the
+  source; nothing would have noticed its removal. Soul's survivor is now M14.
+- **S3, `pipeline_key` made `Instance` a root and `pipeline_id` did not**, so an
+  instance could be written but never referenced and no resolution could take
+  one as its subject. The key writer had been extended for the new kind and the
+  id reader left behind.
+- **S6, the derivation test's temp directory is per-run**, named by pid and
+  nanos. The best-effort clear and its `.ok()` are gone rather than hardened:
+  with no directory shared between runs there is nothing to defend. The
+  mutation suite had been leaving mutated schemas in the shared one.
+- **Recorded, not fixed:** S5, the `ForeignDocument` type-id literal can drift
+  from `epiphany-core`'s real one and nothing connects them; the strong fix is a
+  dev-dependency that crosses this cut's deletion line. Cut 8 owns it.
+- **Informational for Cut 8:** the leaf pulls `redb` and `fs2` through
+  `cultcache-rs`, so Huginn gets an embedded database in its graph from this
+  leaf whatever else it chooses.
+
+**The test shape was the common cause.** S2 and S3 were both invisible because
+the three new kinds' tests asserted key strings and never parsed them back.
+`keys_read_back_as_ids_of_their_kind` is the pin that would have caught both,
+and it is now in the Keeps list for every kind added after this.
+
+**Cut 6's second fix batch landed** at `9b68d83c` (one composer,
+`KeyParts::key`, for every non-root, non-resolution key, with `.` escaped to
+`_d`), `4cccb45c` (a resolution reads back by the key it has; `declared_kind`
+added) and `4a654351` (the per-run schema directory's cost stated). It closed
+Soul's second-pass findings:
+
+- **F-A, the composed hand-off key was still not injective.** S1's fix made the
+  repo *segment* injective and left the *composition* open: a dotted
+  `to_instance` and a dotted date could trade bytes across the `.` separator.
+  Fixed at the composer, not the segment.
+- **F-B, a resolution was unreferenceable.** Soul's mutation adding
+  `| PipelineKind::Resolution` to the root case survived, because nothing read
+  a resolution's key back. Fixed with a Resolution arm in `pipeline_id`.
+
+**Soul's third pass, on that batch, found the same invariant open again**, one
+level higher, and Self stopped the patch sequence. Three consecutive fixes had
+each made one composition site injective (segment, then composed local, then
+root namespace) and left the site above it ambiguous. Per doctrine, escalating
+guards mean the ownership is wrong. The three CONFIRMED High findings, all
+`epiphany-pipeline/src/lib.rs` at `4a654351`, became Cut 6b:
+
+- **Campaign and instance share one root namespace** (`:693-700`, `:553-556`).
+  Campaign `yggdrasil` and instance `yggdrasil` key identically. Soul measured
+  254 documents keying to 234 distinct keys, 20 colliding, 10 from this pair.
+- **A resolution's key discards its subject's root kind** (`:703-707` with
+  `:529-538`). `declared_kind` hardcodes `Campaign` for a bare slug; a mutation
+  flipping it to `Instance` survived because the information was already gone.
+- **A resolution of a resolution composes `resolution:resolution:…`**
+  (`:564-568`), which `pipeline_id` reads back as `InvalidFormat`. The comment
+  beside it names the path as live.
+
+Three medium survivors go into the same cut: the composed local's total length
+check is unpinned (a hand-off local reaches about 140 bytes against a
+documented 64); the root check inside the composer is unpinned (`pipeline_key`
+is `pub` and a colon in a root yields four segments); and "a kind's tail arity
+is fixed by the arm" is enforced by a doc comment, not the type.
+
+Cut 6 corrections, continued:
+
+19. **`<Org_Repo>` escapes three bytes, not two.** The Keys paragraph below
+    said `_` and `/`; `9b68d83c` added `.` → `_d` so that an escaped repo can
+    sit inside a `.`-separated local without trading bytes with its neighbours.
+    Cut 6b generalises the escape to every slug entering a local and the
+    paragraph is superseded there.
+20. **The key table never stated the resolution key.** `resolution:<subject id>`
+    was the shape since Cut 3a and appeared in no table. Pre-existing; Cut 6b's
+    grammar table is the first complete one.
+21. **`rg -n "std::process" epiphany-pipeline/src` is not empty**, and should
+    not be: the per-run temp directory from S6 reads `std::process::id()` under
+    `#[cfg(test)]`. The intent (no process is spawned, no socket is opened)
+    holds; the grep is narrowed to `Command|UdpSocket|BackingStore`. Second
+    negative grep this campaign to drift from its intent; the first was
+    correction 15.
+22. **The shared cargo target directory was left at 8,642 paths against an
+    8,284 baseline, and that is ruled acceptable for this pass.** The growth is
+    one debug profile of this package's dependency tree, with no new package,
+    target, profile or platform, and deleting it would evict a cache the next
+    build re-creates. This is a judgment per pass, not a loosening of the rule:
+    the path list is still recorded and compared every time. (`find | wc -l`
+    counts the root directory and PowerShell's `Get-ChildItem -Recurse` does
+    not, so 8,642 and 8,641 are the same count.)
+23. **Cut 5's Soul addendum carries a second "byte-identical" claim about
+    `epiphany-state.exe`.** Its other half is stronger than claimed and stands:
+    the negative greps are empty across the whole tree including untracked and
+    ignored files. But the binary claim has the shape correction 17 withdrew,
+    and that artifact's hash is build-root dependent. Marked suspect, not
+    evidence; no hash replaces it.
+24. **`schemas/cultnet/README.md:5` promises the folder helps "foreign
+    consumers inspect the wire shape", and `:40-44` now says a widened enum is
+    additive because "these readers are ours".** Both sentences are true today
+    and they will contradict each other the day Eureka has an outside reader.
+    Recorded, not resolved: it needs a real answer if a foreign consumer
+    appears, and the answer is a versioning policy, not a README edit.
+
+**Mutation harness audit (Eyes, 2026-09-16).** Soul's third pass ran a no-op
+control mutation and it "killed" `bounds_refuse_in_utf8_bytes`: the harness's
+text round-trip had collapsed the test's `é` literal to one byte, so every
+mutation through that path would have reported a kill whatever it changed.
+Soul caught it only because it ran the control. Eyes then audited every suite
+in this repo and in Ghostlight:
+
+- **No committed suite has the defect.** `tools/eureka-cut4-mutations.ps1` (at
+  `a9f06c2a`), `cut5` and `cut6` all use `[IO.File]::ReadAllText` /
+  `WriteAllText`, measured byte-identical on every live target. The corrupting
+  harness was Soul's own inline one and is not on disk anywhere; its text is
+  unrecoverable. That is the shape finding S9 under History already names as
+  Standing: a mutation with no artifact on disk is unverifiable.
+- **Cut 1's M1-M3 are suspect for a different reason.** The ad-hoc
+  `eureka-c1-mutate.ps1` joined lines with `\n`, rewriting two CRLF files to LF
+  for the whole file while mutated; `core.autocrlf=true` hid the rewrite from
+  `git diff`. Whether that changed a verdict is unknown and was not re-run.
+  Cuts 3a, 4, 5, 6, the Cut 2 fix pass and all Ghostlight verdicts are not
+  suspect.
+- **No suite in either repo has a no-op control**, and the committed suites
+  structurally forbid one: each throws when a replacement changes nothing
+  (`cut4:86`, `cut5:216`, `cut6:237`). Ghostlight has never had a scripted
+  harness; its mutations are hand edits restored by `git checkout`.
+- **The measured rule** is encoding symmetry and end-of-line preservation, not
+  `-Encoding utf8` by itself: mixed-encoding round-trips corrupt the `é`, and
+  any non-`-Raw` `Get-Content` corrupts line endings regardless of encoding.
+
+Cut 6b's suite is the first with a control (M0) and the rule is now in the
+Eureka skill.
+
+**Cut 6b landed** at `602ffd9f` (the three key-shape exceptions deleted;
+does not build, by design), `1bddd2ac` (one grammar for every kind; 20 tests,
+0 warnings) and `95ee551a` (`tools/eureka-cut6b-mutations.ps1`, the first
+suite with a no-op control). Source outside tests 774 → 726, tests 734 → 881,
+no schema, dependency, kind, field or epoch moved. Hands' spec discrepancies,
+all kept: `local` takes `&[&str]` rather than a fixed array because the
+Resolution and Finding arms carry a parent's parts; the whole-local bound
+refuses `InvalidFormat` to match the reader; `key_segment` is a pure escape
+and each caller validates its own field first; two "unchanged" tests carried
+literal keys that moved; and `{CAMPAIGN}:resolution:R8` is now asserted
+*accepted* with the Q11 rationale in its doc comment, so a future runtime
+guard is visible.
+
+**Soul's first pass on the grammar** (Fable, script
+`soul-cut6b-mutations.ps1` in the session scratchpad, M0 green twice) built a
+whole-key injectivity probe: 212,450 distinct keys across all thirteen kinds
+with adversarial slugs, repos, labels and dates and resolutions nested to
+depth four, **zero collisions**, every key three segments, every key reading
+back to its own kind and identity, 157,010 resolution keys recovering exactly
+their subject. `self` collides with nothing as a slug, a label or a campaign.
+Hands' M1-M6 all killed on rerun; Soul's own S1, S6, S7, S8, S9 killed; S3
+(`splitn(3, ':')`) survived as an equivalent mutant because `label_text`
+refuses a colon in the third segment anyway. Three survived for real:
+
+- **F2 (medium): the escape's `_`→`__` half is pinned only through an
+  `OrgRepo`.** A mutant escaping only `.` when the value has no `/` survives,
+  and hand-offs to `a_db` and to `a.b` then share a key. That is the pass-2
+  collision class, one edit from reopening.
+- **F3 (medium-low): the composer's root check is pinned for one byte.** Under
+  `trim_end_matches('.')`, campaign slug `eureka-state.` composes a key the
+  reader refuses, and the write validator recomputes and compares without
+  reading back, so a document is admitted under an id no `PipelineRef` can
+  name.
+- **F4 (medium-low): the 64-byte boundary is unpinned on both sides.**
+  Fixtures sit at 55 and 66+, so a `> 65` mutant survives and the writer
+  admits a 65-byte local the reader refuses. The code is right; the pin was
+  missing.
+
+And four findings that are not code defects: **F1**, the "depth at most five"
+claim is false (corrected above); **F5**, a dotted finding label now refuses as
+`finding.key` rather than `finding.label`, consistent with every other kind
+and accepted as the behaviour; **F6**, the authority map overstated the escape
+rule for `Date` (corrected above); **F7**, Hands' "twelve fixed call sites" is
+eleven literal slices plus two computed vectors, the Finding one fixed in
+practice by `parent_cut` pinning the verdict local to two parts. **F8**,
+pre-existing and informational: a cut-report key drops the spec revision
+(a standing ruling) and a verdict key drops the report attempt (implied, not
+stated). `pipeline_id` accepting `c:campaign:notself` and the like is grammar
+versus reachability, admission's job, as the spec says.
+
+The stale Cut 6 script entries M5 and M12-M15 match zero anchors at HEAD and
+the script throws at its line 234 rather than reporting a kill. Loud, as the
+rule requires. Target dir: Hands' growth to 9,279 was one debug profile;
+Soul left 8,991 because cargo rotated out one of Hands' incremental sessions,
+which cannot be recreated and is not a deletion.
+
+**The first fix batch landed** at `4b85dd2d` (F1-F4 pinned; Soul's S2, S4 and
+S5 now die; the depth test computes its expectation from the formula) and
+`d03a32df` (one harness, `tools/eureka-mutations.ps1`, with per-cut entries
+files `eureka-cut5-`, `-cut6-`, `-cut6b-mutations.psd1`; the three old scripts
+deleted; `tools/` net −24 lines). The harness runs each entry with
+`--exact <test>` and reports `TEST NOT RUN` for a name that runs nothing,
+where the old scripts would have said SURVIVED. Cut 6's stale entries M5 and
+M12-M15 were deleted with notes, on Self's instruction, which was a mistake;
+see F3 below.
+
+**Soul's second pass** (Fable; scripts `soul-cut6b-fix-*.ps1` in the session
+scratchpad) attacked the harness directly and reran every entry with the
+whole suite: no verdict was borrowed from a collateral kill. Held: S2/S4/S5
+die, the four pins are as promised, all three suites report the same verdicts
+through the new harness, refusal `value` is the failing part and asserting
+`field` alone cannot hide a wrong-reason refusal. Found:
+
+- **F1 (medium): the control could damage what it protects.** M0 wrote the
+  target before comparing, having read it as text, so on a broken harness or
+  a BOM-bearing target it reported "harness broken" and left the file
+  changed with no restore source but the checkout the rules forbid.
+- **F2 (low): "exactly once" counted non-overlapping matches**, so a
+  self-overlapping anchor like `}\n}\n` in a run of three braces passed as
+  one.
+- **F3 (low-medium): the deletion notes for Cut 6's M12/M13 named the wrong
+  pinning entry.** `key_segment` still exists and nothing in the committed
+  suite removes its escape or breaks its injectivity; the tests do pin the
+  rule (Soul's N7/N8 die), the suite claimed coverage it lacked. Self's brief
+  ordered "delete, do not re-anchor"; the coherent fix was to re-anchor.
+- **F4 (medium): dotted roots were unpinned on writer and reader.** No test
+  used a campaign or instance slug with a dot, so `label_text` on the root in
+  either `pipeline_key` or `pipeline_id` survived the whole suite.
+- **F5 (low): the reader's kind check was unpinned for root kinds.** A mutant
+  excusing `Instance` from the kind-segment comparison survived: exactly the
+  "reader excuses a root" shape Cut 6b existed to kill.
+- **F6 (low): the depth test restated the literal 64** rather than
+  referencing the bound, so moving both to 60 passed it; the bound itself is
+  pinned by F4's fixtures.
+- **F7 (recorded): `-Test` splits on whitespace**, so a path with spaces
+  cannot be expressed. Not reachable on this host.
+
+**The second fix batch landed** at `9370aa0f` (harness: the original is read
+as bytes and is the restore source on every path; M0 compares the re-encoded
+bytes to the original before writing anything, then still writes through and
+hashes so a broken write path is caught, restoring the original bytes before
+any throw; anchor occurrences are counted overlapping; the offset reverse-edit
+path is deleted; a BOM-bearing target is now tolerated rather than refused)
+and `f00062db` (`dotted_roots_key_and_read_back`;
+`keys_read_back_as_ids_of_their_kind` extended by three root-kind asserts, its
+first change since Cut 6; `const LOCAL_MAX: usize = 64` shared by `local` and
+the depth test; entries N3, N6, N7, N8, N9, N10 in the 6b file, M4 and S5
+re-anchored on the constant; the Cut 6 notes corrected to M5→N3+M6, M12→N7,
+M13→N8, M15→N6+M1). Tests 21, 0 warnings. Soul's attack script rerun against
+the fixed harness: every variant leaves every target byte-identical and runs
+no entry.
+
+**Soul's third pass** (Fable; `soul-cut6b-fix2-*` in the session scratchpad)
+reran all three suites through the committed harness (every entry killed, M0
+green on every target, 0 warnings unmutated) and **closed the grammar
+pins**: the dotted-roots test asserts exact tuples, the root-kind asserts are
+appended to the read-back test with nothing weakened, a BOM-bearing target
+round-trips byte-identically and rustc accepts a leading BOM, and its own
+non-revert mutations died or were equivalent (swapped escape codes remain
+injective; `chars().count()` equals `len()` for ASCII parts). What survived
+is the harness under failure, not the grammar:
+
+- **The multi-target write loop sits outside the `try` whose `finally`
+  restores**, so a write that throws on the second target leaves the first
+  mutated with no message. Low for today's single-target entries, medium
+  against the harness's stated contract.
+- **M0's write-through has no `finally`**: a write that dies after
+  truncation leaves a truncated target, and only the hash-mismatch branch
+  restores.
+- **A killed process runs no `finally`**, and the harness has no timeout of
+  its own, so a tool-enforced timeout is exactly the path that leaves the
+  tree mutated. The next M0 would catch it without saying why.
+- **The reader accepts a trailing dot on the root and on the local**
+  (`pipeline_id`, `:556-557`); only the writer refuses, so a `PipelineRef`
+  with trailing junk passes the reader against its own doc comment. One
+  fixture closes it.
+- `LOCAL_MAX` names the writer's bound; the reader's is `dotted_text`'s
+  literal 64, which is also the `Slug` bound. Redundant, not split: the
+  writer refuses first. A comment at `:651` still says "the 64-byte bound".
+- Hands' line counts were +6/−1 and +73/−6, not +5/−1 and +68/−6.
+
+**The third fix batch landed** at `9d57a460` (harness: every target write
+inside the restoring `try`; M0's write-through in its own `try`/`finally`; a
+shared restore that is hash-first, attempts every target, and prints
+`RESTORE FAILED` with the original SHA-256 before rethrowing; a sidecar
+`<target>.eureka-mutation-original` written before any write and removed
+after a verified restore, from which a run that died mid-mutation is
+repaired at the next start with a message; `-TimeoutSeconds`, default 1800,
+killing the process tree inside the command runner's own `finally` with the
+verdict `TIMED OUT (no verdict)`) and `7cd1a38b` (the reader refuses
+`c.:target:x`, `c:target:x.`, `c:target:.x` and `c:target:a..b`; X1 and X11
+are entries). Hands reproduced every attack: locked targets on either side
+leave both unchanged; a tree killed mid-entry leaves the mutant and the
+sidecar, and the rerun repairs and says so; a one-second timeout kills the
+runner and leaves the target unchanged. Soul in flight on this batch
+together with Cut 6c.
+
+## Probes and source reads this pass
+
+No cargo build ran this pass. Every new mechanism claim below was settled by a
+source read; the one build-dependent claim (rmcp as a stdio server) was settled
+by P4 in the first pass and is unchanged. No build outputs were created, so
+none were deleted. Claims are marked **(source read)** or **(probe)**.
+
+| # | Claim | Evidence |
+|---|---|---|
+| R1 | **No Rust Qdrant client exists anywhere under `F:\Projects`.** | (source read) `grep -rn qdrant --include=Cargo.toml --include=Cargo.lock --include=*.rs` over `F:\Projects` returns nothing in any live tree. |
+| R2 | **Epiphany had one, and deleted it.** `856648de` "Delete unused semantic projection subsystem" removed `semantic_backend.rs` (1,018 lines), "Typed boundary around the Qdrant and Ollama HTTP APIs", plus 8,800 more lines of projector. | (source read) `git show 856648de --stat`; `git show 856648de^:epiphany-core/src/semantic_backend.rs`. |
+| R3 | **That client was plain `reqwest::blocking` against Qdrant's REST API**, not a Qdrant crate: `PUT/GET/DELETE {base}/collections/{name}`, `PUT {base}/collections/{name}/points`, `POST .../points/query`, `.../points/scroll`, `.../points/delete`. Embeddings were `POST {base}/api/embed` returning `.embeddings`. | (source read) `856648de^:.../semantic_backend.rs:116,130,157,207,244,262,287,318,351,397,535,560`; deps at `856648de^:epiphany-core/Cargo.toml:37` (`reqwest = { version = "0.12", features = ["blocking","json"] }`). |
+| R4 | **Epiphany has no CultNet *server* for documents.** Its live `cultnet_rs::` usage is service identity and trust anchors only. Its only UDP binds are the Persona Discord permit issuer, the Persona delivery client and Atlas publication. | (source read) `grep cultnet_rs::` over `epiphany-core/src` yields only `ServiceIdentitySigner`, `GameCultServiceTrustAnchorRecord`, `open/enroll_service_identity_at`, `derive_service_identity_id`. `UdpSocket::bind` appears only at `atlas/transport.rs:245`, `bin/epiphany-persona-discord-permit.rs:38`, `persona_discord_crossing.rs:322`. |
+| R5 | **The permit issuer is a hand-rolled request/response loop**, not a reusable document server: `serve_persona_discord_permit_rudp` loops `transport.receive_once()`, matches one `DocumentPutRaw`, and replies with another. | (source read) `persona_discord_permit.rs:330-400`. |
+| R6 | **Odin is the real harness to copy.** `odin-daemon` runs `CultMeshRudpDocumentServer::new(socket, SinkHandle, SnapshotHandle, CultMeshSystemClock, options)` and a `poll_once` loop, with Idunn activation, a process write lease, signal handling and presence-health publication. | (source read) `Odin/crates/odin-daemon/src/main.rs:14-40,542-560,600-700`. |
+| R7 | **CultMesh's document server is port-shaped and mockable.** `CultMeshRudpRawDocumentSink::accept_raw_document(receipt)` and `CultMeshRudpSnapshotSource::raw_snapshot(&query)` are traits with blanket impls for closures; the clock is a trait. | (source read) `CultLib/packages/cultmesh-rs/src/rudp_document_server.rs:51-95`. |
+| R8 | **A lean CultNet daemon needs six dependencies.** `odin-daemon` is `signal-hook, anyhow, chrono, cultcache-rs, cultmesh-rs, cultnet-rs, fs2, rmp-serde, serde`, and Odin's whole lock file is 156 packages. Epiphany's is 295. | (source read) `Odin/crates/odin-daemon/Cargo.toml`; `grep -c '^\[\[package\]\]' Cargo.lock` in both repos. |
+| R9 | **`epiphany-core` is 40,941 lines across 37 modules with 39 `mod` declarations**, and pulls Ghostlight, `ed25519-dalek`, `ignore`, `semver`, `cultmesh-rs`, `cultnet-rs` and `windows-sys`. | (source read) `wc -l epiphany-core/src/*.rs`; `epiphany-core/Cargo.toml`. |
+| R10 | **Epiphany's commit owner and its profile are crate-private**, so no external crate can reuse admission as it stands. | (source read) `reasoning_context.rs:1590` `pub(crate) struct TypedCommitStore`, `:1606` `pub(crate) const MIND_COMMIT_STORE`, `:1613` `pub(crate) fn commit_authorized_mind_mutation`. |
+| R11 | **`RedbMessagePackBackingStore` stores one redb row per `(type, key)`**, transactionally, and creates parent directories. redb permits one writable handle per path, and the CultCache lock owns the open/transaction/close interval. | (source read) `cultcache-rs/src/lib.rs:960-1013`, `:979-982`. |
+| R12 | **Nothing consumes `@gamecult/huginn`.** The only `package.json` naming it is Huginn's own. Eve's Huginn entry points at a checked-in fixture file, not the package. | (source read) Grep over every `package.json` under `F:\Projects`; `Eve/web/local-provider-catalog.json:72-83` gives `"url": "./fixtures/huginn-cc-surface.eve"`. |
+| R13 | **Eve's Huginn fixture is static and already stale.** It describes `E:\Projects\CultCacheTS\.voidbot\state\huginn.cc` and declares `"freshness": {"state": "fixture"}`, `"splitTarget": "Huginn"`. | (source read) `Eve/web/fixtures/huginn-cc-surface.eve:16`; `huginn-cc-surface.conformance.json`. |
+| R14 | **CultCache Studio exists** as a Unity editor surface in CultLib. | (source read) `CultLib/src/GameCult.Unity/Assets/Caching/Editor/CultCacheStudioWindow.cs`, `CultCacheStudioDrawers.cs`. |
+| R15 | **Qdrant on Yggdrasil is voidbot's container**, `qdrant/qdrant:v1.17.1`, host network, bound `127.0.0.1`, storage `/srv/voidbot/qdrant`, started by `voidbot-retrieval.service`. | (source read) `gamecult-ops/compose/voidbot-retrieval.yggdrasil.yaml`; `systemd/voidbot-retrieval.service`. |
+| R16 | **Two Ollama endpoints exist, and the Yggdrasil precedent is the local one.** `epiphany.service` embeds against `http://10.77.0.1:11435` with `qwen3-embedding:0.6b`; voidbot's indexer uses Nightwing `10.77.0.3:11434` with the same model. | (source read) `gamecult-ops/systemd/epiphany.service:14-15`; `runbooks/yggdrasil-replacement-2026-07.md:184,193`; `runbooks/voidbot-retrieval-recovery-yggdrasil.md:42-62`. |
+| R17 | **Idunn v2 is recipe-plus-binding.** A repo publishes `deployment/idunn/recipe.toml` (`gamecult.idunn.target_declaration.v1`: steps, artifacts, `[service]`, `[state.slots]`, `[[provides]]`, `[[dependencies]]`); Yggdrasil admits a paired `gamecult.idunn.operator_binding.v2` naming runners, workload roots, route, brakes, rollout and placement. | (source read) `Odin/deployment/idunn/recipe.toml`; `Ghostlight/deployment/idunn/recipe.toml:168-187`; `gamecult-ops/idunn/yggdrasil/bindings/odin.toml.in`, `bindings/README.md`. |
+| R18 | **Idunn brakes are typed and already separated.** `idunn.deployment_brake.v1` (scope `deployment`) and `idunn.lifecycle_brake.v1` (scope `continuity-restart`) are distinct records with distinct authorities. | (source read) `cultnet-rs/src/idunn_deployment_brake.rs:9-15`; `idunn_lifecycle_brake.rs:4-7`. |
+| R19 | **The authority backup is an explicit path list, daily at 03:20 UTC.** It tars a fixed set including `var/lib/gamecult/epiphany` and `srv/voidbot/state`; a path not listed is not backed up. | (source read) `gamecult-ops/scripts/backup-gamecult-authority-yggdrasil.sh:80-105`; `systemd/gamecult-authority-backup.timer`. |
+| R20 | **The workstation reaches Yggdrasil by a supervised SSH tunnel with a fixed forward table**, scheduled task `GameCult-Yggdrasil-Tunnel`. It already forwards `17875` (voidbot MCP) and `16333/16334` (Qdrant). | (source read) `gamecult-ops/scripts/start-yggdrasil-tunnel.ps1:13-26`; `runbooks/yggdrasil-ssh-tunnel.md:86-88`. |
+| R21 | **Allocated `178xx` RUDP/service ports** are 17870 Idunn health, 17871 Odin rendezvous, 17873 VoidBot swarm publisher, 17874 Hermodr, 17875 voidbot MCP, 17876 Epiphany permit listener, 17877 Starfire permit requester, 17878 dings. **17872 and 17879 are unallocated.** | (source read) `gamecult-ops/inventory.md:247,455,502,537`; `runbooks/yggdrasil-replacement-2026-07.md:315-321`; `idunn/yggdrasil/bindings/*.in`. |
+
+Carried forward from the first pass and still load-bearing:
+
+- **P4 (probe).** rmcp 2.2.0 with `features = ["server","macros","transport-io"]` serves stdio JSON-RPC, handshakes at `2025-06-18`, emits both `inputSchema` and `outputSchema` from schemars, returns `structuredContent`, maps `ErrorData::invalid_params` to `-32602`, and spawns nothing.
+- **P7 (probe).** cultcache-ts `inspectCultCacheBytes` decodes a Rust-written `cultcache.store.v1` record; Rust writes an empty member catalog, so the TS decode is generic.
+
+Superseded probes: P5, P6, P8, P9, P10 and P11 all measured git layout, store locking at session scope, or git attribute classification. They were evidence for a repo-committed store and no longer bear on any live design. P1-P3 were Cut 1 and landed.
+
+## D1. Package boundaries and where admission lives
+
+This is the decision the brief asks for, so it is stated first.
+
+**Ruling 1 says Epiphany owns the schemas. The target's End state assigns
+admission, queries and the index to the organ** ("**The organ (Huginn).** One
+service owns every mind it hosts: admission, with per-document rules and typed
+refusals; ... queries ...; semantic search ...; a typed hand-off"). Those are
+consistent, and together they settle the split:
+
+- **Epiphany owns the document types, their keys, their bounds and the published
+  JSON schemas.**
+- **Huginn owns admission rules, receipts, storage, queries, the index, the
+  hand-off and the CultNet surface.**
+
+**Admission does not live in `epiphany-core`, and Huginn does not depend on it.**
+Three source-grounded reasons:
+
+1. **It cannot.** The commit owner, its profile and the wrappers are all
+   `pub(crate)` (R10). Exposing them would publish Epiphany's Mind commit
+   machinery as a public API to make an unrelated service compile.
+2. **The weight is absurd.** Huginn would compile 40,941 lines and 295 lock
+   packages, including Ghostlight and `ed25519-dalek`, to use about 2,000 lines
+   of it (R9). Odin's comparable daemon costs 156 packages total (R8). This is
+   exactly the build fan-out AGENTS.md's Source And Build Economy forbids.
+3. **The rules are not the same rules.** Epiphany's admission is bound to a
+   scheduler: launch requests, sealed reasoning bases, decision contexts.
+   Pipeline admission is bound to an instance and a campaign. Sharing the
+   function would mean sharing none of the interesting part.
+
+**So a third package owns the shared half.** New leaf library
+`epiphany-pipeline`, in the Epiphany repo, workspace member, `autobins = false`:
+
+| | |
+|---|---|
+| **Owner** | The ten document kinds plus the three new ones, their value types, bound aliases, format rules, key derivation, and the derived JSON schemas. |
+| **Dependencies** | `cultcache-rs`, `schemars`, `serde`, `rmp-serde`, `chrono`, `anyhow`. Nothing else. |
+| **Consumers** | Huginn's `huginn-mind` (admission) and `eureka-state` (typed tool schemas), both by git rev. Epiphany itself does **not** consume it in this campaign; that is campaign two. |
+| **Why a new crate** | A live cross-repo consumer needs these types without Epiphany's 295-package graph. `F:\Projects\CLAUDE.md` says authority separation alone does not justify a crate; this is not authority separation, it is a named external consumer and a hard dependency boundary. |
+| **Why in the Epiphany repo** | Ruling 1. The schema publication path, `schemas/cultnet/index.json` and the derivation test stay where they are. |
+
+`epiphany-core` keeps the schema-derivation test's *outputs* — the committed
+`schemas/cultnet/epiphany.pipeline.*.v1.schema.json` files are Epiphany's
+publication artifact — but the test that derives and compares them moves into
+`epiphany-pipeline`, reading `../schemas/cultnet` the way it already does
+(`pipeline_store.rs:1173`).
+
+**Huginn's package boundary**, applying AGENTS.md's one-package-per-production-
+entrypoint rule. Two entrypoints, so two binary-owning packages plus one library:
+
+| Package | Kind | Owns |
+|---|---|---|
+| `huginn-mind` | library | Mind storage, admission rules, receipts, queries, derivations, the index port and the embedding port. No process, no socket. |
+| `huginn-daemon` | binary `huginn-daemon` | The CultNet surface, the Idunn lifecycle, Qdrant and Ollama adapters, the serve loop. |
+| `eureka-state` | binary `eureka-state` | The stdio MCP client. |
+
+**The daemon test (`F:\Projects\CLAUDE.md`).** `huginn-daemon` earns its process:
+it outlives every Claude Code session, owns an independent resource dependency
+(Qdrant, a redb store), and isolates a dead session from a corrupted mind. That
+is lifecycle, resource and failure isolation, and it protects the named
+invariant "exactly one writer per mind". `eureka-state` earns a *separate*
+entrypoint but is **not** a daemon: it is a per-session stdio child with a
+different dependency set (rmcp, tokio) and a different lifecycle. `huginn-mind`
+earns no process at all.
+
+**Why `eureka-state` lives in Huginn, not Epiphany.** The client and the server
+share the request and response document types. Putting the client in Epiphany
+would make the wire contract have two owners in two repos. It also keeps rmcp
+and tokio out of Epiphany's release bundle, which was the original Cut 4's
+reason for a separate package anyway (`construction.rs:82-98` lists the nine
+packaged binaries; none changes).
+
+## D2. Documents
+
+Unchanged from the landed Cut 3a except as noted: the value-wrapper pattern, the
+`value_types!` single field list, the bound aliases (`Short` 200, `Line` 1,000,
+`Para` 4,000 UTF-8 bytes), the format types (`Label`, `Slug`, `OrgRepo`, `Sha`,
+`FullSha`, `Sha256Hex`, `Date`), key derivation, and the ten kinds all survive
+verbatim. The epoch stays `epiphany.pipeline.epoch.v1`. Adding the three kinds
+widens the `PipelineKind` enum in the five schemas that embed it, which ruling
+8's 2026-09-16 amendment settles as additive.
+
+**Deleted from the set:** `PipelineWriterHolder` and its wrapper
+`EpiphanyPipelineWriterHolder` (`pipeline_documents.rs:334-349,492-497`). They
+were the display record of the per-clone lease.
+
+**Added: three kinds, each with a live consumer.**
+
+| Kind | Type id | Value fields | Live consumer |
+|---|---|---|---|
+| `instance` | `epiphany.pipeline.instance.v1` | `instance: Slug`, `display_name: Short`, `created_at: Date`, `host: Short` | The mind's identity document. Admission's identity check (ruling 14); `whoami` in `eureka-state`; the hand-off's `from`/`to`. |
+| `stewardship` | `epiphany.pipeline.stewardship.v1` | `instance: Slug`, `repo: OrgRepo`, `assigned_on: Date`, `note: Line` | Ruling 14's "stewardship is an assignment". Query "which repos does this instance steward"; the Rehydrate brief; admission's campaign-repo check. |
+| `hand_off` | `epiphany.pipeline.hand_off.v1` | `from_instance: Slug`, `to_instance: Slug`, `repo: OrgRepo`, `documents: Vec<Short>[256]`, `reason: Para`, `handed_on: Date` | Ruling 14's "reassignment is an explicit typed hand-off recorded in both minds". Cut 12's import path. |
+
+**Keys.** *Superseded by Cut 6b's grammar (correction 19, 20). Kept as the
+shape Cut 6 landed; the live table is in Cut 6b.*
+
+| Kind | Key as landed by Cut 6 | Key after Cut 6b |
+|---|---|---|
+| `instance` | `<instance slug>` | `<instance>:instance:self` |
+| `stewardship` | `<instance>:stewardship:<Org_Repo>` | unchanged |
+| `hand_off` | `<from>:hand_off:<to>.<repo>.<date>` | `<from>:hand_off:<to escaped>.<repo>.<date>` |
+| campaign | `<slug>` | `<campaign>:campaign:self` |
+| resolution | `resolution:<subject id>` (never stated here before) | `<subject root>:resolution:<subject kind>.<subject local>` |
+| everything else | `<campaign>:<kind>:<local>` | unchanged |
+
+`<Org_Repo>` is the `OrgRepo` with `_`, `/` and `.` escaped: `_` → `__`,
+`/` → `_-`, `.` → `_d` (the third added at `9b68d83c`, correction 19). `/` is
+not a `Label` byte, `.` is the local separator, and the key must segment
+unambiguously. Every other byte passes through and is never `_`, so a reader
+going left to right takes each `_` with the byte after it and never has a
+choice: the encoding is reversible, therefore injective. Admission recomputes
+it and refuses a mismatch with the existing `InvalidIdentity`.
+
+**Corrected 2026-09-16, after Soul.** This read "`/` replaced by `_`", which is
+not injective: `GameCult_Epiphany/thing` and `GameCult/Epiphany_thing` are both
+well-formed `OrgRepo` and both keyed to `GameCult_Epiphany_thing`. An instance
+stewarding both would have silently lost one document. The doubling trick alone
+(`_`→`__`, `/`→`_`) does not fix it either — `a_/b` and `a/_b` both give
+`a___b`. Sample keys move accordingly: `…:stewardship:GameCult_-Epiphany`.
+
+**Resolution matrix additions.** `stewardship` resolves by
+`Superseded{by: stewardship}` or `Withdrawn`. `instance` and `hand_off` are not
+resolvable. Everything else is unchanged.
+
+**`PipelineRefusal` splits.** The landed enum (`pipeline_store.rs:41-55`) mixes
+document refusals with store, git and lease refusals. It becomes two:
+
+- `epiphany-pipeline` keeps the document half: `FieldBound`, `InvalidFormat`,
+  `InvalidIdentity`.
+- `huginn-mind` owns the service half: `MissingIdentity`, `ForeignEpoch`,
+  `ForeignStore`, plus every admission-rule refusal (`MissingReference`,
+  `WrongReferenceKind`, `IdentityCollision`, `AlreadyResolved`,
+  `IncompatibleResolution`, `CitesResolvedDocument`, `RevisionWithoutSupersession`,
+  `InvalidOptions`, `InvalidChoice`, `RepoNotInCampaign`, `DuplicateLabel`,
+  `CutReportWithoutSpec`, `RangeOutsideCommits`, `FalsifiedClaimWithoutConfirmedFinding`,
+  `UnprovenClaimWithConfirmedFinding`, `FindingWithoutRange`, `FindingWithoutEvidence`,
+  `UnknownInvariant`), plus `ForeignInstance { declared, mind }` (ruling 14) and
+  `Unavailable`.
+
+**Deleted refusals:** `NotRepoRoot`, `NoMainWorkTree`, `StoreNotMarkedBinary`,
+`LockNotIgnored`, `WrongBranch`, `WriterLeaseHeld`. Every one of them is a
+statement about a repo-resident store.
+
+## D3. The organ's storage and admission
+
+**One mind per instance, one redb store per mind.**
+`<state_root>/minds/<instance>/mind.cc` as a `RedbMessagePackBackingStore`
+(R11). Redb, not the single-file store, because a mind grows without bound and
+the single-file backing store rewrites the whole snapshot on every write; that
+is the monolithic-store footgun `~/.claude/CLAUDE.md` names under
+Infrastructure. Odin uses the single-file store, but its topology store is small
+and bounded.
+
+**Identity.** The first write to a mind carries both the
+`EpiphanyPipelineIdentity` (epoch) and the `instance` document, in one batch.
+The opener refuses records-without-identity (`MissingIdentity`), a foreign epoch
+(`ForeignEpoch`) and any unregistered type (`ForeignStore`), exactly as the
+landed `pipeline_cache` does (`pipeline_store.rs:87-120`) — that logic moves
+almost verbatim; only its backing store changes.
+
+**Admission.** One public entry:
+
+```
+admit(&mut Mind, PipelineAdmissionBatch) -> PipelineAdmissionOutcome
+```
+
+with `PipelineAdmissionBatch { instance, provenance, documents (1..64) }` and the
+outcome one of `Committed { receipt_id, committed_at, writes }`,
+`AlreadyAdmitted { receipt_id }`, `Refused(PipelineRefusal)` or
+`Conflict { identities }`.
+
+Steps, in order:
+
+1. **Identity check (ruling 14).** `batch.instance` must equal the mind's
+   `instance` document, or `ForeignInstance`. This is the check that replaces
+   the whole lease.
+2. Validate bounds and formats.
+3. Recompute keys.
+4. Check references against the store image plus the batch.
+5. Apply the per-kind rules (unchanged from the old D4, minus the campaign
+   `origin` check, which no longer has a repo to inspect — `repo` must instead
+   be one the instance stewards, giving `RepoNotInCampaign` a new source).
+6. Derive writes (the `Answered` resolution for a ruling that answers a
+   question; the paired `stewardship` records on a `hand_off`).
+7. Commit.
+
+**Receipts stay, and Huginn owns its own commit primitive.** `huginn-mind`
+defines `HuginnCommitReceipt` with its own type id
+`huginn.mind_commit_receipt.v1`, carrying the same shape that earned its keep in
+Epiphany: authority, invariant owner, strong reads, writes, a content-digest
+receipt id, and `committed_at`. It replays idempotently on an exact match and
+returns typed `Conflict` on a lost CAS.
+
+This is deliberately **not** a reuse of `EpiphanyMindCommitReceipt`. The landed
+Cut 3a reused it with `store_id = "epiphany-pipeline"` because both lived in one
+crate; across a repo boundary that reuse would drag the whole crate (D1).
+Roughly 120 lines of receipt/replay/CAS logic are re-implemented. That is a real
+duplication and it is the honest price of the service boundary — it is named
+here, in the subtraction ledger, and as follow-up FU-3, rather than hidden.
+
+**Admission time** lives on the receipt, never in a document, so exact replay
+stays byte-identical. Unchanged.
+
+**Concurrency.** The organ is the only writer to any mind it hosts, and it is
+single-process. CAS stays as defence in depth against its own bugs and against
+the import path. The old session lease has no successor: there is nothing left
+for it to exclude.
+
+## D4. Queries
+
+*Superseded by Cut 9 as landed (`49cc6e3`), 2026-09-16. Still true: one
+owner for every derivation, status derived at read time, the open-items
+sentence. Now false: `get` is `view`; `query` returns a
+`PipelineQueryPage { items, matched }`, not a `Vec`; `rulings_in_force` and
+`stewardship` were never built and are query presets; the view is
+`{ id, document, admission, status }`, not the seven-field shape below;
+`PipelineQuery` has no `status`, `outcome`, `text_contains` or `instance`
+and has `in_force: Option<bool>`; `semantic` is refused typed until Cut 11;
+"in force when no resolution names it" is the non-recursive form, and the
+landed rule is "no resolution that is itself in force" (Q17 B); `history`
+exists and is missing here. The Cut 9 section is the owner.*
+
+`huginn-mind` owns every derivation; no client re-derives status.
+
+- `get(id) -> Option<PipelineDocumentView>`
+- `query(&PipelineQuery) -> Vec<PipelineDocumentView>`
+- `open_items(campaign) -> PipelineOpenItems`
+- `rulings_in_force(Option<campaign>) -> Vec<PipelineDocumentView>`
+- `stewardship(instance) -> Vec<OrgRepo>`
+
+`PipelineDocumentView` is
+`{ id, kind, document, resolution: Option<(id, PipelineResolution)>, receipt_id, admitted_at, faculty }`,
+its admission fields joined from the receipts naming the document.
+
+`PipelineQuery` keeps its landed field set — `campaign`, `repo`, `cut`, `kinds`,
+`status`, `outcome`, `faculty`, `admitted_after/before`, `text_contains`,
+`limit` ≤ 200 — and gains `instance` and `semantic: Option<{ text, top_k }>`.
+When `semantic` is set the query runs through the index (D5) and the hit ids are
+resolved back through the typed store, so the store stays the truth.
+
+Derived state, never stored, unchanged from the landed design: a document is
+**in force** when no resolution names it; **open items** are unresolved
+questions, findings and follow-ups, in-force cut specs with no report, and cut
+reports with no verdict.
+
+## D5. The index
+
+**Owner:** `huginn-daemon`, through two ports defined in `huginn-mind` so the
+library stays testable without either service:
+
+```
+trait EmbeddingPort { fn embed(&self, texts: &[String]) -> Result<Vec<Vec<f32>>>; }
+trait IndexPort { fn upsert(&self, points: Vec<IndexPoint>) -> Result<()>;
+                  fn search(&self, vector: Vec<f32>, top_k: u32, filter: IndexFilter) -> Result<Vec<IndexHit>>;
+                  fn delete(&self, ids: Vec<String>) -> Result<()>; }
+```
+
+**Adapters.** `QdrantIndex` and `OllamaEmbedding`, both plain `reqwest::blocking`
+against the REST endpoints R3 establishes, ported in shape from the deleted
+`semantic_backend.rs`. That module is the precedent: it confined JSON to one
+xenos-facing boundary and treated Qdrant as "a rebuildable projection rather
+than canonical authority", which is exactly this design's relationship to it.
+
+**Collections.** `huginn_pipeline_documents`, one point per document, vector
+size 1,024 (`qwen3-embedding:0.6b`, R16). Payload `{ instance, campaign, repo,
+kind, doc_id, admitted_at }`, with payload indexes on `instance`, `campaign`,
+`repo` and `kind`. Receipts, identity and provenance are never indexed.
+In-force status is never indexed; clients resolve it through `get`.
+
+**Indexing is at admission, in the same call, but not in the same transaction.**
+The typed commit lands first; the index upsert follows. If the upsert fails the
+admission still succeeded, and the organ records the document id in a
+`pending_index` slot and retries on its next poll. The index is a projection, so
+a stale index is a degraded read, never a lost write. The reverse order would
+let an index failure reject an admitted document.
+
+**Rebuild.** `huginn-daemon --reindex <instance>` drops and rebuilds the
+collection from the typed store. This is the affordance that makes the
+projection disposable, and it is the negative proof that the index is not truth.
+
+## D6. The CultNet surface
+
+*Partly superseded by Cut 9 and Q13 A, 2026-09-16: the `RulingsInForce`
+and `Stewardship` operations are presets of `Query`; there is no `History`
+operation, which Q17 B's obligation requires; the wire types are
+`huginn-mind`'s, carried by the client for types only. The Cut 10 refresh
+is the owner of the surface's shape.*
+
+**Copy Odin's harness (R6, R7).** `huginn-daemon` binds one loopback UDP socket
+from `GAMECULT_IDUNN_CANDIDATE_BIND`, constructs
+`CultMeshRudpDocumentServer::new(socket, sink, snapshot, CultMeshSystemClock::default(), options)`,
+and runs a `poll_once` loop with `signal-hook` handling SIGTERM/SIGINT.
+
+Requests arrive as `DocumentPutRaw` and replies go back as `DocumentPutRaw`,
+the shape Epiphany's permit issuer already uses (R5) and that the document
+server routes natively. Two request documents and two response documents:
+
+| Document | Type id | Payload |
+|---|---|---|
+| request | `huginn.mind_request.v1` | `instance`, `operation: Admit \| Get \| Query \| OpenItems \| RulingsInForce \| Stewardship \| HandOff \| Import`, and the operation's typed argument |
+| response | `huginn.mind_response.v1` | `request_id`, `outcome: Ok(payload) \| Refused(PipelineRefusal)` |
+
+Read operations are also served through `CultMeshRudpSnapshotSource`, so a
+plain CultNet snapshot client can read a mind without speaking the request
+document at all. That is the affordance that keeps the MCP surface swappable.
+
+**Schema publication.** `huginn.mind_request.v1` and `huginn.mind_response.v1`
+are Huginn's contracts and are published from Huginn, not Epiphany. Ruling 1
+covers pipeline *state* schemas, which stay in `schemas/cultnet/`. The organ's
+transport contracts belong to the provider that owns the boundary, which is
+exactly what `schemas/cultnet/README.md:52-56` already says.
+
+**Port.** `rudp://10.77.0.1:17872`, the lower of the two unallocated `178xx`
+ports (R21), with a private candidate range `27880-27887` by analogy with
+Odin's `27872-27879`.
+
+## D7. `eureka-state`
+
+*Partly superseded by Cut 9 and Q13 A, 2026-09-16: the `query` output is a
+page with `matched`; the `rulings_in_force` and `stewardship` tool rows are
+presets; there is no `history` tool, without which the Q17 affordance
+stops at the crate boundary; "types are the `epiphany-pipeline` types" is
+false for the view and query types, which are `huginn-mind`'s. The Cut 13
+refresh is the owner.*
+
+A stdio MCP server that is a thin CultNet client. It owns no state, no cache and
+no fallback.
+
+| Tool | Input | Output |
+|---|---|---|
+| `admit` | `{ instance, provenance, documents }` | `PipelineAdmissionOutcome` |
+| `get` | `{ instance, id }` | `{ found, view }` |
+| `query` | `{ instance, query: PipelineQuery }` | `{ views }` |
+| `open_items` | `{ instance, campaign }` | `PipelineOpenItems` |
+| `rulings_in_force` | `{ instance, campaign? }` | `{ views }` |
+| `stewardship` | `{ instance }` | `{ repos }` |
+| `whoami` | `{}` | `{ instance, organ_endpoint, reachable }` |
+
+Input and output types are the `epiphany-pipeline` types deriving `JsonSchema`,
+returned as `Json<T>`, so tool schemas equal the published schemas (P4).
+Refusals are typed outcomes, not JSON-RPC errors; malformed input is
+`invalid_params`.
+
+**No `repo_root` anywhere.** The old design threaded it through every tool
+because the store was a file in a repo. The mind is now addressed by instance.
+
+**Configuration.** Two environment variables, `EUREKA_ORGAN_ENDPOINT` (default
+`rudp://127.0.0.1:17872`) and `EUREKA_INSTANCE`. No config file.
+
+**Unreachable organ (target, "Availability is honest").** Every tool returns
+`{ refused: Unavailable { detail } }` naming the endpoint and the failure. The
+server never spools, never caches, never degrades to a local file. `whoami`
+exists so an agent can check reachability in one call before starting a
+campaign, and the Rehydrate brief calls it first.
+
+**Registration is the operator's, not Hands'.** After Hands reports the binary
+path, the operator runs:
+
+```
+claude mcp add --scope user --transport stdio eureka-state --env EUREKA_INSTANCE=<slug> --env EUREKA_ORGAN_ENDPOINT=rudp://127.0.0.1:17872 -- C:\Users\Meta\.eureka\bin\eureka-state.exe
+```
+
+Unprobed: the exact `--env` spelling on CLI 2.1.268. Hands confirms it from
+`claude mcp add --help` and reports it; the operator runs the confirmed line.
+
+## D8. The trust boundary
+
+**State it plainly: on a single-operator LAN there is no authentication here,
+and the design does not pretend otherwise.**
+
+The organ binds loopback on Yggdrasil and is reached from the workstation over
+the existing supervised SSH tunnel (R20). Anything that can open that socket can
+declare any instance. `ForeignInstance` is therefore a **collision and
+attribution** control — it stops instance A writing into B's mind by mistake,
+and keeps history attributable — not an access control.
+
+This matters because the alternative is available and already used in this
+codebase: `cultnet-rs` ships `ServiceIdentitySigner`, `enroll_service_identity_at`
+and trust anchors, and Epiphany's permit path signs with them (R4). Enrolling a
+per-instance identity would make `ForeignInstance` enforceable. It would also
+mean distributing and rotating a key to every workstation that runs Claude Code.
+
+**This is a real fork; see Q6.** Do not let Hands invent a credential system.
+
+## Cut 4. Delete the repo-store, lease and git layers
+
+- **Repo/branch:** Epiphany `codex/eureka-pipeline-state`. No dependencies.
+- **First:** confirm `git status` is clean at `5fb4eb22`.
+
+**Deletes first.**
+
+| Path | Lines | What dies |
+|---|---:|---|
+| `epiphany-core/src/pipeline_store.rs` | 1,251 | **The whole file.** See below. |
+| `epiphany-core/src/pipeline_documents.rs:334-349` | 16 | `PipelineWriterHolder` and its `Bounded` impl |
+| `epiphany-core/src/pipeline_documents.rs:492-497` | 6 | `EpiphanyPipelineWriterHolder` wrapper |
+| `epiphany-core/src/pipeline_documents.rs:602-617` | 16 | `validate_pipeline_writes`, the commit-profile validator |
+| `epiphany-core/src/lib.rs:21` | 1 | `mod pipeline_store;` |
+| `epiphany-core/src/lib.rs:132` | 1 | `pub use pipeline_store::{...};` |
+| `.gitattributes:1` | 1 | `/.epiphany/pipeline/pipeline.cc binary` |
+| `.gitignore:37` | 1 | `/.epiphany/pipeline/*.lock` |
+
+**Yes, `pipeline_store.rs` dies whole.** Every one of its parts is a repo-store
+part:
+
+- `PIPELINE_COMMIT_STORE` (`:76-81`) — the commit profile, dead with Cut 5.
+- `pipeline_cache` (`:87-120`) — the epoch/foreign-type opener. Its *logic*
+  survives, but it is re-authored against redb in Cut 8; it is not moved,
+  because its signature takes a `RuntimeSpineBackingStore`.
+- `git`, `git_line`, `committed_line` (`:125-162`) — the committed-blob checks.
+- `require_repo_root`, `main_work_tree`, `common_dir_of` (`:165-201`) — ruling
+  10's resolution.
+- `PipelineStore` (`:204-226`) — the read path, now CultNet.
+- `PipelineWriter`, `attach`, `require_branch`, `Drop` (`:230-331`) — the lease
+  and branch binding.
+- `live_holder`, `current_holder`, `holder_cache`, `read/write_writer_holder`
+  (`:334-387`) — the holder record.
+- `mod tests` (`:389-1251`, 863 lines) — 15 tests, all of which pin a deleted
+  rule. The four that pin *document* rules — `every_pipeline_kind_round_trips_through_named_slot_zero`,
+  `bounds_refuse_in_utf8_bytes`, `repo_fields_must_be_org_slash_repo`,
+  `keys_are_derived_and_mismatch_refuses`, `composed_keys_cannot_collide`,
+  `parent_ids_are_parsed_strictly`, `resolution_subject_is_a_full_id_of_its_kind`
+  — **move to Cut 6**, not deleted. They are listed here as moves so the count
+  is honest.
+
+**Keeps.**
+
+- Every document kind, value type, bound alias, format rule and key derivation
+  in `pipeline_documents.rs`.
+- `validate_pipeline_write_envelope` (`:621-645`), bounds plus key recomputation.
+- All ten `schemas/cultnet/epiphany.pipeline.*.v1.schema.json` files and their
+  `index.json` entries. Ruling 1 keeps them; Cut 6 adds three more.
+- `.gitattributes:2`, `/schemas/cultnet/epiphany.pipeline.*.schema.json text eol=lf`.
+- `process_observation::capture_process_instance` — other callers at
+  `bin/epiphany-mvp-coordinator.rs:257,1703` and `bin/epiphany-swarm.rs:211,723`.
+- `repository_body_observer::repository_git_command` — other callers at
+  `repository_body_observer.rs:734,745,1041,1054,1063,1077`.
+- `fs2` in `epiphany-core/Cargo.toml` — still used by
+  `packaged_release/construction.rs`.
+- `schemars` — Q5 keeps it; Cut 6 needs it.
+
+**Per-file changes.** `pipeline_documents.rs:19` drops
+`use crate::pipeline_store::PipelineRefusal;` and gains a local `PipelineRefusal`
+holding only `FieldBound`, `InvalidFormat` and `InvalidIdentity`, with its
+`Display` and `Error` impls carried from `pipeline_store.rs:57-63`. This is a
+temporary home; Cut 6 moves the whole module out.
+
+**Authority map.**
+
+- **Owner:** nothing. This cut removes an owner and installs no replacement; the
+  organ becomes the owner in Cut 8.
+- **Inputs / outputs:** none.
+- **Derived state:** none. The holder file is gone.
+- **Forbidden writers:** after this cut, no Epiphany code may open a pipeline
+  store, take a lease, or read git for pipeline purposes.
+- **Shared paths:** none remain.
+- **Deletion line:** the table above.
+
+**Verification.**
+
+- **Builds:** `cargo check -p epiphany-core --lib --tests`, then
+  `cargo check -p epiphany-release-bundle --bin epiphany-state`. One at a time,
+  `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex`.
+- **Tests:** `cargo test -p epiphany-core --lib`. Expect 180 − 15 = **165**, and
+  the report states the exact number. The surviving document tests are re-added
+  in Cut 6, so this cut legitimately reduces coverage; Soul checks that only the
+  named 15 disappeared.
+- **Negative greps**, all empty:
+  - `rg -n "PipelineWriter|PipelineStore|WriterLeaseHeld|main_work_tree|check-attr|git-common-dir" epiphany-core/src`
+  - `rg -n "\.epiphany/pipeline" -- . ':!notes'`
+  - `rg -n "pipeline" .gitattributes .gitignore` returns only the schema
+    `eol=lf` line.
+- **Operator:** none.
+
+**Subtraction ledger:** −1,291 lines, +about 20 (the reduced refusal enum). No
+dependency, format or target change.
+
+## Cut 5. Collapse `TypedCommitStore` back into the Mind commit owner
+
+- **Repo/branch:** Epiphany, same branch. Depends on Cut 4.
+- **Why this cut exists.** Cut 2 generalised the commit owner so a *second*
+  profile could use it. Cut 4 deletes that second profile, and D3 puts the
+  organ's receipts in another repo. `TypedCommitStore` is now a one-implementation
+  abstraction surviving only because it exists — a named STOP condition in
+  `~/.claude/CLAUDE.md`. Honest accounting: **Cut 2's generalisation did not pay
+  off**, and leaving it in place to avoid admitting that is the failure mode the
+  doctrine warns about.
+- **Why it is a separate cut.** It is pure subtraction on the Mind path, and
+  Soul must be able to falsify "Mind behaviour is unchanged" without pipeline
+  code in the diff.
+
+**Deletes first.**
+
+| Path | Lines | What dies |
+|---|---:|---|
+| `reasoning_context.rs:1590-1597` | 8 | `struct TypedCommitStore` |
+| `reasoning_context.rs:1599-1604` | 6 | `fn validate_mind_writes` (inlined) |
+| `reasoning_context.rs:1606-1611` | 6 | `const MIND_COMMIT_STORE` |
+| `reasoning_context.rs:1614` | 1 | the `store: &TypedCommitStore` parameter |
+| `reasoning_context.rs:1435,1466,1516,1540,1566` | 5 | the `&MIND_COMMIT_STORE` argument at each of the five wrappers |
+| `reasoning_context.rs:2521-2530`, `:2599-2610` | ~20 | `TEST_COMMIT_STORE`, `NOW_REFUSING` and the profile-parameterised test harness at `:2540` |
+
+**Per-file changes.** In `commit_authorized_mind_mutation`
+(`reasoning_context.rs:1613-1622`), re-inline the three choices the profile
+carried: `runtime_spine_backing_store` at `:1641`,
+`crate::runtime_spine::open_runtime_spine_cache` at `:1642`,
+`validate_mind_write_envelope` at `:1644`, and the literal `"epiphany-mind"` at
+`:1665` and `:1669`.
+
+**Keeps — and this is the part that must not be lost.** Cut 2's *tests* proved
+real rules and stay, re-expressed against the concrete owner:
+
+- the Mind epoch refusal is pinned (mutation M2b dropped the check and failed);
+- validation-before-replay is pinned;
+- the owner reads and writes one store, never two.
+
+Do **not** delete a verifier to make this cut smaller. AGENTS.md's Verification
+Guardrails: preserve the claim in the smallest owning surface.
+
+**Authority map.**
+
+- **Owner:** `commit_authorized_mind_mutation`, still the only *production* code
+  that builds receipts, replays, and runs batch CAS — now concretely, for Mind
+  only. One test plants a receipt on purpose, which is how the replay rule is
+  pinned; that is the second construction site and it is deliberate.
+- **Inputs:** authority, invariant owner, strong reads, writes, companions, time.
+- **Outputs:** `EpiphanyMindCommitOutcome`.
+- **Derived state:** `store_id` inside the receipt's document versions, now the
+  constant `"epiphany-mind"`.
+- **Forbidden writers:** any new function building an `EpiphanyMindCommitReceipt`
+  or calling `compare_and_swap_batch` with a receipt.
+- **Shared paths:** the five Mind wrappers. There is no sixth.
+- **Deletion line:** the table above.
+
+**Verification.**
+
+- **Tests:** `cargo test -p epiphany-core --lib` passes at the Cut 4 count.
+  `disjoint_mind_mutations_merge_and_same_identity_conflicts`
+  (`reasoning_context.rs:2482`) pins Mind CAS and replay unchanged.
+- **Behaviour-unchanged proof, per the Hands brief:** a Mind receipt id captured
+  by running the pin test **at base `5fb4eb22`** must equal the id after this
+  cut. A value captured from the new code is not evidence.
+- **Mutations:** drop the epoch check from the opener; make the validator a
+  no-op; make the owner read one store and write another. Each must fail its
+  named test.
+- **Negative greps:** `rg -n "TypedCommitStore|MIND_COMMIT_STORE" epiphany-core/src`
+  is empty.
+
+**Subtraction ledger:** −46 lines, +about 8 re-inlined. No dependency change.
+
+**If Soul or Hands finds a live second consumer this cut is wrong** — stop and
+report rather than deleting. The map asserts there is none; `rg` is the check.
+
+## Cut 6. Extract `epiphany-pipeline`
+
+- **Repo/branch:** Epiphany, same branch. Depends on Cut 4.
+
+**Adds: package `epiphany-pipeline/`.**
+
+- `Cargo.toml`: `autobins = false`, `license-file = "../LICENSE"`, dependencies
+  `anyhow`, `chrono`, `cultcache-rs` (pinned `a0813c6`), `rmp-serde`, `schemars = "1"`,
+  `serde`. Dev-dependencies `serde_json`, `tempfile`.
+- `src/lib.rs`: the whole of `pipeline_documents.rs` (623 lines after Cut 4),
+  moved verbatim apart from the module doc's cut-map references, plus the
+  reduced `PipelineRefusal`.
+- The three new kinds from D2, their keys, and their entries in the
+  `pipeline_kinds!` macro.
+
+**Moves.**
+
+- `epiphany-core/src/pipeline_documents.rs` → `epiphany-pipeline/src/lib.rs`.
+- The seven document tests named in Cut 4 → `epiphany-pipeline/src/lib.rs`
+  tests, minus their git-repo scaffolding (`campaign_repo`, `git_ok`, `attach`,
+  `holder`), which has nothing left to set up.
+- `pipeline_published_schemas_match_derivation` (`pipeline_store.rs:1172-1203`)
+  → `epiphany-pipeline`, still reading `../schemas/cultnet` via
+  `env!("CARGO_MANIFEST_DIR")`.
+
+**Deletes.** `epiphany-core/src/lib.rs:20` (`mod pipeline_documents;`) and
+`:131` (`pub use pipeline_documents::*;`). `epiphany-core` then has no pipeline
+surface at all, which is correct: its consumption is campaign two.
+
+**Per-file changes.**
+
+- Root `Cargo.toml:2-8`: add `"epiphany-pipeline"` to workspace members. It is
+  **not** added to `[dependencies]`, and no `[[bin]]` references it.
+- `schemas/cultnet/index.json`: three new entries in the existing shape
+  (`kind: document_payload`, `wireContracts: ["cultnet.schema.v0"]`) for
+  `instance`, `stewardship` and `hand_off`.
+- Three new `schemas/cultnet/epiphany.pipeline.<kind>.v1.schema.json` files,
+  derived, never hand-written.
+- `schemas/cultnet/README.md:29-31`: the Main Families entry currently says
+  pipeline state is "stored per repo at `.epiphany/pipeline/pipeline.cc`".
+  Replace with: stored in an instance's mind, owned by the Huginn memory organ;
+  name the three added kinds.
+- `schemas/cultnet/README.md:33-41`: the wire note says these contracts "cross to
+  Eureka MCP clients and the voidbot projection". Replace the voidbot half: they
+  cross to the Huginn organ and its `eureka-state` client. Keep the `[value]`
+  payload sentence, the derivation sentence and the Q2 evolution sentence.
+
+**Authority map.**
+
+- **Owner:** `epiphany-pipeline`, for document shape, bounds, formats, keys and
+  derived schemas.
+- **Inputs:** none; it is a pure type library.
+- **Outputs:** typed documents, derived JSON schemas, `pipeline_key`.
+- **Derived state:** the published schema files.
+- **Forbidden writers:** nothing in this package may open a store, spawn a
+  process, or reach a network. It has no `std::process`, no socket and no
+  backing-store dependency beyond `cultcache-rs` types.
+- **Shared paths:** `huginn-mind` and `eureka-state`, both by git rev.
+- **Deletion line:** `epiphany-core`'s two pipeline modules and their exports.
+
+**Verification.**
+
+- **Builds:** `cargo check -p epiphany-pipeline --lib --tests`, then
+  `cargo check -p epiphany-core --lib --tests`.
+- **Tests:** `cargo test -p epiphany-pipeline --lib`. The nine moved tests
+  (seven plus the derivation test plus `decode_refuses_an_envelope_of_a_foreign_type`,
+  which Cut 4's fix batch added after this was written), plus four new ones:
+  `instance_stewardship_and_hand_off_round_trip`,
+  `stewardship_key_escapes_the_repo_slash`, `hand_off_names_both_instances`, and
+  `keys_read_back_as_ids_of_their_kind`. Thirteen in total.
+- **Key⇄id round-tripping is the test shape this cut was missing.** The first
+  three key tests assert key strings and never parse them back, which is why
+  Soul found an unvalidated instance segment and a reader that refused the new
+  root kind. `keys_read_back_as_ids_of_their_kind` walks every sample, keys it
+  and parses it back. Resolution is the one kind whose key is not an id of
+  itself; the test states that rather than skipping it.
+- **The derivation test is the schema gate.** On mismatch it writes the derived
+  file to a per-run directory under `std::env::temp_dir()` named by pid and
+  nanos, and fails naming the path. There is no bless flag, and no directory is
+  shared between runs. Thirteen schemas must now match.
+- **Mutations:** add a variant to one value type's enum without regenerating its
+  schema — the derivation test fails. Change `<Org_Repo>` escaping to keep the
+  slash — the key test fails. (A *field* cannot be added to those macro-built
+  value types without failing the whole target, which would prove nothing about
+  the derivation test in particular; the variant changes exactly one derived
+  schema.)
+- **Negative greps:**
+  - `rg -n "serde_json::Value|Vec<u8>" epiphany-pipeline/src` empty
+    (`serde_json` is a dev-dependency only).
+  - `rg -n "std::process|UdpSocket|BackingStore" epiphany-pipeline/src` empty.
+    *Corrected (21): `process::Command|UdpSocket|BackingStore`; the per-run
+    test directory reads `std::process::id()` under `#[cfg(test)]`.*
+  - `rg -n "pipeline" epiphany-core/src` empty. *Corrected (15): the narrower
+    grep over the type names.*
+- **Operator:** none.
+
+**Subtraction ledger:** Epiphany-core −623 lines; new package +about 700
+including the three kinds, +about 400 derived JSON. Net repo change is small;
+the point is the dependency boundary, not the line count.
+
+## Cut 6b. The key grammar
+
+Anchor: `epiphany-pipeline/src/lib.rs` at `4a654351`, 1,508 lines. Lands
+**before** Cut 6c and does not absorb it. Spec by Imagination 2026-09-16;
+in Hands.
+
+### Why a grammar and not a fourth fix
+
+Three passes each made one composition site injective and left the site above
+it ambiguous. The key space had **four** shapes and no single reader: `<slug>`
+for campaign and instance (two early returns at `:693-700`), `<root>:<kind>:<local>`
+for ten kinds (`KeyParts::key`, `:671-683`), `resolution:<subject id>` (a third
+early return at `:703-707`), and recursively `resolution:resolution:…`. Three of
+the four are written by an early `return` that never reaches the composer, so
+the reader `pipeline_id` (`:545-586`) needs a `match kind` with a root arm and a
+recursive arm to undo them, plus `declared_kind` (`:529-538`) to guess the kind
+of a string that does not carry one. Every confirmed defect lives in one of
+those exceptions. A fourth pass would guard an arm that should not exist.
+
+### The grammar
+
+```
+key      ::= root ":" kind ":" local
+root     ::= slug
+kind     ::= one of the thirteen `PipelineKind` names, literally
+local    ::= part ( "." part )*
+part     ::= label
+slug     ::= label ( "." label )*            ; total <= 64 bytes
+label    ::= [A-Za-z0-9_-]{1,64}
+```
+
+Two byte facts already in the source: `label_text` (`:118-126`) admits neither
+`.` nor `:`; `dotted_text` (`:131-139`) is `label ("." label)*` bounded at 64
+bytes with no empty parts. Two rules the cut adds:
+
+- **R1. Every key has exactly three segments.** Roots included.
+- **R2. No local part is a `Slug`.** A `Slug` or `OrgRepo` entering a local is
+  escaped to one label first. So `local.split('.')` recovers its parts exactly
+  at any arity.
+
+Unambiguity then follows from the alphabet, not from checks: `:` is in no part,
+so segment recovery is forced; the kind is a literal segment, so nothing is
+inferred; `.` is in no part, so local recovery is exact. `declared_kind` has no
+successor because there is nothing left to guess.
+
+| Kind | Key |
+|---|---|
+| campaign `c` | `c:campaign:self` |
+| instance `y` | `y:instance:self` |
+| resolution of `c:question:Q1` | `c:resolution:question.Q1` |
+| resolution of campaign `c` | `c:resolution:campaign.self` |
+| resolution of that resolution | `c:resolution:resolution.question.Q1` |
+| hand-off | `<from>:hand_off:<to escaped>.<repo escaped>.<date>` |
+| stewardship | `<instance>:stewardship:<repo escaped>` |
+| the nine others | `<campaign>:<kind>:<local>`, unchanged |
+
+Roots take the reserved constant `self` as local; a reader recovers a root's
+identity from segment 1 and never consults it. A resolution is keyed inside its
+subject's root with the subject's kind and local as its own local. Nesting is
+bounded by construction, not by a guard: a nested local is
+`11 * (depth - 1) + len(subject local)` bytes against the 64-byte bound, so a
+one-byte subject local nests six deep and `question.Q1` five, and
+`pipeline_id` does not recurse. *(Corrected after Soul F1: this first said
+"at most five"; the bound is the local, and the depth follows from the subject.)*
+
+**The one escape, generalised.** `repo_segment` (`:619-636`, `_`→`__`,
+`/`→`_-`, `.`→`_d`, injectivity verified by Soul) becomes `key_segment` and
+gains one caller: `hand_off.to_instance`, the only place a raw `Slug` reached a
+local (`:720`) and exactly Soul's pass-2 collision pair, closed from the other
+side. Its output is not assumed to be a label; `Game Cult/x` escapes and is
+refused downstream by `label_text`, which is already tested.
+
+**Where the total length bound lives:** in one function,
+`local<const N: usize>(field, parts: [&str; N])`, which runs every part through
+`label_text` and the join through one 64-byte `bound`. It is not a type fact and
+is not dressed as one; it is pinned by M4. Today the total check (`:681`) is the
+second of two `dotted_text` calls on overlapping data, which is why deleting it
+was invisible to every sample.
+
+**Where tail arity lives:** `local` takes an array, not a chainable builder, so
+a conditional tail cannot be written as a quiet extra chain call. That does
+*not* prove one arm emits one arity, and after this cut arity is no longer
+load-bearing: under R2 a local reads back at any arity. The property the doc
+comment at `:663-670` defended is retired, and the invariant that replaces it,
+"no local part carries the separator", has a runtime mutation (M6).
+
+### Deletes first
+
+| Path | Lines | What dies |
+|---|---:|---|
+| `lib.rs:526-538` | 13 | `declared_kind`. Defect 2's hardcoded `Campaign` dies with the function. |
+| `lib.rs:550-570` | 21 | `pipeline_id`'s `match kind`: the root arm, the resolution arm and its recursion, and the comment defending them. |
+| `lib.rs:638-684` | 47 | `KeyParts`, its constructors and `key`. Replaced by a free function, not renamed. |
+| `lib.rs:692-707` | 16 | `pipeline_key`'s three early `return`s. The cut is not done until they are gone. |
+
+97 lines. No file, schema file or type dies. The deletes go **before** `local`
+is written; if they coexist with the new composer at any commit the cut has
+produced a fourth shape.
+
+### Keeps, moves, adds
+
+Keeps: every kind, type id, field, bound and format type; no `value_types!` or
+`pipeline_kinds!` entry moves; `PipelineRef` and its `Bounded` impl
+(`:365-370`) unchanged. `repo_segment` → `key_segment`, same body.
+`parent_local` (`:589-600`) unchanged. `parent_cut` (`:605-617`) keeps both
+rules; `rsplit_once('.')` becomes an index into the split, net −4. The
+outcome-invariance assertion in `keys_are_derived_and_mismatch_refuses`
+(`:1077-1084`) and the `!key.starts_with("<campaign>:")` assertion in
+`instance_stewardship_and_hand_off_round_trip` (`:1311-1315`) stay true.
+
+Adds: `const ROOT_LOCAL: &str = "self"` and `fn local`. `pipeline_id` is
+**replaced whole**, one shape with no `match kind`: exactly three segments, kind
+segment equals `kind.name()`, root through `dotted_text`, every local part
+through `label_text`, local bounded whole, returns `(root, local)`.
+
+### Per-file changes, `epiphany-pipeline/src/lib.rs`
+
+| Line | Change |
+|---|---|
+| `:12-13` | Module doc states the grammar in four lines. |
+| `:117` | `Label`'s doc comment retargets `KeyParts::key` to `local`. |
+| `:526-538` | Delete `declared_kind`. |
+| `:540-586` | Replace `pipeline_id` whole. |
+| `:605-617` | `parent_cut`: index into `local.split('.')`. |
+| `:619-636` | Rename `repo_segment` → `key_segment`; generalise its doc comment. |
+| `:638-684` | Delete `KeyParts`; add `local` and `ROOT_LOCAL`. |
+| `:687-752` | `pipeline_key`: thirteen arms, one exit. Campaign/Instance emit `local(field, [ROOT_LOCAL])`. Resolution parses its subject id once, then `local(field, [subject_kind.name(), subject_local_parts…])`. `HandOff` gains `key_segment` on `to_instance`. |
+| `:780-781`, `:824-934` | Thirteen expected sample keys move. |
+| `:1088-1166` | `composed_keys_cannot_collide`: the probe built `KeyParts` directly and moves to `local`; the hand-off pair keeps its conclusion with a dotted receiver now escaping to `thought-cage_dGameCult`. |
+| `:1256-1291` | `a_resolution_is_named_by_the_key_it_has`: `{CAMPAIGN}:resolution:R8` becomes well-formed grammar and leaves the refused list; reachability is admission's rule. Said in the doc comment. |
+| `:1329-1363` | `keys_read_back_as_ids_of_their_kind`: **body unchanged.** |
+| `:1419-1455` | `hand_off_names_both_instances`: add a dotted-receiver assertion. |
+
+`schemas/cultnet/`: **no file changes.** `notes/eureka-pipeline-state-cut.md`:
+the Keys table above is marked superseded and the scar at the old `:483-488`
+stays.
+
+### Authority map
+
+- **Owner:** `pipeline_key` (`:687`), through the single composer `local`. No
+  arm has a path to a key the composer never saw.
+- **Inputs:** the document's own fields. No clock, store, registry or counter.
+- **Outputs:** one `String`, or a `PipelineRefusal` naming the field.
+- **Derived state:** the key is derived, never stored. `pipeline_id` is the key
+  read backwards and holds no state. `declared_kind`'s inference is deleted.
+- **Forbidden writers:** no arm of `pipeline_key` may `return` a key; no local
+  part may be a raw `Slug`, `Short` or `OrgRepo` (a validated `Date` is
+  `[0-9-]{10}`, already a label, and passes raw; Soul F6 corrected the first
+  wording, which claimed every non-label value was escaped); nothing may infer
+  a kind from an id's shape; reachability ("does this document exist", "may this
+  kind be resolved") stays with admission in `huginn-mind` per the resolution
+  matrix above. Cross-field rules stay out of `Bounded`.
+- **Shared paths:** `pipeline_key`, `pipeline_id`, `PipelineRef::validate`
+  (`:365-370`), `validate_pipeline_write_envelope` (`:759-772`). Four paths,
+  one grammar, no fifth.
+- **Deletion line:** the 97 lines above, before `local` is written.
+
+### Verification
+
+Builds: `cargo check -p epiphany-pipeline --lib --tests`, then
+`cargo check -p epiphany-core --lib --tests` (untouched; its only mention of
+the package is a doc comment at `runtime_spine.rs:8754-8758`).
+`CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex`, path-list baseline.
+
+Tests: `cargo test -p epiphany-pipeline --lib`, thirteen existing plus six.
+
+| Test | Rule it pins |
+|---|---|
+| `every_key_has_exactly_three_segments` | R1, over every sample plus a nested resolution: three segments, segment 1 a `Slug`, segment 2 in `PipelineKind::ALL` by name, each local part a `Label`. Also asserts a `Target` whose campaign is `Slug("a:b")` is refused by the `pub` `pipeline_key` (M5). |
+| `roots_of_different_kinds_do_not_share_a_key` | Defect 1: campaign `yggdrasil` and instance `yggdrasil`, `assert_ne!`. |
+| `a_resolution_names_its_subjects_kind` | Defect 2: resolutions of `c:question:Q1` and `c:ruling:Q1` key differently, as do resolutions of campaign `c` and instance `c`, and each reads back recovering its subject kind. |
+| `a_resolution_of_a_resolution_reads_back` | Defect 3: a resolution whose subject is a resolution validates, keys, reads back; five nestings key, six refuse on the local bound with `field == "resolution.key"`. |
+| `a_composed_local_is_bounded_whole` | The total bound: a hand-off whose escaped receiver is 60 label bytes composes about 80 and is refused `InvalidFormat { field: "hand_off.key" }`. |
+| `no_local_part_carries_the_separator` | R2: `local("probe", ["a.b"])` and `local("probe", ["a", "b.c"])` both refused; a hand-off with a dotted `to_instance` keys to an escaped local. |
+
+Unchanged in name and assertion: `keys_read_back_as_ids_of_their_kind`,
+`keys_are_derived_and_mismatch_refuses`,
+`every_pipeline_kind_round_trips_through_named_slot_zero`,
+`pipeline_published_schemas_match_derivation`,
+`decode_refuses_an_envelope_of_a_foreign_type`, `bounds_refuse_in_utf8_bytes`,
+`repo_fields_must_be_org_slash_repo`, `parent_ids_are_parsed_strictly`,
+`resolution_subject_is_a_full_id_of_its_kind`.
+
+Negative checks: `rg -n "declared_kind|KeyParts" epiphany-pipeline/src` empty;
+no `return Ok(` inside `pipeline_key`; `rg -n "match kind"` empty;
+`git diff --stat 4a654351 -- schemas/cultnet/` **empty**;
+`rg -n "to_instance.0.clone\(\)"` empty. If Hands finds any consumer of a
+pipeline key outside `epiphany-pipeline/src/lib.rs`, the cut is wrong; stop.
+
+### Mutations
+
+Committed as `tools/eureka-cut6b-mutations.ps1` with byte-exact UTF-8 I/O,
+anchors that must match exactly once, and **M0, a no-op control** that rewrites
+the file through the same path and must leave every test green. A redesign's
+mutations restore the old permissiveness rather than break a check.
+
+| # | Survivor | Mutation, exactly | Killed by |
+|---|---|---|---|
+| M1 | Roots share a namespace | `Campaign` arm returns `Ok(value.slug.0.clone())` | `roots_of_different_kinds_do_not_share_a_key`; collaterally the three-segment test and the read-back test |
+| M2 | Resolution key drops the subject kind | `Resolution` arm omits `subject_kind.name()` from the parts | `a_resolution_names_its_subjects_kind` (both pairs key `c:resolution:Q1`) |
+| M3 | Nested resolution unnameable | `Resolution` arm returns `format!("resolution:{}", subject.id)` | `a_resolution_of_a_resolution_reads_back`; the three-segment test |
+| M4 | Total bound unpinned | In `local`, delete the `bound` on the join, keep per-part `label_text` | `a_composed_local_is_bounded_whole` |
+| M5 | Root check unpinned | In `pipeline_key`, drop `dotted_text` on the root | the refusal assertion in `every_key_has_exactly_three_segments` |
+| M6 | Head may carry a dot | In `local`, `dotted_text` on `parts[0]` instead of `label_text` | `no_local_part_carries_the_separator` |
+
+M6's stated limit: the array type is a compile fact with no runtime mutation,
+and one-arm-one-arity is not proven and no longer needs to be.
+
+### Ordering against Cut 6c
+
+Cut 6c's central keep ("no key moves") is false after this cut, its retyping of
+`ResolutionOutcome`'s referents to `PipelineRef` rests on the `pipeline_id`
+this cut replaces whole, and this cut is the smaller diff in the shared sample
+block. So 6b lands first, and Imagination reissues 6c against the landed
+grammar with three edits: re-anchor by content (everything from `:526` shifts
+by about −60 lines); replace "no key moves" with "keys moved in 6b and are
+settled; 6c moves none further, checked by `git diff -- schemas/cultnet/`
+naming exactly six files"; and add one fixture the new grammar makes available,
+a `Superseded` entry naming a resolution (`c:resolution:question.Q1`).
+
+### Subtraction estimate
+
+−97 source, +38 outside tests, +110 tests; net −59 outside tests. Zero schema
+files, types, kinds, dependencies, targets, formats or epoch. **Every key
+moves**, which is the cut's whole cost and is free exactly once: nothing reads
+these keys yet. Once `huginn-mind` reads them, the same change is a
+stored-document re-key.
+
+## Cut 6c. The Ghostlight shapes
+
+- **Repo/branch:** Epiphany `codex/eureka-pipeline-state`. Depends on Cut 6b
+  (landed at `1bddd2ac`, mutation suite at `95ee551a`) and its fix batch.
+  Blocks Cut 8. Lands before Cut 8 (ruling C) and is the last cut inside
+  Epiphany before the pause.
+- **Anchors.** Every `file:line` below is against `epiphany-pipeline/src/lib.rs`
+  at `95ee551a`, 1,608 lines, twenty tests, re-found by content after the key
+  grammar shifted everything from the old `:526` down. The 6b fix batch lands
+  on `lib.rs` before Hands starts, so **re-anchor by content again**: every
+  anchor is a `struct`, `impl`, `fn` or sample opener that greps cleanly.
+- **Reissued** 2026-09-16 by Imagination against the landed grammar. Three
+  edits from the first issue: anchors re-found; the Keeps claim about keys
+  rewritten; one fixture added that only the new grammar makes available, a
+  `Superseded` entry naming a resolution by the key it has. Deletes, adds,
+  `Promise`, the two unit enums, `StructuralDelta`, M17/M19/M20/M21, the
+  authority map and the subtraction estimate carry over; M16 and M18 keep
+  their rule and gain sharper forgeries; M22 is new.
+
+**Why this cut exists, and why now.** Ghostlight's independently run campaign
+(D9) named six pains. Four were already built: finding identity, the ledger
+derivation, cut status and the direction of the supersession relation are
+covered by keys, joins and `PipelineResolution` as they stand. What is left is
+one genuine hole (promises), two fields wearing one shape (ruling authority,
+finding origin), and four retypings that are breaking, not additive. Under
+ruling 8 a retyping costs an epoch bump the moment a pinned reader exists.
+Nothing reads these schemas today: a grep for `SubtractionEstimate`,
+`MutationRecord`, `ResolutionOutcome`, `VerdictClaim`, `StructuralDelta` and
+`subtraction_estimate` over Epiphany finds `lib.rs`, the four schema files
+that embed them, and one prose mention in this map; over `F:\Projects\Huginn`
+and the Eureka skill checkout it finds nothing (source read). A whole-drive
+search timed out, so any other tree is unchecked. Cut 8 pins a git rev and
+closes the window. **The four retypings cost nothing today and an epoch
+tomorrow.**
+
+**Rulings carried in:** A, Soul measures every promise and `Unproven` carries
+the ones it could not reach; B, `Fixed { commit: Sha }` is admitted with its
+referent outside the document set; C, this lands before Cut 8.
+Multi-supersession is `Vec<PipelineRef>[8]`, cardinality being admission's
+(Q10 asked against Cut 8). Q11 A: nesting stays. Q12: `OrgRepo` untouched; the
+tightening is its own commit and is not folded in. No kind widens, so
+`epiphany.pipeline.epoch.v1` holds. **Zero new kinds.**
+
+### Deletes first
+
+| Path | Lines | What dies |
+|---|---:|---|
+| `lib.rs:290-294` | 5 | `SubtractionEstimate` and the two-line comment on its list default. Its consumer becomes `StructuralDelta`. |
+| `lib.rs:388-396` | 9 | `impl Bounded for ResolutionOutcome`. Replaced whole, not patched: every arm changes referent type, and a patched impl is how a length-only check survives. |
+| `lib.rs:826-828` | 3 | The cut-spec sample's `SubtractionEstimate { … }` literal. |
+| `lib.rs:296` | 1 | `MutationRecord`'s `mutation: Line` field, rewritten in place as `location`/`before`/`after`. |
+
+The comment at `:298-299` names the dead type and is reworded to stand alone.
+No file or schema file dies; `index.json` is untouched because no kind is
+added and no type id renamed. Deletes go before any field is added: if
+`SubtractionEstimate` and `estimate: StructuralDelta` coexist at any commit,
+the cut has two estimate shapes.
+
+### Keeps
+
+- **All thirteen kinds, `pipeline_key`, `pipeline_id`, `local`, `key_segment`
+  and the epoch.** Keys moved in Cut 6b and are settled; this cut moves none
+  further, because it adds, retypes or removes no field a key is derived from.
+  The check is mechanical: `git diff --stat <base> -- schemas/cultnet/` at the
+  end names exactly the six regenerated schema files. `index.json` carries no
+  hashes (its entries are id, kind, wire contracts, version, type, title and
+  path, and the derivation test asserts that shape), so it is byte-identical.
+- **`PipelineRef` and its `Bounded` impl (`:363-376`).** It becomes
+  load-bearing for four more referents. It already parses the id against its
+  declared kind through `pipeline_id`, whose kind-segment check (`:553-555`)
+  refuses a mismatch; that is why retyping 1 is cheap and what the new fixture
+  rides on.
+- **The whole key suite**, `keys_read_back_as_ids_of_their_kind` included. All
+  twenty tests stay unchanged in name and assertion. They are blind to this
+  cut, which is why it carries its own tests.
+- **`Short`** stays the type for full-id fields already parsed at key
+  derivation (`cut_report.cut_spec`, `verdict.cut_report`, `finding.verdict`,
+  `cut_spec.rulings`, `ruling.answers`). Retyping those is a larger cut.
+- **The outcome-invariance assertion** in `keys_are_derived_and_mismatch_refuses`
+  (`:1029-1037`): a subject has one resolution key whatever the outcome.
+
+### Adds
+
+Two `unit_enums!` entries and one `value_types!` entry. No kind, module,
+dependency or target.
+
+```
+RulingAuthority { Operator, Standing, Defaulted }
+FindingOrigin   { Introduced, PreExisting }
+pub struct Promise { label: Label, text: Line }
+```
+
+`Promise` is not a document and has no key; it is identified by its report's
+id plus its label, as `TargetInvariant` is by its target's (`:276`). It is not
+resolvable and does not enter the resolution matrix.
+
+### Per-file changes, `epiphany-pipeline/src/lib.rs`
+
+| Line | Change |
+|---|---|
+| `:262-267` | Add `RulingAuthority` and `FindingOrigin` to the `unit_enums!` block. |
+| `:290-294` | Delete `SubtractionEstimate` and its comment. |
+| `:296` | `pub struct MutationRecord { label: Label, rule: Line, location: CodeLocation, before: Line, after: Line, commit: Sha, failed_as_expected: bool }` |
+| `:298-299` | Reword the comment so it no longer names `SubtractionEstimate`. |
+| after `:307` | `pub struct Promise { label: Label, text: Line }` beside `LandedName`. |
+| `:308` | `VerdictClaim` gains `promise: Option<Label>` and `mutations: Vec<Label>[8]`. |
+| `:319-322` | `PipelineRuling` gains `authority: RulingAuthority`. |
+| `:327` | `subtraction_estimate: SubtractionEstimate` → `estimate: StructuralDelta`. |
+| `:330-335` | `PipelineCutReport` gains `promises: Vec<Promise>[64]`. |
+| `:337-341` | `PipelineFinding` gains `origin: FindingOrigin`. |
+| `:378-386` | `ResolutionOutcome`: `Superseded { by: Vec<PipelineRef> }` with `#[schemars(extend("maxItems" = 8))]` on `by`, because the enum is outside `value_types!`, the only place `[max]` is emitted automatically (`:236`); `Answered { by: PipelineRef }`; `Fixed { commit: Sha, by: Option<PipelineRef> }`; `Deferred { to: PipelineRef }`. `Recorded`/`Withdrawn` unchanged. |
+| `:388-396` | Replace `impl Bounded for ResolutionOutcome` whole: `Superseded` → `list(&format!("{field}.by"), by, 8)`; `Answered` → `by.validate("{field}.by")`; `Fixed` → validate `commit` as `{field}.commit` then `by` as `{field}.by`; `Deferred` → `to.validate("{field}.to")`; `Recorded`/`Withdrawn` → `reason.validate("{field}.reason")`. `Option<PipelineRef>` validates through the blanket impl (`:68-72`); `list` (`:99-105`) checks the maximum and validates every item. |
+| `:800-808` | Ruling sample gains `authority: RulingAuthority::Operator`. |
+| `:826-828` | Cut-spec sample: `estimate: StructuralDelta { … }` on its own lines opening with `estimate: StructuralDelta {`, carrying Cut 3a's real numbers `lines_added: 900, lines_removed: 0`, not transposed (M21). |
+| `:835` | Report sample's `MutationRecord` literal gains `label`, `location`, `before`, `after`, `commit`. |
+| `:831-845` | Report sample gains `promises: vec![Promise { label: l("P1"), text: "One derived key per document.".into() }]`. |
+| `:846-852` | Verdict sample: the claim gains `promise: Some(l("P1"))` and `mutations: vec![l("M1")]`. |
+| `:853-859` | Finding sample gains `origin: FindingOrigin::Introduced`. |
+| `:866-870` | Resolution sample: `Answered { by: PipelineRef { kind: Ruling, id: id("ruling", "R8") } }`. Its key stays `eureka-state:resolution:question.Q1`. |
+| `tests`, after `:1510` | Five new tests, named under Verification. No sample is added, so every `samples().remove(N)` index (`:889-926`) is unchanged. |
+
+`schemas/cultnet/`: six of thirteen files regenerate: `ruling`, `cut_spec`,
+`cut_report`, `verdict`, `finding`, `resolution`. Derived, never hand-written:
+`pipeline_published_schemas_match_derivation` writes the derivation to a
+per-run temp directory and names it in the failure; copy from there. The other
+seven, `index.json`, `README.md` and the two non-pipeline schemas are
+byte-identical.
+
+### The fixture the grammar made available
+
+Before 6b a resolution's key was `resolution:<subject id>`, which `pipeline_id`
+could not read back as an id of kind `Resolution`, so no `PipelineRef` could
+name one. After 6b it is an ordinary `<root>:resolution:<subject kind>.<subject
+local>` and reads back. This cut is the first to put such a reference inside
+another document's outcome, pinned in
+`resolution_outcome_referents_are_parsed_ids_of_their_kind`:
+
+- **Positive.** A resolution of `eureka-state:ruling:R8` with outcome
+  `Superseded { by: [Ref{Ruling, ruling:R9}, Ref{Resolution, <the sample resolution's key>}] }`
+  validates. The resolution id is derived from `pipeline_key(&resolution_sample())`,
+  not spelled. That is Ghostlight's own case: a ruling partly overturned by two
+  later records.
+- **Forgery.** The same list with the resolution entry's kind changed to
+  `Ruling` is refused `InvalidFormat` with `field == "resolution.outcome.by[1].id"`.
+  Well-formed, right length, right root, wrong kind. This is M16's killer; a
+  length-only check passes it.
+
+Stated limit: a `Superseded` entry naming `eureka-state:resolution:R8` also
+validates. That id is well-formed grammar no resolution derives; whether a
+document with an id exists is admission's rule. Hands must not make the
+library refuse it.
+
+### Authority map
+
+- **Owner, inputs, outputs, derived state:** unchanged. `epiphany-pipeline`
+  owns shape, bounds, formats and keys. No status, ledger row or cut state is
+  stored by this cut, and none may be added by it.
+- **Moved:** a resolution's referent stops being an unparsed string and becomes
+  a parsed `PipelineRef` (or a `Sha`). Before, `ResolutionOutcome`'s referents
+  were length-bounded only, alone among referents in the library. After, they
+  are validated where every other referent is, `PipelineRef::validate`, one of
+  the four grammar paths 6b named.
+- **Forbidden writers:** cross-field and cross-document rules stay out of
+  `Bounded`. Hands must not implement any of these in this package:
+  `operator_quote` only with `authority: Operator`; every promise in a cited
+  report named by exactly one claim (ruling A); a `mutations` label existing in
+  the cited report; a `Superseded` list being non-empty; a `Superseded`
+  referent existing. They are admission and belong to `huginn-mind`
+  (`:97-98`, `:706-708`).
+- **Shared paths:** none new. Nothing consumes these types yet.
+- **Deletion line:** the deletes table, before any field is added.
+
+**Cut 8 inherits five named refusals** and its verification table grows by
+five rows: `QuoteWithoutOperator`, `PromiseWithoutVerdict`,
+`UnknownMutationLabel`, `EmptySupersession`, `UnknownSupersessor`.
+
+### The multi-supersessor hole
+
+D9 found that one resolution per subject cannot hold Ghostlight's two partial
+supersessors, and the key permits exactly one resolution per subject. The
+shape half closes here: `Superseded` takes `Vec<PipelineRef>[8]`. Cardinality
+is an admission rule, not a shape, so a permissive list in the schema plus a
+restrictive rule in Cut 8 costs nothing whichever way Q10 is ruled; the
+reverse ordering costs an epoch.
+
+### Verification
+
+**Builds:** `cargo check -p epiphany-pipeline --lib --tests`, then
+`cargo check -p epiphany-core --lib --tests`. `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex`,
+one package, the workstation as host and target; this library has no
+platform-specific code.
+
+**Tests:** `cargo test -p epiphany-pipeline --lib`. The existing tests plus
+five, all existing unchanged in name and assertion.
+
+| Test | Rule it pins |
+|---|---|
+| `resolution_outcome_referents_are_parsed_ids_of_their_kind` | A resolution's referent is a full id of the kind it declares. Covers `Superseded` (positive and forgery), `Answered`, `Deferred`, and `Fixed`'s optional `by`, each with a wrong-kind forgery asserting the refusal's `field`. |
+| `fixed_resolution_requires_a_commit_sha` | Ruling B: a fix names the tree where the finding stopped being true. Forgery: uppercase hex of legal length. |
+| `mutation_records_carry_a_dot_free_label_and_a_commit` | A mutation has a key-safe identity and is pinned to a tree. Forgeries: `label: "M1.a"`, `commit: "dirty-worktree"`. |
+| `a_verdict_claim_names_the_promise_and_the_mutation_it_measured` | Ruling A's shape half: `promise` and `mutations` exist, are `Label`-typed, and `mutations` is bounded at 8 (nine refused `FieldBound { field: "verdict.claims[0].mutations", limit: 8, actual: 9 }`). |
+| `the_sample_cut_spec_estimates_a_net_addition` | The estimate's two `u32` fields are not interchangeable: `lines_added == 900`, `lines_removed == 0`. A tripwire with stated limits (M21). |
+
+**Negative greps over `epiphany-pipeline/src`:**
+`rg -n "SubtractionEstimate|subtraction_estimate"` empty;
+`rg -n "Superseded \{ by: Short|Answered \{ by: Short|Fixed \{ by: Short|Deferred \{ to: Short"`
+empty; `rg -n "operator_quote|promise|mutations"` shows no `if`, `match` or
+`?`-chained condition on another field; `git diff --stat <base> -- schemas/cultnet/`
+names exactly six `.schema.json` files; `rg -n '"maxItems": 8' schemas/cultnet/epiphany.pipeline.resolution.v1.schema.json`
+matches once under `Superseded.by`. **If `schemars` 1 rejects `extend` on a
+variant field, stop and report; do not drop the bound from the schema.**
+
+**Operator:** none blocking.
+
+### Mutations, M16-M22
+
+Entries file `tools/eureka-cut6c-mutations.psd1`, run through the shared
+`tools/eureka-mutations.ps1` harness from the 6b fix batch (built-in M0,
+byte-exact I/O, anchors matching exactly once, hash-checked restore).
+
+A retyping is the mutation-hostile case: the compiler catches the type change,
+so the tempting test is "construct a valid value, assert `Ok(())`", which stays
+green under every mutation below. The key suite is structurally blind here
+because a resolution's key is outcome-invariant. Where the cut's content is
+types, the mutation is a type-level mutation (M19, M20, M22).
+
+| # | Mutation, exactly | Killed by | The careless test it survives |
+|---|---|---|---|
+| **M16** | `Superseded` arm: `list(&format!("{field}.by"), by, 8)` → `bound(&format!("{field}.by"), 8, by.len())`, length only. | the referents test, via the wrong-kind forgery in a two-entry list | any test superseding with a good id |
+| **M17** | The whole `match self { … }` body → `let _ = field; Ok(())`. | the same test's `Answered` and `Deferred` forgeries | every existing test |
+| **M18** | `commit.validate(&format!("{field}.commit"))?;` → `let _ = commit;` | `fixed_resolution_requires_a_commit_sha` via `Sha("5F98228D9C")`; `hex` requires lowercase (`:114-120`) | a test using `Sha("notacommit")`, which a length check also rejects |
+| **M19** | `MutationRecord { label: Label,` → `label: Short,` | `mutation_records_carry_a_dot_free_label_and_a_commit` via `label: "M1.a"` | a test asserting `label: "M1"` validates |
+| **M20** | `commit: Sha, failed_as_expected: bool }` → `commit: Short, …` | the same test via `commit: "dirty-worktree"` | any test supplying a real sha |
+| **M21** | Two-line anchor `estimate: StructuralDelta {` + `lines_added: 900, lines_removed: 0,` → numbers transposed. The anchor must include the opener; the numbers alone also match the report sample (`:839`). | `the_sample_cut_spec_estimates_a_net_addition` | every round-trip, bounds and schema test |
+| **M22** | `VerdictClaim`: `mutations: Vec<Label>[8]` → `[16]` | the verdict-claim test via nine labels | any test supplying one label |
+
+Stated limits: M21 is a fixture assertion and the only test-visible hazard in
+retyping 4; once both estimate and delta are `StructuralDelta`, six-axis
+comparability is a type fact. `Promise` and `promises: Vec<Promise>[64]` have
+no mutation: a promise is two bounded strings, and the rule that matters
+(every promise measured) is Cut 8's.
+
+### Subtraction estimate
+
+Removed: 17 source lines (one value type with its comment, one hand-written
+`Bounded` impl, one sample literal, one field rewritten in place) and one
+unvalidated-referent class. Added: about +125 source, about 85 of them the five
+tests; about +23 outside tests. Derived JSON: six files regenerate, about +130
+/ −45. Value types net zero. Kinds, dependencies, targets, formats, epoch: all
+zero. Liability retired: the one field class whose referent was never parsed,
+and a pair of estimate/actual types that could not be compared on four of six
+axes, both of which would have been paid for at an epoch bump the moment Cut 8
+pinned a rev.
+
+**If Hands finds a consumer of any of the five names outside
+`epiphany-pipeline/src/lib.rs` and the four schema files, this cut is wrong**:
+stop and report rather than retyping.
+
+**Landed 2026-09-16** at `4d6af409` (deletes; does not build by design, the
+outcome having no `Bounded` impl until the next commit), `13570e84` (the
+shapes; 26 tests, 0 warnings) and `dddf9ede` (entries M16-M22 in
+`tools/eureka-cut6c-mutations.psd1`). Hands re-anchored by content, since
+`lib.rs` had moved twice since `95ee551a`; the spec's "twenty tests" was
+twenty-one by then. `schemars` 1.2.2 accepted the `extend` attribute on the
+variant field, and `"maxItems": 8` appears exactly once, under
+`Superseded.by`. Six schema files regenerated (+193/−22); `index.json`
+byte-identical. All four suites green-and-killed afterwards, the nineteen
+6b entries included: keys did not move. Structural delta: source outside
+tests +45/−19, tests +163/−5, file 1,616 → 1,801 lines, no kind, dependency,
+target, format or epoch change.
+
+Corrections and scars from Hands:
+
+29. **M19 and M20 first came back "DID NOT BUILD."** The sample and the test
+    spelled the label and commit with the newtype constructors, so widening
+    the type made the tree fail to compile instead of admitting the forgery.
+    Fixed by constructing through `From<&str>`. A type-level mutation only
+    reads as a kill when the fixture is spelled so the widened tree compiles;
+    the spec implied that and did not say it.
+30. **`5f98228` is a legal seven-character sha**, so it was no forgery;
+    replaced by six characters.
+31. **The estimate test carries one assertion beyond the spec**: the sample
+    estimate equals the sample report's structural delta, which required
+    aligning the sample's `formats_added`. Soul is asked whether that moved
+    anything else.
+32. **The refusal `value` is the failing part, not the whole id**, so the
+    third-batch reader fixture asserts `field` only, as Cut 6b's did.
+33. **"The nineteen 6b entries" is seventeen** (M1-M6, S2, S4, S5, N3,
+    N6-N10, X1, X11). Self's count, corrected by Soul.
+
+**Soul's pass on Cut 6c and the third batch** (Fable; `soul-cut6c-*` in the
+session scratchpad) held every shape, schema and key promise: all thirteen
+derived schemas byte-identical to the committed files, exactly six changed
+against `117f54b7`, the bound under `Superseded.by` alone, `Fixed.by`
+nullable and `commit` the sha pattern, `Promise` in the report schema with
+its bound, the thirteen expected keys identical before and after, the
+`Bounded` impl reading only its own fields, and the extra estimate
+assertion moving nothing else. All four suites green-and-killed through the
+harness; Hands' attack script reruns identically; a one-second timeout on
+real cargo kills cleanly and leaves no lock. Non-revert mutations that
+validated only the first supersessor, mis-indexed the refusal path, or
+skipped `Some` in the blanket impl all died. Three fixtures were missing:
+
+- **`Fixed.commit` is unpinned when `by` is `Some`** (medium): the only
+  forgery had `by: None`, so an impl that trusts the reference and skips
+  the sha passes the suite. That is half of ruling B.
+- **The validator's supersession bound is unpinned**; only the schema
+  attribute's 8 is, so the two could drift.
+- **The `Recorded`/`Withdrawn` reason bound was never pinned**, before or
+  after 6c.
+
+And three harness follow-ups: a stale sidecar for a file outside the
+current targets is ignored rather than repaired; repair overwrites hand
+edits without recording them; a locked target during repair throws a raw
+exception. A stated limit, not a defect: widenings of `Promise.label` and
+the verdict claim's label fields cannot be reached by a `Bounded` test
+because the samples spell them through the newtype (scar 29's class), and
+no published schema carries a dot-free pattern, so that rule is Rust-side
+only. Self-deferral passes the shape and is admission's. The 9,165 versus
+9,807 target-dir discrepancy was files versus paths; paths is the
+convention.
+
+**The fix batch landed** at `fcfbda3f` (the three fixtures, entries S2, S14,
+S10 killed; 26 tests) and `3f7d58d1` (harness: every sidecar under the repo
+root is repaired at startup, not only the current targets; a `-Repo`
+parameter, which is Q14's option A; bytes that differ from a sidecar are
+saved to `<file>.eureka-mutation-overwritten` with their SHA-256 printed
+before the restore; equal bytes say "sidecar matched; nothing to restore";
+a locked target prints the harness's own words and keeps the sidecar).
+Soul's XA-XD reproduced with those outcomes.
+
+**The Epiphany half of Cut 8 landed** at `a65c6420`: the leaf's `prepare`,
+`decode`, `register_pipeline_document_types` and
+`validate_pipeline_write_envelope` are live and public, the validator
+returns `Result<(), PipelineRefusal>`, the live registrar registers exactly
+the thirteen kinds and the test cache registers the stand-in,
+`PIPELINE_SCHEMA_EPOCH` exists in code again, `anyhow` and `rmp-serde` are
+normal dependencies with the lock unchanged, and
+`every_kind_is_at_the_epochs_version` pins the epoch's version against every
+type id and the registrar's count. 27 tests, 0 warnings; `epiphany-core`
+recompiled nothing; entries E1-E3 killed. Source outside tests net −3.
+
+**Soul's pass** (Fable; `soul-cut8e-*` in the session scratchpad) attacked
+the door from an external crate by path: the four public functions and the
+epoch constant are reachable; the thirteen wrappers, `Bounded`,
+`pipeline_id`, `ForeignDocument` and `derived_schema` are not (E0603,
+E0432, E0599); all thirteen kinds round-trip `prepare`, `validate`,
+`decode` with the key equal to `pipeline_key`'s; a structural tamper, a
+forged key, a foreign type and one kind's type over another's payload each
+refuse as named. The validator carries no `anyhow` inside; six direct
+dependencies exactly; the lock and the schemas unchanged; the twenty-six
+prior test names intact. Every suite killed through the harness, including
+the new E1-E3, and its own non-revert mutations died (`.v01`, `epochs.v1`,
+one kind at `.v2`, the inverse of S2, the reason bound at 1,001, only the
+first supersessor validated). A double registration cannot move the
+registrar's count because the cache dedupes, so that mutant is equivalent.
+**The Epiphany half of Cut 8 closes; Huginn pins `a65c6420`.** Found, none
+touching the leaf's contract:
+
+- **A sidecar whose file is gone crashes the harness with no message, and
+  it stays crashed** (medium): PowerShell 5.1 collapses an empty byte array
+  from an `if` expression to `$null`, the comparison throws the .NET
+  exception, the "could not repair" line sits outside the `try`, and every
+  later run in that root dies the same way until a human deletes the
+  sidecar. Bytes are never destroyed.
+- **A locked target during repair leaves an `.eureka-mutation-overwritten`
+  file whose name lies**, since it is written before the failed restore.
+- **Seven doc comments describe the organ in the present tense** as a
+  consumer that exists, and one claims a Huginn test that does not.
+- **`decode` is a door, not a guard**: an envelope built without `prepare`
+  is accepted by `decode` and, when the key and fields are valid, by the
+  validator too, by design; but `decode` alone bound-checks nothing, and
+  its doc does not say so. Cut 9's views and Cut 12's import must not read
+  `decode` as validation.
+- Reach, not defects: a forged supersessor at index seven is unpinned
+  (fixtures forge index one and fail the count at nine); the epoch test
+  pins the version suffix only, and the schema-derivation test is what
+  kills a renamed type id.
+
+**That batch landed** at `b3bd4a82` (harness: a missing target is its own
+case, recreated from the sidecar and said so; a sidecar of a sidecar stops
+the run naming both files before any repair; the overwritten copy is
+removed again when a restore fails without opening the file; every
+per-sidecar body is one `try`/`catch` so no raw exception escapes; Soul's
+XA-XK reproduced) and `aef0e1bf` (doc comments: no organ described as
+existing; `decode` says it is a typed read, not validation). 27 tests, 0
+warnings, lock and schemas unchanged. No separate Soul pass: the next Soul
+on Huginn runs this harness.
+
+**The Huginn half of Cut 8 landed** on `eureka/memory-organ` at `946758f`
+(store, mind, opener; 4 tests), `a4c5b79` (receipt and commit primitive; 4
+tests), `0bd7133` (admission, refusal, the rule table; 26 tests, 0
+warnings) and `ca30d3e` (entries H1-H20, all killed through Epiphany's
+harness with `-Repo`, four targets, M0 green). `cargo check --workspace`
+clean; one `cultcache-rs`, no `epiphany-core`; one inherited `syn`
+duplicate the leaf's graph already carries. Target dir +656 paths, +0.39
+GB, inside the budget. +3,491 lines over 11 files, +8 direct dependencies,
+lock 3 → 93 packages, two Huginn document types, no binaries or targets.
+Soul in flight.
+
+Hands' discrepancies, all kept and recorded:
+
+34. **The leaf's `PipelineRefusal` and `PipelineDocument` derive neither
+    `Serialize` nor `JsonSchema`**, so `MindRefusal::Document` mirrors the
+    refusal through a `#[serde(remote)]` definition compiled against the
+    leaf's shape (drift breaks the build), and `PipelineAdmissionBatch`
+    cannot derive either. **Cut 10's wire cannot serialise a batch until the
+    leaf derives them.** That is an additive leaf change and a Cut 10
+    prerequisite; recorded here so Cut 10's refresh carries it.
+35. **`FindingWithoutRange` is unreachable**: a rangeless envelope fails the
+    leaf's decode first. Variant kept; the test asserts the real refusal.
+36. **The epoch record is derived when the batch carries the `instance`
+    document**, not when the image is empty, so a replay of the first batch
+    is `AlreadyAdmitted` and not a collision.
+37. **`Mind::open` recognises the owned store's lock failure by its error
+    text**, because the store gives no typed signal. One string match,
+    commented; Soul is asked whether any other store failure can be misread.
+38. **`receipt.rs` is 277 lines against a 220 cap**, by its tests and the
+    two provenance shapes that live beside their only consumer.
+39. **`prepare_entry_named` appears once outside `receipt.rs`**, in
+    `mind.rs` for the epoch record. The spec's grep is narrowed to that.
+40. **`Cargo.lock` was already LF**, so the whole-file rewrite Cut 7's Soul
+    predicted did not happen; the lock gained 809 lines.
+
+**Soul's pass on the Huginn half** (Fable; `soul-cut8h-*` and
+`soul_probe.rs` in the session scratchpad) held identity at the layer where
+it fails: a real redb mind copied under another instance's directory is
+`ForeignInstance` and opens under its own name with its receipt; a second
+process taking the same path gets `MindAlreadyOwned` in under a
+millisecond with the store intact; a directory at the path and a read-only
+file are `Unavailable`, never misread as ownership. The digest moves with
+the strong reads and not with provenance, `now` or the store's timestamp;
+`committed_at` equals the `now` passed in; the refusal mirror serialises
+every variant byte-identical to a derive and a new leaf variant breaks the
+build. H1-H20 all killed; pins, lock and leafness exact. **Cut 8 does not
+close as specified.** Found:
+
+- **The opener's epoch step checks neither the record's key nor its count**
+  (medium): it takes the first record; a record keyed otherwise opens, two
+  records open, and a current-plus-foreign pair refuses only by sort order.
+  The spec said exactly one, keyed by the epoch string. No test pinned it.
+- **"Withdrawing a resolution reopens its subject" is unimplementable under
+  the key grammar** (medium): a resolution's key is outcome-invariant and
+  one per subject, so after a withdrawal every later resolution of the same
+  subject is `AlreadyResolved` forever. The sentence was Imagination's, not
+  a ruling. Raised as Q17 below with Self's default applied.
+- **A withdrawn stewardship can never be regained on the same mind**
+  (medium for Cut 12): the derived stewardship keys `{mind}:stewardship:{repo}`
+  and collides with the withdrawn one. Spec-consistent as written; raised
+  as Q18 below, a key-shape question, before Cut 12.
+- **The organ minted a leaf refusal** for an empty `campaign.repos`; the
+  leaf's list bound has no minimum and says minimums are admission's. Low.
+- **"One CAS" and "strong reads beyond the first" were unpinned** (medium as
+  tests): a receipt written in a second swap, and only the first cited
+  document pinned, both survived the suite.
+- **Fifteen rule rows had no mutation**: stewardship checked against the
+  batch only; spec mismatch on repo; promise-label equality; the in-force
+  target; the matrix beyond one row per kind; the derived stewardship's
+  date; derived writes' own validation; batch-level identity uniqueness;
+  batch size; question options; duplicate labels; finding locations;
+  answered-coherence. The real code answers every one correctly; the suite
+  could not see a regression in any of them.
+- **README and AGENTS again describe CultNet publication and a Qdrant
+  connection in the present tense**, and README still says `.cc`.
+- **`receipt.rs` is 194 non-blank, non-comment lines outside tests**, over
+  the 220 cap only with its tests; recorded, the cap was pressure.
+- **Stated limit, not a defect:** every stored envelope carries a
+  `stored_at` that CultCache's `prepare_entry_named` stamps from the wall
+  clock, so "no clock read inside the crate" is true of Huginn's decisions
+  and false of the bytes it stores. The receipt names payload bytes and
+  their digests, not the envelope's stamp; replay compares payloads; the
+  CAS expectation is built from the live image at commit time, never
+  reconstructed from a receipt. Cut 9's in-force derivation must not
+  depend on `stored_at`. Recorded in the authority map's inputs.
+- `Mind::open` recognises the store's lock failure by its error text; a
+  CultLib re-pin that rewords it silently demotes `MindAlreadyOwned` to
+  `Unavailable`. FU-9.
+
+**The fix batch landed** (Opus) at `1cfa81d` (the epoch gate: exactly one
+record, keyed by the epoch string, equal to it, with `found` carrying the
+foreign value, the wrong key, or the record count, decided before any
+value is read; `MindRefusal::EmptyRepos` in place of the minted leaf
+refusal; docs without present-tense claims about unbuilt cuts), `acd32f3`
+(Self's Q17 default reverted on the operator's ruling; the matrix and its
+test byte-identical to `ca30d3e` plus a doc comment naming the ruling and
+the leaf cut it needs) and `30daff8` (a recording store pins one swap
+carrying documents and receipt together; every cited image document is a
+strong read; one fixture and one entry per unpinned row, Soul's survivors
+S8-S23 as entries H26-H39). 31 tests, 0 warnings; H1-H39 all killed
+through Epiphany's harness; +525/−26 over seven files, one refusal variant
+added. Hands named the gap the ruling leaves until the leaf cut lands: the
+matrix now admits a second resolution after a withdrawal and the key still
+refuses it as `AlreadyResolved`. **Cut 6d (resolution history, stewardship
+by sequence) must land before Cut 9.**
+
+**Soul on the fix batch** (Fable; `soul-cut8f-*` and `soul_probe2.rs` in the
+session scratchpad) held every promise: the epoch gate's count-then-key-
+then-value order under four non-revert forms; `EmptyRepos` in place of the
+minted refusal; the matrix and its test byte-identical to `ca30d3e` after
+the revert; one swap and every strong read pinned, with the second-CAS
+and emptied-expectation forms dead by the store's own contract; H1-H39
+killed; docs on `mind.redb` and the live crate. **Cut 8 closes on the
+admission rules as ruled today.** Two findings sharpen what the Cut 6d
+Huginn follow-up must do, and it now owns them:
+
+- **Q19 A is not enforced**: a withdrawal of a withdrawal committed, chain
+  unbounded, the rejected Q19 B shape as a standing record. The follow-up
+  caps the chain at depth two.
+- **The Q17 gap has two owners, not one**: after a withdrawal, a re-
+  resolution is refused by the key (A10) and also by admission's in-force
+  derivation (A8), which still counts the withdrawn resolution. The key
+  sequence alone would not reopen a subject; in-force must ignore withdrawn
+  resolutions too, as the 6d spec already says.
+
+Test gaps, the real code correct by probe and the suite blind to a
+regression, all folded into the follow-up: the in-force half of
+`stewardship_of`; a document cited twice pinned zero times; derived writes
+skipping A7; the in-force target decided from the image only; `Answered`
+coherence only when the ruling is in the batch; branch compared
+case-insensitively. Stated limits: the epoch pair's "both orders" pin lives
+only in the helper call, because every store returns rows in key order;
+a case-insensitive epoch key is equivalent since only the organ writes it.
+One doc residue: README still names the two stub crates' purposes in the
+present tense.
+
+**The Cut 10 prerequisite landed** at Epiphany `b4b17fc` (correction 34):
+`PipelineDocument` derives `Serialize`, `Deserialize` and `JsonSchema` with
+an adjacent tag whose string is exactly `PipelineKind::name()`, so a wire
+reader dispatches on the same string the key's kind segment carries and no
+second registry maps spellings to kinds; `PipelineRefusal` derives the same
+three with serde's default external tagging, which already puts every
+variant's named parts on the wire. One test round-trips every sample and
+every refusal through JSON and MessagePack and holds both schemas to
+exactly the thirteen kinds and the four variants; entries D1 (tag renaming
+removed) and D2 (a refusal field skipped) killed beside E1-E3. 28 tests, 0
+warnings; no kind, field, type id, epoch, schema file, lock or dependency
+moved. Huginn's `#[serde(remote)]` mirror comes out in Cut 10 when the pin
+moves to this commit.
+
+41. **Suspect, not accepted: `epiphany-core` recompiled once after the leaf
+    change.** Hands called it legitimate because "every dependent's
+    metadata is stale", but `epiphany-core` is not a dependent of the leaf
+    (Cut 6 proved no path in either direction, and Soul's pass on the
+    Epiphany half saw it finish in half a second untouched). Either a
+    shared target-dir fingerprint was evicted by another session's build,
+    or something depends on the leaf that this map says does not. **Self
+    checked the second half at once**: `cargo tree --workspace -i
+    epiphany-pipeline -e normal,build,dev` lists the leaf alone, so no
+    workspace crate depends on it in any kind. What remains is the shared
+    target dir: another session was building Ghostlight into it during this
+    pass, and a fingerprint evicted by a different environment or profile
+    reads as a "recompile" of an untouched crate. That is the build-economy
+    cost of one shared `CARGO_TARGET_DIR` across sessions, already accepted
+    (correction 22); not a dependency, and not Hands' explanation either.
+
+## Cut 6d. Resolution history and stewardship by sequence
+
+Imagination, 2026-09-16, revised the same day for Q19 A and Q20 A.
+Implements Q17 B, Q18 A as corrected, Q19 A and Q20 A: **a hand-off is a
+transfer of stewardship, symmetric and final as a record; a lease is two
+transfers and nothing more** (no lease, expiry, return or intent field
+anywhere); **a withdrawal cannot be withdrawn**; and **stewardship is keyed by
+a per-(instance, repo) sequence, not by date**, exactly as resolutions are
+keyed by a per-subject sequence.
+
+- **Repo/branch:** Epiphany `codex/eureka-pipeline-state`. Anchors are
+  `file:line` against `epiphany-pipeline/src/lib.rs` at **`b4b17fc`** (2,099
+  lines, 28 tests), byte-identical at HEAD `542dc184` (`git diff --stat
+  b4b17fc HEAD -- epiphany-pipeline/ schemas/cultnet/ tools/` empty, probed
+  twice). HEAD moved three times during this pass, the map only; re-anchor by
+  content as every cut since 6b has.
+- **Depends on:** nothing unlanded. **Blocks:** Cut 9 (in-force derivation),
+  Cut 12 (hand-off), and a Cut 8 follow-up commit in Huginn that this cut
+  implies (below). Lands before any of them.
+- **Cost:** two kinds' keys move (`resolution`, `stewardship`); two fields are
+  added (`resolution.sequence`, `stewardship.sequence`); two schema files
+  regenerate; no epoch moves; no kind widens. Keys are free to move today: no mind exists on Yggdrasil.
+  Huginn pins `a65c6420` (`crates/huginn-mind/Cargo.toml:15`) and its fixtures
+  spell both old shapes, so the pin move is a named follow-up, not a surprise.
+
+### What the cut does
+
+**Q17 B.** A resolution is the record of how a subject was closed and by
+what. Its key gains a per-subject sequence as the **last** local part:
+`<subject root>:resolution:<subject kind>.<subject local>.n<N>`. Withdrawn
+resolutions stay under their subject as records; the subject can be resolved
+again at `n<N+1>`; the history is the key prefix
+`<root>:resolution:<kind>.<local>.n`.
+
+**Q18 A + Q20 A.** A stewardship is keyed by repo and a per-(instance, repo)
+sequence: `<instance>:stewardship:<repo escaped>.n<N>`. A repo transferred
+away and later transferred back to the same mind is two records under one
+prefix, `<instance>:stewardship:<repo escaped>.n`, and the in-force one is
+the latest not withdrawn. `assigned_on` stays a field, validated as a `Date`
+by the derived `Bounded` impl, and no longer enters the key.
+
+Both are key-shape changes in the leaf plus one field each. Everything semantic
+(what "in force" means, what `AlreadyResolved` refuses, how a transfer derives
+its writes) is admission's and is specified here for the Huginn follow-up, not
+built here. The leaf gains no cross-field rule (authority map, Cut 6b/6c).
+
+### Decisions, with the reasons
+
+#### D1. The sequence is a field the writer sets; admission checks it
+
+This decision is made once and applied to both kinds: `resolution.sequence`
+is per subject, `stewardship.sequence` is per `(instance, repo)`. The leaf
+holds no image (`pipeline_key`'s inputs are "the document's own
+fields. No clock, store, registry or counter", map Cut 6b authority map), so
+the only way the sequence reaches the key is a field. Admission cannot set it
+either: `admit_prepared` takes envelopes "prepared by anyone" and the receipt
+digests the exact payload bytes (`receipt.rs`, map Cut 8 A9/A11), so a field
+rewritten by admission would make Cut 12's import and exact replay
+impossible. Precedent already in the leaf: `revision: u32` on `target` and
+`cut_spec` is writer-set and keyed `r<N>`, and Huginn's `revision_rule`
+(`admission.rs:605-622` at `1cfa81d`) checks it against the image. The
+sequence follows the same pattern exactly.
+
+- **Fields:** `sequence: u32` on `PipelineResolution` after `subject`, and
+  `sequence: u32` on `PipelineStewardship` after `repo`.
+- **Bound:** none in the leaf beyond `u32` and `LOCAL_MAX`; `n4294967295` is
+  an 11-byte label. The leaf refuses neither `0` nor a gap, as it refuses
+  neither `revision: 0` nor `revision: 7` without a predecessor; those are
+  admission's (`revision_rule` refuses 0). Stated in both fields' doc comments
+  and pinned as a stated limit in the new tests.
+- **Admission's rule (follow-up), the same for both:** `sequence ==
+  latest + 1`, where `latest` is the greatest `sequence` among the records of
+  the same scope (resolutions of that subject; stewardships of that
+  `(mind, repo)`) in image ∪ batch other than this document; and no record of
+  that scope is in force other than this document. Refusals below.
+- **Derived writes** (a ruling's `Answered` resolution; on a transfer, the
+  source mind's `Withdrawn` resolution of its stewardship and the receiving
+  mind's new stewardship) get their `sequence` from `derive()` the same way,
+  since `derive` already reads `docs` (`admission.rs:417-458` at `30daff8`).
+
+#### D2. Spelling: `n<N>`, the last part
+
+Every numeric key part the leaf has carries a one-letter marker (`r2`, `h1`,
+`s2`, `:724,:731,:739,:748`), and `parent_cut` reads the marker to tell a
+spec's tail from a report's. The sequence takes `n` ("the nth resolution").
+Nothing parses it back: admission reads `sequence` from the document, never
+from the key, and the reader `pipeline_id` stays one shape with no `match
+kind` (R1, R2 hold; `:579-599` unchanged). The marker buys legibility and the
+house convention for one byte per nesting; the alternative, bare digits, was
+considered and rejected because a key a human reads in a Studio row should
+say what its tail is.
+
+The sequence is the **last** part so that the subject's resolutions, and only
+they, share the prefix `<root>:resolution:<kind>.<local>.n`. Under R2 no part
+carries a dot, so `question.Q1.n` cannot match `question.Q10.n1`, and the
+withdrawal of `Q1`'s first resolution keys under `resolution.question.Q1.n1.n1`,
+outside the prefix. The same spelling and position serve stewardship: the
+history of a repo on a mind is the prefix `<instance>:stewardship:<repo
+escaped>.n`, and `key_segment` escapes `.` to `_d`, so an escaped repo can
+never end in `.n`. Both prefix properties are pinned by leaf tests (below) and
+are what Cut 9's history queries ride on.
+
+#### D3. Nesting arithmetic changes
+
+A depth-one local is `<kind>.<subject local>.n<s>`. Each nesting prepends
+`resolution.` (11 bytes) and appends `.n<s>` (3 bytes for one digit), so a
+chain `d` deep composes `14 * (d - 1) + L1` bytes, `L1` the depth-one local.
+At `LOCAL_MAX = 64`: `ruling.A.n1` (11 bytes) and `question.Q1.n1` (14 bytes)
+both key **four** deep and refuse at five (53 and 56 fit; 67 and 70 do not).
+The bound stays the local's alone (`local`, `:673-682`); no guard is added
+(Q11 A). The depth test derives its expectation from `LOCAL_MAX` and the two
+literal widths, so the numbers are not restated.
+
+A stewardship local is `<repo escaped>.n<N>`, so the escaped repo has
+`LOCAL_MAX - 3` bytes for a one-digit sequence (61), not 64. It does not
+nest. The resolution of a stewardship is `<instance>:resolution:stewardship.<repo
+escaped>.n<N>.n<M>`, two sequence parts, the inner one the stewardship's; a
+withdrawal of that is one more `resolution.` and `.n1`, and Q19 A stops the
+chain there.
+
+#### D4. What "withdrawn" means, and what `AlreadyResolved` becomes
+
+Documents are immutable and status is derived (Cut 9: "status is derived at
+read time, never stored"), so the only way a resolution stops counting is
+another document naming it: **a resolution of the resolution with outcome
+`Withdrawn`**, the matrix row Cut 8 first specified ("resolution: `Withdrawn`
+only: withdrawing a resolution reopens its subject", map `:2376`) and Soul
+found unimplementable under the outcome-invariant key. The sequence makes it
+implementable. Huginn's landed fix batch already restored that row
+(`acd32f3`, `admission.rs:673` at `30daff8`: `(K::Resolution, O::Withdrawn {
+.. }) => true`) and its doc comment says the sequence "is mapped separately";
+this is that map.
+
+In-force, one derivation for every kind, recursive and well-founded:
+
+> `in_force(kind, id)` holds when no resolution `R` with `R.subject == (kind,
+> id)` exists in image ∪ batch such that `in_force(Resolution, key(R))`.
+
+`key(R)` is strictly longer than `id`, so the recursion descends a bounded
+chain (D3) and terminates. Today's `in_force` (`admission.rs:255-267`) is the
+non-recursive special case that counts a withdrawn resolution as if it still
+stood; that is the exact defect Soul named.
+
+The in-force resolution of a subject is then "the latest not withdrawn". The
+two readings of that phrase ("the latest, if not withdrawn" and "the latest
+among the not-withdrawn") coincide **only if a withdrawal cannot itself be
+withdrawn**: otherwise `n1` withdrawn, `n2` admitted, then `n1`'s withdrawal
+withdrawn leaves two resolutions standing. **Q19, ruled A:** the chain is capped at admission (a resolution
+of a resolution is admissible only when that resolution's own subject is not
+a resolution), so reinstating a withdrawn closure is done by resolving the
+subject again at `n<N+1>`, which is what "keep a log, attached to the
+subject" asks for. Under A the two readings coincide and "the latest not
+withdrawn" is exact.
+
+`AlreadyResolved { subject }` moves from A10 to A8:
+
+- **A8, resolution row:** the subject has an in-force resolution other than
+  this document → `AlreadyResolved { subject }`. "Other than this document"
+  is content identity (the same `subject`, `sequence`, `outcome`, `rationale`,
+  `resolved_on`), so an exact replay passes A8 and reaches A9's
+  `AlreadyAdmitted`, as the ruling row's `own` closure already arranges
+  (`admission.rs:496-501`). A wrong sequence → `ResolutionOutOfSequence {
+  subject, expected, actual }` (new `MindRefusal` variant, Huginn's enum, not
+  the leaf's).
+- **A10:** the `Resolution` arm of `refuse_collisions` (`admission.rs:727-729`
+  at `30daff8`) is deleted. A resolution key is no longer one-per-subject, so a collision on
+  it means what it means for every other kind: that identity is taken.
+  `IdentityCollision` names it. The map's A10 sentence "a subject resolves at
+  most once because its resolution key is outcome-invariant" is retired.
+- **The ruling row** keeps `AlreadyResolved` (a ruling answering a question
+  whose resolution is in force); the derived `Answered` resolution's sequence
+  is `latest + 1`, so a question withdrawn-and-reopened can be answered again.
+
+#### D5. Stewardship: keyed by sequence, in force = the latest not withdrawn
+
+- **Key:** `local(&key_field, &[&key_segment(&value.repo.0), &sequence])`
+  with `let sequence = format!("n{}", value.sequence);`, after the existing
+  `org_repo_text("stewardship.repo", …)?`. `assigned_on` does not enter the
+  key, so the arm validates nothing about it; the field is validated where
+  every field is, by the `Bounded` impl `value_types!` emits (`:248-253`),
+  and `validate_pipeline_write_envelope` runs that before the key check.
+  Q20's first draft put the date in the key and a `validate` call in the arm;
+  both are gone, and no test may assert a date-shaped refusal from
+  `pipeline_key`.
+- **Date-invariance:** two stewardships of one repo with one sequence and
+  different `assigned_on` key once, exactly as two resolutions of one subject
+  with one sequence and different outcomes key once. Pinned in the new test.
+- **Escaped repo bound:** the local is `<repo escaped>.n<N>`, so the escaped
+  repo has 61 bytes for a one-digit sequence. `a_composed_local_is_bounded_whole`'s
+  stewardship boundary moves with it (below).
+- **In force (follow-up), mirroring the resolution row exactly:** `sequence
+  == latest(mind, repo) + 1` → else `StewardshipOutOfSequence { repo,
+  expected, actual }`; and no in-force stewardship of `(mind, repo)` other
+  than this document → else `AlreadyStewarded { repo }`. Both are new
+  `MindRefusal` variants; the first is the sequence rule the coordinator
+  named, the second is the in-force half `AlreadyResolved` plays for
+  resolutions, and it is the one Cut 12's transfer-back depends on (a repo
+  cannot be assigned twice while one assignment stands). Today the row is
+  the key collision (`:2362`), which a sequenced key no longer provides.
+  With both, at most one stewardship of a repo is in force on a mind, so
+  "the latest not withdrawn" is "the one not withdrawn" and `stewardship_of`
+  (`admission.rs:271-284` at `30daff8`) keeps returning `find_map` of the
+  in-force one with no tie-break.
+- **Same-day limit, retired.** With the date out of the key, a repo
+  transferred away and back to the same mind on one day is `n1` withdrawn and
+  `n2` standing; nothing collides. The hand-off key itself still carries
+  `handed_on` (`:721`), so two hand-offs in one direction for one repo on one
+  day still share a key; that is the pre-existing hand-off shape, which this
+  cut does not touch, recorded under Findings.
+
+#### D6. A hand-off is a transfer; the derivations are symmetric already
+
+Operator, 2026-09-16: "We might start with, say, Odin as steward over a whole
+swarm of infra tools, and spin off a new steward only when the workload
+justifies it. Odin wouldn't be getting it back in that case."
+
+`derive` at `admission.rs:433-452` (`30daff8`) reads only `from_instance ==
+mind` (withdraw the in-force stewardship) and `to_instance == mind` (assign a
+new one, `assigned_on: handed_on`). A transfer back is a hand-off with the
+instances swapped; the source side withdraws the transferee's stewardship
+(a resolution at that stewardship's next sequence), the receiving side
+derives a new stewardship at `latest(mind, repo) + 1`, which no longer
+collides with the withdrawn original. **No field names a return, and none is
+added.** `hand_off` is unchanged in shape and key; `PipelineHandOff`
+(`:374-377`) does not move and `hand_off.v1.schema.json` does not regenerate.
+
+What changes for Cut 8's per-kind rules: the hand-off row's two derivations
+each set a `sequence` (`derive` computes both from `docs`), and the derived
+stewardship's key is `<mind>:stewardship:<repo escaped>.n<N>`. What changes for Cut 12's
+spec: the sentence "with the superseding `stewardship` on the source side"
+(map `:2707-2709`) is wrong at HEAD and was before this cut — Cut 8 derives a
+`Withdrawn` resolution on the source side, not a supersession — and one test
+is added, `a_repo_transferred_back_is_stewarded_again` (transfer A→B, then
+B→A; A's in-force stewardship is `n2`; `n1` is still readable by key; the
+prefix `A:stewardship:<repo escaped>.n` yields both). Cut 12 models no return
+specially.
+
+### Deletes first
+
+| Path | Lines | What dies |
+|---|---:|---|
+| `epiphany-pipeline/src/lib.rs` | 0 | Nothing. The cut adds one field and two key parts; the resolution and stewardship arms are already one exit each through `local`, and the cut changes what they compose, not how. |
+| Huginn `crates/huginn-mind/src/admission.rs:727-729` at `30daff8` (follow-up, not this commit) | 3 | `refuse_collisions`'s `Resolution` arm. Goes before any new rule is added in that commit. (The matrix's Q17 A paragraph already died at `acd32f3`.) |
+
+An honest zero in the leaf, not an omission.
+
+### Keeps and moves
+
+- **Keeps:** thirteen kinds, `PipelineKind`, every type id, the epoch
+  constant (`:667`), `pipeline_id` (`:579-599`) untouched, `local`,
+  `key_segment`, `ROOT_LOCAL`, `LOCAL_MAX`, `parent_local`, `parent_cut`,
+  `PipelineRef`, `ResolutionOutcome` and its `Bounded` impl, the hand-off arm
+  (`:714-723`) and key, `PipelineHandOff` and `PipelineStewardship.assigned_on`
+  as fields, the outcome-invariance assertion (`:1102-1109`: the sequence is
+  the same across outcomes, so the assertion stays true as written), every
+  `value_types!` and `pipeline_kinds!` entry,
+  `validate_pipeline_write_envelope`, all twenty-eight test names.
+- **Moves:** the resolution sample key (`:941`), the stewardship sample key
+  (`:951`), and every literal resolution or stewardship key in the tests
+  (listed per line below). The nested-depth arithmetic in
+  `a_resolution_of_a_resolution_reads_back` and the stewardship boundary in
+  `a_composed_local_is_bounded_whole` are key-shape assertions and move with
+  the shape; both are named below with the exact new expression.
+- **Re-anchor, not move:** `tools/eureka-cut6b-mutations.psd1` M2 pins the
+  exact `let parts = …` line of the resolution arm; that line changes, so M2's
+  `Old` and `New` are re-anchored (below). Precedent: N7/N8 re-anchored Cut
+  6's M12/M13 in the same file.
+
+### Adds
+
+| Add | Owner | Live consumer | Protected invariant | Why an existing owner cannot serve |
+|---|---|---|---|---|
+| `PipelineResolution.sequence: u32` | the leaf (shape and key) | `pipeline_key`'s resolution arm now; `huginn-mind`'s resolution row and `derive` in the follow-up | A subject's resolutions are distinct records with a total order the key carries, so a withdrawn one is kept and the next one is nameable (Q17 B) | The key must come from fields (D1); no existing field distinguishes two resolutions of one subject. |
+| `n<N>` as the last part of a resolution local | `pipeline_key` | the same | History is one key prefix per subject (D2) | The composer has no other path to a key. |
+| `PipelineStewardship.sequence: u32` | the leaf | `pipeline_key`'s stewardship arm now; `huginn-mind`'s stewardship row and `derive` in the follow-up | A repo's stewardships on a mind are distinct records with a total order the key carries, so a transferred-away repo can come back as a new record (Q18 A, Q20 A) | No existing field distinguishes two assignments of one repo to one mind; the date was rejected (Q20) because same-day records would collide and a date orders nothing the sequence does not. |
+| `n<N>` as the last part of a stewardship local | `pipeline_key` | the same | History is one key prefix per `(instance, repo)` | The composer has no other path to a key. |
+| Three tests and `tools/eureka-cut6d-mutations.psd1` (M23-M27) | the leaf's suite | the shared harness | Each rule above has a runtime mutation | — |
+
+No kind, module, dependency, target, format or epoch. No type outside
+`value_types!`.
+
+### Per-file changes, `epiphany-pipeline/src/lib.rs` at `b4b17fc`
+
+| Line | Change |
+|---|---|
+| `:16-20` | Module doc gains one sentence: "A resolution's local ends in its per-subject sequence, `n<N>`, and a stewardship's in its per-repo sequence, so a subject's resolutions and a repo's assignments each share a prefix." |
+| `:363` | `pub struct PipelineResolution { subject: PipelineRef, sequence: u32, outcome: ResolutionOutcome, rationale: Para, resolved_on: Date }`, with a doc comment: the record of how a subject was closed and by what; `sequence` is per subject and set by the writer, `1` for the first; whether it is the previous plus one, and whether an earlier one still stands, are admission's. |
+| `:369-371` | `pub struct PipelineStewardship { instance: Slug, repo: OrgRepo, sequence: u32, assigned_on: Date, note: Line }`; doc: "an assignment of a repo to a mind; `sequence` is per `(instance, repo)`, set by the writer, `1` for the first, so a repo transferred away and back is two records under one prefix. `assigned_on` is a field, not a key part." |
+| `:695-701` | Rewrite the arithmetic comment: each nesting prepends `resolution.` and appends `.n<s>`, `14 * (n - 1) + L1` bytes against `LOCAL_MAX`. |
+| `:702-707` | Resolution arm: `let sequence = format!("n{}", value.sequence);` before `let parts = …`; the parts line becomes `let parts = std::iter::once(value.subject.kind.name()).chain(subject_local.split('.')).chain(std::iter::once(sequence.as_str())).collect::<Vec<_>>();`. The tuple line `(field, subject_root, local(&key_field, &parts)?)` is **byte-identical** (M3 anchors it). |
+| `:710-713` | Stewardship arm: `org_repo_text("stewardship.repo", &value.repo.0)?; let sequence = format!("n{}", value.sequence);` then `local(&key_field, &[&key_segment(&value.repo.0), &sequence])`. No validation of `assigned_on` here. |
+| `:937-941` | Resolution sample gains `sequence: 1`; expected key `format!("{CAMPAIGN}:resolution:question.Q1.n1")`. |
+| `:948-951` | Stewardship sample gains `sequence: 1`; expected key `format!("{INSTANCE}:stewardship:GameCult_-Epiphany.n1")`. |
+| `:1251` | `ruling.R8` → `ruling.R8.n1`. |
+| `:1270` | `question.Q1` → `question.Q1.n1`. `:1272` (`{CAMPAIGN}:resolution:R8` validates as well-formed grammar) unchanged; `:1274-1284` refused list unchanged. |
+| `:1296` | `campaign.self` → `campaign.self.n1`. |
+| `:1413`, `:1428`, `:1432` | Stewardship keys gain `.n1`. `:1436-1441` (no org) and `:1443-1452` (60-byte name still refused, now at 73 bytes) unchanged. |
+| `:1530` | The nested probe's subject id: `question.Q1` → `question.Q1.n1` (a real resolution key; the key composed is `resolution.question.Q1.n1.n1`). |
+| `:1616-1620` | `campaign.self` → `campaign.self.n1` in both the key and the read-back tuple. |
+| `:1824-1831` | Doc comment: the new arithmetic and depths (four for both fixtures at 64). |
+| `:1840` | Expected `resolution.question.Q1.n1.n1`. |
+| `:1841-1843` | Recovery: `let (subject_kind, rest) = local.split_once('.')`; `let (subject_local, _sequence) = rest.rsplit_once('.')`; assert `format!("{root}:{subject_kind}:{subject_local}") == inner`. |
+| `:1846` | `let nesting = "resolution.".len() + ".n1".len();` The loop and its two assertions are otherwise unchanged; `deepest` is still derived from `LOCAL_MAX`. |
+| `:1886-1912` | The stewardship boundary: `let stewardship_rest = "GameCult_-".len() + ".n1".len();` and `stewarded(64 - stewardship_rest)`, `stewarded(65 - stewardship_rest)`. Comment says the local is `<repo escaped>.n<N>`. The hand-off half is untouched. |
+| tests, after `:1938` | Three new tests, under Verification. No sample is added, so every `samples().remove(N)` index is unchanged. |
+
+`tools/eureka-cut6b-mutations.psd1:38-39` (M2): `Old` becomes the new parts
+line above; `New` becomes `let parts = subject_local.split('.').chain(std::iter::once(sequence.as_str())).collect::<Vec<_>>();`
+(the kind dropped, the sequence kept, so the mutant still compiles and still
+keys `question.Q1` and `ruling.Q1` to one key, which
+`a_resolution_names_its_subjects_kind` kills as before). No other 6b, 6c, 8e
+or D entry anchors a line this cut touches (read: M1, M3-M6, S2, S4, S5, N3,
+N6-N10, X1, X11 anchor `local`, `key_segment`, `pipeline_id` and the campaign
+arm; 6c anchors `ResolutionOutcome`'s impl, `MutationRecord`, `VerdictClaim`
+and the estimate literal).
+
+`schemas/cultnet/`: **exactly two files regenerate.**
+`epiphany.pipeline.resolution.v1.schema.json`: `properties` gains
+`"sequence": { "format": "uint32", "minimum": 0, "type": "integer" }` (the
+shape `revision` already has in `epiphany.pipeline.target.v1.schema.json:101-105`)
+and `required` (`:219-224`) gains `"sequence"` after `"subject"`.
+`epiphany.pipeline.stewardship.v1.schema.json`: the same property, and
+`required` (`:37-42`) gains `"sequence"` after `"repo"`. Derived, never
+hand-written: `pipeline_published_schemas_match_derivation` writes the
+derivation to a per-run temp directory and names it; copy from there.
+`epiphany.pipeline.hand_off.v1.schema.json` is **byte-identical**: no field
+moves on `PipelineHandOff`, and keys are not in schemas. The other ten and
+`index.json` (no hashes) are byte-identical. **No epoch moves.** Honesty
+about "additive": the epoch constant's doc comment (`:660-666`) says additive
+means "a new named field with a serde default", and neither `sequence` has
+one — a default of `0` would key a document to `n0`, which admission refuses,
+so the default would be a lie.
+This lands without a bump on the same ground Cut 6c's four required fields
+did: no store is written at this epoch and no reader is pinned to the file
+(Huginn pins the crate rev, not the schema). Recorded under Findings as the
+rule the campaign will owe an epoch to once a mind exists.
+
+`git diff --stat b4b17fc -- schemas/cultnet/` names exactly the two files.
+
+### Authority map
+
+- **Owner:** `pipeline_key` (`:687`), through `local`, for both keys. Unchanged
+  owner; changed inputs.
+- **Inputs:** the document's own fields, now including `resolution.sequence`
+  and `stewardship.sequence`. `stewardship.assigned_on` is **not** a key
+  input. No clock, store, registry or counter. A sequence is a field the
+  writer sets, never derived here.
+- **Outputs:** one `String` or a `PipelineRefusal` naming the field
+  (`resolution.key`, `stewardship.key`, `stewardship.repo`).
+- **Derived state:** the key, never stored. The history of a subject is a
+  key prefix, not a list anything maintains. In-force status, the sequence
+  rule, the withdrawal chain and the single-in-force-stewardship rule are
+  admission's, computed at rule time, never stored (Cut 8/9), and are **not
+  in this crate**.
+- **Forbidden writers:** the leaf may not check either `sequence` against
+  anything (not `> 0`, not a gap), may not refuse a nested resolution, may
+  not decide which stewardship is in force, may not put `assigned_on` (or any
+  date) into the stewardship key, and may not parse a sequence back out of a
+  key. `pipeline_id` gains no arm. Nothing may put a sequence anywhere but
+  last. Admission (Huginn) may not set or rewrite `sequence` on a submitted
+  document; it computes it only for the writes it derives.
+- **Shared paths:** the four grammar paths of 6b, unchanged:
+  `pipeline_key`, `pipeline_id`, `PipelineRef::validate`,
+  `validate_pipeline_write_envelope`. Huginn's `admit` and `admit_prepared`
+  converge before A1 and see the new keys through A3 with no new code.
+- **Deletion line:** none in the leaf. In the follow-up: `refuse_collisions`'s
+  `Resolution` arm and the matrix's Q17 A default go before any new rule is
+  added.
+
+### Verification
+
+**Builds.** `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex`, path-list
+baseline before and after. `cargo check -p epiphany-pipeline --lib --tests`;
+`cargo test -p epiphany-pipeline --lib` (28 existing + 3 = **31 tests**, 0
+warnings); `cargo check -p epiphany-core --lib --tests` (untouched; `cargo
+tree --workspace -i epiphany-pipeline -e normal,build,dev` lists the leaf
+alone, map correction 41, so no recompile is legitimate). Host = target =
+workstation; the leaf has no platform code.
+
+Baseline probed this pass in a detached worktree at `b4b17fc` under the
+scratchpad: 28 passed, 0 failed, 15 s wall with warm rlibs; worktree removed.
+
+**Tests.** Existing twenty-eight unchanged in name; assertions unchanged
+except the key-shape moves named per line above.
+
+| Test | Rule it pins |
+|---|---|
+| `a_subject_keeps_every_resolution_it_had` | Q17 B in the key: two resolutions of `question:Q1` with `sequence` 1 and 2 key to `…question.Q1.n1` and `…n2`, `assert_ne`; each reads back through `pipeline_id` with the local's last part `n<sequence>`; the same document with `sequence` 1 under `Answered` and `Withdrawn` keys once (outcome-invariance holds per sequence). Stated limits: `sequence: 0` composes `n0` and `u32::MAX` composes `n4294967295` (21-byte local under `ruling.A`); the leaf refuses neither, admission does. |
+| `a_subjects_resolutions_share_a_prefix_no_other_key_has` | D2: over the keys of `Q1` n1..n3, `Q10` n1, `ruling:Q1` n1, the campaign-root resolution n1, and the withdrawal of `Q1.n1` (`resolution.question.Q1.n1.n1`), `starts_with("{CAMPAIGN}:resolution:question.Q1.n")` selects exactly the three. Pinned as a string property, which is what a prefix query is. |
+| `a_repo_keeps_every_stewardship_it_had` | Q18 A + Q20 A in the key: one repo with `sequence` 1 and 2 keys to `…GameCult_-Epiphany.n1` and `…n2`, `assert_ne`; each reads back through `pipeline_id` with the last part `n<sequence>`; the same document with `sequence` 1 on `2026-09-15` and on `2026-09-16` keys **once** (date-invariance: `assigned_on` is a field, not a key part); over the keys of `GameCult/Epiphany` n1..n2, `GameCult/Epiphany_thing` n1 and `GameCult/Huginn` n1, `starts_with("{INSTANCE}:stewardship:GameCult_-Epiphany.n")` selects exactly the two. Stated limit: `sequence: 0` composes `n0`; the leaf refuses nothing on the value. |
+
+**Negative greps over `epiphany-pipeline/src`:** `rg -n "sequence"` shows the
+two fields, the two arms, docs and tests and **no** `if`, `match`, `==`, `>`
+or `+ 1` on either outside `tests`; `rg -n "assigned_on" -- src/lib.rs`
+shows the field, the samples, the derived stewardship nowhere (the leaf
+derives nothing) and **no** occurrence inside `pipeline_key`; `rg -n "match kind|declared_kind|KeyParts"` empty;
+`rg -n "fn pipeline_id" -A 20` shows no change (`git diff b4b17fc --
+epiphany-pipeline/src/lib.rs` has no hunk in `:572-599`); `git diff --stat
+b4b17fc -- schemas/cultnet/` names exactly two files; `rg -n '"sequence"'
+schemas/cultnet/epiphany.pipeline.{resolution,stewardship}.v1.schema.json`
+matches twice in each (property and required) and `rg -n '"sequence"'
+schemas/cultnet/epiphany.pipeline.hand_off.v1.schema.json` is empty;
+`rg -n "lease|expiry|returns_to|intent"` empty.
+
+**Suites that must still kill every entry:** `eureka-cut6b-mutations.psd1`
+(seventeen entries, M2 re-anchored), `eureka-cut6c-mutations.psd1` (M16-M22),
+`eureka-cut8-epiphany-mutations.psd1` (E1-E3, D1-D2), `eureka-cut5-`, `eureka-cut6-`
+if still run per the harness header, and the new `eureka-cut6d-mutations.psd1`.
+All through `tools/eureka-mutations.ps1` with M0 green.
+
+#### Mutations, `tools/eureka-cut6d-mutations.psd1`
+
+Each restores the old permissiveness of the shape it pins. Anchors are
+content Hands lands, matched exactly once.
+
+| # | Rule | Mutation, exactly | Killed by |
+|---|---|---|---|
+| M23 | A subject's resolutions are distinct records | Resolution arm: `.chain(std::iter::once(sequence.as_str()))` → removed (the old one-per-subject key) | `a_subject_keeps_every_resolution_it_had` (n1 and n2 key equal); collaterally every moved sample key |
+| M24 | A repo's stewardships on a mind are distinct records | Stewardship arm: `&[&key_segment(&value.repo.0), &sequence]` → `&[&key_segment(&value.repo.0)]` (the old one-per-repo key) | `a_repo_keeps_every_stewardship_it_had` (n1 and n2 key equal); collaterally every moved stewardship key |
+| M25 | The stewardship sequence is the last part | Stewardship arm: `&[&key_segment(&value.repo.0), &sequence]` → `&[&sequence, &key_segment(&value.repo.0)]` | the same test's prefix assertion (`n1.GameCult_-Epiphany` leaves the prefix) |
+| M26 | The sequence is the last part | Resolution arm: sequence chained **before** the subject local (`once(kind).chain(once(sequence)).chain(local parts)`) | `a_subjects_resolutions_share_a_prefix_no_other_key_has` (`question.n1.Q1` leaves the prefix) |
+| M27 | The nested subject is recovered whole, sequence stripped | In the resolution arm, `subject_local.split('.')` → `subject_local.rsplit_once('.').map_or(subject_local, \|(head, _)\| head).split('.')` (drop the subject's own sequence when nesting) | `a_resolution_of_a_resolution_reads_back` (the recovered subject is `question.Q1`, not the inner key) and `every_key_has_exactly_three_segments`'s nested probe |
+
+Stated limits: the `n` marker is pinned only by the sample-key equalities in
+`keys_are_derived_and_mismatch_refuses` and the two prefix literals, a
+fixture pin like 6c's M21; a marker change is a spelling change and no
+mutation restores a permissiveness by it. The `u32` type has no runtime
+mutation. Date-invariance has no mutation of its own: putting `assigned_on`
+into the key is not a permissiveness the old code had, and M24 already pins
+that the second part is the sequence and nothing else (a mutant that appends
+the date as a third part dies on M24's test's `assert_eq` of the local's
+part count, which Hands asserts as `2`).
+
+**Operator checks before landing:** none. Q19 and Q20 are ruled.
+
+### The Cut 8 follow-up commit this cut implies
+
+Huginn `eureka/memory-organ`, one commit after **`30daff8`** (the fix batch
+landed as `acd32f3`, which restored the `resolution → Withdrawn` matrix row
+and flipped the nested assertions, and `30daff8`, entries H21-H39; anchors
+below are `file:line` at `30daff8`). Pinned rev moves from `a65c6420` to this
+cut's landing commit, which also carries `b4b17fc`'s derives: the
+`#[serde(remote)]` mirror of `PipelineRefusal` in `refusal.rs` can come out
+then, but that is Cut 10's stated work and not this commit's.
+
+| File | Change |
+|---|---|
+| `crates/huginn-mind/Cargo.toml:15` | `rev` → the 6d landing commit. |
+| `Cargo.lock` | the `epiphany-pipeline` source line. |
+| `src/refusal.rs` | `ResolutionOutOfSequence { subject: String, expected: u32, actual: u32 }`, `StewardshipOutOfSequence { repo: String, expected: u32, actual: u32 }`, `AlreadyStewarded { repo: String }`. `AlreadyResolved { subject }` kept. The two `OutOfSequence` variants are the sequence rule for each kind; `AlreadyResolved`/`AlreadyStewarded` are the in-force half. |
+| `src/admission.rs:23-26` | Module doc: "in force" is recursive: no resolution names the document that is itself in force. |
+| `:248-267` | `resolutions()` yields `(key, &PipelineResolution)`; `in_force_unless` becomes the recursion of D4, with `own` taking the whole `&PipelineResolution` (content identity) rather than the outcome. Add `latest_resolution(subject) -> u32` and `latest_stewardship(mind, repo) -> u32` over image ∪ batch (0 when none). |
+| `:271-284` | `stewardship_of` unchanged in shape; its result is now unique by the `AlreadyStewarded` rule. |
+| `:417-458` | `derive`: the ruling's `Answered` resolution and the source side's `Withdrawn` resolution each get `sequence: latest_resolution(subject) + 1`; the receiving side's stewardship gets `sequence: latest_stewardship(mind, repo) + 1` with `assigned_on: handed_on` as before. Keys follow from the leaf, no other code. |
+| `:591`, new `resolution_rule` steps | Before the matrix: `sequence` rule (`ResolutionOutOfSequence`), then in-force (`AlreadyResolved`). After the matrix, Q19 A: a subject of kind `Resolution` whose own subject is a `Resolution` → `IncompatibleResolution`. |
+| `:598` | Stewardship row, mirroring the resolution row: `sequence == latest_stewardship + 1` else `StewardshipOutOfSequence`; then no in-force stewardship of `(mind, repo)` other than this document, else `AlreadyStewarded`. |
+| `:654-680` | `matrix`: already restored at `acd32f3`; unchanged. |
+| `:724-733` | `refuse_collisions`: delete the `Resolution` arm (`:727-729`); one refusal, `IdentityCollision`. |
+| `src/fixtures.rs:100-107`, `:263-270` | `stewardship(instance, repo)` sets `sequence: 1`; add `stewardship_n(instance, repo, sequence)`; `resolution(subject, outcome)` sets `sequence: 1`; add `resolution_n(subject, sequence, outcome)`. |
+| Tests moving | `two_minds_in_one_state_root_stay_separate:800`, `the_resolution_matrix_is_admissions:1024,:1042`, `a_ruling_answering_a_question…:1132,:1135`, `a_hand_off_derives_this_minds_side_only:1427,:1448`, `id_of:1474-1477` (appends `.n1`): every `…:stewardship:GameCult_-Epiphany` gains `.n1` and every `…:resolution:question.Q1` gains `.n1`. Fixtures in `:52-116` of the landed batch (H21-H39's tests) that spell either literal move the same way; grep `stewardship:GameCult\|resolution\", \"question.Q1\"` after `30daff8` and re-anchor. |
+| `subject_resolves_at_most_once:977` | Renamed `a_subject_with_a_resolution_in_force_refuses_another`: second resolution of `Q1` at `sequence: 2` → `AlreadyResolved`; at `sequence: 1` → `ResolutionOutOfSequence { expected: 2, actual: 1 }`; the answering ruling → `AlreadyResolved` (unchanged). |
+| new `a_withdrawn_resolution_reopens_its_subject_and_stays_readable` | `Q1` resolved n1; withdrawal of `…question.Q1.n1` (`Withdrawn`) lands; `Q1` resolved n2 lands; `get` of n1 still returns it; a withdrawal of the withdrawal → `IncompatibleResolution` (Q19 A); a third resolution at n3 while n2 stands → `AlreadyResolved`; a second answering ruling after the withdrawal derives `…question.Q1.n2`. |
+| new `a_repo_is_stewarded_once_at_a_time_and_again_after_a_transfer` | second stewardship of `REPO` at `sequence: 2` while n1 stands → `AlreadyStewarded`; at `sequence: 1` → `StewardshipOutOfSequence { expected: 2, actual: 1 }`; after a hand-off away, a hand-off back (swapped instances) lands and derives `<mind>:stewardship:GameCult_-Epiphany.n2` with `assigned_on` the second `handed_on`; `envelope` of n1 still present; the source mind's derived withdrawal is `…:resolution:stewardship.GameCult_-Epiphany.n1.n1`. |
+| `tools/eureka-cut8-mutations.psd1` | H14's expectation stands (`IdentityCollision` on a ruling). Any H21-H39 entry anchoring `stewardship_of`, `derive` or `refuse_collisions` lines re-anchored. New: H40 resolution sequence rule → `true`; H41 in-force non-recursive (a withdrawn resolution still counts) → the reopen test; H42 stewardship sequence rule → `true` → the stewardship test's `expected: 2, actual: 1` case; H43 `AlreadyStewarded` dropped → the same test; H44 Q19 cap dropped → the reopen test's withdrawal-of-withdrawal; H45 `derive` uses `sequence: 1` for every derived write → the reopen test's second ruling and the transfer test's `n2`. |
+| `README.md`, `AGENTS.md` | unchanged; Cut 12's map section corrected by Self ("superseding" → "withdrawal"). |
+
+Estimate: +about 260 lines in Huginn (rules 50, refusals 9, fixtures 16,
+tests 150, entries 48), −about 3 (the A10 arm). One build, `cargo test -p
+huginn-mind --lib`, plus the cut-8 suite through the harness with `-Repo`.
+
+### Subtraction estimate
+
+Epiphany, this cut: source outside tests +about 12 (two fields, two
+`format!("n{}")` lines, two chained parts, four doc lines), −0; tests +about
+100 (three tests) and about 25 lines of moved literals; two schema files
++5/−0 each; one 6b entry re-anchored. Kinds, dependencies, targets, formats,
+epoch, `index.json`: zero. Liability retired: the one key that could not
+name the second closure of a subject, and the one key that could not name
+the second stewardship of a repo — both of which Soul found as medium
+defects against Cut 8, and both of which would have cost a stored-document
+re-key the moment Yggdrasil's mind held a resolution. Also retired before it
+ever shipped: the date-keyed stewardship's same-day collision.
+
+Huginn, the follow-up: +260/−3 as above. Net across both: about +380, all
+tests and rules for a capability the operator asked for by name.
+
+### Build budget
+
+Epiphany: `epiphany-pipeline` lib + tests only; `epiphany-core` check, no
+rebuild expected. Debug, workstation host = target, no features, no
+codegen. Footprint delta: within the noise of a warm leaf rebuild (the probe
+this pass rebuilt the leaf's test binary in 15 s); expected +0 to +40 paths.
+Huginn follow-up: `huginn-mind` lib + tests; the leaf rlib rebuilds at the
+new rev (+about 30 paths). Retention: the shared target dir is the operator's;
+nothing deleted.
+
+### Operator questions
+
+None open. Two were raised by this spec and ruled the same day:
+
+- **Q19. Can a withdrawal be withdrawn? Ruled A, 2026-09-16.** A resolution
+  is admissible with `Withdrawn` only when its subject's own subject is not a
+  resolution (chain depth two at admission). To reinstate a withdrawn
+  closure, resolve the subject again at `n<N+1>`. History stays append-only,
+  "the latest not withdrawn" has one reading, and the in-force recursion
+  never re-raises an earlier record over a later one. The rejected B (any
+  depth; in-force is "the latest among the not-withdrawn") could express a
+  standing record that is not in force. H44's mutant is exactly B.
+- **Q20. Stewardship keyed by date or by sequence? Ruled A (sequence),
+  2026-09-16.** `<instance>:stewardship:<repo escaped>.n<N>`, writer-set
+  `sequence: u32` checked by admission as previous plus one, exactly as
+  resolutions; `assigned_on` stays a field. The first draft's date key was
+  rejected for the same-day collision and because a date orders nothing the
+  sequence does not.
+
+The Q18 correction (transfer, not lease) raised nothing new: the derivations
+were already symmetric in the source.
+
+### Findings not assignable to this cut
+
+- **"Additive" has two definitions in the repo.** The epoch constant's doc
+  (`lib.rs:660-666`) says a new field is additive with a serde default; the
+  campaign's practice (6c's four required fields, this cut's `sequence`) is
+  "additive while no store is written at the epoch". Both are right today and
+  will disagree the day Yggdrasil holds a mind. Owner: the map's ruling 8
+  text and the constant's doc; not this cut's.
+- **Cut 12's spec says "the superseding `stewardship` on the source side"**
+  (map `:2707-2709`); Cut 8 landed a `Withdrawn` resolution there
+  (`admission.rs:437-442`). Stale before this cut; Self's to correct.
+- **Cut 8's map text at A10** ("a subject resolves at most once because its
+  resolution key is outcome-invariant", `:2344`) and the stewardship row
+  ("the key collides, A10", `:2362`) both describe the shape this cut retires.
+  Self's, at the follow-up's landing.
+- **Cut 9's `open_items_and_rulings_in_force_follow_resolutions`** needs the
+  recursive derivation and a reopened-subject fixture, or it will pin the
+  non-recursive defect as correct. Cut 9's spec should say so before Hands
+  reads it.
+- **Same-day granularity survives only in the hand-off key** (`:721`,
+  `<from>:hand_off:<to>.<repo>.<handed_on>`): two hand-offs in one direction
+  for one repo on one day share a key. The stewardship half of this limit is
+  retired by Q20 A. If the Odin-swarm workflow ever transfers a repo twice
+  in a day in one direction, the hand-off key wants the same treatment; not
+  asked, not this cut's, recorded.
+- **`Date` derives `Ord` on its string** (`:212`), correct for `YYYY-MM-DD`
+  only because `Bounded::validate` enforces the shape. Nothing orders dates
+  after Q20; the sequence orders.
+
+### Pinned HEADs
+
+- Epiphany `codex/eureka-pipeline-state` at `542dc184` (map only since
+  `87d3420c`: `993600fd`, `76167f0a`, `542dc184`); `epiphany-pipeline/src/lib.rs`,
+  `schemas/cultnet/` and `tools/` byte-identical to `b4b17fc`. Tree clean.
+- Huginn `eureka/memory-organ` at `30daff8`, tree clean. The fix batch
+  landed as `acd32f3` (matrix row `resolution → Withdrawn` restored, nested
+  assertions flipped) and `30daff8` (nineteen rules pinned, entries
+  H21-H39). Follow-up anchors above are against `30daff8`. Pin in
+  `crates/huginn-mind/Cargo.toml:15` is still `a65c6420`.
+- CultLib untouched and unread this pass (Soul is in that tree).
+- Probe artifacts: a detached worktree `scratchpad/cut6d-wt` at `b4b17fc` ran
+  `cargo test -p epiphany-pipeline --lib` once (28 passed) under the shared
+  target dir and was removed; Huginn's sources at `1cfa81d` were copied to
+  `scratchpad/huginn-*-1cfa81d.rs` by `git show` and read there while the
+  batch was in flight, then the landed `30daff8` was grepped for every site
+  the follow-up anchors.
+
+## Cut 7. Retire Huginn's TypeScript body
+
+- **Repo/branch:** Huginn `main` at `91b7fcf`, on a new branch
+  `eureka/memory-organ`. No dependency on the Epiphany cuts.
+
+**Deletes first.**
+
+| Path | Lines | Note |
+|---|---:|---|
+| `src/cli.ts` | 23 | the `huginn <file>` CLI |
+| `src/huginn-eve-dsl.ts` | 57 | `buildHuginnEveDsl` |
+| `src/index.ts` | 8 | package entry |
+| `dist/` (9 tracked files) | 88 | tracked build output |
+| `package.json` | 35 | `@gamecult/huginn` |
+| `package-lock.json` | 70 | |
+| `tsconfig.json` | 26 | |
+
+Total **307 tracked lines and 16 files.**
+
+**This is safe to delete outright** because nothing consumes it (R12). The
+census's one hesitation — `src/index.ts:2` re-exporting `inspectCultCacheBytes`
+— is resolved: a grep of every `package.json` under `F:\Projects` finds no
+dependant.
+
+**Nothing needs to move to CultCache Studio.** Ruling 17 says generic `.cc`
+inspection *belongs* to CultCache Studio, and CultCache Studio already exists
+and already inspects and edits `.cc` state (R14). `buildHuginnEveDsl` is a
+57-line string builder over CultLib's `inspectCultCacheBytes`; CultLib owns the
+inspector, and the Studio owns the presentation. Porting a stale text projection
+into a working editor would be additive work that buys nothing. **Record the
+retirement; move no code.** If the operator later wants a headless `.cc`-to-Eve
+projection, it is a CultLib cut with its own consumer.
+
+**Eve's fixture and catalog entry stay, with a provenance correction.**
+
+- `Eve/web/fixtures/huginn-cc-surface.eve` and its `.conformance.json` are
+  conformance material for Eve's own lowering path, exercised by
+  `docs/renderer-parity.md:58`. They do not import or execute Huginn (R13).
+  Deleting them would remove an Eve test to tidy another repo.
+- But the conformance file's `"ownerRepo": "Huginn"` and
+  `"exitCriteria": "Move to Huginn when .cc schema inspection ... become runtime-owned"`
+  are now false: Huginn will never own that surface. **Cut 7 changes those two
+  fields** — `ownerRepo` to `Eve`, `exitCriteria` to a sentence saying the
+  surface is a retired-projection fixture retained for lowering conformance —
+  and adds one line to `docs/renderer-parity.md:58` marking it as such.
+- `Eve/web/local-provider-catalog.json:72-83` keeps its entry; it already
+  declares `"freshness": {"state": "fixture"}` and points at the file, not the
+  package. No change.
+
+**Huginn's legacy `.voidbot` Persona state is out of scope and stays untouched.**
+Recorded, not solved, per the target's Not-in-scope list:
+
+- `.voidbot/state/huginn.cc` (35,297 bytes) holds eight legacy `void.*` document
+  types and zero `gamecult.persona_state.v0` documents, and identifies its
+  jurisdiction as `repo:CultCacheTS`.
+- `.voidbot/voice/identity.json` says the Persona and repo are Huginn, and
+  carries the lost path `E:\Projects\Huginn`.
+- These two disagree about who the Persona is. That contradiction predates this
+  campaign, survives it, and belongs to whoever owns the portable-Persona
+  migration. **Hands does not touch `.voidbot/` in any cut.** Recorded as FU-1.
+
+**Adds.** An empty Rust workspace: root `Cargo.toml` with
+`members = ["crates/huginn-mind", "crates/huginn-daemon", "crates/eureka-state"]`,
+`resolver = "3"`, `[workspace.package] edition = "2024"`, `license = "MIT"`,
+`publish = false`, following Odin's layout. `.gitignore` gains `target/` and
+drops the four stale entries the census flagged (`dist-test/`, `dist-inspector/`,
+`release/`, `release-inspector/`, `.gitignore:2-5`).
+
+**Docs.** `README.md` (74 lines) and `AGENTS.md` (81 lines) are rewritten, not
+deleted: Huginn is the memory organ that owns instance minds. Both currently
+describe the `E:` drive body and deleted EpiphanyAgent commands. The rewrite
+states the new invariant, the CultNet surface, the Qdrant dependency, and that
+`.cc` inspection is CultCache Studio's.
+
+**Authority map.**
+
+- **Owner:** Huginn becomes the memory organ. Before this cut it owned a
+  projection; after it, it owns state.
+- **Inputs:** none yet; Cut 8 adds them.
+- **Outputs:** none yet.
+- **Derived state:** none.
+- **Forbidden writers:** after this cut nothing in Huginn emits Eve DSL, reads
+  `.cc` for inspection, or publishes an npm package.
+- **Shared paths:** Eve's fixture is now Eve's alone.
+- **Deletion line:** the table above, plus the two corrected Eve fields.
+
+**Verification.**
+
+- **Builds:** `cargo check --workspace` in Huginn succeeds on an empty
+  workspace (three stub crates with empty `lib.rs`/`main.rs`).
+- **Negative greps:** `rg -n "buildHuginnEveDsl|@gamecult/huginn|cultcache-ts" F:\Projects\Huginn`
+  empty; `rg -n -F 'E:\Projects' F:\Projects\Huginn --glob '!.voidbot/**'`
+  empty. *(Corrected after Soul: the original regex form was a ripgrep
+  parse error, not an empty result.)*
+- **Unchanged check:** `.voidbot/` is byte-identical.
+  `git diff --stat 91b7fcf -- .voidbot` is empty.
+- **Eve:** its renderer-parity fixture check still passes.
+- **Operator:** confirm `npm` publication of `@gamecult/huginn` is not expected
+  to continue. The package was never published to a registry consumer this map
+  can find, but unpublishing is the operator's call.
+  **Ruled 2026-09-16:** not publishing, nothing to unpublish. The operator
+  first said npm was unreachable ("our entire subnet is blocked"), then
+  corrected it the same day: "apparently that was true yesterday, but I was
+  able to get to npm signup just now, so we're not actually blocked on
+  publishing. Still for a later pass." So registry publication is deferred
+  by choice, not impossible; the QUIC map's Q5 stays on C for that campaign
+  on that reason. Huginn itself publishes nothing either way.
+
+**Subtraction ledger:** −307 lines, −16 files, −1 npm package, −1 CLI
+entrypoint, −1 sibling `file:` dependency. +about 30 lines of workspace
+scaffolding. Two Eve fields corrected.
+
+**Landed 2026-09-16** at Huginn `1320fc4`, `f63c0f2`, `e20c786` on
+`eureka/memory-organ` and Eve `e777e4c` on `main`. Hands verified the
+spec's Body claims before deleting: no `package.json` under `F:\Projects`
+depends on `@gamecult/huginn` but its own; the Eve fixture neither imports
+nor executes Huginn; the catalog entry needs no change. Corrections:
+
+25. **The deletes table sums to 15 files and 315 lines, not 16 and 307.** The
+    seven paths were unambiguous, so Hands deleted exactly those; `dist/` is
+    96 lines by numstat, not 88. Spec arithmetic, not a Body fault.
+26. **`Cargo.lock` is committed**, following Odin's layout, though the spec's
+    adds did not list it. Kept.
+27. **`.gitignore` keeps `node_modules/`**, which the spec did not name and
+    which is now stale too. One-line follow-up.
+28. **The conformance fixture also carries `"splitTarget": "Huginn"`.** The
+    spec named two fields; the third is as false as the two. Soul is asked
+    whether anything reads it.
+
+Verification: `cargo check --workspace` clean (three stub crates, zero
+dependencies); both negative greps empty; `.voidbot` diff empty; Eve's four
+`web/*.test.mjs` pass (13 tests), the fixture compiles through
+`compileEveDsl`, and the edited conformance JSON validates against Eve's
+schema. Huginn net +118 / −444 across 26 files; README 74 → 47, AGENTS
+81 → 48. No mutation suite: nothing here is a rule a unit test pins.
+
+Consumer grep over the whole tree found no live consumer of the package, CLI
+or DSL builder. The surface id `cultcache.huginn.inspector` survives in
+Ghostlight's vendored Eve copy and the `Eve-aetheria-authority` worktree,
+both of which still say `"ownerRepo": "Huginn"` until re-vendored, and in
+VoidBot's provider-advertisement prose describing the old inspection role.
+Recorded as FU-7: re-vendor, and retire the VoidBot hand-off prose when
+VoidBot's Persona doc is next touched. (First written as FU-2, which was
+already taken; Soul caught the collision.)
+
+**Soul on Cut 7** (default model) held the deletion line (`.voidbot` tree
+hash identical at both ends, so no mode or EOL flip is possible), the
+no-consumer claim over every manifest, lockfile, import string and runbook
+under `F:\Projects`, the workspace (`cargo 1.95.0`; `resolver = "3"` and
+edition 2024 both satisfied; `--locked` clean), and every Eve check. Found:
+
+- **A second `ownerRepo` authority disagrees with the first.**
+  `EveConformance/tools/parity/parity-manifest.json:466` still says Huginn,
+  and `run-parity.mjs:826` compares it to Eve's metadata, so the parity check
+  for this fixture now fails. The spec named only Eve's two fields; the
+  reader lives in a third repo. Nobody would have seen it, because the
+  harness cannot reach a report anyway: the manifest wants an Aetheria
+  conformance file that has not existed since July. Pre-existing hole,
+  recorded here, not this cut's.
+- **Three more Huginn-naming fields** in the fixture material: `purpose`,
+  `splitTarget`, and the `.eve` file's first-line comment. No programmatic
+  reader; four consecutive fields that contradict each other.
+- **AGENTS.md describes Cuts 8-10 in the present tense** with no stub
+  caveat; README carries one at `:33-35`. AGENTS is the surface an agent
+  rehydrates from. The spec asked for that content, so it is a tension
+  between the spec and the "describe the live system" invariant.
+- **The spec's second negative grep is unrunnable as written**: the escaped
+  backslashes are a Unicode-property error to ripgrep. Corrected below to a
+  fixed-string search.
+- **Committed blobs carry CRLF, including `Cargo.lock`**; no
+  `.gitattributes`; the predecessor blobs and Odin's lock are CRLF too, so
+  house pattern, not a deviation. The first cut that adds a dependency will
+  rewrite the lock as LF and produce a whole-file diff. Recorded.
+
+**The Cut 7 fix batch landed** at EveConformance `048ea2f` (manifest
+`ownerRepo` → Eve; the isolated `run-parity.mjs:824-833` comparison passes),
+Eve `167a2d3` (`purpose` and the `.eve` comment reworded; `splitTarget`
+omitted, because the schema declares it an optional string, five Eve-owned
+fixtures already omit it, and no reader consumes it on fixture metadata;
+schema validation true, 13 tests pass, the fixture compiles), and Huginn
+`4094e68` (AGENTS carries the stub caveat; the "does not" list is one
+sentence naming Studio). Three one-line-class edits with their checks
+pasted; no separate Soul pass. The next Soul on Huginn, at Cut 8, rereads
+AGENTS against the Body. **Cut 7 is closed.**
+
+Operator ruling on the npm check: not publishing, nothing to unpublish, and
+npmjs is unreachable from this network (see Verification above).
+
+## Cut 8. `huginn-mind`: storage, identity and admission
+
+Refreshed by Imagination 2026-09-16 against the landed key grammar and the
+Cut 6c shapes; the first issue, written against Epiphany `5fb4eb22` and
+Huginn `91b7fcf`, was stale in every anchor and is replaced whole.
+
+### Pins
+
+Every `file:line` below is against these trees, all verified clean and pushed
+this pass.
+
+| Repo | Branch | HEAD | Notes |
+|---|---|---|---|
+| Epiphany | `codex/eureka-pipeline-state` | `ca7e230c` | in sync with `origin`. `epiphany-pipeline/src/lib.rs` last moved at `dddf9ede` (1,937 lines, 26 tests); anchors are against that file at that commit, which is byte-identical at `ca7e230c`. |
+| Huginn | `eureka/memory-organ` | `4094e68` | in sync with `origin`. Three stub crates, zero dependencies, `Cargo.lock` holds only the three members (CRLF, no `.gitattributes`). |
+| CultLib | `main` | `4a2fdaf` | `git diff --stat a0813c6 4a2fdaf -- packages/cultcache-rs packages/cultnet-rs packages/cultmesh-rs` is **empty**: the three Rust runtimes are byte-identical at the pin Epiphany uses and at `main`. Huginn pins `a0813c6eed24d30bf88073ef615b633c77ebfcd6`, the same rev, and must: a second rev of the same git URL is a second `cultcache-rs` package, and `epiphany_pipeline`'s `DatabaseEntry` wrappers would not unify with Huginn's cache. |
+| gamecult-ops | `main` | — | read only for R15 (Qdrant is voidbot's container, `compose/voidbot-retrieval.yggdrasil.yaml`) and the `[[dependencies]]` shape (`Ghostlight/deployment/idunn/recipe.toml:173-187`). Cut 8 names no dependency; that is Cut 14's. |
+
+Body facts the brief asked to verify, not trust:
+
+- **`epiphany-pipeline` has exactly four normal dependencies** (`Cargo.toml:17-21`: `chrono`, `cultcache-rs`, `schemars`, `serde`) and three dev-dependencies (`:23-26`: `anyhow`, `rmp-serde`, `serde_json`). A throwaway crate pinning it by git rev resolved **91 packages, no `epiphany-core`, no Ghostlight, one `cultcache-rs`, `redb 4.3.0`, `schemars 1.2.2`** (probe: `cargo generate-lockfile` in the session scratchpad, no compile). After this cut it has six normal dependencies; see Epiphany half.
+- **`epiphany-core` pins CultLib at `a0813c6`** for `cultcache-rs`, `cultmesh-rs`, `cultnet-rs` (`epiphany-core/Cargo.toml:15-17`; root `Cargo.toml:24-25`). Huginn pins the same rev, above.
+- **Huginn's crates are empty stubs**: `crates/huginn-mind/src/lib.rs` 0 bytes, `crates/huginn-daemon/src/main.rs` is `fn main() {}`, `crates/eureka-state/src/lib.rs` 0 bytes; each `Cargo.toml` has an empty `[dependencies]`.
+- **The receipt logic in `epiphany-core` at HEAD** is `commit_authorized_mind_mutation` (`reasoning_context.rs:1584-1701`, 118 lines), `EpiphanyMindCommitReceipt` and its `validate` (`:543-602`), `EpiphanyMindCommitAuthority` (`:604-616`), `EpiphanyMindCommitOutcome` (`:618-624`), `EpiphanyMindDocumentVersion` (`:159-202`), `mind_commit_receipt_id` (`:1836-1851`), `validate_unique_envelope_identities` (`:1853-1861`), `validate_mind_document_versions` (`:1863-1875`), `current_write_collisions` (`:1877-1893`). **About 260 lines, not the 120 FU-3 names.** Everything but the receipt struct and outcome is `pub(crate)` or private (R10 still holds).
+- **The leaf's write path is test-only.** `PipelineDocument::prepare` (`lib.rs:475-487`), `decode` (`:489-499`), `register_pipeline_document_types` (`:502-511`) and `validate_pipeline_write_envelope` (`:739-757`) are all `#[cfg(test)]` and `pub(crate)`, and the `anyhow`/`CultCache`/`CultCacheEnvelope` imports they need are gated with them (`:32-39`). Their doc comments say "until the organ prepares, decodes and validates them (Cut 8)". **So Cut 8 touches Epiphany**, and the old section's silence on that was wrong. Without this, Huginn would have to re-declare the thirteen `DatabaseEntry` wrappers and their type ids: a second authority over the wire shape.
+- **No epoch constant exists anywhere in code.** `PIPELINE_SCHEMA_EPOCH` died with Cut 4's fix batch (Landed, correction list, "Cut 8 writes them in the organ"). The string `epiphany.pipeline.epoch.v1` survives only in prose (`schemas/cultnet/README.md:41-44`, the map). Ruling 1 makes the epoch a schema fact Epiphany owns; a Huginn-local literal would be the S5 drift shape. It goes back into the leaf as one `pub const` (Epiphany half).
+- **`cultcache-rs` at `a0813c6` offers two redb stores**, both keyed one row per `(type, key)` with a transactional `compare_and_swap_batch` that refuses a replacement whose identity already exists and is not in `expected` (`lib.rs:1098-1150` transient, `:1492-1543` owned). `RedbMessagePackBackingStore` (`:966`) reopens the database per operation; `OwnedRedbMessagePackBackingStore` (`:1340-1445`) holds an fs2 exclusive lock on `<path>.lock`, the file handle and the open database for its lifetime, records the file identity (dev/inode on unix, `GetFileInformationByHandle` on Windows, `:1772-1795`), and clones share that ownership. Both implement `CacheBackingStore` (`:1713`, `:1844`). `CultCache::add_backing_store` gives a type exactly one home store (`:1968-2015`) and `pull_all_backing_stores` refuses an unregistered type (`:2022-2046`).
+- **`cultnet-rs`** (`packages/cultnet-rs`, 0.1.0) is not a Cut 8 dependency and is not read further; R6/R7 carry for Cut 10.
+
+### What changed against the old Cut 8 section
+
+1. **Epiphany is touched.** A small "Epiphany half" lands first: the leaf's prepare/decode/register/validate path stops being `cfg(test)`, `anyhow` and `rmp-serde` become normal dependencies, the epoch constant returns, and the live registrar stops registering the test stand-in. Huginn then pins that commit.
+2. **The store is `OwnedRedbMessagePackBackingStore` at `<state_root>/minds/<instance>/mind.redb`**, not the transient redb store at `mind.cc`. Owned gives the single-writer invariant a mechanism (the lock is held for the daemon's life, so a second opener of the same mind is refused structurally, in or out of process) instead of a sentence. *The mechanism is CultCache's, not redb's: the owned store's exclusive file lock, its file-identity check and the transactional `compare_and_swap_batch` are `cultcache-rs` semantics, in CultLib since the engine's return on 2026-09-03 (`b672fb7`) and pinned across runtimes by the CultCache migration on 2026-09-13/14; redb is the engine under the owned store. Operator correction, 2026-09-16.* `.redb`, not `.cc`: Epiphany selects its backend by extension (`runtime_store_backend.rs:29-34`) and CultCache Studio inspects `cultcache.store.v1` files (P7); a redb file named `.cc` would lie to both.
+3. **The receipt is duplicated, bounded, and smaller than Epiphany's.** No authority enum, no companions, no `invariant_owner`, no `store_id`; provenance is a field on the receipt, not a companion document; the digest excludes provenance so exact replay is idempotent across sessions (old D4's rule, which Epiphany's digest does not give). The moving alternative is costed under "FU-3" and not recommended now.
+4. **The rule set is stated in full** (the old section pointed at "the old D4", which is now in History only through refusal names). `WrongReferenceKind` is gone: references are looked up by `(kind.type_id(), id)`, so a wrong kind is a missing reference. `RepoNotInCampaign` splits into `RepoNotStewarded` (campaign repos against the mind's stewardship, D3 step 5) and `RepoNotInCampaign` (spec/report repo against the campaign).
+5. **`hand_off` is admitted here with its derivations on this mind's side only**; Cut 12 composes the two-mind operation and the import over `admit_prepared`. The old section's `hand_off_derives_stewardship_on_both_sides` moves to Cut 12, where both minds exist.
+6. **The batch and outcome types are `pub` and derive `JsonSchema`** so Cut 10's wire and Cut 13's tools can carry them whichever way Q13 is ruled.
+7. **The mutation suite is an entries file in Huginn run through Epiphany's harness with a `-Repo` parameter** (Q14), not a copied harness.
+8. **Tests: 25, mutations: 20**, replacing the old 16/3. Estimate about +2,100 lines in Huginn and +40/−20 in Epiphany, not +1,400.
+
+### Repo, branch, ordering
+
+- **Epiphany half:** `codex/eureka-pipeline-state`, one commit, pushed before the Huginn half's lock is generated (Cargo fetches the rev from GitHub). Epiphany's remaining stake is schema ownership; this commit is inside that stake, not a new service surface.
+- **Huginn half:** `eureka/memory-organ` from `4094e68`, four commits: (1) `Cargo.toml`, `store.rs`, `mind.rs` with the opener and identity rules; (2) `receipt.rs` and the commit primitive; (3) `admission.rs` and `refusal.rs` with the rule table; (4) `tools/eureka-cut8-mutations.psd1`. Soul can verify per commit; if Hands' attempt runs long, the split point is between (2) and (3), and the map records it as 8a/8b.
+- Depends on Cuts 6c and 7 (both landed). Blocks Cuts 9, 10, 12.
+
+### Deletes first
+
+Epiphany, `epiphany-pipeline/src/lib.rs` at `dddf9ede`:
+
+| Path | Lines | What dies |
+|---|---:|---|
+| `:32-39` | 8 | The two `#[cfg(test)]` gates on `use anyhow::Result;` and `use cultcache_rs::{CultCache, CultCacheEnvelope};` and the four-line comment explaining why they were dev-dependencies. |
+| `:475-479`, `:489-491`, `:502-506`, `:739-743` | 17 | Four `#[cfg(test)]` attributes and the four doc comments that say "test scaffolding until the organ ... (Cut 8)". Replaced by one-line live doc comments. |
+| `:509` | 1 | `cache.register_entry_type::<ForeignDocument>()?;` inside the live registrar. The test stand-in moves to the tests' `schema_cache` (`:977-981`). A live registrar that registers a `cfg(test)` type does not compile un-gated, so this delete is forced, not optional. |
+| `Cargo.toml:23-26` | 2 | `anyhow` and `rmp-serde` leave `[dev-dependencies]`. |
+
+Huginn: nothing; the crate is empty. The *replaced* liability is named: the writer lease, git preconditions and merge tool Cut 4 deleted, and the transient-store/session-lease split the old D3 needed.
+
+### Keeps and moves
+
+- **Keeps, Epiphany:** every kind, type id, field, bound, format, key, `pipeline_key`, `pipeline_id` (stays private; Huginn looks references up by `(type_id, key)` and never parses an id, so it needs no reader), `PipelineRefusal`'s four variants including `ForeignStore` (raised by `decode`, which stays here; D2's "moves to the organ" for this one variant is corrected: the raiser stays, so the variant stays), the twenty-six tests unchanged in name, `ForeignDocument` still `cfg(test)`, the wrappers still `pub(crate)`, `schemas/cultnet/` byte-identical (no kind, field or type id moves; `git diff --stat -- schemas/cultnet/` empty).
+- **Moves, Epiphany:** `anyhow` and `rmp-serde` from dev to normal dependencies (both already in the workspace lock; zero lock change). `register_entry_type::<ForeignDocument>` from the registrar to `schema_cache`.
+- **Keeps, Huginn:** `Cargo.toml` workspace (`:1-11`), `README.md`, `AGENTS.md` (the stub caveat at `AGENTS.md:15-17` and `README.md:33-35` becomes false for `huginn-mind` and is reworded in commit 1 to say which crate is live).
+- **Not moved (FU-3):** `epiphany-core`'s receipt. Moving it to CultLib means a `cultcache-rs` change under an in-flight QUIC campaign at `4a2fdaf`, a new CultLib rev to re-pin in Epiphany (campaign two) and Huginn, a receipt generic over an authority type Epiphany's three-variant enum and Huginn's provenance would both instantiate, and a C# reference-parity question for a helper only Rust uses. Moving it into `epiphany-pipeline` breaks the leaf's own charter (`lib.rs:3-7`: no storage). **Recommendation: duplicate, bounded to one file `receipt.rs` of at most 220 lines, with the digest formula written in its doc comment so a later extraction is mechanical.** FU-3 stands with "a third consumer" as the trigger, and its line count is corrected to about 260 in Epiphany.
+
+### Adds
+
+### Epiphany half, `epiphany-pipeline`
+
+| Add | Owner | Live consumer | Protected invariant | Why not an existing owner |
+|---|---|---|---|---|
+| `pub const PIPELINE_SCHEMA_EPOCH: &str = "epiphany.pipeline.epoch.v1"` | the leaf (ruling 1) | `huginn-mind`'s opener and first write | One epoch string, owned where the schemas are; a breaking bump refuses the old store (Q2, ruling 8) | No constant exists; a Huginn literal is the S5 shape. |
+| `pub fn register_pipeline_document_types(&mut CultCache)` (un-gated, thirteen types only) | the leaf | `Mind::open` | Only the leaf names the wrappers; the organ registers what the leaf publishes and nothing else | The wrappers are `pub(crate)`; this is the one door. |
+| `pub fn PipelineDocument::prepare(&self, &CultCache) -> anyhow::Result<CultCacheEnvelope>` (un-gated) | the leaf | `Mind::admit` | Every stored payload is `[value]` prepared with `prepare_entry_named` and keyed by `pipeline_key` | Same door. |
+| `pub fn PipelineDocument::decode(&CultCacheEnvelope) -> Result<Self, PipelineRefusal>` (un-gated) | the leaf | `Mind::get`, Cut 9's views, Cut 12's import | A decode is type-matched both ways (`ForeignStore` on any other type) | Same door. |
+| `pub fn validate_pipeline_write_envelope(&CultCacheEnvelope) -> Result<(), PipelineRefusal>` (un-gated; return type narrowed from `anyhow::Result<()>`) | the leaf | `Mind::admit_prepared` (Cut 8) and the import replay (Cut 12) | Bounds, formats, then key recomputation, on the envelope that will be stored, whoever prepared it | The organ must not re-derive this check. The narrowing removes a `downcast_ref` at `:1072-1076`; every failure path is already a `PipelineRefusal`. |
+
+### Huginn half, `crates/huginn-mind`
+
+Dependencies (`Cargo.toml`): `anyhow`, `chrono = "0.4.44"`, `cultcache-rs` (git `a0813c6…`), `epiphany-pipeline` (git, `rev` = the Epiphany half's commit), `rmp-serde = "1"`, `schemars = "1"`, `serde`, `sha2 = "0.10"`. Dev: `tempfile = "3"`. No `reqwest`, no `cultnet-rs`, no `cultmesh-rs`, no socket. `sha2` is the one package new to Huginn's graph that the leaf does not already bring (it is in Epiphany's lock, not the leaf's 36).
+
+| Add | Owner | Live consumer | Protected invariant | Why not an existing owner |
+|---|---|---|---|---|
+| `store.rs`: `pub trait MindStore: CacheBackingStore + Clone { fn compare_and_swap_batch(&self, expected: &[CultCacheEnvelope], replacements: Vec<CultCacheEnvelope>) -> anyhow::Result<bool>; }` with `impl MindStore for OwnedRedbMessagePackBackingStore`; `#[cfg(test)] MemoryStore` (a `BTreeMap` behind a `Mutex`, cloneable) and `#[cfg(test)] RefusingStore` (a `MemoryStore` whose CAS returns `Ok(false)` or `Err` on command) | `huginn-mind` | `Mind::open` (owned redb), every admission test (memory), Cut 12's atomicity test (refusing) | The commit primitive is testable without redb, a daemon or Qdrant; CAS is not on `CacheBackingStore`, so the narrow trait is the only way to inject it | `cultcache-rs` exposes CAS as inherent methods on concrete stores. Epiphany's `RuntimeSpineBackingStore` enum solves it with an extension switch the organ does not need. |
+| `mind.rs`: `pub struct Mind<S: MindStore> { instance: Slug, store: S, image: CultCache }`; `pub fn open(state_root: &Path, instance: &Slug) -> Result<Mind<OwnedRedbMessagePackBackingStore>, MindRefusal>`; `pub fn open_with(store: S, instance: &Slug) -> Result<Mind<S>, MindRefusal>`; `pub fn instance(&self) -> &Slug`; `pub fn get(&self, kind: PipelineKind, id: &str) -> Result<Option<PipelineDocument>, MindRefusal>`; `pub fn envelope(&self, kind, id) -> Option<&CultCacheEnvelope>`; `pub fn envelopes(&self) -> &[CultCacheEnvelope]` (the image, for Cut 10's snapshot source); `pub fn receipts(&self) -> Result<Vec<HuginnCommitReceipt>, MindRefusal>`; `pub fn is_empty(&self) -> bool`; `pub fn path_for(state_root, instance) -> PathBuf` (`<state_root>/minds/<instance>/mind.redb`) | `huginn-mind` | Cut 10's daemon (`open`, `envelopes`), Cut 9 (`get`, `envelopes`, `receipts`), Cut 12 (`envelope`) | Ruling 14: a store is canonical to one instance, and identity lives in the state (the `instance` document) not the path; ruling 15: one writer (the owned lock); ruling 20's analogue: the opener refuses before it attaches | Nothing in Huginn exists; Epiphany's opener is `pub(crate)` and bound to its Mind types. |
+| `mind.rs`: `HuginnMindEpoch` (`DatabaseEntry`, type `huginn.mind_epoch.v1`, slot 0 `schema_epoch: String`, keyed by the epoch string) | `huginn-mind` | the opener; the first write (derived) | The store carries the schema epoch it was written at, so a breaking bump can refuse it (`ForeignEpoch`) | Epiphany's `EpiphanyPipelineIdentity` died in Cut 4 and its type id was Epiphany's. |
+| `receipt.rs`: `HuginnCommitReceipt` (`DatabaseEntry`, type `huginn.mind_commit_receipt.v1`, slots: `schema_version`, `receipt_id`, `instance: String`, `provenance: PipelineProvenance`, `strong_reads: Vec<DocumentVersion>`, `writes: Vec<DocumentVersion>`, `committed_at: String`), `DocumentVersion { document_type, document_key, schema_id, payload_msgpack, payload_sha256 }`, `pub(crate) fn receipt_id(instance, strong_reads, writes) -> String` = `"mind-commit-" + sha256(rmp_serde::to_vec_named(&(instance, strong_reads, writes)))`, `validate`, `pub(crate) fn commit(&mut Mind, provenance, strong_reads, writes, now) -> Result<Committed \| AlreadyAdmitted \| Conflict, MindRefusal>` (the one construction site of a receipt; the CAS; the conflict re-read) | `huginn-mind` | `Mind::admit_prepared` only | A batch lands whole with a receipt naming its exact bytes, or not at all; exact replay answers with the stored receipt; a lost CAS is typed `Conflict`; the receipt id is a digest of what was read and written, never of who wrote it | FU-3: Epiphany's is `pub(crate)` and shaped for its scheduler. |
+| `admission.rs`: `Faculty { SelfFaculty, Imagination, Hands, Soul, MindSteward, Eyes, Operator }`, `PipelineProvenance { faculty, agent: Short, session: Short, tool: Short }`, `PipelineAdmissionBatch { instance: Slug, provenance, documents: Vec<PipelineDocument> }` (1..=64), `PipelineAdmissionOutcome { Committed { receipt_id, committed_at, writes: Vec<PipelineRef> }, AlreadyAdmitted { receipt_id }, Refused(MindRefusal), Conflict { identities: Vec<PipelineRef> } }`, `impl Mind { pub fn admit(&mut self, batch, now: DateTime<Utc>) -> PipelineAdmissionOutcome; pub fn admit_prepared(&mut self, instance, provenance, envelopes: Vec<CultCacheEnvelope>, now) -> PipelineAdmissionOutcome }`, the rule table below, the derivations | `huginn-mind` | Cut 10's sink calls `admit`; Cut 12's hand-off and import call `admit_prepared`; Cut 13 constructs `PipelineAdmissionBatch` and reads `PipelineAdmissionOutcome` (through the wire, Q13) | Every cross-field and cross-document rule lives here and nowhere else; the leaf never gains one; the daemon and the client never re-derive one | D1/D2: admission is Huginn's. `JsonSchema` on the four public types costs nothing (`schemars` is already in the graph through the leaf) and keeps Q13 open. |
+| `refusal.rs`: `pub enum MindRefusal` = `Document(epiphany_pipeline::PipelineRefusal)`, `ForeignInstance { declared, mind }`, `MissingIdentity`, `ForeignEpoch { found, expected }`, `ForeignStore { r#type }`, `MindAlreadyOwned { path }`, `BatchSize { actual }`, `IdentityCollision { kind, id }`, `MissingReference { kind, id }`, `AlreadyResolved { subject }`, `IncompatibleResolution { subject_kind, outcome }`, `CitesResolvedDocument { kind, id }`, `EmptySupersession`, `UnknownSupersessor { id }`, `RevisionWithoutSupersession { kind, revision }`, `DuplicateLabel { field, label }`, `InvalidOptions { question }`, `InvalidChoice { ruling, choice }`, `QuoteWithoutOperator { ruling }`, `RepoNotStewarded { repo }`, `RepoNotInCampaign { repo }`, `CutReportWithoutSpec { report }`, `SpecMismatch { field }`, `RangeOutsideCommits { head }`, `FalsifiedClaimWithoutConfirmedFinding { claim }`, `UnprovenClaimWithConfirmedFinding { claim }`, `PromiseWithoutVerdict { promise }`, `UnknownMutationLabel { label }`, `FindingWithoutRange`, `FindingWithoutEvidence`, `UnknownInvariant { label }`, `NotStewarded { repo }`, `Unavailable { detail }`; `Display`, `Error`, `JsonSchema` | `huginn-mind` | the outcome above; Cut 13's tool outputs | Refusals are data with a field an agent can act on, never a transport error | D2 assigned the service half here. `Document(..)` wraps rather than copies the leaf's four. |
+
+`Faculty` and `PipelineProvenance` are the shapes Cut 4 deleted from Epiphany (`ca275c7b^:pipeline_documents.rs`, `Faculty` unit enum and `PipelineProvenance` value type), re-created here because their only consumer is the receipt. Cut 9's `faculty` query filter and `PipelineDocumentView.faculty` read them from receipts. `faculty` is attribution, not authority (ruling 18); no rule below trusts it.
+
+### The opener, exactly
+
+`Mind::open_with(store, instance)`, fail-closed and in this order, nothing attached until every step passes:
+
+1. `store.pull_all()` → the raw envelopes. A store error is `Unavailable`.
+2. Every envelope's type is one of the thirteen pipeline type ids, `huginn.mind_epoch.v1` or `huginn.mind_commit_receipt.v1`; else `ForeignStore { type }`. (A runtime or Mind store passed by mistake dies here, as in Cut 3a.)
+3. If any envelope exists: exactly one `HuginnMindEpoch` keyed `PIPELINE_SCHEMA_EPOCH` whose value equals it, else `MissingIdentity` (none) or `ForeignEpoch { found, expected }` (another).
+4. If any envelope exists: exactly one `instance` document, else `MissingIdentity`; its `instance` field equals the declared `instance`, else `ForeignInstance { declared, mind }`. **This is ruling 14's "identity lives in the state, not in a path": the path is derived from the slug for convenience and the document is the authority.** A store moved to another instance's directory is refused.
+5. Register the fifteen types, `add_generic_backing_store(store.clone())`, `pull_all_backing_stores()`.
+
+`Mind::open(state_root, instance)` computes the path, calls `OwnedRedbMessagePackBackingStore::new(path)` (creates parent directories, takes the exclusive lock; a second owner fails there and is mapped to `MindAlreadyOwned { path }`), then `open_with`. An empty store is a valid open (`is_empty()`), and only the first admission may write into it.
+
+### Admission, exactly
+
+`admit(batch, now)` prepares every document through the leaf (`validate()`, then `prepare()`) and calls `admit_prepared`. `admit_prepared` is the single commit path for Cuts 8, 10 and 12, in this order; the first failing step is the outcome and nothing after it runs:
+
+| # | Step | Refusal |
+|---|---|---|
+| A1 | `batch.instance == mind.instance()` | `ForeignInstance { declared, mind }` |
+| A2 | 1..=64 envelopes | `BatchSize` |
+| A3 | Every envelope: `validate_pipeline_write_envelope` (bounds, formats, key) | `Document(..)` |
+| A4 | Identities unique within the batch | `IdentityCollision` |
+| A5 | Every document carrying an instance field names this mind: `instance.instance`, `stewardship.instance`; `hand_off.from_instance == mind || hand_off.to_instance == mind` | `ForeignInstance` |
+| A6 | Empty mind: the batch contains exactly one `instance` document (else `MissingIdentity`) and admission **derives** the `HuginnMindEpoch` write. Non-empty mind: an `instance` document in the batch collides (A8). | `MissingIdentity` |
+| A7 | References: every `PipelineRef` and every full-id `Short` field names a document present in image ∪ batch under `(kind.type_id(), id)`. Fields: `question.raised_in`, `ruling.answers`, `cut_spec.rulings`, `cut_spec.questions`, `cut_report.cut_spec`, `cut_report.forks`, `verdict.cut_report`, `verdict.claims[].findings`, `finding.verdict`, `follow_up.source`, `resolution.subject`, `resolution.outcome.{by,to}`, `hand_off.documents`. `Fixed.commit` and `ForeignRef` are syntax only (ruling B, D6). | `MissingReference { kind, id }` |
+| A8 | Per-kind rules, table below, including derivations. Derived writes are appended to the batch and pass A3-A8 themselves. | per row |
+| A9 | Replay: compute `receipt_id` over `(instance, strong_reads, writes)`; if a receipt with that id exists, its writes (minus `committed_at`) must equal ours, and the outcome is `AlreadyAdmitted { receipt_id }`. **Validation before replay (ruling 20):** a replayed batch the current rules refuse is refused at A3-A8, never answered from the store. | — |
+| A10 | Collision: any write whose `(type, key)` exists in the image | `IdentityCollision { kind, id }`. *(As first written this row also named `AlreadyResolved` for a resolution key, "a subject resolves at most once because its resolution key is outcome-invariant". Cut 6d gave resolutions and stewardships a per-subject sequence, so a key collision is only ever a collision; `AlreadyResolved` and `AlreadyStewarded` are A8's in-force rules now. Corrected 2026-09-16.)* |
+| A11 | Commit through `receipt::commit`: `strong_reads` = the exact image envelopes of every document A7 resolved in the image (cited bytes pinned into the receipt); `writes` = the batch plus derived writes; the receipt envelope appended; one `compare_and_swap_batch(expected = strong_reads, replacements = writes + receipt)`. `true` → re-pull the image, `Committed`. `false` → re-pull, diff, `Conflict { identities }`. | `Unavailable` on a store error |
+
+Per-kind rules (A8). "In force" means no resolution that is itself in
+force names it in image ∪ batch: the derivation is recursive, so a
+withdrawn resolution stops counting (Q17 B, landed in the Cut 6d
+follow-up). For the two sequenced kinds, resolution and stewardship, A8
+checks sequence then in-force: `sequence` must equal the latest for the
+subject (or the `(instance, repo)`) plus one, else `ResolutionOutOfSequence`
+/ `StewardshipOutOfSequence`; and no resolution (stewardship) may be in
+force for that subject (repo), else `AlreadyResolved` / `AlreadyStewarded`.
+A withdrawal cannot itself be withdrawn (Q19 A), read as nesting depth: a
+resolution whose subject's own subject is a resolution is refused after
+the matrix, so a chain is at most base, closure, withdrawal. *(First
+written here as an outcome reading, "a resolution with outcome
+`Withdrawn`"; the code and the ruling text implement the nesting reading,
+which Soul confirmed. Corrected 2026-09-16.)* Under Self's ruling
+extending Q19's rationale, a withdrawal is also refused when the base
+subject already has an in-force record later than the one the withdrawal
+would reinstate (`WouldReinstateOverLater`), so no base ever has two
+records in force.
+
+| Kind | Rule | Refusal |
+|---|---|---|
+| campaign | `repos` non-empty and every repo is stewarded by this mind (an in-force `stewardship` for `(mind, repo)` exists in image ∪ batch) | `InvalidOptions`-style `FieldBound` comes from the leaf; `RepoNotStewarded { repo }` |
+| target | `revision == 1`, or revision N with a `resolution(Superseded{by: this target})` of revision N−1 in the batch; invariant labels unique | `RevisionWithoutSupersession`, `DuplicateLabel` |
+| question | ≥ 2 options with unique labels; `recommended` is one of them | `InvalidOptions`, `DuplicateLabel` |
+| ruling | `operator_quote.is_some()` ⇒ `authority == Operator` (6c); `answers`, if set, names an in-force question and `choice` is one of its options; admission **derives** `resolution { subject: that question, outcome: Answered { by: this ruling }, rationale: ruling.ruling, resolved_on: ruled_on }` unless the batch already carries an identical one | `QuoteWithoutOperator`, `AlreadyResolved`, `InvalidChoice` |
+| cut_spec | `repo ∈ campaign.repos`; every cited ruling in force; revision rule as target, same `cut` | `RepoNotInCampaign`, `CitesResolvedDocument`, `RevisionWithoutSupersession` |
+| cut_report | cites its spec (A7) and the spec is in force; `repo` and `branch` equal the spec's; `range.head ∈ commits[].sha` | `CutReportWithoutSpec` (missing), `CitesResolvedDocument`, `SpecMismatch { field }`, `RangeOutsideCommits` |
+| verdict | cites its report (A7); each `Falsified` claim cites ≥ 1 `Confirmed` finding in image ∪ batch; an `Unproven` claim cites no `Confirmed` finding; **every promise of the cited report is named by exactly one claim's `promise`** (ruling A); every `claims[].mutations` label exists in the report's `mutations[].label` | `FalsifiedClaimWithoutConfirmedFinding`, `UnprovenClaimWithConfirmedFinding`, `PromiseWithoutVerdict { promise }` (zero or two claims), `UnknownMutationLabel` |
+| finding | `range` present (type fact; the refusal exists for the import path's raw envelopes), `evidence` ≥ 1, `locations` ≥ 1; every `invariants[]` label exists in the in-force target of the campaign | `FindingWithoutRange`, `FindingWithoutEvidence`, `UnknownInvariant` |
+| follow_up | source exists (A7) | — |
+| resolution | subject exists (A7); `sequence` is the subject's latest plus one; no resolution of the subject is in force; outcome fits the matrix below; every `by`/`to` referent exists (A7, named `UnknownSupersessor` when the outcome is `Superseded`) and is in force; `Superseded.by` non-empty; up to 8 supersessors, each named (Q10); the subject is not a withdrawal (Q19 A) | `ResolutionOutOfSequence`, `AlreadyResolved`, `IncompatibleResolution`, `EmptySupersession`, `UnknownSupersessor`, `CitesResolvedDocument` |
+| instance | only on an empty mind (A6); `instance == mind` (A5) | — |
+| stewardship | `instance == mind` (A5); `sequence` is the `(mind, repo)` latest plus one; no stewardship of the repo is in force on this mind | `StewardshipOutOfSequence`, `AlreadyStewarded` |
+| hand_off | one side is this mind (A5). **Source side** (`from == mind`): an in-force `stewardship(mind, repo)` exists, every `documents[]` id exists here (A7), and admission **derives** `resolution { subject: that stewardship, sequence: latest + 1, outcome: Withdrawn { reason: <hand_off key> } }`. **Receiving side** (`to == mind`): admission **derives** `stewardship { instance: mind, repo, sequence: latest + 1, assigned_on: handed_on, note: <hand_off key> }`. A hand-off is a transfer (Q18); a return is a second hand-off, and its derived stewardship takes the next sequence rather than colliding. Cut 12 admits the same `hand_off` into both minds atomically and imports the named documents. | `NotStewarded { repo }` |
+
+Resolution matrix (admission's, this crate; the leaf never refuses a row of it):
+
+| Subject | Allowed outcomes |
+|---|---|
+| target | `Superseded { by: [target] }` |
+| question | `Answered { by: ruling }` (that ruling's `answers` must name this question), `Withdrawn` |
+| ruling | `Superseded { by: [ruling…] }` |
+| cut_spec | `Superseded { by: [cut_spec, same cut] }`, `Withdrawn` |
+| finding | `Fixed { commit, by: Option<cut_report> }`, `Deferred { to: follow_up }`, `Recorded`, `Withdrawn` |
+| follow_up | `Fixed { commit, by: Option<cut_report> }`, `Superseded { by: [follow_up] }`, `Withdrawn` |
+| stewardship | `Superseded { by: [stewardship] }`, `Withdrawn` |
+| resolution (Q11 A) | `Withdrawn` only: withdrawing a resolution reopens its subject; nothing else has a meaning yet |
+| campaign, cut_report, verdict, instance, hand_off | not resolvable |
+
+Everything `Superseded` takes a list because the shape does (6c); the matrix constrains the referents' kinds, and each kind's row says which. The old D4's "a supersession chain cannot cycle because `by` must be in force" still holds and needs no cycle check.
+
+### The seam Cut 11 needs
+
+`Committed { writes: Vec<PipelineRef> }` names every document the batch landed, derived writes included, and `Mind::envelope(kind, id)` returns its bytes. Cut 11's daemon indexes *after* `admit` returns, from those two, and never inside it. Cut 8 defines no `IndexPort`, no `EmbeddingPort`, no `pending_index` document and no hook, callback or trait object on `Mind`; D5's ports arrive with Cut 11 in `index.rs`. The negative grep below pins that nothing index-shaped is here.
+
+### Per-file changes
+
+Epiphany, `epiphany-pipeline` at `dddf9ede` (re-anchor by content; the file has not moved since, but Hands greps the opener):
+
+| Line | Change |
+|---|---|
+| `Cargo.toml:17-21` | Add `anyhow = "1"` and `rmp-serde = "1"`; the comment at `:14-16` says the write path is live and why the two crates are normal dependencies. `:23-26` keeps `serde_json` alone. |
+| `lib.rs:28-29` | Module doc: "The wrappers are crate-private: outside code registers, prepares and decodes them through `register_pipeline_document_types`, `PipelineDocument::prepare` and `PipelineDocument::decode`, and validates a write through `validate_pipeline_write_envelope`." |
+| `lib.rs:32-39` | `use anyhow::Result; use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry};` with no gates and a one-line comment. |
+| `lib.rs:43-47` | `PipelineRefusal` doc: `ForeignStore` is raised by `decode` and stays; the organ's refusals wrap this enum. |
+| after `lib.rs:644` (`LOCAL_MAX`) | `pub const PIPELINE_SCHEMA_EPOCH: &str = "epiphany.pipeline.epoch.v1";` with a doc comment carrying the README's rule: additive keeps it, a widened `PipelineKind` is additive, a breaking bump refuses the old store. |
+| `lib.rs:475-487` | `prepare`: drop `#[cfg(test)]`, `pub`, doc "Prepares the envelope the organ stores: keyed by `pipeline_key`, payload `[value]` through `prepare_entry_named`." |
+| `lib.rs:489-499` | `decode`: drop the gate, `pub`. |
+| `lib.rs:502-511` | `register_pipeline_document_types`: drop the gate, `pub`, delete `:509`. |
+| `lib.rs:515-520` | `ForeignDocument` doc: it stands in for a receipt of *any* organ; Huginn pins the rule against its real receipt type. Still `cfg(test)`. |
+| `lib.rs:739-757` | `validate_pipeline_write_envelope`: drop the gate, `pub`, return `Result<(), PipelineRefusal>`, `.into()` at `:754` removed. |
+| `lib.rs:977-981` | `schema_cache`: add `cache.register_entry_type::<ForeignDocument>()?;` after the registrar call. |
+| `lib.rs:1072-1076` | `keys_are_derived_and_mismatch_refuses`: `assert_eq!(validate_pipeline_write_envelope(&envelope), Err(PipelineRefusal::InvalidIdentity { .. }))` directly; no `downcast_ref`. |
+| `lib.rs:1299` | unchanged (`?` on a `PipelineRefusal` inside an `anyhow` test still compiles). |
+| tests, after `:1935` | `every_kind_is_at_the_epochs_version`: `PIPELINE_SCHEMA_EPOCH` ends in `.v1` and every `kind.type_id()` ends in `.v1`; the live registrar registers exactly `PipelineKind::ALL.len()` types (`registered_entry_types().len()`), so the stand-in is not among them. |
+
+`schemas/cultnet/`: no change. `notes/eureka-pipeline-state-cut.md`: Self's.
+
+Huginn at `4094e68`, all new files except:
+
+| Line | Change |
+|---|---|
+| `crates/huginn-mind/Cargo.toml:8` | the dependency list above; `[dev-dependencies] tempfile = "3"`. |
+| `Cargo.lock` | regenerated; gains about 91 packages; the CRLF→LF whole-file rewrite Soul predicted on Cut 7 lands here. |
+| `README.md:33-35`, `AGENTS.md:15-17` | "The crates are stubs" → `huginn-mind` is live (storage, identity, admission); the other two are stubs. |
+| `crates/huginn-mind/src/lib.rs` | `pub mod admission; pub mod mind; pub mod receipt; pub mod refusal; pub mod store;` and re-exports of the public names above. |
+| `crates/huginn-mind/src/{store,mind,receipt,admission,refusal}.rs` | as under Adds. Tests live beside their module. |
+| `tools/eureka-cut8-mutations.psd1` | entries H1-H20 below. |
+
+### Authority map
+
+- **Owner:** `huginn-mind`, for the mind's identity, every admission rule, every derivation of a write, and the receipt. Inside it: `Mind::open_with` owns "may this store be this instance's mind"; `Mind::admit_prepared` owns "may this batch enter"; `receipt::commit` owns "did it enter, whole, with a receipt".
+- **Inputs:** the store's envelopes (through `MindStore`), the batch, the declared instance, the caller's clock (`now: DateTime<Utc>`, passed in; the crate never reads a clock).
+- **Outputs:** `PipelineAdmissionOutcome`, `MindRefusal`, receipts, envelopes by key.
+- **Derived state:** the epoch record on the first write; the `Answered` resolution for a ruling that answers; the stewardship withdrawal or assignment on a hand-off; the image (`CultCache`) is a cache of the store and is re-pulled after every commit. In-force status is computed at rule time and never stored (Cut 9 owns the read-side derivation).
+- **Forbidden writers:** nothing outside `receipt::commit` constructs a `HuginnCommitReceipt` or calls `compare_and_swap_batch` (one test plants a receipt through `MemoryStore` to pin replay; that is the second construction site and it is deliberate, as in Cut 5). Nothing outside `huginn-mind` validates a document, derives a write, decides in-force status, or writes a mind except through `admit`/`admit_prepared`. The leaf gains no cross-field rule. The daemon, the client and the index may not touch the store. No `Mind` method reads the wall clock or the environment.
+- **Shared paths:** `admit` (typed) and `admit_prepared` (envelopes) converge before A1; Cut 10's sink, Cut 12's hand-off and import, and Cut 13's tools all end in `admit_prepared`. Four grammar paths in the leaf stay four.
+- **Deletion line:** the Epiphany deletes table, before any Huginn dependency is added.
+
+### Verification
+
+**Builds.** `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex` for both repos, path-list baseline recorded before and after. Epiphany: `cargo check -p epiphany-pipeline --lib --tests`, `cargo test -p epiphany-pipeline --lib` (27 tests, 0 warnings), then `cargo check -p epiphany-core --lib --tests` (untouched; a leaf dependency promotion does not reach it). Huginn: `cargo check -p huginn-mind --lib --tests`, `cargo test -p huginn-mind --lib`, `cargo check --workspace` (the two stubs still build), `cargo tree -p huginn-mind -e normal -d` (zero duplicates; one `cultcache-rs`). Host and target are the workstation; `OwnedRedbMessagePackBackingStore` has a unix and a windows arm and only the windows arm is exercised here; Cut 14 builds on Yggdrasil.
+
+**Tests**, `crates/huginn-mind`, each named for the rule it pins.
+
+| Test | Rule |
+|---|---|
+| `an_empty_store_opens_and_the_first_write_must_carry_the_instance` | A6, ruling 14: a batch without `instance` into an empty mind is `MissingIdentity`; with it, the receipt's writes name the instance document and the epoch record (derived). |
+| `the_instance_document_is_the_identity_not_the_path` | Opener step 4: a store written for `yggdrasil` opened as `thought-cage` (same path) is `ForeignInstance`; a store copied to `minds/thought-cage/` and opened as `yggdrasil` opens. |
+| `admission_refuses_a_foreign_instance_whatever_the_transport` | A1, A5: `batch.instance` foreign; a `stewardship` naming another instance; a `hand_off` naming neither side. All `ForeignInstance`, store bytes unchanged. |
+| `the_opener_refuses_foreign_epoch_missing_identity_and_foreign_type_before_attaching` | Steps 2-4, in order; each leaves bytes unchanged; a `MemoryStore` counts `pull_all` calls to prove nothing attached. |
+| `a_mind_has_one_owner_at_a_time` | Ruling 15: a second `Mind::open` of the same path while the first is alive is `MindAlreadyOwned`; after drop it opens. Real redb in a `tempdir`. |
+| `two_minds_in_one_state_root_stay_separate` | Path derivation and store isolation: documents admitted into one are absent from the other; `path_for` differs. |
+| `keys_are_recomputed_and_a_forged_key_refuses` | A3 through the shared path: `admit_prepared` with an envelope whose key is edited is `Document(InvalidIdentity)`. |
+| `references_must_exist_in_image_or_batch` | A7: a ruling answering an absent question, a follow-up sourced from an absent finding, a verdict citing an absent report, a resolution of an absent subject; each `MissingReference` naming kind and id; a well-formed id of the wrong kind at the same key is also `MissingReference` (no `WrongReferenceKind`). |
+| `batch_is_all_or_nothing` | A11 + `RefusingStore`: a refused third document, and separately a CAS that returns `false`, leave the store byte-identical and no receipt written. |
+| `exact_replay_returns_already_admitted_across_provenance` | A9: the same documents with a different `provenance` and a later `now` return `AlreadyAdmitted` with the first receipt id; one receipt in the store. |
+| `a_refused_batch_is_not_answered_from_a_stored_receipt` | Ruling 20's second half: admit a cut_spec citing R1; supersede R1; replay the first batch byte-for-byte → `CitesResolvedDocument`, not `AlreadyAdmitted`. |
+| `a_receipt_names_the_exact_bytes_it_read_and_wrote` | The receipt's `strong_reads` are the cited envelopes' bytes and `writes` the stored bytes, each with a matching `payload_sha256`; `receipt_id` recomputes from `(instance, strong_reads, writes)` and **not** from provenance (two receipts with different provenance and equal content have equal ids). |
+| `a_document_is_written_once_and_superseded_by_resolution` | A10 + target invariant: re-putting `ruling:R8` with new text is `IdentityCollision`; superseding it by resolution lands and the old ruling is still readable by key. |
+| `subject_resolves_at_most_once` | A10 on a resolution key: `AlreadyResolved { subject }`, whatever the second outcome. |
+| `the_resolution_matrix_is_admissions` | Every row: one accepted outcome and one refused per subject kind, `instance` and `hand_off` refused with any outcome, a resolution of a resolution accepted with `Withdrawn` and refused with `Superseded`. |
+| `supersession_names_each_supersessor_and_none_is_empty` | 6c inherited + Q10: `Superseded { by: [] }` → `EmptySupersession`; two named supersessors both existing → lands; one absent → `UnknownSupersessor`; one resolved → `CitesResolvedDocument`. |
+| `a_ruling_answering_a_question_derives_the_answered_resolution_atomically` | A8 ruling row: the receipt's writes hold ruling and resolution; `choice` not among options → `InvalidChoice`; answering a resolved question → `AlreadyResolved`. |
+| `an_operator_quote_requires_operator_authority` | 6c: `QuoteWithoutOperator`. |
+| `a_revision_requires_its_predecessors_supersession_in_the_batch` | target and cut_spec rows: `RevisionWithoutSupersession`; with the resolution in the batch, lands. |
+| `a_cut_report_cites_an_in_force_spec_and_agrees_with_it` | `CutReportWithoutSpec`, `CitesResolvedDocument`, `SpecMismatch { field: "branch" }`, `RangeOutsideCommits`. |
+| `verdict_vocabulary_binds_claims_to_findings_promises_and_mutations` | `FalsifiedClaimWithoutConfirmedFinding`, `UnprovenClaimWithConfirmedFinding`, `PromiseWithoutVerdict` (zero claims and two claims name P1), `UnknownMutationLabel`. |
+| `a_finding_names_evidence_locations_and_known_invariants` | `FindingWithoutEvidence`, `FindingWithoutRange` (through `admit_prepared` with a hand-built envelope lacking `range`, since the type makes it unreachable from `admit`), `UnknownInvariant`. |
+| `a_campaign_names_only_repos_this_mind_stewards` | `RepoNotStewarded`; with the stewardship in the same batch, lands; a cut_spec whose repo is outside `campaign.repos` → `RepoNotInCampaign`. |
+| `a_hand_off_derives_this_minds_side_only` | Source side: withdrawal of the stewardship derived, `NotStewarded` without one, `MissingReference` for an unnamed document; receiving side: stewardship derived; the same `hand_off` admitted into both minds (two `MemoryStore`s) lands in both with the same key. |
+| `decode_refuses_the_organs_own_receipt` | S5 closed here: a `HuginnCommitReceipt` envelope through `PipelineDocument::decode` is `ForeignStore { type: "huginn.mind_commit_receipt.v1" }`, against the real type. |
+
+Epiphany, one new test named under Per-file changes; the twenty-six existing unchanged in name and assertion.
+
+**Mutations.** `F:\Projects\Huginn\tools\eureka-cut8-mutations.psd1`, entries H1-H20, run through Epiphany's `tools/eureka-mutations.ps1` with the `-Repo` parameter Q14 adds:
+
+```
+powershell -File F:\Projects\Epiphany\tools\eureka-mutations.ps1 -Repo F:\Projects\Huginn `
+    -Entries tools/eureka-cut8-mutations.psd1 `
+    -Target crates/huginn-mind/src/mind.rs,crates/huginn-mind/src/receipt.rs,crates/huginn-mind/src/admission.rs `
+    -Test 'cargo test -p huginn-mind --lib'
+```
+
+Anchors are content the entry names; Hands writes them against the code it lands, exactly once each, and M0 is built in. Every entry below is a ruling this cut implements, mutated to restore the old permissiveness, killed by one named test.
+
+| # | Ruling | Mutation, exactly | Killed by |
+|---|---|---|---|
+| H1 | 14: admission refuses another instance's identity | A1: `if batch.instance != self.instance` → `if false` | `admission_refuses_a_foreign_instance_whatever_the_transport` |
+| H2 | 14: identity in the state | Opener step 4: compare the stored instance against the declared one → compare against itself | `the_instance_document_is_the_identity_not_the_path` |
+| H3 | 14: a mind is never un-owned | A6: drop the `MissingIdentity` return on an empty mind | `an_empty_store_opens_and_the_first_write_must_carry_the_instance` |
+| H4 | 14: the epoch record is derived on the first write | A6: drop the derived `HuginnMindEpoch` write | the same test (the receipt lacks the epoch write); collaterally the opener test on re-open |
+| H5 | 15: one writer | `Mind::open`: `OwnedRedbMessagePackBackingStore::new` → `RedbMessagePackBackingStore::new` wrapped (the transient store; requires a `cfg(test)`-free `impl MindStore` for it, which Hands adds only in the mutation, so the entry is `MustNotCompile = $false` and the killer is the second open succeeding) | `a_mind_has_one_owner_at_a_time` |
+| H6 | 20: fail-closed opener | Opener: move the attach (`add_generic_backing_store`) above step 2 | `the_opener_refuses_foreign_epoch_missing_identity_and_foreign_type_before_attaching` (the `pull_all` count) |
+| H7 | 20: validation before replay | A9 moved above A7 | `a_refused_batch_is_not_answered_from_a_stored_receipt` |
+| H8 | Q2/epoch: foreign epoch refused | Opener step 3: `found != PIPELINE_SCHEMA_EPOCH` → `false` | the opener test |
+| H9 | Opener: foreign type refused | Step 2: skip the type check | the opener test |
+| H10 | Receipt: idempotent replay | A9: skip the lookup (always commit) | `exact_replay_returns_already_admitted_across_provenance` (`IdentityCollision` instead) |
+| H11 | Receipt: the digest is content, not author | `receipt_id`: add `provenance` to the digested tuple | `a_receipt_names_the_exact_bytes_it_read_and_wrote` |
+| H12 | Receipt: strong reads pin cited bytes | A11: `expected = &[]` | `a_receipt_names_the_exact_bytes_it_read_and_wrote` (empty `strong_reads`) and `batch_is_all_or_nothing`'s CAS branch |
+| H13 | All-or-nothing | A11: on `false`, return `Committed` | `batch_is_all_or_nothing` |
+| H14 | Supersession, not overwrite | A10: skip the collision check (the store's CAS still refuses, so the outcome becomes `Conflict`) | `a_document_is_written_once_and_superseded_by_resolution` (expects `IdentityCollision`) |
+| H15 | Resolution matrix in admission | `matrix(subject_kind, outcome)` → `true` | `the_resolution_matrix_is_admissions` |
+| H16 | 6c: `EmptySupersession` | drop the `is_empty` check | `supersession_names_each_supersessor_and_none_is_empty` |
+| H17 | Q10 + 6c: `UnknownSupersessor` | resolution referents skipped in A7 | the same test |
+| H18 | 6c: `QuoteWithoutOperator` | drop the check | `an_operator_quote_requires_operator_authority` |
+| H19 | Ruling A: every promise measured once | `PromiseWithoutVerdict`: `count != 1` → `count == 0` | `verdict_vocabulary_binds_claims_to_findings_promises_and_mutations` (the two-claims forgery) |
+| H20 | 6c: `UnknownMutationLabel` | drop the check | the same test |
+
+Stated limits: `ForeignStore` through `decode` is the leaf's rule and is pinned there; H5's mutant needs a helper impl the entry supplies in `New`, which is a two-edit entry on `store.rs` and `mind.rs` (the harness supports `Edits`). `MindAlreadyOwned` is the store's lock, not a Huginn check; H5 pins that Huginn chose the owning store, not that fs2 works.
+
+**Negative greps.**
+
+- `rg -n "reqwest|UdpSocket|qdrant|ollama|cultnet|cultmesh|IndexPort|EmbeddingPort|pending_index" F:\Projects\Huginn\crates\huginn-mind` empty (Cut 11 owns the ports; Cut 10 the socket).
+- `rg -n "prepare_entry\(" crates/huginn-mind/src` empty: only `prepare_entry_named`, and only inside `receipt.rs` (the receipt) — pipeline documents are prepared by the leaf.
+- `rg -n "compare_and_swap_batch" crates/huginn-mind/src`: the trait, its impl(s), and exactly one call in `receipt.rs`.
+- `rg -n "HuginnCommitReceipt \{" crates/huginn-mind/src`: two sites, `receipt::commit` and the replay-planting test.
+- `rg -n "Utc::now|SystemTime::now|std::env::var" crates/huginn-mind/src` empty.
+- `rg -n "epiphany_core|epiphany-core|ghostlight" F:\Projects\Huginn --glob '!.voidbot/**'` empty; `cargo tree -p huginn-mind -e normal | rg -c "epiphany-core"` is 0.
+- `rg -n "cfg\(test\)" F:\Projects\Epiphany\epiphany-pipeline\src\lib.rs` shows only `ForeignDocument`, `derived_schema` and `mod tests`.
+- `rg -n "impl Bounded|fn validate" crates/huginn-mind/src` shows no impl over a leaf type (the leaf's `Bounded` is `pub(crate)`; if Hands needs it, that is a finding, not a workaround).
+- `git diff --stat dddf9ede -- schemas/cultnet/` empty. `git diff --stat 4094e68 -- .voidbot` empty.
+
+**Operator checks:** none blocking. Q13 and Q14 are asked below; both have a default Hands can build under.
+
+### Subtraction estimate
+
+Epiphany: −28 lines (gates, comments, one registration, two dev-dependency lines), +about 40 (constant, doc lines, one test, two dependency lines); net about +12 outside tests, +15 tests. Zero schema, kind, field, type id, epoch or lock change. Liability retired: the last `cfg(test)`-shaped "until the organ" waivers, and the drift hazard of an epoch string nobody owned in code.
+
+Huginn: +about 2,100 lines (store 120, mind 260, receipt 220, refusal 90, admission 700, tests 650, entries file 120), +1 live crate, +8 direct dependencies, about +91 lock packages, +2 document types (`huginn.mind_epoch.v1`, `huginn.mind_commit_receipt.v1`), zero binaries, zero targets. Of the receipt file, about 200 lines duplicate `epiphany-core`'s 260; the rest is the service boundary D1 chose. Nothing in Huginn is removed because nothing is there.
+
+### Build budget
+
+- **Packages that compile:** Epiphany `epiphany-pipeline` (lib + tests); `epiphany-core` check only, no rebuild expected since the leaf is not its dependency. Huginn `huginn-mind` (lib + tests) and its 90 transitive packages, the two stubs.
+- **Profiles/targets/platforms:** debug only, workstation host = target, no features, no codegen paths, no release profile.
+- **Footprint:** `C:\Users\Meta\.cargo-target-codex` measured this pass at **9,872 paths, 8.2 GiB (`debug/` only)**, drive C: 261 GiB free. `libcultcache_rs`, `libredb` and `libepiphany_pipeline` rlibs are already present from Epiphany builds; Huginn's feature unification may or may not reuse them. **Expected delta: +400 to +900 paths, +0.4 to +0.9 GiB**, all under `debug/`. Hands records the before/after path list as every cut has, and reports a miss.
+- **Retention:** the shared dir is the operator's; nothing is deleted by this cut.
+
+### Operator questions
+
+- **Q13. Where do the batch and outcome types live for the client?** `eureka-state` (Cut 13) must construct `PipelineAdmissionBatch` and read `PipelineAdmissionOutcome`/`MindRefusal`, and the map says it does not depend on `huginn-mind` ("would invite a second validator", Cut 13). Cut 10 puts the wire types in the `huginn-daemon` *binary* crate, which a client cannot import either. Options: **A.** `eureka-state` depends on `huginn-mind` for types, with a negative grep that it never calls `open`, `admit` or `admit_prepared`; the graph cost is one package beyond what the leaf already brings (`redb` comes with the leaf regardless). **B.** A fourth crate `huginn-wire` holding only the request/response/outcome types; doctrine's "a named external consumer with a hard dependency boundary" argument (D1) applies weakly, since the boundary is a discipline a grep can pin. **C.** Put them in `epiphany-pipeline`; refused here because D6 already rules Huginn's transport contracts are Huginn's. **Recommended: A.** Cut 8 makes the types `pub` and `JsonSchema` so A or B both work; the choice is Cut 10/13's, but it should be ruled before Cut 10 writes `wire.rs` into a binary crate. **Ruled A, 2026-09-16** ("I'll take your recommendations"). Cut 13's "no dependency on `huginn-mind`" becomes "depends on it for types only, with a negative grep that it never calls `open`, `admit` or `admit_prepared`"; Cut 10's `wire.rs` moves out of the binary crate accordingly when Cut 10 is refreshed.
+- **Q14. How does Huginn run the mutation harness?** **A.** Add `-Repo` (default: the harness's own parent) to `tools/eureka-mutations.ps1` in Epiphany, about four lines, and keep one harness; Huginn holds only its entries file and its verification names Epiphany's path. **B.** Copy the harness into Huginn: a second copy of a 19 KB script the operator will notice, one bug away from two behaviours. **C.** Move the harness to the Eureka skill repo (`GameCult/Eureka`), the owner of cross-repo Eureka tooling, and point both repos at `~/.claude/skills/eureka/tools/`: coherent, three repos touched, and Cut 15 ("Skill wiring") is its natural home. **Recommended: A now, C in Cut 15.** *Taken as a default by Self, 2026-09-16: not a product fork.*
+- **Q15. `mind.redb`, not `mind.cc`.** D3 wrote `mind.cc`; `F:\Projects\CLAUDE.md` says "all state should be CultCache `.cc` files". A redb-backed CultCache store is CultCache state in a different container, and the extension is what Epiphany's backend selector and CultCache Studio key on. **Recommended: `mind.redb`**, and the doctrine sentence reads "CultCache state", which this is. If the operator wants `.cc` literally, the cost is Epiphany's selector convention and Studio misreading the file, both real. **Ruled `mind.redb`, 2026-09-16.** The operator asked how redb got in: it entered Epiphany's runtime spine as the keyed backing store on 2026-08-08 (`5d6a7316`) and CultLib with the return of the Rust CultCache engine on 2026-09-03 (`b672fb7`); it is CultCache's own embedded keyed backend at the shared pin, not a dependency this campaign added.
+- **Q16 (carried, not new). Q6/ruling 18 stands:** identity is declared. This spec builds no credential path; `ForeignInstance` is collision and attribution control (D8). *Not a question: ruling 18 is in force and nothing here reopens it. Left as written so the reader sees it was checked.*
+
+### Findings not assignable to a cut
+
+- **FU-3's number is stale:** the Epiphany receipt path is about 260 lines, not 120, and Huginn's copy is about 200 because it drops authority variants, companions, `invariant_owner` and `store_id`. Self corrects the follow-up text.
+- **`open_runtime_spine_cache` (`runtime_spine.rs:646-653`) declares `SingleFileMessagePackBackingStore` while `commit_authorized_mind_mutation` (`reasoning_context.rs:1612`) passes a `RuntimeSpineBackingStore`;** one of the two is not what it reads as, or a conversion hides between them. Not read further because it is Epiphany's Mind path and Soul is in that tree; it belongs to campaign two or a Mind Steward note, not to Cut 8.
+- **The map's Cut 10 puts `HuginnMindRequest`/`HuginnMindResponse` in the daemon binary crate and Cut 13 forbids a `huginn-mind` dependency** — the client then has no crate to get the wire types from. Q13 above; the fix is Cut 10's spec.
+- **`README.md:33-35` and `AGENTS.md:15-17` in Huginn go stale the moment commit 1 lands**; the per-file table rewords them, but the "describe the live system" tension Soul raised on Cut 7 recurs at every Huginn cut until the workspace is whole.
+- **Huginn's `.gitignore` still carries `node_modules/`** (Cut 7 correction 27); one line, not this cut's.
+- **The old D4 rule text survives only in git history** (`304832ad^:notes/eureka-pipeline-state-cut.md:546-632`); the live map has the refusal names and no rules. This spec restates them in full; Self should make the map's Cut 8 section the owner so the next reader does not need `git show`.
+
+### Pinned HEADs
+
+Epiphany `ca7e230c` (lib.rs at `dddf9ede`), Huginn `4094e68`, CultLib `main` `4a2fdaf` with the Rust runtimes identical to `a0813c6`, Eureka skill checkout untouched. Probe artifacts: the lockfile resolution ran in the session scratchpad (`pin-probe/`, removed after this spec was written) and compiled nothing. The shared target dir read 9,872 paths before this pass and 9,874 after; this pass ran no cargo build, so the two paths belong to a concurrent build (Soul is in the Epiphany tree). Both repo trees are clean at the pinned HEADs.
+
+## Cut 9. `huginn-mind`: queries and derivations
+
+Imagination, 2026-09-16, refreshed against the Body after the Cut 6d Huginn
+follow-up and its fix batch. Replaces the old Cut 9 section whole; the
+paragraph "Carried in from the Q17 ruling and the Cut 6d follow-up" is kept
+as requirements R-A to R-C below.
+
+### Pins
+
+| Repo | Branch | HEAD | State |
+|---|---|---|---|
+| Epiphany | `codex/eureka-pipeline-state` | `94df3a8f` | tree clean; map only since `d5a36c2a`. |
+| Epiphany leaf | `epiphany-pipeline/src/lib.rs` | `d5a36c2a` (2,366 lines) | the rev Huginn pins in `crates/huginn-mind/Cargo.toml`. |
+| Huginn | `eureka/memory-organ` | `7b67730` | **an uncommitted Hands batch is in the tree** (`crates/huginn-mind/src/admission.rs`, `tools/eureka-cut8-mutations.psd1`: a subject-selection fix in `derive`, a dead arm deleted, four tests). Every anchor in this spec is a function, type or test **name**, never a line; Hands re-anchors by content after that batch lands, and this cut lands after it. |
+| CultLib | `a0813c6` | `cultcache-rs` checkout `~/.cargo/git/checkouts/cultlib-7ab3069e1ba2db32/a0813c6` | read for `CultCacheEnvelope` only. |
+
+Body facts this spec rests on, each by source read of the files named:
+
+- `admission.rs` holds `Docs { image: Vec<Held>, batch: Vec<Staged> }` and
+  every derivation: `from_image`, `push`, `in_batch`, `in_image`, `find`,
+  `of_kind`, `resolutions`, `stewardships`, `latest_resolution`,
+  `derived_resolution_sequence`, `derived_stewardship_sequence`,
+  `latest_stewardship`, `in_force`, `in_force_unless`, `stewardships_of`,
+  `later_in_force`, `stewardship_of`, and the free fn `later_than`. Nothing
+  else in the crate decides in force.
+- `in_force_unless(kind, id, own)` is the recursive derivation of Cut 6d D4:
+  no resolution `R` naming `(kind, id)`, other than `own`, such that
+  `in_force(Resolution, key(R))`. It returns `bool` and does not say *which*
+  resolution closes the document; the views need that resolution.
+- `Mind` exposes `envelopes()` (the image, sorted `(type, key)`),
+  `envelope(kind, id)`, `get(kind, id)` (one typed decode), `receipts()`
+  (every `HuginnCommitReceipt`, decoded from the image), `instance()`,
+  `is_empty()`; `raw_envelope` and `cache` are `pub(crate)`.
+- A receipt names its `writes: Vec<DocumentVersion>` by `(document_type,
+  document_key)` and its `strong_reads` separately; `committed_at` is the
+  `now` admission was passed, RFC3339 seconds UTC (`receipt::candidate`); a
+  strong read is re-inserted unchanged in the swap but recorded under
+  `strong_reads`, never `writes` (`receipt::commit`). A10 refuses a write
+  whose identity the image holds, so **exactly one receipt names any stored
+  document as a write**.
+- `PipelineProvenance { faculty: Faculty, agent, session, tool }` and
+  `Faculty` derive `Serialize`, `Deserialize`, `JsonSchema` (`receipt.rs`).
+- At `d5a36c2a` the leaf's `PipelineDocument` (adjacently tagged `{ kind,
+  value }`), `PipelineRef`, `PipelineKind`, `ResolutionOutcome`, every
+  value type and `PipelineRefusal` derive `Serialize`, `Deserialize` and
+  `JsonSchema`. So a view carrying a `PipelineDocument` derives `JsonSchema`
+  (Q13 A holds with no leaf change).
+- `CultCacheEnvelope { key, type, payload, stored_at: String, schema_id }`.
+  `rg stored_at crates/huginn-mind/src` is empty today.
+- Baseline (probe): detached worktree at `7b67730` under the scratchpad,
+  `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex`, `cargo test -p
+  huginn-mind --lib`: **41 passed, 0 failed, 5.5 s wall warm**; target dir
+  10,579 paths before and after; worktree removed; main tree untouched.
+
+### What the cut does
+
+The read side of a mind, in `huginn-mind`, testable over a `&Mind<MemoryStore>`
+with no store file, daemon or index:
+
+- **Views.** `PipelineDocumentView { id, document, admission, status }`: the
+  document, the admission facts joined from the one receipt that wrote it
+  (`receipt_id`, `admitted_at`, `provenance` whole), and its status derived
+  at read time (`InForce`, or `Resolved` by a named in-force resolution).
+- **Queries.** `Mind::view(&PipelineRef)`, `Mind::query(&PipelineQuery)`
+  (by campaign root, repo, cut, kinds, in-force, faculty, admission window;
+  capped at 200, ordered by `(admitted_at, id)`, with the match count so a
+  truncation is visible), `Mind::open_items(&campaign)`, and
+  `Mind::history(&HistoryScope)` — every resolution a subject ever had, or
+  every assignment of a repo on this mind, in sequence order, withdrawn ones
+  included with their status and reasons (R-B).
+- **One owner for in force.** `Docs` and every derivation move whole from
+  `admission.rs` into `src/docs.rs`. The views read through the same
+  `Docs`; the one helper they need that admission lacks
+  (`closing_resolution_unless`, the resolution that closes a document)
+  becomes the body of `in_force_unless`, so admission calls it too. No
+  derivation reads `stored_at` (R-C).
+- **`semantic` is accepted and refused typed** (`Unavailable`) until Cut 11.
+
+Requirements carried in, restated so Hands reads them here:
+
+- **R-A (Q17 B, Cut 6d follow-up).** Status is the recursive in-force
+  derivation admission uses; a test pinning the non-recursive form pins
+  the defect. The reopen case (n1, its withdrawal, n2) is in the status test.
+- **R-B (Q17's two obligations).** A subject's resolution history is a
+  first-class view with withdrawn records and their reasons; the index
+  (Cut 11) gets a document-plus-admission source, which is `Mind::view` per
+  landed `PipelineRef`, so withdrawals are indexable documents with their
+  `reason` in the payload.
+- **R-C (Soul, Cut 8 Huginn half).** `stored_at` is the store's stamp;
+  `admitted_at` is the receipt's `committed_at`. Pinned by a runtime test
+  that scrambles `stored_at` and by a negative grep.
+- **Soul's standing findings the views must not hide:** history lands one
+  record per batch (Cut 12's import constraint), so two records of one
+  scope carry two receipts; the history test asserts distinct `receipt_id`s.
+  Replay refuses once a scope has advanced (ruling 20); the views do not
+  touch replay and add no path around it.
+
+### What changed against the old Cut 9 section
+
+1. **`Docs` moves; nothing is copied.** The old section had "Deletes first:
+   none" and a `src/query.rs` with its own derivations. That would be a
+   second in-force. The shared module is the cut's first commit.
+2. **Five functions collapse to four, differently cut.** `get` becomes
+   `view` (a document with its facts and status); `rulings_in_force` and
+   `stewardship` are `query` presets (`kinds: [Ruling], in_force: true,
+   campaign` and `kinds: [Stewardship], in_force: true`) and are deleted
+   from this crate's surface; `history` is new (R-B); `open_items` stays.
+3. **`PipelineQuery` sheds three fields.** `instance` (the mind is the
+   instance; D6's request carries it and the daemon routes on it),
+   `outcome` (`history` carries outcomes; a document's closing outcome is in
+   its `status`), `text_contains` (Q21 below; Cut 11 owns which fields are
+   text). `status` becomes `in_force: Option<bool>`.
+4. **The view is four fields, not seven.** `receipt_id`, `admitted_at` and
+   `faculty` fold into `admission: AdmissionFacts` carrying the whole
+   provenance; `resolution: Option<(id, PipelineResolution)>` becomes
+   `status: PipelineStatus`.
+5. **A query result says how many matched.** `PipelineQueryPage { items,
+   matched }`; the cap never truncates silently.
+6. **A document with no receipt is refused, not shown.** The store is the
+   organ's alone; a row admission did not write is an integrity fault
+   (`Unavailable`), the same answer `Docs::from_image` gives a row that does
+   not decode.
+7. **Tests 6 → 10, mutations 3 → 23**, in `tools/eureka-cut9-mutations.psd1`;
+   three cut-8 entries re-anchor to `docs.rs`.
+
+### Decisions, with the reasons
+
+#### D1. The shared derivation module is a move of `Docs`, not a new abstraction
+
+`Docs` already is the thing: "the image and the batch, the two places a rule
+may look". The views look at the image alone, which is `Docs` with an empty
+batch, built by the same `Docs::from_image(mind.envelopes())`. Moving the
+struct and its `impl` into `src/docs.rs` (`pub(crate)`, fields `pub(crate)`
+so H49's mutant in `check` still compiles) changes no derivation and no
+call site: `admission.rs` keeps `stage`, `refuse_foreign_instance`,
+`references`, `resolve`, `derive`, `check`, `revision_rule`,
+`unique_labels`, `outcome_name`, `matrix`, `resolution_rule`,
+`refuse_collisions`, `kind_of_id`, and every `docs.` call reads as before.
+`later_than` moves because only `later_in_force` calls it. `kind_of_type`
+moves with `from_image`.
+
+Rejected: a trait over "a document set" implemented by the image and by
+image ∪ batch. It would be one implementor with a flag; `Docs` with an
+empty batch is that already.
+
+#### D2. The one new derivation: which resolution closes a document
+
+`in_force_unless` answers "is any in-force resolution naming this document
+other than `own`?" as a `bool`. The views need the resolution itself for
+`PipelineStatus::Resolved`. So:
+
+```
+fn closing_resolution_unless(&self, kind, id, own) -> Option<(&str, &PipelineResolution)>
+    = self.resolutions().find(|(key, r)| r.subject.kind == kind && r.subject.id.0 == id
+                                       && !own(r) && self.in_force(Resolution, key))
+fn closing_resolution(&self, kind, id) -> Option<(&str, &PipelineResolution)>
+    = self.closing_resolution_unless(kind, id, |_| false)
+fn in_force_unless(&self, kind, id, own) -> bool
+    = self.closing_resolution_unless(kind, id, own).is_none()
+```
+
+`find` is exact, not a tie-break: under `AlreadyResolved` (A8) and the Q19
+cap at most one resolution of a subject is in force. Admission's callers of
+`in_force`/`in_force_unless` change nothing and now run through the same
+`find` the views do; H41's mutant lands inside `closing_resolution_unless`
+and kills admission's reopen test and the views' status test alike, which is
+the proof that there is one owner (V1 below).
+
+Two small extractions for the history views, so that `history` shares
+admission's scope selection rather than restating it:
+
+```
+fn resolutions_of(&self, subject: &PipelineRef) -> impl Iterator<Item = (&str, &PipelineResolution)>
+    = self.resolutions().filter(|(_, r)| r.subject == *subject)
+fn assignments_of(&self, mind: &Slug, repo: &OrgRepo) -> impl Iterator<Item = (&str, &PipelineStewardship)>
+    = self.stewardships().filter(|(_, s)| s.instance == *mind && s.repo == *repo)
+```
+
+`latest_resolution` becomes `resolutions_of(subject).filter(own != …).map(sequence).max()`;
+`latest_stewardship` and `stewardships_of` (the in-force ones; name kept)
+filter `assignments_of(mind, repo)`. Same results, one scope selector each.
+H47 and H60 anchor lines inside these two and re-anchor (Per-file changes).
+
+The history is selected by the `subject` field, as `latest_resolution`
+already does, not by the `…<kind>.<local>.n` key prefix. The leaf's test
+`a_subjects_resolutions_share_a_prefix_no_other_key_has` pins that the two
+select the same set; the prefix is the storage-level affordance (Studio, a
+raw scan), the field is the organ's, and the views parse no key part for it.
+
+#### D3. Admission facts come from receipts, from `writes` only
+
+```
+pub struct AdmissionFacts { pub receipt_id: String, pub admitted_at: String, pub provenance: PipelineProvenance }
+```
+
+Built once per read as `AdmissionIndex` (`pub(crate)`, in `query.rs`): a
+`BTreeMap<(String, String), AdmissionFacts>` over `mind.receipts()?`,
+inserting every `receipt.writes[].identity()` with `admitted_at =
+receipt.committed_at`. `strong_reads` are never read: a document cited by a
+later batch keeps its first receipt. Two receipts naming one write, or a
+pipeline document in the image that no receipt names, is
+`Unavailable { detail: "document <type>/<key> has no commit receipt" | "… is written by two receipts" }`,
+raised from `view` and `query` alike, never a silent skip (V4). The epoch
+record and the receipts themselves appear in `writes` and are simply never
+looked up.
+
+`admitted_at` is the caller's `now` as admission stored it (`committed_at`,
+RFC3339 `Z`, seconds), so its string order is its time order; the crate
+still reads no clock. `stored_at` is not consulted anywhere (R-C; V2).
+
+Rejected: `admission: Option<AdmissionFacts>` with `None` for an
+unreceipted row. That is the "show it and let the reader guess" shape; the
+store has one writer and the receipt is its proof.
+
+#### D4. The view is a struct of four fields
+
+A `(document, facts, status)` tuple serialises as a positional JSON array
+and gives Cut 13's tool schema three unnamed slots, and it cannot carry the
+id: a `PipelineDocument` does not carry its key, the client must not derive
+keys (Cut 13's negative grep), and every follow-up call (`history`,
+`view`) takes a `PipelineRef`. So:
+
+```
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct PipelineDocumentView {
+    pub id: PipelineRef,
+    pub document: PipelineDocument,
+    pub admission: AdmissionFacts,
+    pub status: PipelineStatus,
+}
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum PipelineStatus {
+    InForce,
+    Resolved { resolution: PipelineRef, record: PipelineResolution },
+}
+```
+
+`Resolved.record` is the whole closing resolution (outcome, rationale,
+`resolved_on`) because rehydration wants why, not only that. Kinds the
+matrix makes unresolvable (campaign, cut_report, verdict, instance,
+hand_off) are always `InForce`, by the same derivation and no special case.
+A withdrawn resolution's own view is `Resolved { resolution: <its
+withdrawal>, record: { outcome: Withdrawn { reason }, .. } }`, which is how
+R-B's "with their reasons" reaches an agent.
+
+#### D5. The query type
+
+```
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct PipelineQuery {
+    pub campaign: Option<Slug>,        // the key's root: a campaign slug, or an instance for stewardships and hand-offs
+    pub repo: Option<OrgRepo>,
+    pub cut: Option<Label>,
+    pub kinds: Vec<PipelineKind>,      // empty = every kind
+    pub in_force: Option<bool>,
+    pub faculty: Option<Faculty>,      // attribution, ruling 18: it filters, it grants nothing
+    pub admitted_after: Option<Short>, // exclusive, string-compared against `admitted_at`
+    pub admitted_before: Option<Short>,// exclusive
+    pub limit: Option<u32>,            // None = QUERY_LIMIT_MAX; clamped to 1..=QUERY_LIMIT_MAX
+    pub semantic: Option<SemanticQuery>,
+}
+pub struct SemanticQuery { pub text: Line, pub top_k: u32 }
+pub struct PipelineQueryPage { pub items: Vec<PipelineDocumentView>, pub matched: u32 }
+pub const QUERY_LIMIT_MAX: usize = 200;
+```
+
+Filter semantics, each one rule:
+
+| Filter | Matches |
+|---|---|
+| `campaign` | the key's root segment equals it. The grammar is `<root>:<kind>:<local>`, three segments for every kind (`pipeline_id`; leaf test `every_key_has_exactly_three_segments`), and `kind_of_id` in admission already reads the kind segment the same way. A resolution's root is its subject's root, so a campaign's resolutions match with it. |
+| `repo` | `campaign.repos` contains it; `cut_spec.repo`, `cut_report.repo`, `follow_up.repo`, `stewardship.repo`, `hand_off.repo` equal it; a resolution matches when its **base** matches. target, question, ruling, verdict, finding, instance carry no repo and never match. |
+| `cut` | the local begins with `cut-<label>.` (cut_spec `cut-<label>.r<N>`, cut_report `.h<N>`, verdict `.s<N>`, finding `.s<N>.<label>`: the leaf's `parent_cut` guarantees the prefix), or a resolution whose base matches. No walking of references; the key already carries the chain. |
+| `kinds` | `document.kind()` is in the list; empty list matches all. |
+| `in_force` | `status` is `InForce` (true) or `Resolved` (false). |
+| `faculty` | `admission.provenance.faculty` equals it. |
+| `admitted_after` / `admitted_before` | `admitted_at > after`, `admitted_at < before`, plain string comparison; a caller passes RFC3339 UTC (a date alone, `2026-09-16`, compares correctly against `2026-09-16T…`). |
+| `semantic` | refused before any filter runs: `Err(Unavailable { detail: "semantic query: the index is not wired (Cut 11)" })`. Typed, never empty. |
+
+**Base of a resolution:** follow `subject` while the subject is a resolution
+(depth ≤ 2 by Q19 A); the base is the first non-resolution document, found
+through `Docs::find`. A7 guarantees it is in the image.
+
+Ordering: `(admitted_at, id)` ascending, `id` the key string; ties within one
+batch (same `committed_at`) fall to key order, which is root-first and so
+differs from the image's `(type, key)` order (the seed batch orders
+`eureka-state:campaign:self`, `eureka-state:target:r1`,
+`yggdrasil:instance:self`, `yggdrasil:stewardship:…` by id and
+campaign, instance, stewardship, target by type). `matched` is the count
+before the cut. Stated limit: no cursor; a caller pages by
+`admitted_after` at second granularity and sees `matched > items.len()`
+when a page is short. Exact paging is a follow-up if a proof campaign ever
+shows a query over 200 matches (Findings).
+
+`instance` is not a query field: `query` takes `&self` on one mind. The
+daemon selects the mind from the request's `instance` (D6) before it calls
+anything here.
+
+#### D6. `open_items`
+
+```
+pub struct PipelineOpenItems {
+    pub questions: Vec<PipelineDocumentView>,
+    pub findings: Vec<PipelineDocumentView>,
+    pub follow_ups: Vec<PipelineDocumentView>,
+    pub specs_without_report: Vec<PipelineDocumentView>,
+    pub reports_without_verdict: Vec<PipelineDocumentView>,
+}
+```
+
+`Mind::open_items(&self, campaign: &Slug)`: root equals the campaign for
+every list; `questions`, `findings`, `follow_ups` are those kinds in force;
+`specs_without_report` are in-force cut specs no cut report's `cut_spec`
+names (a superseded `r1` is not open; `r2` with no report is); `reports_without_verdict`
+are cut reports no verdict's `cut_report` names (reports are not
+resolvable, so in-force is not a condition). Each list in query order,
+uncapped: the open set of one campaign is bounded by the campaign and
+truncating it would hide work.
+
+#### D7. `history`
+
+```
+pub enum HistoryScope { Subject(PipelineRef), Repo(OrgRepo) }
+```
+
+`Mind::history(&self, scope)`: `Subject` → `resolutions_of(subject)`;
+`Repo` → `assignments_of(self.instance(), repo)`. Views, ordered by the
+record's `sequence` ascending (the sequence is the owner of history order;
+`admitted_at` coincides but is not the rule), uncapped. A resolution's own
+withdrawals are not in its subject's history (their subject is the
+resolution); `history(Subject(<resolution id>))` lists them. Each record
+carries its own receipt (one per batch).
+
+#### D8. Where the code sits, and dependency injection
+
+`src/query.rs`: the public types above, `AdmissionIndex`, a private
+`Reader<'a> { docs: Docs, facts: AdmissionIndex, mind: &'a Mind<S> }` built
+once per call, and `impl<S: MindStore> Mind<S> { view, query, open_items,
+history }`, following `admission.rs`'s `impl Mind` shape. Every function
+takes `&self`; a test opens `Mind::open_with(MemoryStore::new(), …)` and
+admits through the fixtures. No store file, no daemon, no clock, no new
+dependency; `schemars` and `serde` are already direct dependencies.
+
+`Mind::get(kind, id)` stays: the typed one-document read the opener's
+tests and Cut 12's import use. `view` is the read with facts and status,
+and is what Cut 10's `Get`, Cut 13's `get` and Cut 11's index source call.
+
+Cost, stated: each read call decodes the image once (`Docs::from_image`)
+and every receipt once, as each admission already does. Holding a decoded
+image on `Mind` (refreshed in `refresh`, refused by the opener when a row
+does not decode) would remove both and is recorded under Findings, not
+done here.
+
+### Deletes and moves first
+
+| Path (by name) | Lines | What |
+|---|---:|---|
+| `admission.rs`: `struct Staged`, `struct Held`, `struct Docs`, `fn kind_of_type`, `impl Docs` (every method), `fn later_than` | about 170 | **Move** to `src/docs.rs`. Byte-identical bodies except the three edits in D2 (`closing_resolution_unless` extracted from `in_force_unless`; `resolutions_of`/`assignments_of` extracted from `latest_resolution`, `latest_stewardship`, `stewardships_of`). Fields of `Docs`, `Held`, `Staged` become `pub(crate)`. |
+| `admission.rs` module doc, the sentence beginning `"In force" is recursive` | 3 | Moves to `docs.rs`'s module doc; admission's says where in force lives. |
+| the old Cut 9 section's `rulings_in_force` and `stewardship(instance)` | — | Not built. Presets of `query` (D5); Cut 10's `RulingsInForce`/`Stewardship` operations and Cut 13's two tools become presets when those cuts are refreshed (Findings). |
+| the old section's `PipelineQuery.{instance, status, outcome, text_contains}` | — | Not built (D5, Q21). |
+
+Nothing in the leaf. Nothing in `Cargo.toml`, `Cargo.lock`, the two stubs.
+
+### Keeps
+
+Every admission rule, refusal variant, test name and cut-8 entry (three
+re-anchored). `Mind::get`, `envelopes`, `envelope`, `receipts`. The
+`#[serde(remote)]` mirror in `refusal.rs` is untouched here though dead
+(Findings; Cut 10's). The leaf pin `d5a36c2a`.
+
+### Adds
+
+| Add | Owner | Live consumer | Protected invariant | Why an existing owner cannot serve |
+|---|---|---|---|---|
+| `src/docs.rs` (`pub(crate)`): the moved `Docs` plus `closing_resolution_unless`, `closing_resolution`, `resolutions_of`, `assignments_of` | `huginn-mind` | `admission.rs` (every rule) and `query.rs` (every view) | **One derivation of in force, of a subject's history and of a repo's assignments, shared by admission and the views**; status is computed at read time and never stored | It is the existing owner, moved so a second module can reach it without `admission.rs` exporting its internals. |
+| `PipelineDocumentView`, `AdmissionFacts`, `PipelineStatus` (`pub`, `JsonSchema`) | `huginn-mind` | Cut 10's `Get`/`Query` responses; Cut 11's index source (`view` per landed ref); Cut 13's `get`/`query`/`open_items` outputs (Q13 A) | A client never re-derives status or joins receipts; the id travels with the document | Nothing carries id + document + facts + status; the leaf owns no receipt and no status. |
+| `PipelineQuery`, `SemanticQuery`, `PipelineQueryPage`, `QUERY_LIMIT_MAX` | `huginn-mind` | Cut 10's `Query`; Cut 13's `query` | The cap and the stable order; a truncation is visible; `semantic` is typed-refused until Cut 11 | — |
+| `PipelineOpenItems`, `HistoryScope` | `huginn-mind` | Cut 13's `open_items`; a new Cut 13 `history` tool (Findings, Cut 13's refresh) | Open work and a scope's history are derived, not maintained | — |
+| `AdmissionIndex` (`pub(crate)`) | `query.rs` | the four read functions | Facts come from `writes` only; an unreceipted row refuses | The receipt is `receipt.rs`'s; this is its read side. |
+| `impl<S: MindStore> Mind<S> { view, query, open_items, history }` | `huginn-mind` | as above | D1's injection: testable over `MemoryStore` | — |
+| fixtures: `admit_at(mind, documents, now)`, `admit_as(mind, faculty, documents)`, `question_n(label)` → `question(&format!("Q{n}"), &["A","B"], "A")` | tests | the ordering, faculty and cap tests | — | `admit` fixes clock and faculty. |
+| ten tests, `tools/eureka-cut9-mutations.psd1` (V1-V23) | the crate's suite | Epiphany's harness with `-Repo` | every rule above has a runtime mutant | — |
+
+No dependency, target, binary, document type, schema, kind, format or
+epoch. `refusal.rs` gains no variant: `Unavailable { detail }` carries the
+two integrity cases and the semantic refusal, as it carries every other
+"the organ cannot answer" case.
+
+### Per-file changes, by name
+
+**`crates/huginn-mind/src/docs.rs`** (new). Module doc: "The image and the
+batch, the two places a rule or a view may look, and every derivation over
+them. *In force* is recursive: a document is in force when no resolution that
+is itself in force names it, so a withdrawn resolution stops closing its
+subject. Computed over image and batch at rule time, over the image at read
+time, never stored, and never from `stored_at`." Then, moved: `Staged`,
+`Held`, `Docs` (fields `pub(crate)`), `kind_of_type`, `impl Docs` with the
+D2 edits, `later_than`. `in_force_unless`'s doc comment stays on it;
+`closing_resolution_unless` gets: "The in-force resolution naming the
+document, other than `own`, if any; exact rather than a tie-break because
+A8 and the Q19 cap admit at most one."
+
+**`crates/huginn-mind/src/admission.rs`**: `use crate::docs::{Docs, Staged};`
+(and `Held` only if a remaining fn names it; today none does). The moved
+block deleted. Module doc: the "In force is recursive" sentence replaced by
+"In force, the sequences and the scopes are `docs.rs`'s, shared with the
+views (Cut 9)." Every `docs.` call unchanged. The batch in flight touches
+`derive`; nothing here overlaps it except by import.
+
+**`crates/huginn-mind/src/query.rs`** (new): D3-D8. `Reader::new(mind)`
+calls `Docs::from_image(mind.envelopes())?` and `AdmissionIndex::build(mind)?`;
+`Reader::view_of(&Held) -> Result<PipelineDocumentView, MindRefusal>`
+(facts lookup, `closing_resolution` → status); `Reader::base(&Held) ->
+&Held` for resolutions; `Reader::matches(&PipelineQuery, &Held, &view)`;
+`fn ordered(views) -> Vec<…>` sorting by `(admission.admitted_at, id.id.0)`.
+`query`: `semantic` check first; collect matching views; `matched = len`;
+sort; truncate to the clamped limit.
+
+**`crates/huginn-mind/src/lib.rs`**: `mod docs;` (private), `pub mod query;`,
+re-exports `pub use query::{AdmissionFacts, HistoryScope, PipelineDocumentView,
+PipelineOpenItems, PipelineQuery, PipelineQueryPage, PipelineStatus,
+SemanticQuery, QUERY_LIMIT_MAX};`. Module doc: after the three decisions,
+one sentence: "The read side derives status, joins the receipts and answers
+typed queries through the same `docs` the rules use; nothing is stored for
+it."
+
+**`crates/huginn-mind/src/fixtures.rs`**: the three helpers above; `admit`
+becomes `admit_at(mind, documents, now())`.
+
+**`tools/eureka-cut8-mutations.psd1`**: header `-Target` gains
+`crates/huginn-mind/src/docs.rs`. H41: `File` → `docs.rs`; `Old` is the
+`&& !own(resolution)` / `&& self.in_force(PipelineKind::Resolution, key)`
+pair as it lands in `closing_resolution_unless`. H47: `File` → `docs.rs`;
+`Old`/`New` re-anchored on `stewardships_of`'s filter as it lands over
+`assignments_of` (the mutant still drops the `in_force_unless` conjunct).
+H60: `File` → `docs.rs`; `Old` re-anchored on `latest_resolution`'s body
+over `resolutions_of` (the mutant still reads `self.image` only). H49 is
+unchanged (its `New` reads `docs.image`, which `pub(crate)` keeps legal).
+Every other entry anchors code that does not move (Hands greps each `Old`
+once after the move; the harness refuses a zero-match anchor anyway).
+
+**`tools/eureka-cut9-mutations.psd1`** (new): V1-V23 below.
+
+**`README.md`, `AGENTS.md`**: the live-crate sentence gains "queries and
+derived status"; no present-tense claim about Cuts 10-13.
+
+### Authority map
+
+- **Owner:** `huginn-mind`. Inside it, `docs::Docs` owns every derivation
+  (in force, the closing resolution, the sequences, the scopes);
+  `query::AdmissionIndex` owns the join of admission facts;
+  `Mind::{view, query, open_items, history}` own the read surface;
+  `Mind::admit_prepared` still owns admission and calls `Docs` as before.
+- **Inputs:** `mind.envelopes()` (decoded through the leaf's `decode`),
+  `mind.receipts()`, the query argument, the mind's instance. **Not
+  inputs:** `stored_at`, a clock, the environment, a store handle, the
+  index.
+- **Outputs:** `PipelineDocumentView`s, `PipelineQueryPage`,
+  `PipelineOpenItems`, `MindRefusal::Unavailable` for the two integrity
+  faults and the semantic refusal.
+- **Derived state:** status, the base of a resolution, the admission index,
+  the order, the match count — all computed per call, none stored. No
+  admission writes an `in_force`, `status` or `admitted_at` field; the
+  receipt's `committed_at` is the only stored time the views read.
+- **Forbidden writers:** `query.rs` may not decide in force, a sequence or
+  a scope by any rule of its own (it calls `Docs`); may not read
+  `stored_at`; may not construct a receipt, call the store, or write; may
+  not parse a sequence out of a key; may not derive a key. `admission.rs`
+  may not keep a private copy of any `Docs` method. Cut 10's daemon, Cut
+  11's index and Cut 13's client may not compute status; the index may not
+  index status (D5) though the view carries it.
+- **Shared paths:** `Docs::from_image` and every derivation, called by
+  admission over image ∪ batch and by the views over the image;
+  `closing_resolution_unless` under both `in_force_unless` and
+  `PipelineStatus`; `Mind::view` under `get` (Cut 10/13) and the index
+  (Cut 11).
+- **Deletion line:** the move out of `admission.rs` lands in the first
+  commit, before `query.rs` exists; `cargo test -p huginn-mind --lib` is
+  41 green between the two commits.
+
+### Verification
+
+**Commits.** (1) `docs.rs` move with D2's three edits, three cut-8 entries
+re-anchored, 41 tests green, H1-H61 killed. (2) `query.rs`, fixtures, the
+ten tests, `lib.rs`, README/AGENTS. (3) `eureka-cut9-mutations.psd1`, all
+entries killed. Soul verifies per commit.
+
+**Builds.** `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex`; path-list
+baseline before and after; **no `cargo clean` of any scope** (the fix batch's
+deviation). `cargo check -p huginn-mind --lib --tests`; `cargo test -p
+huginn-mind --lib` (41 + 10 = **51 tests**, 0 warnings); `cargo check
+--workspace`; `cargo tree -p huginn-mind -e normal -d` unchanged. Host =
+target = workstation; no platform code touched.
+
+**Tests**, `crates/huginn-mind/src/query.rs`, each named for the rule it pins.
+
+| Test | Pins |
+|---|---|
+| `status_is_the_derivation_admission_uses` | R-A. Q1 open → `InForce`; a ruling answers it → `Resolved { resolution: …question.Q1.n1, record.outcome: Answered }`; withdraw n1 → Q1 `InForce` again and n1's own view `Resolved { resolution: …question.Q1.n1.n1, record.outcome: Withdrawn { reason } }`; resolve n2 → Q1 `Resolved { …n2 }`. The ruling stays `InForce` after its resolution is withdrawn (Soul's observation). A campaign and a verdict are `InForce` with no special case. |
+| `a_subjects_history_lists_every_resolution_with_its_status_and_receipt` | R-B, D7, V9-V10. Ten reopen cycles on Q1 (n1..n10 with withdrawals of n1..n9): `history(Subject(Q1))` is exactly n1..n10 in sequence order (n10 after n9, not after n1), n1..n9 each `Resolved` by its withdrawal with `Withdrawn { reason }`, n10 `InForce`; no withdrawal in the list; `history(Subject(<n1>))` is `[n1.n1]`; every record's `receipt_id` distinct (one per batch). |
+| `a_repos_stewardship_history_on_a_mind_lists_every_assignment` | D7, V11. Hand off `REPO` away and back, and `OTHER_REPO` once: `history(Repo(REPO))` is `[n1 Resolved { Withdrawn { reason: <hand-off key> } }, n2 InForce]` with `assigned_on` the two `handed_on`s; `OTHER_REPO` absent; the other mind is not consulted. |
+| `views_join_admission_facts_from_the_receipt_that_wrote_them` | D3, V3-V4. `receipt_id` equals `Committed.receipt_id`; `admitted_at` equals `committed_at` and the `now` passed; `provenance` equals the batch's; a derived write (the `Answered` resolution) carries the ruling's receipt; a document cited as a strong read by a later batch keeps its first receipt; a planted pipeline document with no receipt (`MemoryStore::plant`, then `open_with`) makes `view` of it and any `query` `Unavailable` naming it. |
+| `views_read_admitted_at_from_the_receipt_not_stored_at` | R-C, V2. Seed and admit at two `now`s; copy every row into a second `MemoryStore` with `stored_at` overwritten by a constant, and again with the stamps reversed; `open_with` each; `query` and `history` outputs equal the original's. |
+| `query_filters_each_select_by_one_field` | D5, V16-V23. One assertion per filter: `campaign` (a second campaign on the same repo; a resolution matches by its root; a stewardship matches under the instance root), `repo` (`campaign.repos` contains; `cut_spec.repo`; a question never), `cut` (cut-9 spec, report, verdict, finding and the spec's supersession match; cut-10's do not; a ruling never), `kinds`, `in_force` both ways, `faculty` (admitted as `Soul` vs `Hands`), `admitted_after`/`admitted_before` at the exact boundary (exclusive). |
+| `query_orders_by_admitted_at_then_id_and_caps_at_200_with_the_match_count` | D5, V5-V7. 201 questions over four batches at rising `now`s, Q2's batch before Q1's; `limit: Some(500)` → 200 items, `matched: 201`, first item Q2's batch; `None` → 200; `Some(0)` → 1; `Some(5)` → 5. The seed batch (one `now`) orders by id: `campaign:self`, `target:r1`, `instance:self`, `stewardship:…`, not by type. |
+| `open_items_are_derived_from_in_force_and_citation` | D6, V12-V15. Open: an unanswered question, a `Plausible` finding, a follow-up, spec `cut-9.r2` (r1 superseded, no report), report `cut-10.h1` (no verdict). Not open: the answered question, the `Fixed` finding, `r1`, a spec with a report, a report with a verdict, a second campaign's question. |
+| `semantic_query_refuses_typed_until_wired` | D5, V8. `semantic: Some(..)` with every other filter set → `Err(Unavailable)`, never `Ok(empty)`; the same query without `semantic` → `Ok`. |
+| `view_of_an_absent_id_is_none_and_of_a_present_one_is_its_document` | D4/D8. `view` of an absent ref → `Ok(None)`; of a present one → the decoded document equal to `Mind::get`'s and the key equal to `id.id`. |
+
+**Negative greps** (`crates/huginn-mind/src`):
+
+- `rg -n "stored_at"` empty.
+- `rg -n "fn in_force|fn closing_resolution|fn latest_resolution|fn latest_stewardship|fn stewardships_of|fn later_in_force|fn resolutions_of|fn assignments_of"` matches in `docs.rs` only, once each.
+- `rg -n "struct Docs|struct Held|struct Staged|fn later_than|fn kind_of_type"` in `docs.rs` only.
+- `rg -n "Utc::now|SystemTime::now|std::env::var"` empty.
+- `rg -n "pipeline_key|split\(':'\)" query.rs`: no `pipeline_key`; `split(':')` at most in the one root/local reader (the same shape `kind_of_id` uses).
+- `rg -n "compare_and_swap|prepare_entry|HuginnCommitReceipt \{" query.rs` empty.
+- `rg -n "reqwest|qdrant|ollama|IndexPort|EmbeddingPort|pending_index" crates/huginn-mind` empty (Cut 11's).
+- `rg -n "rulings_in_force|fn stewardship\(|text_contains|outcome:" query.rs` empty of any function or field by those names.
+- `git diff --stat 7b67730 -- Cargo.toml Cargo.lock crates/huginn-mind/Cargo.toml` empty (after the batch in flight lands, against its commit).
+
+**Suites that must still kill every entry:** `eureka-cut8-mutations.psd1`
+(H1-H61 with H41, H47, H60 re-anchored; `-Target` gains `docs.rs`) and the
+new `eureka-cut9-mutations.psd1`, both through `tools/eureka-mutations.ps1`
+with `-Repo F:\Projects\Huginn`, M0 green. Cut 9's run:
+
+```
+powershell -File F:\Projects\Epiphany\tools\eureka-mutations.ps1 -Repo F:\Projects\Huginn `
+    -Entries tools/eureka-cut9-mutations.psd1 `
+    -Target crates/huginn-mind/src/docs.rs,crates/huginn-mind/src/query.rs `
+    -Test 'cargo test -p huginn-mind --lib'
+```
+
+#### Mutations, `tools/eureka-cut9-mutations.psd1`
+
+Each rule has a **revert** (the old permissiveness: the rule absent) and,
+where one exists, a **loosening** (the rule weakened, not absent). Anchors
+are content Hands lands, matched exactly once; `Killed by` names the test
+the entry runs; collateral kills are noted where they are the point.
+
+| # | Rule | Revert | Loosening | Killed by |
+|---|---|---|---|---|
+| V1 | One owner for in force (D2) | `closing_resolution_unless` body → `None` (nothing ever closes) | H41's form: drop `&& self.in_force(PipelineKind::Resolution, key)` (a withdrawn resolution still closes) | `status_is_the_derivation_admission_uses`; collaterally `a_withdrawn_resolution_reopens_its_subject_and_stays_readable` and `a_document_is_written_once_and_superseded_by_resolution` in the full run — the same anchor as H41, listed twice on purpose: one mutant, two suites, one owner |
+| V2 | `admitted_at` is the receipt's, not the store's (R-C) | `admitted_at: receipt.committed_at.clone()` → `mind.raw_envelope(&write.document_type, &write.document_key).map_or_else(\|\| receipt.committed_at.clone(), \|e\| e.stored_at.clone())` | none: one source field | `views_read_admitted_at_from_the_receipt_not_stored_at` |
+| V3 | Facts from `writes` only (D3) | — | `receipt.writes.iter()` → `receipt.writes.iter().chain(&receipt.strong_reads)` (a later citation overwrites the first receipt) | `views_join_admission_facts_from_the_receipt_that_wrote_them` |
+| V4 | An unreceipted row refuses, not hides (D3) | `Edits`: in `query`'s loop `let facts = …?;` → `let Ok(facts) = … else { continue };`, in `view` → `else { return Ok(None) };` | the two-receipts check dropped (`insert` without the `is_some()` refusal) | the same test |
+| V5 | The cap (D5) | `.clamp(1, QUERY_LIMIT_MAX)` → `.max(1)` | `QUERY_LIMIT_MAX: usize = 200` → `201` | `query_orders_by_admitted_at_then_id_and_caps_at_200_with_the_match_count` |
+| V6 | Stable order `(admitted_at, id)` | sort by `id` only | sort by `admitted_at` only (stable over image order, so ties fall to `(type, key)`) | the same test (Q2 before Q1; the seed batch's id order) |
+| V7 | `matched` is the count before the cut | `matched` computed after `truncate` | — | the same test |
+| V8 | `semantic` refuses typed (D5) | the `semantic` arm returns `Ok(PipelineQueryPage { items: vec![], matched: 0 })` | the check moved after the filters (still refuses; equivalent — recorded as such, not an entry) | `semantic_query_refuses_typed_until_wired` |
+| V9 | History is in sequence order (D7) | the sort removed (image order: n1, n10, n2, …) | none: every other order the data offers (`admitted_at`, receipt order) coincides with sequence in a well-formed mind | `a_subjects_history_lists_every_resolution_with_its_status_and_receipt` |
+| V10 | `Subject` history selects by subject | `resolutions_of` → `resolutions()` (every resolution) | subject compared by `id` only, `kind` ignored | the same test (withdrawals excluded; `history(<n1>)` exact) |
+| V11 | `Repo` history selects `(mind, repo)` | `assignments_of` → `stewardships()` | `repo` compared, `instance` ignored | `a_repos_stewardship_history_on_a_mind_lists_every_assignment` |
+| V12 | Open questions/findings/follow-ups are in force (D6) | the `InForce` condition dropped | — | `open_items_are_derived_from_in_force_and_citation` |
+| V13 | Specs without report: in force only | in-force dropped (superseded r1 counted) | — | the same test |
+| V14 | Reports without verdict | the citation check dropped (every report open) | citation compared by `cut` prefix instead of the exact id | the same test |
+| V15 | Open items are one campaign's | the root filter dropped | — | the same test |
+| V16 | `cut` filter is the label | `starts_with(&format!("cut-{label}."))` → `starts_with("cut-")` | the trailing `.` dropped (`cut-9` matches `cut-90`) | `query_filters_each_select_by_one_field` |
+| V17 | Filters reach a resolution through its base | `base()` returns the resolution itself | base followed one step, not to the non-resolution | the same test (the spec's supersession matches `cut`) |
+| V18 | `campaign` is the key root | the filter dropped | compared against `campaign` fields only (stewardship under the instance root, and resolutions, never match) | the same test |
+| V19 | `kinds` | dropped | — | the same test |
+| V20 | `in_force` | dropped | inverted | the same test |
+| V21 | `faculty` (attribution filters, grants nothing) | dropped | — | the same test |
+| V22 | `admitted_after`/`admitted_before` exclusive | dropped | `>` → `>=` | the same test (the boundary case) |
+| V23 | `repo` matches `campaign.repos` and the five repo fields | dropped | `campaign.repos` omitted | the same test |
+
+Stated limits: the recursion's termination (`key(R)` strictly longer than
+`id`) has no runtime mutant, as in Cut 6d; the `JsonSchema` derives are
+pinned by compilation of Cut 13, not here; V8's "moved check" is
+equivalent and is recorded, not run.
+
+**Operator checks before landing:** Q21 below has a recommended default
+Hands builds under; nothing blocks.
+
+### Subtraction estimate
+
+Source outside tests: `admission.rs` −about 175 (the move, the doc
+sentence); `docs.rs` +about 205 (the moved 170 plus D2's four helpers and
+docs); `query.rs` +about 330 (types 70, index 45, reader and filters 150,
+the four functions 65); `lib.rs` +4; fixtures +20. Net **+about 385**
+outside tests. Tests +about 520 (ten tests). Entries +about 300 (V1-V23),
+cut-8 re-anchors ±15. Total about +1,200 with tests and entries against the
+old section's +600 (which had six tests and three mutants and a second
+derivation).
+
+Liability retired before it shipped: the second in-force the old section
+implied; two functions (`rulings_in_force`, `stewardship`) and three query
+fields whose meaning was either a preset or a second owner. Nothing in the
+crate is removed net because the read side did not exist; the move is the
+cut's subtraction and it is a real one: after it, `admission.rs` holds no
+derivation.
+
+Kinds, dependencies, lock, targets, formats, schemas, epoch: zero.
+
+### Build budget
+
+`huginn-mind` lib + tests only; the two stubs re-checked by `cargo check
+--workspace` with no change. Debug, workstation host = target, no features,
+no codegen. The leaf rlib and the 90 transitive packages are warm (the probe
+rebuilt only the crate's test binary: 5.5 s). Expected footprint delta: +0
+to +40 paths, all under `debug/` for the crate's own fingerprint and test
+binary; baseline 10,579 paths this pass. Retention: the shared target dir is
+the operator's; **nothing is cleaned**, in any scope.
+
+### Operator questions
+
+- **Q21. `text_contains` until Cut 11?** The landed field set had a
+  substring filter over a document's text. **A. Drop it (recommended).**
+  Cut 11 defines once which fields of each kind are text (its `IndexPoint`
+  source); a substring filter here would be a second definition of "the
+  text of a document", or a filter over serialised JSON, which is the
+  symptom-shaped kind. Until Cut 11 lands, an agent reads views; `history`
+  and `open_items` carry the precedent an agent rehydrates from (ruling 2).
+  **B. Keep it**, built over a `text_of(&PipelineDocument)` projection in
+  `huginn-mind` that Cut 11's index then reuses. Coherent, but it pulls
+  Cut 11's projection forward into this cut for a filter nothing yet
+  consumes. If B, the projection is one owner and `text_contains` is a
+  filter over it; Cut 11's spec must then say it reuses `text_of`.
+  **Taken as a default by Self, 2026-09-16: A.** Not a product fork; a
+  second definition of a document's text is what Cut 11 would have to
+  reuse or delete.
+
+Decisions Self can overturn without an operator (not questions):
+`instance` and `outcome` leave `PipelineQuery` (D5); an unreceipted row
+refuses (D3); the view carries the whole provenance and the whole closing
+record (D4); `open_items` and `history` are uncapped (D6, D7).
+
+### Findings not assignable to this cut
+
+- **`refusal.rs`'s `#[serde(remote)]` mirror `DocumentRefusal` is dead at
+  the pin**: `PipelineRefusal` derives `Serialize`, `Deserialize`,
+  `JsonSchema` at `d5a36c2a`. Cut 8's map already assigns its removal to
+  Cut 10; still true, still not done.
+- **`admission.rs`'s doc on `PipelineAdmissionBatch`** ("the leaf's
+  `PipelineDocument` derives neither `Serialize` nor `JsonSchema` at the
+  pinned rev, so this type cannot either") **is false at the pin** —
+  `PipelineDocument` derives all three (leaf, `pipeline_kinds!`). The batch
+  can derive them now; discrepancy 34's premise is gone. Cut 10's, with the
+  wire.
+- **D4, D6 and D7 in the map are superseded** by this spec: D4's
+  seven-field view and five functions; D6's `RulingsInForce | Stewardship`
+  operations (presets of `Query`); D7's `rulings_in_force` and `stewardship`
+  tools (presets) and a missing `history` tool (R-B's affordance must reach
+  the client or the obligation is unmet at the agent). Self's, at this
+  cut's landing; Cut 10's and Cut 13's refreshes carry them.
+- **Every read decodes the image and the receipts once per call**, as every
+  admission already does. A decoded image held on `Mind` and refreshed in
+  `refresh` would let the opener refuse a non-decoding store up front and
+  remove `Docs::from_image`'s `Unavailable` path from both sides. Not this
+  cut's; worth doing when a mind is large enough to measure.
+- **No exact paging.** A query over 200 matches pages by `admitted_after`
+  at second granularity; `matched` makes the truncation visible. A cursor
+  `(admitted_at, id)` is the exact form if a proof campaign needs it.
+- **The batch in flight** touches `derive` and the cut-8 entries; this cut
+  moves `Docs` out from under `derive`'s call sites. Land order: that batch,
+  then this cut's commit (1). If that batch adds a `Docs` method, it moves
+  with the rest and Hands says so in the report.
+- **`Faculty::SelfFaculty`** is the wire spelling Cut 13's tool schema will
+  show. Cosmetic; noted for Cut 13's refresh, not changed here.
+
+### Pinned HEADs
+
+- Epiphany `codex/eureka-pipeline-state` at `94df3a8f`, tree clean; leaf at
+  `d5a36c2a`, the rev Huginn pins.
+- Huginn `eureka/memory-organ` at `7b67730` with an uncommitted Hands batch
+  in `admission.rs` and `eureka-cut8-mutations.psd1`; this spec anchors by
+  name because of it.
+- CultLib `a0813c6` (the cargo checkout), read for `CultCacheEnvelope`.
+- Probe artifacts: `scratchpad/cut9-wt` (detached at `7b67730`, one `cargo
+  test -p huginn-mind --lib`, 41 passed, removed); `scratchpad/cut9-baseline.log`;
+  `scratchpad/leaf-d5a36c2a.rs` (a `git show` copy, read only). No file in
+  either repo was written; no `notes/` file was touched.
+
+## Cut 10. `huginn-daemon`: the CultNet surface
+
+Imagination, 2026-09-16, refreshed against the Body after Cut 9 landed and
+Q13 was ruled A. Replaces the old Cut 10 section whole. The old section put
+the wire types in a binary crate (overturned by Q13 A), copied Odin's
+document-server harness (which cannot reply to a request), listed operations
+Cut 9 turned into presets, and predated `Mind::{view, query, open_items,
+history}`. Every anchor here is a function, type, constant or test **name**,
+never a line: a Hands batch is landing in `crates/huginn-mind/src/query.rs`,
+`docs.rs` and `tools/eureka-cut9-mutations.psd1` while this is written (the
+main tree carried those three modified and a harness sidecar at spec time),
+and this cut touches none of those three files.
+
+### Pins
+
+| Repo | Branch | HEAD | State |
+|---|---|---|---|
+| Huginn | `eureka/memory-organ` | `8fc39b1` | the last commit; the Hands batch above is uncommitted in the tree. This cut lands after it. |
+| Epiphany | `codex/eureka-pipeline-state` | `fb18395f` | tree clean; `epiphany-pipeline/src/lib.rs` last moved at `d5a36c2a`, the rev `crates/huginn-mind/Cargo.toml` pins. No Epiphany change in this cut. |
+| CultLib | `main` | `47aa7b6` | `git diff --stat a0813c6 47aa7b6 -- packages/cultcache-rs packages/cultnet-rs packages/cultmesh-rs` is **empty**; every source read below is against the checkout Huginn pins, `a0813c6`. |
+| Odin | `main` | `5a015d9` | read for the house daemon shape (`crates/odin-daemon/src/main.rs`) and Eve document ids (`crates/odin-core/src/documents.rs`). |
+| Idunn | `main` | `5b3f646` | read for the house request/response shape over a hub (`src/host_actuator.rs`, `HostActuatorHub`). |
+| gamecult-ops | `main` | `36a466f` | `systemd/epiphany.service`, `runbooks/odin-yggdrasil.md`, `idunn/yggdrasil/bindings/odin.toml.in`, `inventory.md` (17872 still unallocated). |
+
+Body facts this spec rests on, each by source read of the named file or by
+the probe at the end:
+
+- **`CultMeshRudpDocumentServer` cannot reply to a request.** Its sink is
+  `CultMeshRudpRawDocumentSink::accept_raw_document(receipt) -> Result<()>`;
+  a `DocumentPutRaw` is admitted or rejected (`ApplicationRejected`), and the
+  only bytes that go back are the transport ACK. Reads are `SnapshotRequest`
+  → `SnapshotResponseRaw` selected by `schema_ids`/`record_keys` only
+  (`cultmesh-rs/src/rudp_document_server.rs`, `deliver_application_message`).
+  So D6's "replies go back as `DocumentPutRaw`" has no mechanism, and a
+  `PipelineQuery` cannot ride a snapshot filter. That server is Odin's shape
+  because Odin is a catalog; the organ is a service.
+- **`CultNetRudpServerHub` is the multi-session request/response substrate.**
+  One socket, one `CultNetRudpSession` per remote peer, events
+  `Connected | Frame | Pong | Disconnected` from `receive_event_once`, and
+  `send_schema_message(&session, &CultNetMessage)` addressed to one session
+  by `(remote_addr, session_generation)` (`cultnet-rs/src/rudp.rs`,
+  `CultNetRudpServerHub`). Idunn's `HostActuatorHub::service` is the live
+  house pattern (`Idunn/src/host_actuator.rs`). The hub drops any packet
+  whose `connection_id` is not its own (`receive_packet_once`).
+- **`cultnet.operation_request.v0` / `cultnet.operation_response.v0` are the
+  typed request/response envelope**, with C# reference parity
+  (`CultLib/src/GameCult.Networking/CultNetSchemaMessages.cs`,
+  `CultNetOperationRequestMessage`/`ResponseMessage`; `CultNetOperationServer.cs`
+  with `Accepted`/`Rejected` replies and `FailureSchemaId =
+  "gamecult.cultnet.operation_failure.v1"` carrying `{code, message}`), published
+  JSON at `CultLib/contracts/cultnet/cultnet.operation-{request,response}.schema.json`,
+  and named by Eve as its plugin ABI carrier (`Eve/docs/plugin-architecture.md`,
+  "Executable Plugin ABI"). Fields: `message_id, service_id, operation,
+  payload_schema, payload_encoding, payload, source_runtime_id?,
+  target_runtime_id?`; the response adds `status`, `diagnostics`. CultNet
+  validates `payload_encoding == "messagepack-base64"` and every string
+  non-empty (`contracts.rs`, `validate_message`). The Rust
+  `CultNetOperationServer` (`operation_service.rs`) is a single-peer wrapper
+  over one `CultNetRudpSocketTransportConnection` and nothing in Rust uses
+  it; the C# one is multi-handler. Not used here.
+- **Schema publication over CultNet is `SchemaCatalogRequest` →
+  `CultNetSchemaRegistry::create_catalog_response`**, registrations carry
+  `schema_json` (required, hashed canonically), `kind:
+  WireMessage | DocumentPayload | SharedContract` (`schema_discovery.rs`).
+  This is the one place JSON crosses the wire, and it is schema publication.
+- **A client is `CultMesh::create_rudp_client_for_endpoint(runtime_id,
+  connection_id, "rudp://host:port", CultMeshRudpSocketOptions)`** then
+  `connect`, `send_schema_message`, `receive_schema_message_once`,
+  `poll_resends` (`cultnet-rs/src/cultmesh.rs`, `rudp.rs`). `CultMesh::connect_rudp_client_for_endpoint`
+  does the connect wait. Cut 13 needs nothing else from the transport.
+- **`huginn-mind` at `8fc39b1`:** `Mind::open(state_root, &Slug) ->
+  Result<Mind<OwnedRedbMessagePackBackingStore>, MindRefusal>` with
+  `MindAlreadyOwned` for a held lock (`mind.rs`); `Mind::admit(batch, now)`,
+  `admit_prepared` and step A1 `if instance != self.instance()` inline in
+  `admit_steps` (`admission.rs`); `Mind::{view, query, open_items, history}`
+  (`query.rs`); `PipelineAdmissionBatch` derives only `Clone, Debug,
+  PartialEq, Eq` under a doc comment claiming the leaf's `PipelineDocument`
+  cannot serialise, which is false at `d5a36c2a` (Cut 9's finding);
+  `refusal.rs` still carries the `#[serde(remote = "PipelineRefusal")]`
+  mirror `DocumentRefusal` and the two `with` attributes on
+  `MindRefusal::Document`, dead since the leaf derives all three traits;
+  `store::test_stores::{MemoryStore, RefusingStore}` are `#[cfg(test)]
+  pub(crate)` and unreachable from another crate; `lib.rs` re-exports the
+  read and admission types but not `epiphany_pipeline`; the crate reads no
+  clock and no environment. `Mind<OwnedRedbMessagePackBackingStore>` is
+  `Send` (probe).
+- **Odin's daemon** (`odin-daemon/src/main.rs`): `parse_options` over exact
+  `--state-root --idunn-projection --idunn-anchor`, `GAMECULT_IDUNN_CANDIDATE_BIND`
+  asserted loopback, `signal_hook::flag::register` for SIGTERM/SIGINT with
+  the PID-namespace comment, a bootstrap loop `while !try_activate()` gated
+  on Idunn's process write lease and activation records, a self-presence
+  heartbeat published through `publish_cultnet_message_to_rudp_catalog`, and
+  `std::os::fd::{FromRawFd, RawFd}` for systemd-passed signer descriptors —
+  **Linux-only**. `signal-hook` 0.3 registers SIGTERM/SIGINT on Windows
+  (probe).
+- **`epiphany.service`** spells its endpoints `--qdrant-url`,
+  `--ollama-base-url`, `--ollama-model` and its Idunn health as
+  `--idunn-rudp-health 10.77.0.1:17870` (gamecult-ops `systemd/epiphany.service`);
+  those are Cut 11's and Cut 14's flags and are not added here.
+- **Eve's operator surface is a provider advertisement plus surface documents
+  through Odin**: `gamecult.eve.provider_advertisement.v1` (required:
+  `providerId, serviceId, verseId, title, kind, freshness, schemas, witnesses,
+  surfaces, commands`; `Eve/schemas/…provider_advertisement.v1.schema.json`)
+  and `gamecult.eve.surface_state.v1` (`odin-core/src/documents.rs`,
+  `EveSurfaceStateRecord { provider_id, title, version, updated_at, surface:
+  Value }`). Nothing in Rust builds one outside Sleipnir; both carry JSON
+  `Value` bodies. No Eve DSL type exists in `cultnet-rs` or `cultmesh-rs`.
+- **Probe** (detached worktree at `8fc39b1` under the scratchpad,
+  `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex`, PowerShell, `cargo
+  test -p huginn-daemon --lib` once, worktree removed, main tree untouched
+  by it): with the dependency set under Build budget, a `CultNetRudpServerHub`
+  on `127.0.0.1:0` accepted two `CultMesh::create_rudp_client_for_endpoint`
+  clients, received one `OperationRequest` from each carrying a base64
+  `rmp_serde::to_vec_named(PipelineQuery)`, answered each on its own session
+  with an `OperationResponse` carrying a `PipelineQueryPage`, and each client
+  decoded the reply correlated to its own `message_id`. `schemars::schema_for!
+  (PipelineQueryPage)` is 42,899 bytes of JSON. Build 30.4 s warm; lock 93 →
+  139 entries (41 new package names, listed under Build budget); target dir
+  10,619 → 11,030 paths, 8.74 → 9.08 GiB. Probe files kept at
+  `scratchpad/cut10-probe-lib.rs` and `cut10-probe-Cargo.toml`.
+
+### What the cut does
+
+The organ's body: one process that opens one instance's mind, serves
+admission and the read side over CultNet RUDP to whoever can reach its
+socket (the LAN and, through Cut 14's route, WireGuard), refuses to start
+when it cannot open the mind, and publishes its own wire schemas on request.
+
+- **The wire, in `huginn-mind::wire`** (Q13 A): `HuginnMindRequest` with one
+  variant per `Mind` method plus `Whoami`; `HuginnMindResponse` with the
+  method's return type per variant plus `Refused(MindRefusal)` for the read
+  side; `MindStatus`, the answer to `Whoami` and the typed state a dashboard
+  would project. All derive `Serialize, Deserialize, JsonSchema`; the payloads
+  are Cut 8's and Cut 9's types unchanged.
+- **The envelope, in `huginn-daemon::envelope`:** a `HuginnMindRequest` rides
+  `cultnet.operation_request.v0` (`service_id = "huginn.mind"`, `operation` =
+  the variant's name, `payload_schema = "huginn.mind_request.v1"`, `payload` =
+  base64 of named MessagePack); the response rides
+  `cultnet.operation_response.v0` the same way with `status` derived from the
+  response. An envelope the daemon cannot decode is answered with
+  `gamecult.cultnet.operation_failure.v1 { code, message }`, status
+  `rejected`, and touches no mind.
+- **The daemon, in `huginn-daemon::daemon`:** `Daemon<S: MindStore> { mind:
+  Mind<S>, index: I }` and `handle(&mut self, request, now) ->
+  HuginnMindResponse`, a pure dispatch with no socket, no clock and no rule:
+  `Admit` → `mind.admit`; every other instance-bearing request →
+  `mind.require_instance(&declared)?` then the method; after a `Committed`
+  outcome, `index.committed(&mind, &writes)`, whose error is logged and never
+  changes the outcome.
+- **The loop, in `huginn-daemon::serve`:** `run(daemon, hub, registry,
+  stopping)` over `CultNetRudpServerHub`: frames on the `schema` channel are
+  decoded, answered on their session, and every other message is answered
+  with `CultNetMessage::Error`; `SchemaCatalogRequest` is answered from the
+  registry holding the two wire schemas. Hostile datagrams and a departed
+  session are logged and served past, never fatal.
+- **`main`:** `--state-root`, `--instance`, `--bind`; open the mind first,
+  bind second, serve until SIGTERM/SIGINT. A mind that will not open ends the
+  process with the refusal on stderr and no socket ever bound.
+- **One instance check, one owner:** step A1 becomes `Mind::require_instance`,
+  called by `admit_steps` as before and by the daemon for reads. The daemon
+  compares nothing itself.
+
+Not in this cut, by decision: an Eve provider advertisement or surface
+(Q23), the Idunn activation handshake and presence heartbeat (Cut 14),
+Qdrant and Ollama (Cut 11), a hand-off or import operation (Cut 12 decides
+whether it needs one; Findings), and any `.cc` state of the daemon's own.
+
+### What changed against the old Cut 10 section
+
+1. **The wire types move out of the binary** into `huginn-mind::wire` (Q13 A)
+   and the daemon gains a lib target so Cut 13 can run it in-process.
+2. **`CultNetRudpServerHub` + operation envelopes replace
+   `CultMeshRudpDocumentServer` + `DocumentPutRaw`/snapshot**, because the
+   document server has no reply path and a snapshot has no query. `SinkHandle`
+   and `SnapshotHandle` are not built.
+3. **Operations are `Mind`'s methods:** `whoami, admit, view, query,
+   open_items, history`. D6's `Get` is `view`; `RulingsInForce` and
+   `Stewardship` are `query` presets (Cut 9); `HandOff` and `Import` are Cut
+   12's in-process operations and have no wire form here.
+4. **No Odin bootstrap wait, heartbeat, `fs2`, `cultmesh-rs` or
+   `pending_index`.** The Idunn handshake is Linux-only and Cut 14's; the
+   index retry slot is Cut 11's; the daemon holds no lease file of its own
+   (the owned store's lock is the single-writer mechanism, Cut 8).
+5. **The smoke spawns no process.** `serve::run` is driven in-process over a
+   loopback hub; Cut 14's runbook verification exercises the real process.
+6. **Two deletions in `huginn-mind`** the map assigned here: the
+   `DocumentRefusal` mirror, and the false doc on `PipelineAdmissionBatch`
+   (which now derives the three traits).
+7. **Tests 5 → 10, mutations 2 → 16** in `tools/eureka-cut10-mutations.psd1`.
+
+### Decisions, with the reasons
+
+### D1. Request/response over CultNet RUDP through the hub; not a CultMesh publication
+
+Admission is a command with a typed outcome and a query is a filter with a
+page; both are request/response. The three CultNet shapes that could carry
+them, by source read:
+
+| Shape | Reply per request | Multi-session | Query filters | Verdict |
+|---|---|---|---|---|
+| `CultMeshRudpDocumentServer` (D6's) | none from the sink; ACK or rejection | yes | `schema_ids`, `record_keys` only | cannot answer `admit` or `query` |
+| `CultNetOperationServer` (Rust) | yes, typed envelope | no: one peer, a new Connect resets the session | any | one workstation session at a time |
+| `CultNetRudpServerHub` + `OperationRequest`/`Response` | yes, per session | yes | any | **this** |
+
+A CultMesh publication path was considered for admission (put a request
+document, snapshot the response document later): two round trips and a
+response store the daemon would have to own and expire, which is a cache
+pretending to be truth. Rejected. Reads through a snapshot source (D6's
+"plain CultNet snapshot client can read a mind") are also not built: a
+snapshot cannot express `PipelineQuery`, and the raw image is the store's
+shape, not the view's (status and admission facts are derived, Cut 9).
+
+What this buys against doctrine: the organ speaks CultNet (RUDP over UDP,
+ruling 19) with CultLib's own typed envelope that the C# reference and Eve's
+ABI already speak; JSON crosses the wire only as schema publication (D7).
+What it does not buy: a CultMesh state document a dashboard can pull without
+speaking the operation envelope. That is Q23.
+
+### D2. The wire types, exactly
+
+`crates/huginn-mind/src/wire.rs`, `pub mod wire`, re-exported from `lib.rs`:
+
+```rust
+pub const MIND_SERVICE_ID: &str = "huginn.mind";
+pub const MIND_REQUEST_SCHEMA: &str = "huginn.mind_request.v1";
+pub const MIND_RESPONSE_SCHEMA: &str = "huginn.mind_response.v1";
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum HuginnMindRequest {
+    Whoami,
+    Admit(PipelineAdmissionBatch),                       // carries `instance`
+    View { instance: Slug, id: PipelineRef },
+    Query { instance: Slug, query: PipelineQuery },
+    OpenItems { instance: Slug, campaign: Slug },
+    History { instance: Slug, scope: HistoryScope },
+}
+impl HuginnMindRequest {
+    /// The envelope's `operation`: `whoami | admit | view | query | open_items | history`.
+    pub fn operation(&self) -> &'static str;
+    /// The instance the request declares; `Whoami` declares none.
+    pub fn instance(&self) -> Option<&Slug>;
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum HuginnMindResponse {
+    Whoami(MindStatus),
+    Admit(PipelineAdmissionOutcome),
+    View(Option<PipelineDocumentView>),
+    Query(PipelineQueryPage),
+    OpenItems(PipelineOpenItems),
+    History(Vec<PipelineDocumentView>),
+    Refused(MindRefusal),                                // the read side's refusal
+}
+impl HuginnMindResponse {
+    /// The envelope's `status`, the C# reference's vocabulary: `rejected`
+    /// for `Refused(_)` and `Admit(Refused(_))`, `accepted` otherwise
+    /// (`Conflict` and `AlreadyAdmitted` are answers, not refusals).
+    pub fn status(&self) -> &'static str;
+}
+
+/// What a mind says about itself: the typed state a dashboard projects.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct MindStatus {
+    pub instance: Slug,
+    pub schema_epoch: String,     // PIPELINE_SCHEMA_EPOCH
+    pub documents: u32,           // pipeline documents in the image
+    pub receipts: u32,
+}
+impl<S: MindStore> Mind<S> { pub fn status(&self) -> MindStatus; }   // in mind.rs
+```
+
+`Admit` carries the batch whole because the batch already carries
+`instance` and `provenance`; a second `instance` beside it would be two
+declarations. The read requests carry `instance` because ruling 14 says a
+write carrying another instance's identity is refused *whatever the
+transport*, and a read of the wrong mind is the same collision on the read
+side (D3). `Whoami` carries none: it is how a client learns which mind it
+reached.
+
+`PipelineAdmissionBatch` gains `Serialize, Deserialize, JsonSchema`; its
+doc comment loses the false sentence. `MindRefusal::Document` loses its two
+`with` attributes; `DocumentRefusal` is deleted.
+
+Serialisation: `rmp_serde::to_vec_named` and `rmp_serde::from_slice`, so
+field names on the wire are the names the JSON schemas publish (the C#
+reference keys by name). `PipelineDocument` is adjacently tagged
+`{kind, value}` and rides as a map; the leaf's `[value]` array form is the
+*store* shape, not the wire's, and the daemon never sees an envelope.
+
+Schemas: `schemas/cultnet/huginn.mind_request.v1.schema.json` and
+`huginn.mind_response.v1.schema.json` in Huginn, derived by
+`schemars::schema_for!` and pinned byte-for-byte by a test (Epiphany's
+`pipeline_published_schemas_match_derivation` pattern). They are Huginn's
+contracts, published from Huginn (D6's schema-publication paragraph stands).
+Expect about 100 KB each; the pipeline value types are inlined by
+`schemars` under `$defs` and Epiphany's thirteen files are not copied.
+
+### D3. One instance check, owned by the mind
+
+`admit_steps`'s A1 becomes:
+
+```rust
+impl<S: MindStore> Mind<S> {
+    /// Ruling 14 across every transport: the declared instance is this
+    /// mind's, else `ForeignInstance { declared, mind }`. A1 for admission;
+    /// the daemon asks it for every read that names an instance.
+    pub fn require_instance(&self, declared: &Slug) -> Result<(), MindRefusal>;
+}
+```
+
+`admit_steps` calls it where the inline comparison was; behaviour identical,
+H1 re-anchors to the new body (Per-file changes). The daemon's `handle`
+calls it once per instance-bearing read before dispatch and never compares
+an instance itself. Rejected: comparing in the daemon (a second validator of
+A1, the thing the brief forbids) and dropping the instance from reads (a
+client configured for `thought-cage` would silently read `yggdrasil`).
+
+### D4. The daemon is a pure dispatch over a hub, without a transport trait
+
+```rust
+// daemon.rs
+pub trait IndexSink<S: MindStore> {
+    /// Called after `Committed`, with the landed refs; Cut 11 reads
+    /// `mind.view(ref)` per ref and indexes. An error never reaches the caller.
+    fn committed(&mut self, mind: &Mind<S>, writes: &[PipelineRef]) -> anyhow::Result<()>;
+}
+pub struct NoIndex;                                   // this cut's implementation
+pub struct Daemon<S: MindStore, I: IndexSink<S>> { mind: Mind<S>, index: I }
+impl Daemon<OwnedRedbMessagePackBackingStore, NoIndex> {
+    pub fn open(state_root: &Path, instance: &Slug) -> Result<Self, MindRefusal>;   // Mind::open
+}
+impl<S: MindStore, I: IndexSink<S>> Daemon<S, I> {
+    pub fn with_index<J: IndexSink<S>>(self, index: J) -> Daemon<S, J>;
+    pub fn mind(&self) -> &Mind<S>;
+    pub fn runtime_id(&self) -> String;                // "huginn-<instance>"
+    pub fn handle(&mut self, request: HuginnMindRequest, now: DateTime<Utc>) -> HuginnMindResponse;
+}
+```
+
+`handle`, exactly: `Whoami` → `Whoami(mind.status())`. `Admit(batch)` →
+`mind.admit(batch, now)`; if `Committed { writes, .. }`, `index.committed(mind,
+&writes)` and on `Err` one `eprintln!` naming the refs; the outcome is
+returned as computed before the sink ran. Every other variant →
+`mind.require_instance(declared)` then the method, `Err(refusal)` →
+`Refused(refusal)`. No `Utc::now()` here: `now` is the caller's, so a test
+pins it.
+
+No `Transport` trait. The loop below is under forty lines; a trait with one
+live and one test implementation over it is the one-implementation
+abstraction ruling 20 killed in Cut 5. Typed hand-off between organs is
+proven without a socket at `handle` (Tests 1-4) and at the envelope codec
+(Tests 5-6); the loop is proven once over a loopback hub (Test 9). The
+hub is CultLib's port, not ours.
+
+The daemon's tests open real minds through `Mind::open` in a `tempfile`
+directory (redb, milliseconds) rather than promoting `MemoryStore` out of
+`cfg(test)`: no feature flag, no `pub` test surface, and the lock is
+exercised. If Cut 13's smoke wants a memory mind, one
+`#[cfg(any(test, feature = "test-stores"))]` line is the promotion; noted
+under Findings, not done.
+
+### D5. The envelope codec, exactly
+
+`envelope.rs`, pure functions:
+
+```rust
+pub const FAILURE_SCHEMA: &str = "gamecult.cultnet.operation_failure.v1";   // the C# reference's FailureSchemaId
+#[derive(Serialize, Deserialize, JsonSchema, ..)]
+pub struct OperationFailure { pub code: String, pub message: String }       // keys as the C# type: `code`, `message`
+
+pub fn encode_request(message_id: &str, request: &HuginnMindRequest, source_runtime_id: Option<String>) -> Result<CultNetMessage>;
+pub fn decode_request(message: &CultNetMessage) -> Result<(String /*message_id*/, HuginnMindRequest), OperationFailure>;
+pub fn encode_response(message_id: &str, operation: &str, response: &HuginnMindResponse, source_runtime_id: &str) -> Result<CultNetMessage>;
+pub fn encode_failure(message_id: &str, operation: &str, failure: &OperationFailure, source_runtime_id: &str) -> CultNetMessage;
+pub fn decode_response(message: &CultNetMessage) -> Result<(String, Result<HuginnMindResponse, OperationFailure>)>;   // Cut 13's side, tested here for symmetry
+```
+
+`decode_request` refuses, each with its own `code`, in this order:
+`not-an-operation-request` (any other `CultNetMessage`), `wrong-service`
+(`service_id != MIND_SERVICE_ID`), `wrong-payload-schema`, `payload-not-base64`,
+`payload-not-a-request` (`rmp_serde::from_slice` fails), `operation-mismatch`
+(`operation != request.operation()`: the envelope's string is checked against
+the enum, never trusted). `payload_encoding` is CultNet's own check
+(`validate_message`) and is not re-checked. `source_runtime_id` and
+`target_runtime_id` on a request are read by nothing (ruling 18: declared,
+not verified, and the declaration is in the payload). `message_id` is the
+client's correlation key and is echoed; the daemon keeps no table of them —
+the receipt is the organ's idempotency (A9), and a replayed `admit` answers
+`AlreadyAdmitted` from the mind, not from a message cache.
+
+`encode_response`: `status = response.status()`, `payload_schema =
+MIND_RESPONSE_SCHEMA`, `diagnostics = []`, `source_runtime_id =
+Some(runtime_id)`. `encode_failure`: `status = "rejected"`, `payload_schema =
+FAILURE_SCHEMA`, `diagnostics = [failure.code.clone()]`.
+
+Base64 is `base64::engine::general_purpose::STANDARD` (the crate cultnet-rs
+already depends on). Connection id is `cultnet_rs::CULTNET_OPERATION_CONNECTION_ID`
+(`0x4355_4c54`), CultLib's constant for operation services; the hub drops
+every other connection id, and Cut 13's client must use the same.
+
+### D6. The loop, exactly
+
+`serve.rs`:
+
+```rust
+pub struct ServeOptions { pub session_timeout: Duration /* 30 s */, pub idle_sleep: Duration /* 2 ms */ }
+pub fn bind(addr: SocketAddr, runtime_id: &str) -> Result<CultNetRudpServerHub>;   // non-blocking socket; max_fragment_bytes 1200, max_pending_reliable_packets 1024, max_peers 256
+pub fn schema_registry() -> Result<CultNetSchemaRegistry>;                          // the two wire schemas, kind WireMessage, wire contract CultNetSchemaV0
+pub fn answer<S, I>(daemon: &mut Daemon<S, I>, registry: &CultNetSchemaRegistry, message: CultNetMessage, now: DateTime<Utc>) -> CultNetMessage;
+pub fn run<S, I>(daemon: &mut Daemon<S, I>, hub: &mut CultNetRudpServerHub, registry: &CultNetSchemaRegistry, stopping: &AtomicBool, options: &ServeOptions) -> Result<()>;
+```
+
+`answer`: `OperationRequest` → `decode_request` → `handle(request,
+now)` → `encode_response`, or `encode_failure` on a decode failure;
+`SchemaCatalogRequest` → `registry.create_catalog_response`; anything else
+→ `CultNetMessage::Error { error: "huginn.mind answers cultnet.operation_request.v0 and cultnet.schema_catalog_request.v0" }`.
+
+`run`: until `stopping`, `hub.remove_timed_out_sessions`, `hub.poll_resends`,
+then drain `receive_event_once`: a `Frame` on channel `schema` is decoded
+(`decode_cultnet_message_from_slice`, `CultNetSchemaV0`) and its `answer`
+sent with `hub.send_schema_message(&session, ..)`; `Connected`, `Pong`,
+`Disconnected` are ignored; a frame on another channel is ignored. `Err`
+from `receive_event_once` (a hostile datagram fails `decode_rudp_packet`,
+or the peer limit) and from `send_schema_message` (a session that left) are
+printed and served past. `Utc::now()` is read once per frame here, the
+crate's only clock read. Idle loops sleep `idle_sleep`, Odin's shape.
+
+Stated limits: a socket error and a hostile datagram are indistinguishable
+at `receive_event_once` and both are logged, so a dead socket spins with
+logging rather than exiting (Odin has the same shape; Cut 14's health is
+the observer). The reliable window is `1024 × 1200` bytes per session, about
+1.2 MB in flight; a `Query` page of 200 maximal views may exceed it and
+`send_many` refuses with an error the loop logs, so the client times out
+instead of receiving a typed answer. Soul probes the number; if it is real,
+the fix is `PipelineQuery.limit` guidance in Cut 13 or a larger window, not
+a second page format.
+
+### D7. `main`, exactly
+
+`main.rs`: `parse_options` over exactly `--state-root <abs path>`,
+`--instance <slug>`, `--bind <ip:port>`, each required, each once, Odin's
+parser shape; then `Daemon::open` (**before** any socket), on `Err(refusal)`
+print `refusal` (its `Display`) to stderr and exit 1; then `bind`,
+`schema_registry`, `signal_hook::flag::register` for SIGTERM and SIGINT with
+Odin's PID-namespace comment (Cut 14 runs this under Idunn), `run`. Nothing
+reads the environment: `GAMECULT_IDUNN_CANDIDATE_BIND` and the rest are Cut
+14's, which decides how Idunn supplies `--bind`. The mind is dropped at
+process exit and the store's lock with it.
+
+The `--instance` slug is parsed as `Slug` (`epiphany_pipeline`'s newtype,
+`From<&str>`); the daemon reaches the leaf only through
+`huginn_mind::epiphany_pipeline`, a `pub use epiphany_pipeline;` added to
+`huginn-mind`'s `lib.rs` so one crate pins one rev and the daemon and Cut
+13's client never declare the git dependency twice.
+
+### D8. What this cut owns of the operator surface, and what it does not
+
+Owned here: `MindStatus` (the typed state a dashboard projects), the two
+wire schemas on the catalog, and the fact that any CultNet client can call
+`whoami`. Not owned here: an Eve provider advertisement or a
+`surface_state` composition through Odin. Reasons: the advertisement shape
+is a JSON `Value` body with `verseId`, `freshness`, `witnesses` fields that
+only mean something once the daemon is a Verse citizen on Yggdrasil beside
+Odin (Cut 14), nothing in Rust builds one outside Sleipnir, and the presence
+heartbeat it would ride on is Cut 14's. Building it here would be a
+dashboard-shaped surface with no dashboard, which `F:\Projects\CLAUDE.md`
+names as the thing not to invent. Q23 asks where it lands.
+
+### Deletes first
+
+| Path (by name) | Lines | What |
+|---|---:|---|
+| `crates/huginn-mind/src/refusal.rs`: `enum DocumentRefusal` with its `#[serde(remote = "PipelineRefusal")]`, `#[allow(dead_code)]` and doc comment; the `#[serde(with = "DocumentRefusal")]` and `#[schemars(with = "DocumentRefusal")]` attributes on `MindRefusal::Document` | about 20 | Dead since the leaf derives all three traits at `d5a36c2a`. `MindRefusal::Document(PipelineRefusal)` derives directly. |
+| `crates/huginn-mind/src/admission.rs`: the doc sentence on `PipelineAdmissionBatch` beginning `The leaf's `PipelineDocument` derives neither` | 3 | False at the pin. Replaced by "Rides the wire whole (`wire::HuginnMindRequest::Admit`)." |
+| `crates/huginn-mind/src/admission.rs`: the inline A1 comparison in `admit_steps` | 3 | Moves into `Mind::require_instance` (D3). |
+| `crates/huginn-daemon/src/main.rs`: `fn main() {}` | 1 | The stub. |
+| `README.md`, `AGENTS.md`: every sentence saying `huginn-daemon` is a stub, "nothing here publishes yet", "nothing here publishes or connects yet" | about 8 | Describe the live system. |
+| The old Cut 10 section's `src/wire.rs` in the binary, `SinkHandle`/`SnapshotHandle`, `cultmesh-rs`, `fs2`, `signal-hook` bootstrap wait and heartbeat, `pending_index` retry slot, `RulingsInForce`/`Stewardship`/`HandOff`/`Import` operations, the snapshot read path, and the spawn-the-binary smoke | — | Not built (What changed, 1-5). |
+| The map's D6 and D7 | — | Superseded by D1-D7 here for the transport and by Cut 13's refresh for the tools; the port (`rudp://10.77.0.1:17872`, private range `27880-27887`) and the schema-publication paragraph stand. D8 stands unchanged. Self's edit at landing. |
+
+Nothing in the leaf, `Cargo.toml` workspace, `Cargo.lock` beyond the
+daemon's additions, `query.rs`, `docs.rs`, or the cut-9 entries.
+
+### Keeps
+
+Every admission rule and refusal variant; `Mind::get`, `envelopes`,
+`envelope`, `receipts`; every test name in `huginn-mind`; H1-H67 with H1
+re-anchored; V1-V23 untouched; the leaf pin `d5a36c2a`; `MemoryStore` and
+`RefusingStore` `cfg(test)`; D8's trust boundary (no signer, no anchor, no
+credential path: ruling 18).
+
+### Adds
+
+| Add | Owner | Live consumer | Protected invariant | Why an existing owner cannot serve |
+|---|---|---|---|---|
+| `huginn-mind::wire`: `HuginnMindRequest`, `HuginnMindResponse`, `MindStatus`, the three constants, `operation()`, `instance()`, `status()` | `huginn-mind` | `huginn-daemon` (`envelope`, `daemon`), Cut 13's client (Q13 A) | One vocabulary of operations, equal to `Mind`'s methods; refusals are data in the response, never a transport error | Q13 A: the client imports types from `huginn-mind`; a binary crate cannot be imported. |
+| `Mind::require_instance`, `Mind::status` (`mind.rs`) | `huginn-mind` | `admit_steps`; `Daemon::handle` | Ruling 14 has one check and it is the mind's; `whoami` is derived from the mind, not from configuration | A1 was inline; the daemon must not restate it. |
+| `pub use epiphany_pipeline;` (`lib.rs`) | `huginn-mind` | the daemon's `Slug`, `PipelineRef`; Cut 13 | One git rev of the leaf in the workspace | Two `[dependencies]` entries on one git URL are two places to drift. |
+| `schemas/cultnet/huginn.mind_{request,response}.v1.schema.json` + test | Huginn | the catalog response; Cut 13's schema test | The published schema equals the derivation, byte for byte | Huginn's contracts are published from Huginn (D6). |
+| `huginn-daemon` `[lib]` `huginn_daemon`: `daemon.rs` (`IndexSink`, `NoIndex`, `Daemon`, `handle`), `envelope.rs` (D5), `serve.rs` (D6) | `huginn-daemon` | `main.rs`; Cut 13's smoke in-process; Cut 11 (`IndexSink`); Cut 14 (`run` under Idunn) | The daemon owns the socket, the process and the envelope, and no rule; the index never decides an outcome; an undecodable envelope touches no mind | Nothing in Huginn serves a socket; Odin's harness is a catalog, not a service. |
+| `main.rs` (D7) | `huginn-daemon` | the operator, Cut 14's unit | Refuse loudly before listening (ruling 15) | — |
+| `tools/eureka-cut10-mutations.psd1`, D1-D16 | the crate's suite | Epiphany's harness with `-Repo` | every ruling the daemon implements has a revert and a loosening | — |
+| Dependencies of `huginn-daemon`: `anyhow`, `base64 = "0.22"`, `chrono = "0.4.44"`, `cultnet-rs` (git `a0813c6…`), `huginn-mind` (path), `rmp-serde = "1"`, `schemars = "1"`, `serde`, `serde_json = "1"`, `signal-hook = "0.3"`; dev `tempfile = "3"` | `huginn-daemon` | as named | — | `cultmesh-rs`, `fs2`, `cultcache-rs` are not needed: the hub and the client live in `cultnet-rs`, the daemon names no store type and holds no lease file. |
+
+No new document type, kind, format, epoch, `.cc` file, HTTP, JSON on the
+wire outside the schema catalog, Qdrant, Ollama, signer or anchor.
+
+### Per-file changes, by name
+
+**`crates/huginn-mind/src/refusal.rs`**: the deletes above; module doc's
+"the wire (Cut 10) serialises it" stays true.
+
+**`crates/huginn-mind/src/admission.rs`**: `PipelineAdmissionBatch` derives
+`Serialize, Deserialize, JsonSchema`; doc replaced. In `admit_steps`, the A1
+block becomes `self.require_instance(instance)?;` under the same `// A1`
+comment.
+
+**`crates/huginn-mind/src/mind.rs`**: `require_instance` and `status` on
+`impl<S: MindStore> Mind<S>`; `status` counts `image` entries whose type is
+a `PipelineKind` type id (`is_known_type` minus the two organ types) and
+receipts by `HuginnCommitReceipt::TYPE`; `MindStatus` lives in `wire.rs`
+and is imported.
+
+**`crates/huginn-mind/src/wire.rs`** (new): D2, with a module doc: "The
+organ's request and response vocabulary: one operation per `Mind` method
+and `whoami`. Payloads are the admission and read types unchanged. The
+daemon carries these in CultNet's operation envelope; the client constructs
+them. Nothing here validates a document, derives a status or names a
+transport."
+
+**`crates/huginn-mind/src/lib.rs`**: `pub mod wire;`, `pub use wire::{...}`,
+`pub use epiphany_pipeline;`; module doc gains one sentence: "The wire
+vocabulary is here too, so the daemon and the client share one set of
+types."
+
+**`crates/huginn-mind/src/fixtures.rs`**: unchanged (the batch in flight may
+touch it; this cut needs nothing from it).
+
+**`crates/huginn-daemon/Cargo.toml`**: `[lib] name = "huginn_daemon" path =
+"src/lib.rs"`, `[[bin]] name = "huginn-daemon" path = "src/main.rs"`, the
+dependencies above, a header comment naming the crate's charter (socket,
+process, envelope; no rule).
+
+**`crates/huginn-daemon/src/lib.rs`**: `pub mod daemon; pub mod envelope;
+pub mod serve;` and re-exports.
+
+**`crates/huginn-daemon/src/{daemon,envelope,serve,main}.rs`**: D4-D7.
+Tests beside their module.
+
+**`schemas/cultnet/`** (new directory in Huginn): the two files; a
+`README.md` of five lines saying whose they are and how they are checked.
+
+**`tools/eureka-cut8-mutations.psd1`**: H1's `File` becomes
+`crates/huginn-mind/src/mind.rs` and its `Old` the comparison inside
+`require_instance` as Hands lands it (the mutant still `if false`); the
+header's `-Target` already lists `mind.rs`.
+
+**`tools/eureka-cut10-mutations.psd1`** (new): D1-D16 below.
+
+**`README.md`, `AGENTS.md`**: `huginn-daemon` is live (the CultNet surface:
+admission and reads over RUDP, schema catalog, no index yet); `eureka-state`
+is the remaining stub; the `cargo` block gains `cargo run -p huginn-daemon --
+--state-root <abs> --instance <slug> --bind 127.0.0.1:17872`.
+
+**`Cargo.lock`**: regenerated; +41 package names (Build budget).
+
+### Authority map
+
+- **Owner:** `huginn-daemon` owns the socket, the sessions, the process
+  lifetime and the envelope; `huginn-mind` owns every rule, the instance
+  check, the receipt, the status and the wire vocabulary. Inside the daemon:
+  `Daemon::open` owns "may this process serve this mind" (by delegating to
+  `Mind::open`); `Daemon::handle` owns "which `Mind` method answers this
+  request"; `envelope` owns "is this a request at all"; `serve::run` owns
+  "which session gets which reply".
+- **Inputs:** `--state-root`, `--instance`, `--bind`; datagrams on one socket;
+  the wall clock, once per frame, in `serve`.
+- **Outputs:** one `OperationResponse` (or failure, or `Error`) per frame on
+  the frame's session; the schema catalog; the process exit code; stderr.
+- **Derived state:** the hub's session table (CultLib's, expired by timeout);
+  `MindStatus` per `Whoami` call; the schema registry built at start. The
+  daemon persists nothing of its own.
+- **Forbidden writers:** the daemon may not call `compare_and_swap_batch`,
+  `admit_prepared`, `prepare_entry`, or construct a `HuginnCommitReceipt`; may
+  not validate a document, derive a status or compare an instance (it calls
+  `require_instance`); may not read `stored_at`; may not open a second mind
+  or reopen its mind; may not spool, cache or retry a request; may not read
+  `source_runtime_id`, `connect_payload` or `remote_addr` for any decision;
+  may not sign, verify or enrol an identity; may not read the environment.
+  `IndexSink` may not change an outcome. `huginn-mind` may not name a socket,
+  a message, or `cultnet_rs`.
+- **Shared paths:** `Mind::require_instance` under `admit_steps` and under
+  every read the daemon dispatches; `Mind::admit` under the wire (this cut),
+  Cut 12's hand-off (in-process) and Cut 13's tool (through the wire);
+  `envelope::{encode,decode}_*` under the daemon and Cut 13's client.
+- **Deletion line:** the `refusal.rs` mirror and the false doc land in
+  commit (1) before `wire.rs` exists; `cargo test -p huginn-mind --lib` is
+  green between commits.
+
+### Verification
+
+**Commits.** (1) `huginn-mind`: the two deletes, `require_instance` with
+H1 re-anchored, `status`, `PipelineAdmissionBatch` derives, the leaf
+re-export; suite green, H1-H67 and V1-V23 killed. (2) `huginn-mind::wire`
+and the two schema files with their test. (3) `huginn-daemon` lib: `daemon`,
+`envelope`, `serve`, tests. (4) `main.rs`, README/AGENTS. (5)
+`eureka-cut10-mutations.psd1`, every entry killed. Soul verifies per
+commit; if Hands runs long the split is between (2) and (3), recorded as
+10a/10b.
+
+**Builds.** `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex` through
+PowerShell (the Bash tool collapses the path; Cut 6d's scar); path-list
+baseline before and after; **no `cargo clean` of any scope**. `cargo check
+-p huginn-mind --lib --tests`; `cargo test -p huginn-mind --lib` (51 + the
+batch in flight's count, 0 warnings); `cargo check -p huginn-daemon --lib
+--bin huginn-daemon --tests`; `cargo test -p huginn-daemon --lib`; `cargo
+check --workspace` (the `eureka-state` stub still builds); `cargo tree -p
+huginn-daemon -e normal -d` shows **no duplicate of any GameCult crate**
+(one `cultcache-rs`, one `epiphany-pipeline`, one `cultnet-rs`); the only
+duplicates are the `windows-sys` majors the lock already carried plus 0.52
+from `socket2` (probe).
+Host = target = workstation; the Linux build is Cut 14's.
+
+**Tests**, `crates/huginn-mind` (new, beside the existing) and
+`crates/huginn-daemon`, each named for the rule it pins. Daemon tests open
+`Daemon::open(tempdir, "yggdrasil")` and seed with one `instance` document
+built inline (`PipelineInstance { instance, display_name, created_at, host }`
+through `huginn_mind::epiphany_pipeline`), `PipelineProvenance { faculty:
+Faculty::Hands, .. }`, and a fixed `now`.
+
+| # | Test | Pins |
+|---|---|---|
+| 1 | `mind::tests::require_instance_is_the_one_check_admission_and_the_daemon_share` (huginn-mind) | D3: `require_instance("thought-cage")` on a `yggdrasil` mind is `ForeignInstance { declared: "thought-cage", mind: "yggdrasil" }`; `admit` with `batch.instance = "thought-cage"` returns the same value; the existing `admission_refuses_a_foreign_instance_whatever_the_transport` still passes. |
+| 2 | `wire::tests::the_wire_vocabulary_is_the_minds_methods_and_status_is_derived_from_the_response` (huginn-mind) | D2: `operation()` yields the six names; `instance()` is `None` only for `Whoami`; `status()` is `rejected` exactly for `Refused(_)` and `Admit(Refused(_))`; every variant round-trips through `to_vec_named`/`from_slice`. |
+| 3 | `wire::tests::published_wire_schemas_match_derivation` (huginn-mind) | D2: the two files equal `serde_json::to_string_pretty(schema_for!(..))` byte for byte. |
+| 4 | `daemon::tests::a_batch_round_trips_typed_through_handle_without_a_socket` | D4: `Admit([instance])` → `Admit(Committed { writes: [instance:self] })`; `Whoami` → `MindStatus { instance: "yggdrasil", documents: 1, receipts: 1 }`; `Query { kinds: [Instance] }` → one view whose `admission.provenance` is the batch's; `View(id)` → `Some`; `OpenItems` → all empty; `History(Repo(..))` → empty. No socket, no clock read (`now` is passed). |
+| 5 | `daemon::tests::a_read_or_a_write_naming_another_instance_is_refused_by_the_mind_and_writes_nothing` | Rulings 14 and 18 across the transport: `Query { instance: "thought-cage" }` → `Refused(ForeignInstance)`; `Admit(batch.instance = "thought-cage")` → `Admit(Refused(ForeignInstance))`; `Whoami.documents` unchanged after both. |
+| 6 | `daemon::tests::the_index_is_handed_every_landed_write_after_commit_and_never_decides_the_outcome` | D4, Cut 11's seam: a `RecordingIndex` receives exactly `Committed.writes` (derived writes included: a ruling that answers a question hands two refs) and can `mind.view` each at call time; a `FailingIndex` leaves the outcome `Committed` and the documents readable. |
+| 7 | `envelope::tests::a_refusal_is_a_typed_response_not_a_transport_failure` | D5: `encode_response(Refused(..))` is an `OperationResponse` with `status: "rejected"`, `payload_schema: MIND_RESPONSE_SCHEMA`, decoding back to the same `HuginnMindResponse`; `Committed` → `accepted`; `AlreadyAdmitted` and `Conflict` → `accepted`. |
+| 8 | `envelope::tests::a_malformed_envelope_is_answered_with_a_failure_and_touches_no_mind` | D5: six malformed messages (each code above) through `serve::answer` yield `OperationResponse { status: "rejected", payload_schema: FAILURE_SCHEMA, message_id: <echoed> }` with the named `code`, and `Whoami.documents` is 0 after all six; a non-operation message yields `CultNetMessage::Error`; a `SchemaCatalogRequest { include_schema_json: true }` yields both schemas whose `content_hash` equals the registry's. |
+| 9 | `serve::tests::two_clients_get_their_own_replies_over_loopback` | D6: `bind("127.0.0.1:0")`, `run` on a thread with a stop flag; two `CultMesh::connect_rudp_client_for_endpoint` clients with `CULTNET_OPERATION_CONNECTION_ID`; one sends `Admit`, the other `Query`, each in its own thread; each receives the reply whose `message_id` is its own and decodes it typed; a third client on another connection id receives nothing within the timeout; stop flag → `run` returns and the thread joins. |
+| 10 | `daemon::tests::the_daemon_refuses_loudly_when_it_cannot_open_the_mind_and_binds_nothing` | Ruling 15: a first `Daemon::open` holds the lock; a second on the same path is `Err(MindAlreadyOwned)`; a store planted for `yggdrasil` opened as `thought-cage` is `Err(ForeignInstance)`; `Daemon::open`'s signature takes no address (the bind cannot precede it), and `main`'s order is pinned by D12 below. |
+
+**Negative greps.**
+
+- `rg -n "compare_and_swap|admit_prepared|prepare_entry|HuginnCommitReceipt \{|stored_at|in_force|closing_resolution|pipeline_key|validate\(" crates/huginn-daemon/src` empty.
+- `rg -n "!= self.instance\(\)|== self.instance\(\)|\.instance\(\) [!=]=|instance != |instance == " crates/huginn-daemon/src` empty (the daemon compares no instance).
+- `rg -n "require_instance" crates/huginn-mind/src`: the definition, one call in `admit_steps`, tests; `crates/huginn-daemon/src`: one call in `handle`.
+- `rg -n "Utc::now|SystemTime::now" crates/huginn-daemon/src`: exactly one, in `serve.rs`; `crates/huginn-mind/src` empty.
+- `rg -n "std::env|env::var|GAMECULT_IDUNN" crates/huginn-daemon/src` empty (Cut 14's).
+- `rg -n "ServiceIdentitySigner|enroll_service_identity|verify_service_identity|TrustAnchor|source_runtime_id|connect_payload" crates/huginn-daemon/src`: `source_runtime_id` only where the response sets it; nothing else (ruling 18; D8 stands).
+- `rg -n "reqwest|qdrant|ollama|http://|serde_json::to_value|CultMeshRudpDocumentServer|DocumentPutRaw|SnapshotRequest" crates/huginn-daemon/src` empty except `SnapshotRequest`, which must not appear either (Cut 14 adds Idunn's presence answer if it needs one; Findings).
+- `rg -n "serde_json" crates/huginn-daemon/src`: only in the schema registry build and its test.
+- `rg -n "cultnet_rs|cultmesh_rs|UdpSocket" crates/huginn-mind/src` empty.
+- `rg -n "serde\(remote|DocumentRefusal" crates/huginn-mind/src` empty.
+- `rg -n "epiphany-pipeline" crates/huginn-daemon/Cargo.toml` empty (the leaf is reached through `huginn_mind::epiphany_pipeline`).
+- `rg -n "stub" README.md AGENTS.md`: only about `eureka-state`.
+- `git diff --stat <batch commit> -- crates/huginn-mind/src/query.rs crates/huginn-mind/src/docs.rs tools/eureka-cut9-mutations.psd1` empty.
+
+**Mutations, `tools/eureka-cut10-mutations.psd1`.** Run:
+
+```
+$env:CARGO_TARGET_DIR = 'C:\Users\Meta\.cargo-target-codex'
+powershell -File F:\Projects\Epiphany\tools\eureka-mutations.ps1 -Repo F:\Projects\Huginn `
+    -Entries tools/eureka-cut10-mutations.psd1 `
+    -Target crates/huginn-mind/src/mind.rs,crates/huginn-mind/src/wire.rs,crates/huginn-daemon/src/daemon.rs,crates/huginn-daemon/src/envelope.rs,crates/huginn-daemon/src/serve.rs `
+    -Test 'cargo test -p huginn-daemon --lib'
+```
+
+Entries whose test lives in `huginn-mind` carry their own `Command = 'cargo
+test -p huginn-mind --lib'`. Anchors are content Hands lands, matched once.
+Each ruling has a **revert** (the rule absent) and, where one exists, a
+**loosening**.
+
+| # | Rule | Revert | Loosening | Killed by |
+|---|---|---|---|---|
+| D1 | 14: one instance check, the mind's (D3) | `require_instance` body → `Ok(())` (H1's shape, now shared) | compare `declared.0.len()` to `self.instance.0.len()` | test 1 and test 5 (one anchor, two suites, one owner) |
+| D2 | 14/18 on the wire: the daemon passes the declared instance through | `handle`: `Admit(mut batch)` → `batch.instance = self.mind.instance().clone()` before `admit` | reads: `require_instance` called only for `Query`, not `View`/`OpenItems`/`History` | test 5 |
+| D3 | refusals are data, never a transport failure | `encode_response`: `Refused(_)` → `encode_failure(.., OperationFailure { code: "refused", .. })` | `status()` returns `accepted` for `Refused(_)` | test 7 |
+| D4 | an undecodable envelope touches no mind | `decode_request`: on `payload-not-a-request` return `Ok((id, HuginnMindRequest::Whoami))` | `wrong-service` check dropped | test 8 |
+| D5 | the operation string is checked, not trusted | `operation-mismatch` check dropped | compare case-insensitively | test 8 (an `Admit` payload under `operation: "query"`) |
+| D6 | the index never decides an outcome | `handle`: `index.committed` `Err` → return `Admit(Refused(Unavailable { .. }))` | `index.committed` called before `admit` (the sink then sees refs it cannot `view`) | test 6 |
+| D7 | the index sees every landed write | `index.committed(mind, &[])` | pass `writes[..1]` | test 6 (the derived write) |
+| D8 | each reply goes to its own session | `run`: send the reply to the first session in `hub.sessions()` | send to every session | test 9 |
+| D9 | only the operation connection id is served | `bind`: `CULTNET_OPERATION_CONNECTION_ID` → `CULTMESH_RUDP_DOCUMENT_CATALOG_CONNECTION_ID` | — | test 9 (the third client) |
+| D10 | `whoami` is derived from the mind | `status()`: `documents` → `self.image.len()` (counts the epoch record and receipts) | `receipts` → `0` | test 4 |
+| D11 | 15: a mind that will not open is refused before anything listens | `Daemon::open`: `Mind::open` `Err` → open an empty `Mind` at a sibling path `<instance>-fallback` | `MindAlreadyOwned` mapped to `Ok` after a retry with the lock file deleted | test 10 |
+| D12 | 15: bind after open | `main.rs`: `startup(options) -> Result<(Daemon, Hub, Registry)>` is the one place both happen; the mutant moves `bind` above `Daemon::open`. Test 10 holds the mind's lock, calls `startup` with a free port, asserts `Err`, then binds that port itself: under the mutant the hub holds it and the test's bind fails | — | test 10 |
+| D13 | the wire vocabulary equals `Mind`'s methods | `operation()`: `History` → `"query"` | — | test 2 |
+| D14 | the published schema equals the derivation | the request schema file has one whitespace change | — | test 3 |
+| D15 | `AlreadyAdmitted` and `Conflict` are answers | `status()`: `Admit(AlreadyAdmitted { .. })` → `rejected` | — | test 7 |
+| D16 | a non-operation message is answered, not dropped | `answer`: the `_ =>` arm returns `Error { error: "" }` (CultNet's `validate_message` refuses the empty string, so the send fails and the client hangs) | — | test 8 (the `Error` text is non-empty and names both accepted messages) |
+
+Stated limits: the loop's "log and serve past" on a hostile datagram has no
+mutant because the hub's error path is CultLib's (Findings); the reliable
+window limit is probed, not mutated; the SIGTERM path is not testable in
+the harness and is pinned by reading `main`.
+
+**Operator checks before landing:** Q22 and Q23 below. Q22 has a recommended
+default Hands builds under; Q23 changes nothing in this cut whichever way it
+goes.
+
+### Subtraction estimate
+
+`huginn-mind`: −about 25 (the mirror, the false doc, the inline A1), +about
+150 (`wire.rs` 90, `require_instance` and `status` 30, exports 5, doc 5),
++about 90 tests, +2 schema files (about 200 KB of derived JSON, not counted
+as source). `huginn-daemon`: +about 520 outside tests (`daemon.rs` 110,
+`envelope.rs` 170, `serve.rs` 140, `main.rs` 90, `lib.rs` 10), +about 480
+tests, +1 lib target; the bin target exists as a stub and becomes real.
+Entries file about 260. Total about +1,500 with tests and entries against
+the old section's +900; the difference is the envelope codec and the
+malformed-input surface the old section did not have, and ten tests for
+five.
+
+Liability retired before it shipped: `SinkHandle`/`SnapshotHandle`, a
+`cultmesh-rs` and `fs2` dependency, a pending-index slot, a second copy of
+Odin's Idunn bootstrap on a platform where it does not compile, a
+process-spawning smoke, and four wire operations that were presets or Cut
+12's. Retired in the tree: the dead serde mirror and a false doc.
+
+Kinds, formats, epoch, leaf pin, `.cc` files: zero.
+
+### Build budget
+
+- **Packages that compile:** `huginn-mind` (lib + tests), `huginn-daemon`
+  (lib + bin + tests), `cultnet-rs` and its 40 new transitive packages
+  (probe: `aead, aes, aes-gcm, base64, base64ct, cipher, const-oid, ctr,
+  curve25519-dalek(+derive), der, ed25519, ed25519-dalek, fiat-crypto,
+  ghash, hmac, inout, opaque-debug, pkcs8, polyval, ppv-lite86, rand,
+  rand_chacha, rand_core, rmpv, rustc_version, semver, signal-hook(+registry),
+  signature, socket2, spki, subtle, universal-hash, wasi, wasip2,
+  wit-bindgen, zerocopy(+derive), zeroize`; lock 93 → 139 entries). Most of
+  their rlibs were warm from Epiphany builds: the probe built in 30 s.
+- **Targets:** one lib target new; the bin target exists. Debug only,
+  workstation host = target, no features, no codegen, no release profile.
+- **Footprint:** baseline this pass 10,619 paths, 8.74 GiB under
+  `C:\Users\Meta\.cargo-target-codex\debug`; the probe left it at 11,030
+  paths, 9.08 GiB, and the cut's own build lands on top of that. **Expected
+  delta for the cut: +100 to +300 paths, +0.1 to +0.3 GiB** beyond the
+  probe's, all under `debug/`. Drive C: has over 250 GiB free. Hands records
+  the path list before and after and reports a miss.
+- **Retention:** the shared dir is the operator's; nothing is cleaned.
+
+### Operator questions
+
+- **Q22. Is the organ's surface request/response over CultNet RUDP, a
+  CultMesh state publication, or both?** **A. Request/response through
+  `CultNetRudpServerHub` with `cultnet.operation_request/response.v0`
+  (recommended; D1).** Admission and typed queries are request/response by
+  nature; CultLib's envelope has C# parity and Eve names it as the ABI
+  carrier; the schema catalog is the one JSON surface. **B. CultMesh
+  publication only:** admission as a document put and reads as snapshots.
+  Refused above: the document server cannot reply from its sink, a snapshot
+  cannot carry a query, and a response store would be a cache pretending to
+  be truth. **C. Both:** A for the operations, plus the daemon publishing
+  `MindStatus` (and later an Eve surface) as a CultMesh document through
+  Odin's catalog for dashboards to pull. C is A plus Q23's answer, not a
+  third transport; it costs Odin registration, which is Cut 14's body. If C
+  is wanted now, `MindStatus` is already the document, and the publication
+  is one `publish_cultnet_message_to_rudp_catalog` call on a heartbeat that
+  Cut 14 owns. **Ruled A, 2026-09-16** ("I take your recommendations").
+- **Q23. Where does the operator interface land?** Doctrine says an earned
+  daemon publishes its capabilities as Eve DSL through CultMesh, lowered by
+  others. **A. Not this cut (recommended).** This cut owns `MindStatus` and
+  the wire schemas; a `gamecult.eve.provider_advertisement.v1` and a
+  `surface_state` composition need a Verse identity, freshness and a
+  heartbeat that exist only once Cut 14 puts the daemon beside Odin on
+  Yggdrasil. Land it as a named cut after 14 ("Verse presence": the
+  advertisement, the status surface, the Idunn health it rides with), before
+  the proof campaign so Cut 16 can read the mind from a dashboard. Cuts 15
+  and 16 are skill wiring and the proof; neither is the right owner. **B.
+  Fold it into Cut 14**, since Odin registration is part of being deployed
+  on Yggdrasil; the cost is a larger Cut 14 that already carries the Idunn
+  handshake, the backup and the route. **C. Build the advertisement here**
+  against a workstation-local Odin: a surface with no dashboard, and a
+  `verseId` chosen before the Verse exists; not recommended. **Ruled A,
+  2026-09-16**: a named "Verse presence" cut after Cut 14, before the proof.
+
+Decisions Self can overturn without an operator: no transport trait (D4);
+real redb minds in the daemon's tests rather than a promoted `MemoryStore`
+(D4); the failure-schema mirror carried in the daemon (D5); the option
+spelling `--state-root --instance --bind` (D7); the base64 cost of the
+operation envelope (about a third over raw bytes, accepted as CultNet's
+contract).
+
+### Findings not assignable to this cut
+
+- **`CultNetRudpServerHub::receive_event_once` propagates a hostile
+  datagram as `Err`** (`receive_packet_once`: `decode_rudp_packet(&wire)?`)
+  and the peer limit likewise, so every hub service must treat `Err` as a
+  discard or die on the first stray packet; Idunn's `HostActuatorHub::service`
+  propagates it. CultLib's, under the QUIC campaign's owner; a stray datagram
+  on a mesh port is not hypothetical.
+- **The Rust `cultnet-rs` has no `gamecult.cultnet.operation_failure.v1`
+  type or published schema**, though the C# reference defines
+  `CultNetOperationServer.FailureSchemaId` and `CultNetOperationFailure
+  { code, message }`, and `contracts/cultnet/` publishes only the request
+  and response schemas. This cut carries a two-field mirror with the C#
+  keys; parity belongs in CultLib.
+- **The Rust `CultNetOperationServer` is single-peer and unused in Rust**;
+  the C# one is a multi-handler dispatcher. Either it grows to match or it
+  is deleted; not this campaign's.
+- **The Idunn activation handshake is a second message family.** Odin
+  answers Idunn's route challenge as a `SnapshotRequest` for its own
+  presence record (`exact_self_presence_query`) through the document
+  server's snapshot source, and publishes presence with
+  `publish_cultnet_message_to_rudp_catalog`. Under D1 the hub can answer a
+  `SnapshotRequest` frame with a `SnapshotResponseRaw` (it is one more
+  `CultNetMessage` on the `schema` channel), so Cut 14 adds an arm to
+  `serve::answer` rather than a second server; but Cut 14's spec must say
+  exactly which message Idunn's route driver sends and how a hub-based
+  service satisfies `route_required = true`. Odin's `main.rs` uses
+  `std::os::fd` and builds on Linux only; the Idunn arm will be `cfg(unix)`
+  or Cut 14 must move the signer-descriptor reading behind a port.
+- **`gamecult-ops/runbooks/odin-yggdrasil.md` describes the pre-v2 body**
+  (Compose container, `/srv/odin/current`, `odin.service`) while the
+  binding is `gamecult.idunn.operator_binding.v2` under `idunn-odin`; the
+  runbook Cut 14 models on it is modelling a stale one.
+- **Cut 12 has no wire operation here.** If the two minds of a hand-off live
+  in two daemons, Cut 12 needs either a wire `HandOff`/`Import` pair (one
+  more variant each in `wire.rs`) or an offline tool that opens both stores;
+  if both minds are stores on one host, `hand_off(&mut from, &mut to, ..)`
+  is in-process and no wire form exists. Cut 12's refresh decides; the wire
+  enum widens additively either way.
+- **Cut 13's `tool_schemas_equal_the_published_schemas`** compares against
+  Epiphany's `schemas/cultnet/` (the pipeline documents); it should compare
+  the tool schemas against Huginn's `schemas/cultnet/huginn.mind_*.v1` (the
+  operations). And Cut 13 gains a `history` tool (Q17 B's obligation, Cut
+  9's finding) and loses `rulings_in_force`/`stewardship` as tools in favour
+  of presets. Cut 13's refresh.
+- **`MemoryStore` is `cfg(test)`-private to `huginn-mind`.** The daemon's
+  tests do not need it; if Cut 13's in-process smoke wants a mind without a
+  file, promote `test_stores` behind `#[cfg(any(test, feature =
+  "test-stores"))]` (one line) in that cut.
+- **A `Query` page of 200 maximal views may exceed the hub's reliable
+  window** (1024 packets × 1200 bytes); `send_many` then errors and the
+  client times out. Soul measures it against the leaf's bounds; if real,
+  Cut 13 caps `limit` by default or the hub options grow. Not a second page
+  format.
+- **The wire schemas are large** (`PipelineQueryPage` alone 42.9 KB; the
+  response schema will inline every pipeline value type). Fine on the
+  catalog (16 MiB payload cap) and as files; noted so nobody reads the size
+  as a defect.
+- **`Faculty::SelfFaculty`** is the wire spelling clients will see (carried
+  from Cut 9).
+- **`README.md`/`AGENTS.md`** go stale again at Cut 11 and Cut 13; the
+  "describe the live system" tension recurs until the workspace is whole.
+
+### Pinned HEADs
+
+- Huginn `eureka/memory-organ` at `8fc39b1`; at spec time the main tree
+  carried the concurrent Hands batch uncommitted in
+  `crates/huginn-mind/src/query.rs`, `docs.rs`, `tools/eureka-cut9-mutations.psd1`
+  and a `docs.rs.eureka-mutation-original` harness sidecar. This spec
+  anchors by name and touches none of those files.
+- Epiphany `codex/eureka-pipeline-state` at `fb18395f`; leaf at `d5a36c2a`.
+- CultLib `main` `47aa7b6`, Rust runtimes identical to `a0813c6`.
+- Odin `main` `5a015d9`; Idunn `main` `5b3f646`; gamecult-ops `main`
+  `36a466f`.
+- Probe artifacts: `scratchpad/cut10-wt` (detached at `8fc39b1`, one `cargo
+  test -p huginn-daemon --lib`, 1 passed in 0.08 s after a 30.4 s build,
+  removed and pruned); `scratchpad/cut10-probe-lib.rs` and
+  `cut10-probe-Cargo.toml` kept as evidence. The shared target dir read
+  10,619 paths / 8.74 GiB before and 11,030 / 9.08 GiB after; nothing was
+  cleaned. No file in any repo was written and no `notes/` file was touched.
+
+## Cut 11. Qdrant collections and Ollama embeddings
+
+- **Repo/branch:** Huginn, same branch. Depends on Cut 10 and Q5.
+- **Deletes first:** none.
+
+**Adds.**
+
+- `crates/huginn-mind/src/index.rs`: the `EmbeddingPort` and `IndexPort` traits
+  and `IndexPoint`/`IndexFilter`/`IndexHit` from D5, plus the `pending_index`
+  document and the retry rule.
+- `crates/huginn-daemon/src/qdrant.rs` and `src/ollama.rs`: `reqwest::blocking`
+  adapters over the endpoints R3 establishes. `reqwest` is added here, in the
+  daemon only, never in `huginn-mind`.
+- Daemon flags `--qdrant-url`, `--ollama-base-url`, `--ollama-model`,
+  `--embedding-dimensions`, following `epiphany.service`'s existing spelling
+  (R16) so the unit reads like its neighbour.
+
+**Collection compatibility.** Port the deleted `CollectionCompatibility` idea
+(`856648de^:semantic_backend.rs:47-57`): the collection stores its
+`managed_by`, `corpus_kind`, `projection_version`, `embedding_model` and
+`vector_size`, and the daemon refuses to write into a collection whose
+compatibility record disagrees. That is what stops a model change silently
+mixing 1,024-dim and other-dim vectors.
+
+**Authority map.**
+
+- **Owner:** the typed mind owns truth; Qdrant owns nothing.
+- **Inputs:** admitted documents' bounded text fields.
+- **Outputs:** Qdrant points; semantic hits resolved back through `get`.
+- **Derived state:** **the entire collection.** It is rebuildable by
+  `--reindex`.
+- **Forbidden writers:** nothing writes a Qdrant point except the daemon's
+  post-admission path; nothing reads a pipeline document *from* Qdrant as truth;
+  in-force status is never indexed.
+- **Shared paths:** the `semantic` branch of `query` (Cut 9).
+- **Deletion line:** n/a.
+
+**Verification.**
+
+| Test | Pins |
+|---|---|
+| `admission_succeeds_when_the_index_is_unreachable_and_records_pending` | The index never rejects a write |
+| `pending_index_is_retried_and_cleared` | — |
+| `reindex_rebuilds_the_collection_from_the_store` | The projection is disposable |
+| `semantic_hits_resolve_through_the_typed_store` | Qdrant is not truth |
+| `incompatible_collection_is_refused` | The compatibility record |
+| `receipts_identity_and_provenance_are_never_indexed` | — |
+
+The first four run against **mock ports**; `huginn-mind` has no network
+dependency, which is the point of the trait boundary.
+
+- **Live adapter check (operator or Hands, on Yggdrasil):** one end-to-end
+  admit-then-semantic-query against the real Qdrant and the real Ollama,
+  confirming 1,024 dimensions.
+- **Mutations:** index before committing; index the in-force status; drop the
+  compatibility check.
+- **Negative grep:** `rg -n "reqwest|qdrant|ollama" crates/huginn-mind/src`
+  empty.
+
+**Subtraction ledger:** +about 800 lines. +`reqwest` (daemon only), +1 Qdrant
+collection.
+
+## Cut 12. Stewardship hand-off and mind import
+
+- **Repo/branch:** Huginn, same branch. Depends on Cut 11.
+- **Deletes first:** none.
+- **Adds:** `crates/huginn-mind/src/handoff.rs`.
+  - `hand_off(&mut Mind from, &mut Mind to, HandOffRequest)` admits the
+    `hand_off` document **into both minds** in one logical operation; Cut 8's
+    derivations do the rest: a `Withdrawn` resolution of the source side's
+    stewardship and a new `stewardship` at the next sequence on the target
+    side. *(First written as "the superseding `stewardship` on the source
+    side"; Cut 8 landed a withdrawal, and Cut 6d gave stewardships a
+    sequence so a return is an ordinary second hand-off. A hand-off is a
+    transfer, not a lease (Q18); this cut models no return and gains one
+    test, `a_repo_handed_back_takes_the_next_sequence`, that two hand-offs
+    A→B→A leave A stewarding at n2 and B withdrawn.)*
+  - **Import replays in sequence order, one record per batch where a
+    subject's history is concerned.** Soul on the Cut 6d follow-up: each
+    record in a batch sees the later one as the subject's latest, so
+    `[n1, n2]` in one batch is `OutOfSequence { 3, 1 }` and reversed is
+    `AlreadyResolved`. Spec-consistent, and a constraint on this cut's
+    import loop. Replay is idempotent per batch (`AlreadyAdmitted`),
+    including batches with derived writes, after the follow-up's fix batch.
+  - `import(&mut Mind, foreign: &Path, HandOffRef)` replays the named
+    documents' exact envelopes through `admit` against the target mind. Envelope
+    bytes are carried, not reserialised, so additive fields written by a newer
+    binary survive.
+
+**Not a merge tool.** The deleted D5 merge tool existed because two clones could
+diverge. Two minds cannot diverge: each has one owner. Import is a *transfer* of
+named documents under a recorded hand-off, and it refuses anything not named in
+the hand-off.
+
+**Authority map.**
+
+- **Owner:** `huginn-mind`'s hand-off module, but it writes only through
+  `admit`, so the per-kind rules still apply to imported documents.
+- **Inputs:** the source mind, the target mind, a `HandOffRequest`.
+- **Outputs:** a `hand_off` in both minds, two `stewardship` writes, two
+  receipts.
+- **Derived state:** the stewardship assignments.
+- **Forbidden writers:** import may not bypass `admit`, may not reserialise an
+  envelope, and may not import a document the hand-off does not name.
+- **Shared paths:** `admit`.
+- **Deletion line:** n/a. This replaces the never-built merge tool, which Cut 4
+  deleted from the design.
+
+**Verification.**
+
+| Test | Pins |
+|---|---|
+| `hand_off_writes_both_minds_or_neither` | Atomicity across two stores |
+| `import_replays_envelope_bytes_exactly` | No reserialisation |
+| `import_refuses_a_document_the_hand_off_does_not_name` | — |
+| `imported_documents_still_pass_every_admission_rule` | No bypass |
+| `hand_off_is_idempotent` | Replay returns `AlreadyAdmitted` |
+| `hand_off_between_the_same_instance_refuses` | — |
+
+- **Mutations:** import without re-validating; reserialise on import; write the
+  target before the source and fail the source.
+- **Builds:** `cargo check -p huginn-mind --lib --tests`.
+
+**Subtraction ledger:** +about 500 lines.
+
+## Cut 13. `eureka-state`
+
+- **Repo/branch:** Huginn, same branch. Depends on Cut 10 (the wire) and Q6.
+- **Deletes first:** none.
+- **Adds: `crates/eureka-state`.** Dependencies `anyhow`, `cultnet-rs`,
+  `epiphany-pipeline`, `rmcp = { version = "2.2.0", default-features = false, features = ["server","macros","transport-io"] }`,
+  `schemars`, `serde`, `tokio = { features = ["macros","rt-multi-thread","io-std"] }`.
+  It does **not** depend on `huginn-mind`: it is a client, and linking the rule
+  engine into the client would invite a second validator.
+  - `src/lib.rs`: `EurekaStateServer` with a `ToolRouter` and the seven tools.
+  - `src/main.rs`: `EurekaStateServer::from_env()?.serve(rmcp::transport::stdio()).await?.waiting().await`.
+
+**Authority map.**
+
+- **Owner:** none over state. The server is a transport shim.
+- **Inputs:** JSON-RPC requests; two environment variables.
+- **Outputs:** typed JSON.
+- **Derived state:** none. **No lease cache, no store handle, no local file.**
+- **Forbidden writers:** the package may not open a CultCache store, may not
+  validate a document, may not derive status, and may not write anything to
+  disk. This is the structural guarantee behind "it never writes a second copy".
+- **Shared paths:** the CultNet surface from Cut 10.
+- **Deletion line:** n/a.
+
+**Verification.**
+
+| Test | Pins |
+|---|---|
+| `every_tool_round_trips_against_a_live_daemon` | Pipeline smoke on an ephemeral port |
+| `an_unreachable_organ_returns_typed_unavailable_from_every_tool` | The target's honesty invariant |
+| `tool_schemas_equal_the_published_schemas` | Compare `tools/list` with `schemas/cultnet/` |
+| `whoami_reports_unreachable_without_failing` | Rehydration can check first |
+| `a_refusal_is_an_outcome_not_a_jsonrpc_error` | P4's `structuredContent` path |
+
+- **Negative greps:** `rg -n "BackingStore|CultCache::|std::fs::write" crates/eureka-state/src`
+  empty.
+- **JSON-RPC exchange:** pipe `initialize`, `notifications/initialized`,
+  `tools/list` and one `query` into the built binary, as P4 did.
+- **Build and install (Hands):**
+  `cargo install --locked --path crates/eureka-state --root C:\Users\Meta\.eureka`
+  with the shared `CARGO_TARGET_DIR`. Unprobed: whether `cargo install` honours
+  `CARGO_TARGET_DIR`; Hands confirms from the build log and reports the path.
+- **Registration: the operator's, not Hands'.** Hands reports the binary path
+  and the confirmed `claude mcp add` line from D7; the operator runs it.
+
+**Subtraction ledger:** +about 600 lines. +1 binary, +`rmcp`, +`tokio`.
+
+## Cut 14. Deployment
+
+- **Repos:** Huginn `eureka/memory-organ` (the recipe) and gamecult-ops `main`
+  (the binding, unit inputs, backup and tunnel). Depends on Cut 11 and Q7.
+- **Deletes first:** none.
+
+**Adds, Huginn: `deployment/idunn/recipe.toml`**, `gamecult.idunn.target_declaration.v1`,
+modelled on Odin's (R17):
+
+- `[[steps]]` test then build, runner `rust-build`,
+  `cargo test --locked -p huginn-mind` and
+  `cargo build --locked --release -p huginn-daemon --bin huginn-daemon`.
+- `[[artifacts]]` `huginn-daemon` from `target/release/huginn-daemon`.
+- `[service]` with `--state-root`, `--idunn-projection`, `--idunn-anchor`,
+  `--qdrant-url`, `--ollama-base-url`, `--ollama-model`; `transport = "rudp"`;
+  `route_required = true`; required environment
+  `GAMECULT_IDUNN_CANDIDATE_BIND`, `GAMECULT_IDUNN_PROCESS_WRITE_LEASE`,
+  `GAMECULT_IDUNN_RUNTIME_BUNDLE`.
+- `[service.health] contract = "huginn.runtime-health.v1"`.
+- `[state] schema_generation = "huginn-v1"` with one slot: `minds`, relative
+  path `minds`, kind `cultcache-directory`, writer `process-bound-single-writer`,
+  recovery `preserve`, startup `create-or-open-after-write-lease`.
+  **`recovery = "preserve"` is the load-bearing line: a mind is never
+  reconstructible from a release.**
+- `[[provides]]` capability `huginn.instance-mind`, schema
+  `huginn.mind_response.v1`.
+- `[[dependencies]]` — this is where Qdrant and Ollama are declared, following
+  Ghostlight's shape (`Ghostlight/deployment/idunn/recipe.toml:168-187`): a
+  `shared-infrastructure` dependency on the Qdrant endpoint and one on the
+  embedding endpoint, both `startup = "before-promotion"`, so a candidate that
+  cannot embed is never promoted.
+
+**Adds, gamecult-ops: `idunn/yggdrasil/bindings/huginn.toml.in`**,
+`gamecult.idunn.operator_binding.v2`, modelled on `odin.toml.in`:
+
+- `[repository]` origin `https://github.com/GameCult/Huginn.git`, `admitted_ref`
+  the campaign branch until it merges, then `refs/heads/main`;
+  `minimum_revision = "PROVISIONED_HUGINN_MINIMUM_REVISION"`;
+  `recipe_path = "deployment/idunn/recipe.toml"`.
+- `[runners.rust-build]` identical to Odin's pinned rust image and caps.
+- `[workload]` `state_group = "huginn-v1-state"`, `unit_prefix = "idunn-huginn"`,
+  `release_root = "/srv/gamecult/idunn-releases/huginn"`,
+  `state_root = "/var/lib/gamecult/huginn-v1"`, `network = "host-private"`,
+  `hardening = "strict"`.
+- `[route]` `stable_endpoint = "rudp://10.77.0.1:17872"`, private range
+  `27880-27887` (R21).
+- `[brakes]` **both**, separately, per `F:\Projects\CLAUDE.md` and R18:
+  `deployment_store = "/var/lib/gamecult/idunn-brakes/huginn-deployment-brake.cc"`
+  and `lifecycle_store = ".../huginn-lifecycle-brake.cc"`. Changing the
+  artifact is deployment; restarting the admitted body is continuity. One brake
+  must not gate both.
+- `[rollout] strategy = "candidate-then-promote"`, `retain_releases = 2`.
+  `drain_seconds` is raised above Odin's 10 to let an in-flight admission finish;
+  Hands proposes a value and reports it.
+- `[placement]` `desired_replicas = 1`, `nodes = ["yggdrasil"]`. **One replica is
+  an invariant, not a capacity choice:** two replicas would be two writers to one
+  mind.
+
+**Backup owner — the target requires one, and this is it.** The daily authority
+backup is an explicit path list (R19); a path not named is not backed up.
+**One edit, not two:** `scripts/backup-gamecult-authority-yggdrasil.sh:81-105`
+gains `var/lib/gamecult/huginn-v1` to the `tar` path list.
+`systemd/gamecult-authority-backup.service:15` needs **no** change — its
+`ReadOnlyPaths` already grants the whole `/var/lib/gamecult` tree, so the new
+state root is readable the moment it exists. Hands must not add a redundant
+line there.
+The script freezes named writers before tarring (`:72-74`, currently
+`epiphany-swarm.service` and `epiphany.service`); the `idunn-huginn` unit is
+added to that loop so a mind is never captured mid-commit.
+**Named owner: `gamecult-authority-backup.service`, daily at 03:20 UTC.**
+
+**Workstation reach.** `scripts/start-yggdrasil-tunnel.ps1:13-24` gains one
+entry: `@{ Name = "huginn-organ"; LocalPort = 17872; RemoteHost = "127.0.0.1"; RemotePort = 17872 }`,
+and `runbooks/yggdrasil-ssh-tunnel.md:86-88`'s port table gains the row.
+**Caveat, and it is a real one:** the existing forwards are TCP local forwards,
+and the organ speaks RUDP over **UDP**. `runbooks/yggdrasil-ssh-tunnel.md:32-39`
+already records this exact limitation and recommends WireGuard rather than SSH
+forwards when raw UDP must cross. **See Q7:** the workstation almost certainly
+reaches the organ over the existing WireGuard mesh (`10.77.0.1`), not the SSH
+tunnel. The tunnel row is only added if Q7 chooses a TCP transport.
+
+**Adds, gamecult-ops: `runbooks/huginn-yggdrasil.md`**, following
+`runbooks/odin-yggdrasil.md`'s five headings: Authority map, Release body,
+Initial admission, Verification, plus a Recovery section naming the backup and
+the `--reindex` rebuild.
+
+**Authority map.**
+
+- **Owner:** Idunn owns deployment and continuity actuation. Huginn owns its own
+  state and health.
+- **Inputs:** the admitted revision, the binding, the brakes.
+- **Outputs:** a running `idunn-huginn` unit, published presence health.
+- **Derived state:** the release root; the Qdrant collection.
+- **Forbidden writers:** no operator script deploys Huginn directly; nothing but
+  Idunn writes the release root; nothing but the daemon writes the state root.
+- **Shared paths:** the Qdrant container (Q7), the embedding endpoint, the
+  backup timer.
+- **Deletion line:** n/a.
+
+**Verification.**
+
+- **Operator, and only the operator:** admit the binding, run `idunn up`,
+  confirm the unit reaches Ready, confirm health publishes, confirm the route
+  answers on `10.77.0.1:17872`, then run one `eureka-state whoami` from the
+  workstation.
+- **Restart-preserves-state check:** admit a document, restart the unit through
+  Idunn, query it back. This is the check that `recovery = "preserve"` is real.
+- **Backup check:** run the backup unit once and confirm
+  `var/lib/gamecult/huginn-v1` is in the archive listing.
+- **Brake check:** set the deployment brake and confirm a redeploy is refused
+  while a restart still succeeds. This falsifies the one-brake conflation.
+- **Hands does not deploy.** Deployment is an Idunn actuator gated on root and
+  `IDUNN_ACTUATOR=1` (`scripts/deploy-epiphany-yggdrasil.sh:4-8`).
+
+**Subtraction ledger:** +about 250 lines of ops configuration. +1 systemd
+workload, +1 route, +2 brake stores, +1 backup path, +1 runbook.
+
+## Cut 15. Skill wiring
+
+- **Repo:** `GameCult/Eureka` `main` at `6ca7882`, checked out at
+  `~/.claude/skills/eureka`. It is now a git repo, so Cut 15's edits land as
+  commits there. Depends on Cut 13 being registered.
+
+**`SKILL.md` — exact edits.**
+
+- **`:8-18`, the substrate paragraph.** Replace. Eureka keeps rulings, specs,
+  reports, verdicts, findings and follow-ups in an instance's mind, owned by the
+  Huginn memory organ and reached through the `eureka-state` MCP tools. Delete
+  the claim that Epiphany findings are "queried semantically" — Epiphany has no
+  semantic query since `856648de`. Delete the sentence pointing semantic search
+  at voidbot; the organ owns its own index (ruling 16).
+- **`:57-70`, §0.** Add: at campaign start Self calls `whoami`, then admits
+  `campaign` and `target`. Delete nothing about the target document: campaign
+  prose stays in the repo (target, Invariants).
+- **`:72-125`, §1.** "Imagination produces the cut map" becomes: Imagination
+  admits `cut_spec` revisions and `question`s with `faculty: Imagination`.
+  "Commit the map" (`:122-123`) becomes: nothing to commit — the mind is not in
+  git. **This is the line that must change, or agents will keep trying to commit
+  a store that no longer exists.**
+- **`:126-145`, §2.** Rulings are admitted with `answers`, `choice` and
+  `operator_quote`. Supersession is an explicit `resolution { Superseded }`,
+  never an edit.
+- **`:146-168`, §3.** The Hands brief carries the `cut_spec` id and the in-force
+  ruling ids. Hands admits its `cut_report`.
+- **`:169-188`, §4.** Soul admits one `verdict` plus its `finding`s, each with
+  `range` and `evidence`.
+- **`:189-212`, §5.** Triage outcomes are `resolution` documents.
+- **`:213-228`, §6.** The status header becomes `open_items` plus `query`. Self
+  still reconciles the subtraction ledger, from `cut_report.structural_delta`.
+- **`:230-252`, Self's discipline.** "Keep the maps committed and current"
+  becomes: keep the target committed; never restate typed state in prose. Delete
+  the one-runner rule and the `WriterLeaseHeld` line — there is no lease. Add:
+  when the organ is unreachable, stop and say so; never keep a second copy.
+
+**`references/briefs.md` — exact edits.**
+
+- **`:16-58`, Imagination.** Read first: `rulings_in_force`, `open_items`, and
+  the prior `cut_spec` and `cut_report`. Output: admitted documents plus a short
+  report of ids.
+- **`:60-113`, Hands.** "The spec is `<section>` of `<map>`" (`:63`) becomes
+  "`get <cut_spec id>`". The report becomes `admit cut_report`; the prose report
+  shrinks to the receipt id and blockers. Keep every git and mutation scar at
+  `:74-95` — those are about code, not state.
+- **`:115-148`, Soul.** Scope is the `cut_report` id and its `range`. Report is
+  `admit verdict` plus findings.
+- **`:150-166`, Mind Steward.** Candidates come from `query` over resolutions
+  admitted since the last boundary. The steward never writes the mind.
+- **New section, "Rehydrate."** A fresh agent calls, in order: `whoami`,
+  `rulings_in_force`, `open_items`, `query { kinds: [cut_report], campaign }` —
+  and nothing else.
+
+**`references/cut-map.md` — rewrite, do not delete.** It becomes "Typed campaign
+state": the document set, the keys, the resolution matrix, and query recipes,
+pointing at the Epiphany schemas as owner. The markdown cut map is retired for
+new campaigns, and the reason stands unchanged from the old Cut 5: a committed
+rendering needs a renderer and a regeneration discipline, which is a second
+owner that goes stale exactly the way this file did. The target document stays
+prose. Past cut maps, including this one, remain history.
+
+**`references/changelog.md`** gains a dated entry with this cut map's evidence.
+
+**Verification (Soul, by reading).**
+
+- `rg -n "cut map|status header|repo_root|WriterLeaseHeld|lease" ~/.claude/skills/eureka`
+  hits only history and changelog lines.
+- Every kind in D2, including `instance`, `stewardship` and `hand_off`, is named
+  by at least one brief.
+- No brief asks for prose relay of a typed artifact.
+
+**Subtraction ledger:** prose shrinks; `references/cut-map.md` is replaced rather
+than extended.
+
+## Cut 16. Proof campaign
+
+- **Task:** the two CultLib follow-ups on `CultRecordRefFormatter` recorded in
+  `F:\Projects\Aetheria\docs\cultcache-migration-cut.md:77-83`. Collapse the dead
+  empty check at `src/GameCult.Caching.MessagePack/CultRecordRefFormatter.cs:15-16`,
+  where `CultRecordKey` already equates null and `""`; and make the contract's
+  reason for accepting nil also name code from before `452f928`.
+- **Why this task, unchanged:** real and small, one genuine operator question
+  (whether nil stays accepted on read indefinitely or gets a sunset, which
+  changes the collapsed reader), Soul-falsifiable at the wire layer by decoding a
+  1.0.58 nil store, and CultLib is public with `main` as its default branch.
+- **Repo/branch:** CultLib `eureka/cultrecordref-followups` from `main`
+  `a0813c6`. Depends on Cuts 14 and 15.
+
+**Run.** Note what is *absent* compared with the old Cut 6: no attribute lines
+to commit, no store to commit, no branch binding.
+
+1. Self calls `whoami` and confirms the organ is reachable.
+2. Self admits `campaign` and `target`. The campaign's repo must be one the
+   instance stewards, so Self admits a `stewardship` for `GameCult/CultLib`
+   first if absent.
+3. Imagination admits `cut_spec cut-1.r1` and `question Q1-1`.
+4. The operator rules; Self admits the `ruling` answering Q1-1.
+5. Hands admits `cut_report cut-1.h1`.
+6. Soul admits `verdict cut-1.s1` and its findings.
+7. Self admits `resolution`s and `follow_up`s.
+
+**Pass criteria. All must hold.**
+
+1. Every artifact exists in the instance's mind with a receipt. No `*-cut.md`
+   exists for this campaign, and the Hands and Soul briefs contain ids, not spec
+   prose.
+2. **Nothing about this campaign is committed to CultLib except the code change.**
+   `git status` on the branch shows no `.epiphany/` path and no store file.
+   This is the negative proof that minds left git.
+3. At least one refusal is exercised live and returned typed — for example a
+   `verdict` whose `Falsified` claim lacks a `Confirmed` finding, or a
+   `cut_report` before its spec is admitted.
+4. At least one resolution is admitted, and `open_items` afterwards equals
+   exactly the unresolved set Self states from its own records.
+5. **Rehydration.** A fresh agent with no transcript, no repo docs and no memory,
+   given only the instance slug and the campaign slug, answers a fixed
+   questionnaire using only `whoami`, `rulings_in_force`, `open_items`, `query`
+   and `get`:
+   - Which rulings are in force, and what did the operator say?
+   - What landed, at which SHAs?
+   - Which findings were Confirmed, and how was each resolved?
+   - What follow-ups remain, and why can each wait?
+
+   A Soul pass grades the answers against the mind and git. The proof fails on
+   any factual miss.
+6. **Unreachable is loud.** The operator stops the `idunn-huginn` unit; the next
+   `admit` returns a typed `Unavailable` naming the endpoint, the agent stops,
+   and **no local file appears anywhere**. `git status` and the scratchpad are
+   both clean. This is the target's availability invariant, proved by a
+   deliberate outage rather than asserted.
+7. **Semantic recall.** A `query` with `semantic` set returns the Cut 16 ruling
+   from a paraphrase that shares no exact words with it, and the hit resolves
+   through `get`.
+
+**Fail:**
+
+- any criterion misses;
+- any agent relays a typed artifact as prose to the next agent;
+- Self reads source to verify instead of routing to Soul;
+- any agent writes a local copy of state when the organ is unreachable.
+
+**Subtraction ledger:** the CultLib diff is about −3 lines of C# plus one
+contract sentence.
+
+## Subtraction ledger
+
+Estimates. Self reconciles each at its landing; a miss is allowed but must be
+explained.
+
+| Cut | Removed | Added | Deps / formats / targets |
+|---|---|---|---|
+| 4 | ~1,291 | ~20 | −1 store format, −1 lease, −2 git preconditions |
+| 5 | ~46 | ~8 | none |
+| 6 | ~623 from `epiphany-core` | ~700 Rust, ~400 JSON | +1 package `epiphany-pipeline`; +3 schemas |
+| 7 | ~307, 16 files | ~30 | −1 npm package, −1 CLI, −1 sibling dep |
+| 8 | 0 | ~1,400 | +`epiphany-pipeline` |
+| 9 | 0 | ~600 | none |
+| 10 | 0 | ~900 | +1 binary; +`cultmesh-rs`, `cultnet-rs`, `signal-hook`, `fs2` |
+| 11 | 0 | ~800 | +`reqwest` (daemon only); +1 Qdrant collection |
+| 12 | 0 | ~500 | none |
+| 13 | 0 | ~600 | +1 binary; +`rmcp`, `tokio` |
+| 14 | 0 | ~250 ops | +1 workload, +1 route, +2 brakes, +1 backup path |
+| 15 | prose shrinks | — | `cut-map.md` replaced |
+| 16 | ~3 C# | 1 sentence | none |
+
+**Epiphany's net change across this campaign is negative**: it loses 1,960 lines
+and gains a leaf package it does not itself depend on. The growth is in Huginn,
+and it buys the capability the target names. The liability retired lives outside
+the line count: prose cut maps, header bookkeeping, relayed reports, transcript
+crawls at postmortem, and — new with this rewrite — a per-clone lease, git
+preconditions and an unbuilt merge tool.
+
+## Operator questions
+
+Each has a recommendation. Q6 and Q7 are real forks; Q8 is a subtraction the
+operator may simply want recorded.
+
+- **Q6. Instance identity: declared, or signed?** Depends on: Cuts 8 and 13, and
+  D8.
+  - **A. Declared.** `eureka-state` sends its configured instance slug;
+    admission refuses a mismatch against the mind's `instance` document.
+    Attribution and collision control, not authentication.
+  - **B. Signed.** Enrol a per-instance CultNet service identity
+    (`enroll_service_identity_at`, already used by Epiphany's permit path) and
+    verify the signature at admission.
+
+  **Recommended: A**, with B as a named later cut. On a single-operator LAN
+  behind WireGuard and loopback binds, B protects against an attacker who
+  already has the machine. It also needs key distribution and rotation to every
+  workstation that runs Claude Code, and the target already defers identity
+  binding to a later campaign (ruling 9: answering over a chat channel "needs
+  identity binding first"). Choosing A means saying out loud, in the README and
+  the runbook, that instance identity is not authentication.
+- **Q7. How does the workstation reach the organ?** Depends on: Cuts 13 and 14.
+  - **A. WireGuard.** `eureka-state` talks RUDP to `10.77.0.1:17872` over the
+    existing mesh. No tunnel change.
+  - **B. SSH tunnel.** Add a forward to `start-yggdrasil-tunnel.ps1`.
+
+  **Recommended: A.** The organ speaks RUDP over UDP, and
+  `runbooks/yggdrasil-ssh-tunnel.md:32-39` already records that SSH local
+  forwards cannot carry raw UDP and recommends WireGuard for exactly this case.
+  B would require giving the organ a TCP transport it does not need. The cost of
+  A is that the workstation must have the mesh up, which it already does for
+  other services; the check belongs in `whoami`.
+- **Q8. Does `TypedCommitStore` go (Cut 5)?** Depends on: Cut 5 existing at all.
+  - **A. Collapse it,** as Cut 5 specifies.
+  - **B. Keep it.**
+
+  **Recommended: A.** It was generalised for a second profile that this rewrite
+  moves to another repo, so it is now a one-implementation abstraction — a named
+  STOP condition. Keeping it costs a parameter on every Mind commit and an
+  indirection in the owner. The honest counter-argument, which is why this is a
+  question rather than a silent cut: Cut 2 was three commits and a Soul pass, and
+  deleting it reads as churn. It is not churn; it is the correct response to the
+  ownership change. If the operator prefers B, Cut 5 is dropped and the map says
+  why.
+- **Q9. Qdrant: share voidbot's, or run Huginn's own?** Depends on: Cuts 11 and
+  14.
+  - **A. Share.** Huginn connects to `127.0.0.1:6333` and owns the
+    `huginn_pipeline_documents` collection.
+  - **B. Own.** A second Qdrant under Idunn with its own storage and port.
+
+  **Recommended: A.** Qdrant already runs on Yggdrasil, host-networked on
+  loopback, and collections are the isolation unit; ruling 16 says the organ owns
+  its own *collections*, which A satisfies. The honest cost: the container is
+  started by `voidbot-retrieval.service` and defined in voidbot's compose file
+  (R15), so Huginn's index availability is coupled to a unit Idunn does not own,
+  and that coupling must be declared as a `[[dependencies]]` entry rather than
+  left implicit. B removes the coupling and costs a second Qdrant's memory and
+  storage for one small corpus.
+- **Q10. May one record be superseded by several?** Depends on: Cut 8's
+  admission rules. Cut 6c ships `Superseded { by: Vec<PipelineRef> }` bounded
+  at 8, so the shape admits it. **Recommended: yes, each named.** Cardinality
+  is an admission rule; the library carries the shape.
+- **Q11. Does a resolution of a resolution stay expressible?** Depends on: Cut
+  6b, and the resolution matrix.
+  - **A. Nesting stays.** The grammar reads it back, bounded by the 64-byte
+    local (five or six deep depending on the subject); no arm, no guard, no
+    check.
+  - **B. A `SubjectKind` type** with twelve variants, so the case stops
+    compiling. About +25 lines and one schema file moves.
+  - **C. Runtime refusal** in `pipeline_key`, +3 lines.
+
+  **Recommended: A.** B and C move a row of the resolution matrix out of
+  admission and into the library, and the matrix is admission's. The
+  incoherence was the key shape, and it is gone; deleting the capability is
+  right only when the capability is the incoherence. If the operator wants
+  nesting refused, admission is the coherent place, beside `instance` and
+  `hand_off`. Hands lands 6b under A.
+- **Q12. Should `OrgRepo` be tightened?** Depends on: nothing in a cut. Soul
+  measured that `a/b.`, `./.` and `a/.b` used to be refused as key segments and
+  now key, because `.` is escaped rather than refused. That is injective, so not
+  a collision, but `./.` is not a repository. The widening's real location is
+  `org_repo_text` (`:141-150`), which imposes no byte class at all; the key
+  layer had been acting as its format check by accident.
+  - **A. Tighten `org_repo_text`** to refuse an org or repo part that is
+    exactly `.` or `..`. About +4 lines, closes it everywhere `OrgRepo` appears,
+    mutation M7 killed by `a_repo_part_is_not_a_bare_dot`.
+  - **B. GitHub's full rule**, `[A-Za-z0-9._-]`. Not verified from a source, and
+    it would refuse repos that key fine today.
+  - **C. Leave it.**
+
+  **Recommended: A**, as a four-line follow-up after 6b lands, with no key
+  moving. B is a separate small cut with its own evidence if wanted. 6b lands
+  with C in place.
+- **Q17. Can a resolution be undone?** Depends on: Cut 8's matrix and Cut
+  9's in-force derivation. Under the key grammar a subject has one
+  resolution key, outcome-invariant, so a withdrawn resolution occupies the
+  slot forever and nothing can re-resolve the subject.
+  - **A. A subject resolves at most once, and a resolution is not
+    resolvable.** The matrix row for `resolution` is "none"; the grammar
+    still expresses a resolution of a resolution (Q11 A) and admission
+    refuses it. Nothing moves in the leaf.
+  - **B. Resolutions carry a sequence in their key** (`…:resolution:question.Q1.2`),
+    so a subject can be re-resolved after a withdrawal. A key-grammar change
+    in the leaf; free today, since no mind exists yet on Yggdrasil.
+  - **C. In-force ignores a withdrawn resolution and admission lets a new
+    resolution overwrite it.** Overwrite is the rule this campaign refuses.
+
+  **Recommended: A**, applied as Self's default in the Cut 8 fix batch so
+  Hands is not blocked; reversible if the operator wants B.
+
+  **Ruled B, 2026-09-16.** The operator asked what a resolution is (the
+  record of how a subject was closed and by what; a question's is
+  `Answered { by: ruling }`, not the answer text) and then: "we definitely
+  want to keep a log of withdrawn ones, attached to the subject itself."
+  So a resolution's key gains a per-subject sequence, withdrawn resolutions
+  stay as records under their subject, and the in-force resolution is the
+  latest not withdrawn. Self's default was withdrawn from the Cut 8 fix
+  batch before it landed. The key change is a leaf cut, mapped with Q18's.
+
+  The operator then checked the model behind the ruling: a subject is like
+  a GitHub issue or a Stack Overflow question, one canonical resolution
+  with an affordance to withdraw it, so discarding the withdrawn record
+  would waste context, "but that's making an assumption that this context
+  is even made available to the agents to begin with, and that it is
+  important." Self's answer, recorded as two obligations the ruling
+  carries: the ruling stands on the campaign's own principle, nothing is
+  overwritten and in-force is derived, which Self's default had violated
+  for this one kind; and the context reaches agents only if **Cut 9
+  exposes a subject's resolution history, not only its in-force state**
+  (ruling 2: rehydration and precedent before browsing) and **Cut 11
+  indexes withdrawn resolutions with their reasons**. Both are now
+  requirements on those cuts. The evidence that reversals matter is this
+  map: Q5 ruled A then C, the pause ruled then unruled, a byte-identical
+  claim withdrawn.
+- **Q18. Can a stewardship be regained after a hand-off?** Depends on: Cut
+  12. The derived stewardship keys `<instance>:stewardship:<repo>`, so a
+  repo handed away and handed back collides with the withdrawn record.
+  - **A. Key stewardship by repo and date**, `<instance>:stewardship:<repo>.<assigned_on>`;
+    the in-force stewardship is the latest not withdrawn. A key change in
+    the leaf, free today.
+  - **B. One stewardship per (instance, repo), ever.** A repo handed away
+    cannot come back to the same instance. Simplest; probably wrong for
+    the operator's own workflow, where one instance stewards several repos
+    over time.
+
+  **Recommended: A**, landed as a small leaf cut before Cut 12, not now.
+
+  **Ruled A, 2026-09-16**, with a framing that changes Cut 12's meaning.
+  The operator: "I actually was not planning for such handoffs but I can
+  definitely see it being useful for when a campaign has cross-cutting
+  concerns and the main steward for it must lease another steward's
+  authority over a repo to resolve it." Self first read that as "a hand-off
+  is a lease"; the operator corrected it the same day: "A hand-off is not
+  *always* a lease. We might start with, say, Odin as steward over a whole
+  swarm of infra tools, and spin off a new steward only when the workload
+  justifies it. Odin wouldn't be getting it back in that case." So a
+  hand-off is a transfer of stewardship, symmetric and final as a record; a
+  lease is two transfers and carries no field of its own. Stewardship keys
+  by repo and assignment date; the in-force stewardship is the latest not
+  withdrawn; a return, when there is one, is an ordinary second hand-off.
+  Mapped as a leaf cut with Q17's.
+- **Q19. Can a withdrawal be withdrawn?** Raised by Imagination mapping
+  Cut 6d. **A. No**: a subject reopened by withdrawal is resolved again at
+  the next sequence; chain depth two at admission. **B. Yes**, a withdrawal
+  of a withdrawal reinstates. **Recommended and ruled A, 2026-09-16**
+  ("Agreed on 19 and 20"); it is what gives "latest not withdrawn" one
+  reading.
+- **Q20. Stewardship key granularity.** Imagination found that keying
+  stewardship by repo and date lets a repo move at most once per day per
+  instance, and `Date` is day-granular by design. **A. A per-(instance,
+  repo) sequence**, `<instance>:stewardship:<repo>.n<N>`, writer-set and
+  checked by admission as previous plus one, exactly as Q17's resolutions;
+  `assigned_on` stays a field. **B. Keep the date** and state the limit.
+  **Recommended and ruled A, 2026-09-16.** Supersedes Q18's "by repo and
+  date" wording; Q18's substance (a repo can come back) stands.
+
+## Target contradictions for Self to reconcile
+
+1. **"Embeddings come from Ollama on Nightwing"** (target, ruling 16). The Body
+   disagrees for a Yggdrasil daemon: `epiphany.service` embeds against
+   `http://10.77.0.1:11435`, a Yggdrasil-local Ollama, with the same
+   `qwen3-embedding:0.6b` model (R16). Only voidbot's indexer uses Nightwing
+   `10.77.0.3:11434`. **Recommendation: follow the Epiphany precedent and embed
+   locally at `10.77.0.1:11435`,** which removes a cross-host dependency from the
+   admission path. The target's sentence should name the endpoint, not the host.
+2. **"Huginn is the memory organ ... which also ends the standing authority
+   vacancy where doctrine named Huginn the Persona-state steward"** (ruling 17).
+   It ends the vacancy only for pipeline state. `F:\Projects\CLAUDE.md` names
+   Huginn the runtime steward of `gamecult.persona_state.v0` inspection and
+   migration, and this campaign builds none of that; VoidBot keeps that path.
+   The doctrine paragraph still needs a correction, and it is not this
+   campaign's. Recorded as FU-2.
+3. **"Cut 3a code: keep the document kinds, keys, validation and typed
+   refusals"** (target, Shape decided). Accurate, but the typed refusals split:
+   six of the thirteen landed variants are repo-store refusals and die (D2).
+4. **Document set.** The target's End state lists ten kinds. Ruling 14 requires
+   three more — `instance`, `stewardship`, `hand_off` — each with a live
+   consumer (D2). The target's Documents bullet should name thirteen.
+5. **"a typed hand-off for reassigning stewardship, and an import path for
+   another instance's mind"** (target). Built in Cut 12, but note it is not a
+   merge: two minds cannot diverge, so import is a transfer of named documents,
+   not a reconciliation.
+
+## Follow-ups outside this campaign
+
+- **FU-1. Huginn's legacy `.voidbot` Persona state.** `.voidbot/voice/identity.json`
+  says the Persona is Huginn; `.voidbot/state/huginn.cc` says the jurisdiction is
+  `repo:CultCacheTS` and holds eight legacy `void.*` types and zero
+  `gamecult.persona_state.v0` documents. Out of scope by the target. No cut
+  touches `.voidbot/`. Owner: whoever runs the portable-Persona migration.
+- **FU-2. Doctrine names Huginn the Persona-state steward.** After this campaign
+  Huginn is a real runtime, which makes the doctrine paragraph in
+  `F:\Projects\CLAUDE.md` more tempting to believe and no more true. Either build
+  the Persona path in Huginn or correct the doctrine to name VoidBot. Owner:
+  the operator, via a Mind Steward proposal.
+- **FU-3. The receipt is implemented twice.** `EpiphanyMindCommitReceipt` in
+  Epiphany and `HuginnCommitReceipt` in Huginn share a shape and the digest,
+  replay and CAS logic (D3). Epiphany's path is about 260 lines at `dddf9ede`
+  (`reasoning_context.rs:543-624`, `:1584-1701`, `:1836-1893`), not the 120
+  first written here; Huginn's copy is bounded to one file of at most 220,
+  smaller because it drops the authority enum, companions, `invariant_owner`
+  and `store_id`. Moving it was priced in Cut 8 (a CultLib change under the
+  QUIC campaign, two re-pins, a C# parity question) and declined. This is the
+  price of the service boundary. If a third consumer ever appears, extract
+  the primitive into CultLib rather than adding a third copy.
+- **FU-4. `EpiphanyMindCommitReceipt` naming scar** is now resolved by accident:
+  with the pipeline profile gone, the type serves only Mind again. No action.
+- **FU-5. The Epiphany map's epoch claim is stale.** `state/map.yaml:76-77` says
+  runtime/Mind "v45/v11"; code has `epiphany.runtime_spine.v47`
+  (`runtime_spine.rs:58`). Mind Steward's surface.
+- **FU-6. `state/map.yaml:261`** carries a long prose summary of this campaign
+  that already describes the organ model. It will go stale as the cuts land.
+  Mind Steward's surface, at each phase boundary.
+- **FU-7. Vendored Eve copies and VoidBot prose still name Huginn as the
+  inspector.** Ghostlight's `vendor/eve` submodule (pinned at `672c0c1`) and
+  the `Eve-aetheria-authority` worktree carry the fixture with
+  `"ownerRepo": "Huginn"` until re-vendored; VoidBot's
+  `scripts/export-voidbot-provider-advertisements.mjs:224-233` advertises a
+  `huginnInspectionHandoff` for `.cc` inspection that Huginn no longer does.
+  No code calls Huginn, so nothing breaks. Owners: whoever next bumps the
+  vendored Eve, and VoidBot's Persona doc.
+- **FU-8. EveConformance's parity harness cannot reach a report.**
+  `tools/parity/parity-manifest.json:250` wants
+  `F:\Projects\Aetheria\conformance\eve\aetheria-world-surface.json`, absent
+  since the manifest was last changed 2026-07-11. Found by Soul on Cut 7;
+  outside every campaign here. Owner: Eve/EveConformance.
+- **FU-9. CultCache's owned store signals a held lock by error text only.**
+  `Mind::open` matches the message ("already has an active owner") to map
+  the failure to `MindAlreadyOwned`; a re-pin that rewords it demotes the
+  refusal to `Unavailable` with nothing red. The coherent fix is a typed
+  error in `cultcache-rs`. Owner: CultLib, after the QUIC campaign.
+
+---
+
+# History
+
+Everything below is the record of superseded design. **Nothing here is live.**
+It is kept because the rulings and probes that produced it explain why the
+current design looks the way it does.
+
+## Landed: Cut 1. Re-pin CultLib to `a0813c6`
+
+Landed at `2b76c2e7` (re-pin) and `df82992c` (pin tests). Passed Soul.
+
+Replaced `rev = "e171eca3..."` with `rev = "a0813c6..."` in six manifests,
+converted twelve `load_envelope` sites to `put_envelope` (the API was deleted by
+CultLib `4ed9871`; every site used a storeless cache, so semantics were
+identical), and added `?` at eight `add_generic_backing_store` sites.
+
+- **Verification:** core tests 156/156 with zero warnings; four library packages
+  and all nine bins check.
+- **Soul found no drift on a live path.** Recorded: **F1 (medium, latent)** —
+  under cultcache-rs 0.2.0 a cache with no store accepts `put`/`delete` in memory
+  only, where `e171eca3` refused; Epiphany's four read caches have no mutating
+  caller today. **F2 (low)** — the pin tests proved "this store file is not
+  rewritten", not "no store is attached"; fixed in Cut 2. **F5 (gap)** — typed
+  reads of current-epoch stores are unproven because no current-epoch store
+  exists locally.
+
+## Landed: Cut 2. One commit owner, two store profiles
+
+Landed at `00991c1b` (F2 fix: storeless reads pinned by directory snapshot),
+`46460efc` (the `TypedCommitStore` profile) and `cb6ef5d2` (the fixes). Passed
+Soul at 160/160, with every mutation caught including two of Soul's own.
+
+Deleted three hard-coded Mind choices from `commit_authorized_mind_mutation` and
+replaced them with a profile: `store_id`, `backing_store`, `open_cache`,
+`validate_writes`. The profile owns its backing store, so an opener cannot pick
+a different one; the Mind epoch refusal and validation-before-replay are pinned.
+
+**Cut 5 now collapses this.** The second profile it was built for moved to
+another repo. Recorded honestly rather than quietly kept.
+
+Open decisions it left for the old Cut 3b, both now moot: replay under a changed
+validator, and mapping a lost race between identical commits to `AlreadyAdmitted`.
+The organ's receipt (D3) should handle the second case from the start.
+
+## Landed: Cut 3a. Documents, opener, lease, schemas
+
+Landed at `a1473c45` and `ad18c385`, with fixes at `b4f88d29`, `187e01e7` and
+`a317d4cf`. Tests 180/180, 27 mutations defined and caught.
+
+**Surviving into the new design:** the ten document kinds, the `value_types!`
+single field list, the bound aliases, the format types, key derivation,
+`validate_pipeline_write_envelope`, and the ten derived schemas with their
+byte-for-byte derivation test.
+
+**Deleted by Cut 4:** `pipeline_store.rs` entire — the opener, the writer lease,
+the holder record, `main_work_tree`, the committed-blob attribute checks, branch
+binding, and six refusal variants.
+
+**Soul's Cut 3a findings F1-F8** were all fixed before the rewrite. Their
+disposition under the new model:
+
+| Finding | Was | Now |
+|---|---|---|
+| F1 identity-less first commit bricks the store | Fixed by ruling 12 | **Survives** as Cut 8's `first_write_must_carry_identity_and_instance` |
+| F2 key collisions through dotted labels | Fixed by ruling 11 | **Survives** into `epiphany-pipeline` (Cut 6) |
+| F3 parent ids only prefix-checked | Fixed | **Survives** into `epiphany-pipeline` |
+| F4 resolution keys skip label validation | Fixed | **Survives** into `epiphany-pipeline` |
+| F5 store writable without lease or admission | Fixed | **Moot.** There is no lease; `admit` is the only write path |
+| F6 a worktree takes its own lease | Fixed by ruling 10 | **Moot.** No worktrees, no lease |
+| F7 a stale holder is named after a crash | Fixed | **Moot.** No holder record |
+| F8 git reads local excludes and global attributes | Fixed | **Moot.** No git reads |
+
+**A later Soul pass was in flight when the operator rejected the ownership
+model.** Its findings are referred to elsewhere as S1-S4 and S8. **That
+pass's report is not on disk in this workspace** — the only `S`-labelled
+artifacts in the scratchpad are Soul's *mutation* labels from the Cut 3a fix
+pass (`c3afix-mutations-run.log:15`, mutation S1 against
+`parent_ids_are_parsed_strictly` and `resolution_subject_is_a_full_id_of_its_kind`;
+mutation S3 against the marker rule). So this map classifies by **layer**
+rather than by label, and Self should bind the labels before briefing Hands:
+
+- **Findings against key parsing, identity, bounds, formats or the resolution
+  matrix survive**, and their tests move to `epiphany-pipeline` in Cut 6.
+- **Findings against the store opener's refusals survive in substance**, and are
+  re-tested against redb in Cut 8.
+- **Findings against the lease, the holder, `main_work_tree`, the committed-blob
+  checks, branch binding, or the merge tool are moot with the layer**, and Cut 4
+  is the fix.
+
+If any S-labelled finding does not fall into one of those three buckets, it is
+not covered by this map and Self should route it back to Imagination.
+
+**Self's binding (2026-09-16).** The pass's report was in Self's context, not on
+disk. Its findings bind as follows:
+
+| Finding | Layer | Disposition |
+|---|---|---|
+| S1 `main_work_tree` resolves into a foreign work tree (`--separate-git-dir <holder>/.git`) | git resolution | **Moot.** Cut 4 deletes it |
+| S2 the parent-toplevel check is unpinned (a bare `exists()` survived the suite) | git resolution | **Moot** with S1 |
+| S3 the attribute rule reads the `HEAD` blob, not what git consults | committed-blob checks | **Moot.** No git reads |
+| S4 no-commits and detached-HEAD edge cases of that rule | committed-blob checks | **Moot** with S3 |
+| S5 the API guard is not a file guard: a scratch crate wrote `pipeline.cc` with a forged record | store file | **Moot as written** (no local store), but its substance survives: the organ must be the only writer of its mind on disk. Cut 8 owns refusing foreign records on open; Cut 14 owns volume ownership and permissions |
+| S6 ruling 12 moved Mind write validation after identity-uniqueness and after the store opens | Mind commit path | **Survives.** Untouched by subtraction, and Cut 5's collapse must preserve validation before replay and the current fail-closed order |
+| S7 the target and D6 contradicted ruling 10 | docs | **Resolved** by the 2026-09-16 target rewrite and this map |
+| S8 a lease held by another user's process reports "unknown holder" | lease | **Moot.** No lease |
+| S9 Hands' 27 mutations had no artifacts on disk, so the claim was unverifiable | process | **Standing.** The Eureka Hands brief now requires each mutation to be defined exactly in the report and reproducible from a committed script |
+
+Nothing fell outside the map, so nothing routes back to Imagination.
+
+## Superseded: the repo-owned store design
+
+The following are dead and are not reproduced: the old **D2** (store path
+`<repo_root>/.epiphany/pipeline/pipeline.cc`, required `.gitattributes` and
+`.gitignore` lines, `repo_root` work-tree checks, branch binding), the old **D3**
+(the per-clone session lease in the git common dir, the holder record, who holds
+it), the old **D5** (the merge tool and `pipeline-merge` subcommand), and the old
+**D6** (sharing across repos by foreign read, `ForeignRef` citation and voidbot
+discovery — of which only `ForeignRef` survives, as a field on `ruling` and
+`finding`).
+
+Dead cuts: **old Cut 3b** (admission and queries in `epiphany-core` — replaced by
+Cuts 8 and 9 in Huginn), **old Cut 3c** (the merge command — replaced by Cut 12's
+hand-off), **old Cut 4** (`eureka-state` as an Epiphany package — replaced by
+Cut 13 in Huginn), **old Cut 5** (skill wiring against `repo_root` — replaced by
+Cut 15), **old Cut 6** (the proof campaign with attribute commits and a lease
+check — replaced by Cut 16), and **old Cut 7** (the voidbot semantic projection,
+its crawler exclusion, its vendored cultcache-ts replacement and its
+`search_pipeline_state` tool — replaced by the organ's own Qdrant collections in
+Cut 11, per ruling 16).
+
+Dead rulings: **5** (the store lives in the repo where the task runs), **6** (one
+runner per repo plus a merge tool), **10** (one store per clone, in the main
+working tree), **12** (the profile owns identity-on-first-write — the *rule*
+survives in Cut 8, the *profile* does not), and **Q1, Q3, Q4** (store layout, merge
+settlement, voidbot index scope), all of which asked questions about a store that
+no longer exists.
+
+Dead operator question **Q2** survives as ruling 8's epoch rule; **Q5** survives
+as the `schemars` dependency, now in `epiphany-pipeline`.
+
+- **2026-09-22: Epiphany could not be built from a clean machine.** It pinned Ghostlight `22281891`, whose `vendor/cultcache-py` submodule points at the deleted `GameCult/cultcache-py`. Only local cargo caches hid this. The fix moves the pin to Ghostlight `22937b71`, where that submodule was replaced by the PyPI dependency, and makes three call-site edits in `epiphany-core/src/persona_turn.rs`: `word_budget: 180` (Ghostlight's own `PERSONA_WORD_BUDGET`), plus `output_schema` wrapped in `Some`.
+  - Commits: `codex/eureka-pipeline-state` `0bc90b9c`, `main` `4d1113ef`, `codex/epiphany-shakedown-live` `075049b9`, `codex/epiphany-model-bridge` `ed3c7471`.
+  - Clean build on Yggdrasil: 244/244 tests pass. Peak 4.36 GiB.
+  - **Recorded, not fixed:** `codex/epiphany-model-bridge` has its own pre-existing break. It depends on `path = "../vendor/cultcache-rs"` and `"../vendor/cultnet-rs"`, which do not exist.
+- **2026-09-22: the RS fix batch landed** at Huginn `056db28` (Sonnet, verified on Yggdrasil).
+  - F1: reads go through `head`.
+  - F2: `open_with` is test-only, with a private `open_checked`.
+  - F3: R5b and R5c fixtures.
+  - F5: prose.
+  - Mind 70/70, daemon 18/18. The release check has no `test-support`.
+  - The mutation harness was retired mid-batch (operator ruling), so the `.psd1` edits were never committed.
+- **Soul on the RS fix, 2026-09-22**, the campaign's first **cargo-mutants** pass (Opus, on Yggdrasil).
+  - **RS-2 closes.**
+  - cargo-mutants over `92ac16c..056db28` produced 12 mutants: 6 caught, 0 missed, 6 unviable. The tool cannot delete a statement or reorder calls, so Soul's hand probes covered F1 (killed) and F3.
+  - **S1, blocking: the R5b and R5c fixtures are degenerate.** Their "foreign" type `epiphany.pipeline.campaign.v1` is a known type at the pinned leaf, so both gate-order mutants pass 70/70. A truly foreign id kills both.
+  - **S2:** `Mind::receipts()` is `pub` and skips `head`, an API gap rather than a wire gap.
+  - **S3:** `--all-targets` release builds unify `test-support` into the daemon.
+  - **S4:** prose.
+  - **Closing fixes are in Hands (Sonnet). RS-1 closes when S1 is fixed and proven by hand probe.**
+- **2026-09-22: RS-1's closing fixes landed.** Huginn `fbf793f..8c5f784` (Sonnet, on Yggdrasil):
+  - S1: the fixtures use `NEVER_A_KNOWN_TYPE`, which `is_known_type` rejects at every epoch.
+  - S2: `Mind::receipts()` is `pub(crate)`.
+  - S3: `open_with`'s doc states the real release condition. No Idunn deploy recipe for Huginn exists yet.
+  - S4: prose.
+  - Tests: mind 70/70, daemon 18/18.
+  - **Hand probes:** R5b and R5c both survived at `7771c37` and are both killed at `8c5f784`.
+  - **RS-2 and RS-1 are closed.**
+- **2026-09-22: the committed mutation suites are deleted** (operator ruling, "better nothing than a harness that punishes refactoring").
+  - Huginn `7771c37` (2,383 lines).
+  - Epiphany `703fdd0b` (1,021 lines, the leaf suites).
+  - Tests pin behaviour. Soul runs cargo-mutants on the diff and makes one-off hand probes.
+- **Next on this campaign:** BP-2, the widened pin move, waits on selection Cut 1 merging and on BP-1. The RS-L fix (`8473e75d`) gets its Soul pass now.
+- **Soul on the RS-L fix, 2026-09-22** (Opus, on Yggdrasil).
+  - **Held:**
+    - cargo-mutants 27.1: 22/22 caught. Leaf tests: 37.
+    - OrgRepo bounds are exact.
+    - The listed title classes are refused.
+    - Huginn builds against the new leaf. Its tests show 8 expected `Title` compile errors, which are BP-2's load.
+  - **RS-L does not close.** Findings:
+    - **S1:** DEL (U+007F) passes. The hand-written C0/C1 ranges skip it.
+    - **S2:** "visible" is undefined. A title made only of bidi controls, LRM/RLM, U+180E, a lone combining mark, variation selectors, tags or Hangul fillers is accepted. RLO followed by text allows Trojan-source spoofing.
+    - **S3:** refusing ZWNJ/ZWJ rejects Persian text and emoji sequences.
+    - **S4:** hand probes H01–H10 survive. Unpinned: the owner and repo bounds, a hyphenated repo, U+2028/9, the C1 and C0 edges, U+200C/D, U+2060, and NBSP.
+    - **S5:** `a/b.git` is accepted, giving the same repo a second identity.
+    - **S6:** GitHub names are case-insensitive. Huginn compares repos by exact string (`admission.rs:505`, `docs.rs:103`), so one repo can hold two stewardships.
+    - **S7:** schema prose. `Title` names the private `title_text`, and OrgRepo says maxLength 200 where the true maximum is 140.
+    - **S8:** the repo-contains-slash check is dead.
+- **Self's rulings on the RS-L second fix, 2026-09-22:**
+  - **Title.** A title is valid only if all of these hold:
+    - it contains at least one `char::is_alphanumeric()` character;
+    - it contains no `char::is_control()` character;
+    - it contains no bidi control (U+061C, U+200E/F, U+202A–E, U+2066–9);
+    - it is 1–200 bytes.
+
+    **The zero-width denylist is deleted**, so ZWJ and ZWNJ are allowed alongside real content. The rule uses std only, with no Unicode property tables. An emoji-only title is refused. **Flagged for the operator: this refines the accepted F2 rule.**
+  - **OrgRepo.**
+    - Refuse repo names ending in `.git`.
+    - **Identity is ASCII-case-insensitive.** The leaf exposes one canonical key, `OrgRepo::identity()` (ASCII lowercase), and every comparison and key goes through it. Huginn adopts it at BP-2.
+    - Double hyphens stay allowed.
+  - **S4:** pin every boundary and class with a behavioural test.
+  - **S7:** schema descriptions state the rules and the true maxima.
+  - **S8:** delete the dead check.
+  - **In Hands (Sonnet).**
+- **2026-09-22: the RS-L second fix landed** at `998f97e8` and `ec704d64` (Sonnet, on Yggdrasil).
+  - The title rule is the three-rule algorithm. The denylists and the whitespace check are deleted.
+  - `OrgRepo` refuses a `.git` suffix and gains `identity()`.
+  - Nine schemas were regenerated, and the byte-for-byte pin passes.
+  - Leaf tests: 37/37. No other crate depends on the leaf, and no fixture in the workspace is refused.
+  - Hand probes: every bound probe (H01–H05d) is still killed. The class probes (H06–H10) no longer apply, because the code they mutated is gone.
+  - **Stated limit, accepted by Self:** U+3164, the Hangul Filler, is `Lo`, so `is_alphanumeric` accepts it. A title made only of such characters is invisible and valid. Hands pinned it as accepted rather than reintroduce a one-code-point denylist, which is what this rewrite removed. Closing this properly needs Unicode property data (Default_Ignorable_Code_Point), which is a dependency the leaf does not carry. **Follow-up, FU-Title-Ignorable**, if a display surface ever cares.
+  - **Recorded, not this cut's:** `epiphany-core`'s `process_observation` test is flaky in the container, with a different test name on each run. It reads `/proc` and is environmental.
+  - **Soul's pass on the new rules is dispatched.**
+- **Soul on the RS-L second fix, 2026-09-22** (Opus, on Yggdrasil). **RS-L does not close.**
+  - **Held:** 37/37 tests twice; the schema pin; cargo-mutants 9/9 caught; all five required hand probes die; the bidi set is exactly Unicode's `Bidi_Control`; the byte bound is exactly 1–200 bytes; the dead check's deletion is sound; `a/b.git.git`, `a/.git` and `a/b..git` refuse while `a/git` and `a/.gitignore` are accepted.
+  - **S-1, high: `identity()` is exposed and never adopted.** It has no non-test call site. Key derivation still uses the raw string (`lib.rs:844,853`), so `GameCult/Epiphany` and `gamecult/epiphany` produce two store keys. `bounded_text!` derives `PartialEq`, `Ord` and `Hash` on the raw string, so `==` and every map key compare case-sensitively, and that is the path callers reach for. The doc comment claims the opposite. Two stewardships of one repository can each call the other unstewarded.
+  - **S-2, high: the `.git` refusal is case-sensitive.** `a/b.GIT`, `a/.GIT` and `A/B.GIT` are accepted, and their `identity()` is a string the validator refuses. The alias hazard survives through a case variant.
+  - **S-3, medium-high: the bidi class is unpinned.** Deleting U+2069, U+2066, U+061C, U+200F, U+200E or all of U+202A–D survives the suite. Only U+202E is pinned. Every other bidi assertion uses a lone control, which the alphanumeric rule already refuses, so it pins nothing. cargo-mutants does not generate class-member deletions.
+  - **S-4, medium: the rule widened where it should not have.** `is_control()` is `Cc` only, so U+2028 (`Zl`) and U+2029 (`Zp`) are now accepted inside a title. A one-line field can carry a hard line break. FEFF, U+200B, U+2060 and U+00AD embedded are also accepted now.
+  - **S-5, low-medium: the schema lost its caveat.** The description says "1 to 200 UTF-8 bytes" beside `maxLength: 200`, which a validator reads as 200 characters. A 200-character CJK title passes the schema and is refused by admission.
+  - **Recorded:** the Hangul-filler limit covers a class, not one code point: U+115F, U+1160 and U+FFA0 behave the same. **FU-Title-Ignorable names the class.**
+- **Self's rulings on the RS-L third fix, 2026-09-22:**
+  - **S-1: make it structural, not advisory.** `OrgRepo` gets hand-written `PartialEq`, `Eq`, `Hash`, `PartialOrd` and `Ord` over `identity()`, so `==`, `BTreeMap` and `HashMap` are case-insensitive by default and a caller cannot reach the old behaviour by accident. Key derivation (`lib.rs:844,853`) goes through `identity()`. The raw string stays for display only, and the doc says so. Tests: equality, a map with both spellings holding one entry, and one store key.
+  - **S-2:** the `.git` refusal is ASCII-case-insensitive, and `identity()` is always itself a valid `OrgRepo`. Test `a/b.GIT`, `a/.GIT` and `A/B.GIT`.
+  - **S-3:** pin every bidi code point with an **embedded** fixture, such as `"a\u{2066}b"`, so the alphanumeric rule cannot mask it. All eleven.
+  - **S-4:** refuse U+2028 and U+2029 as well as `is_control()`. Everything else stays allowed, so ZWJ and ZWNJ still work. Test both embedded.
+  - **S-5:** restore the bytes-versus-characters caveat in the `Title` description.
+  - **In Hands (Sonnet).**
+- **2026-09-22: the RS-L third fix landed** at `0631cbef` and `466628ac` (Sonnet, on Yggdrasil).
+  - **S-1:** `OrgRepo` is hand-written outside `bounded_text!`, with `PartialEq`, `Eq`, `Hash`, `PartialOrd` and `Ord` over `identity()`. Key derivation for Stewardship and HandOff escapes `repo.identity()`. Every other macro member is untouched.
+  - **S-2:** the `.git` refusal is case-insensitive.
+  - **S-3:** all twelve bidi code points are pinned with embedded fixtures. *Self's ruling said "eleven" and then listed twelve; Hands pinned twelve.*
+  - **S-4:** U+2028 and U+2029 are refused.
+  - **S-5:** the schema caveat is restored, nine schemas regenerated, and the byte-for-byte pin passes.
+  - Tests: 37/37, with assertions added to existing bodies.
+  - **Hand probes: 15 of 15 killed**, one per bidi point plus S-1, S-2 and S-4.
+  - `composed_keys_cannot_collide` had assumed case-preserving keys and was corrected in the same commit, as part of the same structural change.
+  - **Soul's pass dispatched.**
+- **Soul on the RS-L third fix, 2026-09-22** (Opus, on Yggdrasil). **RS-L closes on its stated invariants.**
+  - **Held, proven rather than asserted:**
+    - `Hash`, `Eq` and `Ord` all delegate to `identity()`, so agreement is total for every input.
+    - ASCII-only folding is airtight here, since the grammar is ASCII and non-ASCII case variants are refused first (probed with U+0130, U+212A, U+1E9E, U+00DF).
+    - Serde round-trips a map with both spellings to one entry.
+    - `identity()` is always itself valid, over all 16,384 two-character ASCII values and all 6,561 `.git`-window cases.
+    - All twelve bidi points and both separators die under per-point deletion.
+    - Nothing outside `is_control()` plus the fourteen named points is refused, across U+0000–U+2FFF.
+    - 37 tests, schema pin green, cargo-mutants 17 caught and 3 missed.
+  - **Closing fixes, ruled by Self:**
+    - **1 and 2:** every `OrgRepo` assertion compares values that should be equal, so `eq -> true`, `hash -> ()` and `cmp -> Equal` all survive. Add the unequal direction: `assert_ne!` on two different repos, different hashes, a non-`Equal` ordering, and `partial_cmp == Some(cmp)` for both equal and unequal pairs. That is S-3's lesson in a new shape.
+    - **3:** the `OrgRepo` schema description is about 1,100 characters of Rust-macro justification, published into nine contracts. Cut it to what a consumer needs: the grammar, the bound, and that identity is case-insensitive. The reasoning belongs in the source comment.
+    - **4:** `lib.rs:2868` says "eleven" above twelve fixtures. **Self's ruling made the same slip.** Say twelve.
+    - **6:** `campaign.repos` accepts both spellings of one repo and validates. Refuse duplicates **by identity**.
+  - **7, recorded, not fixed:** `identity()` allocates per comparison. Revisit only if a profile says so.
+  - **2026-09-22: the closing fixes landed** at `38bc5381` and `bcfc0d54`. **RS-L is closed.**
+    - The unequal direction is pinned, and all five mutants die: `eq -> true`, `hash -> ()`, `cmp -> Equal`, `partial_cmp -> None`, and a raw-string `partial_cmp`.
+    - The `OrgRepo` schema description goes from 1,207 to 313 characters, with the reasoning moved to a source comment that schemars never sees.
+    - The bidi count comment says twelve.
+    - `campaign.repos` refuses duplicates by identity, as `DuplicateRepo { field, repo }`.
+    - Tests: 38. The schema pin is green.
+    - **Two corrections to Self's ruling:** only **8** schemas reference `OrgRepo`, not nine, confirmed from the test's own diff. The duplicate check needed an optional hook on `value_types!`, because a cross-element invariant cannot be expressed per field; it is documented at the macro and at the call site.
+  - **5, answered here so BP-2 does not rediscover it.** Stewardship and hand-off keys change for any repo with an uppercase letter, which would strand documents in an existing store. **BP-2 moves the leaf to epoch v2, and Huginn refuses a store from a previous epoch at open.** So the mismatch cannot happen silently: an old store is refused loudly, which is the designed migration. BP-2 states this rather than writing a key migration.
diff --git a/docs/history/eureka-pipeline-state-target.md b/docs/history/eureka-pipeline-state-target.md
new file mode 100644
index 0000000..9679f74
--- /dev/null
+++ b/docs/history/eureka-pipeline-state-target.md
@@ -0,0 +1,171 @@
+<!-- Provenance: copied verbatim from GameCult/Epiphany ef956865 notes/eureka-pipeline-state-target.md; text below this line is unchanged. -->
+# Eureka pipeline state: target
+
+Status: target (the ends). The means live in `notes/eureka-pipeline-state-cut.md`,
+written by Imagination. Operator rulings are dated 2026-09-15 and 2026-09-16.
+
+**This target was rewritten on 2026-09-16** after the operator rejected the
+ownership model it had been built on. Rulings 5, 6, 10 and 13's store clauses,
+which put the store in the task's repo under a per-clone lease, are superseded
+by rulings 14-17 below. The cut map's Cut 3 sections describe the old model and
+are history, not live design.
+
+## Why
+
+Eureka is the Claude Code counterpart of this organism. It is a skill,
+published as `GameCult/Eureka` and installed at `~/.claude/skills/eureka`, that
+runs the same faculties (Self, Imagination, Hands, Soul, Mind Steward) over
+foundation changes. In its first campaign, the Aetheria CultCache migration, the
+pipeline worked, but its findings lived in prose: the cut map, subagent reports
+and memory files. Self re-read and re-summarised that prose at every step. Stale
+claims survived until a steward caught them. The postmortem needed a transcript
+crawl, and one operator quote survived only in a compaction summary.
+
+Epiphany already has the other half: typed documents, admission and receipts.
+Her own `notes/faculty-workflow-lessons-2026-09-04.md:146-176` proposes typed
+forms of Eureka's habits (`Map`, `Spec`, `CutReport`, `Verdict`, rulings, a
+landed-names digest), but none of them are built.
+
+This campaign builds them once and gives Eureka agents access to them.
+
+## What the first model got wrong
+
+The store was owned by a repo. Nothing owned the state, so the machinery grew to
+compensate: a per-clone writer lease, git-directory resolution, committed
+`.gitattributes` checks, and a merge tool for divergent copies. Three Soul passes
+went into propping that up, and it still resolved a store into a directory the
+operator never named.
+
+Mind state also does not want version control. Git offers branches, merges and
+history rewriting; a mind wants one owner and an append-only record.
+
+The operator's correction: **someone owns the state**. An instance owns its mind,
+and stewardship over repos is an assignment, not an identity. That is Epiphany's
+own design, and Eureka inherits it.
+
+## Operator rulings
+
+1. **Epiphany owns the schemas** for pipeline state.
+2. **Searchable state serves agents first.** Self and new agents rehydrate from
+   it ("what rulings govern stores?", "what is still open?"). Soul and
+   Imagination check precedent in it ("have nil map keys bitten us?"). Operator
+   browsing across projects comes later.
+3. **Two campaigns.** This one covers the schemas, the memory organ, admission,
+   the Eureka MCP client and a proof on one real Eureka task. The second,
+   Epiphany adopting Eureka's habits, comes after the schema stops moving.
+4. **Re-pin first.** Landed: Epiphany moved from CultLib `e171eca3` to
+   `a0813c6`.
+5. **Q1-Q5 (2026-09-15), of which only Q2 and Q5 survive the rewrite:** additive
+   schema changes keep the epoch and a breaking bump refuses the old store
+   (Q2); `schemars` is an unconditional `epiphany-core` dependency and the
+   published JSON schemas are derived from the Rust types (Q5).
+6. **The operator channel is the Claude Code session.** Eureka has no Persona.
+   Self is the operator surface, because spec iteration works best where the
+   question and the tree share a context. A blocking question may be pushed
+   through whatever notification MCP the user configures; Eureka owns no
+   transport and names no provider. Answers come back in the session. Answering
+   over a chat channel is a later campaign and needs identity binding first.
+7. **Eureka is published** as `GameCult/Eureka`, MIT.
+
+### Ownership (2026-09-16)
+
+14. **An instance owns its mind.** A store is canonical to exactly one instance.
+    Identity lives in the state, not in a path. Admission refuses a write
+    carrying another instance's identity, whatever the transport. Stewardship
+    over repos is an assignment recorded in that mind, and one instance may
+    steward several repos. Reassignment is an explicit typed hand-off recorded
+    in both minds, so history stays attributable.
+15. **A service owns the state, on Yggdrasil.** The memory organ is a daemon: it
+    outlives every session, owns a real resource dependency, and isolates a dead
+    session from a corrupted mind. It earns its process under the GameCult
+    daemon test. Minds are no longer committed to git, so there is no per-clone
+    lease, no git-attribute precondition, and no divergence between clones.
+16. **The organ depends on Qdrant directly, not on voidbot.** It owns its own
+    collections and indexes at admission time. voidbot keeps its read-only
+    public-repo retrieval; it is not in this path. Embeddings come from the
+    Ollama endpoint the map names. Epiphany's own service embeds against a
+    Yggdrasil-local endpoint with the same model, and only voidbot uses
+    Nightwing; follow the local precedent and name the endpoint, not the host.
+17. **Huginn is the memory organ.** The dormant `.cc`-to-Eve CLI is retired and
+    generic `.cc` inspection belongs to CultCache Studio in CultLib. Huginn
+    becomes the Rust service that owns instance minds, admission and the index.
+    That gives Huginn a real runtime for the first time, but it closes the
+    authority vacancy only for pipeline state: doctrine still names Huginn the
+    Persona-state steward, and this campaign builds none of that. Recorded as a
+    follow-up, not solved here.
+
+### Shape decided with those rulings
+
+- **Transport:** the organ speaks CultNet. `eureka-state` stays a local stdio MCP
+  server that is a thin CultNet client, so the MCP surface stays swappable and
+  the service protocol stays typed.
+- **Unreachable organ:** refuse loudly and let the campaign stall on that step.
+  No local spool, because that reintroduces two writers.
+- **Cut 3a code:** keep the document kinds, keys, validation and the refusals
+  that survive the layer. Six of the thirteen typed refusals exist only for the
+  repo store and die with it. Delete the store, lease and git layers, and
+  re-point admission at the organ.
+
+## End state
+
+- **Documents.** Epiphany defines the typed pipeline documents: campaign, target,
+  question, ruling, cut spec, cut report, verdict, finding, follow-up and
+  resolution, plus the three ruling 14 requires: instance, stewardship and
+  hand-off. Each has a stable schema id and version, a derived key, and a live
+  Eureka consumer. Schemas are derived from the Rust types and published in
+  `schemas/cultnet/index.json`.
+- **Instance identity.** A mind carries the instance that owns it and the repos
+  it stewards. A campaign names its repo; the mind holds campaigns across every
+  repo that instance stewards.
+- **The organ (Huginn).** One service owns every mind it hosts:
+  - admission, with per-document rules and typed refusals;
+  - exact and filtered queries (by campaign, repo, cut, kind, status,
+    supersession, time), "open items", and "rulings in force";
+  - semantic search over its own Qdrant collections, indexed at admission;
+  - a typed hand-off for reassigning stewardship, and an import path for
+    another instance's mind. Import is not a merge: with one owner per mind,
+    two copies cannot diverge, so nothing needs reconciling;
+  - supervised by Idunn, with a named backup owner for its volume.
+- **Eureka.** The skill's briefs tell Self, Imagination, Hands and Soul to admit
+  and query typed state instead of relaying prose. `eureka-state` is the thin
+  MCP client, registered at user scope.
+- **Proof.** One real Eureka task runs end to end on typed state: rulings
+  admitted, a cut spec, Hands' cut report, Soul findings, follow-ups queried
+  back, and a fresh agent rehydrating from queries alone.
+
+## Invariants
+
+- **One owner.** Exactly one instance owns a mind, and the organ is its only
+  writer. Eureka agents and the MCP client are clients; the index is a
+  projection.
+- **Identity travels with the write.** An admission carries the instance, and a
+  foreign instance is refused.
+- **Typed, not prose.** No JSON store and no blob fields where a typed field
+  exists. JSON appears only in published schemas.
+- **Mind state is not in version control.** Campaign prose (target, cut map) stays
+  in the repo; the mind does not.
+- **Supersession, not deletion.** An old ruling or finding stays queryable as
+  superseded.
+- **The skill defers to the schema.** Eureka describes how to use the state; the
+  schema set and admission rules are owned here.
+- **Availability is honest.** When the organ is unreachable, Eureka refuses and
+  says so. It never writes a second copy.
+
+## Not in scope
+
+- Epiphany's own organs consuming pipeline documents: the second campaign.
+- Operator browsing surfaces (Eve/CultUI) over pipeline state.
+- Answering operator questions over a chat channel.
+- Migrating the Aetheria CultCache campaign's prose into typed documents.
+- Cleanup of `.epiphany-run/` (105 GiB) and the repo-local `target/` (39 GiB).
+- Huginn's legacy `.voidbot` Persona state, which needs its own admission
+  decision.
+
+## Evidence
+
+- Substrate maps (scratch, 2026-09-15): Epiphany typed state and admission; the
+  MCP and client landscape.
+- Dated comparison: `~/.claude/skills/eureka/references/epiphany-comparison-2026-09-15.md`.
+- Campaign precedent: `F:\Projects\Aetheria\docs\cultcache-migration-postmortem.md`.
+- Huginn's dormancy and authority vacancy:
+  `F:\Projects\gamecult-ops\docs\repo-census-2026-09\repos\Huginn.md`.
diff --git a/docs/history/eureka-query-prior-art.md b/docs/history/eureka-query-prior-art.md
new file mode 100644
index 0000000..2b96c4b
--- /dev/null
+++ b/docs/history/eureka-query-prior-art.md
@@ -0,0 +1,524 @@
+<!-- Provenance: copied verbatim from GameCult/Epiphany ef956865 notes/eureka-query-prior-art.md; text below this line is unchanged. -->
+# Prior art for a typed, serializable query surface over a memory organ's read side
+
+Eyes pass, 2026-09-16/17. Facts with evidence pointers. No ranking, no recommendation.
+
+## The thing being measured against
+
+The five capabilities, abbreviated throughout as **C1..C5**:
+
+- **C1** typed predicates over each kind's own fields, expressed as data
+- **C2** projection (summary or whole document)
+- **C3** ordering plus an opaque cursor
+- **C4** one hop of citation in both directions
+- **C5** count / existence without bodies
+
+The portability facts, abbreviated **P1..P5**:
+
+- **P1** does the query itself serialize as typed data across runtimes (MessagePack wire, constructible from TS/C#), or is it Rust-only builder calls?
+- **P2** does it derive a JSON Schema, or is the schema hand-written?
+- **P3** transitive dependency cost; anything dragging in a runtime, network client, DB driver or parser generator
+- **P4** does it assume a backing store engine?
+- **P5** licence, last release, maintenance signal, single-maintainer?
+
+## The crate this lands in
+
+`F:\Projects\Huginn\crates\huginn-mind`, manifest at `F:\Projects\Huginn\crates\huginn-mind\Cargo.toml:9-19`. Dependencies exactly as stated in the brief: `anyhow`, `chrono 0.4.44`, `cultcache-rs` (CultLib, rev `a0813c6e`), `epiphany-pipeline` (Epiphany, rev `5cda0886`), `rmp-serde 1`, `schemars 1`, `serde 1`, `sha2 0.10`. Dev-only: `serde_json`, `tempfile`. The manifest comment states the constraint in its own words: "No network, no socket, no index: those are the daemon's (Cut 10, Cut 11)."
+
+**The baseline P3 measurement, taken directly.** `F:\Projects\Huginn\Cargo.lock` currently resolves **139 packages** for the whole three-crate workspace. A grep of the lockfile for `tokio`, `hyper`, `reqwest`, `tonic`, `async-std`, `mio`, `prost`, `pest`, `lalrpop` and `nom` returns **NONE** — there is no async runtime, no HTTP client, no gRPC stack and no parser generator anywhere in the tree today. The sibling `huginn-daemon` (`crates/huginn-daemon/Cargo.toml`) gets its socket from `cultnet-rs` and its process lifetime from `signal-hook 0.3`, synchronously. So any candidate pulling a runtime in would be introducing the first one, and the 139 is the number a transitive-dependency count should be read against.
+
+---
+
+# Part I — GameCult-internal candidates
+
+## I-1. The incumbent: `PipelineQuery` in `huginn-mind`
+
+**What it is.** A flat option-struct filter, already built, already on the wire, already schema-published. This is the surface a general one would replace.
+
+**Owner.** `huginn-mind`, this crate. Landed in commit `49cc6e3` "Read a mind: views, queries, open items and history".
+
+**Evidence.**
+
+- `F:\Projects\Huginn\crates\huginn-mind\src\query.rs:77-97` — `PipelineQuery`: `campaign: Option<Slug>`, `repo: Option<OrgRepo>`, `cut: Option<Label>`, `kinds: Vec<PipelineKind>`, `in_force: Option<bool>`, `faculty: Option<Faculty>`, `admitted_after: Option<Short>`, `admitted_before: Option<Short>`, `limit: Option<u32>`, `semantic: Option<SemanticQuery>`. Derives `Serialize, Deserialize, JsonSchema`.
+- `query.rs:249-290` — `Reader::matches`, the whole evaluator: a hand-written `if let Some(..)` chain, one branch per field, AND-only.
+- `query.rs:30-32` — `QUERY_LIMIT_MAX = 200`.
+- `query.rs:307-311` — `ordered()`, a fixed sort by `(admitted_at, id)`; not selectable.
+- `query.rs:331-350` — `Mind::query`; `matched` is computed before truncation so a short page is not mistaken for the whole answer.
+- `query.rs:110-117` — `PipelineOpenItems`, five named buckets.
+- `query.rs:121-125` — `HistoryScope::{Subject, Repo}`.
+- `F:\Projects\Huginn\crates\huginn-mind\src\wire.rs:43-50` — `HuginnMindRequest::{Whoami, Admit, View, Query, OpenItems, History}`.
+- `wire.rs:188, 203` — round-trips through `rmp_serde::to_vec_named` in test; MessagePack is the live encoding.
+- `F:\Projects\Huginn\crates\huginn-daemon\src\envelope.rs:39, 84, 144-145` — on the live wire the payload is **`rmp_serde::to_vec_named` then base64** inside a CultNet operation envelope, dispatched by schema id (`MIND_RESPONSE_SCHEMA` vs `FAILURE_SCHEMA`). Base64 is a 4/3 size multiplier on whatever the query serializes to, which is a fact about any encoding that nests deeply.
+- `wire.rs:31-34, 210-221` — the published JSON Schemas are `include_str!`'d from `schemas/cultnet/huginn.mind_request.v1.schema.json` and pinned byte-for-byte against `schemars::schema_for!` by the test `published_wire_schemas_match_derivation`, with `HUGINN_WRITE_SCHEMAS` as the regeneration path. The request schema currently carries 59 `$defs`.
+
+**Portability facts.** P1: yes, it is already typed data on a MessagePack wire. P2: yes, `schemars`, derived and pinned. P3: zero added. P4: no; it runs over `Docs::from_image(mind.envelopes())`. P5: ours.
+
+**Coverage.**
+
+- C1: **partial and cross-cutting only.** Every filter is a field shared across kinds or derived from admission. There is no way to express "severity = High" or "outcome = Withdrawn" — the brief's own example. `severity`, `confidence`, `origin` (`PipelineFinding`), `sequence`/`outcome` (`PipelineResolution`) are unreachable.
+- C2: **no.** `PipelineQueryPage.items` is always `Vec<PipelineDocumentView>` and a view carries the whole `PipelineDocument` (`query.rs:57-63`).
+- C3: **no cursor, fixed order.** `limit` truncates; `matched` tells you it truncated. A page is a truncation, exactly what the brief says it must stop being.
+- C4: **no, but two hops are hardcoded.** `open_items` (`query.rs:366-389`) walks `CutReport.cut_spec` and `Verdict.cut_report` by hand to derive `specs_without_report` and `reports_without_verdict`. `Reader::base` (`query.rs:237-246`) walks resolution→subject so a filter reads through a resolution.
+  The derivation layer beneath it (`F:\Projects\Huginn\crates\huginn-mind\src\docs.rs`) is entirely kind-specific and entirely `pub(crate)`: `find` (`:71`), `of_kind` (`:75`), `resolutions_of` (`:97`), `assignments_of` (`:104`), `stewardships_of` (`:194`), `closing_resolution` (`:186`), `later_in_force` (`:212`), `stewardship_of` (`:225`). There is **no generic "documents citing X" and no generic "documents cited by X"** anywhere in the crate; each traversal that exists was written for one pair of kinds.
+- C5: **no.** `matched: u32` is the only count, and it is a by-product of a query that already materialized every body.
+
+**Three places the incumbent reaches into key strings because there is no structured alternative** — worth recording as pressure evidence:
+
+- `query.rs:169-174` `root_and_local` splits `<root>:<kind>:<local>` by position.
+- `query.rs:262` matches a cut by `format!("cut-{}.", cut.0)` prefix on the local segment.
+- `query.rs:178-195` `repo_matches` is a hand-written match over 13 document variants to answer "does this document carry this repo".
+
+**The semantic hole is already declared.** `query.rs:65-72` and `331-336`: `SemanticQuery { text, top_k }` is accepted by the type and refused typed — "Cut 11 also owns which fields of each kind are text, so no substring filter lives here to become a second answer to that question."
+
+## I-2. `epiphany-pipeline` — the document leaf, and how its references are shaped
+
+**What it is.** The crate that owns document shape, bounds, formats and keys. Not a query surface; it is the schema C1 and C4 would have to be expressed over.
+
+**Owner.** Epiphany, `F:\Projects\Epiphany\epiphany-pipeline\src\lib.rs`, 2444 lines, single file.
+
+**The load-bearing fact for C4: references are not uniformly typed.**
+
+- `lib.rs:400-437` — `PipelineRef { kind: PipelineKind, id: Short }` with `validate_ref()`. This is the typed reference.
+- But most citations are bare `Short`, kind implied by field name:
+  - `lib.rs:349` `PipelineCutReport { cut_spec: Short, forks: Vec<Short>[8], .. }`
+  - `lib.rs:356` `PipelineVerdict { cut_report: Short, .. }`
+  - `lib.rs:357` `PipelineFinding { verdict: Short, .. }`
+  - `lib.rs:342` `PipelineCutSpec { depends_on: Vec<Short>[8], rulings: Vec<Short>[32], questions: Vec<Short>[16] }`
+  - `lib.rs:324` `VerdictClaim { findings: Vec<Short>[16], mutations: Vec<Label>[8], .. }`
+- Typed `PipelineRef` appears in only three places: `PipelineQuestion.raised_in: Option<PipelineRef>` (`lib.rs:334`), `PipelineFollowUp.source: PipelineRef` (`lib.rs:362`), `PipelineResolution.subject: PipelineRef` (`lib.rs:374`).
+- `ForeignRef` (`lib.rs:286`) is the cross-repo reference: `{ repo, commit, kind, id, payload_sha256 }` — typed, but names another repo.
+- `DocRef` (`lib.rs:287`) points at a file range, not a document.
+
+There is **no generic "references out of this document" enumerator** in the leaf. `grep` finds 137 occurrences of `PipelineRef` and no `fn refs`, `fn references` or `fn cites`. A generic C4 hop must therefore either carry a per-field kind table or the leaf must grow a reference enumerator.
+
+**Per-kind predicate fields C1 would need to reach** (`lib.rs:357` and around): `PipelineFinding { confidence: FindingConfidence, severity: FindingSeverity, origin: FindingOrigin, invariants: Vec<Label>[8] }`; `PipelineResolution { sequence: u32, outcome: ResolutionOutcome }` (`lib.rs:374`); `PipelineStewardship { instance, repo, sequence, assigned_on }` (`lib.rs:388`). Every bound is declared in the macro (`[8]`, `[16]`, `[64]`), so field cardinality is already known statically.
+
+**Portability facts.** P1/P2: the documents already serialize and derive `JsonSchema`, same `schemars`. P3: it is already a dependency. P4: no. P5: ours.
+
+**Coverage.** Owns none of C1..C5; it is the type universe they range over.
+
+## I-3. CultCache (`cultcache-rs`) — no query concept at all
+
+**What it is.** The store. Envelope persistence, compare-exchange, snapshot pull.
+
+**Owner.** CultLib, `F:\Projects\CultLib\packages\cultcache-rs\src\lib.rs`, single file.
+
+**Evidence.** The entire public surface is CAS/batch/snapshot: `compare_and_swap_entry` (`:412`), `insert_entry_if_absent` (`:437`), `compare_and_swap_batch` (`:456`), `append_if_snapshot_unchanged` (`:510`), `delete_batch_if_unchanged` (`:543`), `replace_and_append_if_snapshot_unchanged` (`:571`), `pull_all_read_only_snapshot` (`:674`), `compare_exchange` (`:728`), `register_document_type` (`:1952`), `pull_all_backing_stores` (`:2022`). There is **no** `fn query`, `fn filter`, `fn find`, `fn select` or `fn where` anywhere in the file.
+
+**One correction to "no selection at all": the C# reference has two single-value index lookups, and the Rust runtime has neither.**
+
+- `F:\Projects\CultLib\src\GameCult.Caching\CultCache.cs:1495-1509` — `GetByName<T>(string name)` and `GetByIndex<T>(string alias, string value)`. Both funnel through `Single<T>(...)`, so each returns **at most one document**: these are unique-index lookups, not multi-result selection, and there is no range, no set membership, no composition.
+- Consumers are all in the C# tree: `src/GameCult.Mesh/CultMesh.cs:2351, 2433, 3330`, `src/GameCult.Networking/CultNetDatabase.cs:794-797, 1105-1106`.
+- `grep` for `get_by_index` / `by_index` / `index_alias` in `packages/cultcache-rs/src/lib.rs` returns **nothing**. The runtime `huginn-mind` actually depends on has no index concept at all.
+
+A repo-wide search for declared filter/predicate/selector types across `CultLib`, `Epiphany`, `Eve`, `Odin`, `Norn` and `Mimir` sources (`grep -rliE "(struct|class|interface|enum) +[A-Za-z]*(Filter|Predicate|Selector|Criterion|Criteria)"`) returns **zero hits in CultLib, Odin and Norn**; the Eve hits are all `node_modules`; Mimir's two are a signal-processing matched filter and a transport selector, unrelated.
+
+**Coverage.** None of C1..C5. Read is "give me every envelope"; selection is the caller's loop. P4 is the notable one: CultCache is exactly the in-memory-image shape the brief describes, so a candidate that needs a store engine is a different kind of thing.
+
+## I-4. CultNet — one selection shape on the wire, and it is two id allowlists
+
+**What it is.** `CultNetMessage::SnapshotRequest`, the only CultNet message that narrows what comes back.
+
+**Owner.** CultLib, `F:\Projects\CultLib\packages\cultnet-rs\src\snapshot_query.rs`.
+
+**Evidence.**
+
+- `snapshot_query.rs:160-163` — `CultNetRawSnapshotQuery { message_id: String, expectations: BTreeMap<(String, String), CultNetSnapshotSourceExpectation> }`.
+- `snapshot_query.rs:197-217` — `request()` lowers those expectations to `CultNetMessage::SnapshotRequest { message_id, schema_ids: Option<Vec<String>>, record_keys: Option<Vec<String>> }`. Note it lowers to the *cross product* of schema ids and record keys, then re-validates the response against the exact expectations in `accept_response` (`:220-289`).
+- `snapshot_query.rs:30-56` — `CultNetReadOnlySnapshotPolicy` is an explicit `(schema_id, record_key)` allowlist, not a predicate.
+
+**Portability facts.** P1: `SnapshotRequest` crosses the wire, so yes, but it carries no predicates to serialize. P2: not `schemars`-derived here. P3: in-substrate. P4: no. P5: ours.
+
+**Coverage.** C1 no (identity only, no fields). C2 no. C3 no. C4 no. C5 no. This is a fetch-by-id list, not a query.
+
+## I-5. CultMesh — a query *surface*, with the query shape left to the caller
+
+**What it is.** The generic plumbing for "a parameterised, watchable read". It deliberately does not define what a query is.
+
+**Owner.** CultLib. C# reference `F:\Projects\CultLib\src\GameCult.Mesh\CultMeshPrimitives.cs`; TS runtime `F:\Projects\CultLib\packages\cultmesh-ts\src\index.ts`.
+
+**Evidence.**
+
+- `CultMeshPrimitives.cs:628` — `CultMeshQuerySurface<TParameters, TResult>`; `:706` `CultMeshBoundQuerySurface<TParameters, TResult>`. `TParameters` is entirely caller-defined. The TS mirror is `packages/cultmesh-ts/src/index.ts:~643-730`.
+- `CultMeshPrimitives.cs:876-881` — `CultMeshDocumentQueryParameters` is an **empty struct** with a single `Empty` singleton. The document-handle case has no parameters at all.
+- `CultMeshPrimitives.cs:487` `CultMeshQueryContext` and `:593` its builder — this is *routing and locality* context (verse, route hint), not selection.
+- `F:\Projects\CultLib\src\GameCult.Mesh\CultMeshDiscoveryService.cs:34-57` — `CultMeshDiscoveryQuery { EndpointId, VerseIds, AuthorityRuntimeId }`. A three-field discovery filter over Verses, not over documents.
+
+**Coverage.** CultMesh supplies the *slot* a query document would sit in (`TParameters`) and nothing that fills it. None of C1..C5 are answered; the type parameter is the evidence that the question was left open.
+
+## I-6. Eve DSL — binding, and an explicit refusal to own selection
+
+**What it is.** A composition language for interface projection. It binds components to documents and fields.
+
+**Owner.** Eve, `F:\Projects\Eve`.
+
+**Evidence.**
+
+- `F:\Projects\Eve\docs\surface-contract-v1.md:66-71` — the binding primitives: `var` (one live value), `collection` (event-shaped ordered values), `derive` (computed fields such as counts and latest events), `bind` (component props subscribe to a var/collection/derived field).
+- `surface-contract-v1.md:156-158` — a component names `documentId`, `schemaId`, `slotId`, `presentationKind`, `routeHint`. Then, verbatim: "Provider adapters or advertised plugins own schema-specific query selection and decoding. Renderer code must not switch on provider schema ids or call provider-specific query methods to resolve a slot."
+- Selection that does exist in Eve is presentation-only and enumerated, not general. `F:\Projects\Epiphany\epiphany-core\src\atlas\eve_surface.rs:65-93` — `AtlasEveAttentionFilter` is a five-variant enum (`NeedsAttention`, `Degraded`, `Disputed`, `Stale`, `All`) lowered to a `control.select` with a fixed option list (`eve_surface.rs:~548-574`) and an advertised command marked `presentation_only: true, domain_state_effects: "none"` (`eve_surface.rs:~1146-1180`).
+
+**Coverage.** Eve binds to a subset someone else selected. `derive` covers counts (C5-adjacent) at the presentation layer only. C1..C4 are explicitly out of scope by the surface contract's own sentence.
+
+## I-7. Odin — two structs named Query, neither a predicate language
+
+**Owner.** Odin, `F:\Projects\Odin`.
+
+**Evidence.**
+
+- `F:\Projects\Odin\crates\odin-daemon\src\lib.rs:324-328` — `OdinStoreQuery { incarnation: IncarnationRef, provider_signer_identity_id: String, dependencies: Vec<IncarnationRef> }`. A by-identity read; `OdinTopologyStore::read` (`:339`) returns one `OdinStoreSnapshot`. No derives — not serializable as written.
+- `F:\Projects\Odin\crates\odin-core\src\discovery.rs:6-11` — `OdinEndpointQuery<'a> { schema: Option<&'a str>, transport_contains: Option<&'a str>, host_hint: Option<&'a str>, device_filter: Option<&'a str> }`. Four optional string filters, one of them a substring match. **Borrowed lifetimes and no serde derives**: this cannot cross a wire as written. `discover_provider_endpoints` (`:22`) loops `cache().get_all::<EveProviderAdvertisementRecord>()` and filters in Rust.
+
+**Coverage.** `OdinEndpointQuery` is the same flat-option-struct shape as `PipelineQuery` (I-1), arrived at independently, over a different type. Neither covers C1..C5.
+
+## I-8. VoidBot — the live Qdrant filter translation, and a second flat option struct
+
+**What it is.** The only place in the substrate that builds a Qdrant filter document today. Directly relevant because Cut 11 depends on Qdrant.
+
+**Owner.** VoidBot, `F:\Projects\VoidBot`.
+
+**Evidence.**
+
+- `F:\Projects\VoidBot\packages\shared\src\index.ts:114-124` — `RetrievalFilters { corpusKind?: "discord_history" | "repository_source" | "persona_memory"; guildId?; channelId?; authorId?; identityId?; repoName?; pathPrefix?; language?; sourceId? }`. Nine optional strings, AND-only, no ordering, no cursor.
+- `F:\Projects\VoidBot\packages\rag\src\qdrant-vector-store.ts:21` — `type QdrantFilter = Schemas["Filter"]`, i.e. the types come from the Qdrant client's own generated OpenAPI schema types, not hand-written.
+- `qdrant-vector-store.ts:543-563` — `toQdrantFilter`: builds `const must: Schemas["Condition"][]`, appends one exact match per set field, returns `must.length > 0 ? { must } : undefined`. **`should` and `must_not` are never used.** The full Qdrant boolean model is available and only the AND arm is exercised.
+- `qdrant-vector-store.ts:566-584` — `buildMatchAnyFilter(field, values)` produces a `match: { any: [...] }` condition, used only for delete-by-sourceId batches (`:119-125`).
+- `qdrant-vector-store.ts:129-136` `deleteByFilters`, `:142-162` search with `filter: toQdrantFilter(filters)`.
+- Consumers: `packages/rag/src/{file-vector-store,in-memory-vector-store,message-archive,retrieval-service,source-vector-store}.ts` all import `RetrievalFilters` — so the same nine-field struct is the filter shape for the in-memory store, the file store and Qdrant alike.
+- The MCP tool surface exposes a hand-written subset of the same fields: `packages/providers/src/local-llm-tools.ts:79-115` (`search_sources` with `repoName`, `pathPrefix`, `language`, `limit`).
+
+**This is the strongest in-substrate evidence of the pressure the brief names.** Two independent flat option-structs (`PipelineQuery`, `RetrievalFilters`) plus a third (`OdinEndpointQuery`) exist because no general one does, and `RetrievalFilters` additionally flattens Qdrant's boolean model down to `must`-only on the way through.
+
+## I-9. Huginn's own README and AGENTS — authority boundary
+
+Recorded because it bounds where a query surface may live. `F:\Projects\Huginn\README.md:14-24` and `AGENTS.md:26-40`: Huginn owns `.cc` inspection projection and Eve DSL emission for `cultcache.huginn.inspector`; it does **not** own CultCache persistence. Note the AGENTS file still names `E:\Projects\Huginn` as project root while the live tree is `F:\Projects\Huginn` — stale, flagged, not part of this question.
+
+---
+
+# Part II — Prior attempts and abandonments in our own history
+
+## II-1. `ThreadEpiphanyGraphQuery` — a serializable citation-hop query, built and deleted
+
+**What it was.** The closest thing the substrate has ever had to C4 as data.
+
+**Evidence.**
+
+- Added: Epiphany commit `5c62a650` "Add Epiphany graph query surface", 2026-04-29.
+- Shape, from the generated TS at `vendor/codex/codex-rs/app-server-protocol/schema/typescript/v2/ThreadEpiphanyGraphQuery.ts` in that commit:
+  `{ kind: ThreadEpiphanyGraphQueryKind, nodeIds?: string[], edgeIds?: string[], paths?: string[], symbols?: string[], edgeKinds?: string[], direction?: ThreadEpiphanyGraphQueryDirection | null, depth?: number | null, includeLinks?: boolean | null }`
+- `ThreadEpiphanyGraphQueryKind = "node" | "path" | "frontierNeighborhood" | "neighbors"`.
+- `ThreadEpiphanyGraphQueryDirection = "incoming" | "outgoing" | "both"` — **both directions of the hop, as data**.
+- Doc comments in the generated file: direction "Defaults to `both`"; depth "Defaults to 1 and is capped by the server"; includeLinks "Defaults to true so neighborhood queries preserve dataflow/architecture joins".
+- Schema was **derived, not hand-written**: `// This file was generated by [ts-rs]`. The same commit added `codex_app_server_protocol.schemas.json` and `.v2.schemas.json` (138 lines each) and `ClientRequest.json` (85 lines).
+- Deleted: Epiphany commit `5f6f2441` "Remove Epiphany app-server compatibility surface", 2026-07-12. Nothing named `*GraphQuery*` survives in the tree today (`find` returns nothing outside `node_modules`).
+
+**What happened to it.** It was not removed for being a bad query shape. It went out with the whole app-server compatibility surface it lived in — it was a Codex protocol type in `vendor/`, carried on ts-rs and JSON Schema generation, and died with its host. Related surviving history: `2ea57376` "Add local Verse context query", `e2a8b479` "Read graph query from memory graph store", `fa222584` "Move retrieval query law to core", `0cf4b081` "Move graph query smoke to Rust", `bf433d63` "Make semantic readiness proof query-owned".
+
+**Coverage it had.** C1 partial (id/kind sets, not per-kind field predicates), C2 via `includeLinks` only, C3 no cursor but a server-capped depth, **C4 yes — direction and depth as data**, C5 no.
+
+## II-1b. Selective hydration, deleted from CultCache three days ago
+
+**What it was.** A filter applied at the store layer so a pull could hydrate a subset rather than the whole image.
+
+**Evidence.** CultLib commit `900e148d8ad6dceed4b9c14dac23d12a869cb539`, "Read only v4 directory stores; delete probes and selective hydration", 2026-09-13. Its own message: "DirectoryMessagePackBackingStore loses **HydrationFilter**, FlushStageProbe, ReadStageProbe and their stage constants, ReadPersistedGeneration, **PullSelected**, and every legacy path ... **CacheBackingStore.PullSelected** and CultPersistedRecordMetadata go with them."
+
+**What happened to it.** It went out with the v1/v2/v3 store formats in a format-narrowing cut, not as a judgement on filtering. But the effect stands: as of three days before this pass, CultCache's backing-store surface has **no way to pull a subset**. `pull_all_read_only_snapshot` and `pull_all_backing_stores` are what remain. Any query surface above it reads the whole image, which is what `huginn-mind` does (`query.rs:207-208`, `Docs::from_image(mind.envelopes())` per call).
+
+**Also worth recording:** every other CultLib commit matching query/filter/predicate/selector is about **schema-alias or shard-membership resolution**, not field predicates — e.g. `54543b5` "Resolve Python shard discovery filters by schema alias", `1b9140d` "Resolve C# subscription filters by schema alias", `2738f4c` "Resolve TS snapshot filters by schema alias", `7ad74cf` "Filter Python snapshots by shard membership". "Filter" in CultLib means "which records by schema and shard", never "which documents by field value".
+
+## II-2. The RethinkDB lineage — what the archive actually says
+
+The operator's account is **confirmed as to adoption and abandonment**, and **not confirmed as to ReQL or changefeeds specifically**.
+
+**Adoption, with the stated reasons.** Discord `#development`, 2020-03-15:
+
+- `688549686373515270` (00:50): "I've decided [Tympanic] is right, and abusing git for document storage is a bad strategy. I spent a couple days researching a bunch of different db solutions, I feel like I've looked at every one of them."
+- `688550094030503985` (00:52), the anchor: settled on RethinkDB for four named properties — it stores JSON, supports queries, has a realtime push feature like Firebase realtime db, and has a C# client library, "which even Firebase bafflingly lacks".
+- `688550271554682890`: "db is now live at asgard.gamecult.games:28015" (28015 is RethinkDB's client driver port).
+
+**The alternative that was considered and passed over.** 2020-03-11, `#development`: Tympanic `687397982638833793` "What would be a reason to not just go straight to something like SQL? It all depends on how much data we expect to have." Metacrat `687400730948272258` "Maybe you're right about SQL though. I had to use it for my database class and didn't particularly enjoy it, but it's battle tested"; `687411066522697873` "I kinda feel like saying let's cross that bridge when we get to it, migrate to SQL if document store + git ends up being a bottleneck".
+
+**Abandonment.** 2020-2021 RethinkDB was the real production database — editor tooling wrote to it (`691363946623402014`, 2020-03-22), the game would not run without it (`716084893888806983`, 2020-05-30). Then 2021-06-23, `857099401398845442`: "Pretty big change in how we're handling data here. From now on, the Rethink database is obsolete. We can still go back to it, but for now I've configured it to use JSON files when present and fall back to entries defined in a msgpack file", followed immediately by `857099432168128553` "this will make modding trivial".
+
+**What that message is.** It is the CultCache origin: files plus MessagePack, chosen for moddability, replacing a server. Also `1023147757860565012` (2022-09-24) "No really take a look at rethinkdb" — still recommending it a year after dropping it.
+
+**What the archive does not contain.** Searches of the indexed Discord history for ReQL, for changefeeds, and for query/filter-language design return **no hit naming ReQL or changefeeds at all**. The realtime feature is referenced only obliquely and by analogy — "a realtime push feature like Firebase realtime db". So:
+
+- The inheritance the archive *documents* is: document store, JSON/schemaless records, a real client library, and realtime push. Push/watch is the dimension that visibly survives — CultMesh's `watch`/`observe` on a document handle (`CultMeshPrimitives.cs:~2010`, `packages/cultmesh-ts/src/index.ts:~886`) and `CultMeshPollingWatchOptions` (`CultMeshSnapshots.cs:~558`).
+- The inheritance the archive **does not** document is the query side. No term tree, no serialized predicate, no filter document, no selector exists anywhere in CultCache or CultNet (see I-3, I-4). CultNet's only wire selection is two id allowlists.
+- Stated plainly: on the evidence available, **the borrowing was in change notification and document-shaped storage, not in querying.** Whether that was deliberate or simply never reached is not answerable from the archive; see the open questions.
+
+One adjacent scar worth recording, since it is about query complexity in our own code: `1510998723730346114` (2026-06-01), on the Aetheria codebase — a TODO cursing a LINQ query nested ten levels deep.
+
+---
+
+# Part III — External prior art
+
+## III-1. RethinkDB ReQL wire encoding (named prior art)
+
+**What it is.** A query represented not as text but as a tree of typed terms, serialized as nested arrays. Each language driver is a builder over that one wire format.
+
+**Evidence.** `rethinkdb/rethinkdb`, `src/rdb_protocol/ql2.proto`, branch `next` at commit `a2cf1308b57dca2e05d744f225a082881bab3fca` (2026-03-28), 862 lines — https://github.com/rethinkdb/rethinkdb/blob/next/src/rdb_protocol/ql2.proto . Driver-authoring spec: https://rethinkdb.com/docs/writing-drivers/ . Python driver `ast.py`: https://github.com/rethinkdb/rethinkdb-python/blob/master/rethinkdb/ast.py
+
+**The encoding, confirmed with one correction.**
+
+- A term serializes as `[termType, [args...], {optargs}]`, and **the optargs object is omitted entirely when empty** — `ast.py:164-168`, `res = [self.term_type, self._args]; if len(self.optargs) > 0: res.append(self.optargs)`. So a term is a 2- or 3-element array, not always 3.
+- Leaf data is not wrapped; a datum is bare JSON. Documented example: `r.db("blog").table("users")` → `[15, [[14, ["blog"]], "users"]]`, where 15 = TABLE and 14 = DB.
+- Outer frame: `[QueryType, term, globalOptargs]`. `r.expr("foo")` → `[1,"foo",{}]`. `Query.QueryType`: START=1, CONTINUE=2, STOP=3, NOREPLY_WAIT=4, SERVER_INFO=5.
+- Protobuf-era messages: `Query { type=1, query(Term)=2, token=3, OBSOLETE_noreply=4, accepts_r_json=5, global_optargs(repeated AssocPair)=6 }`; `Term { type=1, datum=2, args(repeated Term)=3, optargs(repeated AssocPair)=4 }`; `Datum.DatumType` = R_NULL, R_BOOL, R_NUM, R_STR, R_ARRAY, R_OBJECT, R_JSON.
+- Framing: 8-byte LE token, 4-byte LE length, UTF-8 JSON. Response is token, length, then `{t, r, b, p, n}` = ResponseType, result, backtrace, profile, notes.
+
+**Term types: closed enum, stable ids, never recycled.**
+
+- `Term.TermType` holds **186 named values**; highest id is `BIT_SAR = 196`.
+- Retired ops are left as comments rather than reused: `// OBSOLETE_GROUPED_MAPREDUCE = 46;`, `// OBSOLETE_GROUPBY = 47;` (ql2.proto:452-453). Superseded ops keep their slot: `BETWEEN_DEPRECATED = 36;`. Ids are non-contiguous by design (`HTTP = 153`, `UUID = 169` sit among low-numbered ops), which is only workable because the enum is a fixed registry.
+
+**Protocol versions.** `VersionDummy.Version`: V0_1 `0x3f61ba36`, V0_2 `0x723081e1`, V0_3 `0x5f75e83e`, V0_4 `0x400c2d20`, V1_0 `0x34c2bdc3`. `VersionDummy.Protocol`: PROTOBUF `0x271ffc41`, JSON `0x7e6970c7`. Originally protobuf-framed (ql2.proto:5-31: send version magic as LE32, auth-key length and key, then a length-prefixed serialized `Query` blob). The protocol-type selector arrives at **V0_3**, which is where JSON-over-socket becomes selectable. **V0_4** keeps the same handshake shape and adds parallel query execution. **V1_0** replaces the handshake with SCRAM-SHA-256 (RFC 7677) exchanged as NUL-terminated JSON objects, and protobuf is no longer a choice.
+
+**P2 — was a schema published for the query document? No.** No JSON Schema or other machine-readable schema for the query document was ever published. The driver-authoring spec describes the array encoding in prose plus worked examples and points implementers at `ql2.proto` for the integer constants; third-party drivers (Go `rethinkdb-go/ql2/ql2.pb.go`, Deno, Clojure `rethinkdb-protobuf`) each vendor a copy of the `.proto` and code-generate from it. The `.proto` describes the *protobuf* framing; for the JSON protocol the term-array shape is documented prose only.
+
+**What drivers owned vs. the wire.** Drivers were builders, not query engines. Driver: fluent API → term tree; 8-byte token allocation; length framing; handshake/SCRAM; JSON serialization; response demux by token; cursor and `CONTINUE` batching; pseudotype decoding on the way back (times, binary, geometry); variable-id allocation for FUNC. Server: all query semantics, type checking, arity checking, optarg validation, and backtraces. Errors return `RUNTIME_ERROR`/`COMPILE_ERROR` with a `b` backtrace of frames indexing into the term tree the driver sent; the driver renders that backtrace against its own tree (`compose()` in `ast.py`) but does **not** pre-validate. Structurally confirmed: `ast.py` is ~500 near-empty subclasses carrying only `term_type = P_TERM.X`.
+
+**Function / lambda terms — the part that makes the shape unbounded.**
+
+Term ids: `FUNC = 69`, `VAR = 10`, `IMPLICIT_VAR = 13`, `MAKE_ARRAY = 2`, `FUNCALL = 64`, `JAVASCRIPT = 11`.
+
+- FUNC signature comment: `FUNC = 69; // ARRAY, Top -> ARRAY -> Top`. Proto text (ql2.proto:605-644), verbatim: "An anonymous function. Takes an array of numbers representing variables (see [VAR] above), and a [Term] to execute with those in scope."
+- VAR (ql2.proto:295-303), verbatim: "It's the responsibility of the client to translate from their local representation of a variable to a unique _non-negative_ integer for that variable. (We do it this way instead of letting clients provide variable names as strings to discourage variable-capturing client libraries, and because it's more efficient on the wire.)"
+- Encoding shape: `[69, [[2, [varId...]], body]]` — arg 0 is a MAKE_ARRAY of integer variable ids, arg 1 is the body term. A reference to parameter *n* is `[10, [varId]]`.
+- How a client closure is captured (`ast.py:1958-1980`): the driver reads the lambda's arity by reflection, mints a fresh globally-monotonic integer per parameter, builds `Var` placeholders, **calls the client lambda once at build time with those placeholders**, and records the term tree that the lambda's operator overloading produces. The lambda body is never inspected, compiled or transmitted; only the residue of ReQL operations survives. Host-language control flow inside the lambda runs on the client at build time and leaves no trace.
+- `r.row` is a bare `[13,[]]`. `func_wrap` (`ast.py:1951-1955`) scans a built term for an IMPLICIT_VAR and retro-wraps it as `Func(lambda x: val)`. That is why `r.row` does not work in subqueries (https://rethinkdb.com/api/python/row/) — with nesting there is no way to say which implicit scope is meant. The Java driver dropped `r.row` entirely.
+- **Implication for describing a query's shape in advance:** the term tree is a general expression tree, not a bounded predicate grammar. FUNC introduces lambda abstraction with integer binders, FUNCALL(64) applies them, BRANCH(65) is a conditional, FOR_EACH(68) iterates, and functions are first-class (HTTP's `page` optarg takes `FUNC | STRING`). Terms recurse with no depth or arity bound, and the "type system" is the doc comments (`Sequence, Function(1) -> OBJECT`), not anything enforceable. A query can be validated in advance only as far as "well-formed nested array whose head integer is a member of a 186-entry enum"; arity and type conformance are decided by the server at compile time. **The enum is closed and bounded; what can be built out of it is not.**
+- **Arbitrary client code: no.** The wire carries no client bytecode, source or serialized closure. The single escape hatch is `JAVASCRIPT = 11` — a JS string written by the developer, evaluated server-side in RethinkDB's embedded V8, default timeout 5s (https://rethinkdb.com/api/python/js/). Its second signature returns `Function(*)`, so a JS string can stand where a FUNC is expected: the one place the term grammar hands off to an opaque body.
+
+**P1/P3/P4/P5.** P1: the query is pure data by construction — the drivers exist precisely because the query is the wire format, which is the property being looked for. P3: nothing to depend on; there is no reusable Rust library of the *encoding* separate from a client. P4: yes, unambiguously a front end for a database engine — the server owns every semantic. P5: Apache 2.0 (`LICENSE` at `rethinkdb@next`; GitHub reports `spdx_id: NOASSERTION` due to third-party notices). RethinkDB Inc. shut down 2016; CNCF bought the copyright and assets for $25,000, relicensed from AGPL to Apache 2.0 and contributed it to the Linux Foundation, announced 2017-02-06 (https://www.cncf.io/blog/2017/02/06/cncf-purchases-rethinkdb-source-code-contributes-linux-foundation-apache-license/); community-maintained under the `rethinkdb` org since, not a CNCF hosted project. Last server release **v2.4.4, 2023-12-11** (prior v2.4.3 2023-02-05, v2.4.2 2022-05-07). Repo not archived, 26,998 stars, 1,352 open issues, last default-branch commit `a2cf1308` 2026-03-28. Release cadence roughly one per one-to-two years.
+
+**Rust drivers.** `reql` — crates.io max 0.11.2, published 2023-07-24, 96,744 all-time downloads, 886 in 90 days, MIT/Apache-2.0, repo `rethinkdb/rethinkdb-rs`, last push 2023-07-24, 213 stars, dormant ~3 years. `unreql` — a `reql` fork, max 0.2.1 published 2026-02-10, 13,437 all-time, 1,589 in 90 days, MIT, `https://github.com/vettich/un-rethinkdb-rs`; currently the only Rust driver with recent releases and its 90-day downloads now exceed `reql`'s. Also `rethinkdb-rs/thinker` (superseded, "Use the `reql` crate instead") and `mobc-reql` 0.6.4 (pool wrapper).
+
+**Coverage of C1..C5.** C1 yes and then some — per-field predicates are just terms, but unbounded. C2 yes (`pluck`, `without`, `MAKE_OBJ`). C3 yes — ordering as terms, and cursors as protocol-level `CONTINUE` on a token rather than as a value in the query. C4 yes as general traversal (`eq_join`, `get_all` with an index), nothing citation-specific. C5 yes (`count`, `contains`).
+
+## III-2. Qdrant's filter model
+
+Recorded in detail because Cut 11 depends on Qdrant, and because VoidBot already builds these documents (I-8).
+
+**REST JSON shape.** Top level `Filter`: `must`, `should`, `must_not` (each a `Condition` or an array of them), plus `min_should: {conditions: [...], min_count: uint>=1}`. Recursive — a `Condition` may itself be a `Filter`. `Condition` variants: `FieldCondition`, `IsEmptyCondition`, `IsNullCondition`, `HasIdCondition`, `HasVectorCondition`, `SliceCondition`, `NestedCondition`, `Filter`. `FieldCondition = {key, match?, range?, geo_bounding_box?, geo_radius?, geo_polygon?, values_count?, datetime_range?}`. `Match` variants: `{value}`, `{any:[...]}`, `{except:[...]}`, `{text}`, `{text_any}`, `{phrase}`, `{prefix}`. `Range = {lt,gt,gte,lte}` (floats; RFC-3339 strings for datetime). Nested keys use dot paths with array projection: `"country.cities[].population"`.
+
+```json
+{
+  "must": [
+    { "key": "city", "match": { "value": "London" } },
+    { "key": "price", "range": { "gte": 100.0, "lte": 450.0 } },
+    { "nested": { "key": "diet", "filter": {
+        "must": [ { "key": "food", "match": { "value": "meat" } },
+                  { "key": "likes", "match": { "value": true } } ] } } }
+  ],
+  "must_not": [ { "key": "color", "match": { "any": ["red","black"] } } ],
+  "should":   [ { "key": "location", "geo_radius": {
+                    "center": { "lon": 13.403683, "lat": 52.520711 }, "radius": 1000.0 } } ],
+  "min_should": { "conditions": [ { "is_empty": { "key": "reports" } } ], "min_count": 1 }
+}
+```
+
+**gRPC/protobuf shape**, `qdrant/qdrant` `lib/api/src/grpc/proto/qdrant_common.proto`, Apache-2.0: `Filter { repeated Condition should=1, must=2, must_not=3; optional MinShould min_should=4 }`; `Condition` is a `oneof` of 8 arms; `FieldCondition { string key=1; Match match=2; Range range=3; ... optional bool is_empty=9, is_null=10 }`; `Match` is a `oneof` of 11 scalar-typed arms (`keyword`, `integer`, `boolean`, `text`, `keywords`, `integers`, `except_integers`, `except_keywords`, `phrase`, `text_any`, `prefix`).
+
+**The two shapes are not isomorphic.** gRPC flattens `Match` into scalar-typed oneof arms; REST uses one polymorphic `value`. A single internal shape cannot be both without choosing.
+
+**P2 — yes, a schema is published.** `https://github.com/qdrant/qdrant/blob/master/docs/redoc/master/openapi.json`, OpenAPI 3.0.1, 404 component schemas, every filter type present and verified (`Filter`, `Condition`, `FieldCondition`, `Match`, `Range`, `DatetimeRange`, `GeoBoundingBox`, `GeoRadius`, `GeoPolygon`, `ValuesCount`, `IsEmptyCondition`, `IsNullCondition`, `HasIdCondition`, `HasVectorCondition`, `NestedCondition`, `MinShould`, `SliceCondition`). It is **generated from `schemars` derives** on `lib/segment/src/types.rs`, where `Filter` carries `Deserialize, Serialize, JsonSchema, Validate`. Same generator we use.
+
+**Structural hazard, verified.** `Condition` and `Match` are `#[serde(untagged)]` / OpenAPI `anyOf` **with no discriminator** — variants are told apart by structure alone; `Filter`'s `must`/`should`/`must_not` additionally use a one-or-array codec. Untagged serde enums force `deserialize_any`, and `rmp-serde` has an open reported failure there: msgpack-rust issue #148, untagged enums containing enums fail under rmp-serde while working under serde_json. This is a fact about copying that shape onto a MessagePack wire.
+
+**`qdrant-client` (P1/P3/P4/P5).** P1: **protobuf, not serde.** `Filter` implements `prost::Message`, `Clone`, `PartialEq`, `Debug`, `Default` — **no `Serialize`/`Deserialize`**. The crate's `serde` feature is misleading: `src/serde_impl.rs` and `src/serde_deser.rs` cover payload `Value`/`Struct`/`ListValue` only, never `Filter`/`Condition`. P3: **209 transitive crates with default features, 129 with `default-features = false`** — against our current 139 for the whole workspace. Non-optional `tokio 1.52.3` and `tonic 0.14.6`; plus `reqwest 0.13.4` (via the default `download_snapshots` feature), hyper, h2, axum, tower/tower-http, rustls + ring + webpki, mio, socket2, prost. P4: yes, assumes a running Qdrant server over gRPC; not an in-memory evaluator. P5: Apache-2.0, v1.19.0 released 2026-08-04 (server v1.19.1, 2026-09-04), repo `qdrant/rust-client`, 29 contributors, commits through 2026-09-01 — org-maintained, tracks server releases, not single-maintainer.
+
+**There is no types-only Qdrant crate.** `qdrant` on crates.io is a **0.0.0 placeholder** (last touched 2024-04-18). The server's `segment` crate v0.6.0 holds the real serde+schemars types but is **workspace-internal and unpublished** (`segment` on crates.io is an unrelated Meilisearch analytics fork). `qdrant_rest_client` 0.2.1 is a third-party WASM SDK from second-state.
+
+**Coverage.** C1 yes over payload fields, with real boolean algebra and ranges. C2 no (projection is a separate `with_payload` parameter, not part of the filter). C3 no in-filter ordering; paging is `offset`/`limit` or `scroll` with a point-id continuation, not part of the filter document. C4 no. C5 yes (`count` endpoint takes a filter and returns a count without bodies).
+
+## III-3. Baseline for reading dependency counts
+
+`serde` + `schemars` + `rmp-serde` alone resolve to **22 transitive crates** (verified with `cargo generate-lockfile`, cargo 1.95.0, counting `[[package]]`). Current versions: serde 1.0.229 (MIT/Apache-2.0), schemars 1.2.2 (MIT, 2026-07-27), rmp-serde 1.3.1 (MIT, 2025-12-23). Read against the workspace's 139.
+
+## III-4. Expression evaluators and scripting languages
+
+**A cross-cutting fact first: none of these derive schemars anywhere in their repositories** (GitHub code search, `total_count` 0 for each). And none resolve tokio, reqwest, hyper, sqlx or lalrpop.
+
+| crate | version / date | P1 | P3 transitive | P5 |
+|---|---|---|---|---|
+| `evalexpr` | 13.1.0, 2025-11-26 | **String-parsed.** `Node` AST is public, but `feature_serde` implements **`Deserialize` only, from a string** (`deserialize_str` → `build_operator_tree`). **No `Serialize` on `Node`** — one-way. | 0 default; 24 with serde+regex+rand | **AGPL-3.0-only.** 413★, 20 contributors, last commit 2025-11-26, effectively single-maintainer (ISibboI) |
+| `rhai` | 1.26.1, 2026-09-10 | **String-parsed.** `AST` has private fields, internals behind an `internals` feature. No serde on the AST. Its `serde` feature serializes `Dynamic` *values*; `metadata` emits function signatures. Neither is an AST. | 45 (48 w/ serde). futures-core/task/util, slab, pin-project-lite (async plumbing, no runtime); wasm-bindgen, js-sys | MIT/Apache-2.0. 5,682★, commit 2026-09-16, led by Stephen Chung |
+| `fasteval` | 0.2.4, **2020-01-25** | **String-parsed.** Slab-arena AST, **no serde dependency at all.** Algebraic expressions, not a general predicate language | 0 | MIT. **Dormant** — last commit 2020-09-21, 2 contributors. Forks `fasteval2` (2023-01) and `fasteval3` (2023-11) also stale |
+| `cel` (was `cel-interpreter`/`cel-parser`) | cel 0.14.5, 2026-09-07 | **String-parsed.** AST (`Ast`, `Expr`, `CallExpr`, `ComprehensionExpr`) is public but derives only `Clone, Debug, Default, PartialEq` — **no serde, not even behind a cfg_attr.** Upstream Google CEL defines protobuf `ParsedExpr`/`CheckedExpr`; **cel-rust does not implement it** | 67 — the largest here. **LOUD: `antlr4rust` 0.5.2 (ANTLR runtime) AND `nom` 7.1.3 — two parsing frameworks.** Plus futures/parking_lot, chrono, regex, `cc` + find-msvc-tools (a C compiler in the build graph), 6 windows-* crates | MIT. 677★, pushed 2026-09-16, multi-maintainer |
+| `jsonlogic-rs` | 0.5.0, 2024-12-13 | **Structured data on the wire** (JsonLogic rules are JSON trees) — **but the Rust type is `serde_json::Value`.** No typed enum with derived Serialize/Deserialize; shape checked at runtime | 34. phf + generator/macros, rand stack, deprecated proc-macro-hack, clap 2.33.1 | MIT. Last commit 2024-12-13, 56★, single-maintainer |
+| `jsonlogic` | 0.5.1, **2020-03-05** | Same: `Value` in, `Value` out | 12 | MIT. **Abandoned**, 5★, **1 contributor** |
+| `datalogic-rs` | 5.5.0, 2026-09-12 | **Structured JSON rule, not a string.** Compiles to an arena AST behind `Logic`; **`Logic` is not Serialize/Deserialize** — the serializable artifact is the input JSON | **15 — the cleanest non-trivial tree in the survey.** bumpalo, datavalue-rs, fast-float2, itoa, ryu, self_cell, smallvec, serde. No parser generator, no async, no network, no DB | Apache-2.0. 89★, 6 contributors, 0 open issues, commit 2026-09-12, effectively single-maintainer (GoPlasmatic). Ships Node, WASM, Python, Go, Java, **.NET**, PHP and C bindings plus a 1,804-case conformance suite |
+| `jmespath` | 0.5.0, 2026-01-19 | **String-parsed.** `ast::Ast` public, 18 variants, public fields, derives `Clone, Debug, Display, PartialEq` — **no serde.** Serialize in the repo is on `Variable`, the data type. **`Ast` is not `Send`/`Sync`** (holds `Rcvar`) | 22. serde, serde_json, zmij, itoa, memchr, once_cell, wasm-bindgen; build-dep `slug` → `deunicode` | MIT. 161★, 16 contributors, org-maintained, bursty |
+| `jsonpath-rust` | 1.0.11, 2026-09-09 | **String-parsed.** `JpQuery`, `Segment`, `Selector`, `Filter`, `FilterAtom` derive `Debug, Clone, PartialEq` only — **no serde, no schemars** | 24. **LOUD: `pest` 2.7 + pest_derive/generator/meta + ucd-trie — a full parser generator.** Plus the regex stack | MIT. 159★, 23 contributors, commit 2026-09-09, ~90M downloads |
+
+**P4 for the whole family:** none assumes a backing store. But each is bound to a document model — jsonlogic/jsonpath-rust/jmespath to `serde_json::Value`, datalogic-rs to `DataValue`/bumpalo, evalexpr/rhai/fasteval to their own context types. None reads typed Rust structs directly.
+
+**Why the family as a whole does not meet P1, stated plainly:** six of eight are string-parsed languages whose wire form is source text. Four expose a public AST; **none of the four derive serde on it.** `evalexpr` is the only one with any AST serde impl and it is Deserialize-from-string with no Serialize. Two put structured data on the wire (the JsonLogic family), but as untyped `serde_json::Value` rather than a typed tagged union. **Zero generate a JSON Schema.**
+
+## III-5. Filter and predicate crates
+
+**`predicates` 3.1.4** — MIT/Apache-2.0, updated 2026-02-11, ~225M downloads, assert-rs org (Nick Stevens, Ed Page), 21 contributors. P3: 13 transitive, regex optional, nothing flagged. P4: pure in-memory `fn(&T) -> bool`.
+**Why it does not fit:** P1 fails absolutely. `Predicate<T>` is a trait; combinators produce nested Rust generic types (`AndPredicate<…>`, `FnPredicate<F,T>`) or `BoxPredicate<T>`, and `FnPredicate` wraps a Rust closure. **There is no data-shaped AST and nothing crosses a wire.** A TS or C# caller cannot construct one. Nothing to derive a schema from either.
+
+**`filtrex` — does not exist as a Rust crate.** `crates.io/api/v1/crates/filtrex` returns **404**. Filtrex is JavaScript (joewalnes/filtrex, fork cshaa/filtrex) plus an Elixir port (rcdilorenzo/filtrex). Recorded because it is named in the brief's family list and is otherwise easy to assume into existence.
+
+**nom-based filter languages** — the published examples are small and each carries a flag. `dsq-parser` 0.2.0 (MIT/Apache-2.0, 2026-02-18, **571 downloads**, docs.rs build **failed**): parses a DSQ string into an `Expr` AST, serde non-optional so the AST is serde-shaped, but the authoring surface is a string; **flag: `nom ^8.0`**. `tellaro-query-language` 2.0.0 (2026-09-05, 3,554 downloads): **flag: a 213-line Pest grammar plus an optional `opensearch` feature that is a network client**; crates.io reports its licence as **"non-standard"**. `filter-expr` 0.2.0 (MIT, 2026-08-13, 1,324 downloads), hand-rolled parser; **flag: `async-trait` — its evaluation path is async.** Meilisearch's `filter-parser`, the most-cited real nom filter language, is **not published** (`crates.io/api/v1/crates/filter-parser` → 404); it is workspace-internal.
+
+**`sea-query` 1.0.2** — MIT/Apache-2.0, 2026-08-12, ~1.8M downloads/month, SeaQL org, multi-maintainer. P3: 16 transitive, 15 direct and nearly all optional value-type integrations; **no tokio or DB driver in the core** (those live in `sea-query-binder` and the `sea-query-*-driver` crates); `#![forbid(unsafe_code)]`.
+**Why it does not fit — two independent disqualifiers.** P1: in 1.0 `SimpleExpr` is a type alias for the `Expr` enum, and the docs.rs trait-impl list for `sea_query::expr::Expr` shows `Clone`, `Debug`, many `From<T>`, `PartialEq`, `PgExpr`, `SqliteExpr` and auto traits — **no `Serialize`, no `Deserialize`**; same for `Condition`. Its `serde` feature (one of 44) covers **value** types only (bigdecimal, chrono, uuid, rust_decimal, time, ipnetwork, pgvector). P4: output is a SQL string plus bound parameters for MySQL/Postgres/SQLite; it cannot evaluate over an in-memory collection. P2: no schemars.
+
+**`diesel` 2.3.13** — MIT/Apache-2.0, 2026-09-04, ~36M downloads, lead maintainer Georg Semmler (effectively one primary maintainer, very actively maintained).
+**Why it does not fit — categorically.** The DSL is compile-time typed: each fragment is a distinct generic Rust type (`Eq<column, Bound<…>>`) implementing `QueryFragment<Backend>`. **The query exists only as a monomorphized Rust type, so there is nothing to serialize**, and a TS/C# caller can never produce one. Diesel's serde involvement is row values. P3 flag: backend features pull libpq / libmysqlclient / libsqlite3, and async needs `diesel-async` → tokio. P4: hard-assumes a database engine.
+
+**`sqlx` 0.9.0** — MIT/Apache-2.0, 2026-05-21, 147M downloads, LaunchBadge org.
+**Why it does not fit:** it has no query IR at all. "Compile-time checked queries without a DSL" means SQL strings validated against a live database at compile time; there is no query object, serializable or otherwise. P3 is flagged on every axis the brief names: **mandatory async runtime (tokio/async-std/smol), full PostgreSQL/MySQL/SQLite wire-protocol drivers, TLS stacks.** P4: assumes a live database at compile *and* run time.
+
+## III-6. Query builders and analytic IRs with a serializable IR
+
+**`polars-plan` `Expr` (polars 0.55.2)** — MIT.
+- P1: **serializable.** `polars_plan::dsl::Expr` implements `Serialize` + `Deserialize` (confirmed on the docs.rs trait-impl list for 0.51.0 — the **0.55.2 docs.rs build failed**, last successful render is 0.51.0). Python exposes it as `Expr.meta.serialize()` / `Expr.deserialize()`, `format="binary"` (default) or `"json"`.
+- Exact feature flags: on the umbrella `polars` crate, `serde` (→ polars-buffer/core/utils) and **`serde-lazy`** (→ polars-core/io/lazy/ops/time/utils — *this* is the one that reaches the expression layer). On `polars-plan` itself the feature is plain `serde`, plus `ir_serde` for the resolved IR.
+- **The wire format is explicitly unstable.** Polars documentation states serialization is not stable across versions; a LazyFrame serialized in one version may not deserialize in another. Recurrent serde-feature build breakage: issues #3431, #3875, #18697.
+- P2: **yes, real schemars.** `polars-plan` has a **`dsl-schema`** feature pulling **schemars ^1.2.1** (was ^0.8.22 at 0.51.0), plus serde_json and sha2; it auto-enables `serde` and propagates across the sub-crates. **`dsl-schema` is not exposed on the umbrella `polars` crate's 161-feature list** — it is reachable only via `polars-plan` directly.
+- P3: very large — ~22-57 MB, **~1M SLoC**. **Flag: `polars-plan` 0.55.2 deps include `tokio` and `futures`.** Plus rayon and the arrow/compute stack; `polars-io` brings object-storage/cloud network clients when enabled. No parser generator, no DB driver.
+- P4: **runs over in-memory collections natively**, no database engine required.
+- P5: 0.55.2, 2026-08-06. 120 releases, **55 of them breaking.** ~792K downloads/month, 771 dependents. Ritchie Vink plus 100+ contributors, commercially backed (Polars Inc). **`polars-plan`'s own docs.rs page states it is an internal sub-crate "not intended for external usage"** — no public API stability guarantee.
+
+**`datafusion-proto` 55.1.0 (with `datafusion`'s `LogicalPlan`)** — Apache-2.0, 2026-09-11, 67 versions, quarterly-ish majors with frequent breaking changes, 5.2M downloads, ASF project with many maintainers.
+- P1: **serializable typed data via protobuf, not serde.** `LogicalPlan`/`Expr` are Rust enums without serde derives; `datafusion-proto` converts bidirectionally to generated prost messages. TS/C# callers *can* construct these — the `.proto` is the contract. Caveat: round-tripping UDFs and extension nodes requires registering codecs on the Rust side.
+- P2: the protobuf schema is the machine-readable schema (`datafusion/proto/proto/datafusion.proto` + `datafusion_common.proto`, split into `datafusion-proto-common`/`-models` at 55.x). No schemars. `serde_json` is optional and debug-path only.
+- P3: **heavy.** 22 direct deps: arrow ^59.2.0, **`object_store ^0.13.2` (a network/cloud storage client)**, prost ^0.14.1 and 16 `datafusion-*` crates. **`datafusion-execution` 55.1.0 pulls `tokio` (twice, target-gated), `tokio-util`, `async-trait`, `futures`, `dashmap`, `parquet` and `object_store` unconditionally.** The transitive graph runs to many hundreds: you cannot take `datafusion-proto` without most of a query engine.
+- P4: ships a full execution engine. It does not require an external DB (an in-memory `MemTable` works), but you embed a catalog and a scheduler and tokio.
+- `datafusion-substrait` 55.1.0 (Apache-2.0, 2026-09-11, ~2.4M downloads, ~9,085 SLoC) converts `LogicalPlan` ⇄ Substrait protobuf and **inherits the entire DataFusion tree** — tokio, object_store, arrow, parquet all present.
+
+**`substrait` (substrait-rs) 0.65.0** — Apache-2.0, 2026-08-27, edition 2024, MSRV 1.88.
+- P1: **serializable typed data is the crate's entire purpose** — "Cross-Language Serialization for Relational Algebra". Ships prost-generated `substrait::proto` (`Plan`, `Rel`, `Expression`, `FunctionArgument`, …) plus `substrait::text` for YAML extensions. TS and C# construct these from the published `.proto` with standard codegen; that is designed usage, not a workaround.
+- P2: the protobuf schema **is** the machine-readable schema, published at `substrait-io/substrait` `proto/substrait/*.proto`, packaged at `substrait-io/substrait-packaging`, bindings at `substrait-io/substrait-protobuf`. The simple-extensions YAML additionally has a real **JSON Schema 2020-12** at `text/simple_extensions_schema.yaml`. Spec nuance: Substrait is defined **only** in Protobuf; the JSON you see is Protobuf-JSON output, not an official text format. The crate's `serde` feature "generates serde implementations that match the Protobuf JSON Mapping **via pbjson**" — so serde output is proto-canonical JSON, not an independent serde shape. **No schemars.**
+- P3: direct deps indexmap, prost, serde, serde_json, substrait-extensions, substrait-prost; feature-gated hex, serde_yaml, thiserror; build-deps semver, toml, prost-types. ~6-9.5 MB / **~196K SLoC**, the bulk being generated prost code. **No tokio, no network client, no DB driver, no parser generator.** The only flag is the optional `protoc`/`protox` features, which invoke a protobuf compiler at build time (`protox` is pure Rust, no external binary). Seven features, none default: embed-descriptor, extensions, parse, protoc, protox, semver, serde.
+- P4: **no backing store and no engine.** Pure IR types plus serialization; **it does not evaluate anything** — you supply the evaluator.
+- P5: 162 versions, fast cadence. **17.5M lifetime / ~892K recent downloads.** Owner Jacques Nadeau with co-owners Matthijs Brobbel, Victor Barua, YongChul Kwon, Weston Pace, 13+ contributors — a cross-vendor spec body, not single-maintainer. The repo itself is modest (92★). Still 0.x: no 1.0 stability promise on the Rust binding, and the spec versions independently.
+
+## III-7. Document-store and protocol filter documents, reusable as a shape
+
+**Only four of the surveyed protocols put a structured document on the wire:** MongoDB filters, Elasticsearch/OpenSearch query DSL, Firestore StructuredQuery, and Kubernetes `LabelSelector` (plus JSON Schema, structured but a different kind of predicate). OData, AIP-160, CESQL, GraphQL documents and the Kubernetes `labelSelector`/`fieldSelector` query parameters are all **strings**.
+
+**Only three publish a machine-readable schema of the query shape itself:** OpenSearch, Elastic, Firestore. Kubernetes publishes one for `LabelSelector` specifically. **MongoDB — the most imitated shape of all — publishes none.**
+
+### MongoDB query documents and BSON
+Structured. Keys are dot-notation field paths; values are literals (implicit `$eq`) or operator documents. `$and`/`$or`/`$nor` take arrays of filter documents; **`$not` wraps an operator document, not a full filter** — a known asymmetry. Operators: `$eq $ne $gt $gte $lt $lte $in $nin $exists $type $regex $mod $all $elemMatch $size $bitsAllSet $expr $jsonSchema $text $where`. Example: `{ "$and": [ {"status":"active"}, {"score":{"$gte":10,"$lt":100}}, {"tags":{"$in":["a","b"]}}, {"meta.region":{"$ne":"eu"}} ] }`.
+
+**P2: no.** A BSON 1.1 wire spec exists (bsonspec.org/spec.html) and driver behaviour specs at github.com/mongodb/specifications, but **no published JSON Schema or IDL for the legal shape of a filter document.** Operator semantics are prose. `$jsonSchema` is a validator operator, not a schema of the filter language.
+
+`bson` v3.1.0, 2025-11-20, MIT — **fully standalone, does not require the driver.** Default features are only `compat-3-0-0` (a no-op shim); **`serde` is optional**, and with it `bson::Document` implements Serialize/Deserialize. **No tokio anywhere.** Optional chrono-0_4, jiff-0_2, time-0_3, uuid-1, serde_json-1, serde_with-3, large_dates; also zero-copy `RawDocument`/`RawDocumentBuf`. MessagePack caveat: BSON has types with no MessagePack analogue (ObjectId, Decimal128, Binary subtypes, Timestamp, MinKey/MaxKey), which round-trip through serde as extended-JSON-ish maps rather than natively.
+
+`mongodb` v3.9.1, 2026-09-10, Apache-2.0 — **loud: `tokio ^1.17` is a non-optional dependency** (io-util, sync, macros, net, process, rt, time, fs), plus tokio-util, futures-*, a crypto stack (hmac, md-5, sha1, sha2, pbkdf2, stringprep), base64, rand; optional rustls/openssl, reqwest, hickory-dns, mongocrypt, aws-sigv4. Notably `bson` itself is *optional* there.
+
+### Elasticsearch / OpenSearch Query DSL
+Structured. `bool` with `must`/`should`/`must_not`/`filter` plus `minimum_should_match` and `boost`; leaves `term`, `terms`, `range` (gt/gte/lt/lte/format/time_zone), `match`, `match_phrase`, `exists`, `prefix`, `wildcard`, `regexp`, `ids`, `nested`, `script`. Polymorphism is "a single-key object selects the variant" — a tagged union expressed as an object with exactly one key, which is precisely why Elastic had to write a custom spec language.
+
+**P2: yes, both vendors.** Elastic: `elastic/elasticsearch-specification` (Apache-2.0); source of truth is TypeScript definitions and the compiler emits `output/schema/schema.json`, **a custom JSON type-model — not JSON Schema and not OpenAPI** — covering ~500 endpoints and ~3000 types including `QueryContainer`, `BoolQuery`, `TermQuery`, `RangeQuery`. OpenSearch: `opensearch-project/opensearch-api-specification` (Apache-2.0, **OpenAPI 3.1.0**), query DSL in `spec/schemas/_common.query_dsl.yaml` (~1400 lines), `QueryContainer` with 60+ variants, plain OpenAPI/JSON-Schema-flavoured.
+
+Rust: the official `elasticsearch` 9.1.0-alpha.1 (2025-08-08, Apache-2.0) is **a full HTTP client, reqwest + tokio**, and its bodies are `serde_json::Value` anyway — no typed DSL. Types-only alternatives exist: `elasticsearch-dsl` 0.4.13 (~2023, MIT/Apache-2.0, explicitly independent of the official client, no HTTP, serde types, **no runtime deps**) and `opensearch-dsl` (a fork). Both stale-ish and community-maintained.
+
+### Firestore StructuredQuery (protobuf)
+Structured, protobuf, `google/firestore/v1/query.proto` in googleapis/googleapis, Apache-2.0. `StructuredQuery { select, from[], where: Filter, order_by[], start_at, end_at, offset, limit, find_nearest }`. `Filter` is a **oneof of exactly three**: `composite_filter`, `field_filter`, `unary_filter`. `CompositeFilter { op: AND|OR, filters: repeated Filter }` — recursion lives here and only here. `FieldFilter { field: FieldReference, op, value: Value }` with ops `LESS_THAN, LESS_THAN_OR_EQUAL, GREATER_THAN, GREATER_THAN_OR_EQUAL, EQUAL, NOT_EQUAL, ARRAY_CONTAINS, IN, ARRAY_CONTAINS_ANY, NOT_IN`. `UnaryFilter { field, op }` with `IS_NAN, IS_NULL, IS_NOT_NAN, IS_NOT_NULL`. `FieldReference { field_path }`, dot-delimited. **There is no NOT combinator** — negation exists only as `NOT_EQUAL`/`NOT_IN`/`IS_NOT_*`.
+
+JSON mapping is standard protobuf JSON (lowerCamelCase, enums as string names):
+`{"where":{"compositeFilter":{"op":"AND","filters":[{"fieldFilter":{"field":{"fieldPath":"status"},"op":"EQUAL","value":{"stringValue":"active"}}},{"fieldFilter":{"field":{"fieldPath":"score"},"op":"GREATER_THAN_OR_EQUAL","value":{"integerValue":"10"}}},{"unaryFilter":{"field":{"fieldPath":"deletedAt"},"op":"IS_NULL"}}]}}}`
+
+Rust: **no first-party Google crate.** Generated bindings (`googleapis-tonic-google-firestore-v1`, `gcloud-sdk`, `firestore`) — **loud: tonic ⇒ hyper + tokio + prost; `gcloud-sdk` adds an HTTP and auth stack.** The runtime-free path is taking the Apache-2.0 `.proto` and running prost yourself, which is build-time codegen and gives protobuf encoding rather than MessagePack.
+
+### Kubernetes label selectors and fieldSelector — two distinct surfaces
+`labelSelector` **as a query parameter on LIST/WATCH is a string**: `environment=production,tier!=frontend`, `environment in (production,qa)`, `partition`, `!partition`. Comma means AND. **No OR at all.** The `LabelSelector` **API object** embedded in Deployment/Service specs is **structured**: `{matchLabels:{k:v}, matchExpressions:[{key, operator: In|NotIn|Exists|DoesNotExist, values:[...]}]}`, all terms AND, **no OR, no nesting, no recursion.** `fieldSelector` is **string only** (`metadata.name=foo,status.phase!=Running`) with no structured equivalent and per-resource, mostly undocumented selectable fields.
+
+**P2: yes for `LabelSelector`** — `io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector` and `.LabelSelectorRequirement` in the Kubernetes OpenAPI (kubernetes/kubernetes `api/openapi-spec`, served live at `/openapi/v3`). `k8s-openapi` v0.28.0, 2026-06-15, Apache-2.0, generated from that spec, serde-derived, **no async runtime, types only** (the runtime hazard lives in `kube`, which pulls tokio/hyper/tower). Requires a `v1_xx` feature flag and is a very large crate if you want two structs.
+
+**Partial fit, stated plainly:** the smallest well-schematized structured predicate in the survey and proof the pattern works — but flat and conjunction-only.
+
+### JSON:API filter
+**Unspecified.** Spec v1.1 reserves the `filter` query-parameter family and states it is agnostic about the strategies servers support. No operators, no grammar, no nesting rules, no document shape. jsonapi.org publishes a JSON Schema for the *response* document, not for filters. No Rust crate.
+**Why it does not fit:** it is a naming convention for a URL query parameter, not a predicate language. The only transferable idea is `filter[field]=value`, a string/URL encoding that cannot carry typed values or nesting.
+
+### OData `$filter`
+**String expression:** `$filter=Price gt 20 and (contains(Name,'milk') or Category/Name eq 'Dairy')`. Operators `eq ne gt ge lt le and or not in has`, arithmetic, functions, lambda `any`/`all`, `/` traversal. **A machine-readable grammar is published — as ABNF, not as a data schema:** OASIS OData 4.01 ABNF Construction Rules (docs.oasis-open.org/odata/odata/v4.01/cs01/abnf/odata-abnf-construction-rules.txt, source at oasis-tcs/odata-abnf). CSDL JSON schematizes the *entity model*, not the filter (OASIS Standard 4.01, 2020-05-11; validating schemas at oasis-tcs/odata-csdl-schemas). So the data model has a JSON schema and the predicate language does not. No mainstream typed-AST Rust crate exists; **any usable path means an ABNF/PEG parser generator and you own the AST and the MessagePack mapping.**
+**Why it does not fit:** string-first by design. Serializing it as typed data means inventing the AST OASIS deliberately never published.
+
+### GraphQL
+**The query is a string** — a GraphQL document parsed server-side. Filters inside it are arguments typed by **input object types** (`input UserFilter { and: [UserFilter!], or: [UserFilter!], age: IntFilter }`), which is a genuinely reusable predicate shape — but values reach the server either as literals in the query string or as JSON `variables`, so only the variables half is structured data. Spec: GraphQL October 2021 (spec.graphql.org/October2021/). **P2: yes for the type system** — SDL plus standardized introspection (`__schema`, `__type`, `__InputValue`), so clients can discover filter input types at runtime. **No standard schema for filter semantics**: there is no canonical `IntFilter`/`and`/`or` vocabulary, and Hasura, Postgraphile, Prisma and Dgraph each invent their own operator names. Rust: async-graphql, juniper, graphql-parser — **flag: a parser, and for servers an async runtime.**
+**Partial fit:** the input-object pattern is directly stealable; the transport is not.
+
+### JSON Schema as a predicate language
+Draft **2020-12** is current (json-schema.org/draft/2020-12); IETF standardization is ongoing (`draft-ietf-jsonschema-json-schema-03`, Aug 2026). The ecosystem is fragmented across draft-07 / 2019-09 / 2020-12. A schema is itself JSON, and it is **self-describing** — meta-schema at json-schema.org/draft/2020-12/schema.
+**Can express:** full boolean algebra including **`not`** — real negation, which both MongoDB and Firestore lack — plus type checks, numeric ranges, string constraints (`pattern`, `minLength`, `format`), `enum`, `const`, array constraints (`contains`, `minContains`, `prefixItems`, `uniqueItems`), object constraints, `if`/`then`/`else`, and `$ref`/`$dynamicRef` recursion.
+**Cannot express:** comparison between two fields of the same document (no `a.x > a.y`); any reference to an external value or parameter — every bound is a literal baked into the document; sorting, projection, aggregation or joins; arithmetic; dot-path addressing in a predicate sense — a deep-field range check requires nested `properties` mirroring the document rather than `"a.b.c": {gte: 5}`. Parameterizing a query means rewriting the schema document.
+Rust: `jsonschema` (MIT, active) — **flag: a regex engine, fancy-regex, URL resolution, and optionally `reqwest` for remote `$ref` fetching.** `schemars` generates schemas from Rust types but is not an evaluator.
+
+### CloudEvents SQL (CESQL)
+**String expression**, SQL-like: `subject LIKE '%mySubject%' AND myext = 'value' AND (type = 'a' OR type = 'b')`, evaluating to boolean/integer/string. **v1.0 approved 2024-06-13**, github.com/cloudevents/spec/blob/main/cesql/spec.md, Apache-2.0 (CNCF), SDKs for Go and Java. **No document schema** — the spec defines an ANTLR-based grammar, not a serializable AST — and it operates over the flat CloudEvents attribute set, so there are no nested paths. **No Rust crate**; `cloudevents-sdk` has no CESQL module. **Flag: porting means a parser generator.**
+
+### Cross-cutting structural facts for this family
+- **Recursion and negation matrix:** MongoDB has `$and`/`$or`/`$nor` plus operator-scoped `$not`; Elasticsearch's `bool` has `must_not` and nests freely; **Firestore has AND/OR recursion but no NOT combinator**; Kubernetes `LabelSelector` has neither recursion nor OR; JSON Schema has full boolean algebra including `not`.
+- **Tagged-union encoding differs sharply.** MongoDB and Elasticsearch use "object with a single magic key" (`{"$gt":5}`, `{"term":{…}}`) — cheap in JavaScript, painful in C# and for MessagePack codegen, and the same untagged-discrimination problem Qdrant has (III-2). Firestore's protobuf `oneof` with named enum operators and Substrait's proto messages are the explicitly-tagged counterexamples in the set, and both map cleanly to TypeScript discriminated unions and C# sealed hierarchies.
+- **Runtime-free Rust type sources that were found:** `bson` 3.1.0 + serde (MIT, no tokio, standalone); `k8s-openapi` 0.28.0 (Apache-2.0, types-only, large); prost-generating from Firestore's `query.proto` yourself (Apache-2.0 proto, build-time codegen); `elasticsearch-dsl` 0.4.13 (MIT/Apache, no HTTP, stale). **Carrying runtimes:** `mongodb` (mandatory tokio), `elasticsearch` (reqwest + tokio), `kube` (tokio/hyper/tower), and every OData/AIP-160/CESQL path (parser generators).
+
+## III-8. Cursor and pagination prior art as data
+
+**Google AIP-158** (https://google.aip.dev/158). Request: `int32 page_size` (optional; the API may choose a default and return fewer) and `string page_token`. Response: repeated results as the **first** field, `string next_page_token` (empty means end), optional `int32 total_size`. Opacity, verbatim: page tokens **must** be opaque (but URL-safe) strings and **must not** be user-parseable. **No encoding is mandated.** The AIP *suggests* an internal protobuf message, serialized and base64-encoded, for non-sensitive tokens — and warns that base64-encoding an otherwise-transparent token is **not** sufficient obfuscation. A server-side handle is not required: tokens may carry state, but scope is strict — they must be limited to indicating where to continue and **must not provide any form of authorization**, which is re-checked every call. Expiry is permitted, ~3 days named as reasonable if the server stores data behind the token. No cryptographic guidance.
+
+**AIP-159** covers the `-` wildcard for cross-collection reads and **contains nothing about page tokens.** Only tangentially relevant: cross-parent requests should avoid `order_by` because ordering is ambiguous.
+
+**Relay GraphQL Cursor Connections** (https://relay.dev/graphql/connections.htm). `Connection { edges: [Edge], pageInfo: PageInfo! }`; `Edge { node, cursor }` where `node` may be Scalar/Enum/Object/Interface/Union or Non-Null thereof and **must not be a list**, and `cursor` is a String or a custom scalar that serializes as a String; `PageInfo { hasPreviousPage: Boolean!, hasNextPage: Boolean!, startCursor: String, endCursor: String }`. Arguments `first`/`after` and `last`/`before`. Verbatim: the cursor field's result "should be considered opaque by the client, but will be passed back to the server." `startCursor`/`endCursor` must correspond to the first and last nodes and **can be null when there are no results**. **The spec mandates no encoding — base64 appears nowhere in it.** Base64 of `type:id` or of an offset is ecosystem convention (graphql-js, graphql-ruby, Relay tooling), not spec text. Neither the HTML nor the markdown source carries a printed version or date; the spec's own example uses the placeholder `after: "opaqueCursor"`.
+
+**Rust crates offering an opaque-cursor type.** The exact names `cursor-pagination`, `page-token`, `seek-pagination` and `opaque-cursor` return **zero crates.io results**.
+
+- **`use-cursor` 0.0.1** (crates.io/crates/use-cursor, repo RustUse/use-api). Types `OpaqueCursor`, `AfterCursor`, `BeforeCursor`, `NextCursor`, `PreviousCursor`, `CursorDirection`. P1: **a string newtype, not typed data** — `OpaqueCursor::new("…")` / `as_str()`, **no serde.** P2: no. P3: **zero dependencies.** P4: store-agnostic, and it does no encoding or decoding at all — a validated string wrapper plus direction slots. P5: MIT/Apache-2.0, a single release 2026-05-25, **132 downloads**, single maintainer, Rust 1.95 / edition 2024, ~170 LoC. One release, no track record.
+- **`api-paginate` 0.1.1** (crates.io/crates/api-paginate). `PaginationParams`, `PaginatedResponse`, `CursorPagination { cursor: Option<String>, limit: u32 }`. P1: **the envelope is serde-typed; the cursor itself is `Option<String>`**, with no encode/decode helpers. P2: no schemars; OpenAPI via an optional `utoipa ^4`. P3: serde plus optional utoipa; dev-only criterion/proptest; **no runtime, network, DB or parser deps.** P4: store-agnostic. P5: MIT/Apache-2.0, 0.1.0 2026-09-01 and 0.1.1 2026-09-12, **27 total downloads**, single maintainer, ~196 LoC. Two weeks old.
+- **`paginator-utils` / `paginator-rs` 0.4.0** (crates.io/crates/paginator-rs). Keyset cursors, "URL-safe Base64 and validated on decode", `next_cursor`/`prev_cursor` derived from boundary rows. P1: string cursors over base64; the surrounding page structs are serde. P2: no schemars (a `paginator-zod` sibling generates Zod/TS schemas, 32 downloads). P3: utils deps are base64 ^0.22, serde, serde_json — clean, **no async runtime in core** — but the family fans out into `paginator-axum`/`-actix`/`-rocket`/`-sqlx`/`-sea-orm`/`-surrealdb`, which pull web servers and DB drivers. P4: core is store-agnostic. P5: MIT, 0.4.0 2026-09-07, 10 releases since 2025-05-07, ~16.8K downloads, **single maintainer**.
+- **`bomboni_request` 0.5.0** — the only AIP-158-shaped page-token implementation found. `PlainPageTokenBuilder` plus base64, AES-GCM-encrypted and RSA-encrypted variants; tokens are typed and serde-serializable. P2: no schemars. P3: **loud.** Non-optional aes-gcm 0.11, rsa 0.9, blake2, base64ct, **prost 0.14**, **pest + pest_derive 2.8 (a parser generator)**, regex, itertools, serde, thiserror, time, and four internal `bomboni_*` crates; optional **tonic 0.14**, mysql_common, postgres-types, wasm-bindgen. This is a filter/query-language framework, not a cursor primitive. P5: crates.io reports the licence as **"Non-standard"**; 0.5.0 2026-07-20, 65 versions since 2023-11, 106K downloads, single maintainer.
+- Inspected and **not** opaque-cursor primitives: `page-turner` 1.0.0 (an abstraction over *calling* paginated APIs as a stream; futures 0.3, tokio dev-only; defines no cursor type); `mongodb-cursor-pagination` 0.3.2 (**pulls the MongoDB driver**, stale since 2023); `paginate` 1.1.11 (offset math, 2022); `page-hunter` 0.7.0 (offset model); `rdb-pagination`, `pg_filters`, `diesel_filter`, `diesel_pagination`, `sqlx-data-params`, `clickhouse-filters` (all SQL/ORM-bound); `api-bones` 6.12.0 (a whole REST-envelope framework).
+
+**Stated plainly: no general-purpose, standalone, typed opaque-cursor crate exists in Rust.** The four obvious names are unpublished; the only crate whose stated purpose is modelling an opaque cursor (`use-cursor`) is a zero-dep **string newtype** at 0.0.1 with no serde that explicitly declines to assume a serialization; `api-paginate` types only the envelope; and everything with real download numbers is framework- or database-bound or is offset arithmetic. **Nothing found offers schemars or JSON Schema for a cursor type** — the closest schema stories are `utoipa` (api-paginate) and `paginator-zod`.
+
+**Framework-bound cursors worth recording.**
+- **async-graphql 7.2.1** (2026-09-12, MIT/Apache-2.0): `trait CursorType { type Error: Display; fn decode_cursor(s:&str)->Result<Self,Self::Error>; fn encode_cursor(&self)->String; }` (not object-safe), implemented for primitive ints/floats, bool, char, String, Uuid, `DateTime<Utc>`, Timestamp and ID — plus **`OpaqueCursor<T>` where `T: Serialize + DeserializeOwned`**, "encode/decode the value to base64". **This is the one place in the entire survey where a cursor is a typed serde value with a defined wire encoding, and it is framework-bound.**
+- **sea-orm** has two mechanisms: `Paginator` (`.paginate(db, page_size)`) is offset/limit page numbers with no token; `Cursor` (`.cursor_by(col)`, PR SeaQL/sea-orm#822) is true keyset with `.after()/.before()/.first()/.last()`, where **the cursor value is the raw typed column value** — no serialization, no base64, nothing wire-shaped.
+- **diesel** has **no built-in pagination.** The canonical approach is the "Extending Diesel" guide: hand-roll `Paginated<T>` implementing `QueryFragment`, emitting `SELECT *, COUNT(*) OVER () FROM (subquery) LIMIT … OFFSET …`. Offset-based, Postgres-specific for the window count, no cursor type. Third-party helpers (`diesel_pagination` 2.0.0, `diesel_filter` 2.0.0, `length_aware_paginator`) reproduce the same offset pattern.
+
+## III-9. Two cross-cutting facts that touch the MessagePack constraint
+
+1. **Nothing surveyed targets MessagePack natively.** Serde-based candidates (polars `Expr`) would go through `rmp-serde`. Protobuf-based candidates (substrait, datafusion-proto, Firestore, qdrant-client) have protobuf-binary and protobuf-JSON as their defined encodings; MessagePack means encoding the proto-derived structure yourself, or going proto → pbjson → serde → rmp, which drops the protobuf wire contract.
+2. **Untagged-union discrimination is the recurring hazard.** Qdrant (`Condition`, `Match`), MongoDB (`{"$gt":5}`) and Elasticsearch (`{"term":{…}}`) all discriminate variants by structure or by a single magic key rather than an explicit tag. `#[serde(untagged)]` forces `deserialize_any`, and `rmp-serde` has an open reported failure there — msgpack-rust issue #148, untagged enums whose variants contain enums fail under rmp-serde while succeeding under serde_json. Firestore's protobuf `oneof`, Substrait's proto messages and ReQL's leading integer term id are the explicitly-tagged counterexamples in the set.
+
+**Sources for Part III-2 through III-9:** [qdrant filtering](https://qdrant.tech/documentation/concepts/filtering/) · [qdrant openapi.json](https://github.com/qdrant/qdrant/blob/master/docs/redoc/master/openapi.json) · [qdrant_common.proto](https://raw.githubusercontent.com/qdrant/qdrant/master/lib/api/src/grpc/proto/qdrant_common.proto) · [qdrant-client Filter](https://docs.rs/qdrant-client/latest/qdrant_client/qdrant/struct.Filter.html) · [lib.rs qdrant-client](https://lib.rs/crates/qdrant-client) · [msgpack-rust #148](https://github.com/3Hren/msgpack-rust/issues/148) · [serde enum representations](https://serde.rs/enum-representations.html) · [evalexpr](https://github.com/ISibboI/evalexpr) · [rhai](https://docs.rs/rhai/1.26.1/rhai/) · [fasteval](https://github.com/likebike/fasteval) · [cel](https://docs.rs/cel/0.14.5/cel/) · [datalogic-rs](https://github.com/GoPlasmatic/datalogic-rs) · [jmespath.rs](https://github.com/jmespath/jmespath.rs) · [jsonpath-rust](https://github.com/besok/jsonpath-rust) · [predicates](https://lib.rs/crates/predicates) · [sea-query Expr](https://docs.rs/sea-query/1.0.2/sea_query/expr/enum.Expr.html) · [polars-plan features](https://docs.rs/crate/polars-plan/latest/features) · [substrait-rs](https://docs.rs/substrait/latest/substrait/) · [simple_extensions_schema.yaml](https://github.com/substrait-io/substrait/blob/main/text/simple_extensions_schema.yaml) · [datafusion-proto deps](https://deps.rs/crate/datafusion-proto/55.1.0) · [bson](https://crates.io/crates/bson) · [elasticsearch-specification](https://github.com/elastic/elasticsearch-specification) · [opensearch query_dsl.yaml](https://github.com/opensearch-project/opensearch-api-specification/blob/main/spec/schemas/_common.query_dsl.yaml) · [Firestore query.proto](https://github.com/googleapis/googleapis/blob/master/google/firestore/v1/query.proto) · [AIP-160](https://google.aip.dev/160) · [AIP-158](https://google.aip.dev/158) · [Relay Connections](https://relay.dev/graphql/connections.htm) · [k8s-openapi](https://crates.io/crates/k8s-openapi) · [CESQL](https://github.com/cloudevents/spec/blob/main/cesql/spec.md) · [async-graphql CursorType](https://docs.rs/async-graphql/latest/async_graphql/types/connection/trait.CursorType.html) · [use-cursor](https://crates.io/crates/use-cursor) · [sea_orm::Cursor](https://docs.rs/sea-orm/latest/sea_orm/struct.Cursor.html)
+
+---
+
+# Questions this pass could not answer
+
+1. **Was the query side of RethinkDB deliberately not carried into CultCache, or simply never reached?** The archive names four adoption reasons and none of them is ReQL; ReQL and changefeeds are never mentioned by name in the indexed Discord history. Nothing found says "we chose not to have queries". **To answer:** ask the operator directly. The archive cannot settle intent, only what was said.
+
+2. **Does the 2020-2021 Aetheria-Economy tree contain the C# ReQL driver usage, and what query shapes were actually written against it?** That would show which ReQL constructs were ever exercised here, which is different from what ReQL offered. **To answer:** check out `GameCult/Aetheria-Economy` around commits from 2020-03 to 2021-06 and grep for the C# driver's term builders. Not indexed by voidbot under a name I could confirm.
+
+3. **Which of the thirteen document kinds actually need per-kind predicates, and on which fields?** I recorded what the types expose (`severity`, `confidence`, `origin`, `sequence`, `outcome`, `repo`). I did not find a record of what callers have asked for and been unable to express. **To answer:** search the Eureka campaign's own findings and follow-ups for read-side requests, or ask the operator for the driving query list.
+
+4. **What exactly does Cut 11 intend to own?** `query.rs:65-72` says Cut 11 owns "which fields of each kind are text" and the index. Whether Cut 11 also intends to own structured filter pushdown into Qdrant — which would make the structured-filter shape and Qdrant's filter shape the same question — is not written anywhere I found. The Huginn repo contains no `docs/` or `notes/` directory and no file mentioning "Cut 11" outside `query.rs`'s comments. **To answer:** locate the campaign's target document and cut map (the `PipelineCampaign.target_doc` DocRef would name it) or ask the operator.
+
+5. **Is there a stored mind image to measure against?** Every portability claim about paging and counting assumes a document population size. I found no fixture corpus outside `fixtures.rs`. **To answer:** run the daemon against a real mind store and count documents per kind, or read `crates/huginn-mind/src/fixtures.rs` as the only current sample and treat it as synthetic.
+
+6. **Does `epiphany-pipeline` want to grow a reference enumerator, and is that Epiphany's call or Huginn's?** C4 needs one; the leaf has none and references are split between typed `PipelineRef` and bare `Short`. Changing the leaf is a cross-repo change at a pinned rev (`5cda0886`). **To answer:** an operator ruling on which repo owns the hop table.
+
+7. **Whether `unreql` or any other crate exposes the ReQL term-tree encoding *without* a client.** The survey found drivers, not an encoding library. **To answer:** read `unreql`'s crate structure for a types-only module, or accept that no such split exists.
+
+8. **Does `rmp-serde` actually fail on the specific untagged shape we would write, or only on the nested-enum case in msgpack-rust #148?** The hazard is recorded (III-2, III-9) but not reproduced against our own types. **To answer:** a ten-line test — define a two-variant `#[serde(untagged)]` enum whose variants contain enums, round-trip it through `rmp_serde::to_vec_named`, and see. This is cheap and would settle whether untagged encoding is available to us at all.
+
+9. **What does `qdrant-client` actually resolve to with `default-features = false` *inside our lockfile*?** 209/129 are the survey's numbers taken in isolation; the overlap with our existing 139 is unmeasured, and the marginal cost is what matters. **To answer:** add it to `huginn-daemon` on a scratch branch, `cargo generate-lockfile`, diff the `[[package]]` count, discard.
+
+10. **Can the Qdrant filter shape be obtained as types without the client?** The survey establishes there is no published types-only crate and that `segment` (which has the serde+schemars derives) is workspace-internal. Whether generating Rust types from Qdrant's published OpenAPI, or from `qdrant_common.proto` via prost, produces something usable without tonic was not tested. **To answer:** run a schema-to-Rust generator over `openapi.json` and count what comes out.
+
+11. **Is the polars `Expr` serialization instability a blocker in practice, and does `dsl-schema` actually emit a usable schema?** Both facts are from documentation and feature lists; neither was exercised. The 0.55.2 docs.rs build failure means the current API surface was not directly inspected. **To answer:** build `polars-plan` with `dsl-schema`, emit the schema, and check whether a serialized `Expr` survives a patch-version bump.
+
+12. **Does Substrait's expression subset cover per-kind field predicates over our document types without a relational schema underneath it?** Substrait is relational algebra; our image is not tables. Whether `Expression` is usable detached from `Rel`/`ReadRel` was not established. **To answer:** attempt to construct a bare `Expression` tree with `substrait` 0.65.0 and see what it requires.
+
+13. **How large does a serialized query actually get under each shape, through base64?** The daemon base64s its MessagePack payload (I-1), so encoding verbosity costs 4/3 on top. No candidate was measured. **To answer:** encode the same worked predicate — "open findings of High severity on this campaign" — in each candidate shape and compare byte counts.
diff --git a/docs/history/eureka-read-side-cut.md b/docs/history/eureka-read-side-cut.md
new file mode 100644
index 0000000..c6f6009
--- /dev/null
+++ b/docs/history/eureka-read-side-cut.md
@@ -0,0 +1,1246 @@
+<!-- Provenance: copied verbatim from GameCult/Epiphany ef956865 notes/eureka-read-side-cut.md; text below this line is unchanged. -->
+# Huginn read side: the consumer cut map
+
+Date: 2026-09-22. Imagination output (Opus). Nothing here is committed and no
+repository was edited. Self places and commits this file. Its natural home is a
+section of `F:\Projects\Epiphany\notes\eureka-pipeline-state-cut.md`, the
+campaign that owns the read-side rulings, with a pointer from §12 of
+`F:\Projects\CultLib\docs\cultnet-selection-cut.md`.
+
+Status, 2026-09-29 (Self): **RS-L, RS-2 and RS-1 are landed and closed**
+(2026-09-22; the record is in `eureka-pipeline-state-cut.md`, "RS-L closes",
+"RS-2 and RS-1 are closed"). **P-1 and P-2** were folded into selection's R-G
+and R-M, and selection Cut 1 merged to CultLib `main` at `dbee044`
+(2026-09-23); the RS-3 brief confirms both are in that merge. **Both operator
+questions in §9 are ruled** (2026-09-22: Q-RS1 B, one non-empty `Title`;
+Q-RS2 A, `huginn-mind` links `cultnet-rs`). **Next:** BP-2 once BP-1 lands
+(BP-1 in Hands 2026-09-29), then **RS-3**. The Pins table below is as of
+2026-09-22 and stale; each brief re-takes its anchors.
+
+**2026-09-29: BP-2 and RS-3 landed and closed.** BP-2 is at Huginn `e770fb9` and leaf `4891f2e5`,
+with pins at CultLib `6251cbc`. RS-3 is at `511afa2`, `eb57bdb` and `9673ab8`: huginn-mind 91 tests,
+daemon 19, and nothing reimplemented. Soul closed it; in-force, the snapshot restriction and the
+single owner of repo identity all held under probe. Recorded:
+- one orphan record takes every read offline, failing closed on a corruption the single writer
+  cannot produce;
+- a cursor that dies with a restart is refused with the substrate's message about a "selection
+  digest". That is CultLib's wording to fix;
+- the selection `in_force=true` + `cited answers exists=false` misses a question reopened by a
+  withdrawal, because the withdrawn answer still cites it. Cut 15's recipes must say so;
+- header pages are bounded per header, not per page, and `ResponseTooLarge` stays reachable.
+**Next: BP-3**, in Hands.
+
+*As written 2026-09-22:* cut map for five cuts and two CultLib prerequisites.
+**P-1** and **P-2** go to the selection campaign's next fix batch, before
+`cultnet/selection-cut1` merges. **RS-L** is the leaf (Epiphany). **RS-1**,
+**RS-2** and **RS-3** are Huginn. **BP-2** belongs to the body-plane map and
+is widened here by one mechanical clause.
+
+**Rulings this map is written under.**
+
+- **Operator, 2026-09-17** (Epiphany map, "Operator rulings on the read side"):
+  - the generic vocabulary lives in CultNet, and the organ consumes it;
+  - receipt ordinals: yes. The stored type changes, the store takes a new
+    version, and an existing store refuses to open rather than being misread;
+  - `open_items` and `history` are deleted, not kept as presets;
+  - `question` and `ruling` gain a `Short` title in the leaf, and it rides the
+    same store version as the ordinal.
+- **R-3 (selection map §16):** `admitted_after` and `admitted_before` are deleted
+  from the organ's wire. The latest N is `descending, limit: N`.
+- **Q13 A (Epiphany map, 2026-09-16):** the wire types live in `huginn-mind`,
+  and the client depends on that crate for types only.
+- **What stays with the organ:** the row and reference implementations, the
+  roles, in force, the summary, the snapshot restriction and the deletions.
+- **S6 (Cut 10 residue, recorded 2026-09-22) is owned here:**
+  - declared names used only as read filters are never checked against the
+    grammar;
+  - `OrgRepo` claims a format it does not enforce.
+
+## Pins
+
+| Repo | Branch | HEAD | State |
+|---|---|---|---|
+| Huginn | `eureka/memory-organ` | `4f7e3b5` | **Dirty: the Cut 10 residue batch is in Hands.** It modifies seven files: `huginn-mind/Cargo.toml` (+8, a `test-support` feature), `mind.rs` (+74), `admission.rs` (±6), `daemon.rs`, `serve.rs`, `huginn-daemon/Cargo.toml` and the cut10 entries file. Anchors below are against `4f7e3b5`. **Hands re-takes them after the residue lands:** `mind.rs` lines shift, and `admission.rs` lines may shift. This map was not written against the uncommitted diff. |
+| Epiphany | `codex/eureka-pipeline-state` | `b3ae787b` | Clean. The leaf changed after `9d3a3efd` only in tests (+32 lines at `lib.rs:2484`), so leaf anchors hold at both. Huginn pins the leaf at `9d3a3efd`. |
+| CultLib | `main` | `070fac0` | The selection branch is not merged. `origin/main` is 14 commits past the merge base `b3d9cf7`. |
+| CultLib | `cultnet/selection-cut1` | `00f4c02` | Selection Cut 1 finished executing. Its final Soul pass is running. Rust anchors are against `git show 00f4c02:packages/cultnet-rs/src/selection.rs`. |
+
+**Pins in use:**
+
+- Huginn: `cultcache-rs` and `cultnet-rs` at `a0813c6`, and the leaf at `9d3a3efd`.
+- The leaf: `cultcache-rs` at `a0813c6`.
+
+`git diff --stat a0813c6 00f4c02 -- packages/cultcache-rs` is **empty**. In the
+same range, `cultnet-rs` gains selection (+3,111/−21 over 6 files).
+
+## 0b. Model page: identity, lifecycle and authority
+
+Every persistent or long-lived kind this cut touches has a row. No cell is empty.
+
+| Kind | Identity (what names it) | Lifecycle | Authority (who decides) |
+|---|---|---|---|
+| **Commit receipt** (`huginn.mind_commit_receipt.v2`) | `receipt_id` = `mind-commit-` + sha256 of `(instance, strong_reads, writes)`. **`ordinal` is not part of the identity.** It is excluded from the digest, as `committed_at` and `provenance` are (`receipt.rs:10-14`), so an exact replay still finds its stored receipt (A9). | Written once in its batch's own swap. It never changes and is never deleted. A replay answers `AlreadyAdmitted` with the stored receipt. | `receipt.rs`. `candidate` (`:160-178`) is the one construction site. `commit` (`:211-245`) is the one swap. |
+| **Admission ordinal** (a field on the receipt) | A `u64` position in this mind's admission history. It starts at 1 and is dense: the receipts carry exactly `{1..=N}`. **Head** means `N`, the number of receipts. | Assigned when a batch is admitted, as `head + 1`, under the single writer: `&mut Mind` plus redb's lifetime lock. It is never reused. A lost swap lands nothing, so it leaves no gap. | `receipt.rs` owns both `head()` and assignment. Admission asks it for `head + 1`. The read side asks it for `head` as the current `asOf`. Both refuse a chain that is not dense, with `Unavailable`. No other code computes an ordinal. |
+| **Store version** | The epoch record `huginn.mind_epoch.v1`, keyed by and naming the leaf's `PIPELINE_SCHEMA_EPOCH` (`mind.rs:25-42`), together with every stored type id. Each id carries its own version. | The epoch moves when the leaf breaks its schema. A type id moves when its owner breaks that type. An old store is refused by the opener and never migrated. That is the operator's ruling, and it costs nothing today (F5). | The leaf owns the epoch string and its thirteen type ids. Huginn owns the receipt's type id and the gates. **The epoch gate runs first** (RS-1), so a store written at an old epoch is refused as `ForeignEpoch`. A foreign type in a store at the current epoch stays `ForeignStore`. |
+| **Question and ruling title** | The field `title` on `PipelineQuestion` and `PipelineRuling`. Its type depends on Q-RS1. | Written by the author, immutable like every leaf field, and required. | The leaf owns the field and its bound. Admission validates it through `PipelineDocument::validate`, as it does every other field. |
+| **Selection cursor** | An opaque string minted by `cultnet_rs::Cursor::mint`. It carries `asOf`, the last `(ordinal, schemaId, recordKey)`, and a digest of the selection with `cursor` and `limit` cleared. | One per page that has a next page. It lives as long as the client keeps it. **It never goes stale on Huginn:** the mind is append-only with one writer, so the organ can always present rows as of any `asOf ≤ head`. | The substrate mints it, parses it and checks its digest. The organ decides which `asOf` to answer at: the cursor's own, and never `head`, because the substrate refuses `cursor_stale` whenever the two differ (F7). An `asOf > head` is refused `CursorInvalid`: this mind could not have minted it. |
+| **Snapshot image** (the rows as of `asOf`) | `asOf`. | Built per read call and thrown away with it. Nothing is stored. | `query.rs` `Reader::at(mind, as_of)` builds it. It holds the documents whose writing receipt has `ordinal ≤ asOf`, and **every derivation runs over that restricted image**: in force, the closing resolution, citations and base. |
+| **Declared vocabulary**: aliases, roles and their value domains | Alias and role names, which are the organ's closed lists (RS-3 §"Vocabulary"). | Changes only with code. There is no catalog. A new alias or role is a normal change. | `huginn-mind` `rows.rs`, through `RowSet`. The substrate door checks the **names**. The organ's door checks the **values**, which is S6. |
+| **Citation edge** | `(from: PipelineRef, role: CitationRole, to: PipelineRef)`. | Derived from the leaf fields each time it is read. Never stored. | `docs.rs` `citations()` is the one edge list. Admission's A7 (`admission.rs:242-285` today) and the read side's `Row::references` both read it. |
+| **Header (summary)** | `PipelineDocumentSummary`, keyed by the row's `id`. | Derived each time it is read, and bounded by `SUMMARY_MAX_BYTES`. | `query.rs`. It is the organ's meaning of `projection: header` (selection §2 "Projection"). |
+| **Published schemas** | The leaf's thirteen `epiphany.pipeline.<kind>.v2.schema.json` files plus `index.json`. Huginn's `huginn.mind_request.v1` and `huginn.mind_response.v1`. | They are regenerated whenever the derivation changes, and pinned byte for byte by a test (leaf `lib.rs:2324`; Huginn `wire.rs:210-216`). The request schema `$ref`s CultLib's published selection schema by its `$id` (F9). | The leaf owns its thirteen. Huginn owns its two. CultLib owns `cultnet.selection.schema.json`, and nothing copies it. |
+| **Mutation suites** | Files: `tools/eureka-cut9-mutations.psd1` (V entries), `tools/eureka-cut10-mutations.psd1` (D/S entries), and the new `tools/eureka-readside-mutations.psd1` (Huginn) and `tools/eureka-readside-leaf-mutations.psd1` (Epiphany). | The entries whose rule died with a deletion are **deleted** (RS-2). The entries whose rule survives under a new spelling are **re-authored** in the readside suite (RS-3). Every file keeps its M0 control. | Hands writes them. The harness is `~/.claude/skills/eureka/tools/eureka-mutations.ps1`. |
+
+Forks this page surfaced: **Q-RS1** (what a title is) and **Q-RS2** (whether
+`huginn-mind` may link `cultnet-rs`). Both are in §9.
+
+## 1. Body facts
+
+Each fact comes from a source read at a named HEAD, and wherever a mechanism
+claim needed it, from a run. The probes are in the session scratchpad:
+
+- `readside-probe/` was built against `cultnet-rs@00f4c02` and `huginn-mind` by
+  path. That path was the `4f7e3b5` tree plus the residue batch's uncommitted
+  edits, read only; see "Not probed".
+- `storev2/` holds copies of the leaf and of `huginn-mind`, emulating the
+  version bump.
+- `schemaprobe/`.
+
+The target directory is `C:\Users\Meta\.cargo-target-codex\imag-readside`: 941
+files, 0.37 GiB, cold build 3m07s. Nothing was cleaned.
+
+### F1. The four reads today (`query.rs` at `4f7e3b5`)
+
+**What every read shares.** Every read builds `Reader::new`
+(`query.rs:206-209`). That decodes **the whole image**
+(`docs.rs:42-52`) and **every receipt** (`mind.rs:186-196`, then
+`AdmissionIndex::build`, `query.rs:134-150`), on every call. A document that no
+receipt wrote refuses as `Unavailable`. A document that two receipts wrote
+refuses the same way.
+
+**`view`** (`:323-327`). It asks `validate_ref` first (V24), then finds the
+`(kind, key)` by a linear search, then joins the facts and the status.
+
+**`query`** (`:331-350`):
+- It refuses `semantic` before the reader exists (V8/V8L).
+- It scans every held document.
+- `Reader::matches` (`:249-290`) applies these filters:
+  - `campaign` = the key's root segment (V18/V18L: the root, not a field);
+  - `repo` and `cut`, read through `base()` (`:237-246`), which walks
+    resolutions down to their subject;
+  - `kinds`;
+  - `in_force`;
+  - `faculty`;
+  - `admitted_after` and `admitted_before`, compared as strings.
+- It orders by `(admitted_at, id)` (`:307-311`).
+- It clamps `limit` into `1..=200` (`QUERY_LIMIT_MAX`, `:32`), and reports
+  `matched` before the cap.
+
+**`open_items`** (`:355-391`). It filters all views to the campaign root, then
+builds five lists:
+- in-force questions, findings and follow-ups;
+- in-force cut specs that no `cut_report.cut_spec` names;
+- cut reports that no `verdict.cut_report` names.
+
+It is uncapped.
+
+**`history`** (`:401-435`):
+- `Subject(ref)` asks `validate_ref`, reads `resolutions_of`, and orders by
+  sequence.
+- `Repo(org_repo)` reads `assignments_of(mind, repo)` and orders by sequence.
+  **Nothing checks the `OrgRepo`.** The doc comment at `:399-400` claims "the
+  type already holds [it] to its own format". It does not: `Bounded` is
+  crate-private to the leaf, and a deserialised `OrgRepo` is never validated.
+  This is S6.
+
+**Wire.** `HuginnMindRequest` (`wire.rs:42-50`) and `HuginnMindResponse`
+(`:81-90`) carry one variant each per read. **Daemon.** The arms are at
+`daemon.rs:84-99`. The instance gate at `:66-71` runs for every read.
+
+**Probe, run.** A real redb mind built through the organ's public API
+reproduces the `open_items` scenario of `query.rs:943-1003` and three answer
+cycles for `history`. Every list the organ answered was then re-answered
+through `cultnet_rs::select` over rows built from the organ's own views. **All
+seven relations match, in members and in order:** the five open lists,
+`history(Subject)` and `history(Repo)`.
+
+`specs_without_report` came back `[cut-9.r2, cut-12.r2]`. That is admission
+order, because the probe's clock advances per batch. The Cut 9 test pins
+`[cut-12.r2, cut-9.r2]`, the id order that results when every batch shares one
+`now()`. **Tests that pin id order under a single clock change their
+expectation once the order becomes the ordinal.** Hands expects this; it is
+not a regression.
+
+### F2. Where receipt ordinals come from
+
+There is no ordinal today.
+- `candidate` (`receipt.rs:160-178`) is the one place a receipt is constructed.
+  `commit` (`:211-245`) makes one compare-and-swap. Its expectation is the
+  strong reads, and its insert-only replacements are the writes plus the
+  receipt.
+- **The swap does not guard an ordinal.** Receipts are insert-only under their
+  digest key, so two receipts claiming one ordinal would both insert (the store
+  semantics are at `store.rs:135-159`). Uniqueness therefore rests on the single
+  writer: `admit` takes `&mut self`, and the owned store holds a lifetime lock
+  (ruling 15). F7 of the Cut 10 pass already recorded that the store is not
+  sealed.
+- The map's answer is to derive the ordinal as `head + 1` and to **validate
+  density wherever it is read**. It does not add an insert-only ordinal row,
+  which would be a new persistent kind that guards only against this organ's own
+  code. Sealing the store is the recorded follow-up that closes the gap
+  structurally.
+
+**Probe, run: the order cannot be recovered from the clock.** A real store,
+written by Cut 10's Soul probe (copied from
+`…F--Projects-Aetheria…/cut10-probe-run/state-1789593994318/minds/yggdrasil/mind.redb`),
+decodes to 31 receipts with **5 distinct `committed_at` values**. A store
+therefore cannot be migrated by deriving ordinals from time. That confirms the
+ruling to refuse rather than migrate.
+
+### F3. The payload shapes, decoded from the real store
+
+**The receipt** is a **positional 7-element MessagePack array** (`0x97`). That
+holds even though it is written through `prepare_entry_named`
+(`cultcache-rs@a0813c6 lib.rs:2181-2197`). The positions are the
+`#[cultcache(key = N)]` slots.
+
+A v1 receipt decoded under a v2 shape that adds `ordinal` at key 7 gives:
+- **strict:** `Err("invalid length 7, expected struct … with 8 elements")`,
+  which surfaces as `Unavailable` at read time, deep inside every read;
+- **`#[serde(default)]`:** `Ok(0)`. That is a **silent misread**: every old
+  receipt gets ordinal 0.
+
+**So the receipt's type id must move.** Adding the field alone is either a late
+refusal or a silent lie.
+
+**Leaf documents** are `[value]` (`0x91`), where `value` is a named map
+(`schemas/cultnet/README.md:36-38`). A required `title` is therefore a
+breaking change to the leaf. Without a default, an old payload fails with
+"missing field", which follows from serde and was not probed. With a default,
+the change is additive and keeps the epoch, per the leaf's own rule (`README.md:40-46`).
+
+### F4. What the store version bump touches
+
+**Leaf (`epiphany-pipeline` at `b3ae787b`):**
+- `PIPELINE_SCHEMA_EPOCH` `lib.rs:720` changes `v1 → v2`. Its doc at `:713-719`
+  stays true.
+- **All thirteen** type ids in the `pipeline_kinds!` invocation (`:596-630`)
+  move, because `every_kind_is_at_the_epochs_version` (`:2381-2400`) pins every
+  kind at the epoch's version. Two kinds change shape, and thirteen ids move.
+- Thirteen schema files in `schemas/cultnet/` are renamed `v1 → v2`, and
+  `question` and `ruling` gain `title`.
+- `schemas/cultnet/index.json` (`schemaId`, `schemaVersion`, `documentType`,
+  `path` ×13) is updated.
+- `schemas/cultnet/README.md:41` (the epoch named in prose) is updated.
+
+**Huginn:**
+- `receipt.rs:27` (`RECEIPT_SCHEMA_VERSION`), `:95` (the type id) and `:348`
+  (a test literal) change `v1 → v2`. `HuginnCommitReceipt` gains
+  `#[cultcache(key = 7)] pub ordinal: u64`.
+- The daemon test literals `"epiphany.pipeline.epoch.v1"` at `daemon.rs:380`
+  and `envelope.rs:183` change, and so does the `"epiphany.pipeline.instance.v1/…"`
+  detail at `daemon.rs:645`.
+- Both published wire schemas are regenerated, because they embed
+  `PipelineDocument` (the new titles) and `AdmissionFacts` (the new ordinal).
+- `HuginnMindEpoch` (`huginn.mind_epoch.v1`) is **unchanged**. Its shape does
+  not move, and it is keyed by whatever the epoch string is.
+
+**Untouched, checked:**
+- `epiphany-core/src/runtime_spine.rs:8761` uses
+  `"epiphany.pipeline.campaign.v1"` as a stand-in for a *foreign* type id. Its
+  rule is "an id the spine never registered", which any string satisfies. It
+  does not depend on the leaf; that is stated at `:8754-8757`.
+
+### F5. How an existing store refuses to open (probe, run)
+
+The `storev2/` probe copies the leaf and applies the bump:
+- the epoch becomes v2 and all thirteen type ids become `.v2`;
+- `question` and `ruling` gain `title`.
+
+It also copies `huginn-mind`, with the receipt at v2 carrying `ordinal`, and
+opens a copy of the real v1 store:
+
+```
+gate order today (types, then epoch): Some(ForeignStore { type: "epiphany.pipeline.campaign.v1" })
+gate order epoch first:              Some(ForeignEpoch { found: "epiphany.pipeline.epoch.v1", expected: "epiphany.pipeline.epoch.v2" })
+v2 opener refuses: ForeignStore { type: "epiphany.pipeline.campaign.v1" }
+```
+
+**Today's opener refuses the old store, but by the wrong gate.** A real epoch
+bump always moves the type ids, by the leaf's rule. The type gate
+(`mind.rs:137`, `:220-225`) therefore always fires before the epoch gate
+(`:138`, `:235-257`). **The epoch gate is unreachable for the one case it
+exists for.** Its doc at `mind.rs:21-24` promises "a breaking schema bump
+refuses the old store".
+
+The fix swaps the two calls at `:137-138`. Checked against the opener test
+(`mind.rs:345-413`): **none of its eight cases changes its expected refusal**
+under the swap.
+- The "runtime store passed by mistake" case carries a current epoch record, so
+  it still reaches the type gate.
+- A foreign store with **no** epoch record becomes `MissingIdentity` instead of
+  `ForeignStore`. No test pins that case. It is honest: such a store has no
+  mind identity at all.
+
+### F6. `select`'s snapshot contract, run
+
+On a probe row set:
+- A cursor minted at `asOf 21` answers page 2 at `asOf 21`.
+- The same cursor answered with `asOf 22` gives
+  `CursorStale { as_of: 21, current: 22 }` (`selection.rs:1131-1136`).
+- **So "Huginn never refuses `cursor_stale`" (selection map §2 "Snapshot") is
+  the organ's job:** it must answer as of the cursor's `asOf`, and pass that
+  `asOf`. It learns `asOf` through `Cursor::parse` (public, `:1326-1346`)
+  **before** calling `select`, so that it can restrict the rows. This is a
+  dependency on near-final code (§10).
+
+### F7. The substrate door checks names, never values (S6 lives in the organ), run
+
+`cultnet_rs::validate` (`selection.rs:756-862`) refuses these:
+- empty lists and blank entries;
+- a bad `op`;
+- `values` and `number` present in the wrong combination;
+- an undeclared `index` on the reachable schemas;
+- a comparison on a non-numeric alias;
+- undeclared roles.
+
+**It never looks at a value.** Probe:
+- a `root` value `"eureka state/../x"` validates, and answers `[]`;
+- a `cites.target` of `{schemaId: ruling, recordKey: <a question's key>}`
+  validates, and answers `[]`.
+
+An unknown `schemas` id is not refused either. `reachable_schemas` (`:864-873`)
+filters it away silently. This is the S6 class exactly: a malformed filter reads
+as an empty answer. Selection map D1 already assigns value refusal to "the row
+owner … at the door". **The organ's value door is RS-3's.**
+
+### F8. `Evaluation` carries no `matched` (source read)
+
+`Evaluation { rows, edges, next_cursor }` (`selection.rs:1080-1085`) has no
+count. `select` computes the full matched list (`:1120-1152`) and discards its
+length. The page's `matched` is on the wire (`contracts.rs@00f4c02:365-368`),
+but a Rust consumer cannot fill it without re-running `select`, and even then
+only up to the 200 cap.
+
+This is a gap in the owner: **P-1**. No Rust server answers v1 today
+(`snapshot_query.rs` serves v0), so Huginn is the first caller to feel it.
+
+### F9. Publishing Huginn's request schema with a substrate type in it (probe, run)
+
+`impl JsonSchema for cultnet_rs::Selection` inside a consumer crate fails with
+**`E0117`**, the orphan rule. So §12's "hand-maintained `JsonSchema` impl for
+the `cultnet-rs` types inside Huginn" **cannot be written**. The same applies
+to BP-3's plan for the manifest.
+
+What works, and was run, is
+`#[schemars(schema_with = "selection_ref")]` on Huginn's own field, returning
+`{"$ref": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.selection.schema.json"}`,
+which is the `$id` published at `00f4c02`. This gives one owner for the
+selection's shape and no mirror type in Huginn.
+
+`Edge` has no `$defs` entry in CultLib's response schema; it is inline under
+`properties.edges`. Huginn therefore types its edges in its own vocabulary
+instead (RS-3).
+
+### F10. `Selection` does not derive `Eq` (probe, run)
+
+`#[derive(PartialEq, Eq)]` on a struct carrying `cultnet_rs::Selection` fails
+with `E0277`. `Selection` and `FieldPredicate` derive `PartialEq` only
+(`selection.rs:400`, `:435`). `HuginnMindRequest` derives `Eq` (`wire.rs:42`).
+This is a gap in the owner: **P-2**. Every field is a string, bool, integer or
+vector, so `Eq` is derivable.
+
+### F11. `huginn-mind` has no CultNet dependency, and a check says so
+
+`huginn-mind/Cargo.toml` depends on `cultcache-rs` and the leaf, and says "No
+network, no socket, no index". The Cut 8 verification
+(`eureka-pipeline-state-cut.md:3701`) requires this grep to come back empty:
+
+`rg -n "reqwest|UdpSocket|qdrant|ollama|cultnet|cultmesh|IndexPort|EmbeddingPort|pending_index" crates/huginn-mind`
+
+**Carrying `Selection` in `wire.rs`, which is where Q13 A put the wire types,
+breaks that check.**
+
+`cultnet-rs` brings `socket2`, `aes-gcm`, `ed25519-dalek`, `rand`, `uuid` and
+`windows-sys`. It adds **zero** packages to the workspace build, because
+`huginn-daemon` already pulls all of them. `selection.rs` itself uses only
+`serde`, `serde_bytes`, `base64` and `sha2`. This is Q-RS2.
+
+### F12. Record keys are unique across kinds
+
+- The leaf derives every key as `<root>:<kind>:<local>`
+  (`query.rs:165-174` reads it that way).
+- The probe image had 36 distinct keys over 36 views.
+
+This matters because `select` indexes rows by record key alone
+(`selection.rs:1095`). Huginn is safe under that indexing whichever way the
+selection Soul pass settles it.
+
+## 2. CultLib prerequisites (routed to the selection campaign, not this map's Hands)
+
+These fill gaps in their owner. Self adds them to the selection branch's next
+fix batch, so that they land **before the merge** that BP-2 pins to.
+
+- **P-1. `Evaluation.matched: u32`**, the length of the ordered list before
+  cursor and limit.
+  - Rule to pin: `matched` is the count before paging, unchanged across a
+    walk's pages.
+  - Revert: drop it. Loosening: `matched = page.len()` must die on a fixture
+    with 3 matches and `limit: 1`.
+  - The C# evaluator's page already carries it. The parity vectors should
+    compare `matched`; check whether they already do.
+- **P-2. `Eq` on `Selection`, `FieldPredicate`, `Citation`, `Incoming` and
+  `Edge`.**
+  - `RecordRef` already has it.
+  - No test is needed beyond a compile use. Fallback, if the selection campaign
+    refuses: Huginn drops `Eq` from `HuginnMindRequest`. That costs nothing
+    today, because its tests use `assert_eq!`, which needs only `PartialEq`.
+
+## 3. Cut order
+
+```
+[Cut 10 residue batch lands on Huginn]                       (in Hands now)
+      │
+      ├──► RS-2  Huginn: delete open_items, history, the admission window       (no pin move)
+      │      │
+      │      ▼
+      │    RS-1  Huginn: the receipt ordinal, receipt v2, epoch-first opener     (no pin move)
+      │
+      ├──► RS-L  Epiphany leaf: titles, epoch v2, OrgRepo and Label doors         (parallel: another repo)
+      │
+[P-1, P-2 → selection Soul → selection merges to CultLib main]
+      ▼
+BP-1  CultLib content plane                                  (body-plane map; Q-BP1)
+      ▼
+BP-2  one pin move: leaf cultcache → X; Huginn cultcache, cultnet → X; Huginn leaf → RS-L tip
+      │  (widened here: the mechanical adoption of RS-L's titles and epoch in Huginn's fixtures and literals)
+      ▼
+RS-3  Huginn: the consumer (Row/RowSet, value door, snapshot, page, summary, edges)
+      ▼
+BP-3  Huginn: deferral to the body plane                     (body-plane map; Q-BP2)
+      ▼
+Cut 11, Cut 13
+```
+
+**Why RS-2 and RS-1 run early.** Neither needs a new pin. Both are plain Huginn
+work that can land while CultLib finishes selection. RS-2 comes first because
+it is pure subtraction, and it leaves RS-1 and RS-3 fewer read paths to carry.
+
+**What the gap costs.** Between RS-2 and RS-3 the organ answers `view`,
+`query`, `whoami` and `admit`. The two relations that RS-2 unpins (R-B, D6) are
+re-pinned as selections in RS-3. No client exists, because Cut 13 is unbuilt.
+
+**RS-L can land at any time**, but **before BP-2**, so that Huginn moves its
+leaf pin once (§4).
+
+## 4. The pin sequence
+
+- **CultLib revision X** is the first `main` commit that carries both of these:
+  - the selection merge, including P-1 and P-2;
+  - BP-1.
+- **The leaf** pins `cultcache-rs` at X. BP-2 makes this the leaf's commit,
+  **after** RS-L, so the leaf's tip carries both changes.
+- **Huginn**, in one commit (BP-2's Huginn half):
+  - `huginn-mind` pins `cultcache-rs` at X;
+  - `huginn-daemon` pins `cultnet-rs` at X;
+  - `huginn-mind` pins the leaf at the leaf's tip.
+
+  `huginn-mind` gains `cultnet-rs` at **X** in RS-3. That adds an edge at the
+  same revision, not a pin move.
+- **Result:** every CultLib pin moves once, and the leaf pin moves once.
+  `cargo tree -d` shows one `cultcache-rs` and one `cultnet-rs`. The probe build
+  shows two `cultcache-rs` when the revisions differ, confirming the body-plane
+  map's F5.
+
+**BP-2 is widened by one clause.** Adopting RS-L changes the leaf's API: two
+required fields and a new epoch. BP-2's Huginn commit is therefore **not**
+revision strings only. It also:
+- adds `title` in `fixtures.rs:162-187` and in its own probe;
+- updates the three version literals of F4;
+- regenerates the two published wire schemas.
+
+It changes no behaviour. It is verified by:
+- the full suite green;
+- the cut8, cut9 and cut10 mutation suites rerun clean;
+- `cargo tree -p huginn-daemon -e normal -d` clean.
+
+The body-plane map's "74 tests at `202e5e3`" is stale. Re-count after the
+residue lands.
+
+**Conditional default: this depends on Q-BP1, and nothing here re-asks it.**
+- Under **Q-BP1 A**, BP-1 is small and starts now, so the pins wait for it and
+  move once.
+- Under **B or C**, BP-1 becomes a TLS or QUIC campaign. Waiting would stall
+  RS-3 on an unrelated transport. In that case BP-2 splits:
+  - it moves to the selection merge now, and RS-3 proceeds;
+  - a second CultLib-only pin move follows BP-1. The leaf pin does not move
+    again unless the leaf's `cultcache-rs` changes.
+
+  Self decides at that point. It is not an operator question: a pin move costs
+  four strings and one `cargo tree` check.
+
+## 5. The cuts
+
+### Cut RS-L. The leaf: titles, the epoch, and two grammar doors
+
+- **Repo/branch:** Epiphany `codex/eureka-pipeline-state` from `b3ae787b`.
+  Depends on Q-RS1 (the type of `title`). No pin moves.
+- **Deletes first:** none. The v1 schema files are **renamed**, not kept
+  beside v2, so there is no second copy.
+- **Changes, by anchor (`lib.rs` at `b3ae787b`):**
+  - `:349-352` `PipelineQuestion` and `:353-356` `PipelineRuling` each gain
+    `title: <T>`, where `<T>` depends on Q-RS1. Under Q-RS1 B, `:344` campaign
+    and `:358` cut spec move from `Short` to the same `<T>`.
+  - `:720` `PIPELINE_SCHEMA_EPOCH` becomes `"epiphany.pipeline.epoch.v2"`.
+  - The thirteen type ids in `:596-630` go to `.v2`. The test at `:2381`
+    forces it.
+  - Two public doors are added beside `Slug::validate_slug` (`:214-227`), on its
+    pattern:
+    - `OrgRepo::validate_org_repo(&self)` delegates to `org_repo_text`
+      (`:157-166`), through `Bounded::validate(self, "org_repo")`;
+    - `Label::validate_label(&self)` delegates to `label_text` (`:134-142`).
+
+    Each delegates, so the grammar keeps one owner.
+  - `schemas/cultnet/`: rename the thirteen files, regenerate them, update
+    `index.json`, and update `README.md:41`.
+- **Authority:** the leaf owns every grammar. The organ calls doors and
+  re-derives nothing. That is the precedent set by `validate_ref` and
+  `validate_slug`.
+- **Verification:**
+  - builds: `cargo test -p epiphany-pipeline --lib`, with the new target
+    subdirectory given in §7.
+  - tests:
+    - `pipeline_published_schemas_match_derivation` pins the renamed and
+      regenerated files byte for byte.
+    - `every_kind_is_at_the_epochs_version` pins v2 throughout.
+    - A new test, `the_org_repo_and_label_doors_are_the_grammar`, runs these
+      inputs:
+
+      | Door | Refuses | Accepts |
+      |---|---|---|
+      | `OrgRepo` | `"GameCult"`, `"/Repo"`, `"GameCult/"`, `"a/b/c"`, 201 bytes | `"GameCult/Epiphany"` |
+      | `Label` | `""`, `"a.b"`, 65 bytes, `"é"` | `"cut-10"` |
+    - A new test, `question_and_ruling_carry_a_title`, round-trips each kind
+      through `prepare`/`decode`. Under Q-RS1 A or B it also asserts that an
+      empty title refuses.
+  - mutations (`tools/eureka-readside-leaf-mutations.psd1`, M0 control):
+
+    | Entry | Kind | Mutation |
+    |---|---|---|
+    | `L1` | revert | `validate_org_repo` returns `Ok(())` |
+    | `L1L` | loosening, a function of the input | `org_repo_text` accepts when `contains('/')` |
+    | `L2` | revert | `validate_label` returns `Ok(())` |
+    | `L2L` | loosening, the wrong grammar | `validate_label` delegates to `dotted_text`; the fixture `"a.b"` is a valid slug and an invalid label |
+    | `L3` | revert, Q-RS1 A/B only | the title's non-empty check is removed |
+  - negative: `git grep -n 'epiphany\.pipeline\.[a-z_]*\.v1' -- epiphany-pipeline schemas`
+    is empty. Checked for collisions: `notes/` and the `runtime_spine`
+    stand-in are outside that scope, deliberately.
+- **Subtraction estimate:** about +45 source lines (4 fields, 2 doors with docs)
+  and about +60 test lines. The schema files churn by rename, plus about 2 fields
+  each on two files. No dependency changes.
+
+### Cut RS-2. Huginn: delete `open_items`, `history`, and the admission window
+
+- **Repo/branch:** Huginn `eureka/memory-organ`, after the residue batch lands.
+  No pin move. Subtraction only, so that Soul can falsify it on its own.
+- **First:** re-take every anchor below against the post-residue HEAD.
+- **Deletes (anchors at `4f7e3b5`):**
+  - **`query.rs`:**
+
+    | Lines | What is deleted | Size |
+    |---|---|---|
+    | `:107-117` | `PipelineOpenItems` | 11 |
+    | `:119-125` | `HistoryScope` | 7 |
+    | `:352-391` | `open_items` | 40 |
+    | `:393-435` | `history` | 43 |
+    | `:89-92` | the fields `admitted_after`/`admitted_before` | |
+    | `:279-288` | their filters | |
+    | `:570-663` | tests: both history tests | about 93 |
+    | `:942-1003` | tests: the open-items test | about 61 |
+    | in `:765-886` | tests: the window lines of `query_filters_each_select_by_one_field` | |
+  - **`wire.rs`:**
+    - `:48-49` (the variants), `:60-61` and `:72-73` (the arms) and `:87-88`
+      (the response variants);
+    - the test fixtures at `:155-159` and `:172-173`;
+    - the operation names asserted at `:184`.
+  - **`lib.rs:41`:** the re-exports of `HistoryScope` and `PipelineOpenItems`.
+  - **`daemon.rs`:**
+    - `:92-99`, the two arms;
+    - the tests that exercise them only:
+      - `a_refusal_open_items_raised_is_the_answer_the_dispatch_returns_whole` (`:624`);
+      - `open_items_refuses_on_a_fault_inside_the_requested_campaign` (`:660`);
+      - the `OpenItems`/`History` lines in the instance-gate tests at
+        `:401-416`, `:455-459`, `:518-522` and `:581`.
+
+      Each instance-gate test keeps its `query` and `view` cases.
+  - **`serve.rs`:**
+    - `:591` (`"m-o"`);
+    - `:855` (`"open_items"` as the long operation name).
+
+    N4 needs two operation names of different lengths. **Replace `open_items`
+    with `whoami`, six bytes against `view`'s four.** Do not delete the case:
+    the rule that the gate is exercised across operations survives.
+  - **`README.md:51`:** the clause "a campaign's open work, and a subject's or a
+    repo's history".
+  - **Entries:**
+    - cut9: V9, V10, V11, V12, V13, V13L, V14, V14L, V15, V22 and V22L (11);
+    - cut10: D19, D19L, D23, D23L, S1 and S1d (6).
+
+    D13 and D13L anchor on the deleted `operation()` arms: re-anchor them on the
+    surviving arms (`"view"`/`"query"`), with the same rule.
+
+    Each deleted entry's rule is either **ruled away** (the window, R-3) or
+    **re-pinned in RS-3** under the selection spelling. That second group is
+    R-B, D6, V9-V15, D19 and D23: RS-3 re-authors them by name.
+- **Keeps:**
+  - `docs.rs` `resolutions_of` (`:97-99`) and `assignments_of` (`:104-106`).
+    Admission's sequence rules still read both, through `latest_*`,
+    `derived_*` and `stewardships_of`.
+  - `semantic` and its refusal, as-is: Cut 11 owns "the `semantic` branch of
+    `query`" (Epiphany map `:5321`).
+- **Authority:** no ownership moves. Two public operations stop existing.
+- **Verification:**
+  - builds: `cargo test -p huginn-mind -p huginn-daemon`.
+  - negative, all over `crates` and `README.md`: each of the following
+    patterns is empty, and each has been checked for collisions:
+
+    | Pattern | Checked against |
+    |---|---|
+    | `open_items`, `OpenItems`, `PipelineOpenItems` | — |
+    | `HistoryScope` | — |
+    | `fn history\b` | prose uses "history" in comments |
+    | `admitted_after`, `admitted_before` | — |
+  - mutations: cut9 (27 remaining) and cut10 (65 remaining) rerun, with every
+    M0 green.
+- **Subtraction estimate:** about −110 source lines and about −330 test lines.
+  17 entries are removed and 2 re-anchored. No dependency or format changes.
+
+### Cut RS-1. Huginn: the receipt ordinal, receipt v2, and the epoch gate first
+
+- **Repo/branch:** Huginn, after RS-2. No pin move. The leaf is still at
+  epoch v1 here. Its epoch arrives with BP-2, before any mind is deployed:
+  Cut 14 is unbuilt. The one store version any deployed mind ever carries is
+  therefore (leaf epoch v2, receipt v2), which is the ruling's single migration.
+- **Deletes first:** none.
+- **Changes (anchors at `4f7e3b5`):**
+  - **`receipt.rs`:**
+    - `:27` and `:95` change `v1 → v2`. `HuginnCommitReceipt` (`:94-111`)
+      gains `#[cultcache(key = 7)] pub ordinal: u64`.
+    - `candidate` (`:160-178`) takes `ordinal: u64`.
+    - `digest` (`:116-120`) is **unchanged**: the ordinal is not digested. The
+      header doc (`:10-14`) names the ordinal beside `committed_at` and
+      `provenance`.
+    - `validate` (`:122-142`) refuses `ordinal == 0`.
+    - New: `pub(crate) fn head(mind) -> Result<u64, MindRefusal>` decodes the
+      receipts and requires their ordinals to be exactly `{1..=N}`. Anything
+      else is `Unavailable { detail: "receipt ordinals are not 1..=N: …" }`.
+      Admission calls it for `head + 1`. Nothing else computes an ordinal.
+  - **`admission.rs`:** the one `candidate(…)` call passes `head(self)? + 1`.
+  - **`query.rs`:** `AdmissionFacts` (`:36-41`) gains `ordinal: u64`, and
+    `AdmissionIndex::build` (`:134-150`) fills it. **The order is not switched
+    here.** `ordered` (`:307-311`) is deleted in RS-3, not rewritten twice.
+  - **`mind.rs:137-138`:** swap to `refuse_foreign_epoch`, then
+    `refuse_foreign_types`. The doc at `:129-133` is updated to match.
+  - **`wire.rs`:** regenerate the response schema, because `AdmissionFacts`
+    changes.
+- **Authority map:**
+  - **Owner:** `receipt.rs` owns the ordinal, meaning both its assignment and
+    its validity.
+  - **Inputs:** the image's receipts.
+  - **Outputs:** `head`; and `ordinal` on each receipt and on `AdmissionFacts`.
+  - **Derived state:** `AdmissionFacts.ordinal`, which is display-only until
+    RS-3 makes it the order.
+  - **Forbidden writers:** no code outside `receipt.rs` counts receipts to
+    produce an ordinal. `MindStatus.receipts` (`wire.rs:106-114`) counts them
+    for display and is not an ordinal.
+  - **Shared paths:** `admit` and `admit_prepared`, and so the daemon's sink
+    and Cut 12's import, all end in the one `candidate` call.
+  - **Deletion line:** none. The ordinal is new.
+- **Verification (tests; each rule has a revert and a loosening that fail):**
+
+  | Test | Rule it pins | Mutants that must die |
+  |---|---|---|
+  | `ordinals_are_admission_order_not_clock_or_id_order` | ordinal is `head + 1` at admission. The fixture has **three batches admitted at the same `now`**, whose receipt ids sort opposite to admission order; the probe's real store shows 31 receipts in 5 seconds, so this is the live case | revert `ordinal: 1` for every receipt (dies on the density check); **function-of-input loosening:** the ordinal is the rank of `(committed_at, receipt_id)` among receipts, which the same-second fixture kills; off-by-one `head` |
+  | `an_exact_replay_keeps_its_ordinal` | the ordinal is not digested (A9) | the ordinal inside the digest makes the replay commit again or refuse, and must die |
+  | `a_chain_that_is_not_dense_refuses_admission_and_reads_alike` | density is validated wherever the ordinal is read. The fixture plants a duplicate and a gap through `MemoryStore` | `head` returns `len()` without checking; the check runs only in admission |
+  | `a_v1_receipt_store_is_refused_at_open` | receipt v2 is a new type. The fixture plants a v1-shaped 7-slot receipt under `huginn.mind_commit_receipt.v1` | adding the field with `#[serde(default)]` and keeping the v1 id; F3 shows that this decodes to 0 silently |
+  | `a_store_written_at_the_previous_epoch_is_refused_by_the_epoch_gate` | epoch first. The fixture has an epoch record at `epoch.v0` and type ids at `.v0` | swapping the gates back makes it `ForeignStore`, which must die. The existing eight cases in `mind.rs:345-413` stay green unchanged, and that is part of the check |
+
+  - Entries: `tools/eureka-readside-mutations.psd1`, R1-R5 with L variants
+    and an M0.
+  - Cut8's A9 replay entries rerun, because `candidate`'s signature changed.
+- **Subtraction estimate:** about +45 source lines and +160 test lines. No
+  dependency changes. **Formats:** one moves, receipt v1 → v2.
+
+### Cut RS-3. Huginn: the consumer
+
+- **Repo/branch:** Huginn, after BP-2 (pins at X, leaf at RS-L's tip) and after
+  RS-1. Depends on Q-RS2, and on P-1 and P-2 being in X.
+- **Commits, in order.** Each builds and passes on its own.
+  1. **The edge list moves to its owner (ownership only).** It moves from
+     `admission.rs:175-178` (`kind_of_id`) and `:223-285`
+     (`outcome_references`, `references`) into
+     `docs.rs::citations(document) -> Vec<(CitationRole, PipelineRef)>` and
+     `CitationRole`: the fifteen roles of the earlier read-side spec's D3 (list
+     below).
+     - Admission's `references` becomes a map over `citations`, carrying the
+       `Missing` classification (`:203-207`) and the hand-off source-side
+       filter. It has the same refusals in the same order.
+     - Cut8's `H17` entry (`refs.extend(outcome_references(…))`) is
+       re-anchored into `docs.rs`, with the rule unchanged.
+     - Verified by: the cut8 suite 67 of 67 (plus H17 re-anchored) and the
+       full admission test set, unchanged.
+  2. **Deletes first:**
+     - `PipelineQuery` (`query.rs:77-97`) and `PipelineQueryPage` (`:101-105`);
+     - `QUERY_LIMIT_MAX` (`:32`), which is replaced by
+       `cultnet_rs::LIMIT_MAX`, the substrate's clamp;
+     - `Reader::matches` (`:249-290`) and `ordered` (`:307-311`);
+     - `root_and_local`'s role as a filter. It survives as the row's value
+       source for `root` and `cut`;
+     - `repo_matches` (`:178-195`), which moves to the row's `repo` values;
+     - `lib.rs:40-43`, the re-exports of all of the above.
+  3. **The consumer:** `rows.rs` (new), `query.rs` rewritten around it,
+     `wire.rs`, `refusal.rs`, and `daemon.rs:88-91`. Details below.
+  4. **Tests and the readside entries.**
+- **New dependency:** `huginn-mind` gains
+  `cultnet-rs = { git = …, rev = X, package = "cultnet-rs" }` (Q-RS2 A).
+- **Vocabulary: the organ's closed lists.**
+  - **Schemas.** These are the thirteen leaf type ids. `schemas` entries are
+    matched exactly: Rust carries no alias matching (`selection.rs:438-440`).
+  - **Aliases.** Each row answers `values(alias)` with strings. Every value is
+    checked at the organ's door against the domain in the last column.
+
+    | Alias | Declared on | Value | Door (domain) |
+    |---|---|---|---|
+    | `root` | all | the key's root segment. This is V18/V18L's rule, renamed from `campaign` because a stewardship's root is an instance and a resolution's is its subject's | `Slug::validate_slug` |
+    | `in_force` | all | `"true"`/`"false"` | exactly those two |
+    | `faculty` | all | `Faculty` variant name | the closed set |
+    | `repo` | campaign (each listed repo), cut_spec, cut_report, follow_up, stewardship, hand_off, resolution (read through `base`: V17/V17L) | `OrgRepo` text | `OrgRepo::validate_org_repo` (RS-L) |
+    | `cut` | cut_spec, cut_report, verdict, finding, resolution (through `base`) | the label in `cut-<label>.` (V16/V16L: the prefix ends at the dot) | `Label::validate_label` (RS-L) |
+    | `severity`, `confidence`, `origin` | finding | variant name | closed set |
+    | `authority` | ruling | variant name | closed set |
+    | `claim_outcome` | verdict (one value per claim) | variant name | closed set |
+    | `outcome` | resolution | `Superseded`, `Answered`, `Fixed`, `Deferred`, `Recorded` or `Withdrawn` | closed set |
+
+    No alias is numeric. `is_numeric` is `false` everywhere, so the substrate
+    refuses any comparison.
+  - **Roles** (`CitationRole`, one per referring leaf field, with the wire
+    spelling equal to the field name), and `target_leaves`:
+
+    | Role | Source field | Target leaves |
+    |---|---|---|
+    | `raised_in` | `question.raised_in` | all 13 |
+    | `answers` | `ruling.answers` | question |
+    | `rulings` | `cut_spec.rulings` | ruling |
+    | `questions` | `cut_spec.questions` | question |
+    | `cut_spec` | `cut_report.cut_spec` | cut_spec |
+    | `forks` | `cut_report.forks` | question |
+    | `cut_report` | `verdict.cut_report` | cut_report |
+    | `findings` | `verdict.claims[].findings` | finding |
+    | `verdict` | `finding.verdict` | verdict |
+    | `source` | `follow_up.source` | all 13 |
+    | `subject` | `resolution.subject` | all 13 |
+    | `superseded_by` | `Superseded.by` | all 13 |
+    | `resolved_by` | `Answered.by` and `Fixed.by` | all 13 |
+    | `deferred_to` | `Deferred.to` | all 13 |
+    | `documents` | `hand_off.documents`, on both sides; an entry whose kind segment does not read cites nothing | all 13 |
+
+    **"Any" is spelled as the thirteen ids, never as an empty list.** The
+    substrate reads empty as "unrestricted" (`selection.rs:1204`), and Huginn
+    should not depend on that reading (§10). Role names are unique, so
+    `target_leaves(role)` needs no schema.
+  - **Not edges:**
+    - `cut_spec.depends_on`, `finding.invariants` and `claim.promise`, which
+      are labels;
+    - `precedents`, which is `ForeignRef`, another store's;
+    - `Fixed.commit`.
+- **`rows.rs` (new): types, rules and boundaries only.**
+  - `pub(crate) struct SelectionRow` holds:
+    - `kind`, `key`, `ordinal: u64`;
+    - `values: BTreeMap<&'static str, Vec<String>>`;
+    - `refs: Vec<(CitationRole, PipelineRef)>`;
+    - the `PipelineDocumentView` it projects.
+  - `impl cultnet_rs::Row for SelectionRow`:
+    - `ordinal as i64`;
+    - `references()` maps each ref to
+      `(role.name(), RecordRef{kind.type_id(), id}, None)`. There are no
+      payloads.
+  - `pub(crate) struct Vocabulary` implements `cultnet_rs::RowSet` from the two
+    tables above, and nothing else.
+  - `fn refuse_values(selection) -> Result<(), MindRefusal>`, **the organ's
+    door (S6)**, runs after `cultnet_rs::validate`:
+    - every `schemas` entry is one of the thirteen ids;
+    - every `keys` entry parses as a `PipelineRef` whose kind is its own kind
+      segment, and passes `validate_ref`;
+    - every `any_of` value is in its alias's domain;
+    - `cites.target.schemaId` is one of the thirteen ids, and
+      `PipelineRef{that kind, recordKey}.validate_ref()` passes. That is
+      V24's rule, now at this door.
+
+    Refusals name what the client sent: `SelectionInvalid { field:
+    "fields[1].values" | "keys" | "schemas" | "cites.target", value, message }`.
+    This carries Cut 10 N2's lesson.
+- **`query.rs` rewritten: types and rules.**
+  - `Reader::at(mind, as_of)`:
+    - `AdmissionIndex` is built over **all** receipts, so an orphan or a double
+      write still refuses as before (V4/V4L).
+    - The image is filtered to documents whose writing receipt has
+      `ordinal ≤ as_of`.
+    - `Docs` is built over that filtered image, so in force, the closing
+      resolution, `base` and citations are all as of `as_of`.
+    - `Reader::new(mind)` becomes `Reader::at(mind, head)`. `view` keeps using
+      it.
+  - `Mind::query(&self, selection: &Selection, semantic: Option<&SemanticQuery>) -> Result<PipelineSelectionPage, MindRefusal>`
+    does, in order:
+    1. refuses `semantic`, before any read (V8/V8L unchanged);
+    2. runs `cultnet_rs::validate(selection, &Vocabulary)`;
+    3. runs `refuse_values`;
+    4. takes `as_of` from `Cursor::parse(cursor)?.as_of` if a cursor is
+       present, and otherwise `head`; an `as_of > head` is `CursorInvalid`;
+    5. builds `Reader::at` and the rows;
+    6. calls `cultnet_rs::select(&Vocabulary, &rows, selection, as_of)`;
+    7. projects the page.
+  - `PipelineSelectionPage` carries:
+    - `matched: u32`, from P-1;
+    - `as_of: u64`;
+    - `next: Option<String>`;
+    - `items: PipelinePageItems`;
+    - `edges: Option<Vec<PipelineEdge>>`, present exactly when the selection
+      has a hop.
+  - `PipelinePageItems` is `enum { Headers(Vec<PipelineDocumentSummary>), Documents(Vec<PipelineDocumentView>) }`,
+    chosen by `selection.projection` (`PROJECTION_HEADER`/`PROJECTION_DOCUMENT`).
+  - `PipelineEdge` is `{ from: PipelineRef, role: CitationRole, to: PipelineRef }`,
+    which is the organ's typing of `EdgeMatch` (F9).
+  - `PipelineDocumentSummary` follows the earlier read-side spec's D1, with
+    these changes:
+    - it carries `id`, `admission` (now with `ordinal`), a status summary
+      (`InForce | Resolved { resolution, outcome }`) and `facts: PipelineFacts`
+      per kind;
+    - **`Question` and `Ruling` facts gain `title`**;
+    - it is bounded by `SUMMARY_MAX_BYTES = 8_192`.
+
+    The earlier spec lives at
+    `…F--Projects-Aetheria…/scratchpad/cut10b-read-side-spec.md:120-205`, a
+    scratchpad and **not durable**. Self copies D1's type block into this
+    section when placing the map, or the spec dies with the session.
+- **`wire.rs`:**
+  - `Query { instance: Slug, #[schemars(schema_with = "selection_ref")] selection: Selection, semantic: Option<SemanticQuery> }`.
+    `selection_ref` returns the `$ref` of F9.
+  - `HuginnMindResponse::Query(PipelineSelectionPage)`.
+  - Regenerate both schema files.
+  - Keep `Eq` (P-2) or drop it (the fallback).
+- **`refusal.rs`:**
+  - adds `SelectionInvalid { field: String, value: Option<String>, message: String }`
+    and `CursorInvalid { message: String }`;
+  - adds one total mapping from `SelectionRefusal`, **with no wildcard arm**:
+    - `Invalid` becomes `SelectionInvalid`;
+    - `CursorInvalid` becomes `CursorInvalid`;
+    - `CursorStale` becomes `Unavailable` ("the organ answers at the cursor's
+      asOf; a stale refusal is an organ defect"). A test proves it
+      unreachable;
+    - `ReferenceOutsideTarget` becomes `Unavailable`, as integrity: A7 admits
+      only referents of the declared kind.
+- **`daemon.rs:88-91`:** the arm passes `selection` and `semantic` through, and
+  the refusal crosses unchanged. The existing D entries for this arm are
+  re-anchored.
+- **Authority map:**
+  - **Owners:**
+    - The substrate owns the grammar of a selection's names, the order, the
+      cursor, the hop and paging.
+    - The organ owns the rows, their ordinals and values, the vocabulary, the
+      value domains, the snapshot, the header, and the mapping of refusals.
+    - The leaf owns every value grammar.
+  - **Inputs:** the image, the receipts, and `head` (from `receipt.rs`).
+  - **Outputs:** `PipelineSelectionPage` and typed refusals.
+  - **Derived state:**
+    - `in_force`, `base` and the edges are derived per read, over the snapshot;
+    - the summary is derived per read;
+    - `matched` is the substrate's.
+  - **Forbidden writers:**
+    - no filter, order or paging logic in `huginn-mind`, beyond the as-of
+      restriction;
+    - no second copy of the selection's schema;
+    - no refusal of a selection name that the substrate already refuses. If
+      the substrate ever starts refusing unknown `schemas`, the organ's copy
+      of that rule is deleted (§10);
+    - `cultnet_rs::select`'s result is never re-filtered.
+  - **Shared paths:**
+    - `view` and `query` share `Reader::at`;
+    - admission and reads share `citations` and `head`.
+  - **Deletion line:** commit 2 above.
+- **The relations, re-pinned by name** (R-B and D6 of Cut 9, and V9-V15):
+
+  | Test | Relation |
+  |---|---|
+  | `a_subjects_history_is_one_cites_hop` | `schemas:[resolution], cites{target: S, role: subject}`, in ordinal order, with withdrawn records included with their status. The ten-cycle fixture of the deleted test is used, so n10 lands after n9 |
+  | `a_repos_assignments_are_one_selection` | `schemas:[stewardship], root:[instance], repo:[R]` |
+  | `open_work_is_five_selections` | the probe's five selections (F1), with the `query.rs:943-1003` fixture: the exact-id citation (V13L, V14L), and the superseded revision not open (V13) |
+
+  Each is a positive answer **and** a fixture that fails when the relation is
+  weakened. For example, `role` omitted from the subject history must return
+  the `resolved_by` edges too, and the test must see that.
+- **Verification (tests and mutations).** The file is
+  `tools/eureka-readside-mutations.psd1`, with target
+  `crates/huginn-mind/src/{rows.rs,query.rs,docs.rs,refusal.rs}`. The rows run
+  in this order: snapshot, order, value door, edges and refusals, summary and
+  wire.
+
+  | Rule | Test | Revert | Loosening (at least one a function of the input where the rule is "derived from") |
+  |---|---|---|---|
+  | A page is exact as of `asOf`: rows **and** every derivation | `a_walk_reads_the_snapshot_its_cursor_names`. Mint at N; admit a batch that closes a page-2 item and adds a match; page 2 still shows the item in force, the new match is absent, and `matched` is unchanged | use `head` instead of the cursor's `asOf` (the substrate refuses stale, and the test must see `CursorStale` → `Unavailable`) | restrict rows but build `Docs` over the full image, so in force leaks; `ordinal < as_of` (the boundary batch is dropped: the fixture's last page-1 row lands at exactly `asOf`) |
+  | `asOf > head` is refused | `a_cursor_from_the_future_is_invalid` | skip the check | `>=` in place of `>` (a cursor at exactly `head` must answer) |
+  | The order is the ordinal | `the_page_order_is_admission_order` (same-second batches, ids opposite to admission) | `Row::ordinal` returns 0 | the ordinal from the rank of `admitted_at` |
+  | `root` is the key root, in the Slug grammar (S6) | `a_root_outside_the_grammar_is_refused_not_empty` | skip | check only the first value (the fixture is `["eureka-state", "a/../b"]`) |
+  | `repo` is an OrgRepo (S6) | `a_repo_outside_org_repo_is_refused` (`"GameCult/"`, `"a/b/c"`) | skip | `contains('/')` |
+  | `cut` is a Label | `a_cut_outside_label_is_refused` (`"1.2"`) | skip | the Slug door in place of the Label door |
+  | Enum domains are exact | `enum_values_are_the_variant_names` (`"high"` refused, `"High"` accepted) | skip | a case-folded comparison |
+  | `schemas` and `keys` name things this organ holds | `an_unknown_schema_or_malformed_key_is_refused` | skip | accept any id that starts with `epiphany.pipeline.` |
+  | `cites.target` passes the leaf's ref grammar (V24) | `a_cites_target_whose_kind_disagrees_is_refused` | skip | check the schema id only, not `validate_ref` |
+  | V17/V17L: through base, to the first non-resolution | `repo_and_cut_reach_a_resolution_through_its_base` | values from the row itself | one step of `base` (the fixture is a withdrawal of a resolution) |
+  | One edge list | `every_role_yields_its_edge` (a fixture per role, 15) | drop one role's arm | `resolved_by` from `Answered` only (a `Fixed { by: Some }` fixture) |
+  | Refusals cross typed (D19/D23's successor) | `a_selection_refusal_crosses_the_dispatch_as_itself` | rewrap as `Unavailable` | swallow into an empty page |
+  | The header is bounded | `a_summary_is_bounded_whatever_the_lists` (maximal cut spec) | drop the bound test's constant | measure the facts without `admission` |
+  | Wire schemas equal derivation, and `selection` is CultLib's `$ref` | the existing `published_wire_schemas_match_derivation` | — | — |
+
+  - builds:
+    - `cargo test -p huginn-mind -p huginn-daemon`;
+    - `cargo tree -p huginn-daemon -e normal -d`, which must show no
+      `cultcache-rs` or `cultnet-rs` duplicate.
+  - negative:
+    - `rg -n "fn matches|fn ordered|QUERY_LIMIT_MAX|PipelineQuery\b|repo_matches" crates/huginn-mind/src`
+      is empty;
+    - `rg -n "impl .*JsonSchema for .*cultnet" crates` is empty;
+    - under Q-RS2 A, Cut 8's grep is **replaced** with
+      `rg -n "UdpSocket|CultNetRudp|bind\(|reqwest|qdrant|ollama|IndexPort|EmbeddingPort|pending_index" crates/huginn-mind/src`.
+      Checked for collisions: `bind(` does not occur in `huginn-mind` today.
+      Self amends the Cut 8 text the same day.
+  - suites rerun: cut8, cut9 (whatever V entries remain: V1-V8, V16-V21, V23 and
+    V24 are re-authored here and **deleted from cut9 in the same commit**, so no
+    rule has two entries), and cut10.
+  - operator: none. Cut 13's tool list decides whether any selection deserves a
+    named convenience (the ruling puts that there).
+- **Subtraction estimate:**
+  - Source removes about 180 lines: `matches` 42, `ordered` 5, `PipelineQuery`
+    with its page 28, `repo_matches` 18, and the admission reference code, which
+    moves (about 65, net about +15).
+  - Source adds about 520 lines:
+    - `rows.rs`, about 230 (the vocabulary tables 60, the row build 70, the
+      value door 80, the trait impls 20);
+    - `query.rs`, about 170 (`Reader::at` 25, `query` 40, the page and items
+      30, the summary with facts 75);
+    - `docs.rs` `citations` and `CitationRole`, about 80;
+    - `refusal.rs`, about 25;
+    - `wire.rs`, about 15.
+  - Net source is about +340.
+  - Tests add about 650 lines. About 250 of the deleted test lines are re-pinned
+    under the new spelling.
+  - About 32 entries are added and about 15 cut9 entries deleted.
+  - One dependency edge is added: `cultnet-rs` → `huginn-mind`. It adds no
+    workspace package.
+
+## 6. Subtraction ledger (estimate)
+
+| Cut | Source removed | Source added | Tests (net) | Entries | Deps / formats |
+|---|---:|---:|---:|---|---|
+| P-1, P-2 (CultLib) | 0 | about 10 | about +30 | +2 | none |
+| RS-L (leaf) | 0 | about 45 | about +60 | +5 | epoch v1→v2; 13 type ids; 13 schema files renamed |
+| RS-2 | about 110 | 0 | about −330 | −17, 2 re-anchored | two operations removed from the wire |
+| RS-1 | 0 | about 45 | about +160 | +10 | receipt v1→v2 |
+| BP-2 widening | 0 | 0 | about ±10 (fixtures) | 0 | pins |
+| RS-3 | about 180 | about 520 | about +400 | +32, −15 | +`cultnet-rs` edge on `huginn-mind` |
+| **Total** | **about 290** | **about 620** | **about +320** | **about +17** | one store version |
+
+**Honest net.** The organ grows by about +330 source lines, and the net test
+growth is modest. What that buys:
+- typed selection with a hop, a cursor and an exact snapshot, where there was a
+  scan with a clock order;
+- a value door where malformed filters read as empty;
+- one edge list where there were two;
+- a read-back of the admission order that the clock could not give.
+
+What it retires:
+- two hard-coded relation endpoints;
+- an order that was a timestamp;
+- a filter language private to the organ.
+
+**This is budget pressure, not a metric.** Hands may escalate a miss with an
+argument.
+
+## 7. Build budget
+
+- **Hosts.** The host and the target are both the workstation (Windows). Cut 14
+  builds on Yggdrasil, and nothing here proves anything about Linux.
+- **Commands.** Cargo runs through PowerShell only.
+- **Huginn.** Use the target that the Huginn checkout already uses
+  (`C:\Users\Meta\.cargo-target-codex`). **A second checkout of Huginn (Soul's)
+  uses its own subdirectory**, following the Eureka scar about shared build
+  output.
+  - Builds: `huginn-mind` and `huginn-daemon`, lib and tests, debug.
+  - RS-2 and RS-1 are warm: about +20 to +80 paths.
+  - RS-3 after BP-2 is warm at X: `cultnet-rs` is already compiled for the
+    daemon, and `huginn-mind` recompiles.
+- **Leaf.** `epiphany-pipeline` lib tests, warm: about +10 paths.
+- **CultLib P-1/P-2.** `cultnet-rs` lib and tests, run on the selection branch's
+  own target, as its campaign has it.
+- **Measured.** The probe's cold build of `cultnet-rs@00f4c02`, `huginn-mind`
+  and the leaf in a fresh target took 3m07s at 0.37 GiB. That is an upper bound
+  for any cold rebuild this campaign causes. C: had 229 GiB free.
+
+## 8. Deliberately not in scope
+
+- **A selection over another mind or several minds.** A mind is the instance.
+  Selection §13 is "not across shards or minds".
+- **Numeric aliases.** `revision`, `attempt`, `pass` and `sequence` could be
+  declared numeric later, as a normal change. No caller asks for them now.
+- **Text search.** `semantic` stays beside `selection` and stays refused until
+  Cut 11, which owns it. Cut 11's lowering of `FieldPredicate` to Qdrant filters
+  is Cut 11's.
+- **Watching a selection.** Selection Cut 2 is not Huginn's, since Huginn does
+  not subscribe (selection map D7).
+- **Oversize pages.** A `document`-projection page can exceed the window. The
+  typed `ResponseTooLarge` refusal stands until BP-3. Cut 13 should default to
+  `header` with a small `limit`.
+- **Sealing the store** so that admission is its only writer (Cut 10 F7). That
+  would make ordinal uniqueness structural instead of resting on the single
+  writer. It is recorded as the follow-up that owns that gap.
+- **Migrating old stores.** The ruling is to refuse. No import path exists
+  (F2 shows why).
+- **Named conveniences** for the old endpoints. Cut 13 decides those.
+- **Rust alias matching for `schemas`.** This is the substrate's (D7).
+- **The leaf's `Short` admitting an empty campaign or cut-spec title.** It is in
+  scope only if Q-RS1 B is ruled.
+- **S7 (Windows device names in the slug grammar).** It is unrelated and remains
+  recorded.
+
+## 9. Operator questions
+
+**Two new forks. Q-BP1 and Q-BP2 stay the operator's and are not re-asked
+here.**
+
+- **This cut depends on Q-BP1 for pin timing only** (§4, conditional
+  default).
+- **It depends on Q-BP2 not at all.** The header summary exists either way, as
+  `projection: header`. Under Q-BP2 B, BP-3 would reuse this cut's
+  `PipelineDocumentSummary`. It would not grow a second one.
+
+**Q-RS1: RULED B by the operator, 2026-09-22 ("good rec").** A new leaf text
+type, `Title`, holds 1 to 200 bytes. All four titles use it (campaign, cut
+spec, question and ruling), in epoch v2. RS-L implements it.
+
+*History, the question as asked:* **Q-RS1. What is a title? The leaf's epoch moves in RS-L, so this is the free
+moment to decide.** Titles are required by the ruling. The leaf's `Short`
+accepts the empty string, so a required `Short` can still be a bare leaf.
+Campaign and cut-spec titles are already `Short` and can be empty today.
+
+- **A.** A non-empty title for `question` and `ruling` only: a new leaf text
+  type `Title`, 1 to 200 bytes. The other two titles stay as they are.
+- **B.** `Title` for all four titles (campaign, cut spec, question, ruling),
+  in the same epoch v2.
+- **C.** `Short`, like the existing titles. Empty is allowed, and a non-empty
+  rule would be a later change.
+
+**Recommended: B.** The epoch moves anyway in this cut, and all thirteen type
+ids move with it by the leaf's rule. Tightening the two existing titles now
+costs about 4 lines and one more loosening mutant. Doing it later costs a
+second epoch and a second store refusal, which is exactly what the "same store
+version" ruling set out to avoid. C honours the letter of "gain a title" and
+still admits a bare leaf.
+
+**Depends:** the RS-L field types, the `L3` entry, the leaf's schema text, and
+every fixture that builds these kinds.
+
+**Q-RS2: RULED A by the operator, 2026-09-22 ("A, for sure").** `huginn-mind`
+depends on the whole of `cultnet-rs`. Cut 8's standing check narrows from "no
+`cultnet`" to "no transport use in `huginn-mind`". RS-3 rewrites that check.
+**Follow-up recorded, FU-SelSplit (CultLib).** Make selection separable from
+the transport, either as a feature or as a small package. Trigger: a second
+consumer wants selection without CultNet's transport.
+
+*History, the question as asked:* **Q-RS2. May `huginn-mind`, the rule engine, link `cultnet-rs`?** Q13 A put the
+wire types in `huginn-mind`, and the substrate's `Selection` rides the wire. So
+`huginn-mind` must depend on the crate that defines `Selection`. That crate
+also carries CultNet's transport, crypto and sockets. Cut 8's standing check
+says `huginn-mind` has no `cultnet` at all (F11).
+
+- **A.** `huginn-mind` depends on `cultnet-rs` whole.
+  - Cut 8's negative grep narrows from "no cultnet" to "no transport use"
+    (sockets, the RUDP hub, `bind(`, the index ports).
+  - No package is added to the workspace, because the daemon already links
+    all of it.
+  - Cost: the rule engine links code it must never call, held by a grep
+    rather than by the graph.
+- **B.** CultLib first makes selection separable. That means either a
+  `transport` default feature on `cultnet-rs`, so that `huginn-mind` uses
+  `default-features = false`, or a small `cultnet-selection-rs` package that
+  `cultnet-rs` re-exports. Then `huginn-mind` links only `serde`, `base64` and
+  `sha2`.
+  - Cost: one CultLib cut before RS-3, plus either a feature flag or one more
+    package in CultLib's Rust set. Doctrine treats both as liabilities that
+    need a named consumer. Huginn would be that consumer.
+- **C.** Move the wire types out of `huginn-mind`, reversing Q13.
+
+**Recommended: A.** It follows from the two rulings as they stand. The crate
+boundary Cut 8 drew was about *behaviour* (no network in the rule engine), and
+a narrowed grep pins that behaviour. B is the right answer only if a consumer
+appears that must not link transport, and a client of Huginn is not one:
+`eureka-state` needs `cultnet-rs` for its transport anyway. Record B as a
+CultLib follow-up with that trigger.
+
+**Depends:** RS-3's `Cargo.toml` and negative checks, the Cut 8 text Self
+amends, and whether RS-3 waits on a CultLib packaging cut (B).
+
+## 10. Selection's near-final code this cut depends on (what a Soul finding could change)
+
+All anchors are `selection.rs@00f4c02`.
+
+| Dependency | Where | If it changes |
+|---|---|---|
+| `Evaluation` has no `matched` | `:1080-1085` | **Must change (P-1).** RS-3 fills `matched` from it. |
+| Selection types lack `Eq` | `:400`, `:435` | P-2, or Huginn drops `Eq`. |
+| `Cursor::parse` is public and exposes `as_of` | `:1301-1346` | **Load-bearing.** Huginn reads `as_of` before `select` to restrict rows. If Soul makes the cursor private, the substrate must expose `cursor_as_of(&str) -> Result<u64, SelectionRefusal>` instead. It must not become an organ-side parse of an opaque format. |
+| `select` refuses `CursorStale` exactly when `cursor.as_of != as_of` | `:1131-1136` | Huginn passes the cursor's own `asOf`, so equality holds under any comparison rule. |
+| `select` does not call `validate` | `:1089-1114` | Huginn calls it first. If `select` starts validating, Huginn's call becomes redundant: delete it, and keep one owner. |
+| `validate` does not refuse unknown `schemas` | `:864-873` | Huginn's door refuses them. If the substrate starts refusing, **delete Huginn's copy.** |
+| `target_leaves(role)` has no schema parameter, and empty means unrestricted | `:747`, `:1204` | Huginn's roles are unique and "any" is spelled as the 13 ids, so it is unaffected either way. |
+| Rows are indexed by record key alone | `:1095` | Huginn's keys are unique across kinds (F12), so it is unaffected. |
+| `Row::ordinal -> i64`, `as_of: u64` | `:699`, `:1093` | A cast in `rows.rs`. |
+| Glob re-export: `select`, `validate`, `matches`, `Cursor` at the crate root | `lib.rs@00f4c02` (`pub use selection::*`) | If they move under `cultnet_rs::selection::`, only spelling changes. Huginn always calls them qualified. |
+| `projection` is a `String` with two constants | `:374-376`, `:462` | Huginn matches the constants. An enum would be a spelling change. |
+| The published `$id` of `cultnet.selection.schema.json` | `contracts/cultnet/…@00f4c02` | RS-3's `$ref` names it. A move of the `$id` fails Huginn's byte-for-byte schema test, which is the intended tripwire. |
+
+## 11. What was probed, what was only read, and what is not settled
+
+- **Probed by running code:**
+  - F1: all seven old relations equal a `select` over rows. Organ answers and
+    substrate answers match in members and in order.
+  - F2: the real store has 31 receipts in 5 seconds.
+  - F3: the receipt is a positional 7-slot array; a v2 strict decode fails;
+    a v2 decode with a default gives a silent 0.
+  - F5: the real v1 store is refused by today's gate order as `ForeignStore`
+    and by epoch-first order as `ForeignEpoch`.
+  - F6: `CursorStale` on an `asOf` mismatch.
+  - F7: the substrate door accepts malformed values.
+  - F9: `E0117`, and the `$ref` via `schema_with` works.
+  - F10: `E0277` on `Eq`.
+  - F12: key uniqueness.
+  - The duplicate `cultcache-rs` when revisions differ (the body-plane map's F5)
+    was seen in the probe build.
+- **Read only:**
+  - `Evaluation` lacking `matched` (F8). It is certain from the struct but not
+    exercised.
+  - That a required leaf field fails an old payload with "missing field". This
+    follows from serde. It is not probed, because the opener refuses such a
+    store first in any case.
+  - The `$defs` layout of CultLib's response schema.
+  - The Cut 8 grep text.
+- **Not probed:**
+  - **The probe's `huginn-mind` was the working tree at `4f7e3b5` plus the
+    residue batch's uncommitted edits.** It was read through a path dependency
+    and was never modified. The relations it exercised (`open_items`,
+    `history`, `query`, `receipts`, `open`) are outside the residue's scope
+    (the gate fixtures, `path_for`, the `open_with` door), so the results
+    should hold at the post-residue HEAD. Hands re-runs the equivalence as
+    RS-3's re-pinned tests in any case.
+  - C# decoding anything Huginn emits. Huginn's wire is its own; only
+    `Selection` is shared, and the selection campaign's parity vectors own it.
+  - Performance. Every read still decodes the whole image and every receipt
+    per call (F1), and RS-3 adds a row build. That is fine at campaign scale
+    and is not measured at a thousand-document mind.
+- **Not settled here:** Q-RS1 and Q-RS2 are the operator's; Q-BP1 and Q-BP2 are
+  already open. P-1 and P-2 are the selection campaign's to accept.
+- **Substrate missing, recorded per the skill:** typed pipeline state. This map,
+  its model page and its questions live in markdown, and the durable summary
+  spec (earlier read-side D1) lives in another session's scratchpad. Huginn is
+  the organ that would hold both, and it is the thing being built.
+
+## Appendix A. The summary type (carried here from cut10b-read-side-spec.md D1, 2026-09-17)
+
+Copied verbatim by Self on 2026-09-22 from a session scratchpad that will not survive. It predates the move of selection into CultNet: `PipelineQuery`/`Projection` here are the organ's own vocabulary and are superseded by CultNet's `Selection` and `projection`. What remains authoritative is `PipelineDocumentSummary`, `PipelineStatusSummary`, `PipelineFacts`, the field table and the size bound. Q-RS1 decides whether question and ruling facts gain a `title`.
+
+### D1. Projection: a summary is the default, the document is asked for
+
+`PipelineQuery` gains `projection: Projection` with
+`enum Projection { Summary, Document }`, `Default = Summary`. The page's
+items become one of two vectors, not a per-item tag:
+
+```
+pub enum PipelineQueryItems { Summaries(Vec<PipelineDocumentSummary>), Documents(Vec<PipelineDocumentView>) }
+pub struct PipelineQueryPage { pub items: PipelineQueryItems, pub matched: u32, pub as_of: u32, pub next: Option<String> }
+```
+
+`PipelineDocumentView` is unchanged and remains `view`'s answer and Cut 11's
+index source. The summary:
+
+```
+pub struct PipelineDocumentSummary {
+    pub id: PipelineRef,
+    pub admission: AdmissionFacts,          // unchanged type: receipt_id, admitted_at, provenance
+    pub status: PipelineStatusSummary,
+    pub facts: PipelineFacts,
+}
+pub enum PipelineStatusSummary {
+    InForce,
+    Resolved { resolution: PipelineRef, outcome: ResolutionOutcome },   // the record's outcome, not its rationale
+}
+#[serde(tag = "kind", content = "value", rename_all = "snake_case")]   // the leaf's own envelope spelling
+pub enum PipelineFacts {
+    Campaign    { title: Short, repos: Vec<OrgRepo> },
+    Target      { revision: u32, invariants: Vec<Label> },
+    Question    { label: Label, options: Vec<Label>, recommended: Label, raised_in: Option<PipelineRef>, asked_on: Date },
+    Ruling      { label: Label, answers: Option<Short>, choice: Option<Label>, authority: RulingAuthority, ruled_on: Date },
+    CutSpec     { cut: Label, revision: u32, title: Short, repo: OrgRepo, branch: Short, base: Sha, depends_on: Vec<Short> },
+    CutReport   { cut_spec: Short, attempt: u32, repo: OrgRepo, branch: Short, range: CommitRange },
+    Verdict     { cut_report: Short, pass: u32, range: CommitRange, outcomes: Vec<ClaimOutcome> },
+    Finding     { verdict: Short, label: Label, confidence: FindingConfidence, severity: FindingSeverity, origin: FindingOrigin, claim: Line, invariants: Vec<Label>, range: CommitRange },
+    FollowUp    { label: Label, source: PipelineRef, repo: OrgRepo, owner: Short, item: Line },
+    Resolution  { subject: PipelineRef, sequence: u32, outcome: ResolutionOutcome, resolved_on: Date },
+    Instance    { instance: Slug, display_name: Short, host: Short, created_at: Date },
+    Stewardship { instance: Slug, repo: OrgRepo, sequence: u32, assigned_on: Date, note: Line },
+    HandOff     { from_instance: Slug, to_instance: Slug, repo: OrgRepo, handed_on: Date },
+}
+```
+
+Each field, by the question it answers for a caller deciding what to work on:
+
+| Field | Question |
+|---|---|
+| `id` | what to `view`, cite, or resolve; the key already carries campaign, cut and label, so those are not repeated. |
+| `admission` | who landed it, when, under which faculty (ruling 18: attribution). The type is Cut 9's, unchanged, so there is one admission shape. |
+| `status` | is it open, and if not, what closed it and how (`Answered by`, `Superseded by`, `Withdrawn { reason }`). The closing record's `rationale` (Para) and `resolved_on` are the one thing dropped: the caller who wants why opens the resolution. |
+| Campaign `title, repos` | which repos are in jurisdiction. |
+| Target `revision, invariants` | which invariant labels findings and verdicts may cite; whether this is the standing revision (with `status`). |
+| Question `label, options, recommended, raised_in, asked_on` | is it open, what are the choices, what raised it, how old it is. The question text is `Para` and not carried. |
+| Ruling `label, answers, choice, authority, ruled_on` | did it answer a question and with which option; was it the operator's, standing, or defaulted. The ruling text is `Para` and not carried. |
+| CutSpec `cut, revision, title, repo, branch, base, depends_on` | which cut, which revision, where it lands, what it waits on. |
+| CutReport `cut_spec, attempt, repo, branch, range` | which spec it reports, which attempt, what range to check out. |
+| Verdict `cut_report, pass, range, outcomes` | which report, which pass, and whether any claim was falsified or unproven, one enum per claim in claim order. |
+| Finding `verdict, label, confidence, severity, origin, claim, invariants, range` | the triage row: how sure, how bad, whether it was introduced, which invariant it breaks, and its one-line claim. `claim` is the leaf's own `Line` and is carried whole, not projected; `failure_scenario` (Para), `locations`, `evidence` are not. |
+| FollowUp `label, source, repo, owner, item` | who owns it, where, and its one-line item (the leaf's `Line`). |
+| Resolution `subject, sequence, outcome, resolved_on` | what it closed, its place in the subject's history, how. |
+| Instance | the whole document: four short fields. |
+| Stewardship `instance, repo, sequence, assigned_on, note` | which assignment, and the note, which on a derived assignment carries the hand-off key (`docs.rs:136-140`). |
+| HandOff `from, to, repo, handed_on` | who moved what where; `documents` (256 Shorts, 51 KB) and `reason` (Para) are not carried. |
+
+**Rule the summary obeys, and the test pins:** a summary's encoded size is
+bounded by a named constant independent of the document's lists.
+`SUMMARY_MAX_BYTES = 8_192`. Arithmetic from the leaf's bounds: `id` 230,
+`admission` 720, `status` worst 2,100 (`Superseded` by eight refs), facts worst
+2,300 (CutSpec) or 2,100 (Resolution), names ~300: about 5.7 KB. A page of
+200 is therefore ≤ 1.6 MiB in the pathological case and ~80 KB in the real
+one (~400 B per summary). The maximal `Document` page stays what it is; the
+daemon's size refusal (Self's F1 ruling) is the backstop for that projection,
+and Cut 13's default projection is `Summary`.
+
+**On prose in the summary (Q-A below).** `finding.claim` and `follow_up.item`
+are carried because the leaf typed them as one-line statements. Question and
+ruling have only `Para` text, so their rows show a label and a date. Whether
+the leaf should give those kinds a `Short` title is a leaf question, raised,
+not answered here.
+
+**Rejected:** a per-item tag (`Vec<enum { Summary, Document }>`) — every item
+would carry a tag and the caller would match per item for a decision made
+once per query. A `fields: Vec<FieldName>` selector — a field-path language,
+which is the thing bounded out. Carrying `PipelineStatus` whole in the
+summary — 4 KB of rationale per resolved row against a bound whose point is
+to be small.
+
diff --git a/docs/history/huginn-organ-cut.md b/docs/history/huginn-organ-cut.md
new file mode 100644
index 0000000..294301f
--- /dev/null
+++ b/docs/history/huginn-organ-cut.md
@@ -0,0 +1,659 @@
+<!-- Provenance: copied verbatim from GameCult/Epiphany ef956865 notes/huginn-organ-cut.md; text below this line is unchanged. -->
+# Huginn wired in: cut map for Cuts 11-15
+
+Date: 2026-09-29. Imagination output (Opus). Nothing here is committed, and no
+repository or live service was written to. Self places this map. Its natural
+home is a section of `F:\Projects\Epiphany\notes\eureka-pipeline-state-cut.md`
+that replaces the old Cuts 11-15 (lines 5490-5853). Mark those lines as history
+the same day, so that no reader sees two live designs.
+
+**Q-H1 reversed, 2026-09-30 (operator).** Self laid out the five things 14-I still needs and recommended the
+interim unit. The operator: "So, what's blocking Huginn? I want us to be gathering evidence on Eureka ASAP" and then
+"Go for it." **Q-H1 is now A.** Cut 14 builds the interim unit as mapped, and its deletion line stays 14-I. Self
+deploys it under the operator's standing deployment authority, which replaces "the operator deploys" in Cut 14.
+Q-H2 has moved on: authority backups now run to Raven (weekly tier added 2026-09-30), so Cut 14's backup items apply
+under Q-H2 A. Cut 15 follows once 14 is live. The Q-H1 B text below is history.
+
+**Cut 15 merged, 2026-09-30 (Self).** GameCult/Eureka `main` is at `bdb9dfd` (`051e1fc`, `2a0e9f7`, `272f5ca`,
+`f0ff484`, `bdb9dfd`).
+- Soul took three passes. The first found the Soul brief had stopped reading operator rulings (High). That is fixed:
+  Soul claims against every cited ruling and every direction in force, independent of Hands' promises.
+- Live checks passed against the mind. `eureka-state` was redeployed on CultLib `8fc74c70`, and checks 3 and 6 now
+  pass from Starfire.
+- The substrate gaps are tabulated in `references/campaign-state.md`, and each becomes a `follow_up` in the first
+  campaign.
+- **Operator, on moving to typed state: "how are we going to move to Huginn mid-campaign? Methinks we don't."**
+  Campaigns already in flight finish in prose. The first typed campaign starts fresh in a new session: Idunn as a
+  watchdog that reports to the operator on Discord (store-recovery Q-R4).
+
+**Cut 14 status, 2026-09-30 (Self).** Huginn is live on Yggdrasil: `huginn.service` on `10.77.0.1:17872/udp`,
+instance `eureka`, started 13:24 CEST.
+- The release is `0c4e410` (the `eureka/memory-organ` head), with binary sha256 `a02ae1f5...`.
+- gamecult-ops `a0320e4`/`14df7ce`, Huginn README `dcb85de`. The ufw rule admits Starfire only.
+- Checks 1, 2, 4, 5 (at the firewall counters) and 7 pass. Check 4 admitted the mind's identity document
+  `eureka:instance:self` (receipt `mind-commit-379a2a34...`), and it survived a restart.
+- Check 8 waits for the 04:00 CEST backup on 1 October. The map's freeze-loop script no longer exists. The
+  non-freezing state-backup producer covers `/var/lib/gamecult`, so no freeze loop was added.
+- **Check 3 fails, and Cut 15 is blocked on it.** `eureka-state` on Windows cannot reach the daemon. The
+  cultnet-rs client binds `127.0.0.1` by default (`cultmesh.rs:256`), and on Windows a loopback-bound socket cannot
+  send to `10.77.0.1` (os error 10051). This is CultLib's defect, and it is fixed there (`hands/rudp-client-bind`).
+  After that come Huginn's pin bump, the Windows rebuild of `eureka-state`, and a rerun of checks 3 and 6.
+- Self default: the derived Qdrant collection `huginn_mind_eureka` joins the backup's `QDRANT_SKIP`, because the
+  collection is disposable and the mind file is the truth.
+
+**Operator rulings, 2026-09-29, each asked on its own:**
+
+- **Q-H1: B, wait for Idunn.** Cut 14's interim systemd unit is **not**
+  built. The organ deploys through Idunn after route continuity (Idunn
+  `docs/route-continuity-cut.md`) lands. Cut 14 is remapped as 14-I once that
+  campaign settles. A Rust runtime-presence implementation shared with Idunn,
+  rather than a third copy, is its prerequisite, and where it lives is a fork
+  to bring then. Cuts 11a, 11b, 13a and 13b proceed. They run against a
+  hand-started daemon in tests only.
+- **Q-H2: C, no backup yet.** Nothing on Yggdrasil is backed up today (the
+  authority backup unit was never installed). That is recorded as a
+  standing risk, not solved here.
+- **Q-H4: one mind, instance `eureka`.** The operator asked first: "Wouldn't
+  a single instance be bad for concurrency? ... can multiple Eureka instances
+  share a Mind on Huginn?" Self answered from the Body. The daemon is the
+  mind's only writer, and any number of sessions are its clients. Racing
+  admissions get typed refusals. Focus comes from scoped queries, not from
+  mind size. **Self's addition for Cut 13, from that exchange:** receipts
+  name the instance but not the session that admitted a batch. With several
+  sessions sharing one mind, the admitting session is recorded on the receipt
+  (declared attribution, like the instance).
+- **Q-H5: park Cut 12**, tag and note, not deleted.
+- **Q-H6: A, the hybrid, with a standing direction.** The operator: "every bit
+  of prose we're passing around should be viewed as a potential liability,
+  *especially* if it's too big to just shove the whole thing into context. We
+  should be looking for ways to turn what remains into typed state as well."
+  Every Imagination pass looks for the next prose surface that could become
+  typed (body facts, the model page, the subtraction ledger), and proposes it
+  rather than adding prose.
+
+**Objective (operator, 2026-09-29):** "Huginn wired in". Eureka's pipeline
+runs on Huginn's typed state. In scope: Cuts 11, 13, 14 and 15. Cut 12 is
+recommended for parking (see Q-H5). Out of scope: Cut 16 (the proof
+campaign), the Verse-presence cut (Q23 A), a public or stranger-ready skill,
+and the landing site.
+
+**What lands ahead of these cuts** (mapped elsewhere, not re-mapped here):
+
+- BP-1: CultLib content plane. It is in Hands on `cultmesh/rust-content-plane`, with three commits pushed.
+- BP-2: the pin move.
+- RS-3: `Mind::query(selection, semantic)`. It adds `cultnet-rs` to `huginn-mind`, and deletes `PipelineQuery` and `QUERY_LIMIT_MAX`.
+- BP-3: `HuginnMindResponse::Deferred`, `MAX_DEFERRED_BODY_BYTES`, and a deferral budget of 256 MiB.
+
+Every Huginn anchor below is against `eureka/memory-organ` at `8c5f784`, which
+is clean. RS-3 and BP-3 move `query.rs`, `wire.rs` and `serve.rs`, so **each
+brief re-takes its anchors after they land.**
+
+## Pins
+
+| Repo | Branch | HEAD | Used for |
+|---|---|---|---|
+| Huginn | `eureka/memory-organ` | `8c5f784` | Cuts 11 and 13 |
+| Epiphany | `codex/eureka-pipeline-state` | `4f784d04` | the leaf's text fields (`epiphany-pipeline/src/lib.rs:510-578`), read only |
+| Eureka skill | `main` | `19487f0` | Cut 15 (`~/.claude/skills/eureka`) |
+| gamecult-ops | `main` | `8554e60` | Cut 14 |
+| Idunn | (current) | `5bbb461` | read only. The route-continuity target and cut map are the dependency for 14-I |
+
+## Probe facts (run 2026-09-29, read-only except as noted)
+
+- **P1. Qdrant on Yggdrasil** is `qdrant 1.17.1`, on `127.0.0.1:6333`.
+  - It holds exactly two collections, both voidbot's:
+    - `voidbot_repository_source_chunks`: 116,877 points;
+    - `voidbot_discord_history_chunks`: 40,788 points.
+  - Both are 1,024-dimensional, `Cosine`, `on_disk: true`, with keyword payload indexes (`sourceId`, `corpusKind`, `repoName`, `pathPrefixes`, …).
+  - **`config.metadata` is null on both.** They were restored, not created by voidbot's code. So voidbot's embedder-compatibility check (`VoidBot/packages/rag/src/qdrant-vector-store.ts:458-477`) has nothing to compare against in production.
+- **P2. Raven's Ollama is live, and voidbot already uses it.**
+  - `/srv/voidbot/retrieval/voidbot.env` reads `RAG_OLLAMA_BASE_URL=http://10.77.0.4:11434` and `RAG_OLLAMA_MODEL=qwen3-embedding:0.6b`. So the 2026-09-26 cutover has happened.
+  - `gamecult-ops/inventory.md:669` and `runbooks/voidbot-retrieval-recovery-yggdrasil.md:40-62` still name Nightwing. They are stale.
+  - Nightwing (`10.77.0.3:11434`) did not answer.
+  - Epiphany's old Yggdrasil-local endpoint (`10.77.0.1:11435`) did not answer.
+- **P3. What Raven serves.** Ollama `0.21.1`. Tags:
+  - `qwen3-embedding:0.6b`: digest `ac6da0dfba84…`, Q8_0;
+  - `bge-m3:latest`.
+  - One embed call per model, from Yggdrasil, returned **1,024 dimensions for both**. Each call took **5-6 s cold**. `/api/ps` reports a context of 4,096.
+  - Side effect: this probe loaded `bge-m3` into Raven's VRAM until its 5-minute keep-alive expired.
+- **P4. How voidbot uses Qdrant**, which is the convention to reuse (`qdrant-vector-store.ts`):
+  - The point id is the first 16 bytes of `sha256(chunk id)`, shaped into a v5-style UUID (`:264-280`). The real id travels in the payload.
+  - Collections are created with `metadata {managedBy, corpusKind, embedderId, vectorLength, schemaVersion}` (`:203-216`).
+  - **`embedderId` is `ollama:<baseUrl>:<model>`** (`ollama-embedder.ts:29-31`). Moving the host therefore reads as a model change, which is the hazard the 2026-09-26 memory warns about. Huginn keys compatibility on **model name plus digest**, not on the URL.
+  - Query text is prefixed `Instruct: …\nQuery: …` when an instruction is configured (`:42-48`).
+- **P5. WireGuard exists.**
+  - Starfire has the adapter `wg-gamecult-starfire` at `10.77.0.2`, and it is Up.
+  - Yggdrasil has `wg-gamecult` at `10.77.0.1/24`, reachable from Starfire.
+  - `10.77.0.1:17872/udp` is unbound. Ports in use today: 17871 (Odin, via nginx), 17873, 17876 and 17890 (Idunn's host-actuator hub, which is not in R21's list).
+  - **ufw admits UDP on wg only per port:** 3075, 17871, 17876 (from `10.77.0.2` only) and 17890. **17872 needs a rule.**
+  - Starfire's 17877 RUDP requester is not listening today. So a Rust RUDP client on Windows over WireGuard has a precedent, but it is not proven live right now.
+- **P6. `crates/eureka-state` is an empty stub:** `src/lib.rs` has 0 lines, and `Cargo.toml` has no dependencies.
+- **P7. The daemon serves one mind per process.**
+  - `serve.rs:91-111` takes exactly `--state-root`, `--instance` and `--bind`.
+  - `Mind::open` takes a lifetime-exclusive redb lock (`mind.rs:127-139`).
+  - `IndexSink::committed` runs **synchronously inside `Daemon::handle`, before the reply** (`daemon.rs:74-83`).
+  - `run` is a single-threaded poll loop (`serve.rs:257-297`). Any blocking call made there stalls every session.
+- **P8. The hand-off already works one side at a time.** Admission derives:
+  - the source side's withdrawal when `from_instance == mind` (`admission.rs:331-346`);
+  - the target side's stewardship when `to_instance == mind` (`:347-353`).
+  So a hand-off is two ordinary admissions, one per mind.
+- **P9. Idunn v2's contract for a routed stateful target**, read from source:
+  - The state slot kinds are only `cultcache-file` and `external-file` (`Idunn/src/deployment.rs:182-187`). **There is no `cultcache-directory`.**
+  - A dependency on non-Idunn infrastructure is `kind = "external-operator-binding"`. It is satisfied by the binding's `external_capabilities` (`deployment.rs:1359-1383`, `deployment_plan.rs:146-249`). `shared-infrastructure` needs a managed provider with Odin correlation.
+  - The route challenge for `rudp` is a CultNet `SnapshotRequest` for `gamecult.runtime_presence_health.v2`, keyed by the target (`drivers.rs:5524-5545`). The service must answer it with signed presence, signed with the Idunn activation credential. It must also adopt the process write lease.
+  - Huginn implements none of this.
+  - **No shared Rust implementation exists.** `cultnet-rs` has the contracts and signers (`runtime_authority_contracts.rs`, 3,309 lines). Each Rust service writes its own participant: Ghostlight's `idunn_health.rs` is 2,001 lines, and Odin has its own.
+  - Unit names are `idunn-<target>-<sha256>` per incarnation.
+  - There are **391 failed `idunn-*` transient units** on Yggdrasil today.
+- **P10. No backup runs on Yggdrasil.**
+  - `gamecult-authority-backup.service` is not installed. The only backup timer is `dpkg-db-backup.timer`.
+  - The script `scripts/backup-gamecult-authority-yggdrasil.sh:74-76` would refuse at its first step anyway: it freezes `epiphany.service` and `epiphany-swarm.service`, which are absent (`freeze_unit` returns 1 when a unit is inactive).
+  - Its path list does not name any Idunn target's state root either, including `odin` and `streampixels-service`.
+- **P11. How Claude Code reaches MCP servers today** (`~/.claude.json`):
+  - `voidbot` at `:17875` is the **Yggdrasil-hosted** MCP, reached through the SSH tunnel (`start-yggdrasil-tunnel.ps1:24`).
+  - `aquasynth_dings` at `:17878` runs locally.
+  - The target's "Shape decided" says `eureka-state` is a local **stdio** server. That governs here. The HTTP convention recorded in memory is not a ruling.
+
+**Not probed:**
+
+- whether `cultnet-rs`'s RUDP client works on Windows;
+- whether Claude Code accepts a tool schema that `$ref`s a remote `$id`;
+- whether Qdrant accepts `.` in a collection name;
+- whether `ureq` without TLS covers both adapters;
+- which connection id Idunn's RUDP challenge uses.
+
+Each is assigned to a cut's first step below.
+
+## Standing rulings, checked against the maps
+
+| Ruling | Where it is recorded | Holds? |
+|---|---|---|
+| An instance owns its mind; a service owns the state | target 14 and 15; map rulings 14 and 15 | yes |
+| The organ depends on Qdrant directly, not on voidbot | target 16; map 16 | yes |
+| The organ shares voidbot's Qdrant, with the coupling declared | map 21 (Q9 A) | yes. "Declared" means an Idunn dependency, which the interim deploy (Q-H1 A) cannot express. The runbook states the coupling until 14-I. |
+| Identity is declared, not authenticated | map 18 (Q6 A) | yes |
+| The workstation reaches the organ over WireGuard | map 19 (Q7 A) | yes. P5 confirms the mesh; the ufw rule is Cut 14's. |
+| Eureka has no Persona | target 6; map 9 | yes |
+| Embeddings: Raven's Ollama (operator, 2026-09-26, for voidbot) | memory `nightwing-embedding-migration-2026-09-26.md` | **the target disagrees.** Target ruling 16 still says "Epiphany's own service embeds against a Yggdrasil-local endpoint … only voidbot uses Nightwing". Both endpoints are dead (P2). Self sweeps that sentence. Huginn uses the endpoint voidbot uses, with the same model. |
+| `open_items` and `history` are deleted, not kept as presets | read-side map (2026-09-17) | yes. Cut 13's old seven tools shrink to four. |
+| Q13 A: the client depends on `huginn-mind` for types only | map ~3931 | yes |
+| No committed mutation harness | operator, 2026-09-22 | yes. Old Cut 11 and 12's "Mutations:" lines are void. Soul runs `cargo-mutants` on each diff. |
+
+## 0b. Model page
+
+One row per persistent or long-lived kind these cuts touch. **A bold cell is empty or disputed.**
+
+| Kind | What names it | What happens to it over time | Who decides |
+|---|---|---|---|
+| **Index point**: one per indexable document | A v5-shaped UUID from `sha256(document id)` (P4's function, reused). The payload holds `doc_id`, `kind`, `root`, `ordinal` and `text_sha256`. | Written after the document's batch commits, off the serve loop. Never updated, because documents are immutable. Never deleted, except when its collection is rebuilt. A missing point is recreated by reconciliation. | Only the daemon's index worker writes one. `huginn-mind::index_text` decides what the text is. Qdrant decides nothing. |
+| **Collection**, one per mind | `huginn_mind_<instance>`. Its metadata is `{managed_by: "huginn", instance, model, model_digest, dimensions, index_text_version}`. | Created on the first reconciliation. Rebuilt whole when its metadata disagrees with the running configuration. **A collection whose mind is retired has no owner.** With one instance this is a recorded follow-up, not a cut. | The daemon serving that instance. It never touches a collection whose `managed_by` or `instance` is not its own. |
+| **Index text version** | `huginn_mind::index::INDEX_TEXT_VERSION` | Bumped whenever `index_text` changes. A bump makes every collection disagree, so each is rebuilt. | `huginn-mind` |
+| **Embedding model binding** | Model name plus the digest from `/api/tags`. Never the base URL (P4). | Changes when the operator changes the configuration, or when Raven re-pulls the model and the digest changes. Either one rebuilds the collection. | The operator, through the unit's arguments. The daemon verifies the binding at each reconciliation. |
+| Index health (behind or unreachable) | none: in-memory in the worker | Lost on restart, and recomputed by reconciliation at startup. Never persisted, never written to the mind. | The worker |
+| Pending semantic reply | `(session, message_id)` in the serve loop | Lives until the worker answers or the session times out. Lost on restart, and the client asks again. | `serve` |
+| **Eureka instance** | A slug. **The operator names it (Q-H4).** | Created by the first admission of its `instance` document, which Self writes at the first campaign. Never renamed: a rename is a new mind. | The operator names it. Admission enforces it (A1, `require_instance`). |
+| MCP registration | `eureka-state` at user scope in `~/.claude.json`, with the environment variables `EUREKA_INSTANCE` and `HUGINN_ENDPOINT` | One stdio child per Claude Code session. It dies with the session and holds nothing. | The operator, because it is configuration |
+| Deferred body (BP-3), client side | The manifest's `contentHash` | Fetched and verified per call, then dropped. Never written by `eureka-state`. | `cultnet_rs::fetch_content` owns verification. |
+| **Deployed daemon identity** | Interim (Q-H1 A): the systemd unit `huginn.service` on Yggdrasil, with runtime id `huginn-<slug>` (`daemon.rs:54-56`). Later: `idunn-huginn-<sha>`. | Interim: systemd restarts the unit, which is continuity. **The operator installs a new binary, which is deployment, and no brake gates it (Q-H1).** | Interim: the operator. After 14-I: Idunn. |
+| Mind store | `/var/lib/gamecult/huginn/minds/<slug>/mind.redb` | Preserved forever. It is the only truth. **No backup owner runs (P10), so this is Q-H2.** | The daemon is the single writer, through the redb lock. |
+| Firewall admission | A ufw rule: `10.77.0.1 17872/udp on wg-gamecult from 10.77.0.2` | Installed once. It dies in 14-I if Idunn's route owns it. | Interim: the operator |
+| Hand-off / imported mind | The leaf `hand_off` key | Admitted separately into each mind (P8). Import has no consumer (Q-H5). | `huginn-mind` admission |
+
+## Operator questions (one batch)
+
+**Q-H1. How does Huginn get onto Yggdrasil this week?**
+
+- **A. An interim operator-installed systemd unit, retired into Idunn by a named later cut (14-I).**
+  - The operator builds the binary in the pinned Rust image, at an exact revision, on Yggdrasil.
+  - It binds `10.77.0.1:17872` directly, with no nginx in the path.
+  - The state root is chosen now so that 14-I is a unit swap and no data moves.
+  - Costs:
+    - it contradicts the old authority map's "no operator script deploys Huginn directly";
+    - it has no deployment brake;
+    - the Qdrant coupling is written in a runbook rather than declared to Idunn.
+- **B. Wait for Idunn.** Huginn is deployed only through Idunn, after two things land: route continuity's route-proof class (its Q1 b) and a shared Rust runtime participant in `cultnet-rs`. "Wired in" does not close this week.
+- **C. Idunn now, against today's contract.**
+  - Huginn writes a third copy of the service-side presence, activation and lease code (Ghostlight's copy is 2,001 lines).
+  - It also has to answer the route challenge and pass Odin-correlated readiness.
+  - Its RUDP route goes through nginx UDP, whose reload loop is exactly what route continuity exists to fix. Every reload breaks RUDP sessions (route-continuity target).
+  - All of this is reworked when that campaign lands.
+- **Recommended: A,** with 14-I named, dated and blocked on route continuity plus the shared participant.
+  - Neither B nor C gives a working organ on a path that will survive.
+  - C would build the thing route continuity is deleting.
+  - A's authority gap is real. The operator, not a map, should accept it.
+- **Depends on it:** Cut 14's whole shape, whether this week closes, and whether 14-I exists.
+
+**Q-H2. Who backs up the mind?** The target requires a named backup owner. None runs (P10).
+
+- **A. Revive the authority backup.**
+  - Edit the freeze list: drop the two absent Epiphany units and add `huginn.service`.
+  - Add `var/lib/gamecult/huginn` to the path list.
+  - Install the timer.
+  - Side effect: daily backups resume for voidbot, Bifrost and Idunn configuration, including a daily pause of five containers.
+- **B. A Huginn-only timer:** freeze `huginn.service`, tar `minds/`, thaw. This makes a second backup mechanism.
+- **C. Ship with no backup,** and record it as a blocking follow-up.
+- **Recommended: A.** One owner of backup, and the script is already that owner. It is simply not running. **The operator must accept the side effects, and should know that Idunn targets' state (`odin`, `streampixels-service`) is in no backup either.**
+- **Depends on it:** Cut 14's gamecult-ops diff, and one verification step.
+
+**Q-H4. What is the Eureka instance called, and how many are there?**
+
+- **A. One instance for all Claude Code Eureka work,** for example `eureka`, with host `starfire`.
+- **B. One per workstation or per operator,** for example `metacrat.starfire`.
+- **Recommended: A.** Ruling 14 lets one instance steward several repos. Stewardship, not the instance, is what separates repos.
+- **Depends on it:** the unit's `--instance`, the state path, the collection name, and the MCP environment. It is cheap now and a new mind later.
+
+**Q-H5. Park Cut 12?** (the consumer audit)
+
+- Nothing that "wired in" needs calls a cross-mind hand-off or an import:
+  - there is one instance (Q-H4);
+  - no second mind exists;
+  - Epiphany's adoption is the second campaign.
+- Old Cut 12's `hand_off(&mut Mind from, &mut Mind to)` **cannot be built as specified**:
+  - each mind is locked by its own daemon process (P7);
+  - "both minds or neither" would need a cross-process protocol.
+- The hand-off already works as two ordinary admissions, one per mind, each derived and idempotent (P8).
+- **Recommended: park it.** The map keeps a note: the hand-off is two admissions, sender first. Import waits for a consumer. No tag is needed, because no code exists.
+- **Depends on it:** whether Cut 12 is built at all.
+
+**Q-H6. What does Eureka keep in typed state, and what stays in prose?**
+
+- **A. A hybrid.**
+  - Typed documents hold the questions, rulings, `cut_spec` (Hands' contract), `cut_report`, verdicts, findings, follow-ups and resolutions.
+  - The status header becomes a query.
+  - The committed map keeps only what has no kind: body facts, the model page, rationale, and the subtraction ledger narrative.
+  - Per-cut specs live only as `cut_spec`, so no spec exists twice.
+- **B. Typed state for records only.** Specs stay in the prose map, and `cut_spec` goes unused.
+- **C. Retire the markdown map entirely** (old Cut 15).
+- **Recommended: A.**
+  - B leaves the kind the leaf spent most of its bounds on without a consumer.
+  - C discards body facts and the model page, which no kind carries. Step 0b is what stopped re-cutting.
+- **Depends on it:** Cut 15's text, and the output format of every future Imagination pass, this one included.
+
+## Cut order
+
+```
+[BP-1 → BP-2 → RS-3 → BP-3]                     (in flight, other maps)
+        │
+BP-2 ──► 11a  Huginn: the index write side (text, adapters, worker, reconcile)
+        │      (after BP-2; may land before or after RS-3, serially on the branch)
+        ▼
+BP-3 ──► 11b  Huginn: semantic read (rank the hits through the one evaluator; non-blocking)
+        ▼
+       13a  Huginn: envelope moves to huginn-mind; eureka-state client core
+        ▼
+       13b  Huginn: the MCP surface, Windows build and install
+        │
+11a ──► 14   gamecult-ops: the interim unit, ufw, runbook, backup (Q-H1 A, Q-H2); the operator deploys
+        ▼
+       15   Eureka skill: typed-state wiring (Q-H6); after 13b is registered and 14 is live
+       ---
+       12   parked (Q-H5)        14-I  Idunn path, blocked (see the end)
+```
+
+## Cut 11a. The index write side
+
+- **Repo/branch:** Huginn, `eureka/memory-organ`, after BP-2. The worktree is named by Self.
+- **First:** Hands checks, in `ureq` 3's own Cargo manifest, that `default-features = false` gives plain HTTP with no TLS. If it does not, Hands uses `reqwest` with `blocking` and no TLS, and reports which.
+- **Deletes first:**
+  - `NoIndex` (`daemon.rs:20-27`) as the binary's index. It survives only in tests, or goes if the new worker's mock serves them.
+  - The "No crate opens that connection yet" line in `README.md`.
+
+**Adds, `huginn-mind/src/index.rs`.** This is pure: no network and no JSON.
+
+- `pub const INDEX_TEXT_VERSION: u32`.
+- `pub struct IndexEntry { id: PipelineRef, text: String, text_sha256: String, ordinal: u64 }`.
+- `pub fn index_text(&PipelineDocument) -> Option<String>`. It reads the leaf's fields (`lib.rs:510-578`), joined by newlines and bounded at `INDEX_TEXT_MAX_BYTES` (16 KiB, cut at a char boundary):
+
+  | Kind | Fields |
+  |---|---|
+  | campaign | `title` |
+  | target | `invariants[].statement`, `not_in_scope`, `canonical_implementations` |
+  | question | `title`, `question`, `options[].text` |
+  | ruling | `title`, `ruling`, `operator_quote` |
+  | cut_spec | `title`, `first`, `adds`, `keeps_moves` |
+  | cut_report | `commits[].subject`, `deviations` (`what`, `why`), `undone`, `promises[].text` |
+  | verdict | `claims[].claim` |
+  | finding | `claim`, `failure_scenario`, `evidence[].result` |
+  | follow_up | `item`, `why_it_can_wait` |
+  | resolution | `rationale`, **withdrawn ones included** (the Q17 B obligation) |
+  | hand_off | `reason` |
+  | instance, stewardship | none |
+
+- `impl Mind { pub fn index_entries(&self, only: Option<&[PipelineRef]>) -> Vec<IndexEntry> }`. The ordinal comes from the writing receipt (RS-1).
+- Owner: `huginn-mind`, because "which fields are text" is a rule about the leaf's documents, and RS-3 names Cut 11 its owner.
+  - Live consumer: the daemon's worker.
+  - Protected invariant: the text is derived, never stored, and never includes receipts, provenance or status.
+  - Why no existing owner serves: the leaf owns shape, not retrieval text, and the daemon owns no rule.
+
+**Adds, `huginn-daemon/src/index/`.** Three files: `mod.rs`, `ollama.rs`, `qdrant.rs`. The daemon depends on `ureq` (see First) and `serde_json`, and `serde_json` is used only in the two adapter files: that is the xenos boundary.
+
+- **Ports**, which are narrow traits so tests mock them:
+  - `Embedder { model_identity() -> ModelIdentity{name, digest, dimensions}; embed(&[String]) -> Vec<Vec<f32>> }`;
+  - `VectorIndex { describe(name) -> Option<CollectionMeta>; recreate(name, meta); ids(name) -> BTreeSet<String>; upsert(name, points) }`.
+
+  `search` is 11b's.
+- **The worker** is one thread that owns both ports and receives jobs over a channel.
+  - **`IndexSink::committed` builds the entries** (local and cheap) **and only enqueues them.** It never blocks and never waits on the network. This is the fix for P7.
+  - **At startup, one reconciliation:**
+    1. read the model identity;
+    2. `describe` the collection;
+    3. if it is absent, or its metadata disagrees, `recreate` it;
+    4. if the metadata names another `managed_by` or `instance`, refuse and log, and never recreate;
+    5. take `ids`, subtract, then embed and upsert what is missing, in batches of 32, with `wait=true`.
+  - **On failure:** log, keep the failed entries in memory, and retry with a backoff that starts at 30 s and is capped at 10 min.
+- **Options:** `--qdrant-url`, `--ollama-url` and `--embedding-model` join `parse_options` (`serve.rs:96`). **All three are required**, so there is no index-less mode. An unreachable index is a degraded projection, not a configuration.
+- **The query instruction constant** for qwen3 lives beside the Ollama adapter. 11b uses it.
+
+**Authority map.**
+
+- Owner: the typed mind owns truth, and the worker owns the projection.
+- Inputs: `IndexEntry`s built by `huginn-mind`, and the configuration.
+- Outputs: Qdrant points and collection metadata.
+- Derived state: the whole collection and the worker's in-memory health.
+- Forbidden writers: nothing else writes `huginn_mind_*`; voidbot never does; admission never waits on the index; the mind never stores index state; there is no `pending_index` document (old Cut 11 is superseded).
+- Shared paths: `IndexSink::committed` (live writes) and startup reconciliation share one embed-and-upsert routine.
+- Deletion line: `NoIndex` leaves the binary.
+
+**Verification** (Yggdrasil, stopgap, Rust image): `ygg-verify.sh F:/Projects/Huginn <sha> rust 'cargo test --locked --workspace'`, then `cargo mutants --in-diff` on the cut's range.
+
+| Test (behaviour) | Rule |
+|---|---|
+| `an_admission_replies_while_the_embedder_is_blocked` (the mock embedder waits on a barrier; `handle` returns `Committed` before the barrier is released) | The index never delays or refuses admission |
+| `reconcile_indexes_exactly_the_indexable_documents_the_collection_lacks` | The projection converges by set difference |
+| `a_model_digest_change_rebuilds_the_collection` (same name, different digest) | Compatibility is keyed on model and digest, **never on the URL**. At least one fixture pair must differ only in URL and expect **no** rebuild. |
+| `a_collection_owned_by_another_instance_is_never_recreated` | No cross-mind writes |
+| `index_text_ignores_admission_facts_and_indexes_withdrawn_resolutions` | Text is derived from the document alone, and Q17's obligation holds |
+| `point_ids_are_a_pure_function_of_the_document_id` (a fixed vector, computed by P4's algorithm) | Stable ids across restarts, with voidbot's convention |
+
+- **Negative greps:**
+  - `rg -n "ureq|reqwest|serde_json|qdrant|ollama" crates/huginn-mind/src` is empty;
+  - `rg -n "thread::spawn" crates/huginn-daemon/src` hits only `index/`.
+- **Live adapter check (operator-approved, because it writes to the shared Qdrant):** a scratch instance `verify.<rand>` on Yggdrasil admits two documents; its collection appears with P1-style parameters and the metadata above; then the collection is deleted by hand.
+
+**Estimate:** about 650 lines added, most of them tests. +`ureq`, +`serde_json` (daemon only). −`NoIndex` from the binary.
+
+**Build budget:** the Huginn workspace, on Yggdrasil only, with one release build for the live check.
+
+**Hands context:** about 150k tokens: `daemon.rs`, `serve.rs` and `mind.rs` headers plus the new code.
+
+## Cut 11b. Semantic read
+
+**Added 2026-09-29 (Self), from Soul's pass on 11a:**
+- **The mind judges every hit.** The index never deletes points. Withdrawn and
+  superseded documents are indexed on purpose, and point payloads carry no status. So
+  Qdrant supplies candidate ids and scores, and every hit is joined back through the
+  mind: ids the mind doesn't hold are dropped (a restored mind, or a second store), and
+  the rest are filtered by RS-3's in-force derivation, through selection. A hit is
+  never shown on the index's word alone.
+- **The effective embedding bound is the model's context, not 16 KiB.**
+  `qwen3-embedding:0.6b` takes 4096 tokens and Ollama truncates beyond that silently.
+  Long documents rank on their first ~4k tokens.
+- **Model identity is re-checked on each flush.** A model re-pulled with the same
+  dimensions and a new digest must not mix vectors until a restart. An idle mind whose
+  collection is lost also stays `Current` until the next upsert fails. Found by Soul on
+  11a's closing batch; 11b owns both.
+- **11a merged** into `eureka/memory-organ`. It was: Soul closed it on conditions. A fix batch is in Hands: pin the
+  backoff, reconcile again after any failure, label the collection with the mind's
+  identity, and merge BP-3.
+
+- **Repo/branch:** Huginn, after RS-3 and BP-3. Anchors are re-taken on their tip.
+- **Deletes first:**
+  - the refusal "semantic query: the index is not wired (Cut 11)", at both sites (`query.rs:296-299`, and the daemon test at `daemon.rs:534-541`, re-taken);
+  - the test `semantic_query_refuses_typed_until_wired`. Its rule dies; the replacements are below.
+
+**Adds.**
+
+- **`huginn-mind`:** `Mind::rank(&self, selection: &Selection, hits: &[(PipelineRef, f32)]) -> Result<PipelineSelectionPage, MindRefusal>`. Its rules:
+  1. A selection with a `cursor`, together with `semantic`, is refused `SelectionInvalid` (`field: "cursor"`), because semantic answers are not pageable.
+  2. The rows are restricted to hit ids present in the image as of `head`. A hit with no document is dropped and logged by the caller, never fabricated.
+  3. RS-3's own path runs: `cultnet_rs::validate`, the value door, then `select` over the restricted rows. **The one evaluator decides membership. Qdrant never filters.**
+  4. Order is score descending, with ties broken by ordinal.
+  5. Truncate to `limit`.
+  6. `next: None`.
+- **`huginn-daemon`:**
+  - A `Query` with `semantic` is not answered inline. `serve` stores `(session, message_id, request)` and sends a `Search { text, top_k }` job to the worker.
+  - The worker embeds with the query instruction and searches the collection, with no filter and an oversample of `min(top_k × 4, 200)`.
+  - The loop drains worker replies on each poll, calls `rank`, and replies on the stored session.
+  - When the worker is unhealthy, or the call fails: `Refused(Unavailable { detail })`, and the detail names the endpoint.
+- **`VectorIndex` gains `search`.**
+
+**Authority map:** the owner of membership is `rank`, over RS-3's evaluator. Qdrant supplies only a candidate set and scores. Forbidden: lowering a `FieldPredicate` into a Qdrant filter, because that would be a second evaluator; RS-3 §8 had left this to Cut 11, and this cut refuses it.
+
+**Verification:**
+
+| Test | Rule |
+|---|---|
+| `semantic_hits_pass_through_the_selections_own_predicates` (a hit of an excluded kind is absent) | One evaluator |
+| `semantic_results_are_ordered_by_score_not_ordinal` | Ranking |
+| `a_hit_without_a_document_is_dropped` | Qdrant is not truth |
+| `an_unreachable_embedder_is_refused_unavailable_never_an_empty_page` | Honest availability |
+| `another_session_is_answered_while_a_semantic_search_is_outstanding` (blocked mock embedder) | The loop never waits on the network |
+| `cursor_with_semantic_is_refused` | Not pageable |
+
+- **Live (operator-approved):** on the scratch instance, a paraphrase query returns a document that shares no exact words with it, and the hit resolves through the same page type.
+
+**Estimate:** about 350 lines added. No new dependencies.
+
+**Hands context:** about 150k tokens.
+
+## Cut 13a. The envelope moves to its owner; the client core
+
+- **Repo/branch:** Huginn, after 11b.
+- **Moves (ownership only; one commit that builds on its own):**
+  - `huginn-daemon/src/envelope.rs` (223 lines) moves to `huginn-mind/src/envelope.rs`: `encode_request`, `decode_request`, the response pair, `OperationFailure` and `FAILURE_SCHEMA`.
+  - `huginn-mind` gains `base64`. It already has `cultnet-rs` through RS-3.
+  - The daemon imports the module from `huginn-mind`.
+  - Rule: **one spelling of the operation envelope.** The client and the daemon cannot drift apart.
+  - Verified by the daemon's existing envelope tests, unchanged, run from their new home.
+- **Adds, `crates/eureka-state` (library part).**
+  - `Cargo.toml`: `huginn-mind` (types, envelope), `cultnet-rs`, `anyhow`, `serde`, `serde_json`.
+  - `HuginnClient { endpoint: SocketAddr, instance: Slug, timeout }`:
+    - its one method is `call(HuginnMindRequest) -> Result<HuginnMindResponse, ClientError>`;
+    - the transport is `CultNetRudpSocketTransportConnection` on `CULTNET_OPERATION_CONNECTION_ID`, channel `schema`, as the daemon expects (`serve.rs:283`);
+    - it resolves `Deferred` through `cultnet_rs::fetch_content`, capped at BP-3's `MAX_DEFERRED_BODY_BYTES` (imported, not copied);
+    - `ClientError::Unavailable { endpoint, detail }` is the only transport error.
+  - Owner: none over state; the client is a transport shim.
+  - Forbidden: opening a store, calling `Mind::open`, `admit` or `admit_prepared`, deriving status, or writing any file.
+
+**Verification** (Yggdrasil):
+
+| Test | Rule |
+|---|---|
+| `every_operation_round_trips_against_a_live_daemon` (an in-process daemon on `127.0.0.1:0` with a temp mind) | Pipeline smoke |
+| `a_closed_port_is_unavailable_naming_the_endpoint_within_the_timeout` | Loud unavailability. The timeout is a function of the configured value, so probe two values. |
+| `a_deferred_answer_resolves_to_the_same_page_as_a_direct_one` | BP-3's client side |
+| `a_foreign_instance_is_an_answer_not_an_error` | Refusals are data |
+
+- **Negative grep:** `rg -n "Mind::open|\.admit\(|admit_prepared|OwnedRedb|std::fs::(write|create)" crates/eureka-state/src` is empty.
+
+**Estimate:** about 300 lines added. The move is net 0.
+
+**Hands context:** about 120k tokens.
+
+## Cut 13b. The MCP surface, the build and the install
+
+- **Landed before it (2026-09-30, Self):** Cut 11b and its follow-ups merged to
+  `eureka/memory-organ` at `e3e0c38` and `ff39d80`. Cut 13a merged at `33641f4`
+  (Soul: no blocker; fixes at `3dc50ee`). 13a's client now has **two** errors:
+  `ClientError::Unavailable` (transport, timeout, out-of-protocol answer) and
+  `ClientError::Rejected { endpoint, code, detail }` (an envelope-level
+  `OperationFailure`). Its `timeout` bounds the whole call; answers are checked
+  against the request's id and operation; every call disconnects its session.
+  13b maps `Rejected` like `Unavailable`: a result with `isError: true` and the
+  typed body, so an MCP caller can tell a permanent mismatch from a down daemon.
+- **Built (2026-09-30):** `hands/cut13b` at `120e0a6`, green on Yggdrasil; Soul pass running. Windows
+  binary `C:\Users\Meta\.eureka\bin\eureka-state.exe` (from `63ac503`). **Registered by the operator**
+  (user scope), 2026-09-30. In Windows PowerShell the documented form
+  `claude mcp add ... -e K=V -- <exe>` fails with "missing required argument 'commandOrUrl'": the
+  variadic `-e` swallows the name and path. The form that worked puts positionals first:
+  `claude mcp add eureka-state <exe> --scope user -e EUREKA_INSTANCE=eureka -e HUGINN_ENDPOINT=rudp://10.77.0.1:17872`.
+  `whoami` answers `reachable: false` until Cut 14.
+- **Repo/branch:** Huginn, after 13a.
+- **First:**
+  1. Hands builds a 20-line scratch rmcp server whose tool schema carries a `$defs`-internal `$ref`, and confirms `claude mcp` lists and calls it. It is not committed.
+  2. Hands confirms the `claude mcp add` syntax from `claude mcp add --help`.
+- **Adds.**
+  - The binary `eureka-state` (`src/main.rs`) uses `rmcp = "2.2.0"`, the version Epiphany's lockfile already resolves, with `server`, `macros` and `transport-io`, plus `tokio` (`rt`, `macros`, `io-std`) and `schemars`.
+  - **Configuration comes from the environment:** `EUREKA_INSTANCE` and `HUGINN_ENDPOINT` (`rudp://10.77.0.1:17872`). Missing or invalid configuration does not stop startup. `whoami` reports it, and every other tool refuses it, typed. An MCP server that dies at startup vanishes silently from Claude Code.
+  - **Four tools, 1:1 with the wire.** The old `open_items`, `rulings_in_force`, `stewardship` and `history` tools are deleted designs. Their recipes move to the skill (Cut 15).
+
+    | Tool | Input | Output |
+    |---|---|---|
+    | `whoami` | `{}` | `{ instance, endpoint, reachable, status: Option<MindStatus> }` |
+    | `admit` | `{ faculty, agent, session, documents }` | `PipelineAdmissionOutcome`. `instance` and `provenance.tool = "eureka-state"` are filled in by the server, **never taken from input**. |
+    | `view` | `{ id }` | `Option<PipelineDocumentView>` |
+    | `query` | `{ selection, semantic? }` | `PipelineSelectionPage` |
+
+  - Refusals are successful tool results carrying the typed refusal. `Unavailable` is a result with `isError: true` and the typed body. Malformed input is `invalid_params`.
+  - **Input schemas are self-contained:** schemars output with the CultLib selection schema bundled into `$defs`, and no remote `$id` reference.
+
+**Verification.**
+
+- On Yggdrasil, a JSON-RPC exchange piped into the Linux build: `initialize`, `notifications/initialized`, then `tools/list`, which lists 4 tools and contains no `$ref` outside `#/$defs`. Then `whoami` against a closed port, which gives `reachable: false` and no JSON-RPC error.
+- Test `admit_ignores_any_instance_in_input`. The rule: declared identity is configuration, not a per-call argument.
+- **Windows (Starfire; Windows-only work, one job, nothing else running):** `cargo install --locked --path crates/eureka-state --root C:\Users\Meta\.eureka`. Hands reports the binary path and the build log's target directory.
+- **Registration is the operator's:** `claude mcp add --scope user eureka-state -e EUREKA_INSTANCE=<Q-H4> -e HUGINN_ENDPOINT=rudp://10.77.0.1:17872 -- C:\Users\Meta\.eureka\bin\eureka-state.exe`, in the syntax confirmed by First.
+- **Operator only, after Cut 14:** `whoami` from a Claude Code session answers `reachable: true`. This is the only proof of the Windows RUDP path over WireGuard.
+
+**Estimate:** about 400 lines added. +1 binary, +`rmcp`, +`tokio`.
+
+**Hands context:** about 180k tokens. rmcp's API is the unknown.
+
+## Cut 14. Interim deployment (under Q-H1 A and Q-H2 A)
+
+- **Repos:** gamecult-ops `main`, plus one line in Huginn's `README.md` for the run command. Depends on 11a, because the options exist from then.
+- **Deletes first:** from `scripts/backup-gamecult-authority-yggdrasil.sh:74-76`, the absent `epiphany-swarm.service` and `epiphany.service` in the freeze loop (under Q-H2 A).
+
+**Adds, gamecult-ops.**
+
+- **`systemd/huginn.service`:**
+  - `User=huginn`, with a system user created by the runbook;
+  - `ExecStart=/opt/gamecult/huginn/current/huginn-daemon --state-root /var/lib/gamecult/huginn --instance <Q-H4> --bind 10.77.0.1:17872 --qdrant-url http://127.0.0.1:6333 --ollama-url http://10.77.0.4:11434 --embedding-model qwen3-embedding:0.6b`;
+  - `Restart=on-failure`;
+  - `After=`/`Requires=wg-quick@wg-gamecult.service`, because the bind needs the interface;
+  - **no ordering on Qdrant or Raven**, because the index is a projection;
+  - `StateDirectory`/`ReadWritePaths` limited to `/var/lib/gamecult/huginn`;
+  - `ProtectSystem=strict`;
+  - `MemoryMax=768M`, which covers BP-3's 256 MiB deferral budget plus the mind.
+
+  Hands confirms the WireGuard unit's real name with `systemctl list-units` before writing `Requires=`.
+- **`runbooks/huginn-yggdrasil.md`:**
+  - Authority: the mind file is truth; the collection is disposable; Qdrant is shared with voidbot, and **this is the undeclared coupling ruling 21 wanted declared**; the embedder is Raven.
+  - Release body: build in `rust@sha256:4c2fd73e…` (the Odin binding's pinned image) at an exact revision, with `cargo build --locked --release -p huginn-daemon`. Install to `/opt/gamecult/huginn/releases/<sha>/`, then flip `current`.
+  - Install: user, directories, unit, and the ufw rule `ufw allow in on wg-gamecult from 10.77.0.2 to 10.77.0.1 port 17872 proto udp comment 'Huginn mind RUDP from Starfire'`.
+  - Verification.
+  - Recovery: stop the unit, delete `huginn_mind_<slug>` to force a rebuild, restore `minds/` from backup.
+  - **Retirement:** this unit, the ufw rule and the release section die in 14-I.
+- **`inventory.md`:** allocate 17872 to Huginn, and add a Huginn line to the Yggdrasil services list. The stale Nightwing embedding text (P2) belongs to the embedding migration's owner. Hands does not rewrite it. Hands reports it.
+- **Backup (under Q-H2 A):**
+  - add `var/lib/gamecult/huginn` to the tar list;
+  - add `huginn.service` to the freeze loop;
+  - install and enable `gamecult-authority-backup.timer`, which is operator-run.
+
+**Authority map (interim).**
+
+- Owner: the operator owns deployment and continuity until 14-I. Huginn owns its state.
+- Forbidden writers: nothing but the daemon writes `/var/lib/gamecult/huginn`. Nothing but the runbook's release step writes `/opt/gamecult/huginn`.
+- Deletion line: 14-I.
+
+**Verification (operator only; Hands does not deploy):**
+
+1. The unit reaches `active`.
+2. The daemon's stderr says it is serving `10.77.0.1:17872`.
+3. From Starfire, `eureka-state` `whoami` answers `reachable: true`.
+4. **Restart preserves state:** admit, run `systemctl restart huginn`, then `view` the document.
+5. **Negative:** a `whoami` from Raven (`10.77.0.4`) times out, because ufw admits Starfire only.
+6. **Negative:** stop the unit. The next `admit` is `Unavailable` naming the endpoint, and no file appears on Starfire.
+7. The collection `huginn_mind_<slug>` exists, with its metadata.
+8. **Backup:** run the backup service once. `tar --list` shows `var/lib/gamecult/huginn/minds/<slug>/mind.redb`.
+
+**Estimate:** about 150 lines of ops configuration and prose. +1 unit, +1 ufw rule, +1 port, +1 backup path, and backups resume.
+
+## Cut 15. Skill wiring (under Q-H6 A)
+
+- **Repo:** `GameCult/Eureka`, `main` at `19487f0` (`~/.claude/skills/eureka`). Depends on 13b being registered and 14 being live.
+- **The old Cut 15's anchors are stale:** `SKILL.md` is now 533 lines, and "Mind Steward" is now Life. Hands re-takes them. The sections to change:
+
+| Where | Change |
+|---|---|
+| `SKILL.md:8-19` (the substrate paragraph) | Eureka keeps questions, rulings, cut specs, reports, verdicts, findings, follow-ups and resolutions as typed documents in the instance's mind (Huginn), through the `eureka-state` tools. The committed target and map keep what has no kind. Delete "committed docs … memory files" as the store. |
+| §0 (`:58-72`) | Self calls `whoami` first. If the organ is unreachable, stop and say so. Then Self admits `stewardship` (if absent), `campaign` and `target`. |
+| §0b and §1 (`:74-165`) | Imagination admits `question`s and `cut_spec`s. The map document keeps body facts, the model page and rationale, and **has no per-cut spec sections**. "Commit the map" applies to that prose only. |
+| §2 (`:167-189`) | A ruling is admitted with `answers`, `choice` and `operator_quote`. Supersession is a `resolution`, never an edit. |
+| §3 (`:190-300`) | The Hands brief names the `cut_spec` id and the rulings in force. Hands admits a `cut_report`. `cargo-mutants` survivor triage goes into `cut_report.deviations`, or into a follow-up. |
+| §4 (`:304-335`) | Soul admits one `verdict` plus its `finding`s. Admitting is a Mind write, not a Body edit, so Soul stays read-only on repos. |
+| §5 and §6 (`:337-399`) | Triage outcomes are `resolution`s and `follow_up`s. The status header becomes a set of selection recipes. Self reconciles the ledger from `cut_report.structural_delta`. |
+| Self's discipline (`:401-451`) | Never restate typed state in prose. When the organ is unreachable, stop; never keep a second copy (the target's invariant). **Keep "Record the substrate you needed and did not have".** |
+| `references/briefs.md` | Each faculty's "read first" becomes selection recipes. Hands gets `view <cut_spec id>`. A new **Rehydrate** section: `whoami`, then the recipes. |
+| `references/cut-map.md` | Rewrite it as "Campaign state": the document set, the keys, the resolution matrix, and **selection recipes** in RS-3's vocabulary (below). The prose-map template shrinks to body facts, model page and rationale. |
+| `references/changelog.md` | A dated entry with this map's evidence. |
+
+**Selection recipes** to write. These replace the deleted presets, spelled in RS-3's aliases:
+
+- **rulings in force:** `schemas: [epiphany.pipeline.ruling.v2]`, `in_force = true`, `root = <campaign>`;
+- **open items:** questions, findings and follow-ups with `in_force = true`;
+- **specs with no report:** `cut_spec`s, with the hop `cut_spec` inbound and absent (Hands must confirm that the substrate can express absence; if it cannot, this recipe is two queries and says so);
+- **a subject's history:** `resolution`s with `subject` = X, `descending`.
+
+**Verification (Soul, by reading plus one live exercise).**
+
+- `rg -n "status header|WriterLeaseHeld|lease|open_items|rulings_in_force|Mind Steward" ~/.claude/skills/eureka` hits only changelog and history lines.
+- Every leaf kind is named by at least one brief.
+- No brief asks for prose relay of a typed artifact.
+- **Live:** a fresh agent given only the skill and the instance slug runs `whoami` and the rulings-in-force recipe against the live organ, and both return typed answers.
+
+**Estimate:** prose shrinks. `cut-map.md` is replaced, not extended.
+
+## Cut 12. Parked (Q-H5)
+
+Recorded, not built:
+
+- A hand-off is two admissions, one per mind, sender first. Each side's derivation already exists (P8).
+- Import waits for a consumer, most likely Epiphany's adoption campaign.
+- Old Cut 12's in-process `hand_off(&mut from, &mut to)` is infeasible under one daemon per mind (P7).
+
+## 14-I. Idunn path (blocked; not this week)
+
+Named so that the interim unit has a deletion line. Its dependencies:
+
+1. **Route continuity** (`Idunn/docs/route-continuity-target.md`, invariants 1, 2 and 5, and its Q1 b):
+   - Huginn declares no `odin.verse-rendezvous` dependency, so it is a route-proof target.
+   - No nginx reload on observation, because every reload breaks RUDP sessions.
+   - Stateful deadlines resolve (its Q3).
+2. **A shared Rust runtime participant** in `cultnet-rs`: presence signing, activation credential, lease adoption and the challenge answer. Otherwise Huginn writes a third copy (P9). The owner is CultLib.
+3. **Idunn has no path from a selected dependency's endpoint to a service argument.** Qdrant and Ollama will be `external-operator-binding` dependencies whose endpoints are duplicated in `argument_bindings`, as Ghostlight duplicates Odin's. Route this to Idunn.
+4. **The slot for `minds/<slug>/mind.redb` is `external-file`**, because redb is not Idunn's single-file CultCache format. It is one slot per instance, so the recipe names the instance.
+5. Whether the huginn-daemon hub (`serve.rs:138`, which drops other connection ids) receives Idunn's RUDP challenge. Not probed.
+
+The later Verse-presence cut (Q23 A) comes after 14-I.
+
+## Subtraction ledger (estimates; Self reconciles at each landing)
+
+| Cut | Removed | Added | Dependencies, targets, formats |
+|---|---|---|---|
+| 11a | `NoIndex` from the binary | ~650 | +`ureq`, +`serde_json` (daemon); +1 collection per mind |
+| 11b | the unwired refusal and its test | ~350 | none |
+| 13a | 223 (moved) | ~300 | +`base64` in `huginn-mind` (moved) |
+| 13b | the old design's 3 preset tools | ~400 | +1 binary; +`rmcp`, +`tokio` |
+| 12 | the whole cut (parked) | 0 | none |
+| 14 | 2 dead freeze entries | ~150 ops | +1 unit, +1 ufw rule, +1 port; backups resume |
+| 15 | per-cut prose sections, status headers | prose shrinks | `cut-map.md` replaced |
+
+## What in the old specs (cut map lines 5490-5866) is now wrong
+
+1. **Cut 11's `pending_index` document.** A mind admits exactly fifteen types (`mind.rs:84-88`), and this would be derived state in the truth store. It is replaced by reconciliation by set difference.
+2. **Cut 11's "indexing at admission, in the same call".** It blocks the single-threaded serve loop (P7). A cold embed takes 5-6 s (P3).
+3. **Cut 11's flags "following `epiphany.service`'s spelling (R16)" and its `10.77.0.1:11435` precedent.** Both endpoints are dead (P2).
+4. **The compatibility record ported from voidbot.** Its `embedderId` includes the host URL (P4). Compatibility keys on model and digest instead.
+5. **One shared collection with an `instance` payload.** It becomes one collection per mind.
+6. **Cut 12's two-mind in-process hand-off.** It is infeasible (P7), and the hand-off already works per mind (P8).
+7. **Cut 13's seven tools.** They become four, after the operator deleted `open_items` and `history` as presets.
+8. **Cut 13's "tool schemas equal the published schemas".** The published request schema will `$ref` CultLib's `$id` (RS-3 F9). MCP tool schemas must be self-contained.
+9. **Cut 13 is missing Deferred handling** (BP-3 §7).
+10. **Cut 14's `kind = cultcache-directory`.** No such kind exists (P9).
+11. **Cut 14's "`shared-infrastructure` dependency on Qdrant, Ghostlight's shape (`:168-187`)".** Ghostlight declares only Odin, and non-Idunn infrastructure is `external-operator-binding` (P9).
+12. **Cut 14's `idunn-huginn` unit name** in the backup freeze loop. Units are named per incarnation, `idunn-<target>-<sha>` (P9).
+13. **Cut 14's "Named owner: `gamecult-authority-backup.service`, daily at 03:20 UTC".** It is not installed, and it would refuse to run (P10).
+14. **Cut 14's route through nginx `rudp://10.77.0.1:17872` with presence health.** Huginn has no runtime participant, and route continuity is rewriting that path (P9).
+15. **Cut 15's anchors, and its "Mind Steward" name.** Its `open_items` plus `query` status header and its rehydration sequence both use deleted tools.
+16. **Q14 C** (move the mutation harness into the skill repo). It is moot: the harnesses were retired.
diff --git a/docs/history/postmortem-eureka-schema-phase.md b/docs/history/postmortem-eureka-schema-phase.md
new file mode 100644
index 0000000..4507f7f
--- /dev/null
+++ b/docs/history/postmortem-eureka-schema-phase.md
@@ -0,0 +1,226 @@
+<!-- Provenance: copied verbatim from GameCult/Epiphany ef956865 notes/postmortem-eureka-schema-phase.md; text below this line is unchanged. -->
+# Eureka pipeline state, schema-ownership phase: postmortem
+
+Date: 2026-09-16. Written at the phase boundary, not at the end of the
+campaign. Cuts 1-6d closed Epiphany's stake in the work; Cuts 7-16 build
+Huginn and the `eureka-state` client and are still running. Evidence: the cut
+map `notes/eureka-pipeline-state-cut.md`, the branch
+`codex/eureka-pipeline-state`, and the Soul reports recorded in the map's
+Landed section.
+
+## Summary
+
+Epiphany now owns the schemas for Eureka's pipeline state, in one leaf
+library that a separate organ can depend on without dragging the runtime in
+with it. `epiphany-pipeline` is 2,444 lines with its tests, 34 of them, and
+publishes 13 derived schemas. It has no dependency on `epiphany-core`; the
+dependency runs the other way. The public surface is five doors:
+registration, prepare, decode, write-envelope validation, and reference
+validation.
+
+The phase landed across 113 commits in three days. At writing, the leaf is
+pinned by Huginn at `5cda0886` and nothing in Epiphany blocks the organ.
+
+## Scope and invariants
+
+The target was schema ownership, and only that. The organ, the index, the
+CultNet surface and the MCP client were all excluded from this repo by
+design, because the previous shape put a store, a lease and git preconditions
+inside Epiphany and the operator rejected it mid-campaign.
+
+The invariants that had to survive: one owner per decision, a key grammar in
+which no reader can excuse a document it does not like, schemas that derive
+byte for byte from the types rather than being maintained beside them, and a
+leaf that a second repo can consume without inheriting the runtime.
+
+The earlier attempt failed by bundling. The repo-owned store design is kept
+in the map under History, clearly marked dead, rather than deleted, because
+the reason it died is the reason Cut 4 exists.
+
+## Timeline
+
+| Cut | What it owned | Outcome |
+|---|---|---|
+| 1-2 | Re-pin CultLib, collapse to one commit owner | Landed, Soul-closed |
+| 3a | Ten document kinds and schemas, plus store, lease, git gates | Landed, then half of it deleted by Cut 4 |
+| 4 | Delete the repo-owned store whole | 1,302 lines removed, 549 added |
+| 5 | Collapse the store profile back out | Landed |
+| 6 | Extract `epiphany-pipeline` as a leaf | Landed after two fix batches |
+| 6b | The key grammar | Three fix batches; the grammar was redesigned rather than patched a fourth time |
+| 6c | The Ghostlight shapes | Landed, one fix batch plus two harness repairs |
+| 6d | Resolution history and stewardship by sequence | Landed both sides; the Huginn follow-up needed its own fix batch |
+| follow-up | The public reference validator | Landed both sides, `5cda0886` and `5ba7b0c6` |
+
+## Structural delta
+
+Cut 4 is the honest headline: it deleted 1,302 lines and added 549, and
+retired one store format, one lease and two git preconditions. Cut 6 moved
+the types out of `epiphany-core` rather than copying them, so the extraction
+was a move and not a fork.
+
+The estimates were wrong in a consistent direction. Cut 4's test arithmetic
+was off because the deleted module held 20 tests on Windows rather than 15,
+and Cut 6's `epiphany-core` estimate of −623 should have read about −1,060
+once the test module travelled with the code. Both corrections are recorded
+in the map against the sections they falsify. Cut 6d's test delta was +181,
+not the +173 claimed.
+
+Nothing was parked in this phase.
+
+## What Soul caught
+
+Green tests passed all of the following.
+
+**Split and mislocated authority.** The epoch guard had no test that could
+even construct an envelope to reach it, so an `if false` mutation survived.
+Self ruled deletion over testing what nothing can construct, and Cut 8 wrote
+it in the organ where admission can reach it. Separately, the write path was
+believed live and was in fact test-only; `decode` and the CultCache imports
+looked live only because dead code mentioned them.
+
+**A rule open one level up, three times.** The key grammar was patched twice
+and the same invariant came back both times. The third occurrence was the
+signal to redesign rather than patch. Soul then found no collision in 212,450
+adversarial keys against the new grammar.
+
+**Readers excusing what writers refuse.** The reader accepted a trailing dot
+on the root and the local while the writer refused it, so a reference with
+trailing junk passed the reader against its own documentation. A mutant
+excusing the `Instance` root from the kind check survived: exactly the shape
+Cut 6b existed to kill.
+
+**Tests pinning spelling instead of rules.** A depth test restated the
+literal 64 rather than referencing the bound, so moving both to 60 passed it.
+Fixtures that used the sequence 1 at every nesting level left a nested
+resolution's own sequence unpinned.
+
+**A regression introduced by an earlier fix.** An exact replay of any batch
+carrying a derived write was refused rather than recognised as already
+admitted, because the derivation recomputed a sequence over an image that
+already held the first admission's record. The replay test had used only
+batches without derivations.
+
+**Ordering by key rather than by meaning.** The hand-off replay picked its
+subject by key order, so from the eleventh transfer on, where `n11` sorts
+before `n2`, it derived a withdrawal of the wrong record. Ten round trips
+alone did not expose it.
+
+**Dead code with a test that could not reach it.** The resolution-base arm of
+the reinstatement rule was unreachable because the depth cap fired first.
+Deleting it was the point: a rule defended by a test that cannot run is the
+failure mode of subtraction, not a defence against it.
+
+## Operator corrections
+
+**The repo-owned store.** The operator rejected it mid-campaign, and Cut 4
+deleted it whole rather than demoting it. This is the single largest
+correction of the phase and the reason the leaf is clean.
+
+**A hand-off is a transfer, not a lease.** Self had modelled every stewardship
+hand-off as a loan that returns. The operator's example was Odin holding a
+swarm of infrastructure tools and spinning off a new steward when the
+workload justifies it, with no return. The missing context was that Self had
+only ever seen the cross-cutting case, where borrowing is the natural reading.
+
+**Withdrawn resolutions are kept.** Self's default threw the record away.
+The operator's model was a subject as a question with one canonical answer
+and an affordance for withdrawal, where the withdrawn answer is context to
+learn from. The operator also named the assumption the ruling rests on: that
+the context actually reaches the agents. Self had landed the opposite default
+and reverted it.
+
+**Single-writer semantics are CultCache's.** Self attributed them to redb.
+redb is the storage engine underneath; the owned store lock and the
+compare-and-swap batch are CultCache's, and were built in this same session.
+
+**Stop spending the scarce model on Hands.** The default model inherits the
+root's, so every dispatch had been running on Fable without anyone choosing
+it. The rule now is to name the model on every dispatch.
+
+## Incidents
+
+**Cargo through the Bash tool.** `CARGO_TARGET_DIR=C:\...` has its
+backslashes collapsed, and cargo starts a from-scratch build into a path that
+does not exist. Nothing landed in the shared directory. Cargo on this host
+runs through PowerShell only.
+
+**A scoped `cargo clean` against the brief.** Hands freed and partly retook
+about 400 MB of the shared target directory. Soul could not establish that
+another crate's artifacts were evicted. The next brief forbids it by name.
+
+**Agents ending their turn mid-job, three times.** The briefs now name the
+mechanism rather than the intent: a wait is a foreground poll loop inside one
+tool call. One agent left detached timers that re-fired notifications for an
+hour, so the briefs also forbid background monitors that outlive the run.
+
+**The harness ate fixes.** An early mutation runner restored from a sidecar
+that predated the fix it was testing, reverting real work. A later version
+committed a NUL byte and a literal control character into a target. The
+current harness reads the original as bytes, writes the sidecar before any
+write, restores hash-first, attempts every target, and prints the original
+digest before rethrowing. A tool-enforced timeout was the exact path that
+left a tree mutated, so the harness now owns its own timeout and kills the
+process tree inside its own cleanup.
+
+**Map splices landing at the wrong heading depth.** A specification written
+in a scratchpad began one level deeper than the map's section, and the fold
+put every heading under it a level too deep.
+
+**My own errors in the map**, each corrected in place: a follow-up number
+used twice, an ungreppable regex, seventeen entries described as nineteen, a
+zip digest labelled as the DLL's, a claim that CI was green throughout, an
+overstated scar, and one commit attributed to its neighbour.
+
+## What worked
+
+**Mutation suites as the unit of proof, not test counts.** Every operator
+ruling and every new rule gets a test that fails under its own mutation, and
+the suite is committed with a no-op control that proves the harness restores
+bytes exactly. The controls caught the harness eating fixes; test counts
+never would have.
+
+**A revert mutation and a loosening mutation per rule.** A plain revert is
+too easy a target. The loosening is what found the reader excusing a root
+kind and the unpinned nested sequence. When a loosening turns out to be
+unfalsifiable by construction, it is demoted to a recorded note with the
+reason rather than left in the suite implying coverage it does not have.
+
+**Redesigning on the third occurrence.** The key grammar came back twice
+under patches. The rule that emerged is to treat the third appearance of an
+invariant as evidence about the design, not about the instance.
+
+**Keeping dead designs marked rather than deleted.** The repo-owned store
+sections carry banners naming their false sentences. A reader who finds the
+old model finds it labelled.
+
+**Not capping the Soul loop on a foundation cut.** Cuts 6 and 6b each took
+four passes and the later passes still found real defects.
+
+## What to change in the pipeline
+
+All four of these were approved by the operator on 2026-09-16 after a cost
+review that put roughly half the overhead on process waste and roughly half
+on the inescapable cost of a second agent.
+
+1. **A loosening mutation per rule, alongside the revert.** Landed in the
+   Hands brief.
+2. **One harness in the Eureka repository.** Owed. The PowerShell harness
+   still lives in `F:\Projects\Epiphany\tools\` and Huginn reaches across for
+   it; CultLib's JavaScript runner needs the same contract by name.
+3. **Reports are findings, promises and numbers only, and a second Soul pass
+   is scoped to the fix batch diff.** Landed in both briefs.
+4. **A map commit per cut, rulings excepted.** In effect.
+
+## Open follow-ups
+
+- **Cut 9's spec text calls the `V10L` loosening failable.** It was demoted
+  when the reference validator made it unfalsifiable. Stale text in the map's
+  Cut 9 section, harmless to the code.
+- **FU-9: CultLib's lock failure is text-matched.** `cultcache-rs` needs a
+  typed error. Owner is CultLib, and it can wait because the only consumer
+  matching the text is a test.
+- **FU-1 through FU-8** stand as recorded in the map, each with its file and
+  its reason.
+- **Cut 11 must index withdrawn resolutions with their reasons.** This is the
+  second obligation the operator's Q17 ruling created; the first, a history
+  view, landed in Cut 9.

From 87b6455612936fb4177758c550a3ecff21197e4d Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 14:20:50 +0200
Subject: [PATCH 04/11] Test that a PipelineRefusal read as text names its
 variant and parts

Kills the one cargo-mutants survivor on eureka-pipeline (Display::fmt replaced
by Ok(Default::default())).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/eureka-pipeline/src/lib.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/crates/eureka-pipeline/src/lib.rs b/crates/eureka-pipeline/src/lib.rs
index 7bd75f3..fbf5c83 100644
--- a/crates/eureka-pipeline/src/lib.rs
+++ b/crates/eureka-pipeline/src/lib.rs
@@ -2772,6 +2772,18 @@ mod tests {
         Ok(())
     }
 
+    /// A refusal read as text names its variant and its parts, so an operator
+    /// who sees only the message (a log line, an `anyhow` chain) can tell which
+    /// field was refused and why.
+    #[test]
+    fn a_refusal_read_as_text_names_its_variant_and_parts() {
+        let text = PipelineRefusal::FieldBound { field: "title".into(), limit: 200, actual: 201 }.to_string();
+        assert!(text.starts_with("pipeline refusal: "), "{text}");
+        for part in ["FieldBound", "title", "200", "201"] {
+            assert!(text.contains(part), "{part} is missing from {text}");
+        }
+    }
+
     /// The catalogue is exactly the files beside it: every entry's `path` is a
     /// schema file in the directory, and every schema file in the directory
     /// has an entry, so a schema removed from the catalogue (or a file left

From 44be4cd56490e3901a33edd6ff6f86f41c6508d9 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 14:56:04 +0200
Subject: [PATCH 05/11] WIP: golden corpus and dump for the wire parity test
 (golden still empty)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/eureka-pipeline/golden/envelopes.txt |    0
 crates/eureka-pipeline/src/lib.rs           | 6564 ++++++++++---------
 2 files changed, 3335 insertions(+), 3229 deletions(-)
 create mode 100644 crates/eureka-pipeline/golden/envelopes.txt

diff --git a/crates/eureka-pipeline/golden/envelopes.txt b/crates/eureka-pipeline/golden/envelopes.txt
new file mode 100644
index 0000000..e69de29
diff --git a/crates/eureka-pipeline/src/lib.rs b/crates/eureka-pipeline/src/lib.rs
index fbf5c83..a3c4b22 100644
--- a/crates/eureka-pipeline/src/lib.rs
+++ b/crates/eureka-pipeline/src/lib.rs
@@ -1,3229 +1,3335 @@
-//! Eureka pipeline documents: the typed shape of a Eureka campaign's state.
-//!
-//! This is a leaf type library, and deliberately nothing else. It owns document
-//! shape, field bounds, formats, key derivation and the JSON schemas published
-//! under `schemas/cultnet`; it owns no storage, no admission, no process and no
-//! network. That is the whole reason it is a package: the organ that will admit
-//! these documents depends on these types without depending on the harness
-//! that used to hold them.
-//!
-//! Every kind is a plain `serde` + `JsonSchema` value inside a one-slot
-//! `DatabaseEntry` wrapper, always prepared with `prepare_entry_named`, so the
-//! stored payload is `[value]` and the value is the named map the published
-//! schema describes. Keys are semantic: `pipeline_key` derives them from the
-//! value, and the write validator refuses any envelope whose key differs.
-//!
-//! Every key is `<root>:<kind>:<local>`, three segments for every kind with
-//! none excused: the root is a `Slug`, the kind is the literal kind name, and
-//! the local is `Label`s joined by `.`, so no local part carries a dot and a
-//! reader recovers the parts by splitting. A root's local is the constant
-//! `self`; a resolution's local is its subject's kind and local. A
-//! resolution's local ends in its per-subject sequence, `n<N>`, and a
-//! stewardship's in its per-repo sequence, so a subject's resolutions and a
-//! repo's assignments each share a prefix.
-//!
-//! **Validation follows the type.** `value_types!` is the single field list: it
-//! emits the struct and its `Bounded` impl from the same tokens, so a field
-//! cannot be declared without being validated. Format rules live in the field's
-//! type (`Label`, `Slug`, `OrgRepo`, `Sha`, `Sha256Hex`, `Date`), never in a
-//! hand-written impl that a later field can slip past. A `Vec` field must carry
-//! a maximum, because `Vec<T>` has no `Bounded` impl of its own.
-//!
-//! The wrappers are crate-private: outside code registers, prepares and
-//! decodes them through `register_pipeline_document_types`,
-//! `PipelineDocument::prepare` and `PipelineDocument::decode`, and validates a
-//! write through `validate_pipeline_write_envelope`.
-
-// `anyhow` is the cache's own error type, which `prepare` and the registrar
-// pass through; every refusal this crate decides is a `PipelineRefusal`.
-use anyhow::Result;
-use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry};
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-/// Typed refusals of the pipeline documents: bounds, formats and key identity
-/// (D2's document half), and `ForeignStore`, raised by `decode` for an
-/// envelope of any other type. This is every refusal the leaf decides; a
-/// store's identity and its schema epoch are not decided here, since this
-/// crate owns no store, and belong to the organ that will admit these
-/// documents.
-///
-/// Serialised externally tagged, serde's default for an enum: each variant is
-/// a one-key map from the variant's name to its named fields, so `field` and
-/// `value` are on the wire under their own names and a reader of a refusal
-/// carried over a wire reads the same parts a local caller matches on. No
-/// attribute buys that, which is why there is none: an internal or adjacent
-/// tag would move the fields under a content key without making any of them
-/// more visible.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-pub enum PipelineRefusal {
-    FieldBound { field: String, limit: u32, actual: u32 },
-    InvalidFormat { field: String, value: String },
-    InvalidIdentity { kind: PipelineKind, key: String, expected: String },
-    DuplicateRepo { field: String, repo: String },
-    ForeignStore { r#type: String },
-}
-
-impl std::fmt::Display for PipelineRefusal {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(formatter, "pipeline refusal: {self:?}")
-    }
-}
-
-impl std::error::Error for PipelineRefusal {}
-
-pub(crate) trait Bounded {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal>;
-}
-
-impl<T: Bounded> Bounded for Option<T> {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-        self.as_ref().map_or(Ok(()), |value| value.validate(field))
-    }
-}
-
-macro_rules! unbounded_scalars {
-    ($($ty:ty),* $(,)?) => {$(
-        impl Bounded for $ty {
-            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
-                Ok(())
-            }
-        }
-    )*};
-}
-
-unbounded_scalars!(u32, u64, bool);
-
-fn bound(field: &str, limit: usize, actual: usize) -> Result<(), PipelineRefusal> {
-    if actual > limit {
-        return Err(PipelineRefusal::FieldBound {
-            field: field.into(),
-            limit: limit as u32,
-            actual: actual as u32,
-        });
-    }
-    Ok(())
-}
-
-/// List maximums only. Minimum counts are admission rules with their own
-/// refusals (Cut 3b), so a bounds pass never pre-empts them.
-fn list<T: Bounded>(field: &str, items: &[T], max: usize) -> Result<(), PipelineRefusal> {
-    bound(field, max, items.len())?;
-    for (index, item) in items.iter().enumerate() {
-        item.validate(&format!("{field}[{index}]"))?;
-    }
-    Ok(())
-}
-
-fn format_error(field: &str, value: &str) -> PipelineRefusal {
-    PipelineRefusal::InvalidFormat {
-        field: field.into(),
-        value: value.into(),
-    }
-}
-
-fn hex(field: &str, value: &str, lengths: std::ops::RangeInclusive<usize>) -> Result<(), PipelineRefusal> {
-    let lower_hex = value.bytes().all(|byte| matches!(byte, b'0'..=b'9' | b'a'..=b'f'));
-    if !lengths.contains(&value.len()) || !lower_hex {
-        return Err(format_error(field, value));
-    }
-    Ok(())
-}
-
-/// A key label: `[A-Za-z0-9_-]{1,64}`. Dots are excluded so that a composed key
-/// segments unambiguously; see `local`.
-fn label_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
-    let valid = value
-        .bytes()
-        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'));
-    if !valid || value.is_empty() || value.len() > 64 {
-        return Err(format_error(field, value));
-    }
-    Ok(())
-}
-
-/// A dotted key segment: label parts joined by `.`, at most 64 bytes. Every
-/// part must be a label, so `..`, a leading or trailing dot, and an empty part
-/// are all refused.
-fn dotted_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
-    dotted_within(field, value, 64)
-}
-
-/// `dotted_text`'s grammar with the bound as a parameter: the one place a
-/// dotted segment is parsed, whoever owns the bound.
-fn dotted_within(field: &str, value: &str, max: usize) -> Result<(), PipelineRefusal> {
-    if value.is_empty() || value.len() > max {
-        return Err(format_error(field, value));
-    }
-    for part in value.split('.') {
-        label_text(field, part)?;
-    }
-    Ok(())
-}
-
-/// GitHub's own grammar for `owner/repo`, exactly one `/`: the owner is
-/// `[A-Za-z0-9-]`, 1 to 39 bytes, with no leading or trailing hyphen; the repo
-/// is `[A-Za-z0-9._-]`, 1 to 100 bytes, is never `.` or `..`, and does not end
-/// in `.git`, ASCII-case-insensitively (`a/b.GIT` is refused exactly as
-/// `a/b.git` is), so the suffix rule cannot be dodged by a case variant whose
-/// `identity()` is refused. The repo's own byte alphabet excludes `/`, so a
-/// second `/` inside it is already refused by the byte check; no separate
-/// `contains('/')` check is needed.
-fn org_repo_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
-    let valid = value.split_once('/').is_some_and(|(owner, repo)| {
-        (1..=39).contains(&owner.len())
-            && owner.bytes().all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
-            && !owner.starts_with('-')
-            && !owner.ends_with('-')
-            && (1..=100).contains(&repo.len())
-            && repo.bytes().all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
-            && repo != "."
-            && repo != ".."
-            && !(repo.len() >= 4 && repo[repo.len() - 4..].eq_ignore_ascii_case(".git"))
-    });
-    if valid {
-        Ok(())
-    } else {
-        Err(format_error(field, value))
-    }
-}
-
-macro_rules! bounded_text {
-    ($($(#[$doc:meta])* $name:ident = $limit:literal, $check:expr;)*) => {$(
-        #[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
-        #[serde(transparent)]
-        #[schemars(extend("maxLength" = $limit))]
-        $(#[$doc])*
-        pub struct $name(pub String);
-        impl Bounded for $name {
-            fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-                let check: fn(&str, &str) -> Result<(), PipelineRefusal> = $check;
-                check(field, &self.0)
-            }
-        }
-        impl From<&str> for $name {
-            fn from(value: &str) -> Self {
-                Self(value.into())
-            }
-        }
-    )*};
-}
-
-fn within(limit: usize) -> impl Fn(&str, &str) -> Result<(), PipelineRefusal> {
-    move |field: &str, value: &str| bound(field, limit, value.len())
-}
-
-/// A title holds at least one `char::is_alphanumeric()` character, no
-/// `char::is_control()` character, no U+2028 LINE SEPARATOR or U+2029
-/// PARAGRAPH SEPARATOR (both `Zl`/`Zp`, so `is_control()` does not reach
-/// them, and a one-line field should carry no hard line break), and no bidi
-/// control character: `U+061C`, `U+200E`, `U+200F`, `U+202A`-`U+202E`,
-/// `U+2066`-`U+2069`. No denylist of individual zero-width or format
-/// characters is maintained here; a character not covered by one of these
-/// tests is allowed, so ZWJ and ZWNJ still work.
-fn title_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
-    let alphanumeric = value.chars().any(|character| character.is_alphanumeric());
-    let control = value
-        .chars()
-        .any(|character| character.is_control() || matches!(character, '\u{2028}' | '\u{2029}'));
-    let bidi = value.chars().any(|character| {
-        matches!(
-            character,
-            '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}'
-        )
-    });
-    if !alphanumeric || control || bidi {
-        return Err(format_error(field, value));
-    }
-    within(200)(field, value)
-}
-
-bounded_text! {
-    /// Text of at most 200 UTF-8 bytes.
-    Short = 200, |field, value| within(200)(field, value);
-    /// A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema
-    /// length counts characters. Holds at least one alphanumeric character,
-    /// no control character, and no bidi control character (`U+061C`,
-    /// `U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).
-    #[schemars(extend("minLength" = 1))]
-    Title = 200, title_text;
-    /// Text of at most 1,000 UTF-8 bytes.
-    Line = 1000, |field, value| within(1000)(field, value);
-    /// Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.
-    Para = 4000, |field, value| within(4000)(field, value);
-    /// A key label: `[A-Za-z0-9_-]{1,64}`.
-    Label = 64, label_text;
-    /// A campaign slug or key segment: label parts joined by `.`.
-    Slug = 64, dotted_text;
-    /// A git commit id: 7-40 lowercase hex characters.
-    Sha = 40, |field, value| hex(field, value, 7..=40);
-    /// A full git commit id: exactly 40 lowercase hex characters.
-    FullSha = 40, |field, value| hex(field, value, 40..=40);
-    /// A SHA-256 digest: exactly 64 lowercase hex characters.
-    Sha256Hex = 64, |field, value| hex(field, value, 64..=64);
-}
-
-impl Sha {
-    /// The type's identity rule: two spellings name one commit when one is a
-    /// prefix of the other, so a 7-character abbreviation and the full id of
-    /// the same commit are equal here though not `==`. Both are already 7-40
-    /// lowercase hex. Two distinct commits that share a 7-character prefix are
-    /// git's ambiguity, not the mind's.
-    pub fn names_same_commit(&self, other: &Sha) -> bool {
-        self.0.starts_with(&other.0) || other.0.starts_with(&self.0)
-    }
-}
-
-impl Slug {
-    /// The public door onto the slug grammar, for a caller outside this crate
-    /// that holds a bare `Slug` and no way to reach `Bounded`, which is
-    /// crate-private. On the pattern of `PipelineRef::validate_ref`: it
-    /// delegates so the grammar keeps one owner, and it applies exactly the
-    /// `dotted_text` check that every `Slug` field in this crate is held to,
-    /// so a caller that validates a declared name this way and a document
-    /// field of the same type refuse the same inputs. Named `validate_slug`
-    /// rather than a bare `validate`, because an inherent `validate` would
-    /// shadow `Bounded`'s for every in-crate caller holding a `Slug`.
-    pub fn validate_slug(&self) -> Result<(), PipelineRefusal> {
-        Bounded::validate(self, "slug")
-    }
-}
-
-/// A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +
-/// 100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or
-/// trailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never
-/// `.` or `..`, and does not end in `.git`, ASCII-case-insensitively.
-/// Identity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`
-/// are the same repository.
-//
-// The raw string is display-only. `OrgRepo` is not generated by
-// `bounded_text!`: that macro derives `PartialEq`, `Eq`, `Hash`, `PartialOrd`
-// and `Ord` on the raw string, with no per-member override, so a type built
-// from it compares and keys on spelling. `OrgRepo` instead carries
-// hand-written impls of those five traits, every one of them over
-// `identity()` (the ASCII-lowercased value), so `==`, a `BTreeMap` key and a
-// `HashMap` key are all case-insensitive by construction: `GameCult/Epiphany`
-// and `gamecult/epiphany` compare equal, hash equal, order together and
-// collapse to one map entry, and a caller cannot reach the case-sensitive
-// behaviour by accident. `Hash` and `Eq` agree because both are defined over
-// the same `identity()` string. Every other bounded type keeps the macro's
-// derives untouched. This reasoning is a source comment, not a doc comment,
-// so it does not enter the published schema description (RS-L closing fix 2):
-// a consumer needs the grammar, the bound and the case-insensitivity, not the
-// Rust-macro justification for how that got built.
-#[derive(Clone, Debug, Default, Serialize, Deserialize, JsonSchema)]
-#[serde(transparent)]
-#[schemars(extend("maxLength" = 140))]
-pub struct OrgRepo(pub String);
-
-impl Bounded for OrgRepo {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-        org_repo_text(field, &self.0)
-    }
-}
-
-impl From<&str> for OrgRepo {
-    fn from(value: &str) -> Self {
-        Self(value.into())
-    }
-}
-
-impl PartialEq for OrgRepo {
-    fn eq(&self, other: &Self) -> bool {
-        self.identity() == other.identity()
-    }
-}
-
-impl Eq for OrgRepo {}
-
-impl std::hash::Hash for OrgRepo {
-    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
-        self.identity().hash(state);
-    }
-}
-
-impl PartialOrd for OrgRepo {
-    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-impl Ord for OrgRepo {
-    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
-        self.identity().cmp(&other.identity())
-    }
-}
-
-impl OrgRepo {
-    /// The public door onto the `org_repo` grammar, for a caller outside this
-    /// crate that holds a bare `OrgRepo` (the organ's `repo` alias, RS-3) and
-    /// no way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
-    /// delegates to `org_repo_text` through `Bounded::validate`, so the
-    /// grammar keeps one owner and a declared name checked this way refuses
-    /// exactly what a document's own `OrgRepo` field refuses.
-    pub fn validate_org_repo(&self) -> Result<(), PipelineRefusal> {
-        Bounded::validate(self, "org_repo")
-    }
-
-    /// The one canonical key for an `OrgRepo`: the value, ASCII-lowercased.
-    /// Every comparison, hash, ordering and lookup keyed by repository
-    /// identity goes through this — `PartialEq`, `Hash` and `Ord` above are
-    /// all defined in terms of it — so `GameCult/Epiphany` and
-    /// `gamecult/epiphany` are the same repository everywhere, not only where
-    /// a caller remembers to ask.
-    pub fn identity(&self) -> String {
-        self.0.to_ascii_lowercase()
-    }
-}
-
-impl Label {
-    /// The public door onto the label grammar, for a caller outside this
-    /// crate that holds a bare `Label` (the organ's `cut` alias, RS-3) and no
-    /// way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
-    /// delegates to `label_text` through `Bounded::validate`, so the grammar
-    /// keeps one owner and a declared name checked this way refuses exactly
-    /// what a document's own `Label` field refuses.
-    pub fn validate_label(&self) -> Result<(), PipelineRefusal> {
-        Bounded::validate(self, "label")
-    }
-}
-
-/// A calendar date, `YYYY-MM-DD`.
-#[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
-#[serde(transparent)]
-#[schemars(extend("maxLength" = 10))]
-pub struct Date(pub String);
-
-impl Bounded for Date {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-        match chrono::NaiveDate::parse_from_str(&self.0, "%Y-%m-%d") {
-            Ok(_) if self.0.len() == 10 => Ok(()),
-            _ => Err(format_error(field, &self.0)),
-        }
-    }
-}
-
-macro_rules! bounded_field {
-    ($value:expr, $field:expr) => {
-        Bounded::validate(&$value, $field)?
-    };
-    ($value:expr, $field:expr, $max:literal) => {
-        list($field, &$value, $max)?
-    };
-}
-
-/// The single field list: one invocation emits the value struct and its
-/// `Bounded` impl, so a field can never be left out of validation.
-macro_rules! value_types {
-    ($($(#[$attr:meta])* pub struct $name:ident { $($field:ident: $ty:ty $([$max:literal])?),* $(,)? } $(=> $extra:path)?)*) => {$(
-        $(#[$attr])*
-        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-        pub struct $name {
-            $(
-                $(#[schemars(extend("maxItems" = $max))])?
-                pub $field: $ty
-            ),*
-        }
-
-        impl Bounded for $name {
-            fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
-                $(bounded_field!(self.$field, &format!("{at}.{}", stringify!($field)) $(, $max)?);)*
-                $($extra(self, at)?;)?
-                Ok(())
-            }
-        }
-    )*};
-}
-
-macro_rules! unit_enums {
-    ($($name:ident { $($variant:ident),* $(,)? })*) => {$(
-        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
-        pub enum $name { $($variant),* }
-        impl Bounded for $name {
-            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
-                Ok(())
-            }
-        }
-    )*};
-}
-
-/// RS-L closing fix 4: `campaign.repos` refuses two entries naming the same
-/// repository by identity, not by raw spelling, so `GameCult/Epiphany` and
-/// `gamecult/epiphany` in one list refuse exactly as one entry twice would.
-/// This is a cross-element invariant on `PipelineCampaign` alone, not a
-/// per-type format rule any other `value_types!` struct shares, so it is
-/// wired in as that struct's one `=> extra` hook rather than folded into
-/// `Bounded for OrgRepo` or the list bound in `bounded_field!`.
-fn campaign_repos_are_distinct(campaign: &PipelineCampaign, at: &str) -> Result<(), PipelineRefusal> {
-    let mut seen = std::collections::HashSet::new();
-    for repo in &campaign.repos {
-        if !seen.insert(repo.identity()) {
-            return Err(PipelineRefusal::DuplicateRepo {
-                field: format!("{at}.repos"),
-                repo: repo.0.clone(),
-            });
-        }
-    }
-    Ok(())
-}
-
-unit_enums! {
-    EvidenceKind { Command, Test, Mutation, Probe, SourceRead, Capture }
-    ClaimOutcome { Holds, Falsified, Unproven }
-    FindingConfidence { Confirmed, Plausible }
-    FindingSeverity { Blocker, High, Medium, Low }
-    RulingAuthority { Operator, Standing, Defaulted }
-    FindingOrigin { Introduced, PreExisting }
-}
-
-value_types! {
-    pub struct CodeLocation { path: Short, line: u32, end_line: Option<u32> }
-    pub struct CommitRange { base: Sha, head: Sha }
-    pub struct Evidence { kind: EvidenceKind, locator: Line, result: Line }
-    /// A citation of a document in another repo's pipeline store (D6).
-    pub struct ForeignRef { repo: OrgRepo, commit: FullSha, kind: PipelineKind, id: Short, payload_sha256: Sha256Hex }
-    pub struct DocRef { path: Short, start_line: u32, end_line: u32, commit: Sha }
-    pub struct TargetInvariant { label: Label, statement: Line }
-    pub struct QuestionOption { label: Label, text: Line }
-    pub struct CutDelete { path: Short, lines: u32, note: Line }
-    pub struct FileChange { location: CodeLocation, change: Line }
-    pub struct AuthorityMap {
-        owner: Line, inputs: Vec<Line>[16], outputs: Vec<Line>[16], derived_state: Vec<Line>[16],
-        forbidden_writers: Vec<Line>[16], shared_paths: Vec<Line>[16], deletion_line: Line,
-    }
-    pub struct VerificationTest { name: Short, pins: Line }
-    pub struct NegativeCheck { pattern: Short, scope: Line }
-    pub struct CutVerification {
-        builds: Vec<Line>[64], tests: Vec<VerificationTest>[64],
-        negative: Vec<NegativeCheck>[64], operator: Vec<Line>[64],
-    }
-    pub struct ReportCommit { sha: Sha, subject: Line, builds: bool }
-    /// One mutation a report ran: a key-safe label a verdict claim can name,
-    /// the exact edit, and the tree it was applied to.
-    pub struct MutationRecord { label: Label, rule: Line, location: CodeLocation, before: Line, after: Line, commit: Sha, failed_as_expected: bool }
-    pub struct Deviation { what: Line, why: Line }
-    // D1 tables no maximum for these lists, so they take the shared list
-    // default of 64 rather than a number invented for this field alone.
-    pub struct StructuralDelta {
-        lines_added: u32, lines_removed: u32,
-        dependencies_added: Vec<Short>[64], dependencies_removed: Vec<Short>[64],
-        formats_added: Vec<Short>[64], formats_removed: Vec<Short>[64],
-        targets_added: Vec<Short>[64], targets_removed: Vec<Short>[64],
-    }
-    /// A name the cut landed, and where it lives.
-    pub struct LandedName { name: Short, path: Short }
-    /// A promise a report makes about what it landed. Not a document and not
-    /// resolvable: it is identified by its report's id and its label, as a
-    /// `TargetInvariant` is by its target's. Soul measures every one (ruling
-    /// A), and the rule that every one is measured is admission's.
-    pub struct Promise { label: Label, text: Line }
-    /// The promise this claim measured, and the report's mutations it ran. An
-    /// `Unproven` claim with a promise is one Soul could not reach.
-    pub struct VerdictClaim {
-        claim: Line, outcome: ClaimOutcome, evidence: Vec<Evidence>[8], findings: Vec<Short>[16],
-        promise: Option<Label>, mutations: Vec<Label>[8],
-    }
-
-    pub struct PipelineCampaign { slug: Slug, title: Title, repos: Vec<OrgRepo>[8], working_branch: Short, target_doc: DocRef } => campaign_repos_are_distinct
-    pub struct PipelineTarget {
-        campaign: Slug, revision: u32, invariants: Vec<TargetInvariant>[32], not_in_scope: Vec<Line>[32],
-        canonical_implementations: Vec<Line>[16], doc: DocRef,
-    }
-    pub struct PipelineQuestion {
-        campaign: Slug, label: Label, title: Title, question: Para, options: Vec<QuestionOption>[8], recommended: Label,
-        depends: Vec<Line>[8], raised_in: Option<PipelineRef>, asked_on: Date,
-    }
-    pub struct PipelineRuling {
-        campaign: Slug, label: Label, title: Title, answers: Option<Short>, choice: Option<Label>, ruling: Para,
-        operator_quote: Option<Para>, ruled_on: Date, precedents: Vec<ForeignRef>[8], authority: RulingAuthority,
-    }
-    pub struct PipelineCutSpec {
-        campaign: Slug, cut: Label, revision: u32, title: Title, repo: OrgRepo, branch: Short, base: Sha,
-        depends_on: Vec<Short>[8], first: Vec<Line>[16], deletes: Vec<CutDelete>[64], keeps_moves: Vec<Line>[64],
-        adds: Vec<Line>[64], file_changes: Vec<FileChange>[256], authority_map: Option<AuthorityMap>,
-        verification: CutVerification, estimate: StructuralDelta,
-        rulings: Vec<Short>[32], questions: Vec<Short>[16],
-    }
-    pub struct PipelineCutReport {
-        campaign: Slug, cut_spec: Short, attempt: u32, repo: OrgRepo, branch: Short,
-        commits: Vec<ReportCommit>[128], range: CommitRange, verification: Vec<Evidence>[64],
-        mutations: Vec<MutationRecord>[64], deviations: Vec<Deviation>[32], forks: Vec<Short>[8],
-        structural_delta: StructuralDelta, landed_names: Vec<LandedName>[128], undone: Vec<Line>[32],
-        promises: Vec<Promise>[64],
-    }
-    pub struct PipelineVerdict { campaign: Slug, cut_report: Short, pass: u32, range: CommitRange, claims: Vec<VerdictClaim>[64] }
-    pub struct PipelineFinding {
-        campaign: Slug, verdict: Short, label: Label, range: CommitRange, confidence: FindingConfidence,
-        severity: FindingSeverity, claim: Line, invariants: Vec<Label>[8], locations: Vec<CodeLocation>[16],
-        failure_scenario: Para, evidence: Vec<Evidence>[16], precedents: Vec<ForeignRef>[8], origin: FindingOrigin,
-    }
-    pub struct PipelineFollowUp {
-        campaign: Slug, label: Label, source: PipelineRef, repo: OrgRepo, locations: Vec<CodeLocation>[16],
-        item: Line, why_it_can_wait: Line, owner: Short,
-    }
-    /// The record of how a subject was closed and by what. `sequence` is per
-    /// subject and set by the writer, `1` for the first, and it is the last
-    /// part of the key, so a subject's resolutions share a prefix and a
-    /// withdrawn one is kept under its subject rather than overwritten.
-    /// Whether a sequence is the previous plus one, and whether an earlier
-    /// resolution still stands, are admission's rules: this crate refuses
-    /// neither `0` nor a gap, exactly as it refuses neither `revision: 0` nor
-    /// a `revision` with no predecessor.
-    pub struct PipelineResolution { subject: PipelineRef, sequence: u32, outcome: ResolutionOutcome, rationale: Para, resolved_on: Date }
-
-    /// A mind's identity document. A store is canonical to exactly one
-    /// instance, and this says which; identity lives in the state, not in a
-    /// path.
-    pub struct PipelineInstance { instance: Slug, display_name: Short, created_at: Date, host: Short }
-    /// Stewardship over a repo, as an assignment recorded in a mind. One
-    /// instance may steward several repos, so the repo is part of the key.
-    /// `sequence` is per `(instance, repo)`, set by the writer, `1` for the
-    /// first, so a repo transferred away and back is two records under one
-    /// prefix rather than one document overwriting the other. `assigned_on`
-    /// is a field, not a key part. As on a resolution, whether the sequence
-    /// is the previous plus one, and which assignment is in force, are
-    /// admission's rules and not this crate's.
-    pub struct PipelineStewardship { instance: Slug, repo: OrgRepo, sequence: u32, assigned_on: Date, note: Line }
-    /// A reassignment of stewardship, recorded in both minds. `documents` names
-    /// what travels with it.
-    pub struct PipelineHandOff {
-        from_instance: Slug, to_instance: Slug, repo: OrgRepo, documents: Vec<Short>[256],
-        reason: Para, handed_on: Date,
-    }
-}
-
-/// A reference to another document. The id is parsed as a full pipeline id of
-/// the declared `kind`, so the kind and the id's kind segment cannot disagree.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-pub struct PipelineRef {
-    pub kind: PipelineKind,
-    pub id: Short,
-}
-
-impl Bounded for PipelineRef {
-    fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
-        self.id.validate(&format!("{at}.id"))?;
-        pipeline_id(&format!("{at}.id"), &self.id.0, self.kind).map(|_| ())
-    }
-}
-
-impl PipelineRef {
-    /// The grammar's door for a reader holding a bare reference. A read side
-    /// outside this crate is handed a `kind` and an `id` that may disagree, and
-    /// `Bounded` is crate-private, so without this there is no way to ask; a
-    /// reader with no way to ask answers empty, which reads as "no such
-    /// document" rather than "that is not a reference". It delegates, so the
-    /// grammar keeps one owner: this is exactly what a document's own
-    /// `PipelineRef` field is held to, at the field name `ref`. It is kind-deep,
-    /// like every other read of an id: whether the named document exists, and
-    /// whether the local's shape suits the kind, are admission's rules.
-    ///
-    /// A method rather than a free function because it concerns one public
-    /// type, as `prepare` and `decode` do; the two free doors act on a cache or
-    /// an envelope this crate does not own. `validate_ref` rather than a bare
-    /// `validate`, because an inherent `validate` would shadow `Bounded`'s for
-    /// every in-crate caller holding a `PipelineRef`.
-    pub fn validate_ref(&self) -> Result<(), PipelineRefusal> {
-        self.validate("ref")
-    }
-}
-
-/// How a subject was resolved. Every referent is a parsed `PipelineRef`, so a
-/// resolution names its records by ids of the kinds they declare, validated
-/// where every other referent is; a `Fixed` commit is a `Sha` whose referent
-/// is outside the document set (ruling B). Whether a named document exists,
-/// and how many may supersede one subject, are admission's rules.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-pub enum ResolutionOutcome {
-    /// Overturned, in whole or in part, by later records. The list is bounded
-    /// here because the enum is outside `value_types!`, the only place a list
-    /// maximum is emitted automatically.
-    Superseded {
-        #[schemars(extend("maxItems" = 8))]
-        by: Vec<PipelineRef>,
-    },
-    Answered { by: PipelineRef },
-    Fixed { commit: Sha, by: Option<PipelineRef> },
-    Deferred { to: PipelineRef },
-    Recorded { reason: Line },
-    Withdrawn { reason: Line },
-}
-
-impl Bounded for ResolutionOutcome {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-        match self {
-            Self::Superseded { by } => list(&format!("{field}.by"), by, 8),
-            Self::Answered { by } => by.validate(&format!("{field}.by")),
-            Self::Fixed { commit, by } => {
-                commit.validate(&format!("{field}.commit"))?;
-                by.validate(&format!("{field}.by"))
-            }
-            Self::Deferred { to } => to.validate(&format!("{field}.to")),
-            Self::Recorded { reason } | Self::Withdrawn { reason } => reason.validate(&format!("{field}.reason")),
-        }
-    }
-}
-
-macro_rules! pipeline_kinds {
-    ($($variant:ident($value:ident) => $document:ident, $name:literal, $type_id:tt, $schema:tt;)*) => {
-        $(
-            #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
-            #[cultcache(type = $type_id, schema = $schema)]
-            pub(crate) struct $document {
-                #[cultcache(key = 0)]
-                pub(crate) value: $value,
-            }
-        )*
-
-        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
-        pub enum PipelineKind { $($variant),* }
-
-        impl Bounded for PipelineKind {
-            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
-                Ok(())
-            }
-        }
-
-        /// The envelope enum, adjacently tagged on the kind name: a document
-        /// on a wire is `{ kind, value }`, and `kind` is exactly what
-        /// `PipelineKind::name()` returns, so a reader dispatches on the kind
-        /// segment it already knows from the key and needs no second registry
-        /// mapping variant spellings to kinds. Adjacent rather than internal
-        /// because a value is a named map of its own and an internal tag would
-        /// have to be merged into it; the tag stays beside the value instead.
-        /// This is not a published schema: `schemas/cultnet` publishes the
-        /// thirteen per-kind value documents, and the envelope is the wire's
-        /// shape, not a document's.
-        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-        #[serde(tag = "kind", content = "value", rename_all = "snake_case")]
-        pub enum PipelineDocument { $($variant($value)),* }
-
-        impl PipelineKind {
-            pub const ALL: &'static [PipelineKind] = &[$(Self::$variant),*];
-
-            /// The kind segment of a document key.
-            pub fn name(self) -> &'static str {
-                match self { $(Self::$variant => $name),* }
-            }
-
-            pub fn type_id(self) -> &'static str {
-                match self { $(Self::$variant => <$document as DatabaseEntry>::TYPE),* }
-            }
-
-            #[cfg(test)]
-            pub(crate) fn derived_schema(self) -> schemars::Schema {
-                match self { $(Self::$variant => schemars::schema_for!($value)),* }
-            }
-        }
-
-        impl PipelineDocument {
-            pub fn kind(&self) -> PipelineKind {
-                match self { $(Self::$variant(_) => PipelineKind::$variant),* }
-            }
-
-            /// Field bounds and formats (D1), in UTF-8 bytes and list maximums.
-            pub fn validate(&self) -> Result<(), PipelineRefusal> {
-                match self { $(Self::$variant(value) => value.validate($name)),* }
-            }
-
-            /// Prepares the envelope to be stored: keyed by `pipeline_key`,
-            /// payload `[value]` through `prepare_entry_named`.
-            pub fn prepare(&self, cache: &CultCache) -> Result<CultCacheEnvelope> {
-                let key = pipeline_key(self)?;
-                Ok(match self {
-                    $(Self::$variant(value) => {
-                        cache.prepare_entry_named(key, &$document { value: value.clone() })?.0
-                    })*
-                })
-            }
-
-            /// Decodes a stored envelope, type-matched both ways: an envelope of
-            /// any other type is `ForeignStore`, never the kind that happens to
-            /// parse its payload. It validates neither bounds nor the key: a
-            /// decoded document is a typed read, and
-            /// `validate_pipeline_write_envelope` is the check before a write.
-            pub fn decode(envelope: &CultCacheEnvelope) -> Result<Self, PipelineRefusal> {
-                let invalid = |error: rmp_serde::decode::Error| format_error("payload", &error.to_string());
-                $(if envelope.r#type == <$document as DatabaseEntry>::TYPE {
-                    let document: $document = rmp_serde::from_slice(&envelope.payload).map_err(invalid)?;
-                    return Ok(Self::$variant(document.value));
-                })*
-                Err(PipelineRefusal::ForeignStore { r#type: envelope.r#type.clone() })
-            }
-        }
-
-        /// Registers every pipeline kind in a cache, and nothing else: the one
-        /// door to the crate-private wrappers, so a caller registers exactly
-        /// what this crate publishes.
-        pub fn register_pipeline_document_types(cache: &mut CultCache) -> Result<()> {
-            $(cache.register_entry_type::<$document>()?;)*
-            Ok(())
-        }
-    };
-}
-
-/// A document that is not a pipeline document, for the decode refusal and the
-/// registrar's count to be pinned against something real. It stands in for
-/// any other document a store may hold beside pipeline documents, a commit
-/// receipt say, which is still not a document this library may decode. The
-/// stand-in carries a receipt-shaped type id and is registered only by the
-/// tests' own cache, never by the live registrar.
-#[cfg(test)]
-#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
-#[cultcache(type = "epiphany.mind_commit_receipt.v1", schema = "ForeignDocument")]
-pub(crate) struct ForeignDocument {
-    #[cultcache(key = 0)]
-    pub(crate) marker: Short,
-}
-
-pipeline_kinds! {
-    Campaign(PipelineCampaign) => EpiphanyPipelineCampaignDocument, "campaign",
-        "epiphany.pipeline.campaign.v2", "EpiphanyPipelineCampaignDocument";
-    Target(PipelineTarget) => EpiphanyPipelineTargetDocument, "target",
-        "epiphany.pipeline.target.v2", "EpiphanyPipelineTargetDocument";
-    Question(PipelineQuestion) => EpiphanyPipelineQuestionDocument, "question",
-        "epiphany.pipeline.question.v2", "EpiphanyPipelineQuestionDocument";
-    Ruling(PipelineRuling) => EpiphanyPipelineRulingDocument, "ruling",
-        "epiphany.pipeline.ruling.v2", "EpiphanyPipelineRulingDocument";
-    CutSpec(PipelineCutSpec) => EpiphanyPipelineCutSpecDocument, "cut_spec",
-        "epiphany.pipeline.cut_spec.v2", "EpiphanyPipelineCutSpecDocument";
-    CutReport(PipelineCutReport) => EpiphanyPipelineCutReportDocument, "cut_report",
-        "epiphany.pipeline.cut_report.v2", "EpiphanyPipelineCutReportDocument";
-    Verdict(PipelineVerdict) => EpiphanyPipelineVerdictDocument, "verdict",
-        "epiphany.pipeline.verdict.v2", "EpiphanyPipelineVerdictDocument";
-    Finding(PipelineFinding) => EpiphanyPipelineFindingDocument, "finding",
-        "epiphany.pipeline.finding.v2", "EpiphanyPipelineFindingDocument";
-    FollowUp(PipelineFollowUp) => EpiphanyPipelineFollowUpDocument, "follow_up",
-        "epiphany.pipeline.follow_up.v2", "EpiphanyPipelineFollowUpDocument";
-    Resolution(PipelineResolution) => EpiphanyPipelineResolutionDocument, "resolution",
-        "epiphany.pipeline.resolution.v2", "EpiphanyPipelineResolutionDocument";
-    Instance(PipelineInstance) => EpiphanyPipelineInstanceDocument, "instance",
-        "epiphany.pipeline.instance.v2", "EpiphanyPipelineInstanceDocument";
-    Stewardship(PipelineStewardship) => EpiphanyPipelineStewardshipDocument, "stewardship",
-        "epiphany.pipeline.stewardship.v2", "EpiphanyPipelineStewardshipDocument";
-    HandOff(PipelineHandOff) => EpiphanyPipelineHandOffDocument, "hand_off",
-        "epiphany.pipeline.hand_off.v2", "EpiphanyPipelineHandOffDocument";
-}
-
-/// Parses a full document id: the grammar read backwards. A key and an id are
-/// the same string, so this accepts exactly what `pipeline_key` derives:
-/// `<root>:<kind>:<local>`, three segments for every kind. The kind segment
-/// must equal `kind`'s name, the root is a `Slug`, and the local is `Label`s
-/// joined by `.` and bounded whole by `local_max(kind)`, so `..`, an empty part, spaces and trailing
-/// junk are all refused. Returns the root and the local; nothing is inferred
-/// from either, and no kind is read any other way.
-fn pipeline_id<'a>(
-    field: &str,
-    id: &'a str,
-    kind: PipelineKind,
-) -> Result<(&'a str, &'a str), PipelineRefusal> {
-    let mut segments = id.split(':');
-    let (Some(root), Some(name), Some(local), None) = (
-        segments.next(),
-        segments.next(),
-        segments.next(),
-        segments.next(),
-    ) else {
-        return Err(format_error(field, id));
-    };
-    if name != kind.name() {
-        return Err(format_error(field, id));
-    }
-    dotted_text(field, root)?;
-    dotted_within(field, local, local_max(kind))?;
-    Ok((root, local))
-}
-
-/// The local segment of a parent id in `campaign`, of the expected kind.
-fn parent_local<'a>(
-    field: &str,
-    id: &'a str,
-    campaign: &str,
-    kind: PipelineKind,
-) -> Result<&'a str, PipelineRefusal> {
-    let (owner, local) = pipeline_id(field, id, kind)?;
-    if owner != campaign {
-        return Err(format_error(field, id));
-    }
-    Ok(local)
-}
-
-/// The cut label inside a parent local `cut-<label>.<marker><N>`: exactly two
-/// parts, the label a `Label` and `<N>` a non-empty run of digits.
-fn parent_cut<'a>(field: &str, local: &'a str, marker: char) -> Result<&'a str, PipelineRefusal> {
-    let invalid = || format_error(field, local);
-    let mut parts = local.split('.');
-    let (Some(head), Some(suffix), None) = (parts.next(), parts.next(), parts.next()) else {
-        return Err(invalid());
-    };
-    let cut = head.strip_prefix("cut-").ok_or_else(invalid)?;
-    label_text(field, cut)?;
-    let digits = suffix.strip_prefix(marker).ok_or_else(invalid)?;
-    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
-        return Err(invalid());
-    }
-    Ok(cut)
-}
-
-/// A `Slug` or an `OrgRepo` entering a local, escaped to one label. `/` is not
-/// a `Label` byte, so it cannot survive into a key, and neither may `.`: no
-/// local part carries the separator, or the boundary before it would have two
-/// readings. A dotted slug and a dotted repo name are both ordinary, so both
-/// bytes are escaped rather than refused. The escape has to be injective or two
-/// values claim one key: replacing `/` with `_` alone is not, since
-/// `GameCult_Epiphany/thing` and `GameCult/Epiphany_thing` both give
-/// `GameCult_Epiphany_thing`. So `_` is escaped as well, and every code is two
-/// bytes starting with `_`: `_` becomes `__`, `/` becomes `_-`, and `.` becomes
-/// `_d`. Every other byte is passed through and is never `_`, so a reader going
-/// left to right takes each `_` together with the byte after it and never has a
-/// choice to make; the encoding is therefore reversible, and distinct values
-/// give distinct segments. The caller validates the value as its own type first
-/// and checks the result against the local's rules, which is where an over-long
-/// or otherwise unlabelled value is refused.
-fn key_segment(value: &str) -> String {
-    value.replace('_', "__").replace('/', "_-").replace('.', "_d")
-}
-
-/// The local of a root. A campaign's or an instance's identity is entirely its
-/// root segment, so its local carries none; a reader never consults it.
-const ROOT_LOCAL: &str = "self";
-
-/// The bound on a composed local of every kind but a resolution, whole, in
-/// UTF-8 bytes. Every stored subject key is within it.
-const SUBJECT_LOCAL_MAX: usize = 64;
-
-/// The longest kind name a resolution can name as its subject (`stewardship`),
-/// checked against `PipelineKind::ALL` by a test.
-const LONGEST_KIND_NAME: usize = "stewardship".len();
-
-/// A `.n<sequence>` part at `u32::MAX`.
-const SEQUENCE_PART_MAX: usize = ".n".len() + "4294967295".len();
-
-/// The bound on a resolution's local: a depth-two chain over a maximal
-/// subject, `resolution.<kind>.<subject local>.n<seq>.n<seq>`, at `u32::MAX`
-/// sequences. Depth is capped at two by admission (Q19), and this bound admits
-/// exactly that for every subject, so no subject is born unresolvable. Derived
-/// from `SUBJECT_LOCAL_MAX` and the kind names, never written as a number.
-const RESOLUTION_LOCAL_MAX: usize = "resolution.".len() + LONGEST_KIND_NAME + ".".len() + SUBJECT_LOCAL_MAX + 2 * SEQUENCE_PART_MAX;
-
-// `<root>:<kind>:<local>` must fit a `Short` wherever an id is cited.
-const _: () = assert!(64 + ":".len() + LONGEST_KIND_NAME + ":".len() + RESOLUTION_LOCAL_MAX <= 200);
-
-/// The bound on a kind's composed local, chosen here and nowhere else.
-fn local_max(kind: PipelineKind) -> usize {
-    match kind {
-        PipelineKind::Resolution => RESOLUTION_LOCAL_MAX,
-        _ => SUBJECT_LOCAL_MAX,
-    }
-}
-
-/// The schema epoch every pipeline store is written at, owned here with the
-/// schemas it names. Evolution is additive and keeps it: a new named field
-/// with a serde default, or a widened `PipelineKind`, since each reader ships
-/// with the variants it knows and refuses an unknown kind on the kind, not on
-/// the epoch. A breaking change bumps it, so that a store written at the old
-/// one can be refused by whoever opens it; this crate owns no store and
-/// refuses none.
-pub const PIPELINE_SCHEMA_EPOCH: &str = "epiphany.pipeline.epoch.v2";
-
-/// Composes and validates a local: every part is a `Label`, and the join is
-/// bounded whole by `local_max(kind)`. Both rules live here because this is the only way a local is
-/// built; `pipeline_key` has no other path to a key string. Parts are a slice,
-/// not a builder, so an arm's arity is written at its call site.
-fn local(field: &str, kind: PipelineKind, parts: &[&str]) -> Result<String, PipelineRefusal> {
-    for part in parts {
-        label_text(field, part)?;
-    }
-    let joined = parts.join(".");
-    if joined.len() > local_max(kind) {
-        return Err(format_error(field, &joined));
-    }
-    Ok(joined)
-}
-
-/// Derives a document's identity key (D1, "Keys: identity, not convenience").
-/// Thirteen arms, one exit: every arm names its root and composes its local
-/// through `local`, and the key is formatted here and nowhere else.
-pub fn pipeline_key(document: &PipelineDocument) -> Result<String, PipelineRefusal> {
-    use PipelineDocument as D;
-    let document_kind = document.kind();
-    let kind = document_kind.name();
-    let key_field = format!("{kind}.key");
-    let campaign_field = format!("{kind}.campaign");
-    let (root_field, root, composed) = match document {
-        D::Campaign(value) => ("campaign.slug", value.slug.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
-        D::Instance(value) => ("instance.instance", value.instance.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
-        // A resolution is keyed inside its subject's root, with the subject's
-        // kind and local as its own local and its per-subject sequence last, so
-        // the subject's resolutions and only they share the prefix
-        // `<root>:resolution:<kind>.<local>.n`. A resolution's own key is an
-        // ordinary id, so it composes as a subject like any other; each nesting
-        // prepends `resolution.` (11 bytes) and appends `.n<s>` (3 bytes for
-        // one digit). Depth is capped at two by admission (Q19), and
-        // `RESOLUTION_LOCAL_MAX` admits exactly a depth-two chain over a
-        // maximal subject, so every subject resolves and its resolution can be
-        // withdrawn.
-        D::Resolution(value) => {
-            let field = "resolution.subject.id";
-            let (subject_root, subject_local) = pipeline_id(field, &value.subject.id.0, value.subject.kind)?;
-            let sequence = format!("n{}", value.sequence);
-            let parts = std::iter::once(value.subject.kind.name()).chain(subject_local.split('.')).chain(std::iter::once(sequence.as_str())).collect::<Vec<_>>();
-            (field, subject_root, local(&key_field, document_kind, &parts)?)
-        }
-        // Stewardship and hand-off hang off an instance rather than a campaign.
-        // The root is the whole difference; the key shape is the same.
-        D::Stewardship(value) => {
-            org_repo_text("stewardship.repo", &value.repo.0)?;
-            let sequence = format!("n{}", value.sequence);
-            (
-                "stewardship.instance",
-                value.instance.0.as_str(),
-                local(&key_field, document_kind, &[&key_segment(&value.repo.identity()), &sequence])?,
-            )
-        }
-        D::HandOff(value) => {
-            dotted_text("hand_off.to_instance", &value.to_instance.0)?;
-            org_repo_text("hand_off.repo", &value.repo.0)?;
-            value.handed_on.validate("hand_off.handed_on")?;
-            (
-                "hand_off.from_instance",
-                value.from_instance.0.as_str(),
-                local(
-                    &key_field,
-                    document_kind,
-                    &[&key_segment(&value.to_instance.0), &key_segment(&value.repo.identity()), &value.handed_on.0],
-                )?,
-            )
-        }
-        D::Target(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&format!("r{}", value.revision)])?),
-        D::Question(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
-        D::Ruling(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
-        D::FollowUp(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
-        D::CutSpec(value) => (
-            campaign_field.as_str(),
-            value.campaign.0.as_str(),
-            local(&key_field, document_kind, &[&format!("cut-{}", value.cut.0), &format!("r{}", value.revision)])?,
-        ),
-        D::CutReport(value) => {
-            let spec = parent_local("cut_report.cut_spec", &value.cut_spec.0, &value.campaign.0, PipelineKind::CutSpec)?;
-            let cut = parent_cut("cut_report.cut_spec", spec, 'r')?;
-            (
-                campaign_field.as_str(),
-                value.campaign.0.as_str(),
-                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("h{}", value.attempt)])?,
-            )
-        }
-        D::Verdict(value) => {
-            let report = parent_local("verdict.cut_report", &value.cut_report.0, &value.campaign.0, PipelineKind::CutReport)?;
-            let cut = parent_cut("verdict.cut_report", report, 'h')?;
-            (
-                campaign_field.as_str(),
-                value.campaign.0.as_str(),
-                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("s{}", value.pass)])?,
-            )
-        }
-        D::Finding(value) => {
-            let verdict = parent_local("finding.verdict", &value.verdict.0, &value.campaign.0, PipelineKind::Verdict)?;
-            parent_cut("finding.verdict", verdict, 's')?;
-            let parts = verdict.split('.').chain(std::iter::once(value.label.0.as_str())).collect::<Vec<_>>();
-            (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &parts)?)
-        }
-    };
-    dotted_text(root_field, root)?;
-    Ok(format!("{root}:{kind}:{composed}"))
-}
-
-/// Bounds, formats, then key recomputation, on the envelope that will be
-/// stored, whoever prepared it. It is the whole of what this crate checks
-/// before a write; per-kind and cross-document rules are not decided here and
-/// belong to the admission path of the organ that will admit these documents,
-/// which is expected to call this first rather than re-derive it.
-pub fn validate_pipeline_write_envelope(envelope: &CultCacheEnvelope) -> Result<(), PipelineRefusal> {
-    let document = PipelineDocument::decode(envelope)?;
-    document.validate()?;
-    let expected = pipeline_key(&document)?;
-    if envelope.key != expected {
-        return Err(PipelineRefusal::InvalidIdentity {
-            kind: document.kind(),
-            key: envelope.key.clone(),
-            expected,
-        });
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::BTreeSet;
-    use std::path::Path;
-
-    const CAMPAIGN: &str = "eureka-state";
-    const INSTANCE: &str = "yggdrasil";
-
-    fn s(value: &str) -> Short {
-        value.into()
-    }
-
-    fn t(value: &str) -> Title {
-        value.into()
-    }
-
-    fn l(value: &str) -> Label {
-        value.into()
-    }
-
-    fn slug(value: &str) -> Slug {
-        value.into()
-    }
-
-    fn id(kind: &str, local: &str) -> Short {
-        Short(format!("{CAMPAIGN}:{kind}:{local}"))
-    }
-
-    fn sha() -> Sha {
-        Sha("5f98228d".into())
-    }
-
-    fn date() -> Date {
-        Date("2026-09-15".into())
-    }
-
-    fn range() -> CommitRange {
-        CommitRange { base: sha(), head: sha() }
-    }
-
-    fn location() -> CodeLocation {
-        CodeLocation { path: s("crates/eureka-pipeline/src/lib.rs"), line: 1, end_line: Some(9) }
-    }
-
-    fn evidence() -> Evidence {
-        Evidence { kind: EvidenceKind::Test, locator: "cargo test".into(), result: "ok".into() }
-    }
-
-    fn doc_ref() -> DocRef {
-        DocRef { path: s("notes/eureka-pipeline-state-target.md"), start_line: 1, end_line: 9, commit: sha() }
-    }
-
-    /// One valid document of every kind, with its expected key.
-    fn samples() -> Vec<(PipelineDocument, String)> {
-        use PipelineDocument as D;
-        let repo = || OrgRepo("GameCult/Epiphany".into());
-        let branch = || s("codex/eureka-pipeline-state");
-        vec![
-            (D::Campaign(PipelineCampaign {
-                slug: slug(CAMPAIGN), title: t("Eureka pipeline state"), repos: vec![repo()],
-                working_branch: branch(), target_doc: doc_ref(),
-            }), format!("{CAMPAIGN}:campaign:self")),
-            (D::Target(PipelineTarget {
-                campaign: slug(CAMPAIGN), revision: 2,
-                invariants: vec![TargetInvariant { label: l("mind-admits"), statement: "Only admission writes.".into() }],
-                not_in_scope: vec!["Eve browsing".into()], canonical_implementations: vec!["CultLib".into()], doc: doc_ref(),
-            }), format!("{CAMPAIGN}:target:r2")),
-            (D::Question(PipelineQuestion {
-                campaign: slug(CAMPAIGN), label: l("Q1"), title: t("Who owns the state?"), question: "Who owns the state?".into(),
-                options: vec![
-                    QuestionOption { label: l("A"), text: "an instance".into() },
-                    QuestionOption { label: l("B"), text: "a repo".into() },
-                ],
-                recommended: l("A"), depends: vec!["Cut 3a".into()],
-                raised_in: Some(PipelineRef { kind: PipelineKind::CutSpec, id: id("cut_spec", "cut-3a.r1") }),
-                asked_on: date(),
-            }), format!("{CAMPAIGN}:question:Q1")),
-            (D::Ruling(PipelineRuling {
-                campaign: slug(CAMPAIGN), label: l("R8"), title: t("An instance owns its mind"), answers: Some(id("question", "Q1")), choice: Some(l("A")),
-                ruling: "An instance owns its mind.".into(), operator_quote: Some("all recommendations, go ahead".into()),
-                ruled_on: date(),
-                precedents: vec![ForeignRef {
-                    repo: OrgRepo("GameCult/Aetheria".into()), commit: FullSha("a".repeat(40)), kind: PipelineKind::Ruling,
-                    id: s("cultcache:ruling:R1"), payload_sha256: Sha256Hex("b".repeat(64)),
-                }],
-                authority: RulingAuthority::Operator,
-            }), format!("{CAMPAIGN}:ruling:R8")),
-            (D::CutSpec(PipelineCutSpec {
-                campaign: slug(CAMPAIGN), cut: l("3a"), revision: 1, title: t("Pipeline documents"), repo: repo(),
-                branch: branch(), base: sha(), depends_on: vec![s("2")], first: vec!["Read the spec.".into()],
-                deletes: vec![CutDelete { path: s("old.rs"), lines: 3, note: "dead".into() }],
-                keeps_moves: vec!["commit owner".into()], adds: vec!["pipeline_documents.rs".into()],
-                file_changes: vec![FileChange { location: location(), change: "add".into() }],
-                authority_map: Some(AuthorityMap {
-                    owner: "core".into(), inputs: vec!["typed documents".into()], outputs: vec!["envelopes".into()],
-                    derived_state: vec!["derived keys".into()], forbidden_writers: vec!["MCP".into()],
-                    shared_paths: vec!["admission".into()], deletion_line: "n/a".into(),
-                }),
-                verification: CutVerification {
-                    builds: vec!["cargo check".into()],
-                    tests: vec![VerificationTest { name: s("keys"), pins: "one derived key".into() }],
-                    negative: vec![NegativeCheck { pattern: s("Vec<u8>"), scope: "documents".into() }],
-                    operator: vec!["none".into()],
-                },
-                // Cut 3a's real numbers, and in this order: the tripwire test
-                // reads them back, so a transposition is a failure, not a typo.
-                estimate: StructuralDelta {
-                    lines_added: 900, lines_removed: 0,
-                    dependencies_added: vec![s("schemars")], dependencies_removed: vec![],
-                    formats_added: vec![s("epiphany.pipeline.*.v1")], formats_removed: vec![],
-                    targets_added: vec![], targets_removed: vec![],
-                },
-                rulings: vec![id("ruling", "R8")], questions: vec![id("question", "Q1")],
-            }), format!("{CAMPAIGN}:cut_spec:cut-3a.r1")),
-            (D::CutReport(PipelineCutReport {
-                campaign: slug(CAMPAIGN), cut_spec: id("cut_spec", "cut-3a.r1"), attempt: 1, repo: repo(), branch: branch(),
-                commits: vec![ReportCommit { sha: sha(), subject: "Add the pipeline documents".into(), builds: true }],
-                range: range(), verification: vec![evidence()],
-                mutations: vec![MutationRecord {
-                    // `.into()` on both, not `l()` and `sha()`: the type-level
-                    // mutations (M19, M20) widen these fields to `Short`, and
-                    // a sample spelled with the narrow constructors would stop
-                    // compiling instead of letting the forgery through.
-                    label: "M1".into(), rule: "key derivation".into(), location: location(),
-                    before: "parent_cut(field, spec, 'r')?".into(), after: "spec".into(), commit: "5f98228d".into(),
-                    failed_as_expected: true,
-                }],
-                deviations: vec![Deviation { what: "names".into(), why: "glob exports".into() }],
-                forks: vec![id("question", "Q1")],
-                structural_delta: StructuralDelta {
-                    lines_added: 900, lines_removed: 0, dependencies_added: vec![s("schemars")],
-                    dependencies_removed: vec![], formats_added: vec![s("epiphany.pipeline.*.v1")],
-                    formats_removed: vec![], targets_added: vec![], targets_removed: vec![],
-                },
-                landed_names: vec![LandedName { name: s("PipelineDocument"), path: s("crates/eureka-pipeline/src/lib.rs") }],
-                undone: vec!["admission".into()],
-                promises: vec![Promise { label: l("P1"), text: "One derived key per document.".into() }],
-            }), format!("{CAMPAIGN}:cut_report:cut-3a.h1")),
-            (D::Verdict(PipelineVerdict {
-                campaign: slug(CAMPAIGN), cut_report: id("cut_report", "cut-3a.h1"), pass: 2, range: range(),
-                claims: vec![VerdictClaim {
-                    claim: "A composed key has one source.".into(), outcome: ClaimOutcome::Falsified,
-                    evidence: vec![evidence()], findings: vec![id("finding", "cut-3a.s2.F4")],
-                    promise: Some(l("P1")), mutations: vec![l("M1")],
-                }],
-            }), format!("{CAMPAIGN}:verdict:cut-3a.s2")),
-            (D::Finding(PipelineFinding {
-                campaign: slug(CAMPAIGN), verdict: id("verdict", "cut-3a.s2"), label: l("F4"), range: range(),
-                confidence: FindingConfidence::Confirmed, severity: FindingSeverity::High,
-                claim: "A dotted label composes two keys.".into(), invariants: vec![l("mind-admits")],
-                locations: vec![location()], failure_scenario: "Two documents claim one key.".into(),
-                evidence: vec![evidence()], precedents: vec![], origin: FindingOrigin::Introduced,
-            }), format!("{CAMPAIGN}:finding:cut-3a.s2.F4")),
-            (D::FollowUp(PipelineFollowUp {
-                campaign: slug(CAMPAIGN), label: l("FU-4"),
-                source: PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") },
-                repo: repo(), locations: vec![location()], item: "Per-kind admission rules.".into(),
-                why_it_can_wait: "The organ owns admission.".into(), owner: s("Hands"),
-            }), format!("{CAMPAIGN}:follow_up:FU-4")),
-            (D::Resolution(PipelineResolution {
-                subject: PipelineRef { kind: PipelineKind::Question, id: id("question", "Q1") }, sequence: 1,
-                outcome: ResolutionOutcome::Answered { by: PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") } },
-                rationale: "Ruled A.".into(), resolved_on: date(),
-            }), format!("{CAMPAIGN}:resolution:question.Q1.n1")),
-            // The mind's own three kinds. They are appended rather than
-            // inserted because the helpers below index this list by position.
-            (D::Instance(PipelineInstance {
-                instance: slug(INSTANCE), display_name: s("Yggdrasil mind"), created_at: date(),
-                host: s("yggdrasil"),
-            }), format!("{INSTANCE}:instance:self")),
-            (D::Stewardship(PipelineStewardship {
-                instance: slug(INSTANCE), repo: repo(), sequence: 1, assigned_on: date(),
-                note: "The Eureka campaign repo.".into(),
-            }), format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")),
-            (D::HandOff(PipelineHandOff {
-                from_instance: slug(INSTANCE), to_instance: slug("thought-cage"), repo: repo(),
-                documents: vec![s(CAMPAIGN), id("ruling", "R8")],
-                reason: "The workstation mind takes the campaign.".into(), handed_on: date(),
-            }), format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.{}", date().0)),
-        ]
-    }
-
-    fn instance_sample() -> PipelineInstance {
-        let PipelineDocument::Instance(instance) = samples().remove(10).0 else { unreachable!() };
-        instance
-    }
-
-    fn stewardship_sample() -> PipelineStewardship {
-        let PipelineDocument::Stewardship(stewardship) = samples().remove(11).0 else { unreachable!() };
-        stewardship
-    }
-
-    fn hand_off_sample() -> PipelineHandOff {
-        let PipelineDocument::HandOff(hand_off) = samples().remove(12).0 else { unreachable!() };
-        hand_off
-    }
-
-    fn campaign_sample() -> PipelineDocument {
-        samples().remove(0).0
-    }
-
-    fn question_sample() -> PipelineQuestion {
-        let PipelineDocument::Question(question) = samples().remove(2).0 else { unreachable!() };
-        question
-    }
-
-    fn ruling_sample() -> PipelineRuling {
-        let PipelineDocument::Ruling(ruling) = samples().remove(3).0 else { unreachable!() };
-        ruling
-    }
-
-    fn report_sample() -> PipelineCutReport {
-        let PipelineDocument::CutReport(report) = samples().remove(5).0 else { unreachable!() };
-        report
-    }
-
-    fn verdict_sample() -> PipelineVerdict {
-        let PipelineDocument::Verdict(verdict) = samples().remove(6).0 else { unreachable!() };
-        verdict
-    }
-
-    fn finding_sample() -> PipelineFinding {
-        let PipelineDocument::Finding(finding) = samples().remove(7).0 else { unreachable!() };
-        finding
-    }
-
-    fn resolution_sample() -> PipelineResolution {
-        let PipelineDocument::Resolution(resolution) = samples().remove(9).0 else { unreachable!() };
-        resolution
-    }
-
-    /// The live registrar plus the foreign stand-in, which only the tests
-    /// register.
-    fn schema_cache() -> Result<CultCache> {
-        let mut cache = CultCache::new();
-        register_pipeline_document_types(&mut cache)?;
-        cache.register_entry_type::<ForeignDocument>()?;
-        Ok(cache)
-    }
-
-    #[test]
-    fn every_pipeline_kind_round_trips_through_named_slot_zero() -> Result<()> {
-        let cache = schema_cache()?;
-        let samples = samples();
-        let kinds = samples.iter().map(|(document, _)| document.kind()).collect::<BTreeSet<_>>();
-        assert_eq!(kinds.len(), PipelineKind::ALL.len(), "every kind has a sample");
-        for (document, _) in samples {
-            document.validate()?;
-            let envelope = document.prepare(&cache)?;
-            assert_eq!(envelope.r#type, document.kind().type_id());
-            assert_eq!(envelope.payload[0], 0x91, "{:?} payload is a one-element array", document.kind());
-            assert!(
-                matches!(envelope.payload[1], 0x80..=0x8f | 0xde | 0xdf),
-                "{:?} slot 0 is a named map",
-                document.kind()
-            );
-            assert_eq!(PipelineDocument::decode(&envelope)?, document);
-            Ok::<_, anyhow::Error>(())?;
-        }
-        Ok(())
-    }
-
-    /// Soul F2: a decode is type-matched in both directions. The round-trip
-    /// test above pins the positive match; this pins the refusal, so an
-    /// envelope belonging to another kind can never be decoded as whichever
-    /// pipeline kind happens to parse its payload. The commit receipt is the
-    /// sharp case: a mind's store may legitimately hold one, and it is still
-    /// not a document; `ForeignDocument` stands in for it here.
-    #[test]
-    fn decode_refuses_an_envelope_of_a_foreign_type() -> Result<()> {
-        let cache = schema_cache()?;
-        let foreign = <ForeignDocument as DatabaseEntry>::TYPE;
-        assert!(!foreign.starts_with("epiphany.pipeline."), "{foreign} is a foreign type id");
-        let mut envelope = campaign_sample().prepare(&cache)?;
-        envelope.r#type = foreign.into();
-        assert_eq!(
-            PipelineDocument::decode(&envelope),
-            Err(PipelineRefusal::ForeignStore { r#type: foreign.into() })
-        );
-        Ok(())
-    }
-
-    #[test]
-    fn bounds_refuse_in_utf8_bytes() {
-        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
-        campaign.title = Title("é".repeat(100));
-        assert_eq!(PipelineDocument::Campaign(campaign.clone()).validate(), Ok(()));
-        campaign.title = Title(format!("{}a", "é".repeat(100)));
-        assert_eq!(
-            PipelineDocument::Campaign(campaign.clone()).validate(),
-            Err(PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 })
-        );
-        campaign.title = t("ok");
-        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 9];
-        assert_eq!(
-            PipelineDocument::Campaign(campaign).validate(),
-            Err(PipelineRefusal::FieldBound { field: "campaign.repos".into(), limit: 8, actual: 9 })
-        );
-    }
-
-    /// RS-L closing fix 4: `campaign.repos` refuses two entries naming one
-    /// repository by identity, not only by raw spelling, so `GameCult/Epiphany`
-    /// and `gamecult/epiphany` in one list refuse exactly as the same spelling
-    /// twice would. Two genuinely distinct repos still validate.
-    #[test]
-    fn campaign_repos_refuse_duplicates_by_identity() {
-        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
-        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("gamecult/epiphany".into())];
-        assert_eq!(
-            PipelineDocument::Campaign(campaign.clone()).validate(),
-            Err(PipelineRefusal::DuplicateRepo {
-                field: "campaign.repos".into(),
-                repo: "gamecult/epiphany".into(),
-            })
-        );
-
-        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 2];
-        assert_eq!(
-            PipelineDocument::Campaign(campaign.clone()).validate(),
-            Err(PipelineRefusal::DuplicateRepo {
-                field: "campaign.repos".into(),
-                repo: "GameCult/Epiphany".into(),
-            })
-        );
-
-        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("GameCult/Aetheria".into())];
-        assert_eq!(PipelineDocument::Campaign(campaign).validate(), Ok(()));
-    }
-
-    #[test]
-    fn repo_fields_must_be_org_slash_repo() {
-        let mut report = report_sample();
-        report.repo = OrgRepo("Epiphany".into());
-        assert_eq!(
-            PipelineDocument::CutReport(report).validate(),
-            Err(PipelineRefusal::InvalidFormat { field: "cut_report.repo".into(), value: "Epiphany".into() })
-        );
-        let PipelineDocument::CutSpec(mut spec) = samples().remove(4).0 else { unreachable!() };
-        spec.repo = OrgRepo("GameCult/Epiphany/extra".into());
-        assert!(matches!(
-            PipelineDocument::CutSpec(spec).validate(),
-            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_spec.repo"
-        ));
-        let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
-        follow_up.repo = OrgRepo("/Epiphany".into());
-        assert!(matches!(
-            PipelineDocument::FollowUp(follow_up).validate(),
-            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "follow_up.repo"
-        ));
-    }
-
-    #[test]
-    fn keys_are_derived_and_mismatch_refuses() -> Result<()> {
-        let cache = schema_cache()?;
-        for (document, key) in samples() {
-            assert_eq!(pipeline_key(&document), Ok(key.clone()));
-            let mut envelope = document.prepare(&cache)?;
-            envelope.key = format!("{key}-forged");
-            assert_eq!(
-                validate_pipeline_write_envelope(&envelope),
-                Err(PipelineRefusal::InvalidIdentity { kind: document.kind(), key: envelope.key, expected: key })
-            );
-        }
-        let mut resolution = resolution_sample();
-        let answered = pipeline_key(&PipelineDocument::Resolution(resolution.clone()));
-        resolution.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Resolution(resolution)),
-            answered,
-            "a subject has one resolution key whatever the outcome"
-        );
-        Ok(())
-    }
-
-    /// F2, and Soul's second pass: a composed local segments one way only. The
-    /// rule -- no local part carries the separator -- is pinned on the composer
-    /// in `no_local_part_carries_the_separator`; the pairs below are the ones
-    /// Soul measured through the documents, and each is a pair only because the
-    /// rule holds.
-    #[test]
-    fn composed_keys_cannot_collide() {
-        let key = |document: PipelineDocument| pipeline_key(&document);
-
-        // Soul's hand-off pair. A dotted slug is ordinary on the receiver side
-        // and a dotted repo name (the part after the mandatory `/`, GitHub's
-        // grammar owns no dot on the owner side) is ordinary on the repo side,
-        // so both are escaped: left unescaped these two both key to
-        // `yggdrasil:hand_off:thought-cage.GameCult.Epiphany_-thing.2026-09-15`.
-        let handed = |to: &str, repo: &str| {
-            let mut hand_off = hand_off_sample();
-            hand_off.to_instance = slug(to);
-            hand_off.repo = OrgRepo(repo.into());
-            key(PipelineDocument::HandOff(hand_off))
-        };
-        let dotted_receiver = handed("thought-cage.GameCult", "Epiphany/thing");
-        let dotted_repo = handed("thought-cage", "GameCult/Epiphany.thing");
-        assert_eq!(
-            dotted_receiver,
-            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.epiphany_-thing.2026-09-15"))
-        );
-        assert_eq!(
-            dotted_repo,
-            Ok(format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany_dthing.2026-09-15"))
-        );
-        assert_ne!(dotted_receiver, dotted_repo, "a dotted repo and a dotted receiver cannot claim one key");
-
-        let mut wide_label = finding_sample();
-        wide_label.label = l("F1.G");
-        assert!(
-            matches!(key(PipelineDocument::Finding(wide_label)), Err(PipelineRefusal::InvalidFormat { .. })),
-            "a finding label carrying a dot is refused, not silently composed"
-        );
-        let mut deep_verdict = finding_sample();
-        deep_verdict.verdict = id("verdict", "cut-3a.s1.F1");
-        deep_verdict.label = l("G");
-        assert!(
-            matches!(key(PipelineDocument::Finding(deep_verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
-            "a verdict local that is not cut-<label>.s<N> is refused"
-        );
-        let mut plain = finding_sample();
-        plain.verdict = id("verdict", "cut-3a.s1");
-        plain.label = l("F1");
-        assert_eq!(key(PipelineDocument::Finding(plain)), Ok(format!("{CAMPAIGN}:finding:cut-3a.s1.F1")));
-
-        let mut deep_spec = report_sample();
-        deep_spec.cut_spec = id("cut_spec", "cut-3a.h1.r1");
-        deep_spec.attempt = 2;
-        assert!(
-            matches!(key(PipelineDocument::CutReport(deep_spec)), Err(PipelineRefusal::InvalidFormat { .. })),
-            "a cut label carrying a dot is refused, so cut-3a.h1.h2 has one source"
-        );
-        let mut attempt_two = report_sample();
-        attempt_two.attempt = 2;
-        assert_eq!(key(PipelineDocument::CutReport(attempt_two)), Ok(format!("{CAMPAIGN}:cut_report:cut-3a.h2")));
-    }
-
-    /// F3: every parent id is parsed strictly. These are the bad parents Soul
-    /// found accepted, plus the wrong-kind and marker rules that mutations S1
-    /// and S3 remove.
-    #[test]
-    fn parent_ids_are_parsed_strictly() {
-        let refused = |parent: &str| {
-            let mut report = report_sample();
-            report.cut_spec = Short(parent.into());
-            let key = pipeline_key(&PipelineDocument::CutReport(report));
-            assert!(
-                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_report.cut_spec"),
-                "parent {parent:?} must be refused, got {key:?}"
-            );
-        };
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:junk"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.rX"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-..r1"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-.r1"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1 "));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r"));
-        refused(&format!("{CAMPAIGN}:cut_report:cut-3a.h1"));
-        // Right kind and a well-formed number, but the marker belongs to
-        // another kind: the marker rule is pinned on its own.
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.h1"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.s1"));
-        // A well-formed number with no marker at all. Only the marker rule
-        // refuses this one: the digits rule is satisfied either way.
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.1"));
-        refused(&format!("{CAMPAIGN}:CUT_SPEC:cut-3a.r1"));
-        refused(&format!("EUREKA-STATE:cut_spec:cut-3a.r1"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:"));
-        refused(&format!("{CAMPAIGN}::cut-3a.r1"));
-        refused("cut-3a.r1");
-        let mut other_campaign = report_sample();
-        other_campaign.campaign = slug("other-campaign");
-        assert!(
-            matches!(
-                pipeline_key(&PipelineDocument::CutReport(other_campaign)),
-                Err(PipelineRefusal::InvalidFormat { .. })
-            ),
-            "a parent in another campaign is refused"
-        );
-        let mut verdict = verdict_sample();
-        verdict.cut_report = id("cut_report", "cut-3a.r1");
-        assert!(
-            matches!(pipeline_key(&PipelineDocument::Verdict(verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
-            "a verdict's parent must carry the report marker, not the spec marker"
-        );
-    }
-
-    /// F4: a resolution's subject id is a full id of the declared kind.
-    #[test]
-    fn resolution_subject_is_a_full_id_of_its_kind() {
-        let refused = |kind: PipelineKind, subject: &str| {
-            let mut resolution = resolution_sample();
-            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
-            let document = PipelineDocument::Resolution(resolution);
-            assert!(
-                matches!(document.validate(), Err(PipelineRefusal::InvalidFormat { .. })),
-                "subject {subject:?} must fail validation"
-            );
-            assert!(
-                matches!(pipeline_key(&document), Err(PipelineRefusal::InvalidFormat { .. })),
-                "subject {subject:?} must not compose a key"
-            );
-        };
-        refused(PipelineKind::Question, "");
-        refused(PipelineKind::Question, "not an id: spaces and : colons");
-        refused(PipelineKind::Question, "eureka-state:question:1１");
-        refused(PipelineKind::Question, &format!("{CAMPAIGN}:ruling:R8"));
-        refused(PipelineKind::Ruling, &format!("{CAMPAIGN}:question:Q1"));
-        refused(PipelineKind::Question, &format!("{CAMPAIGN}:question:.."));
-
-        let mut valid = resolution_sample();
-        valid.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Resolution(valid)),
-            Ok(format!("{CAMPAIGN}:resolution:ruling.R8.n1"))
-        );
-    }
-
-    /// Soul G2: a resolution is named by the key it has, and a `PipelineRef`
-    /// of kind `Resolution` accepts exactly that id. `PipelineRef` takes any
-    /// kind, so this is reachable; a follow-up sourced from a resolution is the
-    /// live path. The grammar admits `<campaign>:resolution:R8` too: it is
-    /// well-formed, and no resolution derives it, but whether a document with an
-    /// id exists is admission's rule, not the grammar's, so the reader does not
-    /// refuse it and this test does not ask it to.
-    #[test]
-    fn a_resolution_is_named_by_the_key_it_has() {
-        let sourced = |id: &str| {
-            let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
-            follow_up.source = PipelineRef { kind: PipelineKind::Resolution, id: Short(id.into()) };
-            PipelineDocument::FollowUp(follow_up).validate()
-        };
-        let key = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
-        assert_eq!(key, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
-        assert_eq!(sourced(&key), Ok(()), "a resolution is named by the key it has");
-        assert_eq!(sourced(&format!("{CAMPAIGN}:resolution:R8")), Ok(()), "well-formed grammar is not the reader's to refuse");
-
-        for refused in [
-            // The prefix shape the writer used to emit. No resolution carries it.
-            format!("resolution:{CAMPAIGN}:question:Q1"),
-            format!("{CAMPAIGN}:resolution:{CAMPAIGN}:question:Q1"),
-            // No local, a subject local with an empty part, trailing junk, and a
-            // kind segment that is not `resolution`.
-            format!("{CAMPAIGN}:resolution:"),
-            format!("{CAMPAIGN}:resolution:question..Q1"),
-            format!("{CAMPAIGN}:resolution:question.Q1:junk"),
-            format!("{CAMPAIGN}:question:Q1"),
-        ] {
-            assert!(
-                matches!(sourced(&refused), Err(PipelineRefusal::InvalidFormat { .. })),
-                "{refused:?} is not an id any resolution has"
-            );
-        }
-
-        // A root subject reads back too: a resolution of a campaign carries the
-        // campaign's kind and its `self` local.
-        let mut of_campaign = resolution_sample();
-        of_campaign.subject = PipelineRef { kind: PipelineKind::Campaign, id: Short(format!("{CAMPAIGN}:campaign:self")) };
-        let root_key = pipeline_key(&PipelineDocument::Resolution(of_campaign)).expect("a root subject keys");
-        assert_eq!(root_key, format!("{CAMPAIGN}:resolution:campaign.self.n1"));
-        assert_eq!(sourced(&root_key), Ok(()));
-    }
-
-    /// The three kinds a mind is keyed by. The samples above already round-trip
-    /// every kind; this pins the shapes D2 gives these three specifically: an
-    /// instance is a root keyed by its own slug, and the other two hang off an
-    /// instance rather than a campaign, so neither borrows the campaign tail.
-    #[test]
-    fn instance_stewardship_and_hand_off_round_trip() -> Result<()> {
-        let cache = schema_cache()?;
-        let instance = PipelineDocument::Instance(instance_sample());
-        assert_eq!(pipeline_key(&instance), Ok(format!("{INSTANCE}:instance:self")));
-        for document in [
-            instance,
-            PipelineDocument::Stewardship(stewardship_sample()),
-            PipelineDocument::HandOff(hand_off_sample()),
-        ] {
-            document.validate()?;
-            let envelope = document.prepare(&cache)?;
-            assert_eq!(PipelineDocument::decode(&envelope)?, document);
-            let key = pipeline_key(&document)?;
-            assert!(
-                !key.starts_with(&format!("{CAMPAIGN}:")),
-                "{:?} is keyed by its instance, not by a campaign: {key}",
-                document.kind()
-            );
-            validate_pipeline_write_envelope(&envelope)?;
-        }
-        // A bounded list is still bounded: `documents` carries a maximum, as
-        // every `Vec` field must.
-        let mut wide = hand_off_sample();
-        wide.documents = vec![s("x"); 257];
-        assert_eq!(
-            PipelineDocument::HandOff(wide).validate(),
-            Err(PipelineRefusal::FieldBound { field: "hand_off.documents".into(), limit: 256, actual: 257 })
-        );
-        Ok(())
-    }
-
-    /// Soul F3: a key and an id are the same string, so every kind's key reads
-    /// back as an id of that kind. The kinds a mind is keyed by were added to
-    /// the key writer and left out of the id reader, and nothing noticed,
-    /// because the key tests assert strings and never read one back: an
-    /// instance keys to its slug and then fails to parse as an instance id, so
-    /// no `PipelineRef` and no resolution could ever name one. Every kind now
-    /// reads back with no kind excused, a resolution included, and a root kind
-    /// read as the other root kind is refused: the reader checks the kind
-    /// segment for the roots exactly as for every other kind.
-    #[test]
-    fn keys_read_back_as_ids_of_their_kind() -> Result<()> {
-        for (document, expected) in samples() {
-            let kind = document.kind();
-            let key = pipeline_key(&document)?;
-            assert_eq!(key, expected, "{kind:?} keys to its sample's key");
-            assert_eq!(
-                pipeline_id("read_back", &key, kind).map(|_| ()),
-                Ok(()),
-                "{kind:?} key {key} does not read back as an id of its kind"
-            );
-        }
-
-        let campaign_key = pipeline_key(&campaign_sample())?;
-        let instance_key = pipeline_key(&PipelineDocument::Instance(instance_sample()))?;
-        assert_eq!(
-            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
-            Ok((INSTANCE, ROOT_LOCAL)),
-            "an instance key reads back as an instance"
-        );
-        assert_eq!(
-            pipeline_id("read_back", &instance_key, PipelineKind::Campaign),
-            Err(format_error("read_back", &instance_key)),
-            "an instance key is not a campaign id"
-        );
-        assert_eq!(
-            pipeline_id("read_back", &campaign_key, PipelineKind::Instance),
-            Err(format_error("read_back", &campaign_key)),
-            "a campaign key is not an instance id"
-        );
-
-        // Soul X1 and X11: the reader's root and local are each `dotted_text`
-        // whole, so a trailing dot on either is refused by the reader itself,
-        // not only by the writer that never composes one. A leading dot and
-        // an empty part are the same rule on the local.
-        for malformed in ["c.:target:x", "c:target:x.", "c:target:.x", "c:target:a..b"] {
-            let read = pipeline_id("read_back", malformed, PipelineKind::Target);
-            assert!(
-                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "read_back"),
-                "{malformed:?} is not an id of any kind, got {read:?}"
-            );
-        }
-
-        // The instance root's own key segment is validated, not merely bounded.
-        // Nothing else stands between a `Slug` and a key: a space would compose
-        // a store key carrying a byte no `Label` may hold.
-        let mut spaced = instance_sample();
-        spaced.instance = Slug("thought cage".into());
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Instance(spaced)),
-            Err(PipelineRefusal::InvalidFormat {
-                field: "instance.instance".into(),
-                value: "thought cage".into(),
-            }),
-            "an instance slug is validated where the key is composed"
-        );
-        Ok(())
-    }
-
-    /// The repo is one key segment, so its slash is escaped. Left unescaped it
-    /// would both add a segment the reader cannot tell from a real one and put a
-    /// byte in the key that no `Label` may carry; escaped to a bare `_` it would
-    /// let two repos claim one key, which the colliding pair below pins.
-    #[test]
-    fn stewardship_key_escapes_the_repo_slash() {
-        let stewardship = stewardship_sample();
-        assert_eq!(stewardship.repo, OrgRepo("GameCult/Epiphany".into()));
-        let key = pipeline_key(&PipelineDocument::Stewardship(stewardship.clone()));
-        assert_eq!(key, Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")));
-        assert!(!key.unwrap().contains('/'), "no key segment carries a slash");
-
-        // The escape is not a cosmetic substitution, and the pair that proves
-        // it is a pair: GitHub's grammar keeps `.` and `_` out of the owner,
-        // so both live in the repo half here, and under a naive scheme that
-        // collapsed `/`, `.` and `_` all to a bare `_` both of these key to
-        // `GameCult_Epiphany_thing`, and one of the two documents is lost.
-        let keyed = |repo: &str| {
-            let mut value = stewardship.clone();
-            value.repo = OrgRepo(repo.into());
-            pipeline_key(&PipelineDocument::Stewardship(value))
-        };
-        let dotted_repo = keyed("GameCult/Epiphany.thing");
-        let underscored_repo = keyed("GameCult/Epiphany_thing");
-        assert_eq!(
-            dotted_repo,
-            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany_dthing.n1"))
-        );
-        assert_eq!(
-            underscored_repo,
-            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany__thing.n1"))
-        );
-        assert_ne!(dotted_repo, underscored_repo, "two repos cannot claim one key");
-
-        let mut no_org = stewardship.clone();
-        no_org.repo = OrgRepo("Epiphany".into());
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Stewardship(no_org)),
-            Err(PipelineRefusal::InvalidFormat { field: "stewardship.repo".into(), value: "Epiphany".into() })
-        );
-
-        // S-1: key derivation goes through `identity()`, so a case variant of
-        // the same repository is one store key, not two stewardships of what
-        // is really one repo.
-        let mut upper = stewardship.clone();
-        upper.repo = OrgRepo("gamecult/epiphany".into());
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Stewardship(upper)),
-            pipeline_key(&PipelineDocument::Stewardship(stewardship.clone())),
-            "GameCult/Epiphany and gamecult/epiphany must derive one store key"
-        );
-
-        // An escaped repo is still bound by the key's segment rules.
-        let mut long = stewardship;
-        long.repo = OrgRepo(format!("GameCult/{}", "a".repeat(60)));
-        assert!(
-            matches!(
-                pipeline_key(&PipelineDocument::Stewardship(long)),
-                Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "stewardship.key"
-            ),
-            "a repo segment longer than a key segment is refused"
-        );
-    }
-
-    /// A hand-off is recorded in both minds, so both instances are in the key:
-    /// the sender owns the first segment and the receiver the local. Changing
-    /// either one moves the document.
-    #[test]
-    fn hand_off_names_both_instances() {
-        let key = |hand_off: PipelineHandOff| pipeline_key(&PipelineDocument::HandOff(hand_off));
-        let base = key(hand_off_sample()).expect("the sample keys");
-        assert_eq!(base, format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.2026-09-15"));
-
-        let mut other_sender = hand_off_sample();
-        other_sender.from_instance = slug("thought-cage");
-        assert_ne!(key(other_sender), Ok(base.clone()), "the sender is in the key");
-
-        let mut other_receiver = hand_off_sample();
-        other_receiver.to_instance = slug("mimir");
-        assert_ne!(key(other_receiver), Ok(base.clone()), "the receiver is in the key");
-
-        // Two hand-offs of the same repo between the same pair on different
-        // days are different documents.
-        let mut later = hand_off_sample();
-        later.handed_on = Date("2026-09-16".into());
-        assert_ne!(key(later), Ok(base), "the date is in the key");
-
-        // A dotted receiver is a `Slug` entering a local, so it is escaped to
-        // one label rather than widening the local by a part.
-        let mut dotted_receiver = hand_off_sample();
-        dotted_receiver.to_instance = slug("thought-cage.GameCult");
-        assert_eq!(
-            key(dotted_receiver),
-            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.gamecult_-epiphany.2026-09-15"))
-        );
-
-        // The escape's `_` half is not only for repos: a receiver `a_db` and a
-        // receiver `a.b` would both key to `a_db` if the slug's own `_` passed
-        // through raw, so the slug is escaped as `a__db` and the two differ.
-        let mut underscored_receiver = hand_off_sample();
-        underscored_receiver.to_instance = slug("a_db");
-        let mut dotted_twin = hand_off_sample();
-        dotted_twin.to_instance = slug("a.b");
-        let underscored_receiver = key(underscored_receiver).expect("an underscored receiver keys");
-        assert!(underscored_receiver.contains("a__db"), "{underscored_receiver}: the slug's underscore is escaped");
-        assert_ne!(key(dotted_twin), Ok(underscored_receiver), "`a_db` and `a.b` are two receivers");
-
-        // Both instance slugs are validated as key segments, not merely bounded.
-        let mut bad_receiver = hand_off_sample();
-        bad_receiver.to_instance = Slug("thought cage".into());
-        assert_eq!(
-            key(bad_receiver),
-            Err(PipelineRefusal::InvalidFormat {
-                field: "hand_off.to_instance".into(),
-                value: "thought cage".into(),
-            })
-        );
-        let mut bad_date = hand_off_sample();
-        bad_date.handed_on = Date("2026-9-15".into());
-        assert!(
-            matches!(key(bad_date), Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "hand_off.handed_on"),
-            "a malformed date does not compose a key"
-        );
-    }
-
-    /// A resolution whose subject is the given document, keyed.
-    fn resolution_of(kind: PipelineKind, id: &str) -> Result<String, PipelineRefusal> {
-        let mut resolution = resolution_sample();
-        resolution.subject = PipelineRef { kind, id: Short(id.into()) };
-        pipeline_key(&PipelineDocument::Resolution(resolution))
-    }
-
-    /// R1, the grammar's own test: every key is `<root>:<kind>:<local>`, three
-    /// segments with no kind excused, the root a `Slug`, the kind the literal
-    /// name, and every local part a `Label`. A root that would add a segment is
-    /// refused where the key is composed: `pipeline_key` is `pub` and does not
-    /// validate the document first, so this is reachable without one.
-    #[test]
-    fn every_key_has_exactly_three_segments() {
-        let nested = resolution_of(PipelineKind::Resolution, &format!("{CAMPAIGN}:resolution:question.Q1.n1"))
-            .expect("a resolution of a resolution keys");
-        let keys = samples()
-            .into_iter()
-            .map(|(document, _)| (document.kind(), pipeline_key(&document).expect("every sample keys")))
-            .chain([(PipelineKind::Resolution, nested)]);
-        for (kind, key) in keys {
-            let segments = key.split(':').collect::<Vec<_>>();
-            assert_eq!(segments.len(), 3, "{kind:?} key {key} has three segments");
-            assert_eq!(dotted_text("root", segments[0]), Ok(()), "{key}: the root is a slug");
-            assert_eq!(segments[1], kind.name(), "{key}: the kind segment is the literal kind");
-            assert!(PipelineKind::ALL.iter().any(|known| known.name() == segments[1]));
-            for part in segments[2].split('.') {
-                assert_eq!(label_text("local", part), Ok(()), "{key}: local part {part:?} is a label");
-            }
-        }
-
-        // A root that would add a segment, one that would empty a part, and one
-        // wider than a segment are all refused before a key is formatted. The
-        // refusal names the part that failed, so an empty part reports `""`.
-        let trailing_dot = format!("{CAMPAIGN}.");
-        let leading_dot = format!(".{CAMPAIGN}");
-        let over = "a".repeat(65);
-        for root in ["a:b", trailing_dot.as_str(), leading_dot.as_str(), "a..b", over.as_str()] {
-            let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
-            target.campaign = Slug(root.into());
-            let key = pipeline_key(&PipelineDocument::Target(target));
-            assert!(
-                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "target.campaign"),
-                "root {root:?} does not compose a key, got {key:?}"
-            );
-        }
-    }
-
-    /// Defect 1: the two roots are in distinct namespaces because the kind
-    /// segment distinguishes them, the same mechanism that separates every
-    /// other pair of kinds. Both key; only the pair sees a shared namespace.
-    #[test]
-    fn roots_of_different_kinds_do_not_share_a_key() {
-        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
-        campaign.slug = slug(INSTANCE);
-        let campaign = pipeline_key(&PipelineDocument::Campaign(campaign));
-        let instance = pipeline_key(&PipelineDocument::Instance(instance_sample()));
-        assert_eq!(campaign, Ok(format!("{INSTANCE}:campaign:self")));
-        assert_eq!(instance, Ok(format!("{INSTANCE}:instance:self")));
-        assert_ne!(campaign, instance, "a campaign and an instance of one slug are two documents");
-    }
-
-    /// The root is a `Slug`, so a dotted root keys and reads back whole on
-    /// both sides: the writer's root check and the reader's root check are
-    /// each `dotted_text`, not `label_text`. A campaign `game.cult` and an
-    /// instance `ygg.drasil` key, a document under the dotted campaign keys,
-    /// and each reads back through `pipeline_id` recovering the root exactly.
-    #[test]
-    fn dotted_roots_key_and_read_back() {
-        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
-        campaign.slug = slug("game.cult");
-        let campaign_key = pipeline_key(&PipelineDocument::Campaign(campaign)).expect("a dotted campaign keys");
-        assert_eq!(campaign_key, "game.cult:campaign:self");
-        assert_eq!(
-            pipeline_id("read_back", &campaign_key, PipelineKind::Campaign),
-            Ok(("game.cult", ROOT_LOCAL)),
-            "the dotted campaign root reads back whole"
-        );
-
-        let mut instance = instance_sample();
-        instance.instance = slug("ygg.drasil");
-        let instance_key = pipeline_key(&PipelineDocument::Instance(instance)).expect("a dotted instance keys");
-        assert_eq!(instance_key, "ygg.drasil:instance:self");
-        assert_eq!(
-            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
-            Ok(("ygg.drasil", ROOT_LOCAL)),
-            "the dotted instance root reads back whole"
-        );
-
-        let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
-        target.campaign = slug("game.cult");
-        let target_key = pipeline_key(&PipelineDocument::Target(target)).expect("a target under a dotted campaign keys");
-        assert_eq!(target_key, "game.cult:target:r2");
-        assert_eq!(
-            pipeline_id("read_back", &target_key, PipelineKind::Target),
-            Ok(("game.cult", "r2")),
-            "the dotted root and the local both read back"
-        );
-
-        let resolution = resolution_of(PipelineKind::Campaign, &campaign_key).expect("a resolution of a dotted campaign keys");
-        assert_eq!(resolution, "game.cult:resolution:campaign.self.n1");
-        assert_eq!(
-            pipeline_id("read_back", &resolution, PipelineKind::Resolution),
-            Ok(("game.cult", "campaign.self.n1")),
-            "a resolution under a dotted root reads back"
-        );
-    }
-
-    /// Cut 6c: a resolution's referent is a full id of the kind it declares,
-    /// validated through `PipelineRef` like every other referent, so a
-    /// well-formed id of the wrong kind is refused and the refusal names the
-    /// entry. The positive case is Ghostlight's own: a ruling partly
-    /// overturned by two later records, one of them a resolution named by the
-    /// key it has, which only the 6b grammar made nameable. An id no
-    /// resolution derives, `eureka-state:resolution:R8`, still validates:
-    /// whether a document with an id exists is admission's rule.
-    #[test]
-    fn resolution_outcome_referents_are_parsed_ids_of_their_kind() {
-        let resolved = |subject: PipelineRef, outcome: ResolutionOutcome| {
-            let mut resolution = resolution_sample();
-            resolution.subject = subject;
-            resolution.outcome = outcome;
-            PipelineDocument::Resolution(resolution).validate()
-        };
-        let refused = |field: &str, result: Result<(), PipelineRefusal>| {
-            assert!(
-                matches!(&result, Err(PipelineRefusal::InvalidFormat { field: at, .. }) if at == field),
-                "expected InvalidFormat at {field}, got {result:?}"
-            );
-        };
-        let ruling = |label: &str| PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", label) };
-        let question = |label: &str| PipelineRef { kind: PipelineKind::Question, id: id("question", label) };
-        let inner = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
-        let resolution = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
-
-        let superseded = |second: PipelineRef| ResolutionOutcome::Superseded { by: vec![ruling("R9"), second] };
-        assert_eq!(resolved(ruling("R8"), superseded(resolution)), Ok(()));
-        let forged = PipelineRef { kind: PipelineKind::Ruling, id: Short(inner) };
-        refused("resolution.outcome.by[1].id", resolved(ruling("R8"), superseded(forged)));
-        let underived = PipelineRef { kind: PipelineKind::Resolution, id: Short(format!("{CAMPAIGN}:resolution:R8")) };
-        assert_eq!(resolved(ruling("R8"), superseded(underived)), Ok(()), "well-formed grammar is not the shape's to refuse");
-
-        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Answered { by: ruling("R8") }), Ok(()));
-        let forged = PipelineRef { kind: PipelineKind::Question, id: id("ruling", "R8") };
-        refused("resolution.outcome.by.id", resolved(question("Q1"), ResolutionOutcome::Answered { by: forged }));
-
-        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Deferred { to: question("Q2") }), Ok(()));
-        let forged = PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q2") };
-        refused("resolution.outcome.to.id", resolved(question("Q1"), ResolutionOutcome::Deferred { to: forged }));
-
-        let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
-        let fixed = |by: Option<PipelineRef>| ResolutionOutcome::Fixed { commit: sha(), by };
-        assert_eq!(resolved(finding.clone(), fixed(None)), Ok(()));
-        assert_eq!(resolved(finding.clone(), fixed(Some(ruling("R8")))), Ok(()));
-        let forged = PipelineRef { kind: PipelineKind::Finding, id: id("ruling", "R8") };
-        refused("resolution.outcome.by.id", resolved(finding, fixed(Some(forged))));
-
-        // Soul F2: the validator's bound on a supersession is its own, not
-        // only the schema's. Eight referents are the most a subject names;
-        // nine are refused as a count before any item is read.
-        let rulings = |count: usize| (1..=count).map(|n| ruling(&format!("R{n}"))).collect::<Vec<_>>();
-        assert_eq!(resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(8) }), Ok(()));
-        assert_eq!(
-            resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(9) }),
-            Err(PipelineRefusal::FieldBound { field: "resolution.outcome.by".into(), limit: 8, actual: 9 })
-        );
-
-        // Soul F3: the two reason-carrying outcomes are bounded like every
-        // `Line`; the shared arm is pinned on both so neither can drop out.
-        let wide = Line("a".repeat(1001));
-        for outcome in [
-            ResolutionOutcome::Recorded { reason: wide.clone() },
-            ResolutionOutcome::Withdrawn { reason: wide },
-        ] {
-            let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
-            assert_eq!(
-                resolved(finding, outcome),
-                Err(PipelineRefusal::FieldBound { field: "resolution.outcome.reason".into(), limit: 1000, actual: 1001 })
-            );
-        }
-    }
-
-    /// Ruling B: a fix names the tree where the finding stopped being true,
-    /// as a `Sha`. Uppercase hex of a legal length is the forgery a length
-    /// check passes and `hex` refuses.
-    #[test]
-    fn fixed_resolution_requires_a_commit_sha() {
-        let fixed = |commit: &str, by: Option<PipelineRef>| {
-            let mut resolution = resolution_sample();
-            resolution.subject = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
-            resolution.outcome = ResolutionOutcome::Fixed { commit: Sha(commit.into()), by };
-            PipelineDocument::Resolution(resolution).validate()
-        };
-        assert_eq!(fixed("5f98228d9c", None), Ok(()));
-        for forged in ["5F98228D9C", "5f9822", "dirty-worktree", ""] {
-            assert_eq!(
-                fixed(forged, None),
-                Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: forged.into() }),
-                "{forged:?} is not a commit"
-            );
-        }
-        // Soul F1: naming the record that fixed it does not excuse the commit.
-        let ruling = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
-        assert_eq!(
-            fixed("dirty-worktree", Some(ruling)),
-            Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: "dirty-worktree".into() }),
-            "a fix with a named record still names a commit"
-        );
-    }
-
-    /// A mutation record has a key-safe identity a verdict claim can name,
-    /// and is pinned to a tree: its label is a `Label` and its commit a
-    /// `Sha`, so a dotted label and free text where a sha belongs are refused.
-    #[test]
-    fn mutation_records_carry_a_dot_free_label_and_a_commit() {
-        let recorded = |label: &str, commit: &str| {
-            let mut report = report_sample();
-            // Through `From<&str>`, which every text type has, so the
-            // widened types under M19 and M20 still compile and the
-            // forgeries reach validation.
-            report.mutations[0].label = label.into();
-            report.mutations[0].commit = commit.into();
-            PipelineDocument::CutReport(report).validate()
-        };
-        assert_eq!(recorded("M1", "5f98228d"), Ok(()));
-        assert_eq!(
-            recorded("M1.a", "5f98228d"),
-            Err(PipelineRefusal::InvalidFormat { field: "cut_report.mutations[0].label".into(), value: "M1.a".into() })
-        );
-        assert_eq!(
-            recorded("M1", "dirty-worktree"),
-            Err(PipelineRefusal::InvalidFormat {
-                field: "cut_report.mutations[0].commit".into(),
-                value: "dirty-worktree".into(),
-            })
-        );
-    }
-
-    /// Ruling A's shape half: a claim names the promise it measured and the
-    /// mutations it ran, both as `Label`s, and names at most eight mutations.
-    #[test]
-    fn a_verdict_claim_names_the_promise_and_the_mutation_it_measured() {
-        let sample = verdict_sample();
-        assert_eq!(sample.claims[0].promise, Some(l("P1")));
-        assert_eq!(sample.claims[0].mutations, vec![l("M1")]);
-        assert_eq!(PipelineDocument::Verdict(sample).validate(), Ok(()));
-
-        let claimed = |promise: Option<Label>, mutations: Vec<Label>| {
-            let mut verdict = verdict_sample();
-            verdict.claims[0].promise = promise;
-            verdict.claims[0].mutations = mutations;
-            PipelineDocument::Verdict(verdict).validate()
-        };
-        assert_eq!(claimed(None, vec![]), Ok(()), "a claim need not measure a promise");
-        assert_eq!(
-            claimed(Some(l("P1.a")), vec![]),
-            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].promise".into(), value: "P1.a".into() })
-        );
-        assert_eq!(
-            claimed(None, vec![l("M1.a")]),
-            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].mutations[0]".into(), value: "M1.a".into() })
-        );
-        let labels = |count: usize| (1..=count).map(|n| l(&format!("M{n}"))).collect::<Vec<_>>();
-        assert_eq!(claimed(None, labels(8)), Ok(()));
-        assert_eq!(
-            claimed(None, labels(9)),
-            Err(PipelineRefusal::FieldBound { field: "verdict.claims[0].mutations".into(), limit: 8, actual: 9 })
-        );
-    }
-
-    /// A tripwire on the one hazard of retyping the estimate: the delta's two
-    /// `u32` fields are not interchangeable. The sample spec is Cut 3a's, a
-    /// net addition of 900 lines, and the order is asserted.
-    #[test]
-    fn the_sample_cut_spec_estimates_a_net_addition() {
-        let PipelineDocument::CutSpec(spec) = samples().remove(4).0 else { unreachable!() };
-        assert_eq!(spec.estimate.lines_added, 900);
-        assert_eq!(spec.estimate.lines_removed, 0);
-        assert_eq!(spec.estimate, report_sample().structural_delta, "the estimate and the actual are one shape");
-    }
-
-    /// Defect 2: a resolution's key carries its subject's kind as a literal
-    /// part of the local, so nothing infers it and two subjects of one local
-    /// and different kinds resolve to two keys. Each reads back through the
-    /// reader with the subject kind it was built from.
-    #[test]
-    fn a_resolution_names_its_subjects_kind() {
-        let pairs = [
-            (PipelineKind::Question, id("question", "Q1").0, PipelineKind::Ruling, id("ruling", "Q1").0),
-            (
-                PipelineKind::Campaign,
-                format!("{CAMPAIGN}:campaign:self"),
-                PipelineKind::Instance,
-                format!("{CAMPAIGN}:instance:self"),
-            ),
-        ];
-        for (left_kind, left_id, right_kind, right_id) in pairs {
-            let left = resolution_of(left_kind, &left_id).expect("the left subject keys");
-            let right = resolution_of(right_kind, &right_id).expect("the right subject keys");
-            assert_ne!(left, right, "resolutions of {left_id} and {right_id} are two documents");
-            for (kind, key) in [(left_kind, &left), (right_kind, &right)] {
-                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
-                assert_eq!(root, CAMPAIGN);
-                assert_eq!(local.split('.').next(), Some(kind.name()), "{key} names its subject's kind");
-            }
-        }
-    }
-
-    /// Defect 3: a resolution's own key is an ordinary id, so it composes as a
-    /// subject like any other, and the key reads back to the inner key -- the
-    /// whole inner key, sequence included, since the subject is recovered by
-    /// stripping this resolution's own sequence from the end and the kind from
-    /// the front. The depth bound is tested per kind by
-    /// `every_resolvable_kind_resolves_two_deep`.
-    #[test]
-    fn a_resolution_of_a_resolution_reads_back() {
-        let inner = resolution_of(PipelineKind::Question, &id("question", "Q1").0).expect("the inner keys");
-        let mut outer = resolution_sample();
-        outer.subject = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
-        let outer = PipelineDocument::Resolution(outer);
-        assert_eq!(outer.validate(), Ok(()));
-        let key = pipeline_key(&outer).expect("a resolution of a resolution keys");
-        assert_eq!(key, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"));
-        let (root, local) = pipeline_id("read_back", &key, PipelineKind::Resolution).expect("reads back");
-        let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
-        let (subject_local, _sequence) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
-        assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), inner, "the recovered subject is the inner key");
-    }
-
-    /// Each level of a nesting carries its own sequence, and only its own: the
-    /// part appended is this resolution's `sequence` field, never a copy of the
-    /// sequence the subject already ends in. The fixtures elsewhere all sit at
-    /// `1` at every level, where the two are indistinguishable, so the chain
-    /// here differs at every level and reads back level by level.
-    ///
-    /// On spelling, so silence is not read as coverage: the leaf emits `n<N>`
-    /// with `N` as `u32::to_string` writes it, so `n0` and `n12` are emitted
-    /// and `n01` is not. A hand-built id ending `n01`, `n1x`, or no `n<N>` at
-    /// all is still a well-formed reference -- those are legal labels, and a
-    /// grammar that reads keys may not refuse them on spelling. Nothing in the
-    /// leaf canonicalises them either: such an id simply names a document the
-    /// leaf would never key, which admission's A7 sees as a missing referent.
-    #[test]
-    fn every_level_of_a_nesting_keeps_its_own_sequence() {
-        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
-            let mut resolution = resolution_sample();
-            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
-            resolution.sequence = sequence;
-            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
-        };
-        let first = resolved(PipelineKind::Question, &id("question", "Q1").0, 9);
-        let second = resolved(PipelineKind::Resolution, &first, 10);
-        let third = resolved(PipelineKind::Resolution, &second, 0);
-        let fourth = resolved(PipelineKind::Resolution, &third, 12);
-        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n9"));
-        assert_eq!(second, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n9.n10"));
-        assert_eq!(third, format!("{CAMPAIGN}:resolution:resolution.resolution.question.Q1.n9.n10.n0"));
-        assert_eq!(
-            fourth,
-            format!("{CAMPAIGN}:resolution:resolution.resolution.resolution.question.Q1.n9.n10.n0.n12")
-        );
-        for (outer, inner, sequence) in [(&fourth, &third, 12), (&third, &second, 0), (&second, &first, 10)] {
-            let (root, local) = pipeline_id("read_back", outer, PipelineKind::Resolution).expect("reads back");
-            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
-            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
-            assert_eq!(subject_kind, "resolution", "{outer}: the subject of a nesting is a resolution");
-            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), *inner, "{outer}: the subject is the inner key");
-            assert_eq!(last, format!("n{sequence}"), "{outer}: this level's own sequence, not the subject's");
-        }
-    }
-
-    /// A stewardship is the other sequenced kind, and it composes as a subject
-    /// like any other: the subject's whole local, escaped repo and sequence
-    /// both, is the resolution's local, with the resolution's own sequence
-    /// last. So the two assignments of one repo have two resolutions, and a
-    /// resolution of either is itself resolvable.
-    #[test]
-    fn a_resolution_of_a_stewardship_reads_back() {
-        let stewarded = |sequence: u32| {
-            let mut stewardship = stewardship_sample();
-            stewardship.sequence = sequence;
-            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
-        };
-        let first = stewarded(1);
-        let second = stewarded(2);
-        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
-        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
-
-        let resolved = resolution_of(PipelineKind::Stewardship, &first).expect("a resolution of a stewardship keys");
-        let resolved_second = resolution_of(PipelineKind::Stewardship, &second).expect("the second assignment resolves");
-        assert_eq!(resolved, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n1.n1"));
-        assert_eq!(resolved_second, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n2.n1"));
-        assert_ne!(resolved, resolved_second, "each assignment keeps its own resolution");
-
-        for (key, subject) in [(&resolved, &first), (&resolved_second, &second)] {
-            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
-            assert_eq!(root, INSTANCE, "{key}: a stewardship's resolution lives in the mind's root");
-            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
-            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
-            assert_eq!(subject_kind, PipelineKind::Stewardship.name(), "{key} names its subject's kind");
-            assert_eq!(
-                format!("{root}:{subject_kind}:{subject_local}"),
-                *subject,
-                "{key}: the subject's own sequence is part of the recovered key"
-            );
-            assert_eq!(last, "n1", "{key}: this resolution's own sequence");
-
-            // A withdrawal of that resolution nests one out, as it does under
-            // any other subject, and reads back to the resolution it withdraws.
-            let withdrawal = resolution_of(PipelineKind::Resolution, key).expect("a withdrawal keys");
-            let subject_local = key.split(':').nth(2).expect("three segments");
-            assert_eq!(withdrawal, format!("{INSTANCE}:resolution:resolution.{subject_local}.n1"));
-            let (root, local) = pipeline_id("read_back", &withdrawal, PipelineKind::Resolution).expect("reads back");
-            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
-            let (subject_local, _) = rest.rsplit_once('.').expect("the local ends in its own sequence");
-            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), **key, "{withdrawal}: the withdrawn resolution");
-        }
-    }
-
-    /// A legal dotted local of exactly `length` bytes (`a.a.a`, each part a
-    /// label), for bounds wider than one label.
-    fn dotted_local(length: usize) -> String {
-        match length % 2 {
-            1 => format!("{}a", "a.".repeat(length / 2)),
-            _ => format!("{}aa", "a.".repeat(length / 2 - 1)),
-        }
-    }
-
-    /// A resolution of `subject`, at `sequence`, keyed.
-    fn resolved_at(kind: PipelineKind, subject: &str, sequence: u32) -> Result<String, PipelineRefusal> {
-        let mut resolution = resolution_sample();
-        resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
-        resolution.sequence = sequence;
-        pipeline_key(&PipelineDocument::Resolution(resolution))
-    }
-
-    /// every-subject-resolvable: for each kind that can be a subject, at the
-    /// widest subject local (64) and `u32::MAX` sequences, depth one and depth
-    /// two key and read back through `pipeline_id`; depth three is refused on
-    /// the local bound.
-    #[test]
-    fn every_resolvable_kind_resolves_two_deep() {
-        let wide = "a".repeat(SUBJECT_LOCAL_MAX);
-        let mut widest = 0;
-        for kind in PipelineKind::ALL.iter().copied().filter(|kind| *kind != PipelineKind::Resolution) {
-            let subject = format!("{CAMPAIGN}:{}:{wide}", kind.name());
-            assert_eq!(pipeline_id("subject", &subject, kind), Ok((CAMPAIGN, wide.as_str())), "{kind:?}: the subject parses");
-            let one = resolved_at(kind, &subject, u32::MAX).unwrap_or_else(|error| panic!("{kind:?} depth one: {error}"));
-            let two = resolved_at(PipelineKind::Resolution, &one, u32::MAX)
-                .unwrap_or_else(|error| panic!("{kind:?} depth two: {error}"));
-            for key in [&one, &two] {
-                assert!(key.len() <= 200, "{key}: an id fits a Short");
-                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution)
-                    .unwrap_or_else(|error| panic!("{kind:?}: {key} does not read back: {error}"));
-                assert_eq!(root, CAMPAIGN);
-                assert!(local.len() <= RESOLUTION_LOCAL_MAX);
-            }
-            widest = widest.max(two.len() - format!("{CAMPAIGN}:resolution:").len());
-            assert!(
-                matches!(
-                    resolved_at(PipelineKind::Resolution, &two, u32::MAX),
-                    Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "resolution.key"
-                ),
-                "{kind:?}: depth three is refused on the local bound"
-            );
-        }
-        assert_eq!(widest, RESOLUTION_LOCAL_MAX, "the bound is exactly the widest depth-two chain");
-        assert_eq!(RESOLUTION_LOCAL_MAX, 111);
-    }
-
-    #[test]
-    fn the_longest_kind_name_is_the_longest() {
-        let longest = PipelineKind::ALL.iter().map(|kind| kind.name().len()).max();
-        assert_eq!(longest, Some(LONGEST_KIND_NAME));
-    }
-
-    /// The parser bounds an id's local by kind, exactly where the composer does.
-    #[test]
-    fn an_id_local_is_bounded_by_its_kind() {
-        let at = |kind: PipelineKind, length: usize| {
-            pipeline_id("probe", &format!("{CAMPAIGN}:{}:{}", kind.name(), dotted_local(length)), kind).map(|_| ())
-        };
-        assert_eq!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX), Ok(()));
-        assert!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX + 1).is_err());
-        assert_eq!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX), Ok(()));
-        assert!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX + 1).is_err());
-    }
-
-    #[test]
-    fn sha_names_same_commit() {
-        let full = Sha("5f98228d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a69".into());
-        assert!(full.names_same_commit(&Sha("5f98228".into())));
-        assert!(Sha("5f98228".into()).names_same_commit(&full));
-        assert!(full.names_same_commit(&full));
-        assert!(!full.names_same_commit(&Sha("5f98229".into())));
-        assert!(!Sha("5f98228".into()).names_same_commit(&Sha("5f98229".into())));
-        assert!(!Sha("5f98228a".into()).names_same_commit(&Sha("5f98228b".into())), "equal length, differing");
-    }
-
-    /// stored-documents-valid, on the real mind. `HUGINN_MIND_SNAPSHOT` is a
-    /// writable copy of a state root holding `minds/eureka/mind.redb` (the
-    /// store opens read-write). Read through cultcache-rs's own store.
-    #[test]
-    #[ignore = "needs HUGINN_MIND_SNAPSHOT, a writable copy of a Huginn state root"]
-    fn stored_documents_read_back() {
-        use cultcache_rs::{CacheBackingStore, OwnedRedbMessagePackBackingStore};
-        let root = std::env::var("HUGINN_MIND_SNAPSHOT").expect("HUGINN_MIND_SNAPSHOT names the snapshot state root");
-        let store = OwnedRedbMessagePackBackingStore::new(Path::new(&root).join("minds").join("eureka").join("mind.redb"))
-            .expect("the snapshot opens");
-        let envelopes = store.pull_all().expect("the snapshot reads");
-        let mut stored = Vec::new();
-        for envelope in &envelopes {
-            match PipelineDocument::decode(envelope) {
-                Ok(document) => {
-                    assert_eq!(document.validate(), Ok(()), "{}: valid", envelope.key);
-                    assert_eq!(pipeline_key(&document).as_deref(), Ok(envelope.key.as_str()), "{}: key derives byte for byte", envelope.key);
-                    stored.push((document.kind(), envelope.key.clone()));
-                }
-                Err(PipelineRefusal::ForeignStore { .. }) => {}
-                Err(error) => panic!("{}: does not decode: {error}", envelope.key),
-            }
-        }
-        assert!(stored.len() > 200, "{} pipeline documents read", stored.len());
-        let mut subjects = 0;
-        let resolvable = |kind: &PipelineKind| !matches!(kind, PipelineKind::Resolution | PipelineKind::Campaign | PipelineKind::Instance);
-        for (kind, key) in stored.iter().filter(|(kind, _)| resolvable(kind)) {
-            let one = resolved_at(*kind, key, 1).unwrap_or_else(|error| panic!("{key}: no resolution keys: {error}"));
-            let two = resolved_at(PipelineKind::Resolution, &one, 1).unwrap_or_else(|error| panic!("{key}: no withdrawal keys: {error}"));
-            for derived in [&one, &two] {
-                pipeline_id("read_back", derived, PipelineKind::Resolution).unwrap_or_else(|error| panic!("{derived}: does not parse: {error}"));
-            }
-            subjects += 1;
-        }
-        for (_, key) in stored.iter().filter(|(kind, _)| *kind == PipelineKind::Resolution) {
-            resolved_at(PipelineKind::Resolution, key, 1).unwrap_or_else(|error| panic!("{key}: cannot be withdrawn: {error}"));
-        }
-        // The six findings that could not be resolved before this cut.
-        let stuck = [
-            "cut-bifrost-retire-alarm.s2.verb-default-accepts-malformed",
-            "cut-ops-notice-deploy.s2.pinned-bifrost-predates-retry",
-            "cut-bifrost-notice-retry.s1.unknown-test-ignores-backoff",
-            "cut-bifrost-notice-retry.s2.closed-unknown-retry-unpinned",
-            "cut-bifrost-notice-retry.s2.flapping-clock-retries-every-tick",
-            "cut-idunn-topology-lock.s2.boot-reconcile-skipped-on-contention",
-        ];
-        for label in stuck {
-            let found = stored
-                .iter()
-                .find(|(kind, key)| *kind == PipelineKind::Finding && key.ends_with(label))
-                .unwrap_or_else(|| panic!("{label}: not in the snapshot"));
-            let one = resolved_at(PipelineKind::Finding, &found.1, 1).unwrap_or_else(|error| panic!("{label}: still stuck: {error}"));
-            assert!(one.split(':').nth(2).is_some_and(|local| local.len() > SUBJECT_LOCAL_MAX), "{label}: the old bound refused it");
-        }
-        eprintln!("read back {} pipeline documents, {subjects} subjects", stored.len());
-    }
-
-    /// The total bound, in the one place it lives: parts that are each a legal
-    /// label compose a local wider than 64 bytes and are refused as a whole.
-    #[test]
-    fn a_composed_local_is_bounded_whole() {
-        let mut wide = hand_off_sample();
-        wide.to_instance = Slug("a".repeat(60));
-        assert_eq!(wide.to_instance.validate("hand_off.to_instance"), Ok(()), "the receiver alone is legal");
-        assert_eq!(
-            label_text("part", &key_segment(&wide.repo.0)),
-            Ok(()),
-            "the repo alone is legal"
-        );
-        let key = pipeline_key(&PipelineDocument::HandOff(wide));
-        assert!(
-            matches!(&key, Err(PipelineRefusal::InvalidFormat { field, value }) if field == "hand_off.key" && value.len() > 64),
-            "a local of legal parts is still bounded whole, got {key:?}"
-        );
-
-        // The bound is 64 exactly, on both sides, whether the part that fills
-        // it is a plain label or an escaped repo. A hand-off local is
-        // `<receiver>.<repo>.<date>`, the repo `gamecult_-epiphany` and the
-        // date ten bytes, so the receiver fills the rest; a stewardship local is
-        // `<repo escaped>.n<N>`, so `GameCult_-` and `.n1` bound the name.
-        let hand_off_rest = "gamecult_-epiphany".len() + ".".len() + date().0.len() + ".".len();
-        let stewardship_rest = "GameCult_-".len() + ".n1".len();
-        let received = |receiver: usize| {
-            let mut hand_off = hand_off_sample();
-            hand_off.to_instance = Slug("a".repeat(receiver));
-            pipeline_key(&PipelineDocument::HandOff(hand_off))
-        };
-        let stewarded = |name: usize| {
-            let mut stewardship = stewardship_sample();
-            stewardship.repo = OrgRepo(format!("GameCult/{}", "a".repeat(name)));
-            pipeline_key(&PipelineDocument::Stewardship(stewardship))
-        };
-        for (label, at_64, at_65) in [
-            ("plain label", received(64 - hand_off_rest), received(65 - hand_off_rest)),
-            ("escaped repo", stewarded(64 - stewardship_rest), stewarded(65 - stewardship_rest)),
-        ] {
-            let keyed = at_64.unwrap_or_else(|error| panic!("{label}: a 64-byte local keys: {error}"));
-            assert_eq!(keyed.split(':').nth(2).map(str::len), Some(64), "{label}: {keyed} fills the local exactly");
-            assert!(
-                matches!(&at_65, Err(PipelineRefusal::InvalidFormat { value, .. }) if value.len() == 65),
-                "{label}: a 65-byte local is refused, got {at_65:?}"
-            );
-        }
-    }
-
-    /// The resolution side of the bound: 111 keys and 112 is refused on
-    /// `resolution.key`, filled by a resolution subject (`resolution.<L>.n1`).
-    #[test]
-    fn a_composed_resolution_local_is_bounded_whole() {
-        let overhead = "resolution.".len() + ".n1".len();
-        let subject = |length: usize| format!("{CAMPAIGN}:resolution:{}", dotted_local(length));
-        let at_max = resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead), 1)
-            .expect("a 111-byte resolution local keys");
-        assert_eq!(at_max.split(':').nth(2).map(str::len), Some(RESOLUTION_LOCAL_MAX));
-        assert!(matches!(
-            resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead + 1), 1),
-            Err(PipelineRefusal::InvalidFormat { field, value }) if field == "resolution.key" && value.len() == RESOLUTION_LOCAL_MAX + 1
-        ));
-    }
-
-    /// R2, on the composer every kind goes through: no local part carries the
-    /// separator, the head included. The live case is a hand-off with a dotted
-    /// receiver, which keys to an escaped label rather than a wider local.
-    #[test]
-    fn no_local_part_carries_the_separator() {
-        assert_eq!(
-            local("probe", PipelineKind::Question, &["a.b"]),
-            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "a.b".into() }),
-            "the head may not carry the separator"
-        );
-        assert_eq!(
-            local("probe", PipelineKind::Question, &["a", "b.c"]),
-            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "b.c".into() }),
-            "a tail part may not carry the separator"
-        );
-        assert_eq!(local("probe", PipelineKind::Question, &["a", "b", "c"]), Ok("a.b.c".into()));
-
-        let mut dotted = hand_off_sample();
-        dotted.to_instance = slug("thought-cage.GameCult");
-        let key = pipeline_key(&PipelineDocument::HandOff(dotted)).expect("a dotted receiver keys");
-        let local = key.split(':').nth(2).expect("three segments");
-        assert_eq!(local.split('.').count(), 3, "{key}: the receiver is one part, not two");
-        assert_eq!(local.split('.').next(), Some("thought-cage_dGameCult"));
-    }
-
-    /// Q17 B: a subject's resolutions are distinct records, ordered by a
-    /// per-subject sequence the key carries as its last part, so a withdrawn
-    /// resolution stays under its subject and the next closure is nameable.
-    /// The sequence is a field the writer sets and this crate only composes:
-    /// it bounds nothing beyond `u32` and the local's own width, so `0` and a
-    /// gap both key. Which sequence a document may claim, and whether an
-    /// earlier resolution still stands, are admission's rules, exactly as
-    /// `revision: 0` is.
-    #[test]
-    fn a_subject_keeps_every_resolution_it_had() {
-        let resolved = |sequence: u32| {
-            let mut resolution = resolution_sample();
-            resolution.sequence = sequence;
-            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
-        };
-        let first = resolved(1);
-        let second = resolved(2);
-        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
-        assert_eq!(second, format!("{CAMPAIGN}:resolution:question.Q1.n2"));
-        assert_ne!(first, second, "two resolutions of one subject are two documents");
-        for (sequence, key) in [(1, &first), (2, &second)] {
-            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
-            assert_eq!(root, CAMPAIGN, "{key}: the subject's root");
-            let last = format!("n{sequence}");
-            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
-            assert_eq!(local.split('.').count(), 3, "{key}: subject kind, subject local, sequence");
-        }
-
-        // Outcome-invariance now holds per sequence: one record under two
-        // outcomes is still one key, which is exactly why a second closure of
-        // a subject needs a second sequence and not a second outcome.
-        let mut withdrawn = resolution_sample();
-        withdrawn.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Resolution(withdrawn)),
-            Ok(first.clone()),
-            "one sequence is one key whatever the outcome"
-        );
-
-        // Stated limits. Both are admission's to refuse and neither is the
-        // leaf's, so both compose here.
-        assert_eq!(resolved(0), format!("{CAMPAIGN}:resolution:question.Q1.n0"), "the leaf refuses no sequence value");
-        let mut widest = resolution_sample();
-        widest.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "A") };
-        widest.sequence = u32::MAX;
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Resolution(widest)),
-            Ok(format!("{CAMPAIGN}:resolution:ruling.A.n4294967295")),
-            "the widest sequence is an eleven-byte label, not a refusal"
-        );
-    }
-
-    /// D2: the sequence is the *last* part, so a subject's resolutions and
-    /// only they share the prefix `<root>:resolution:<kind>.<local>.n`. R2 is
-    /// what makes the prefix exact: no local part carries a dot, so
-    /// `question.Q1.n` cannot match `question.Q10.n1`, and the withdrawal of
-    /// `Q1`'s first resolution is a record of that resolution, one nesting
-    /// out and outside `Q1`'s prefix. Pinned as a string property, which is
-    /// what a prefix query is.
-    #[test]
-    fn a_subjects_resolutions_share_a_prefix_no_other_key_has() {
-        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
-            let mut resolution = resolution_sample();
-            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
-            resolution.sequence = sequence;
-            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("the subject keys")
-        };
-        let history = [1, 2, 3].map(|sequence| resolved(PipelineKind::Question, &id("question", "Q1").0, sequence));
-        let others = [
-            resolved(PipelineKind::Question, &id("question", "Q10").0, 1),
-            resolved(PipelineKind::Ruling, &id("ruling", "Q1").0, 1),
-            resolved(PipelineKind::Campaign, &format!("{CAMPAIGN}:campaign:self"), 1),
-            resolved(PipelineKind::Resolution, &history[0], 1),
-        ];
-        assert_eq!(
-            others[3],
-            format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"),
-            "a withdrawal keys under the resolution it withdraws, not under the subject"
-        );
-        let prefix = format!("{CAMPAIGN}:resolution:question.Q1.n");
-        let selected = history
-            .iter()
-            .chain(others.iter())
-            .filter(|key| key.starts_with(&prefix))
-            .collect::<Vec<_>>();
-        assert_eq!(
-            selected,
-            history.iter().collect::<Vec<_>>(),
-            "the prefix selects the subject's resolutions and nothing else"
-        );
-    }
-
-    /// Q18 A and Q20 A: a repo's stewardships on a mind are distinct records,
-    /// ordered by a per-`(instance, repo)` sequence the key carries last, so a
-    /// repo transferred away and later transferred back is two records under
-    /// one prefix rather than one document overwriting the other. The date is
-    /// not in the key: `assigned_on` is validated where every field is, by the
-    /// derived `Bounded` impl, and two assignments differing only in it are
-    /// one document.
-    #[test]
-    fn a_repo_keeps_every_stewardship_it_had() {
-        let stewarded = |repo: &str, sequence: u32, assigned_on: &str| {
-            let mut stewardship = stewardship_sample();
-            stewardship.repo = OrgRepo(repo.into());
-            stewardship.sequence = sequence;
-            stewardship.assigned_on = Date(assigned_on.into());
-            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
-        };
-        let first = stewarded("GameCult/Epiphany", 1, "2026-09-15");
-        let second = stewarded("GameCult/Epiphany", 2, "2026-09-16");
-        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
-        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
-        assert_ne!(first, second, "two assignments of one repo are two documents");
-        for (sequence, key) in [(1, &first), (2, &second)] {
-            let (root, local) = pipeline_id("read_back", key, PipelineKind::Stewardship).expect("reads back");
-            assert_eq!(root, INSTANCE, "{key}: the mind's root");
-            let last = format!("n{sequence}");
-            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
-            assert_eq!(local.split('.').count(), 2, "{key}: the escaped repo and the sequence, nothing else");
-        }
-
-        assert_eq!(
-            stewarded("GameCult/Epiphany", 1, "2026-09-16"),
-            first,
-            "assigned_on is a field, not a key part: one sequence is one key whatever the date"
-        );
-
-        let others = [
-            stewarded("GameCult/Epiphany_thing", 1, "2026-09-15"),
-            stewarded("GameCult/Huginn", 1, "2026-09-15"),
-        ];
-        let prefix = format!("{INSTANCE}:stewardship:gamecult_-epiphany.n");
-        let history = [first, second];
-        let selected = history
-            .iter()
-            .chain(others.iter())
-            .filter(|key| key.starts_with(&prefix))
-            .collect::<Vec<_>>();
-        assert_eq!(
-            selected,
-            history.iter().collect::<Vec<_>>(),
-            "the prefix selects the repo's assignments on this mind and nothing else"
-        );
-
-        assert_eq!(
-            stewarded("GameCult/Epiphany", 0, "2026-09-15"),
-            format!("{INSTANCE}:stewardship:gamecult_-epiphany.n0"),
-            "the leaf refuses no sequence value"
-        );
-    }
-
-    /// Cut 8: the leaf owns the serialisation of the shapes it owns, so a wire
-    /// carrying a document or a refusal reads back the same value rather than
-    /// a mirror definition kept in step by hand in the reader's repo. Both
-    /// encodings are pinned: JSON is what a schema describes, MessagePack is
-    /// what a CultCache payload is written in, and an adjacent tag has to
-    /// survive both. The tag is asserted against `name()` rather than against
-    /// a literal, because the point of the tag is that a reader dispatching on
-    /// a key's kind segment finds the same string here.
-    #[test]
-    fn every_document_and_refusal_serialises_and_reads_back() -> Result<()> {
-        for (document, _) in samples() {
-            let json = serde_json::to_value(&document)?;
-            assert_eq!(json["kind"].as_str(), Some(document.kind().name()), "{json} is tagged with its kind name");
-            assert_eq!(serde_json::from_value::<PipelineDocument>(json.clone())?, document, "{json} reads back");
-            let packed = rmp_serde::to_vec_named(&document)?;
-            assert_eq!(
-                rmp_serde::from_slice::<PipelineDocument>(&packed)?,
-                document,
-                "{:?} reads back through MessagePack",
-                document.kind()
-            );
-        }
-
-        // Every variant, and every one of them carrying its named parts: a
-        // refusal read off a wire names the field it refused, as a local one
-        // does.
-        let refusals = [
-            PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 },
-            PipelineRefusal::InvalidFormat { field: "campaign.slug".into(), value: "a b".into() },
-            PipelineRefusal::InvalidIdentity {
-                kind: PipelineKind::Campaign,
-                key: format!("{CAMPAIGN}:campaign:forged"),
-                expected: format!("{CAMPAIGN}:campaign:self"),
-            },
-            PipelineRefusal::DuplicateRepo { field: "campaign.repos".into(), repo: "gamecult/epiphany".into() },
-            PipelineRefusal::ForeignStore { r#type: <ForeignDocument as DatabaseEntry>::TYPE.into() },
-        ];
-        for refusal in &refusals {
-            let json = serde_json::to_value(refusal)?;
-            assert_eq!(&serde_json::from_value::<PipelineRefusal>(json.clone())?, refusal, "{json} reads back");
-            let packed = rmp_serde::to_vec_named(refusal)?;
-            assert_eq!(
-                &rmp_serde::from_slice::<PipelineRefusal>(&packed)?,
-                refusal,
-                "{refusal:?} reads back through MessagePack"
-            );
-        }
-
-        // The derived schemas list the same two sets. A `const` in the tag
-        // position is what a schema reader dispatches on, so it is read as the
-        // schema writes it and compared to `name()`, not to a literal list.
-        let tag = |variant: &serde_json::Value| {
-            variant["properties"]["kind"]["const"]
-                .as_str()
-                .unwrap_or_else(|| panic!("a document variant schema carries a kind const: {variant}"))
-                .to_owned()
-        };
-        let document_schema = serde_json::to_value(schemars::schema_for!(PipelineDocument))?;
-        let variants = document_schema["oneOf"].as_array().expect("the document schema is a oneOf");
-        assert_eq!(PipelineKind::ALL.len(), 13, "thirteen kinds");
-        assert_eq!(
-            variants.iter().map(tag).collect::<Vec<_>>(),
-            PipelineKind::ALL.iter().map(|kind| kind.name().to_owned()).collect::<Vec<_>>(),
-            "the document schema lists exactly the thirteen kinds, by name"
-        );
-
-        let refusal_schema = serde_json::to_value(schemars::schema_for!(PipelineRefusal))?;
-        let refusal_variants = refusal_schema["oneOf"].as_array().expect("the refusal schema is a oneOf");
-        let named = refusal_variants
-            .iter()
-            .map(|variant| {
-                let properties = variant["properties"].as_object().expect("a refusal variant is an object");
-                assert_eq!(properties.len(), 1, "{variant} is externally tagged");
-                properties.keys().next().expect("one key").to_owned()
-            })
-            .collect::<Vec<_>>();
-        assert_eq!(named, vec!["FieldBound", "InvalidFormat", "InvalidIdentity", "DuplicateRepo", "ForeignStore"]);
-        assert_eq!(named.len(), refusals.len(), "every refusal variant is in the schema and in the round trip");
-        Ok(())
-    }
-
-    #[test]
-    fn pipeline_published_schemas_match_derivation() -> Result<()> {
-        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
-        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
-        // A directory this run alone writes, so everything in it is what this
-        // run derived. A previous run's leftovers -- a mutation run's
-        // especially, since those deliberately derive schemas no committed type
-        // produces -- are not this derivation, and copying one of those into
-        // `schemas/cultnet` publishes a schema no Rust type produces. A shared
-        // directory cleared first would have to defend that clear against a
-        // held handle; an unshared one has nothing to defend. The cost is that
-        // nothing ever removes one. The directory is only created when
-        // something is stale, so a passing run leaves none -- but a failing run
-        // leaves its copies behind for good, one directory per failing run
-        // where the shared design left one however often it failed. That is the
-        // trade: the copies are the evidence the failure message names, and
-        // they outlive the run that wrote them. Whoever reads the failure is
-        // the one who deletes them.
-        let derived_dir = std::env::temp_dir().join(format!(
-            "eureka-pipeline-schemas-{}-{}",
-            std::process::id(),
-            std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_nanos()
-        ));
-        let mut stale = Vec::new();
-        for kind in PipelineKind::ALL {
-            let file = format!("{}.schema.json", kind.type_id());
-            let mut schema = serde_json::to_value(kind.derived_schema())?;
-            schema["$id"] = format!("https://gamecult.dev/epiphany/cultnet/{file}").into();
-            let derived = format!("{}\n", serde_json::to_string_pretty(&schema)?);
-            if std::fs::read(published.join(&file)).ok().as_deref() != Some(derived.as_bytes()) {
-                std::fs::create_dir_all(&derived_dir)?;
-                std::fs::write(derived_dir.join(&file), &derived)?;
-                stale.push(derived_dir.join(&file));
-            }
-            let entry = serde_json::json!({
-                "schemaId": format!("https://gamecult.dev/epiphany/cultnet/{file}"),
-                "kind": "document_payload",
-                "wireContracts": ["cultnet.schema.v0"],
-                "schemaVersion": kind.type_id(),
-                "documentType": kind.type_id(),
-                "title": format!("Epiphany Pipeline {kind:?} v2"),
-                "path": file,
-            });
-            assert!(
-                index["schemas"].as_array().is_some_and(|schemas| schemas.contains(&entry)),
-                "index.json lacks {entry}"
-            );
-        }
-        assert!(stale.is_empty(), "published pipeline schemas differ from the Rust derivation; derived copies: {stale:?}");
-        Ok(())
-    }
-
-    /// A refusal read as text names its variant and its parts, so an operator
-    /// who sees only the message (a log line, an `anyhow` chain) can tell which
-    /// field was refused and why.
-    #[test]
-    fn a_refusal_read_as_text_names_its_variant_and_parts() {
-        let text = PipelineRefusal::FieldBound { field: "title".into(), limit: 200, actual: 201 }.to_string();
-        assert!(text.starts_with("pipeline refusal: "), "{text}");
-        for part in ["FieldBound", "title", "200", "201"] {
-            assert!(text.contains(part), "{part} is missing from {text}");
-        }
-    }
-
-    /// The catalogue is exactly the files beside it: every entry's `path` is a
-    /// schema file in the directory, and every schema file in the directory
-    /// has an entry, so a schema removed from the catalogue (or a file left
-    /// behind by a move) fails here instead of publishing a dangling or
-    /// unlisted contract. Schemas whose owner is another crate (`huginn.*`)
-    /// are published by that crate, not listed here.
-    #[test]
-    fn the_catalogue_lists_exactly_the_schema_files_it_publishes() -> Result<()> {
-        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
-        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
-        let listed = index["schemas"]
-            .as_array()
-            .expect("index.json carries a schemas array")
-            .iter()
-            .map(|entry| entry["path"].as_str().expect("every entry names its file").to_owned())
-            .collect::<std::collections::BTreeSet<_>>();
-        for path in &listed {
-            assert!(published.join(path).is_file(), "index.json lists {path}, which is not in the directory");
-        }
-        let mut files = std::collections::BTreeSet::new();
-        for entry in std::fs::read_dir(&published)? {
-            let name = entry?.file_name().to_string_lossy().into_owned();
-            if name.ends_with(".schema.json") && !name.starts_with("huginn.") {
-                files.insert(name);
-            }
-        }
-        assert_eq!(listed, files, "the catalogue and the schema files beside it disagree");
-        Ok(())
-    }
-
-    /// The epoch is the version every kind is published at: its version
-    /// segment is read from the constant, not restated, and every type id
-    /// carries the same one, so a bumped epoch fails here until the kinds
-    /// move with it. The live registrar registers the kinds and nothing else,
-    /// so the foreign stand-in is not among them.
-    #[test]
-    fn every_kind_is_at_the_epochs_version() -> Result<()> {
-        let (name, version) = PIPELINE_SCHEMA_EPOCH.rsplit_once('.').expect("the epoch carries a version");
-        assert_eq!(name, "epiphany.pipeline.epoch");
-        assert!(
-            version.len() > 1 && version.starts_with('v') && version[1..].bytes().all(|byte| byte.is_ascii_digit()),
-            "{version:?} is not a version segment"
-        );
-        for kind in PipelineKind::ALL {
-            let type_id = kind.type_id();
-            assert!(type_id.ends_with(&format!(".{version}")), "{type_id} is not at the epoch's version {version}");
-        }
-
-        let mut cache = CultCache::new();
-        register_pipeline_document_types(&mut cache)?;
-        let registered = cache.registered_entry_types();
-        assert_eq!(registered.len(), PipelineKind::ALL.len(), "the live registrar registers exactly the kinds: {registered:?}");
-        for kind in PipelineKind::ALL {
-            assert!(registered.iter().any(|name| name == kind.type_id()), "{kind:?} is registered");
-        }
-        Ok(())
-    }
-
-    /// The public door onto the reference grammar, for the read side that
-    /// holds a `kind` and an `id` and no way to reach `Bounded`. Every sample
-    /// document's own key is a reference of its own kind; a kind that is not
-    /// the id's, and a local no writer composes, are `InvalidFormat` at `ref.id`.
-    #[test]
-    fn a_ref_validates_as_an_id_of_the_kind_it_declares() -> Result<()> {
-        for (document, expected) in samples() {
-            let kind = document.kind();
-            let key = pipeline_key(&document)?;
-            assert_eq!(key, expected);
-            assert_eq!(
-                PipelineRef { kind, id: s(&key) }.validate_ref(),
-                Ok(()),
-                "{kind:?}'s own key is not a reference of its kind"
-            );
-        }
-
-        let refused = |reference: PipelineRef, why: &str| {
-            let read = reference.validate_ref();
-            assert!(
-                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "ref.id"),
-                "{why}: {reference:?} was not refused, got {read:?}"
-            );
-        };
-
-        // The kind and the id's kind segment cannot disagree: the whole reason
-        // the door exists, since a reader that cannot ask would look this up
-        // and report the nothing it found.
-        refused(
-            PipelineRef { kind: PipelineKind::Campaign, id: id("question", "Q1") },
-            "a question id is not a campaign reference",
-        );
-        refused(
-            PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q1") },
-            "a question id is not a ruling reference",
-        );
-        // The local is `dotted_text` whole, so a trailing dot is refused by the
-        // reader and not only by the writer that never composes one.
-        refused(
-            PipelineRef { kind: PipelineKind::Question, id: s(&format!("{CAMPAIGN}:question:Q1.")) },
-            "a trailing dot is no local",
-        );
-
-        // The boundary, pinned rather than assumed: a resolution id missing the
-        // per-subject sequence its writer always composes is still a
-        // well-formed id of its kind here. The leaf's grammar is kind-deep, and
-        // the local's per-kind shape belongs to admission; refusing this would
-        // be a new rule in `pipeline_id`, not a door onto the one that exists.
-        assert_eq!(
-            PipelineRef { kind: PipelineKind::Resolution, id: s(&format!("{CAMPAIGN}:resolution:question.Q1")) }
-                .validate_ref(),
-            Ok(()),
-            "the leaf reads a resolution id kind-deep"
-        );
-        Ok(())
-    }
-
-    /// The public door onto the slug grammar, for a caller outside this crate
-    /// holding a bare declared name (Huginn's `require_instance` and
-    /// `Mind::open`, before either reaches admission or the filesystem). It
-    /// applies exactly `dotted_text`: one valid dotted name, and refusals for
-    /// fullwidth characters, `..`, both path separators, the empty string,
-    /// and an empty label.
-    #[test]
-    fn slug_validate_applies_the_dotted_grammar() {
-        assert_eq!(slug("huginn-yggdrasil").validate_slug(), Ok(()));
-        assert_eq!(slug("outer.inner").validate_slug(), Ok(()));
-
-        let refused = |value: &str, why: &str| {
-            let result = slug(value).validate_slug();
-            assert!(
-                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "slug"),
-                "{why}: {value:?} was not refused, got {result:?}"
-            );
-        };
-
-        refused("\u{FF41}\u{FF41}", "fullwidth characters are not ascii alphanumeric");
-        refused("..", "a bare .. is an empty label either side of the dot");
-        refused("../escaped", "a forward-slash path separator is not a label byte");
-        refused("..\\escaped", "a backslash path separator is not a label byte");
-        refused("outer\\inner", "a lone backslash inside one label is not a label byte, with no empty label to hide behind");
-        refused("", "the empty string has no label");
-        refused("outer..inner", "an empty label between two dots is refused");
-        refused(".", "a single dot is one empty label");
-
-        // S5: the 64-byte whole-name bound, pinned with a two-label name
-        // whose parts sit far under 64 bytes each (31 and 32, then 32 and
-        // 32), so only `dotted_text`'s own `value.len() > 64` check -- not
-        // `label_text`'s per-part one -- can be the check that refuses 65.
-        let filler = |n: usize| "a".repeat(n);
-        let at_64 = format!("{}.{}", filler(31), filler(32));
-        let at_65 = format!("{}.{}", filler(32), filler(32));
-        assert_eq!(at_64.len(), 64, "a 64-byte whole name, two labels well under 64 each");
-        assert_eq!(at_65.len(), 65, "one byte past the whole-name bound, same two-label shape");
-        assert_eq!(slug(&at_64).validate_slug(), Ok(()));
-        refused(&at_65, "65 bytes overall is refused, even though neither label alone reaches 64");
-
-        // S5: the 64-byte per-label bound, pinned directly against `Label`
-        // (the type `label_text` guards on its own, with no separate
-        // whole-name wrapper), and with a lone label carrying no dot, so only
-        // `label_text`'s own length check can be the one refusing 65.
-        let label_at_64 = Label::from(filler(64).as_str());
-        let label_at_65 = Label::from(filler(65).as_str());
-        assert_eq!(label_at_64.validate("label"), Ok(()));
-        assert!(
-            matches!(
-                label_at_65.validate("label"),
-                Err(PipelineRefusal::InvalidFormat { ref field, .. }) if field == "label"
-            ),
-            "a 65-byte label was not refused, got {:?}",
-            label_at_65.validate("label")
-        );
-
-        // S5: NUL is refused as a label byte, not merely as one more
-        // non-alphanumeric character that happens to be caught by coincidence.
-        refused("a\u{0}b", "NUL is not a label byte");
-    }
-
-    /// The two doors added beside `Slug::validate_slug` (RS-L), on its
-    /// pattern: each delegates to the grammar its own document field already
-    /// carries, so a declared name checked through the door and a field of
-    /// the same type refuse the same inputs. `OrgRepo` is the `repo` alias's
-    /// domain and `Label` is the `cut` alias's (RS-3's vocabulary table).
-    #[test]
-    fn the_org_repo_and_label_doors_are_the_grammar() {
-        assert_eq!(OrgRepo::from("GameCult/Epiphany").validate_org_repo(), Ok(()));
-        assert_eq!(OrgRepo::from("a/b").validate_org_repo(), Ok(()));
-        assert_eq!(OrgRepo::from("a-b/c.d_e").validate_org_repo(), Ok(()));
-        // Consecutive hyphens stay allowed on both sides; only a leading or
-        // trailing owner hyphen is refused.
-        assert_eq!(OrgRepo::from("a--b/c--d").validate_org_repo(), Ok(()));
-        // S4: a 39-byte owner is accepted, a 100-byte repo is accepted.
-        let owner_at_39 = format!("{}/b", "a".repeat(39));
-        assert_eq!(OrgRepo::from(owner_at_39.as_str()).validate_org_repo(), Ok(()));
-        let repo_at_100 = format!("a/{}", "a".repeat(100));
-        assert_eq!(OrgRepo::from(repo_at_100.as_str()).validate_org_repo(), Ok(()));
-        let repo_refused = |value: &str, why: &str| {
-            let result = OrgRepo::from(value).validate_org_repo();
-            assert!(
-                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "org_repo"),
-                "{why}: {value:?} was not refused, got {result:?}"
-            );
-        };
-        repo_refused("GameCult", "no slash at all");
-        repo_refused("/Repo", "an empty org before the slash");
-        repo_refused("GameCult/", "an empty repo after the slash");
-        repo_refused("a/b/c", "a second slash makes the repo half ambiguous");
-        repo_refused("../..", "an owner of dots is not GitHub's grammar");
-        repo_refused("a/..", "a repo of .. is refused outright");
-        repo_refused("a/.", "a repo of . is refused outright");
-        repo_refused("-a/b", "a leading hyphen is not a valid owner");
-        repo_refused("a-/b", "a trailing hyphen is not a valid owner");
-        repo_refused("a b/c", "a space is not an owner byte");
-        repo_refused("a/b c", "a space is not a repo byte");
-        repo_refused("\u{e9}/\u{fc}", "non-ascii bytes are refused on either side");
-        repo_refused("\0/\0", "NUL is refused on either side");
-        repo_refused("a\n/b", "a newline is not an owner byte");
-        let owner_at_40 = format!("{}/b", "a".repeat(40));
-        repo_refused(&owner_at_40, "40 bytes is past the 39-byte owner bound");
-        let repo_at_101 = format!("a/{}", "a".repeat(101));
-        repo_refused(&repo_at_101, "101 bytes is past the 100-byte repo bound");
-        repo_refused("a//b", "an empty middle segment is still a second slash");
-        repo_refused("/b", "an empty owner is refused");
-        repo_refused("a/", "an empty repo is refused");
-        repo_refused("a.b/c", "a dot is not an owner byte");
-        repo_refused("a_b/c", "an underscore is not an owner byte");
-        // F7 fix batch: a repo name ending in `.git` is refused.
-        repo_refused("a/b.git", "a repo ending in .git is refused");
-        repo_refused("a/.git", "a repo of exactly .git is still a .git suffix");
-        // S-2: the `.git` refusal is ASCII-case-insensitive, so a case variant
-        // cannot dodge it and reach an `identity()` the validator refuses.
-        repo_refused("a/b.GIT", "a repo ending in .GIT is refused like .git");
-        repo_refused("a/.GIT", "a repo of exactly .GIT is still a .git suffix");
-        repo_refused("A/B.GIT", "a mixed-case owner and a .GIT repo both refuse");
-        repo_refused("a/b.GiT", "a mixed-case .git suffix is refused");
-
-        // identity(): the one canonical key, ASCII-lowercased. Every
-        // comparison, hash, ordering and key derivation goes through it.
-        assert_eq!(
-            OrgRepo::from("GameCult/Epiphany").identity(),
-            OrgRepo::from("gamecult/epiphany").identity()
-        );
-        assert_eq!(OrgRepo::from("GameCult/Epiphany").identity(), "gamecult/epiphany");
-
-        // S-1: it is structural, not advisory. `==` on `OrgRepo` compares
-        // identity, not the raw string, so the two spellings are one
-        // repository wherever `OrgRepo` is compared, hashed or ordered.
-        assert_eq!(OrgRepo::from("GameCult/Epiphany"), OrgRepo::from("gamecult/epiphany"));
-        assert_eq!(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany")), std::cmp::Ordering::Equal);
-        assert_eq!(
-            OrgRepo::from("GameCult/Epiphany").partial_cmp(&OrgRepo::from("gamecult/epiphany")),
-            Some(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany"))),
-            "partial_cmp must agree with cmp for an equal pair"
-        );
-
-        // RS-L closing fix 1: every assertion above compares values that
-        // should be equal, so `eq -> true`, `hash -> ()` and `cmp -> Equal`
-        // all survive as mutants. Pin the unequal direction as well: two
-        // different repos must be unequal, hash differently (with
-        // overwhelming probability, not by construction, so this is belt and
-        // suspenders on top of the `!=` and `cmp` checks), and not compare
-        // `Equal`, and `partial_cmp` must agree with `cmp` for an unequal
-        // pair too, per std's own contract that `partial_cmp(a, b) ==
-        // Some(cmp(a, b))`.
-        let a = OrgRepo::from("GameCult/Epiphany");
-        let b = OrgRepo::from("GameCult/Aetheria");
-        assert_ne!(a, b, "two different repos must not compare equal");
-        assert_ne!(
-            a.cmp(&b),
-            std::cmp::Ordering::Equal,
-            "two different repos must not order as Equal"
-        );
-        assert_eq!(
-            a.partial_cmp(&b),
-            Some(a.cmp(&b)),
-            "partial_cmp must agree with cmp for an unequal pair"
-        );
-        let hash_of = |repo: &OrgRepo| {
-            use std::hash::{Hash, Hasher};
-            let mut hasher = std::collections::hash_map::DefaultHasher::new();
-            repo.hash(&mut hasher);
-            hasher.finish()
-        };
-        assert_ne!(
-            hash_of(&a),
-            hash_of(&b),
-            "two different repos must hash differently"
-        );
-
-        let mut hash_map = std::collections::HashMap::new();
-        hash_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
-        hash_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
-        assert_eq!(hash_map.len(), 1, "a HashMap keyed by both spellings holds one entry");
-        assert_eq!(hash_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
-
-        let mut btree_map = std::collections::BTreeMap::new();
-        btree_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
-        btree_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
-        assert_eq!(btree_map.len(), 1, "a BTreeMap keyed by both spellings holds one entry");
-        assert_eq!(btree_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
-
-        // `identity()` is always itself a valid `OrgRepo`: lowercasing never
-        // turns a valid repository into one the grammar refuses, and never
-        // turns a refused one into one it accepts.
-        for value in ["GameCult/Epiphany", "A/B", "a-B/c.D_e", "GameCult/Epiphany.GIT"] {
-            let repo = OrgRepo::from(value);
-            assert_eq!(
-                repo.validate_org_repo().is_ok(),
-                OrgRepo::from(repo.identity().as_str()).validate_org_repo().is_ok(),
-                "identity() of {value:?} disagreed with the value's own validity"
-            );
-        }
-
-        assert_eq!(Label::from("cut-10").validate_label(), Ok(()));
-        let label_refused = |value: &str, why: &str| {
-            let result = Label::from(value).validate_label();
-            assert!(
-                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "label"),
-                "{why}: {value:?} was not refused, got {result:?}"
-            );
-        };
-        label_refused("", "the empty string has no label");
-        label_refused("a.b", "a dot is not a label byte");
-        label_refused(&"a".repeat(65), "65 bytes is past the 64-byte label bound");
-        label_refused("\u{e9}", "a non-ascii byte is not a label byte");
-    }
-
-    /// Q-RS1, ruled B: `question` and `ruling` gain a required `title`, the
-    /// new `Title` type shared with the two titles that move off `Short`
-    /// (campaign, cut spec). Each kind round-trips through `prepare`/`decode`
-    /// with its title intact, an empty title is refused for both, and the
-    /// bound is pinned at its edge: 200 bytes accepted, 201 refused (L3 dies
-    /// on the removal of the non-empty check, not on the length bound, since
-    /// `Title`'s length bound is shared with every other `bounded_text!`
-    /// member and already covered by `bounds_refuse_in_utf8_bytes`).
-    #[test]
-    fn question_and_ruling_carry_a_title() -> Result<()> {
-        let cache = schema_cache()?;
-
-        let mut question = question_sample();
-        question.title = t("Who owns the state?");
-        let envelope = PipelineDocument::Question(question.clone()).prepare(&cache)?;
-        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Question(question.clone()));
-
-        let mut ruling = ruling_sample();
-        ruling.title = t("An instance owns its mind");
-        let envelope = PipelineDocument::Ruling(ruling.clone()).prepare(&cache)?;
-        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Ruling(ruling.clone()));
-
-        question.title = Title(String::new());
-        assert_eq!(
-            PipelineDocument::Question(question.clone()).validate(),
-            Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: String::new() })
-        );
-        ruling.title = Title(String::new());
-        assert_eq!(
-            PipelineDocument::Ruling(ruling.clone()).validate(),
-            Err(PipelineRefusal::InvalidFormat { field: "ruling.title".into(), value: String::new() })
-        );
-
-        // F2 second fix batch: a title holds at least one
-        // `char::is_alphanumeric()` character, no `char::is_control()`
-        // character, and no bidi control character. No zero-width denylist:
-        // a zero-width joiner/non-joiner inside real text is allowed, and a
-        // string of nothing but invisible characters is refused because it
-        // has no alphanumeric character, not because those characters are
-        // individually denylisted.
-        let refused = |value: &str| {
-            let mut refused_question = question.clone();
-            refused_question.title = Title(value.into());
-            assert_eq!(
-                PipelineDocument::Question(refused_question).validate(),
-                Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: value.into() }),
-                "{value:?} should be refused"
-            );
-        };
-        refused(" ");
-        refused("\u{7f}");
-        refused("a\u{7f}");
-        refused("\u{0}");
-        refused("\u{9f}");
-        refused("\u{2028}");
-        refused("\u{202e}"); // RLO alone
-        refused("\u{202e}text"); // RLO plus text
-        refused("\u{200e}"); // LRM alone
-        refused("\u{0301}"); // a lone combining mark
-        refused("\u{fe0f}"); // a variation selector alone
-        refused("\u{a0}"); // NBSP alone
-        refused("\u{1f680}"); // emoji only
-
-        // S-3: every one of the twelve bidi control code points is pinned
-        // with an embedded fixture (real alphanumeric text on both sides), so
-        // the alphanumeric rule cannot mask a hole in the bidi match arm the
-        // way a lone-character fixture would.
-        refused("a\u{061C}b"); // ALM
-        refused("a\u{200E}b"); // LRM
-        refused("a\u{200F}b"); // RLM
-        refused("a\u{202A}b"); // LRE
-        refused("a\u{202B}b"); // RLE
-        refused("a\u{202C}b"); // PDF
-        refused("a\u{202D}b"); // LRO
-        refused("a\u{202E}b"); // RLO
-        refused("a\u{2066}b"); // LRI
-        refused("a\u{2067}b"); // RLI
-        refused("a\u{2068}b"); // FSI
-        refused("a\u{2069}b"); // PDI
-
-        // S-4: U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR are
-        // refused inside otherwise-alphanumeric text, not only alone, since
-        // `char::is_control()` does not reach `Zl`/`Zp`.
-        refused("a\u{2028}b");
-        refused("a\u{2029}b");
-
-        let accepted = |value: &str| {
-            let mut accepted_question = question.clone();
-            accepted_question.title = Title(value.into());
-            assert_eq!(
-                PipelineDocument::Question(accepted_question).validate(),
-                Ok(()),
-                "{value:?} should validate"
-            );
-        };
-        accepted("a");
-        accepted("\u{e9}");
-        accepted("\u{200c}\u{647}\u{6cc}"); // Persian text containing ZWNJ
-        accepted("a\u{200d}b");
-        accepted("a \u{1f680}");
-        accepted(" a ");
-        // Discrepancy from the fix spec: HANGUL FILLER (U+3164) is Unicode
-        // General_Category Lo, so `char::is_alphanumeric()` is true for it in
-        // this toolchain; it is not a denylist candidate, since the fix
-        // batch deletes the hand-written exclusion list on purpose. A title
-        // of U+3164 alone is therefore accepted, not refused.
-        accepted("\u{3164}");
-
-        question.title = Title("a".repeat(200));
-        assert_eq!(PipelineDocument::Question(question.clone()).validate(), Ok(()));
-        question.title = Title("a".repeat(201));
-        assert_eq!(
-            PipelineDocument::Question(question).validate(),
-            Err(PipelineRefusal::FieldBound { field: "question.title".into(), limit: 200, actual: 201 })
-        );
-        Ok(())
-    }
-}
+//! Eureka pipeline documents: the typed shape of a Eureka campaign's state.
+//!
+//! This is a leaf type library, and deliberately nothing else. It owns document
+//! shape, field bounds, formats, key derivation and the JSON schemas published
+//! under `schemas/cultnet`; it owns no storage, no admission, no process and no
+//! network. That is the whole reason it is a package: the organ that will admit
+//! these documents depends on these types without depending on the harness
+//! that used to hold them.
+//!
+//! Every kind is a plain `serde` + `JsonSchema` value inside a one-slot
+//! `DatabaseEntry` wrapper, always prepared with `prepare_entry_named`, so the
+//! stored payload is `[value]` and the value is the named map the published
+//! schema describes. Keys are semantic: `pipeline_key` derives them from the
+//! value, and the write validator refuses any envelope whose key differs.
+//!
+//! Every key is `<root>:<kind>:<local>`, three segments for every kind with
+//! none excused: the root is a `Slug`, the kind is the literal kind name, and
+//! the local is `Label`s joined by `.`, so no local part carries a dot and a
+//! reader recovers the parts by splitting. A root's local is the constant
+//! `self`; a resolution's local is its subject's kind and local. A
+//! resolution's local ends in its per-subject sequence, `n<N>`, and a
+//! stewardship's in its per-repo sequence, so a subject's resolutions and a
+//! repo's assignments each share a prefix.
+//!
+//! **Validation follows the type.** `value_types!` is the single field list: it
+//! emits the struct and its `Bounded` impl from the same tokens, so a field
+//! cannot be declared without being validated. Format rules live in the field's
+//! type (`Label`, `Slug`, `OrgRepo`, `Sha`, `Sha256Hex`, `Date`), never in a
+//! hand-written impl that a later field can slip past. A `Vec` field must carry
+//! a maximum, because `Vec<T>` has no `Bounded` impl of its own.
+//!
+//! The wrappers are crate-private: outside code registers, prepares and
+//! decodes them through `register_pipeline_document_types`,
+//! `PipelineDocument::prepare` and `PipelineDocument::decode`, and validates a
+//! write through `validate_pipeline_write_envelope`.
+
+// `anyhow` is the cache's own error type, which `prepare` and the registrar
+// pass through; every refusal this crate decides is a `PipelineRefusal`.
+use anyhow::Result;
+use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry};
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+/// Typed refusals of the pipeline documents: bounds, formats and key identity
+/// (D2's document half), and `ForeignStore`, raised by `decode` for an
+/// envelope of any other type. This is every refusal the leaf decides; a
+/// store's identity and its schema epoch are not decided here, since this
+/// crate owns no store, and belong to the organ that will admit these
+/// documents.
+///
+/// Serialised externally tagged, serde's default for an enum: each variant is
+/// a one-key map from the variant's name to its named fields, so `field` and
+/// `value` are on the wire under their own names and a reader of a refusal
+/// carried over a wire reads the same parts a local caller matches on. No
+/// attribute buys that, which is why there is none: an internal or adjacent
+/// tag would move the fields under a content key without making any of them
+/// more visible.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum PipelineRefusal {
+    FieldBound { field: String, limit: u32, actual: u32 },
+    InvalidFormat { field: String, value: String },
+    InvalidIdentity { kind: PipelineKind, key: String, expected: String },
+    DuplicateRepo { field: String, repo: String },
+    ForeignStore { r#type: String },
+}
+
+impl std::fmt::Display for PipelineRefusal {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(formatter, "pipeline refusal: {self:?}")
+    }
+}
+
+impl std::error::Error for PipelineRefusal {}
+
+pub(crate) trait Bounded {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal>;
+}
+
+impl<T: Bounded> Bounded for Option<T> {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        self.as_ref().map_or(Ok(()), |value| value.validate(field))
+    }
+}
+
+macro_rules! unbounded_scalars {
+    ($($ty:ty),* $(,)?) => {$(
+        impl Bounded for $ty {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+    )*};
+}
+
+unbounded_scalars!(u32, u64, bool);
+
+fn bound(field: &str, limit: usize, actual: usize) -> Result<(), PipelineRefusal> {
+    if actual > limit {
+        return Err(PipelineRefusal::FieldBound {
+            field: field.into(),
+            limit: limit as u32,
+            actual: actual as u32,
+        });
+    }
+    Ok(())
+}
+
+/// List maximums only. Minimum counts are admission rules with their own
+/// refusals (Cut 3b), so a bounds pass never pre-empts them.
+fn list<T: Bounded>(field: &str, items: &[T], max: usize) -> Result<(), PipelineRefusal> {
+    bound(field, max, items.len())?;
+    for (index, item) in items.iter().enumerate() {
+        item.validate(&format!("{field}[{index}]"))?;
+    }
+    Ok(())
+}
+
+fn format_error(field: &str, value: &str) -> PipelineRefusal {
+    PipelineRefusal::InvalidFormat {
+        field: field.into(),
+        value: value.into(),
+    }
+}
+
+fn hex(field: &str, value: &str, lengths: std::ops::RangeInclusive<usize>) -> Result<(), PipelineRefusal> {
+    let lower_hex = value.bytes().all(|byte| matches!(byte, b'0'..=b'9' | b'a'..=b'f'));
+    if !lengths.contains(&value.len()) || !lower_hex {
+        return Err(format_error(field, value));
+    }
+    Ok(())
+}
+
+/// A key label: `[A-Za-z0-9_-]{1,64}`. Dots are excluded so that a composed key
+/// segments unambiguously; see `local`.
+fn label_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let valid = value
+        .bytes()
+        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'));
+    if !valid || value.is_empty() || value.len() > 64 {
+        return Err(format_error(field, value));
+    }
+    Ok(())
+}
+
+/// A dotted key segment: label parts joined by `.`, at most 64 bytes. Every
+/// part must be a label, so `..`, a leading or trailing dot, and an empty part
+/// are all refused.
+fn dotted_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    dotted_within(field, value, 64)
+}
+
+/// `dotted_text`'s grammar with the bound as a parameter: the one place a
+/// dotted segment is parsed, whoever owns the bound.
+fn dotted_within(field: &str, value: &str, max: usize) -> Result<(), PipelineRefusal> {
+    if value.is_empty() || value.len() > max {
+        return Err(format_error(field, value));
+    }
+    for part in value.split('.') {
+        label_text(field, part)?;
+    }
+    Ok(())
+}
+
+/// GitHub's own grammar for `owner/repo`, exactly one `/`: the owner is
+/// `[A-Za-z0-9-]`, 1 to 39 bytes, with no leading or trailing hyphen; the repo
+/// is `[A-Za-z0-9._-]`, 1 to 100 bytes, is never `.` or `..`, and does not end
+/// in `.git`, ASCII-case-insensitively (`a/b.GIT` is refused exactly as
+/// `a/b.git` is), so the suffix rule cannot be dodged by a case variant whose
+/// `identity()` is refused. The repo's own byte alphabet excludes `/`, so a
+/// second `/` inside it is already refused by the byte check; no separate
+/// `contains('/')` check is needed.
+fn org_repo_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let valid = value.split_once('/').is_some_and(|(owner, repo)| {
+        (1..=39).contains(&owner.len())
+            && owner.bytes().all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+            && !owner.starts_with('-')
+            && !owner.ends_with('-')
+            && (1..=100).contains(&repo.len())
+            && repo.bytes().all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+            && repo != "."
+            && repo != ".."
+            && !(repo.len() >= 4 && repo[repo.len() - 4..].eq_ignore_ascii_case(".git"))
+    });
+    if valid {
+        Ok(())
+    } else {
+        Err(format_error(field, value))
+    }
+}
+
+macro_rules! bounded_text {
+    ($($(#[$doc:meta])* $name:ident = $limit:literal, $check:expr;)*) => {$(
+        #[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        #[serde(transparent)]
+        #[schemars(extend("maxLength" = $limit))]
+        $(#[$doc])*
+        pub struct $name(pub String);
+        impl Bounded for $name {
+            fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+                let check: fn(&str, &str) -> Result<(), PipelineRefusal> = $check;
+                check(field, &self.0)
+            }
+        }
+        impl From<&str> for $name {
+            fn from(value: &str) -> Self {
+                Self(value.into())
+            }
+        }
+    )*};
+}
+
+fn within(limit: usize) -> impl Fn(&str, &str) -> Result<(), PipelineRefusal> {
+    move |field: &str, value: &str| bound(field, limit, value.len())
+}
+
+/// A title holds at least one `char::is_alphanumeric()` character, no
+/// `char::is_control()` character, no U+2028 LINE SEPARATOR or U+2029
+/// PARAGRAPH SEPARATOR (both `Zl`/`Zp`, so `is_control()` does not reach
+/// them, and a one-line field should carry no hard line break), and no bidi
+/// control character: `U+061C`, `U+200E`, `U+200F`, `U+202A`-`U+202E`,
+/// `U+2066`-`U+2069`. No denylist of individual zero-width or format
+/// characters is maintained here; a character not covered by one of these
+/// tests is allowed, so ZWJ and ZWNJ still work.
+fn title_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let alphanumeric = value.chars().any(|character| character.is_alphanumeric());
+    let control = value
+        .chars()
+        .any(|character| character.is_control() || matches!(character, '\u{2028}' | '\u{2029}'));
+    let bidi = value.chars().any(|character| {
+        matches!(
+            character,
+            '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}'
+        )
+    });
+    if !alphanumeric || control || bidi {
+        return Err(format_error(field, value));
+    }
+    within(200)(field, value)
+}
+
+bounded_text! {
+    /// Text of at most 200 UTF-8 bytes.
+    Short = 200, |field, value| within(200)(field, value);
+    /// A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema
+    /// length counts characters. Holds at least one alphanumeric character,
+    /// no control character, and no bidi control character (`U+061C`,
+    /// `U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).
+    #[schemars(extend("minLength" = 1))]
+    Title = 200, title_text;
+    /// Text of at most 1,000 UTF-8 bytes.
+    Line = 1000, |field, value| within(1000)(field, value);
+    /// Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.
+    Para = 4000, |field, value| within(4000)(field, value);
+    /// A key label: `[A-Za-z0-9_-]{1,64}`.
+    Label = 64, label_text;
+    /// A campaign slug or key segment: label parts joined by `.`.
+    Slug = 64, dotted_text;
+    /// A git commit id: 7-40 lowercase hex characters.
+    Sha = 40, |field, value| hex(field, value, 7..=40);
+    /// A full git commit id: exactly 40 lowercase hex characters.
+    FullSha = 40, |field, value| hex(field, value, 40..=40);
+    /// A SHA-256 digest: exactly 64 lowercase hex characters.
+    Sha256Hex = 64, |field, value| hex(field, value, 64..=64);
+}
+
+impl Sha {
+    /// The type's identity rule: two spellings name one commit when one is a
+    /// prefix of the other, so a 7-character abbreviation and the full id of
+    /// the same commit are equal here though not `==`. Both are already 7-40
+    /// lowercase hex. Two distinct commits that share a 7-character prefix are
+    /// git's ambiguity, not the mind's.
+    pub fn names_same_commit(&self, other: &Sha) -> bool {
+        self.0.starts_with(&other.0) || other.0.starts_with(&self.0)
+    }
+}
+
+impl Slug {
+    /// The public door onto the slug grammar, for a caller outside this crate
+    /// that holds a bare `Slug` and no way to reach `Bounded`, which is
+    /// crate-private. On the pattern of `PipelineRef::validate_ref`: it
+    /// delegates so the grammar keeps one owner, and it applies exactly the
+    /// `dotted_text` check that every `Slug` field in this crate is held to,
+    /// so a caller that validates a declared name this way and a document
+    /// field of the same type refuse the same inputs. Named `validate_slug`
+    /// rather than a bare `validate`, because an inherent `validate` would
+    /// shadow `Bounded`'s for every in-crate caller holding a `Slug`.
+    pub fn validate_slug(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "slug")
+    }
+}
+
+/// A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +
+/// 100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or
+/// trailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never
+/// `.` or `..`, and does not end in `.git`, ASCII-case-insensitively.
+/// Identity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`
+/// are the same repository.
+//
+// The raw string is display-only. `OrgRepo` is not generated by
+// `bounded_text!`: that macro derives `PartialEq`, `Eq`, `Hash`, `PartialOrd`
+// and `Ord` on the raw string, with no per-member override, so a type built
+// from it compares and keys on spelling. `OrgRepo` instead carries
+// hand-written impls of those five traits, every one of them over
+// `identity()` (the ASCII-lowercased value), so `==`, a `BTreeMap` key and a
+// `HashMap` key are all case-insensitive by construction: `GameCult/Epiphany`
+// and `gamecult/epiphany` compare equal, hash equal, order together and
+// collapse to one map entry, and a caller cannot reach the case-sensitive
+// behaviour by accident. `Hash` and `Eq` agree because both are defined over
+// the same `identity()` string. Every other bounded type keeps the macro's
+// derives untouched. This reasoning is a source comment, not a doc comment,
+// so it does not enter the published schema description (RS-L closing fix 2):
+// a consumer needs the grammar, the bound and the case-insensitivity, not the
+// Rust-macro justification for how that got built.
+#[derive(Clone, Debug, Default, Serialize, Deserialize, JsonSchema)]
+#[serde(transparent)]
+#[schemars(extend("maxLength" = 140))]
+pub struct OrgRepo(pub String);
+
+impl Bounded for OrgRepo {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        org_repo_text(field, &self.0)
+    }
+}
+
+impl From<&str> for OrgRepo {
+    fn from(value: &str) -> Self {
+        Self(value.into())
+    }
+}
+
+impl PartialEq for OrgRepo {
+    fn eq(&self, other: &Self) -> bool {
+        self.identity() == other.identity()
+    }
+}
+
+impl Eq for OrgRepo {}
+
+impl std::hash::Hash for OrgRepo {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.identity().hash(state);
+    }
+}
+
+impl PartialOrd for OrgRepo {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for OrgRepo {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.identity().cmp(&other.identity())
+    }
+}
+
+impl OrgRepo {
+    /// The public door onto the `org_repo` grammar, for a caller outside this
+    /// crate that holds a bare `OrgRepo` (the organ's `repo` alias, RS-3) and
+    /// no way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
+    /// delegates to `org_repo_text` through `Bounded::validate`, so the
+    /// grammar keeps one owner and a declared name checked this way refuses
+    /// exactly what a document's own `OrgRepo` field refuses.
+    pub fn validate_org_repo(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "org_repo")
+    }
+
+    /// The one canonical key for an `OrgRepo`: the value, ASCII-lowercased.
+    /// Every comparison, hash, ordering and lookup keyed by repository
+    /// identity goes through this — `PartialEq`, `Hash` and `Ord` above are
+    /// all defined in terms of it — so `GameCult/Epiphany` and
+    /// `gamecult/epiphany` are the same repository everywhere, not only where
+    /// a caller remembers to ask.
+    pub fn identity(&self) -> String {
+        self.0.to_ascii_lowercase()
+    }
+}
+
+impl Label {
+    /// The public door onto the label grammar, for a caller outside this
+    /// crate that holds a bare `Label` (the organ's `cut` alias, RS-3) and no
+    /// way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
+    /// delegates to `label_text` through `Bounded::validate`, so the grammar
+    /// keeps one owner and a declared name checked this way refuses exactly
+    /// what a document's own `Label` field refuses.
+    pub fn validate_label(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "label")
+    }
+}
+
+/// A calendar date, `YYYY-MM-DD`.
+#[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+#[serde(transparent)]
+#[schemars(extend("maxLength" = 10))]
+pub struct Date(pub String);
+
+impl Bounded for Date {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        match chrono::NaiveDate::parse_from_str(&self.0, "%Y-%m-%d") {
+            Ok(_) if self.0.len() == 10 => Ok(()),
+            _ => Err(format_error(field, &self.0)),
+        }
+    }
+}
+
+macro_rules! bounded_field {
+    ($value:expr, $field:expr) => {
+        Bounded::validate(&$value, $field)?
+    };
+    ($value:expr, $field:expr, $max:literal) => {
+        list($field, &$value, $max)?
+    };
+}
+
+/// The single field list: one invocation emits the value struct and its
+/// `Bounded` impl, so a field can never be left out of validation.
+macro_rules! value_types {
+    ($($(#[$attr:meta])* pub struct $name:ident { $($field:ident: $ty:ty $([$max:literal])?),* $(,)? } $(=> $extra:path)?)*) => {$(
+        $(#[$attr])*
+        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+        pub struct $name {
+            $(
+                $(#[schemars(extend("maxItems" = $max))])?
+                pub $field: $ty
+            ),*
+        }
+
+        impl Bounded for $name {
+            fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
+                $(bounded_field!(self.$field, &format!("{at}.{}", stringify!($field)) $(, $max)?);)*
+                $($extra(self, at)?;)?
+                Ok(())
+            }
+        }
+    )*};
+}
+
+macro_rules! unit_enums {
+    ($($name:ident { $($variant:ident),* $(,)? })*) => {$(
+        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        pub enum $name { $($variant),* }
+        impl Bounded for $name {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+    )*};
+}
+
+/// RS-L closing fix 4: `campaign.repos` refuses two entries naming the same
+/// repository by identity, not by raw spelling, so `GameCult/Epiphany` and
+/// `gamecult/epiphany` in one list refuse exactly as one entry twice would.
+/// This is a cross-element invariant on `PipelineCampaign` alone, not a
+/// per-type format rule any other `value_types!` struct shares, so it is
+/// wired in as that struct's one `=> extra` hook rather than folded into
+/// `Bounded for OrgRepo` or the list bound in `bounded_field!`.
+fn campaign_repos_are_distinct(campaign: &PipelineCampaign, at: &str) -> Result<(), PipelineRefusal> {
+    let mut seen = std::collections::HashSet::new();
+    for repo in &campaign.repos {
+        if !seen.insert(repo.identity()) {
+            return Err(PipelineRefusal::DuplicateRepo {
+                field: format!("{at}.repos"),
+                repo: repo.0.clone(),
+            });
+        }
+    }
+    Ok(())
+}
+
+unit_enums! {
+    EvidenceKind { Command, Test, Mutation, Probe, SourceRead, Capture }
+    ClaimOutcome { Holds, Falsified, Unproven }
+    FindingConfidence { Confirmed, Plausible }
+    FindingSeverity { Blocker, High, Medium, Low }
+    RulingAuthority { Operator, Standing, Defaulted }
+    FindingOrigin { Introduced, PreExisting }
+}
+
+value_types! {
+    pub struct CodeLocation { path: Short, line: u32, end_line: Option<u32> }
+    pub struct CommitRange { base: Sha, head: Sha }
+    pub struct Evidence { kind: EvidenceKind, locator: Line, result: Line }
+    /// A citation of a document in another repo's pipeline store (D6).
+    pub struct ForeignRef { repo: OrgRepo, commit: FullSha, kind: PipelineKind, id: Short, payload_sha256: Sha256Hex }
+    pub struct DocRef { path: Short, start_line: u32, end_line: u32, commit: Sha }
+    pub struct TargetInvariant { label: Label, statement: Line }
+    pub struct QuestionOption { label: Label, text: Line }
+    pub struct CutDelete { path: Short, lines: u32, note: Line }
+    pub struct FileChange { location: CodeLocation, change: Line }
+    pub struct AuthorityMap {
+        owner: Line, inputs: Vec<Line>[16], outputs: Vec<Line>[16], derived_state: Vec<Line>[16],
+        forbidden_writers: Vec<Line>[16], shared_paths: Vec<Line>[16], deletion_line: Line,
+    }
+    pub struct VerificationTest { name: Short, pins: Line }
+    pub struct NegativeCheck { pattern: Short, scope: Line }
+    pub struct CutVerification {
+        builds: Vec<Line>[64], tests: Vec<VerificationTest>[64],
+        negative: Vec<NegativeCheck>[64], operator: Vec<Line>[64],
+    }
+    pub struct ReportCommit { sha: Sha, subject: Line, builds: bool }
+    /// One mutation a report ran: a key-safe label a verdict claim can name,
+    /// the exact edit, and the tree it was applied to.
+    pub struct MutationRecord { label: Label, rule: Line, location: CodeLocation, before: Line, after: Line, commit: Sha, failed_as_expected: bool }
+    pub struct Deviation { what: Line, why: Line }
+    // D1 tables no maximum for these lists, so they take the shared list
+    // default of 64 rather than a number invented for this field alone.
+    pub struct StructuralDelta {
+        lines_added: u32, lines_removed: u32,
+        dependencies_added: Vec<Short>[64], dependencies_removed: Vec<Short>[64],
+        formats_added: Vec<Short>[64], formats_removed: Vec<Short>[64],
+        targets_added: Vec<Short>[64], targets_removed: Vec<Short>[64],
+    }
+    /// A name the cut landed, and where it lives.
+    pub struct LandedName { name: Short, path: Short }
+    /// A promise a report makes about what it landed. Not a document and not
+    /// resolvable: it is identified by its report's id and its label, as a
+    /// `TargetInvariant` is by its target's. Soul measures every one (ruling
+    /// A), and the rule that every one is measured is admission's.
+    pub struct Promise { label: Label, text: Line }
+    /// The promise this claim measured, and the report's mutations it ran. An
+    /// `Unproven` claim with a promise is one Soul could not reach.
+    pub struct VerdictClaim {
+        claim: Line, outcome: ClaimOutcome, evidence: Vec<Evidence>[8], findings: Vec<Short>[16],
+        promise: Option<Label>, mutations: Vec<Label>[8],
+    }
+
+    pub struct PipelineCampaign { slug: Slug, title: Title, repos: Vec<OrgRepo>[8], working_branch: Short, target_doc: DocRef } => campaign_repos_are_distinct
+    pub struct PipelineTarget {
+        campaign: Slug, revision: u32, invariants: Vec<TargetInvariant>[32], not_in_scope: Vec<Line>[32],
+        canonical_implementations: Vec<Line>[16], doc: DocRef,
+    }
+    pub struct PipelineQuestion {
+        campaign: Slug, label: Label, title: Title, question: Para, options: Vec<QuestionOption>[8], recommended: Label,
+        depends: Vec<Line>[8], raised_in: Option<PipelineRef>, asked_on: Date,
+    }
+    pub struct PipelineRuling {
+        campaign: Slug, label: Label, title: Title, answers: Option<Short>, choice: Option<Label>, ruling: Para,
+        operator_quote: Option<Para>, ruled_on: Date, precedents: Vec<ForeignRef>[8], authority: RulingAuthority,
+    }
+    pub struct PipelineCutSpec {
+        campaign: Slug, cut: Label, revision: u32, title: Title, repo: OrgRepo, branch: Short, base: Sha,
+        depends_on: Vec<Short>[8], first: Vec<Line>[16], deletes: Vec<CutDelete>[64], keeps_moves: Vec<Line>[64],
+        adds: Vec<Line>[64], file_changes: Vec<FileChange>[256], authority_map: Option<AuthorityMap>,
+        verification: CutVerification, estimate: StructuralDelta,
+        rulings: Vec<Short>[32], questions: Vec<Short>[16],
+    }
+    pub struct PipelineCutReport {
+        campaign: Slug, cut_spec: Short, attempt: u32, repo: OrgRepo, branch: Short,
+        commits: Vec<ReportCommit>[128], range: CommitRange, verification: Vec<Evidence>[64],
+        mutations: Vec<MutationRecord>[64], deviations: Vec<Deviation>[32], forks: Vec<Short>[8],
+        structural_delta: StructuralDelta, landed_names: Vec<LandedName>[128], undone: Vec<Line>[32],
+        promises: Vec<Promise>[64],
+    }
+    pub struct PipelineVerdict { campaign: Slug, cut_report: Short, pass: u32, range: CommitRange, claims: Vec<VerdictClaim>[64] }
+    pub struct PipelineFinding {
+        campaign: Slug, verdict: Short, label: Label, range: CommitRange, confidence: FindingConfidence,
+        severity: FindingSeverity, claim: Line, invariants: Vec<Label>[8], locations: Vec<CodeLocation>[16],
+        failure_scenario: Para, evidence: Vec<Evidence>[16], precedents: Vec<ForeignRef>[8], origin: FindingOrigin,
+    }
+    pub struct PipelineFollowUp {
+        campaign: Slug, label: Label, source: PipelineRef, repo: OrgRepo, locations: Vec<CodeLocation>[16],
+        item: Line, why_it_can_wait: Line, owner: Short,
+    }
+    /// The record of how a subject was closed and by what. `sequence` is per
+    /// subject and set by the writer, `1` for the first, and it is the last
+    /// part of the key, so a subject's resolutions share a prefix and a
+    /// withdrawn one is kept under its subject rather than overwritten.
+    /// Whether a sequence is the previous plus one, and whether an earlier
+    /// resolution still stands, are admission's rules: this crate refuses
+    /// neither `0` nor a gap, exactly as it refuses neither `revision: 0` nor
+    /// a `revision` with no predecessor.
+    pub struct PipelineResolution { subject: PipelineRef, sequence: u32, outcome: ResolutionOutcome, rationale: Para, resolved_on: Date }
+
+    /// A mind's identity document. A store is canonical to exactly one
+    /// instance, and this says which; identity lives in the state, not in a
+    /// path.
+    pub struct PipelineInstance { instance: Slug, display_name: Short, created_at: Date, host: Short }
+    /// Stewardship over a repo, as an assignment recorded in a mind. One
+    /// instance may steward several repos, so the repo is part of the key.
+    /// `sequence` is per `(instance, repo)`, set by the writer, `1` for the
+    /// first, so a repo transferred away and back is two records under one
+    /// prefix rather than one document overwriting the other. `assigned_on`
+    /// is a field, not a key part. As on a resolution, whether the sequence
+    /// is the previous plus one, and which assignment is in force, are
+    /// admission's rules and not this crate's.
+    pub struct PipelineStewardship { instance: Slug, repo: OrgRepo, sequence: u32, assigned_on: Date, note: Line }
+    /// A reassignment of stewardship, recorded in both minds. `documents` names
+    /// what travels with it.
+    pub struct PipelineHandOff {
+        from_instance: Slug, to_instance: Slug, repo: OrgRepo, documents: Vec<Short>[256],
+        reason: Para, handed_on: Date,
+    }
+}
+
+/// A reference to another document. The id is parsed as a full pipeline id of
+/// the declared `kind`, so the kind and the id's kind segment cannot disagree.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct PipelineRef {
+    pub kind: PipelineKind,
+    pub id: Short,
+}
+
+impl Bounded for PipelineRef {
+    fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
+        self.id.validate(&format!("{at}.id"))?;
+        pipeline_id(&format!("{at}.id"), &self.id.0, self.kind).map(|_| ())
+    }
+}
+
+impl PipelineRef {
+    /// The grammar's door for a reader holding a bare reference. A read side
+    /// outside this crate is handed a `kind` and an `id` that may disagree, and
+    /// `Bounded` is crate-private, so without this there is no way to ask; a
+    /// reader with no way to ask answers empty, which reads as "no such
+    /// document" rather than "that is not a reference". It delegates, so the
+    /// grammar keeps one owner: this is exactly what a document's own
+    /// `PipelineRef` field is held to, at the field name `ref`. It is kind-deep,
+    /// like every other read of an id: whether the named document exists, and
+    /// whether the local's shape suits the kind, are admission's rules.
+    ///
+    /// A method rather than a free function because it concerns one public
+    /// type, as `prepare` and `decode` do; the two free doors act on a cache or
+    /// an envelope this crate does not own. `validate_ref` rather than a bare
+    /// `validate`, because an inherent `validate` would shadow `Bounded`'s for
+    /// every in-crate caller holding a `PipelineRef`.
+    pub fn validate_ref(&self) -> Result<(), PipelineRefusal> {
+        self.validate("ref")
+    }
+}
+
+/// How a subject was resolved. Every referent is a parsed `PipelineRef`, so a
+/// resolution names its records by ids of the kinds they declare, validated
+/// where every other referent is; a `Fixed` commit is a `Sha` whose referent
+/// is outside the document set (ruling B). Whether a named document exists,
+/// and how many may supersede one subject, are admission's rules.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum ResolutionOutcome {
+    /// Overturned, in whole or in part, by later records. The list is bounded
+    /// here because the enum is outside `value_types!`, the only place a list
+    /// maximum is emitted automatically.
+    Superseded {
+        #[schemars(extend("maxItems" = 8))]
+        by: Vec<PipelineRef>,
+    },
+    Answered { by: PipelineRef },
+    Fixed { commit: Sha, by: Option<PipelineRef> },
+    Deferred { to: PipelineRef },
+    Recorded { reason: Line },
+    Withdrawn { reason: Line },
+}
+
+impl Bounded for ResolutionOutcome {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        match self {
+            Self::Superseded { by } => list(&format!("{field}.by"), by, 8),
+            Self::Answered { by } => by.validate(&format!("{field}.by")),
+            Self::Fixed { commit, by } => {
+                commit.validate(&format!("{field}.commit"))?;
+                by.validate(&format!("{field}.by"))
+            }
+            Self::Deferred { to } => to.validate(&format!("{field}.to")),
+            Self::Recorded { reason } | Self::Withdrawn { reason } => reason.validate(&format!("{field}.reason")),
+        }
+    }
+}
+
+macro_rules! pipeline_kinds {
+    ($($variant:ident($value:ident) => $document:ident, $name:literal, $type_id:tt, $schema:tt;)*) => {
+        $(
+            #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+            #[cultcache(type = $type_id, schema = $schema)]
+            pub(crate) struct $document {
+                #[cultcache(key = 0)]
+                pub(crate) value: $value,
+            }
+        )*
+
+        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        pub enum PipelineKind { $($variant),* }
+
+        impl Bounded for PipelineKind {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+
+        /// The envelope enum, adjacently tagged on the kind name: a document
+        /// on a wire is `{ kind, value }`, and `kind` is exactly what
+        /// `PipelineKind::name()` returns, so a reader dispatches on the kind
+        /// segment it already knows from the key and needs no second registry
+        /// mapping variant spellings to kinds. Adjacent rather than internal
+        /// because a value is a named map of its own and an internal tag would
+        /// have to be merged into it; the tag stays beside the value instead.
+        /// This is not a published schema: `schemas/cultnet` publishes the
+        /// thirteen per-kind value documents, and the envelope is the wire's
+        /// shape, not a document's.
+        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+        #[serde(tag = "kind", content = "value", rename_all = "snake_case")]
+        pub enum PipelineDocument { $($variant($value)),* }
+
+        impl PipelineKind {
+            pub const ALL: &'static [PipelineKind] = &[$(Self::$variant),*];
+
+            /// The kind segment of a document key.
+            pub fn name(self) -> &'static str {
+                match self { $(Self::$variant => $name),* }
+            }
+
+            pub fn type_id(self) -> &'static str {
+                match self { $(Self::$variant => <$document as DatabaseEntry>::TYPE),* }
+            }
+
+            #[cfg(test)]
+            pub(crate) fn schema_name(self) -> &'static str {
+                match self { $(Self::$variant => <$document as DatabaseEntry>::SCHEMA_NAME),* }
+            }
+
+            #[cfg(test)]
+            pub(crate) fn derived_schema(self) -> schemars::Schema {
+                match self { $(Self::$variant => schemars::schema_for!($value)),* }
+            }
+        }
+
+        impl PipelineDocument {
+            pub fn kind(&self) -> PipelineKind {
+                match self { $(Self::$variant(_) => PipelineKind::$variant),* }
+            }
+
+            /// Field bounds and formats (D1), in UTF-8 bytes and list maximums.
+            pub fn validate(&self) -> Result<(), PipelineRefusal> {
+                match self { $(Self::$variant(value) => value.validate($name)),* }
+            }
+
+            /// Prepares the envelope to be stored: keyed by `pipeline_key`,
+            /// payload `[value]` through `prepare_entry_named`.
+            pub fn prepare(&self, cache: &CultCache) -> Result<CultCacheEnvelope> {
+                let key = pipeline_key(self)?;
+                Ok(match self {
+                    $(Self::$variant(value) => {
+                        cache.prepare_entry_named(key, &$document { value: value.clone() })?.0
+                    })*
+                })
+            }
+
+            /// Decodes a stored envelope, type-matched both ways: an envelope of
+            /// any other type is `ForeignStore`, never the kind that happens to
+            /// parse its payload. It validates neither bounds nor the key: a
+            /// decoded document is a typed read, and
+            /// `validate_pipeline_write_envelope` is the check before a write.
+            pub fn decode(envelope: &CultCacheEnvelope) -> Result<Self, PipelineRefusal> {
+                let invalid = |error: rmp_serde::decode::Error| format_error("payload", &error.to_string());
+                $(if envelope.r#type == <$document as DatabaseEntry>::TYPE {
+                    let document: $document = rmp_serde::from_slice(&envelope.payload).map_err(invalid)?;
+                    return Ok(Self::$variant(document.value));
+                })*
+                Err(PipelineRefusal::ForeignStore { r#type: envelope.r#type.clone() })
+            }
+        }
+
+        /// Registers every pipeline kind in a cache, and nothing else: the one
+        /// door to the crate-private wrappers, so a caller registers exactly
+        /// what this crate publishes.
+        pub fn register_pipeline_document_types(cache: &mut CultCache) -> Result<()> {
+            $(cache.register_entry_type::<$document>()?;)*
+            Ok(())
+        }
+    };
+}
+
+/// A document that is not a pipeline document, for the decode refusal and the
+/// registrar's count to be pinned against something real. It stands in for
+/// any other document a store may hold beside pipeline documents, a commit
+/// receipt say, which is still not a document this library may decode. The
+/// stand-in carries a receipt-shaped type id and is registered only by the
+/// tests' own cache, never by the live registrar.
+#[cfg(test)]
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "epiphany.mind_commit_receipt.v1", schema = "ForeignDocument")]
+pub(crate) struct ForeignDocument {
+    #[cultcache(key = 0)]
+    pub(crate) marker: Short,
+}
+
+pipeline_kinds! {
+    Campaign(PipelineCampaign) => EpiphanyPipelineCampaignDocument, "campaign",
+        "epiphany.pipeline.campaign.v2", "EpiphanyPipelineCampaignDocument";
+    Target(PipelineTarget) => EpiphanyPipelineTargetDocument, "target",
+        "epiphany.pipeline.target.v2", "EpiphanyPipelineTargetDocument";
+    Question(PipelineQuestion) => EpiphanyPipelineQuestionDocument, "question",
+        "epiphany.pipeline.question.v2", "EpiphanyPipelineQuestionDocument";
+    Ruling(PipelineRuling) => EpiphanyPipelineRulingDocument, "ruling",
+        "epiphany.pipeline.ruling.v2", "EpiphanyPipelineRulingDocument";
+    CutSpec(PipelineCutSpec) => EpiphanyPipelineCutSpecDocument, "cut_spec",
+        "epiphany.pipeline.cut_spec.v2", "EpiphanyPipelineCutSpecDocument";
+    CutReport(PipelineCutReport) => EpiphanyPipelineCutReportDocument, "cut_report",
+        "epiphany.pipeline.cut_report.v2", "EpiphanyPipelineCutReportDocument";
+    Verdict(PipelineVerdict) => EpiphanyPipelineVerdictDocument, "verdict",
+        "epiphany.pipeline.verdict.v2", "EpiphanyPipelineVerdictDocument";
+    Finding(PipelineFinding) => EpiphanyPipelineFindingDocument, "finding",
+        "epiphany.pipeline.finding.v2", "EpiphanyPipelineFindingDocument";
+    FollowUp(PipelineFollowUp) => EpiphanyPipelineFollowUpDocument, "follow_up",
+        "epiphany.pipeline.follow_up.v2", "EpiphanyPipelineFollowUpDocument";
+    Resolution(PipelineResolution) => EpiphanyPipelineResolutionDocument, "resolution",
+        "epiphany.pipeline.resolution.v2", "EpiphanyPipelineResolutionDocument";
+    Instance(PipelineInstance) => EpiphanyPipelineInstanceDocument, "instance",
+        "epiphany.pipeline.instance.v2", "EpiphanyPipelineInstanceDocument";
+    Stewardship(PipelineStewardship) => EpiphanyPipelineStewardshipDocument, "stewardship",
+        "epiphany.pipeline.stewardship.v2", "EpiphanyPipelineStewardshipDocument";
+    HandOff(PipelineHandOff) => EpiphanyPipelineHandOffDocument, "hand_off",
+        "epiphany.pipeline.hand_off.v2", "EpiphanyPipelineHandOffDocument";
+}
+
+/// Parses a full document id: the grammar read backwards. A key and an id are
+/// the same string, so this accepts exactly what `pipeline_key` derives:
+/// `<root>:<kind>:<local>`, three segments for every kind. The kind segment
+/// must equal `kind`'s name, the root is a `Slug`, and the local is `Label`s
+/// joined by `.` and bounded whole by `local_max(kind)`, so `..`, an empty part, spaces and trailing
+/// junk are all refused. Returns the root and the local; nothing is inferred
+/// from either, and no kind is read any other way.
+fn pipeline_id<'a>(
+    field: &str,
+    id: &'a str,
+    kind: PipelineKind,
+) -> Result<(&'a str, &'a str), PipelineRefusal> {
+    let mut segments = id.split(':');
+    let (Some(root), Some(name), Some(local), None) = (
+        segments.next(),
+        segments.next(),
+        segments.next(),
+        segments.next(),
+    ) else {
+        return Err(format_error(field, id));
+    };
+    if name != kind.name() {
+        return Err(format_error(field, id));
+    }
+    dotted_text(field, root)?;
+    dotted_within(field, local, local_max(kind))?;
+    Ok((root, local))
+}
+
+/// The local segment of a parent id in `campaign`, of the expected kind.
+fn parent_local<'a>(
+    field: &str,
+    id: &'a str,
+    campaign: &str,
+    kind: PipelineKind,
+) -> Result<&'a str, PipelineRefusal> {
+    let (owner, local) = pipeline_id(field, id, kind)?;
+    if owner != campaign {
+        return Err(format_error(field, id));
+    }
+    Ok(local)
+}
+
+/// The cut label inside a parent local `cut-<label>.<marker><N>`: exactly two
+/// parts, the label a `Label` and `<N>` a non-empty run of digits.
+fn parent_cut<'a>(field: &str, local: &'a str, marker: char) -> Result<&'a str, PipelineRefusal> {
+    let invalid = || format_error(field, local);
+    let mut parts = local.split('.');
+    let (Some(head), Some(suffix), None) = (parts.next(), parts.next(), parts.next()) else {
+        return Err(invalid());
+    };
+    let cut = head.strip_prefix("cut-").ok_or_else(invalid)?;
+    label_text(field, cut)?;
+    let digits = suffix.strip_prefix(marker).ok_or_else(invalid)?;
+    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(invalid());
+    }
+    Ok(cut)
+}
+
+/// A `Slug` or an `OrgRepo` entering a local, escaped to one label. `/` is not
+/// a `Label` byte, so it cannot survive into a key, and neither may `.`: no
+/// local part carries the separator, or the boundary before it would have two
+/// readings. A dotted slug and a dotted repo name are both ordinary, so both
+/// bytes are escaped rather than refused. The escape has to be injective or two
+/// values claim one key: replacing `/` with `_` alone is not, since
+/// `GameCult_Epiphany/thing` and `GameCult/Epiphany_thing` both give
+/// `GameCult_Epiphany_thing`. So `_` is escaped as well, and every code is two
+/// bytes starting with `_`: `_` becomes `__`, `/` becomes `_-`, and `.` becomes
+/// `_d`. Every other byte is passed through and is never `_`, so a reader going
+/// left to right takes each `_` together with the byte after it and never has a
+/// choice to make; the encoding is therefore reversible, and distinct values
+/// give distinct segments. The caller validates the value as its own type first
+/// and checks the result against the local's rules, which is where an over-long
+/// or otherwise unlabelled value is refused.
+fn key_segment(value: &str) -> String {
+    value.replace('_', "__").replace('/', "_-").replace('.', "_d")
+}
+
+/// The local of a root. A campaign's or an instance's identity is entirely its
+/// root segment, so its local carries none; a reader never consults it.
+const ROOT_LOCAL: &str = "self";
+
+/// The bound on a composed local of every kind but a resolution, whole, in
+/// UTF-8 bytes. Every stored subject key is within it.
+const SUBJECT_LOCAL_MAX: usize = 64;
+
+/// The longest kind name a resolution can name as its subject (`stewardship`),
+/// checked against `PipelineKind::ALL` by a test.
+const LONGEST_KIND_NAME: usize = "stewardship".len();
+
+/// A `.n<sequence>` part at `u32::MAX`.
+const SEQUENCE_PART_MAX: usize = ".n".len() + "4294967295".len();
+
+/// The bound on a resolution's local: a depth-two chain over a maximal
+/// subject, `resolution.<kind>.<subject local>.n<seq>.n<seq>`, at `u32::MAX`
+/// sequences. Depth is capped at two by admission (Q19), and this bound admits
+/// exactly that for every subject, so no subject is born unresolvable. Derived
+/// from `SUBJECT_LOCAL_MAX` and the kind names, never written as a number.
+const RESOLUTION_LOCAL_MAX: usize = "resolution.".len() + LONGEST_KIND_NAME + ".".len() + SUBJECT_LOCAL_MAX + 2 * SEQUENCE_PART_MAX;
+
+// `<root>:<kind>:<local>` must fit a `Short` wherever an id is cited.
+const _: () = assert!(64 + ":".len() + LONGEST_KIND_NAME + ":".len() + RESOLUTION_LOCAL_MAX <= 200);
+
+/// The bound on a kind's composed local, chosen here and nowhere else.
+fn local_max(kind: PipelineKind) -> usize {
+    match kind {
+        PipelineKind::Resolution => RESOLUTION_LOCAL_MAX,
+        _ => SUBJECT_LOCAL_MAX,
+    }
+}
+
+/// The schema epoch every pipeline store is written at, owned here with the
+/// schemas it names. Evolution is additive and keeps it: a new named field
+/// with a serde default, or a widened `PipelineKind`, since each reader ships
+/// with the variants it knows and refuses an unknown kind on the kind, not on
+/// the epoch. A breaking change bumps it, so that a store written at the old
+/// one can be refused by whoever opens it; this crate owns no store and
+/// refuses none.
+pub const PIPELINE_SCHEMA_EPOCH: &str = "epiphany.pipeline.epoch.v2";
+
+/// Composes and validates a local: every part is a `Label`, and the join is
+/// bounded whole by `local_max(kind)`. Both rules live here because this is the only way a local is
+/// built; `pipeline_key` has no other path to a key string. Parts are a slice,
+/// not a builder, so an arm's arity is written at its call site.
+fn local(field: &str, kind: PipelineKind, parts: &[&str]) -> Result<String, PipelineRefusal> {
+    for part in parts {
+        label_text(field, part)?;
+    }
+    let joined = parts.join(".");
+    if joined.len() > local_max(kind) {
+        return Err(format_error(field, &joined));
+    }
+    Ok(joined)
+}
+
+/// Derives a document's identity key (D1, "Keys: identity, not convenience").
+/// Thirteen arms, one exit: every arm names its root and composes its local
+/// through `local`, and the key is formatted here and nowhere else.
+pub fn pipeline_key(document: &PipelineDocument) -> Result<String, PipelineRefusal> {
+    use PipelineDocument as D;
+    let document_kind = document.kind();
+    let kind = document_kind.name();
+    let key_field = format!("{kind}.key");
+    let campaign_field = format!("{kind}.campaign");
+    let (root_field, root, composed) = match document {
+        D::Campaign(value) => ("campaign.slug", value.slug.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
+        D::Instance(value) => ("instance.instance", value.instance.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
+        // A resolution is keyed inside its subject's root, with the subject's
+        // kind and local as its own local and its per-subject sequence last, so
+        // the subject's resolutions and only they share the prefix
+        // `<root>:resolution:<kind>.<local>.n`. A resolution's own key is an
+        // ordinary id, so it composes as a subject like any other; each nesting
+        // prepends `resolution.` (11 bytes) and appends `.n<s>` (3 bytes for
+        // one digit). Depth is capped at two by admission (Q19), and
+        // `RESOLUTION_LOCAL_MAX` admits exactly a depth-two chain over a
+        // maximal subject, so every subject resolves and its resolution can be
+        // withdrawn.
+        D::Resolution(value) => {
+            let field = "resolution.subject.id";
+            let (subject_root, subject_local) = pipeline_id(field, &value.subject.id.0, value.subject.kind)?;
+            let sequence = format!("n{}", value.sequence);
+            let parts = std::iter::once(value.subject.kind.name()).chain(subject_local.split('.')).chain(std::iter::once(sequence.as_str())).collect::<Vec<_>>();
+            (field, subject_root, local(&key_field, document_kind, &parts)?)
+        }
+        // Stewardship and hand-off hang off an instance rather than a campaign.
+        // The root is the whole difference; the key shape is the same.
+        D::Stewardship(value) => {
+            org_repo_text("stewardship.repo", &value.repo.0)?;
+            let sequence = format!("n{}", value.sequence);
+            (
+                "stewardship.instance",
+                value.instance.0.as_str(),
+                local(&key_field, document_kind, &[&key_segment(&value.repo.identity()), &sequence])?,
+            )
+        }
+        D::HandOff(value) => {
+            dotted_text("hand_off.to_instance", &value.to_instance.0)?;
+            org_repo_text("hand_off.repo", &value.repo.0)?;
+            value.handed_on.validate("hand_off.handed_on")?;
+            (
+                "hand_off.from_instance",
+                value.from_instance.0.as_str(),
+                local(
+                    &key_field,
+                    document_kind,
+                    &[&key_segment(&value.to_instance.0), &key_segment(&value.repo.identity()), &value.handed_on.0],
+                )?,
+            )
+        }
+        D::Target(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&format!("r{}", value.revision)])?),
+        D::Question(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::Ruling(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::FollowUp(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::CutSpec(value) => (
+            campaign_field.as_str(),
+            value.campaign.0.as_str(),
+            local(&key_field, document_kind, &[&format!("cut-{}", value.cut.0), &format!("r{}", value.revision)])?,
+        ),
+        D::CutReport(value) => {
+            let spec = parent_local("cut_report.cut_spec", &value.cut_spec.0, &value.campaign.0, PipelineKind::CutSpec)?;
+            let cut = parent_cut("cut_report.cut_spec", spec, 'r')?;
+            (
+                campaign_field.as_str(),
+                value.campaign.0.as_str(),
+                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("h{}", value.attempt)])?,
+            )
+        }
+        D::Verdict(value) => {
+            let report = parent_local("verdict.cut_report", &value.cut_report.0, &value.campaign.0, PipelineKind::CutReport)?;
+            let cut = parent_cut("verdict.cut_report", report, 'h')?;
+            (
+                campaign_field.as_str(),
+                value.campaign.0.as_str(),
+                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("s{}", value.pass)])?,
+            )
+        }
+        D::Finding(value) => {
+            let verdict = parent_local("finding.verdict", &value.verdict.0, &value.campaign.0, PipelineKind::Verdict)?;
+            parent_cut("finding.verdict", verdict, 's')?;
+            let parts = verdict.split('.').chain(std::iter::once(value.label.0.as_str())).collect::<Vec<_>>();
+            (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &parts)?)
+        }
+    };
+    dotted_text(root_field, root)?;
+    Ok(format!("{root}:{kind}:{composed}"))
+}
+
+/// Bounds, formats, then key recomputation, on the envelope that will be
+/// stored, whoever prepared it. It is the whole of what this crate checks
+/// before a write; per-kind and cross-document rules are not decided here and
+/// belong to the admission path of the organ that will admit these documents,
+/// which is expected to call this first rather than re-derive it.
+pub fn validate_pipeline_write_envelope(envelope: &CultCacheEnvelope) -> Result<(), PipelineRefusal> {
+    let document = PipelineDocument::decode(envelope)?;
+    document.validate()?;
+    let expected = pipeline_key(&document)?;
+    if envelope.key != expected {
+        return Err(PipelineRefusal::InvalidIdentity {
+            kind: document.kind(),
+            key: envelope.key.clone(),
+            expected,
+        });
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::BTreeSet;
+    use std::path::Path;
+
+    const CAMPAIGN: &str = "eureka-state";
+    const INSTANCE: &str = "yggdrasil";
+
+    fn s(value: &str) -> Short {
+        value.into()
+    }
+
+    fn t(value: &str) -> Title {
+        value.into()
+    }
+
+    fn l(value: &str) -> Label {
+        value.into()
+    }
+
+    fn slug(value: &str) -> Slug {
+        value.into()
+    }
+
+    fn id(kind: &str, local: &str) -> Short {
+        Short(format!("{CAMPAIGN}:{kind}:{local}"))
+    }
+
+    fn sha() -> Sha {
+        Sha("5f98228d".into())
+    }
+
+    fn date() -> Date {
+        Date("2026-09-15".into())
+    }
+
+    fn range() -> CommitRange {
+        CommitRange { base: sha(), head: sha() }
+    }
+
+    fn location() -> CodeLocation {
+        CodeLocation { path: s("crates/eureka-pipeline/src/lib.rs"), line: 1, end_line: Some(9) }
+    }
+
+    fn evidence() -> Evidence {
+        Evidence { kind: EvidenceKind::Test, locator: "cargo test".into(), result: "ok".into() }
+    }
+
+    fn doc_ref() -> DocRef {
+        DocRef { path: s("notes/eureka-pipeline-state-target.md"), start_line: 1, end_line: 9, commit: sha() }
+    }
+
+    /// One valid document of every kind, with its expected key.
+    fn samples() -> Vec<(PipelineDocument, String)> {
+        use PipelineDocument as D;
+        let repo = || OrgRepo("GameCult/Epiphany".into());
+        let branch = || s("codex/eureka-pipeline-state");
+        vec![
+            (D::Campaign(PipelineCampaign {
+                slug: slug(CAMPAIGN), title: t("Eureka pipeline state"), repos: vec![repo()],
+                working_branch: branch(), target_doc: doc_ref(),
+            }), format!("{CAMPAIGN}:campaign:self")),
+            (D::Target(PipelineTarget {
+                campaign: slug(CAMPAIGN), revision: 2,
+                invariants: vec![TargetInvariant { label: l("mind-admits"), statement: "Only admission writes.".into() }],
+                not_in_scope: vec!["Eve browsing".into()], canonical_implementations: vec!["CultLib".into()], doc: doc_ref(),
+            }), format!("{CAMPAIGN}:target:r2")),
+            (D::Question(PipelineQuestion {
+                campaign: slug(CAMPAIGN), label: l("Q1"), title: t("Who owns the state?"), question: "Who owns the state?".into(),
+                options: vec![
+                    QuestionOption { label: l("A"), text: "an instance".into() },
+                    QuestionOption { label: l("B"), text: "a repo".into() },
+                ],
+                recommended: l("A"), depends: vec!["Cut 3a".into()],
+                raised_in: Some(PipelineRef { kind: PipelineKind::CutSpec, id: id("cut_spec", "cut-3a.r1") }),
+                asked_on: date(),
+            }), format!("{CAMPAIGN}:question:Q1")),
+            (D::Ruling(PipelineRuling {
+                campaign: slug(CAMPAIGN), label: l("R8"), title: t("An instance owns its mind"), answers: Some(id("question", "Q1")), choice: Some(l("A")),
+                ruling: "An instance owns its mind.".into(), operator_quote: Some("all recommendations, go ahead".into()),
+                ruled_on: date(),
+                precedents: vec![ForeignRef {
+                    repo: OrgRepo("GameCult/Aetheria".into()), commit: FullSha("a".repeat(40)), kind: PipelineKind::Ruling,
+                    id: s("cultcache:ruling:R1"), payload_sha256: Sha256Hex("b".repeat(64)),
+                }],
+                authority: RulingAuthority::Operator,
+            }), format!("{CAMPAIGN}:ruling:R8")),
+            (D::CutSpec(PipelineCutSpec {
+                campaign: slug(CAMPAIGN), cut: l("3a"), revision: 1, title: t("Pipeline documents"), repo: repo(),
+                branch: branch(), base: sha(), depends_on: vec![s("2")], first: vec!["Read the spec.".into()],
+                deletes: vec![CutDelete { path: s("old.rs"), lines: 3, note: "dead".into() }],
+                keeps_moves: vec!["commit owner".into()], adds: vec!["pipeline_documents.rs".into()],
+                file_changes: vec![FileChange { location: location(), change: "add".into() }],
+                authority_map: Some(AuthorityMap {
+                    owner: "core".into(), inputs: vec!["typed documents".into()], outputs: vec!["envelopes".into()],
+                    derived_state: vec!["derived keys".into()], forbidden_writers: vec!["MCP".into()],
+                    shared_paths: vec!["admission".into()], deletion_line: "n/a".into(),
+                }),
+                verification: CutVerification {
+                    builds: vec!["cargo check".into()],
+                    tests: vec![VerificationTest { name: s("keys"), pins: "one derived key".into() }],
+                    negative: vec![NegativeCheck { pattern: s("Vec<u8>"), scope: "documents".into() }],
+                    operator: vec!["none".into()],
+                },
+                // Cut 3a's real numbers, and in this order: the tripwire test
+                // reads them back, so a transposition is a failure, not a typo.
+                estimate: StructuralDelta {
+                    lines_added: 900, lines_removed: 0,
+                    dependencies_added: vec![s("schemars")], dependencies_removed: vec![],
+                    formats_added: vec![s("epiphany.pipeline.*.v1")], formats_removed: vec![],
+                    targets_added: vec![], targets_removed: vec![],
+                },
+                rulings: vec![id("ruling", "R8")], questions: vec![id("question", "Q1")],
+            }), format!("{CAMPAIGN}:cut_spec:cut-3a.r1")),
+            (D::CutReport(PipelineCutReport {
+                campaign: slug(CAMPAIGN), cut_spec: id("cut_spec", "cut-3a.r1"), attempt: 1, repo: repo(), branch: branch(),
+                commits: vec![ReportCommit { sha: sha(), subject: "Add the pipeline documents".into(), builds: true }],
+                range: range(), verification: vec![evidence()],
+                mutations: vec![MutationRecord {
+                    // `.into()` on both, not `l()` and `sha()`: the type-level
+                    // mutations (M19, M20) widen these fields to `Short`, and
+                    // a sample spelled with the narrow constructors would stop
+                    // compiling instead of letting the forgery through.
+                    label: "M1".into(), rule: "key derivation".into(), location: location(),
+                    before: "parent_cut(field, spec, 'r')?".into(), after: "spec".into(), commit: "5f98228d".into(),
+                    failed_as_expected: true,
+                }],
+                deviations: vec![Deviation { what: "names".into(), why: "glob exports".into() }],
+                forks: vec![id("question", "Q1")],
+                structural_delta: StructuralDelta {
+                    lines_added: 900, lines_removed: 0, dependencies_added: vec![s("schemars")],
+                    dependencies_removed: vec![], formats_added: vec![s("epiphany.pipeline.*.v1")],
+                    formats_removed: vec![], targets_added: vec![], targets_removed: vec![],
+                },
+                landed_names: vec![LandedName { name: s("PipelineDocument"), path: s("crates/eureka-pipeline/src/lib.rs") }],
+                undone: vec!["admission".into()],
+                promises: vec![Promise { label: l("P1"), text: "One derived key per document.".into() }],
+            }), format!("{CAMPAIGN}:cut_report:cut-3a.h1")),
+            (D::Verdict(PipelineVerdict {
+                campaign: slug(CAMPAIGN), cut_report: id("cut_report", "cut-3a.h1"), pass: 2, range: range(),
+                claims: vec![VerdictClaim {
+                    claim: "A composed key has one source.".into(), outcome: ClaimOutcome::Falsified,
+                    evidence: vec![evidence()], findings: vec![id("finding", "cut-3a.s2.F4")],
+                    promise: Some(l("P1")), mutations: vec![l("M1")],
+                }],
+            }), format!("{CAMPAIGN}:verdict:cut-3a.s2")),
+            (D::Finding(PipelineFinding {
+                campaign: slug(CAMPAIGN), verdict: id("verdict", "cut-3a.s2"), label: l("F4"), range: range(),
+                confidence: FindingConfidence::Confirmed, severity: FindingSeverity::High,
+                claim: "A dotted label composes two keys.".into(), invariants: vec![l("mind-admits")],
+                locations: vec![location()], failure_scenario: "Two documents claim one key.".into(),
+                evidence: vec![evidence()], precedents: vec![], origin: FindingOrigin::Introduced,
+            }), format!("{CAMPAIGN}:finding:cut-3a.s2.F4")),
+            (D::FollowUp(PipelineFollowUp {
+                campaign: slug(CAMPAIGN), label: l("FU-4"),
+                source: PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") },
+                repo: repo(), locations: vec![location()], item: "Per-kind admission rules.".into(),
+                why_it_can_wait: "The organ owns admission.".into(), owner: s("Hands"),
+            }), format!("{CAMPAIGN}:follow_up:FU-4")),
+            (D::Resolution(PipelineResolution {
+                subject: PipelineRef { kind: PipelineKind::Question, id: id("question", "Q1") }, sequence: 1,
+                outcome: ResolutionOutcome::Answered { by: PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") } },
+                rationale: "Ruled A.".into(), resolved_on: date(),
+            }), format!("{CAMPAIGN}:resolution:question.Q1.n1")),
+            // The mind's own three kinds. They are appended rather than
+            // inserted because the helpers below index this list by position.
+            (D::Instance(PipelineInstance {
+                instance: slug(INSTANCE), display_name: s("Yggdrasil mind"), created_at: date(),
+                host: s("yggdrasil"),
+            }), format!("{INSTANCE}:instance:self")),
+            (D::Stewardship(PipelineStewardship {
+                instance: slug(INSTANCE), repo: repo(), sequence: 1, assigned_on: date(),
+                note: "The Eureka campaign repo.".into(),
+            }), format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")),
+            (D::HandOff(PipelineHandOff {
+                from_instance: slug(INSTANCE), to_instance: slug("thought-cage"), repo: repo(),
+                documents: vec![s(CAMPAIGN), id("ruling", "R8")],
+                reason: "The workstation mind takes the campaign.".into(), handed_on: date(),
+            }), format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.{}", date().0)),
+        ]
+    }
+
+    fn instance_sample() -> PipelineInstance {
+        let PipelineDocument::Instance(instance) = samples().remove(10).0 else { unreachable!() };
+        instance
+    }
+
+    fn stewardship_sample() -> PipelineStewardship {
+        let PipelineDocument::Stewardship(stewardship) = samples().remove(11).0 else { unreachable!() };
+        stewardship
+    }
+
+    fn hand_off_sample() -> PipelineHandOff {
+        let PipelineDocument::HandOff(hand_off) = samples().remove(12).0 else { unreachable!() };
+        hand_off
+    }
+
+    fn campaign_sample() -> PipelineDocument {
+        samples().remove(0).0
+    }
+
+    fn question_sample() -> PipelineQuestion {
+        let PipelineDocument::Question(question) = samples().remove(2).0 else { unreachable!() };
+        question
+    }
+
+    fn ruling_sample() -> PipelineRuling {
+        let PipelineDocument::Ruling(ruling) = samples().remove(3).0 else { unreachable!() };
+        ruling
+    }
+
+    fn report_sample() -> PipelineCutReport {
+        let PipelineDocument::CutReport(report) = samples().remove(5).0 else { unreachable!() };
+        report
+    }
+
+    fn verdict_sample() -> PipelineVerdict {
+        let PipelineDocument::Verdict(verdict) = samples().remove(6).0 else { unreachable!() };
+        verdict
+    }
+
+    fn finding_sample() -> PipelineFinding {
+        let PipelineDocument::Finding(finding) = samples().remove(7).0 else { unreachable!() };
+        finding
+    }
+
+    fn resolution_sample() -> PipelineResolution {
+        let PipelineDocument::Resolution(resolution) = samples().remove(9).0 else { unreachable!() };
+        resolution
+    }
+
+    /// The golden corpus: every sample plus one document per encoding-relevant
+    /// variant (every enum variant, every Option both ways), each under a
+    /// unique label that names what it varies.
+    fn golden_documents() -> Vec<(String, PipelineDocument)> {
+        use PipelineDocument as D;
+        let mut out: Vec<(String, PipelineDocument)> =
+            samples().into_iter().map(|(d, _)| (format!("sample.{}", d.kind().name()), d)).collect();
+        let by = |kind: PipelineKind, kind_name: &str, local: &str| PipelineRef { kind, id: id(kind_name, local) };
+        let resolution = |outcome: ResolutionOutcome| {
+            let mut r = resolution_sample();
+            r.outcome = outcome;
+            D::Resolution(r)
+        };
+        let ruling_ref = || by(PipelineKind::Ruling, "ruling", "R8");
+        out.push(("resolution.superseded".into(), resolution(ResolutionOutcome::Superseded { by: vec![ruling_ref(), by(PipelineKind::Question, "question", "Q1")] })));
+        out.push(("resolution.fixed-by-none".into(), resolution(ResolutionOutcome::Fixed { commit: sha(), by: None })));
+        out.push(("resolution.fixed-by-some".into(), resolution(ResolutionOutcome::Fixed { commit: sha(), by: Some(by(PipelineKind::CutReport, "cut_report", "cut-3a.h1")) })));
+        out.push(("resolution.deferred".into(), resolution(ResolutionOutcome::Deferred { to: by(PipelineKind::FollowUp, "follow_up", "FU-4") })));
+        out.push(("resolution.recorded".into(), resolution(ResolutionOutcome::Recorded { reason: "Noted.".into() })));
+        out.push(("resolution.withdrawn".into(), resolution(ResolutionOutcome::Withdrawn { reason: "Mistaken.".into() })));
+        for (name, authority) in [("standing", RulingAuthority::Standing), ("defaulted", RulingAuthority::Defaulted)] {
+            let mut r = ruling_sample();
+            r.authority = authority;
+            out.push((format!("ruling.authority-{name}"), D::Ruling(r)));
+        }
+        let mut r = ruling_sample();
+        (r.answers, r.choice, r.operator_quote, r.precedents) = (None, None, None, vec![]);
+        out.push(("ruling.options-none".into(), D::Ruling(r)));
+        let mut q = question_sample();
+        q.raised_in = None;
+        out.push(("question.raised-in-none".into(), D::Question(q)));
+        let PipelineDocument::CutSpec(mut spec) = samples().remove(4).0 else { unreachable!() };
+        spec.authority_map = None;
+        out.push(("cut_spec.authority-map-none".into(), D::CutSpec(spec)));
+        for (name, outcome) in [("holds", ClaimOutcome::Holds), ("unproven", ClaimOutcome::Unproven)] {
+            let mut v = verdict_sample();
+            v.claims[0].outcome = outcome;
+            v.claims[0].promise = None;
+            out.push((format!("verdict.claim-{name}-promise-none"), D::Verdict(v)));
+        }
+        let mut f = finding_sample();
+        (f.confidence, f.severity, f.origin) = (FindingConfidence::Plausible, FindingSeverity::Blocker, FindingOrigin::PreExisting);
+        f.locations[0].end_line = None;
+        f.evidence = [EvidenceKind::Command, EvidenceKind::Mutation, EvidenceKind::Probe, EvidenceKind::SourceRead, EvidenceKind::Capture]
+            .into_iter().map(|kind| Evidence { kind, locator: "x".into(), result: "y".into() }).collect();
+        out.push(("finding.plausible-blocker-preexisting-kinds".into(), D::Finding(f)));
+        for (name, severity) in [("medium", FindingSeverity::Medium), ("low", FindingSeverity::Low)] {
+            let mut f = finding_sample();
+            f.severity = severity;
+            out.push((format!("finding.severity-{name}"), D::Finding(f)));
+        }
+        out
+    }
+
+    /// One line per document: `label key type schema payload-hex`.
+    fn golden_lines() -> Result<Vec<String>> {
+        let cache = schema_cache()?;
+        golden_documents()
+            .into_iter()
+            .map(|(label, document)| {
+                document.validate()?;
+                let envelope = document.prepare(&cache)?;
+                let hex: String = envelope.payload.iter().map(|b| format!("{b:02x}")).collect();
+                Ok(format!("{label} {} {} {} {hex}", envelope.key, envelope.r#type, document.kind().schema_name()))
+            })
+            .collect()
+    }
+
+    /// The wire is pinned to bytes. `golden/envelopes.txt` was derived once
+    /// from this crate at its copy of Epiphany ef956865 (huginn 87b6455), which
+    /// was proved byte-identical to the live mind store and to Epiphany; see
+    /// its header. Payload bytes are load-bearing (`ForeignRef.payload_sha256`
+    /// hashes them), and the cultcache type id and schema name are how a store
+    /// resolves a persisted entry. A deliberate wire change re-derives the file
+    /// with `golden_dump` below, in the same commit as a ruling that allows it.
+    #[test]
+    fn encoded_envelopes_match_the_committed_golden() -> Result<()> {
+        let golden = include_str!("../golden/envelopes.txt");
+        let expected: Vec<&str> = golden.lines().filter(|line| !line.starts_with('#') && !line.is_empty()).collect();
+        let actual = golden_lines()?;
+        assert_eq!(actual.len(), expected.len(), "the corpus and the golden file have the same documents");
+        for (actual, expected) in actual.iter().zip(expected) {
+            assert_eq!(actual, expected);
+        }
+        let kinds: BTreeSet<&str> = actual.iter().filter_map(|line| line.split(' ').nth(2)).collect();
+        assert_eq!(kinds.len(), PipelineKind::ALL.len(), "every kind's type id is in the golden");
+        Ok(())
+    }
+
+    /// Prints the golden body to the file named by `GOLDEN_OUT`. Not a check:
+    /// run only for a deliberate wire change, then paste under the header.
+    #[test]
+    #[ignore = "re-derives golden/envelopes.txt; run only for a ruled wire change"]
+    fn golden_dump() -> Result<()> {
+        let out = std::env::var("GOLDEN_OUT").expect("GOLDEN_OUT names the output file");
+        std::fs::write(out, golden_lines()?.join("
+") + "
+")?;
+        Ok(())
+    }
+
+    /// The live registrar plus the foreign stand-in, which only the tests
+    /// register.
+    fn schema_cache() -> Result<CultCache> {
+        let mut cache = CultCache::new();
+        register_pipeline_document_types(&mut cache)?;
+        cache.register_entry_type::<ForeignDocument>()?;
+        Ok(cache)
+    }
+
+    #[test]
+    fn every_pipeline_kind_round_trips_through_named_slot_zero() -> Result<()> {
+        let cache = schema_cache()?;
+        let samples = samples();
+        let kinds = samples.iter().map(|(document, _)| document.kind()).collect::<BTreeSet<_>>();
+        assert_eq!(kinds.len(), PipelineKind::ALL.len(), "every kind has a sample");
+        for (document, _) in samples {
+            document.validate()?;
+            let envelope = document.prepare(&cache)?;
+            assert_eq!(envelope.r#type, document.kind().type_id());
+            assert_eq!(envelope.payload[0], 0x91, "{:?} payload is a one-element array", document.kind());
+            assert!(
+                matches!(envelope.payload[1], 0x80..=0x8f | 0xde | 0xdf),
+                "{:?} slot 0 is a named map",
+                document.kind()
+            );
+            assert_eq!(PipelineDocument::decode(&envelope)?, document);
+            Ok::<_, anyhow::Error>(())?;
+        }
+        Ok(())
+    }
+
+    /// Soul F2: a decode is type-matched in both directions. The round-trip
+    /// test above pins the positive match; this pins the refusal, so an
+    /// envelope belonging to another kind can never be decoded as whichever
+    /// pipeline kind happens to parse its payload. The commit receipt is the
+    /// sharp case: a mind's store may legitimately hold one, and it is still
+    /// not a document; `ForeignDocument` stands in for it here.
+    #[test]
+    fn decode_refuses_an_envelope_of_a_foreign_type() -> Result<()> {
+        let cache = schema_cache()?;
+        let foreign = <ForeignDocument as DatabaseEntry>::TYPE;
+        assert!(!foreign.starts_with("epiphany.pipeline."), "{foreign} is a foreign type id");
+        let mut envelope = campaign_sample().prepare(&cache)?;
+        envelope.r#type = foreign.into();
+        assert_eq!(
+            PipelineDocument::decode(&envelope),
+            Err(PipelineRefusal::ForeignStore { r#type: foreign.into() })
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn bounds_refuse_in_utf8_bytes() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.title = Title("é".repeat(100));
+        assert_eq!(PipelineDocument::Campaign(campaign.clone()).validate(), Ok(()));
+        campaign.title = Title(format!("{}a", "é".repeat(100)));
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 })
+        );
+        campaign.title = t("ok");
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 9];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign).validate(),
+            Err(PipelineRefusal::FieldBound { field: "campaign.repos".into(), limit: 8, actual: 9 })
+        );
+    }
+
+    /// RS-L closing fix 4: `campaign.repos` refuses two entries naming one
+    /// repository by identity, not only by raw spelling, so `GameCult/Epiphany`
+    /// and `gamecult/epiphany` in one list refuse exactly as the same spelling
+    /// twice would. Two genuinely distinct repos still validate.
+    #[test]
+    fn campaign_repos_refuse_duplicates_by_identity() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("gamecult/epiphany".into())];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::DuplicateRepo {
+                field: "campaign.repos".into(),
+                repo: "gamecult/epiphany".into(),
+            })
+        );
+
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 2];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::DuplicateRepo {
+                field: "campaign.repos".into(),
+                repo: "GameCult/Epiphany".into(),
+            })
+        );
+
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("GameCult/Aetheria".into())];
+        assert_eq!(PipelineDocument::Campaign(campaign).validate(), Ok(()));
+    }
+
+    #[test]
+    fn repo_fields_must_be_org_slash_repo() {
+        let mut report = report_sample();
+        report.repo = OrgRepo("Epiphany".into());
+        assert_eq!(
+            PipelineDocument::CutReport(report).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "cut_report.repo".into(), value: "Epiphany".into() })
+        );
+        let PipelineDocument::CutSpec(mut spec) = samples().remove(4).0 else { unreachable!() };
+        spec.repo = OrgRepo("GameCult/Epiphany/extra".into());
+        assert!(matches!(
+            PipelineDocument::CutSpec(spec).validate(),
+            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_spec.repo"
+        ));
+        let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
+        follow_up.repo = OrgRepo("/Epiphany".into());
+        assert!(matches!(
+            PipelineDocument::FollowUp(follow_up).validate(),
+            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "follow_up.repo"
+        ));
+    }
+
+    #[test]
+    fn keys_are_derived_and_mismatch_refuses() -> Result<()> {
+        let cache = schema_cache()?;
+        for (document, key) in samples() {
+            assert_eq!(pipeline_key(&document), Ok(key.clone()));
+            let mut envelope = document.prepare(&cache)?;
+            envelope.key = format!("{key}-forged");
+            assert_eq!(
+                validate_pipeline_write_envelope(&envelope),
+                Err(PipelineRefusal::InvalidIdentity { kind: document.kind(), key: envelope.key, expected: key })
+            );
+        }
+        let mut resolution = resolution_sample();
+        let answered = pipeline_key(&PipelineDocument::Resolution(resolution.clone()));
+        resolution.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(resolution)),
+            answered,
+            "a subject has one resolution key whatever the outcome"
+        );
+        Ok(())
+    }
+
+    /// F2, and Soul's second pass: a composed local segments one way only. The
+    /// rule -- no local part carries the separator -- is pinned on the composer
+    /// in `no_local_part_carries_the_separator`; the pairs below are the ones
+    /// Soul measured through the documents, and each is a pair only because the
+    /// rule holds.
+    #[test]
+    fn composed_keys_cannot_collide() {
+        let key = |document: PipelineDocument| pipeline_key(&document);
+
+        // Soul's hand-off pair. A dotted slug is ordinary on the receiver side
+        // and a dotted repo name (the part after the mandatory `/`, GitHub's
+        // grammar owns no dot on the owner side) is ordinary on the repo side,
+        // so both are escaped: left unescaped these two both key to
+        // `yggdrasil:hand_off:thought-cage.GameCult.Epiphany_-thing.2026-09-15`.
+        let handed = |to: &str, repo: &str| {
+            let mut hand_off = hand_off_sample();
+            hand_off.to_instance = slug(to);
+            hand_off.repo = OrgRepo(repo.into());
+            key(PipelineDocument::HandOff(hand_off))
+        };
+        let dotted_receiver = handed("thought-cage.GameCult", "Epiphany/thing");
+        let dotted_repo = handed("thought-cage", "GameCult/Epiphany.thing");
+        assert_eq!(
+            dotted_receiver,
+            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.epiphany_-thing.2026-09-15"))
+        );
+        assert_eq!(
+            dotted_repo,
+            Ok(format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany_dthing.2026-09-15"))
+        );
+        assert_ne!(dotted_receiver, dotted_repo, "a dotted repo and a dotted receiver cannot claim one key");
+
+        let mut wide_label = finding_sample();
+        wide_label.label = l("F1.G");
+        assert!(
+            matches!(key(PipelineDocument::Finding(wide_label)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a finding label carrying a dot is refused, not silently composed"
+        );
+        let mut deep_verdict = finding_sample();
+        deep_verdict.verdict = id("verdict", "cut-3a.s1.F1");
+        deep_verdict.label = l("G");
+        assert!(
+            matches!(key(PipelineDocument::Finding(deep_verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a verdict local that is not cut-<label>.s<N> is refused"
+        );
+        let mut plain = finding_sample();
+        plain.verdict = id("verdict", "cut-3a.s1");
+        plain.label = l("F1");
+        assert_eq!(key(PipelineDocument::Finding(plain)), Ok(format!("{CAMPAIGN}:finding:cut-3a.s1.F1")));
+
+        let mut deep_spec = report_sample();
+        deep_spec.cut_spec = id("cut_spec", "cut-3a.h1.r1");
+        deep_spec.attempt = 2;
+        assert!(
+            matches!(key(PipelineDocument::CutReport(deep_spec)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a cut label carrying a dot is refused, so cut-3a.h1.h2 has one source"
+        );
+        let mut attempt_two = report_sample();
+        attempt_two.attempt = 2;
+        assert_eq!(key(PipelineDocument::CutReport(attempt_two)), Ok(format!("{CAMPAIGN}:cut_report:cut-3a.h2")));
+    }
+
+    /// F3: every parent id is parsed strictly. These are the bad parents Soul
+    /// found accepted, plus the wrong-kind and marker rules that mutations S1
+    /// and S3 remove.
+    #[test]
+    fn parent_ids_are_parsed_strictly() {
+        let refused = |parent: &str| {
+            let mut report = report_sample();
+            report.cut_spec = Short(parent.into());
+            let key = pipeline_key(&PipelineDocument::CutReport(report));
+            assert!(
+                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_report.cut_spec"),
+                "parent {parent:?} must be refused, got {key:?}"
+            );
+        };
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:junk"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.rX"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-..r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-.r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1 "));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r"));
+        refused(&format!("{CAMPAIGN}:cut_report:cut-3a.h1"));
+        // Right kind and a well-formed number, but the marker belongs to
+        // another kind: the marker rule is pinned on its own.
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.h1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.s1"));
+        // A well-formed number with no marker at all. Only the marker rule
+        // refuses this one: the digits rule is satisfied either way.
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.1"));
+        refused(&format!("{CAMPAIGN}:CUT_SPEC:cut-3a.r1"));
+        refused(&format!("EUREKA-STATE:cut_spec:cut-3a.r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:"));
+        refused(&format!("{CAMPAIGN}::cut-3a.r1"));
+        refused("cut-3a.r1");
+        let mut other_campaign = report_sample();
+        other_campaign.campaign = slug("other-campaign");
+        assert!(
+            matches!(
+                pipeline_key(&PipelineDocument::CutReport(other_campaign)),
+                Err(PipelineRefusal::InvalidFormat { .. })
+            ),
+            "a parent in another campaign is refused"
+        );
+        let mut verdict = verdict_sample();
+        verdict.cut_report = id("cut_report", "cut-3a.r1");
+        assert!(
+            matches!(pipeline_key(&PipelineDocument::Verdict(verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a verdict's parent must carry the report marker, not the spec marker"
+        );
+    }
+
+    /// F4: a resolution's subject id is a full id of the declared kind.
+    #[test]
+    fn resolution_subject_is_a_full_id_of_its_kind() {
+        let refused = |kind: PipelineKind, subject: &str| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            let document = PipelineDocument::Resolution(resolution);
+            assert!(
+                matches!(document.validate(), Err(PipelineRefusal::InvalidFormat { .. })),
+                "subject {subject:?} must fail validation"
+            );
+            assert!(
+                matches!(pipeline_key(&document), Err(PipelineRefusal::InvalidFormat { .. })),
+                "subject {subject:?} must not compose a key"
+            );
+        };
+        refused(PipelineKind::Question, "");
+        refused(PipelineKind::Question, "not an id: spaces and : colons");
+        refused(PipelineKind::Question, "eureka-state:question:1１");
+        refused(PipelineKind::Question, &format!("{CAMPAIGN}:ruling:R8"));
+        refused(PipelineKind::Ruling, &format!("{CAMPAIGN}:question:Q1"));
+        refused(PipelineKind::Question, &format!("{CAMPAIGN}:question:.."));
+
+        let mut valid = resolution_sample();
+        valid.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(valid)),
+            Ok(format!("{CAMPAIGN}:resolution:ruling.R8.n1"))
+        );
+    }
+
+    /// Soul G2: a resolution is named by the key it has, and a `PipelineRef`
+    /// of kind `Resolution` accepts exactly that id. `PipelineRef` takes any
+    /// kind, so this is reachable; a follow-up sourced from a resolution is the
+    /// live path. The grammar admits `<campaign>:resolution:R8` too: it is
+    /// well-formed, and no resolution derives it, but whether a document with an
+    /// id exists is admission's rule, not the grammar's, so the reader does not
+    /// refuse it and this test does not ask it to.
+    #[test]
+    fn a_resolution_is_named_by_the_key_it_has() {
+        let sourced = |id: &str| {
+            let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
+            follow_up.source = PipelineRef { kind: PipelineKind::Resolution, id: Short(id.into()) };
+            PipelineDocument::FollowUp(follow_up).validate()
+        };
+        let key = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
+        assert_eq!(key, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
+        assert_eq!(sourced(&key), Ok(()), "a resolution is named by the key it has");
+        assert_eq!(sourced(&format!("{CAMPAIGN}:resolution:R8")), Ok(()), "well-formed grammar is not the reader's to refuse");
+
+        for refused in [
+            // The prefix shape the writer used to emit. No resolution carries it.
+            format!("resolution:{CAMPAIGN}:question:Q1"),
+            format!("{CAMPAIGN}:resolution:{CAMPAIGN}:question:Q1"),
+            // No local, a subject local with an empty part, trailing junk, and a
+            // kind segment that is not `resolution`.
+            format!("{CAMPAIGN}:resolution:"),
+            format!("{CAMPAIGN}:resolution:question..Q1"),
+            format!("{CAMPAIGN}:resolution:question.Q1:junk"),
+            format!("{CAMPAIGN}:question:Q1"),
+        ] {
+            assert!(
+                matches!(sourced(&refused), Err(PipelineRefusal::InvalidFormat { .. })),
+                "{refused:?} is not an id any resolution has"
+            );
+        }
+
+        // A root subject reads back too: a resolution of a campaign carries the
+        // campaign's kind and its `self` local.
+        let mut of_campaign = resolution_sample();
+        of_campaign.subject = PipelineRef { kind: PipelineKind::Campaign, id: Short(format!("{CAMPAIGN}:campaign:self")) };
+        let root_key = pipeline_key(&PipelineDocument::Resolution(of_campaign)).expect("a root subject keys");
+        assert_eq!(root_key, format!("{CAMPAIGN}:resolution:campaign.self.n1"));
+        assert_eq!(sourced(&root_key), Ok(()));
+    }
+
+    /// The three kinds a mind is keyed by. The samples above already round-trip
+    /// every kind; this pins the shapes D2 gives these three specifically: an
+    /// instance is a root keyed by its own slug, and the other two hang off an
+    /// instance rather than a campaign, so neither borrows the campaign tail.
+    #[test]
+    fn instance_stewardship_and_hand_off_round_trip() -> Result<()> {
+        let cache = schema_cache()?;
+        let instance = PipelineDocument::Instance(instance_sample());
+        assert_eq!(pipeline_key(&instance), Ok(format!("{INSTANCE}:instance:self")));
+        for document in [
+            instance,
+            PipelineDocument::Stewardship(stewardship_sample()),
+            PipelineDocument::HandOff(hand_off_sample()),
+        ] {
+            document.validate()?;
+            let envelope = document.prepare(&cache)?;
+            assert_eq!(PipelineDocument::decode(&envelope)?, document);
+            let key = pipeline_key(&document)?;
+            assert!(
+                !key.starts_with(&format!("{CAMPAIGN}:")),
+                "{:?} is keyed by its instance, not by a campaign: {key}",
+                document.kind()
+            );
+            validate_pipeline_write_envelope(&envelope)?;
+        }
+        // A bounded list is still bounded: `documents` carries a maximum, as
+        // every `Vec` field must.
+        let mut wide = hand_off_sample();
+        wide.documents = vec![s("x"); 257];
+        assert_eq!(
+            PipelineDocument::HandOff(wide).validate(),
+            Err(PipelineRefusal::FieldBound { field: "hand_off.documents".into(), limit: 256, actual: 257 })
+        );
+        Ok(())
+    }
+
+    /// Soul F3: a key and an id are the same string, so every kind's key reads
+    /// back as an id of that kind. The kinds a mind is keyed by were added to
+    /// the key writer and left out of the id reader, and nothing noticed,
+    /// because the key tests assert strings and never read one back: an
+    /// instance keys to its slug and then fails to parse as an instance id, so
+    /// no `PipelineRef` and no resolution could ever name one. Every kind now
+    /// reads back with no kind excused, a resolution included, and a root kind
+    /// read as the other root kind is refused: the reader checks the kind
+    /// segment for the roots exactly as for every other kind.
+    #[test]
+    fn keys_read_back_as_ids_of_their_kind() -> Result<()> {
+        for (document, expected) in samples() {
+            let kind = document.kind();
+            let key = pipeline_key(&document)?;
+            assert_eq!(key, expected, "{kind:?} keys to its sample's key");
+            assert_eq!(
+                pipeline_id("read_back", &key, kind).map(|_| ()),
+                Ok(()),
+                "{kind:?} key {key} does not read back as an id of its kind"
+            );
+        }
+
+        let campaign_key = pipeline_key(&campaign_sample())?;
+        let instance_key = pipeline_key(&PipelineDocument::Instance(instance_sample()))?;
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
+            Ok((INSTANCE, ROOT_LOCAL)),
+            "an instance key reads back as an instance"
+        );
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Campaign),
+            Err(format_error("read_back", &instance_key)),
+            "an instance key is not a campaign id"
+        );
+        assert_eq!(
+            pipeline_id("read_back", &campaign_key, PipelineKind::Instance),
+            Err(format_error("read_back", &campaign_key)),
+            "a campaign key is not an instance id"
+        );
+
+        // Soul X1 and X11: the reader's root and local are each `dotted_text`
+        // whole, so a trailing dot on either is refused by the reader itself,
+        // not only by the writer that never composes one. A leading dot and
+        // an empty part are the same rule on the local.
+        for malformed in ["c.:target:x", "c:target:x.", "c:target:.x", "c:target:a..b"] {
+            let read = pipeline_id("read_back", malformed, PipelineKind::Target);
+            assert!(
+                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "read_back"),
+                "{malformed:?} is not an id of any kind, got {read:?}"
+            );
+        }
+
+        // The instance root's own key segment is validated, not merely bounded.
+        // Nothing else stands between a `Slug` and a key: a space would compose
+        // a store key carrying a byte no `Label` may hold.
+        let mut spaced = instance_sample();
+        spaced.instance = Slug("thought cage".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Instance(spaced)),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "instance.instance".into(),
+                value: "thought cage".into(),
+            }),
+            "an instance slug is validated where the key is composed"
+        );
+        Ok(())
+    }
+
+    /// The repo is one key segment, so its slash is escaped. Left unescaped it
+    /// would both add a segment the reader cannot tell from a real one and put a
+    /// byte in the key that no `Label` may carry; escaped to a bare `_` it would
+    /// let two repos claim one key, which the colliding pair below pins.
+    #[test]
+    fn stewardship_key_escapes_the_repo_slash() {
+        let stewardship = stewardship_sample();
+        assert_eq!(stewardship.repo, OrgRepo("GameCult/Epiphany".into()));
+        let key = pipeline_key(&PipelineDocument::Stewardship(stewardship.clone()));
+        assert_eq!(key, Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")));
+        assert!(!key.unwrap().contains('/'), "no key segment carries a slash");
+
+        // The escape is not a cosmetic substitution, and the pair that proves
+        // it is a pair: GitHub's grammar keeps `.` and `_` out of the owner,
+        // so both live in the repo half here, and under a naive scheme that
+        // collapsed `/`, `.` and `_` all to a bare `_` both of these key to
+        // `GameCult_Epiphany_thing`, and one of the two documents is lost.
+        let keyed = |repo: &str| {
+            let mut value = stewardship.clone();
+            value.repo = OrgRepo(repo.into());
+            pipeline_key(&PipelineDocument::Stewardship(value))
+        };
+        let dotted_repo = keyed("GameCult/Epiphany.thing");
+        let underscored_repo = keyed("GameCult/Epiphany_thing");
+        assert_eq!(
+            dotted_repo,
+            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany_dthing.n1"))
+        );
+        assert_eq!(
+            underscored_repo,
+            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany__thing.n1"))
+        );
+        assert_ne!(dotted_repo, underscored_repo, "two repos cannot claim one key");
+
+        let mut no_org = stewardship.clone();
+        no_org.repo = OrgRepo("Epiphany".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Stewardship(no_org)),
+            Err(PipelineRefusal::InvalidFormat { field: "stewardship.repo".into(), value: "Epiphany".into() })
+        );
+
+        // S-1: key derivation goes through `identity()`, so a case variant of
+        // the same repository is one store key, not two stewardships of what
+        // is really one repo.
+        let mut upper = stewardship.clone();
+        upper.repo = OrgRepo("gamecult/epiphany".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Stewardship(upper)),
+            pipeline_key(&PipelineDocument::Stewardship(stewardship.clone())),
+            "GameCult/Epiphany and gamecult/epiphany must derive one store key"
+        );
+
+        // An escaped repo is still bound by the key's segment rules.
+        let mut long = stewardship;
+        long.repo = OrgRepo(format!("GameCult/{}", "a".repeat(60)));
+        assert!(
+            matches!(
+                pipeline_key(&PipelineDocument::Stewardship(long)),
+                Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "stewardship.key"
+            ),
+            "a repo segment longer than a key segment is refused"
+        );
+    }
+
+    /// A hand-off is recorded in both minds, so both instances are in the key:
+    /// the sender owns the first segment and the receiver the local. Changing
+    /// either one moves the document.
+    #[test]
+    fn hand_off_names_both_instances() {
+        let key = |hand_off: PipelineHandOff| pipeline_key(&PipelineDocument::HandOff(hand_off));
+        let base = key(hand_off_sample()).expect("the sample keys");
+        assert_eq!(base, format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.2026-09-15"));
+
+        let mut other_sender = hand_off_sample();
+        other_sender.from_instance = slug("thought-cage");
+        assert_ne!(key(other_sender), Ok(base.clone()), "the sender is in the key");
+
+        let mut other_receiver = hand_off_sample();
+        other_receiver.to_instance = slug("mimir");
+        assert_ne!(key(other_receiver), Ok(base.clone()), "the receiver is in the key");
+
+        // Two hand-offs of the same repo between the same pair on different
+        // days are different documents.
+        let mut later = hand_off_sample();
+        later.handed_on = Date("2026-09-16".into());
+        assert_ne!(key(later), Ok(base), "the date is in the key");
+
+        // A dotted receiver is a `Slug` entering a local, so it is escaped to
+        // one label rather than widening the local by a part.
+        let mut dotted_receiver = hand_off_sample();
+        dotted_receiver.to_instance = slug("thought-cage.GameCult");
+        assert_eq!(
+            key(dotted_receiver),
+            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.gamecult_-epiphany.2026-09-15"))
+        );
+
+        // The escape's `_` half is not only for repos: a receiver `a_db` and a
+        // receiver `a.b` would both key to `a_db` if the slug's own `_` passed
+        // through raw, so the slug is escaped as `a__db` and the two differ.
+        let mut underscored_receiver = hand_off_sample();
+        underscored_receiver.to_instance = slug("a_db");
+        let mut dotted_twin = hand_off_sample();
+        dotted_twin.to_instance = slug("a.b");
+        let underscored_receiver = key(underscored_receiver).expect("an underscored receiver keys");
+        assert!(underscored_receiver.contains("a__db"), "{underscored_receiver}: the slug's underscore is escaped");
+        assert_ne!(key(dotted_twin), Ok(underscored_receiver), "`a_db` and `a.b` are two receivers");
+
+        // Both instance slugs are validated as key segments, not merely bounded.
+        let mut bad_receiver = hand_off_sample();
+        bad_receiver.to_instance = Slug("thought cage".into());
+        assert_eq!(
+            key(bad_receiver),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "hand_off.to_instance".into(),
+                value: "thought cage".into(),
+            })
+        );
+        let mut bad_date = hand_off_sample();
+        bad_date.handed_on = Date("2026-9-15".into());
+        assert!(
+            matches!(key(bad_date), Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "hand_off.handed_on"),
+            "a malformed date does not compose a key"
+        );
+    }
+
+    /// A resolution whose subject is the given document, keyed.
+    fn resolution_of(kind: PipelineKind, id: &str) -> Result<String, PipelineRefusal> {
+        let mut resolution = resolution_sample();
+        resolution.subject = PipelineRef { kind, id: Short(id.into()) };
+        pipeline_key(&PipelineDocument::Resolution(resolution))
+    }
+
+    /// R1, the grammar's own test: every key is `<root>:<kind>:<local>`, three
+    /// segments with no kind excused, the root a `Slug`, the kind the literal
+    /// name, and every local part a `Label`. A root that would add a segment is
+    /// refused where the key is composed: `pipeline_key` is `pub` and does not
+    /// validate the document first, so this is reachable without one.
+    #[test]
+    fn every_key_has_exactly_three_segments() {
+        let nested = resolution_of(PipelineKind::Resolution, &format!("{CAMPAIGN}:resolution:question.Q1.n1"))
+            .expect("a resolution of a resolution keys");
+        let keys = samples()
+            .into_iter()
+            .map(|(document, _)| (document.kind(), pipeline_key(&document).expect("every sample keys")))
+            .chain([(PipelineKind::Resolution, nested)]);
+        for (kind, key) in keys {
+            let segments = key.split(':').collect::<Vec<_>>();
+            assert_eq!(segments.len(), 3, "{kind:?} key {key} has three segments");
+            assert_eq!(dotted_text("root", segments[0]), Ok(()), "{key}: the root is a slug");
+            assert_eq!(segments[1], kind.name(), "{key}: the kind segment is the literal kind");
+            assert!(PipelineKind::ALL.iter().any(|known| known.name() == segments[1]));
+            for part in segments[2].split('.') {
+                assert_eq!(label_text("local", part), Ok(()), "{key}: local part {part:?} is a label");
+            }
+        }
+
+        // A root that would add a segment, one that would empty a part, and one
+        // wider than a segment are all refused before a key is formatted. The
+        // refusal names the part that failed, so an empty part reports `""`.
+        let trailing_dot = format!("{CAMPAIGN}.");
+        let leading_dot = format!(".{CAMPAIGN}");
+        let over = "a".repeat(65);
+        for root in ["a:b", trailing_dot.as_str(), leading_dot.as_str(), "a..b", over.as_str()] {
+            let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
+            target.campaign = Slug(root.into());
+            let key = pipeline_key(&PipelineDocument::Target(target));
+            assert!(
+                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "target.campaign"),
+                "root {root:?} does not compose a key, got {key:?}"
+            );
+        }
+    }
+
+    /// Defect 1: the two roots are in distinct namespaces because the kind
+    /// segment distinguishes them, the same mechanism that separates every
+    /// other pair of kinds. Both key; only the pair sees a shared namespace.
+    #[test]
+    fn roots_of_different_kinds_do_not_share_a_key() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.slug = slug(INSTANCE);
+        let campaign = pipeline_key(&PipelineDocument::Campaign(campaign));
+        let instance = pipeline_key(&PipelineDocument::Instance(instance_sample()));
+        assert_eq!(campaign, Ok(format!("{INSTANCE}:campaign:self")));
+        assert_eq!(instance, Ok(format!("{INSTANCE}:instance:self")));
+        assert_ne!(campaign, instance, "a campaign and an instance of one slug are two documents");
+    }
+
+    /// The root is a `Slug`, so a dotted root keys and reads back whole on
+    /// both sides: the writer's root check and the reader's root check are
+    /// each `dotted_text`, not `label_text`. A campaign `game.cult` and an
+    /// instance `ygg.drasil` key, a document under the dotted campaign keys,
+    /// and each reads back through `pipeline_id` recovering the root exactly.
+    #[test]
+    fn dotted_roots_key_and_read_back() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.slug = slug("game.cult");
+        let campaign_key = pipeline_key(&PipelineDocument::Campaign(campaign)).expect("a dotted campaign keys");
+        assert_eq!(campaign_key, "game.cult:campaign:self");
+        assert_eq!(
+            pipeline_id("read_back", &campaign_key, PipelineKind::Campaign),
+            Ok(("game.cult", ROOT_LOCAL)),
+            "the dotted campaign root reads back whole"
+        );
+
+        let mut instance = instance_sample();
+        instance.instance = slug("ygg.drasil");
+        let instance_key = pipeline_key(&PipelineDocument::Instance(instance)).expect("a dotted instance keys");
+        assert_eq!(instance_key, "ygg.drasil:instance:self");
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
+            Ok(("ygg.drasil", ROOT_LOCAL)),
+            "the dotted instance root reads back whole"
+        );
+
+        let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
+        target.campaign = slug("game.cult");
+        let target_key = pipeline_key(&PipelineDocument::Target(target)).expect("a target under a dotted campaign keys");
+        assert_eq!(target_key, "game.cult:target:r2");
+        assert_eq!(
+            pipeline_id("read_back", &target_key, PipelineKind::Target),
+            Ok(("game.cult", "r2")),
+            "the dotted root and the local both read back"
+        );
+
+        let resolution = resolution_of(PipelineKind::Campaign, &campaign_key).expect("a resolution of a dotted campaign keys");
+        assert_eq!(resolution, "game.cult:resolution:campaign.self.n1");
+        assert_eq!(
+            pipeline_id("read_back", &resolution, PipelineKind::Resolution),
+            Ok(("game.cult", "campaign.self.n1")),
+            "a resolution under a dotted root reads back"
+        );
+    }
+
+    /// Cut 6c: a resolution's referent is a full id of the kind it declares,
+    /// validated through `PipelineRef` like every other referent, so a
+    /// well-formed id of the wrong kind is refused and the refusal names the
+    /// entry. The positive case is Ghostlight's own: a ruling partly
+    /// overturned by two later records, one of them a resolution named by the
+    /// key it has, which only the 6b grammar made nameable. An id no
+    /// resolution derives, `eureka-state:resolution:R8`, still validates:
+    /// whether a document with an id exists is admission's rule.
+    #[test]
+    fn resolution_outcome_referents_are_parsed_ids_of_their_kind() {
+        let resolved = |subject: PipelineRef, outcome: ResolutionOutcome| {
+            let mut resolution = resolution_sample();
+            resolution.subject = subject;
+            resolution.outcome = outcome;
+            PipelineDocument::Resolution(resolution).validate()
+        };
+        let refused = |field: &str, result: Result<(), PipelineRefusal>| {
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field: at, .. }) if at == field),
+                "expected InvalidFormat at {field}, got {result:?}"
+            );
+        };
+        let ruling = |label: &str| PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", label) };
+        let question = |label: &str| PipelineRef { kind: PipelineKind::Question, id: id("question", label) };
+        let inner = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
+        let resolution = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
+
+        let superseded = |second: PipelineRef| ResolutionOutcome::Superseded { by: vec![ruling("R9"), second] };
+        assert_eq!(resolved(ruling("R8"), superseded(resolution)), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Ruling, id: Short(inner) };
+        refused("resolution.outcome.by[1].id", resolved(ruling("R8"), superseded(forged)));
+        let underived = PipelineRef { kind: PipelineKind::Resolution, id: Short(format!("{CAMPAIGN}:resolution:R8")) };
+        assert_eq!(resolved(ruling("R8"), superseded(underived)), Ok(()), "well-formed grammar is not the shape's to refuse");
+
+        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Answered { by: ruling("R8") }), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Question, id: id("ruling", "R8") };
+        refused("resolution.outcome.by.id", resolved(question("Q1"), ResolutionOutcome::Answered { by: forged }));
+
+        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Deferred { to: question("Q2") }), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q2") };
+        refused("resolution.outcome.to.id", resolved(question("Q1"), ResolutionOutcome::Deferred { to: forged }));
+
+        let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+        let fixed = |by: Option<PipelineRef>| ResolutionOutcome::Fixed { commit: sha(), by };
+        assert_eq!(resolved(finding.clone(), fixed(None)), Ok(()));
+        assert_eq!(resolved(finding.clone(), fixed(Some(ruling("R8")))), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Finding, id: id("ruling", "R8") };
+        refused("resolution.outcome.by.id", resolved(finding, fixed(Some(forged))));
+
+        // Soul F2: the validator's bound on a supersession is its own, not
+        // only the schema's. Eight referents are the most a subject names;
+        // nine are refused as a count before any item is read.
+        let rulings = |count: usize| (1..=count).map(|n| ruling(&format!("R{n}"))).collect::<Vec<_>>();
+        assert_eq!(resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(8) }), Ok(()));
+        assert_eq!(
+            resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(9) }),
+            Err(PipelineRefusal::FieldBound { field: "resolution.outcome.by".into(), limit: 8, actual: 9 })
+        );
+
+        // Soul F3: the two reason-carrying outcomes are bounded like every
+        // `Line`; the shared arm is pinned on both so neither can drop out.
+        let wide = Line("a".repeat(1001));
+        for outcome in [
+            ResolutionOutcome::Recorded { reason: wide.clone() },
+            ResolutionOutcome::Withdrawn { reason: wide },
+        ] {
+            let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+            assert_eq!(
+                resolved(finding, outcome),
+                Err(PipelineRefusal::FieldBound { field: "resolution.outcome.reason".into(), limit: 1000, actual: 1001 })
+            );
+        }
+    }
+
+    /// Ruling B: a fix names the tree where the finding stopped being true,
+    /// as a `Sha`. Uppercase hex of a legal length is the forgery a length
+    /// check passes and `hex` refuses.
+    #[test]
+    fn fixed_resolution_requires_a_commit_sha() {
+        let fixed = |commit: &str, by: Option<PipelineRef>| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+            resolution.outcome = ResolutionOutcome::Fixed { commit: Sha(commit.into()), by };
+            PipelineDocument::Resolution(resolution).validate()
+        };
+        assert_eq!(fixed("5f98228d9c", None), Ok(()));
+        for forged in ["5F98228D9C", "5f9822", "dirty-worktree", ""] {
+            assert_eq!(
+                fixed(forged, None),
+                Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: forged.into() }),
+                "{forged:?} is not a commit"
+            );
+        }
+        // Soul F1: naming the record that fixed it does not excuse the commit.
+        let ruling = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
+        assert_eq!(
+            fixed("dirty-worktree", Some(ruling)),
+            Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: "dirty-worktree".into() }),
+            "a fix with a named record still names a commit"
+        );
+    }
+
+    /// A mutation record has a key-safe identity a verdict claim can name,
+    /// and is pinned to a tree: its label is a `Label` and its commit a
+    /// `Sha`, so a dotted label and free text where a sha belongs are refused.
+    #[test]
+    fn mutation_records_carry_a_dot_free_label_and_a_commit() {
+        let recorded = |label: &str, commit: &str| {
+            let mut report = report_sample();
+            // Through `From<&str>`, which every text type has, so the
+            // widened types under M19 and M20 still compile and the
+            // forgeries reach validation.
+            report.mutations[0].label = label.into();
+            report.mutations[0].commit = commit.into();
+            PipelineDocument::CutReport(report).validate()
+        };
+        assert_eq!(recorded("M1", "5f98228d"), Ok(()));
+        assert_eq!(
+            recorded("M1.a", "5f98228d"),
+            Err(PipelineRefusal::InvalidFormat { field: "cut_report.mutations[0].label".into(), value: "M1.a".into() })
+        );
+        assert_eq!(
+            recorded("M1", "dirty-worktree"),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "cut_report.mutations[0].commit".into(),
+                value: "dirty-worktree".into(),
+            })
+        );
+    }
+
+    /// Ruling A's shape half: a claim names the promise it measured and the
+    /// mutations it ran, both as `Label`s, and names at most eight mutations.
+    #[test]
+    fn a_verdict_claim_names_the_promise_and_the_mutation_it_measured() {
+        let sample = verdict_sample();
+        assert_eq!(sample.claims[0].promise, Some(l("P1")));
+        assert_eq!(sample.claims[0].mutations, vec![l("M1")]);
+        assert_eq!(PipelineDocument::Verdict(sample).validate(), Ok(()));
+
+        let claimed = |promise: Option<Label>, mutations: Vec<Label>| {
+            let mut verdict = verdict_sample();
+            verdict.claims[0].promise = promise;
+            verdict.claims[0].mutations = mutations;
+            PipelineDocument::Verdict(verdict).validate()
+        };
+        assert_eq!(claimed(None, vec![]), Ok(()), "a claim need not measure a promise");
+        assert_eq!(
+            claimed(Some(l("P1.a")), vec![]),
+            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].promise".into(), value: "P1.a".into() })
+        );
+        assert_eq!(
+            claimed(None, vec![l("M1.a")]),
+            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].mutations[0]".into(), value: "M1.a".into() })
+        );
+        let labels = |count: usize| (1..=count).map(|n| l(&format!("M{n}"))).collect::<Vec<_>>();
+        assert_eq!(claimed(None, labels(8)), Ok(()));
+        assert_eq!(
+            claimed(None, labels(9)),
+            Err(PipelineRefusal::FieldBound { field: "verdict.claims[0].mutations".into(), limit: 8, actual: 9 })
+        );
+    }
+
+    /// A tripwire on the one hazard of retyping the estimate: the delta's two
+    /// `u32` fields are not interchangeable. The sample spec is Cut 3a's, a
+    /// net addition of 900 lines, and the order is asserted.
+    #[test]
+    fn the_sample_cut_spec_estimates_a_net_addition() {
+        let PipelineDocument::CutSpec(spec) = samples().remove(4).0 else { unreachable!() };
+        assert_eq!(spec.estimate.lines_added, 900);
+        assert_eq!(spec.estimate.lines_removed, 0);
+        assert_eq!(spec.estimate, report_sample().structural_delta, "the estimate and the actual are one shape");
+    }
+
+    /// Defect 2: a resolution's key carries its subject's kind as a literal
+    /// part of the local, so nothing infers it and two subjects of one local
+    /// and different kinds resolve to two keys. Each reads back through the
+    /// reader with the subject kind it was built from.
+    #[test]
+    fn a_resolution_names_its_subjects_kind() {
+        let pairs = [
+            (PipelineKind::Question, id("question", "Q1").0, PipelineKind::Ruling, id("ruling", "Q1").0),
+            (
+                PipelineKind::Campaign,
+                format!("{CAMPAIGN}:campaign:self"),
+                PipelineKind::Instance,
+                format!("{CAMPAIGN}:instance:self"),
+            ),
+        ];
+        for (left_kind, left_id, right_kind, right_id) in pairs {
+            let left = resolution_of(left_kind, &left_id).expect("the left subject keys");
+            let right = resolution_of(right_kind, &right_id).expect("the right subject keys");
+            assert_ne!(left, right, "resolutions of {left_id} and {right_id} are two documents");
+            for (kind, key) in [(left_kind, &left), (right_kind, &right)] {
+                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+                assert_eq!(root, CAMPAIGN);
+                assert_eq!(local.split('.').next(), Some(kind.name()), "{key} names its subject's kind");
+            }
+        }
+    }
+
+    /// Defect 3: a resolution's own key is an ordinary id, so it composes as a
+    /// subject like any other, and the key reads back to the inner key -- the
+    /// whole inner key, sequence included, since the subject is recovered by
+    /// stripping this resolution's own sequence from the end and the kind from
+    /// the front. The depth bound is tested per kind by
+    /// `every_resolvable_kind_resolves_two_deep`.
+    #[test]
+    fn a_resolution_of_a_resolution_reads_back() {
+        let inner = resolution_of(PipelineKind::Question, &id("question", "Q1").0).expect("the inner keys");
+        let mut outer = resolution_sample();
+        outer.subject = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
+        let outer = PipelineDocument::Resolution(outer);
+        assert_eq!(outer.validate(), Ok(()));
+        let key = pipeline_key(&outer).expect("a resolution of a resolution keys");
+        assert_eq!(key, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"));
+        let (root, local) = pipeline_id("read_back", &key, PipelineKind::Resolution).expect("reads back");
+        let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+        let (subject_local, _sequence) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+        assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), inner, "the recovered subject is the inner key");
+    }
+
+    /// Each level of a nesting carries its own sequence, and only its own: the
+    /// part appended is this resolution's `sequence` field, never a copy of the
+    /// sequence the subject already ends in. The fixtures elsewhere all sit at
+    /// `1` at every level, where the two are indistinguishable, so the chain
+    /// here differs at every level and reads back level by level.
+    ///
+    /// On spelling, so silence is not read as coverage: the leaf emits `n<N>`
+    /// with `N` as `u32::to_string` writes it, so `n0` and `n12` are emitted
+    /// and `n01` is not. A hand-built id ending `n01`, `n1x`, or no `n<N>` at
+    /// all is still a well-formed reference -- those are legal labels, and a
+    /// grammar that reads keys may not refuse them on spelling. Nothing in the
+    /// leaf canonicalises them either: such an id simply names a document the
+    /// leaf would never key, which admission's A7 sees as a missing referent.
+    #[test]
+    fn every_level_of_a_nesting_keeps_its_own_sequence() {
+        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
+        };
+        let first = resolved(PipelineKind::Question, &id("question", "Q1").0, 9);
+        let second = resolved(PipelineKind::Resolution, &first, 10);
+        let third = resolved(PipelineKind::Resolution, &second, 0);
+        let fourth = resolved(PipelineKind::Resolution, &third, 12);
+        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n9"));
+        assert_eq!(second, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n9.n10"));
+        assert_eq!(third, format!("{CAMPAIGN}:resolution:resolution.resolution.question.Q1.n9.n10.n0"));
+        assert_eq!(
+            fourth,
+            format!("{CAMPAIGN}:resolution:resolution.resolution.resolution.question.Q1.n9.n10.n0.n12")
+        );
+        for (outer, inner, sequence) in [(&fourth, &third, 12), (&third, &second, 0), (&second, &first, 10)] {
+            let (root, local) = pipeline_id("read_back", outer, PipelineKind::Resolution).expect("reads back");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+            assert_eq!(subject_kind, "resolution", "{outer}: the subject of a nesting is a resolution");
+            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), *inner, "{outer}: the subject is the inner key");
+            assert_eq!(last, format!("n{sequence}"), "{outer}: this level's own sequence, not the subject's");
+        }
+    }
+
+    /// A stewardship is the other sequenced kind, and it composes as a subject
+    /// like any other: the subject's whole local, escaped repo and sequence
+    /// both, is the resolution's local, with the resolution's own sequence
+    /// last. So the two assignments of one repo have two resolutions, and a
+    /// resolution of either is itself resolvable.
+    #[test]
+    fn a_resolution_of_a_stewardship_reads_back() {
+        let stewarded = |sequence: u32| {
+            let mut stewardship = stewardship_sample();
+            stewardship.sequence = sequence;
+            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
+        };
+        let first = stewarded(1);
+        let second = stewarded(2);
+        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
+        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
+
+        let resolved = resolution_of(PipelineKind::Stewardship, &first).expect("a resolution of a stewardship keys");
+        let resolved_second = resolution_of(PipelineKind::Stewardship, &second).expect("the second assignment resolves");
+        assert_eq!(resolved, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n1.n1"));
+        assert_eq!(resolved_second, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n2.n1"));
+        assert_ne!(resolved, resolved_second, "each assignment keeps its own resolution");
+
+        for (key, subject) in [(&resolved, &first), (&resolved_second, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+            assert_eq!(root, INSTANCE, "{key}: a stewardship's resolution lives in the mind's root");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+            assert_eq!(subject_kind, PipelineKind::Stewardship.name(), "{key} names its subject's kind");
+            assert_eq!(
+                format!("{root}:{subject_kind}:{subject_local}"),
+                *subject,
+                "{key}: the subject's own sequence is part of the recovered key"
+            );
+            assert_eq!(last, "n1", "{key}: this resolution's own sequence");
+
+            // A withdrawal of that resolution nests one out, as it does under
+            // any other subject, and reads back to the resolution it withdraws.
+            let withdrawal = resolution_of(PipelineKind::Resolution, key).expect("a withdrawal keys");
+            let subject_local = key.split(':').nth(2).expect("three segments");
+            assert_eq!(withdrawal, format!("{INSTANCE}:resolution:resolution.{subject_local}.n1"));
+            let (root, local) = pipeline_id("read_back", &withdrawal, PipelineKind::Resolution).expect("reads back");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, _) = rest.rsplit_once('.').expect("the local ends in its own sequence");
+            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), **key, "{withdrawal}: the withdrawn resolution");
+        }
+    }
+
+    /// A legal dotted local of exactly `length` bytes (`a.a.a`, each part a
+    /// label), for bounds wider than one label.
+    fn dotted_local(length: usize) -> String {
+        match length % 2 {
+            1 => format!("{}a", "a.".repeat(length / 2)),
+            _ => format!("{}aa", "a.".repeat(length / 2 - 1)),
+        }
+    }
+
+    /// A resolution of `subject`, at `sequence`, keyed.
+    fn resolved_at(kind: PipelineKind, subject: &str, sequence: u32) -> Result<String, PipelineRefusal> {
+        let mut resolution = resolution_sample();
+        resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+        resolution.sequence = sequence;
+        pipeline_key(&PipelineDocument::Resolution(resolution))
+    }
+
+    /// every-subject-resolvable: for each kind that can be a subject, at the
+    /// widest subject local (64) and `u32::MAX` sequences, depth one and depth
+    /// two key and read back through `pipeline_id`; depth three is refused on
+    /// the local bound.
+    #[test]
+    fn every_resolvable_kind_resolves_two_deep() {
+        let wide = "a".repeat(SUBJECT_LOCAL_MAX);
+        let mut widest = 0;
+        for kind in PipelineKind::ALL.iter().copied().filter(|kind| *kind != PipelineKind::Resolution) {
+            let subject = format!("{CAMPAIGN}:{}:{wide}", kind.name());
+            assert_eq!(pipeline_id("subject", &subject, kind), Ok((CAMPAIGN, wide.as_str())), "{kind:?}: the subject parses");
+            let one = resolved_at(kind, &subject, u32::MAX).unwrap_or_else(|error| panic!("{kind:?} depth one: {error}"));
+            let two = resolved_at(PipelineKind::Resolution, &one, u32::MAX)
+                .unwrap_or_else(|error| panic!("{kind:?} depth two: {error}"));
+            for key in [&one, &two] {
+                assert!(key.len() <= 200, "{key}: an id fits a Short");
+                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution)
+                    .unwrap_or_else(|error| panic!("{kind:?}: {key} does not read back: {error}"));
+                assert_eq!(root, CAMPAIGN);
+                assert!(local.len() <= RESOLUTION_LOCAL_MAX);
+            }
+            widest = widest.max(two.len() - format!("{CAMPAIGN}:resolution:").len());
+            assert!(
+                matches!(
+                    resolved_at(PipelineKind::Resolution, &two, u32::MAX),
+                    Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "resolution.key"
+                ),
+                "{kind:?}: depth three is refused on the local bound"
+            );
+        }
+        assert_eq!(widest, RESOLUTION_LOCAL_MAX, "the bound is exactly the widest depth-two chain");
+        assert_eq!(RESOLUTION_LOCAL_MAX, 111);
+    }
+
+    #[test]
+    fn the_longest_kind_name_is_the_longest() {
+        let longest = PipelineKind::ALL.iter().map(|kind| kind.name().len()).max();
+        assert_eq!(longest, Some(LONGEST_KIND_NAME));
+    }
+
+    /// The parser bounds an id's local by kind, exactly where the composer does.
+    #[test]
+    fn an_id_local_is_bounded_by_its_kind() {
+        let at = |kind: PipelineKind, length: usize| {
+            pipeline_id("probe", &format!("{CAMPAIGN}:{}:{}", kind.name(), dotted_local(length)), kind).map(|_| ())
+        };
+        assert_eq!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX), Ok(()));
+        assert!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX + 1).is_err());
+        assert_eq!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX), Ok(()));
+        assert!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX + 1).is_err());
+    }
+
+    #[test]
+    fn sha_names_same_commit() {
+        let full = Sha("5f98228d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a69".into());
+        assert!(full.names_same_commit(&Sha("5f98228".into())));
+        assert!(Sha("5f98228".into()).names_same_commit(&full));
+        assert!(full.names_same_commit(&full));
+        assert!(!full.names_same_commit(&Sha("5f98229".into())));
+        assert!(!Sha("5f98228".into()).names_same_commit(&Sha("5f98229".into())));
+        assert!(!Sha("5f98228a".into()).names_same_commit(&Sha("5f98228b".into())), "equal length, differing");
+    }
+
+    /// stored-documents-valid, on the real mind. `HUGINN_MIND_SNAPSHOT` is a
+    /// writable copy of a state root holding `minds/eureka/mind.redb` (the
+    /// store opens read-write). Read through cultcache-rs's own store.
+    #[test]
+    #[ignore = "needs HUGINN_MIND_SNAPSHOT, a writable copy of a Huginn state root"]
+    fn stored_documents_read_back() {
+        use cultcache_rs::{CacheBackingStore, OwnedRedbMessagePackBackingStore};
+        let root = std::env::var("HUGINN_MIND_SNAPSHOT").expect("HUGINN_MIND_SNAPSHOT names the snapshot state root");
+        let store = OwnedRedbMessagePackBackingStore::new(Path::new(&root).join("minds").join("eureka").join("mind.redb"))
+            .expect("the snapshot opens");
+        let envelopes = store.pull_all().expect("the snapshot reads");
+        let mut stored = Vec::new();
+        for envelope in &envelopes {
+            match PipelineDocument::decode(envelope) {
+                Ok(document) => {
+                    assert_eq!(document.validate(), Ok(()), "{}: valid", envelope.key);
+                    assert_eq!(pipeline_key(&document).as_deref(), Ok(envelope.key.as_str()), "{}: key derives byte for byte", envelope.key);
+                    stored.push((document.kind(), envelope.key.clone()));
+                }
+                Err(PipelineRefusal::ForeignStore { .. }) => {}
+                Err(error) => panic!("{}: does not decode: {error}", envelope.key),
+            }
+        }
+        assert!(stored.len() > 200, "{} pipeline documents read", stored.len());
+        let mut subjects = 0;
+        let resolvable = |kind: &PipelineKind| !matches!(kind, PipelineKind::Resolution | PipelineKind::Campaign | PipelineKind::Instance);
+        for (kind, key) in stored.iter().filter(|(kind, _)| resolvable(kind)) {
+            let one = resolved_at(*kind, key, 1).unwrap_or_else(|error| panic!("{key}: no resolution keys: {error}"));
+            let two = resolved_at(PipelineKind::Resolution, &one, 1).unwrap_or_else(|error| panic!("{key}: no withdrawal keys: {error}"));
+            for derived in [&one, &two] {
+                pipeline_id("read_back", derived, PipelineKind::Resolution).unwrap_or_else(|error| panic!("{derived}: does not parse: {error}"));
+            }
+            subjects += 1;
+        }
+        for (_, key) in stored.iter().filter(|(kind, _)| *kind == PipelineKind::Resolution) {
+            resolved_at(PipelineKind::Resolution, key, 1).unwrap_or_else(|error| panic!("{key}: cannot be withdrawn: {error}"));
+        }
+        // The six findings that could not be resolved before this cut.
+        let stuck = [
+            "cut-bifrost-retire-alarm.s2.verb-default-accepts-malformed",
+            "cut-ops-notice-deploy.s2.pinned-bifrost-predates-retry",
+            "cut-bifrost-notice-retry.s1.unknown-test-ignores-backoff",
+            "cut-bifrost-notice-retry.s2.closed-unknown-retry-unpinned",
+            "cut-bifrost-notice-retry.s2.flapping-clock-retries-every-tick",
+            "cut-idunn-topology-lock.s2.boot-reconcile-skipped-on-contention",
+        ];
+        for label in stuck {
+            let found = stored
+                .iter()
+                .find(|(kind, key)| *kind == PipelineKind::Finding && key.ends_with(label))
+                .unwrap_or_else(|| panic!("{label}: not in the snapshot"));
+            let one = resolved_at(PipelineKind::Finding, &found.1, 1).unwrap_or_else(|error| panic!("{label}: still stuck: {error}"));
+            assert!(one.split(':').nth(2).is_some_and(|local| local.len() > SUBJECT_LOCAL_MAX), "{label}: the old bound refused it");
+        }
+        eprintln!("read back {} pipeline documents, {subjects} subjects", stored.len());
+    }
+
+    /// The total bound, in the one place it lives: parts that are each a legal
+    /// label compose a local wider than 64 bytes and are refused as a whole.
+    #[test]
+    fn a_composed_local_is_bounded_whole() {
+        let mut wide = hand_off_sample();
+        wide.to_instance = Slug("a".repeat(60));
+        assert_eq!(wide.to_instance.validate("hand_off.to_instance"), Ok(()), "the receiver alone is legal");
+        assert_eq!(
+            label_text("part", &key_segment(&wide.repo.0)),
+            Ok(()),
+            "the repo alone is legal"
+        );
+        let key = pipeline_key(&PipelineDocument::HandOff(wide));
+        assert!(
+            matches!(&key, Err(PipelineRefusal::InvalidFormat { field, value }) if field == "hand_off.key" && value.len() > 64),
+            "a local of legal parts is still bounded whole, got {key:?}"
+        );
+
+        // The bound is 64 exactly, on both sides, whether the part that fills
+        // it is a plain label or an escaped repo. A hand-off local is
+        // `<receiver>.<repo>.<date>`, the repo `gamecult_-epiphany` and the
+        // date ten bytes, so the receiver fills the rest; a stewardship local is
+        // `<repo escaped>.n<N>`, so `GameCult_-` and `.n1` bound the name.
+        let hand_off_rest = "gamecult_-epiphany".len() + ".".len() + date().0.len() + ".".len();
+        let stewardship_rest = "GameCult_-".len() + ".n1".len();
+        let received = |receiver: usize| {
+            let mut hand_off = hand_off_sample();
+            hand_off.to_instance = Slug("a".repeat(receiver));
+            pipeline_key(&PipelineDocument::HandOff(hand_off))
+        };
+        let stewarded = |name: usize| {
+            let mut stewardship = stewardship_sample();
+            stewardship.repo = OrgRepo(format!("GameCult/{}", "a".repeat(name)));
+            pipeline_key(&PipelineDocument::Stewardship(stewardship))
+        };
+        for (label, at_64, at_65) in [
+            ("plain label", received(64 - hand_off_rest), received(65 - hand_off_rest)),
+            ("escaped repo", stewarded(64 - stewardship_rest), stewarded(65 - stewardship_rest)),
+        ] {
+            let keyed = at_64.unwrap_or_else(|error| panic!("{label}: a 64-byte local keys: {error}"));
+            assert_eq!(keyed.split(':').nth(2).map(str::len), Some(64), "{label}: {keyed} fills the local exactly");
+            assert!(
+                matches!(&at_65, Err(PipelineRefusal::InvalidFormat { value, .. }) if value.len() == 65),
+                "{label}: a 65-byte local is refused, got {at_65:?}"
+            );
+        }
+    }
+
+    /// The resolution side of the bound: 111 keys and 112 is refused on
+    /// `resolution.key`, filled by a resolution subject (`resolution.<L>.n1`).
+    #[test]
+    fn a_composed_resolution_local_is_bounded_whole() {
+        let overhead = "resolution.".len() + ".n1".len();
+        let subject = |length: usize| format!("{CAMPAIGN}:resolution:{}", dotted_local(length));
+        let at_max = resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead), 1)
+            .expect("a 111-byte resolution local keys");
+        assert_eq!(at_max.split(':').nth(2).map(str::len), Some(RESOLUTION_LOCAL_MAX));
+        assert!(matches!(
+            resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead + 1), 1),
+            Err(PipelineRefusal::InvalidFormat { field, value }) if field == "resolution.key" && value.len() == RESOLUTION_LOCAL_MAX + 1
+        ));
+    }
+
+    /// R2, on the composer every kind goes through: no local part carries the
+    /// separator, the head included. The live case is a hand-off with a dotted
+    /// receiver, which keys to an escaped label rather than a wider local.
+    #[test]
+    fn no_local_part_carries_the_separator() {
+        assert_eq!(
+            local("probe", PipelineKind::Question, &["a.b"]),
+            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "a.b".into() }),
+            "the head may not carry the separator"
+        );
+        assert_eq!(
+            local("probe", PipelineKind::Question, &["a", "b.c"]),
+            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "b.c".into() }),
+            "a tail part may not carry the separator"
+        );
+        assert_eq!(local("probe", PipelineKind::Question, &["a", "b", "c"]), Ok("a.b.c".into()));
+
+        let mut dotted = hand_off_sample();
+        dotted.to_instance = slug("thought-cage.GameCult");
+        let key = pipeline_key(&PipelineDocument::HandOff(dotted)).expect("a dotted receiver keys");
+        let local = key.split(':').nth(2).expect("three segments");
+        assert_eq!(local.split('.').count(), 3, "{key}: the receiver is one part, not two");
+        assert_eq!(local.split('.').next(), Some("thought-cage_dGameCult"));
+    }
+
+    /// Q17 B: a subject's resolutions are distinct records, ordered by a
+    /// per-subject sequence the key carries as its last part, so a withdrawn
+    /// resolution stays under its subject and the next closure is nameable.
+    /// The sequence is a field the writer sets and this crate only composes:
+    /// it bounds nothing beyond `u32` and the local's own width, so `0` and a
+    /// gap both key. Which sequence a document may claim, and whether an
+    /// earlier resolution still stands, are admission's rules, exactly as
+    /// `revision: 0` is.
+    #[test]
+    fn a_subject_keeps_every_resolution_it_had() {
+        let resolved = |sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
+        };
+        let first = resolved(1);
+        let second = resolved(2);
+        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
+        assert_eq!(second, format!("{CAMPAIGN}:resolution:question.Q1.n2"));
+        assert_ne!(first, second, "two resolutions of one subject are two documents");
+        for (sequence, key) in [(1, &first), (2, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+            assert_eq!(root, CAMPAIGN, "{key}: the subject's root");
+            let last = format!("n{sequence}");
+            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
+            assert_eq!(local.split('.').count(), 3, "{key}: subject kind, subject local, sequence");
+        }
+
+        // Outcome-invariance now holds per sequence: one record under two
+        // outcomes is still one key, which is exactly why a second closure of
+        // a subject needs a second sequence and not a second outcome.
+        let mut withdrawn = resolution_sample();
+        withdrawn.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(withdrawn)),
+            Ok(first.clone()),
+            "one sequence is one key whatever the outcome"
+        );
+
+        // Stated limits. Both are admission's to refuse and neither is the
+        // leaf's, so both compose here.
+        assert_eq!(resolved(0), format!("{CAMPAIGN}:resolution:question.Q1.n0"), "the leaf refuses no sequence value");
+        let mut widest = resolution_sample();
+        widest.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "A") };
+        widest.sequence = u32::MAX;
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(widest)),
+            Ok(format!("{CAMPAIGN}:resolution:ruling.A.n4294967295")),
+            "the widest sequence is an eleven-byte label, not a refusal"
+        );
+    }
+
+    /// D2: the sequence is the *last* part, so a subject's resolutions and
+    /// only they share the prefix `<root>:resolution:<kind>.<local>.n`. R2 is
+    /// what makes the prefix exact: no local part carries a dot, so
+    /// `question.Q1.n` cannot match `question.Q10.n1`, and the withdrawal of
+    /// `Q1`'s first resolution is a record of that resolution, one nesting
+    /// out and outside `Q1`'s prefix. Pinned as a string property, which is
+    /// what a prefix query is.
+    #[test]
+    fn a_subjects_resolutions_share_a_prefix_no_other_key_has() {
+        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("the subject keys")
+        };
+        let history = [1, 2, 3].map(|sequence| resolved(PipelineKind::Question, &id("question", "Q1").0, sequence));
+        let others = [
+            resolved(PipelineKind::Question, &id("question", "Q10").0, 1),
+            resolved(PipelineKind::Ruling, &id("ruling", "Q1").0, 1),
+            resolved(PipelineKind::Campaign, &format!("{CAMPAIGN}:campaign:self"), 1),
+            resolved(PipelineKind::Resolution, &history[0], 1),
+        ];
+        assert_eq!(
+            others[3],
+            format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"),
+            "a withdrawal keys under the resolution it withdraws, not under the subject"
+        );
+        let prefix = format!("{CAMPAIGN}:resolution:question.Q1.n");
+        let selected = history
+            .iter()
+            .chain(others.iter())
+            .filter(|key| key.starts_with(&prefix))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            selected,
+            history.iter().collect::<Vec<_>>(),
+            "the prefix selects the subject's resolutions and nothing else"
+        );
+    }
+
+    /// Q18 A and Q20 A: a repo's stewardships on a mind are distinct records,
+    /// ordered by a per-`(instance, repo)` sequence the key carries last, so a
+    /// repo transferred away and later transferred back is two records under
+    /// one prefix rather than one document overwriting the other. The date is
+    /// not in the key: `assigned_on` is validated where every field is, by the
+    /// derived `Bounded` impl, and two assignments differing only in it are
+    /// one document.
+    #[test]
+    fn a_repo_keeps_every_stewardship_it_had() {
+        let stewarded = |repo: &str, sequence: u32, assigned_on: &str| {
+            let mut stewardship = stewardship_sample();
+            stewardship.repo = OrgRepo(repo.into());
+            stewardship.sequence = sequence;
+            stewardship.assigned_on = Date(assigned_on.into());
+            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
+        };
+        let first = stewarded("GameCult/Epiphany", 1, "2026-09-15");
+        let second = stewarded("GameCult/Epiphany", 2, "2026-09-16");
+        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
+        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
+        assert_ne!(first, second, "two assignments of one repo are two documents");
+        for (sequence, key) in [(1, &first), (2, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Stewardship).expect("reads back");
+            assert_eq!(root, INSTANCE, "{key}: the mind's root");
+            let last = format!("n{sequence}");
+            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
+            assert_eq!(local.split('.').count(), 2, "{key}: the escaped repo and the sequence, nothing else");
+        }
+
+        assert_eq!(
+            stewarded("GameCult/Epiphany", 1, "2026-09-16"),
+            first,
+            "assigned_on is a field, not a key part: one sequence is one key whatever the date"
+        );
+
+        let others = [
+            stewarded("GameCult/Epiphany_thing", 1, "2026-09-15"),
+            stewarded("GameCult/Huginn", 1, "2026-09-15"),
+        ];
+        let prefix = format!("{INSTANCE}:stewardship:gamecult_-epiphany.n");
+        let history = [first, second];
+        let selected = history
+            .iter()
+            .chain(others.iter())
+            .filter(|key| key.starts_with(&prefix))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            selected,
+            history.iter().collect::<Vec<_>>(),
+            "the prefix selects the repo's assignments on this mind and nothing else"
+        );
+
+        assert_eq!(
+            stewarded("GameCult/Epiphany", 0, "2026-09-15"),
+            format!("{INSTANCE}:stewardship:gamecult_-epiphany.n0"),
+            "the leaf refuses no sequence value"
+        );
+    }
+
+    /// Cut 8: the leaf owns the serialisation of the shapes it owns, so a wire
+    /// carrying a document or a refusal reads back the same value rather than
+    /// a mirror definition kept in step by hand in the reader's repo. Both
+    /// encodings are pinned: JSON is what a schema describes, MessagePack is
+    /// what a CultCache payload is written in, and an adjacent tag has to
+    /// survive both. The tag is asserted against `name()` rather than against
+    /// a literal, because the point of the tag is that a reader dispatching on
+    /// a key's kind segment finds the same string here.
+    #[test]
+    fn every_document_and_refusal_serialises_and_reads_back() -> Result<()> {
+        for (document, _) in samples() {
+            let json = serde_json::to_value(&document)?;
+            assert_eq!(json["kind"].as_str(), Some(document.kind().name()), "{json} is tagged with its kind name");
+            assert_eq!(serde_json::from_value::<PipelineDocument>(json.clone())?, document, "{json} reads back");
+            let packed = rmp_serde::to_vec_named(&document)?;
+            assert_eq!(
+                rmp_serde::from_slice::<PipelineDocument>(&packed)?,
+                document,
+                "{:?} reads back through MessagePack",
+                document.kind()
+            );
+        }
+
+        // Every variant, and every one of them carrying its named parts: a
+        // refusal read off a wire names the field it refused, as a local one
+        // does.
+        let refusals = [
+            PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 },
+            PipelineRefusal::InvalidFormat { field: "campaign.slug".into(), value: "a b".into() },
+            PipelineRefusal::InvalidIdentity {
+                kind: PipelineKind::Campaign,
+                key: format!("{CAMPAIGN}:campaign:forged"),
+                expected: format!("{CAMPAIGN}:campaign:self"),
+            },
+            PipelineRefusal::DuplicateRepo { field: "campaign.repos".into(), repo: "gamecult/epiphany".into() },
+            PipelineRefusal::ForeignStore { r#type: <ForeignDocument as DatabaseEntry>::TYPE.into() },
+        ];
+        for refusal in &refusals {
+            let json = serde_json::to_value(refusal)?;
+            assert_eq!(&serde_json::from_value::<PipelineRefusal>(json.clone())?, refusal, "{json} reads back");
+            let packed = rmp_serde::to_vec_named(refusal)?;
+            assert_eq!(
+                &rmp_serde::from_slice::<PipelineRefusal>(&packed)?,
+                refusal,
+                "{refusal:?} reads back through MessagePack"
+            );
+        }
+
+        // The derived schemas list the same two sets. A `const` in the tag
+        // position is what a schema reader dispatches on, so it is read as the
+        // schema writes it and compared to `name()`, not to a literal list.
+        let tag = |variant: &serde_json::Value| {
+            variant["properties"]["kind"]["const"]
+                .as_str()
+                .unwrap_or_else(|| panic!("a document variant schema carries a kind const: {variant}"))
+                .to_owned()
+        };
+        let document_schema = serde_json::to_value(schemars::schema_for!(PipelineDocument))?;
+        let variants = document_schema["oneOf"].as_array().expect("the document schema is a oneOf");
+        assert_eq!(PipelineKind::ALL.len(), 13, "thirteen kinds");
+        assert_eq!(
+            variants.iter().map(tag).collect::<Vec<_>>(),
+            PipelineKind::ALL.iter().map(|kind| kind.name().to_owned()).collect::<Vec<_>>(),
+            "the document schema lists exactly the thirteen kinds, by name"
+        );
+
+        let refusal_schema = serde_json::to_value(schemars::schema_for!(PipelineRefusal))?;
+        let refusal_variants = refusal_schema["oneOf"].as_array().expect("the refusal schema is a oneOf");
+        let named = refusal_variants
+            .iter()
+            .map(|variant| {
+                let properties = variant["properties"].as_object().expect("a refusal variant is an object");
+                assert_eq!(properties.len(), 1, "{variant} is externally tagged");
+                properties.keys().next().expect("one key").to_owned()
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(named, vec!["FieldBound", "InvalidFormat", "InvalidIdentity", "DuplicateRepo", "ForeignStore"]);
+        assert_eq!(named.len(), refusals.len(), "every refusal variant is in the schema and in the round trip");
+        Ok(())
+    }
+
+    #[test]
+    fn pipeline_published_schemas_match_derivation() -> Result<()> {
+        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
+        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
+        // A directory this run alone writes, so everything in it is what this
+        // run derived. A previous run's leftovers -- a mutation run's
+        // especially, since those deliberately derive schemas no committed type
+        // produces -- are not this derivation, and copying one of those into
+        // `schemas/cultnet` publishes a schema no Rust type produces. A shared
+        // directory cleared first would have to defend that clear against a
+        // held handle; an unshared one has nothing to defend. The cost is that
+        // nothing ever removes one. The directory is only created when
+        // something is stale, so a passing run leaves none -- but a failing run
+        // leaves its copies behind for good, one directory per failing run
+        // where the shared design left one however often it failed. That is the
+        // trade: the copies are the evidence the failure message names, and
+        // they outlive the run that wrote them. Whoever reads the failure is
+        // the one who deletes them.
+        let derived_dir = std::env::temp_dir().join(format!(
+            "eureka-pipeline-schemas-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_nanos()
+        ));
+        let mut stale = Vec::new();
+        for kind in PipelineKind::ALL {
+            let file = format!("{}.schema.json", kind.type_id());
+            let mut schema = serde_json::to_value(kind.derived_schema())?;
+            schema["$id"] = format!("https://gamecult.dev/epiphany/cultnet/{file}").into();
+            let derived = format!("{}\n", serde_json::to_string_pretty(&schema)?);
+            if std::fs::read(published.join(&file)).ok().as_deref() != Some(derived.as_bytes()) {
+                std::fs::create_dir_all(&derived_dir)?;
+                std::fs::write(derived_dir.join(&file), &derived)?;
+                stale.push(derived_dir.join(&file));
+            }
+            let entry = serde_json::json!({
+                "schemaId": format!("https://gamecult.dev/epiphany/cultnet/{file}"),
+                "kind": "document_payload",
+                "wireContracts": ["cultnet.schema.v0"],
+                "schemaVersion": kind.type_id(),
+                "documentType": kind.type_id(),
+                "title": format!("Epiphany Pipeline {kind:?} v2"),
+                "path": file,
+            });
+            assert!(
+                index["schemas"].as_array().is_some_and(|schemas| schemas.contains(&entry)),
+                "index.json lacks {entry}"
+            );
+        }
+        assert!(stale.is_empty(), "published pipeline schemas differ from the Rust derivation; derived copies: {stale:?}");
+        Ok(())
+    }
+
+    /// A refusal read as text names its variant and its parts, so an operator
+    /// who sees only the message (a log line, an `anyhow` chain) can tell which
+    /// field was refused and why.
+    #[test]
+    fn a_refusal_read_as_text_names_its_variant_and_parts() {
+        let text = PipelineRefusal::FieldBound { field: "title".into(), limit: 200, actual: 201 }.to_string();
+        assert!(text.starts_with("pipeline refusal: "), "{text}");
+        for part in ["FieldBound", "title", "200", "201"] {
+            assert!(text.contains(part), "{part} is missing from {text}");
+        }
+    }
+
+    /// The catalogue is exactly the files beside it: every entry's `path` is a
+    /// schema file in the directory, and every schema file in the directory
+    /// has an entry, so a schema removed from the catalogue (or a file left
+    /// behind by a move) fails here instead of publishing a dangling or
+    /// unlisted contract. Schemas whose owner is another crate (`huginn.*`)
+    /// are published by that crate, not listed here.
+    #[test]
+    fn the_catalogue_lists_exactly_the_schema_files_it_publishes() -> Result<()> {
+        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
+        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
+        let listed = index["schemas"]
+            .as_array()
+            .expect("index.json carries a schemas array")
+            .iter()
+            .map(|entry| entry["path"].as_str().expect("every entry names its file").to_owned())
+            .collect::<std::collections::BTreeSet<_>>();
+        for path in &listed {
+            assert!(published.join(path).is_file(), "index.json lists {path}, which is not in the directory");
+        }
+        let mut files = std::collections::BTreeSet::new();
+        for entry in std::fs::read_dir(&published)? {
+            let name = entry?.file_name().to_string_lossy().into_owned();
+            if name.ends_with(".schema.json") && !name.starts_with("huginn.") {
+                files.insert(name);
+            }
+        }
+        assert_eq!(listed, files, "the catalogue and the schema files beside it disagree");
+        Ok(())
+    }
+
+    /// The epoch is the version every kind is published at: its version
+    /// segment is read from the constant, not restated, and every type id
+    /// carries the same one, so a bumped epoch fails here until the kinds
+    /// move with it. The live registrar registers the kinds and nothing else,
+    /// so the foreign stand-in is not among them.
+    #[test]
+    fn every_kind_is_at_the_epochs_version() -> Result<()> {
+        let (name, version) = PIPELINE_SCHEMA_EPOCH.rsplit_once('.').expect("the epoch carries a version");
+        assert_eq!(name, "epiphany.pipeline.epoch");
+        assert!(
+            version.len() > 1 && version.starts_with('v') && version[1..].bytes().all(|byte| byte.is_ascii_digit()),
+            "{version:?} is not a version segment"
+        );
+        for kind in PipelineKind::ALL {
+            let type_id = kind.type_id();
+            assert!(type_id.ends_with(&format!(".{version}")), "{type_id} is not at the epoch's version {version}");
+        }
+
+        let mut cache = CultCache::new();
+        register_pipeline_document_types(&mut cache)?;
+        let registered = cache.registered_entry_types();
+        assert_eq!(registered.len(), PipelineKind::ALL.len(), "the live registrar registers exactly the kinds: {registered:?}");
+        for kind in PipelineKind::ALL {
+            assert!(registered.iter().any(|name| name == kind.type_id()), "{kind:?} is registered");
+        }
+        Ok(())
+    }
+
+    /// The public door onto the reference grammar, for the read side that
+    /// holds a `kind` and an `id` and no way to reach `Bounded`. Every sample
+    /// document's own key is a reference of its own kind; a kind that is not
+    /// the id's, and a local no writer composes, are `InvalidFormat` at `ref.id`.
+    #[test]
+    fn a_ref_validates_as_an_id_of_the_kind_it_declares() -> Result<()> {
+        for (document, expected) in samples() {
+            let kind = document.kind();
+            let key = pipeline_key(&document)?;
+            assert_eq!(key, expected);
+            assert_eq!(
+                PipelineRef { kind, id: s(&key) }.validate_ref(),
+                Ok(()),
+                "{kind:?}'s own key is not a reference of its kind"
+            );
+        }
+
+        let refused = |reference: PipelineRef, why: &str| {
+            let read = reference.validate_ref();
+            assert!(
+                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "ref.id"),
+                "{why}: {reference:?} was not refused, got {read:?}"
+            );
+        };
+
+        // The kind and the id's kind segment cannot disagree: the whole reason
+        // the door exists, since a reader that cannot ask would look this up
+        // and report the nothing it found.
+        refused(
+            PipelineRef { kind: PipelineKind::Campaign, id: id("question", "Q1") },
+            "a question id is not a campaign reference",
+        );
+        refused(
+            PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q1") },
+            "a question id is not a ruling reference",
+        );
+        // The local is `dotted_text` whole, so a trailing dot is refused by the
+        // reader and not only by the writer that never composes one.
+        refused(
+            PipelineRef { kind: PipelineKind::Question, id: s(&format!("{CAMPAIGN}:question:Q1.")) },
+            "a trailing dot is no local",
+        );
+
+        // The boundary, pinned rather than assumed: a resolution id missing the
+        // per-subject sequence its writer always composes is still a
+        // well-formed id of its kind here. The leaf's grammar is kind-deep, and
+        // the local's per-kind shape belongs to admission; refusing this would
+        // be a new rule in `pipeline_id`, not a door onto the one that exists.
+        assert_eq!(
+            PipelineRef { kind: PipelineKind::Resolution, id: s(&format!("{CAMPAIGN}:resolution:question.Q1")) }
+                .validate_ref(),
+            Ok(()),
+            "the leaf reads a resolution id kind-deep"
+        );
+        Ok(())
+    }
+
+    /// The public door onto the slug grammar, for a caller outside this crate
+    /// holding a bare declared name (Huginn's `require_instance` and
+    /// `Mind::open`, before either reaches admission or the filesystem). It
+    /// applies exactly `dotted_text`: one valid dotted name, and refusals for
+    /// fullwidth characters, `..`, both path separators, the empty string,
+    /// and an empty label.
+    #[test]
+    fn slug_validate_applies_the_dotted_grammar() {
+        assert_eq!(slug("huginn-yggdrasil").validate_slug(), Ok(()));
+        assert_eq!(slug("outer.inner").validate_slug(), Ok(()));
+
+        let refused = |value: &str, why: &str| {
+            let result = slug(value).validate_slug();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "slug"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+
+        refused("\u{FF41}\u{FF41}", "fullwidth characters are not ascii alphanumeric");
+        refused("..", "a bare .. is an empty label either side of the dot");
+        refused("../escaped", "a forward-slash path separator is not a label byte");
+        refused("..\\escaped", "a backslash path separator is not a label byte");
+        refused("outer\\inner", "a lone backslash inside one label is not a label byte, with no empty label to hide behind");
+        refused("", "the empty string has no label");
+        refused("outer..inner", "an empty label between two dots is refused");
+        refused(".", "a single dot is one empty label");
+
+        // S5: the 64-byte whole-name bound, pinned with a two-label name
+        // whose parts sit far under 64 bytes each (31 and 32, then 32 and
+        // 32), so only `dotted_text`'s own `value.len() > 64` check -- not
+        // `label_text`'s per-part one -- can be the check that refuses 65.
+        let filler = |n: usize| "a".repeat(n);
+        let at_64 = format!("{}.{}", filler(31), filler(32));
+        let at_65 = format!("{}.{}", filler(32), filler(32));
+        assert_eq!(at_64.len(), 64, "a 64-byte whole name, two labels well under 64 each");
+        assert_eq!(at_65.len(), 65, "one byte past the whole-name bound, same two-label shape");
+        assert_eq!(slug(&at_64).validate_slug(), Ok(()));
+        refused(&at_65, "65 bytes overall is refused, even though neither label alone reaches 64");
+
+        // S5: the 64-byte per-label bound, pinned directly against `Label`
+        // (the type `label_text` guards on its own, with no separate
+        // whole-name wrapper), and with a lone label carrying no dot, so only
+        // `label_text`'s own length check can be the one refusing 65.
+        let label_at_64 = Label::from(filler(64).as_str());
+        let label_at_65 = Label::from(filler(65).as_str());
+        assert_eq!(label_at_64.validate("label"), Ok(()));
+        assert!(
+            matches!(
+                label_at_65.validate("label"),
+                Err(PipelineRefusal::InvalidFormat { ref field, .. }) if field == "label"
+            ),
+            "a 65-byte label was not refused, got {:?}",
+            label_at_65.validate("label")
+        );
+
+        // S5: NUL is refused as a label byte, not merely as one more
+        // non-alphanumeric character that happens to be caught by coincidence.
+        refused("a\u{0}b", "NUL is not a label byte");
+    }
+
+    /// The two doors added beside `Slug::validate_slug` (RS-L), on its
+    /// pattern: each delegates to the grammar its own document field already
+    /// carries, so a declared name checked through the door and a field of
+    /// the same type refuse the same inputs. `OrgRepo` is the `repo` alias's
+    /// domain and `Label` is the `cut` alias's (RS-3's vocabulary table).
+    #[test]
+    fn the_org_repo_and_label_doors_are_the_grammar() {
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").validate_org_repo(), Ok(()));
+        assert_eq!(OrgRepo::from("a/b").validate_org_repo(), Ok(()));
+        assert_eq!(OrgRepo::from("a-b/c.d_e").validate_org_repo(), Ok(()));
+        // Consecutive hyphens stay allowed on both sides; only a leading or
+        // trailing owner hyphen is refused.
+        assert_eq!(OrgRepo::from("a--b/c--d").validate_org_repo(), Ok(()));
+        // S4: a 39-byte owner is accepted, a 100-byte repo is accepted.
+        let owner_at_39 = format!("{}/b", "a".repeat(39));
+        assert_eq!(OrgRepo::from(owner_at_39.as_str()).validate_org_repo(), Ok(()));
+        let repo_at_100 = format!("a/{}", "a".repeat(100));
+        assert_eq!(OrgRepo::from(repo_at_100.as_str()).validate_org_repo(), Ok(()));
+        let repo_refused = |value: &str, why: &str| {
+            let result = OrgRepo::from(value).validate_org_repo();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "org_repo"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+        repo_refused("GameCult", "no slash at all");
+        repo_refused("/Repo", "an empty org before the slash");
+        repo_refused("GameCult/", "an empty repo after the slash");
+        repo_refused("a/b/c", "a second slash makes the repo half ambiguous");
+        repo_refused("../..", "an owner of dots is not GitHub's grammar");
+        repo_refused("a/..", "a repo of .. is refused outright");
+        repo_refused("a/.", "a repo of . is refused outright");
+        repo_refused("-a/b", "a leading hyphen is not a valid owner");
+        repo_refused("a-/b", "a trailing hyphen is not a valid owner");
+        repo_refused("a b/c", "a space is not an owner byte");
+        repo_refused("a/b c", "a space is not a repo byte");
+        repo_refused("\u{e9}/\u{fc}", "non-ascii bytes are refused on either side");
+        repo_refused("\0/\0", "NUL is refused on either side");
+        repo_refused("a\n/b", "a newline is not an owner byte");
+        let owner_at_40 = format!("{}/b", "a".repeat(40));
+        repo_refused(&owner_at_40, "40 bytes is past the 39-byte owner bound");
+        let repo_at_101 = format!("a/{}", "a".repeat(101));
+        repo_refused(&repo_at_101, "101 bytes is past the 100-byte repo bound");
+        repo_refused("a//b", "an empty middle segment is still a second slash");
+        repo_refused("/b", "an empty owner is refused");
+        repo_refused("a/", "an empty repo is refused");
+        repo_refused("a.b/c", "a dot is not an owner byte");
+        repo_refused("a_b/c", "an underscore is not an owner byte");
+        // F7 fix batch: a repo name ending in `.git` is refused.
+        repo_refused("a/b.git", "a repo ending in .git is refused");
+        repo_refused("a/.git", "a repo of exactly .git is still a .git suffix");
+        // S-2: the `.git` refusal is ASCII-case-insensitive, so a case variant
+        // cannot dodge it and reach an `identity()` the validator refuses.
+        repo_refused("a/b.GIT", "a repo ending in .GIT is refused like .git");
+        repo_refused("a/.GIT", "a repo of exactly .GIT is still a .git suffix");
+        repo_refused("A/B.GIT", "a mixed-case owner and a .GIT repo both refuse");
+        repo_refused("a/b.GiT", "a mixed-case .git suffix is refused");
+
+        // identity(): the one canonical key, ASCII-lowercased. Every
+        // comparison, hash, ordering and key derivation goes through it.
+        assert_eq!(
+            OrgRepo::from("GameCult/Epiphany").identity(),
+            OrgRepo::from("gamecult/epiphany").identity()
+        );
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").identity(), "gamecult/epiphany");
+
+        // S-1: it is structural, not advisory. `==` on `OrgRepo` compares
+        // identity, not the raw string, so the two spellings are one
+        // repository wherever `OrgRepo` is compared, hashed or ordered.
+        assert_eq!(OrgRepo::from("GameCult/Epiphany"), OrgRepo::from("gamecult/epiphany"));
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany")), std::cmp::Ordering::Equal);
+        assert_eq!(
+            OrgRepo::from("GameCult/Epiphany").partial_cmp(&OrgRepo::from("gamecult/epiphany")),
+            Some(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany"))),
+            "partial_cmp must agree with cmp for an equal pair"
+        );
+
+        // RS-L closing fix 1: every assertion above compares values that
+        // should be equal, so `eq -> true`, `hash -> ()` and `cmp -> Equal`
+        // all survive as mutants. Pin the unequal direction as well: two
+        // different repos must be unequal, hash differently (with
+        // overwhelming probability, not by construction, so this is belt and
+        // suspenders on top of the `!=` and `cmp` checks), and not compare
+        // `Equal`, and `partial_cmp` must agree with `cmp` for an unequal
+        // pair too, per std's own contract that `partial_cmp(a, b) ==
+        // Some(cmp(a, b))`.
+        let a = OrgRepo::from("GameCult/Epiphany");
+        let b = OrgRepo::from("GameCult/Aetheria");
+        assert_ne!(a, b, "two different repos must not compare equal");
+        assert_ne!(
+            a.cmp(&b),
+            std::cmp::Ordering::Equal,
+            "two different repos must not order as Equal"
+        );
+        assert_eq!(
+            a.partial_cmp(&b),
+            Some(a.cmp(&b)),
+            "partial_cmp must agree with cmp for an unequal pair"
+        );
+        let hash_of = |repo: &OrgRepo| {
+            use std::hash::{Hash, Hasher};
+            let mut hasher = std::collections::hash_map::DefaultHasher::new();
+            repo.hash(&mut hasher);
+            hasher.finish()
+        };
+        assert_ne!(
+            hash_of(&a),
+            hash_of(&b),
+            "two different repos must hash differently"
+        );
+
+        let mut hash_map = std::collections::HashMap::new();
+        hash_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
+        hash_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
+        assert_eq!(hash_map.len(), 1, "a HashMap keyed by both spellings holds one entry");
+        assert_eq!(hash_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
+
+        let mut btree_map = std::collections::BTreeMap::new();
+        btree_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
+        btree_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
+        assert_eq!(btree_map.len(), 1, "a BTreeMap keyed by both spellings holds one entry");
+        assert_eq!(btree_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
+
+        // `identity()` is always itself a valid `OrgRepo`: lowercasing never
+        // turns a valid repository into one the grammar refuses, and never
+        // turns a refused one into one it accepts.
+        for value in ["GameCult/Epiphany", "A/B", "a-B/c.D_e", "GameCult/Epiphany.GIT"] {
+            let repo = OrgRepo::from(value);
+            assert_eq!(
+                repo.validate_org_repo().is_ok(),
+                OrgRepo::from(repo.identity().as_str()).validate_org_repo().is_ok(),
+                "identity() of {value:?} disagreed with the value's own validity"
+            );
+        }
+
+        assert_eq!(Label::from("cut-10").validate_label(), Ok(()));
+        let label_refused = |value: &str, why: &str| {
+            let result = Label::from(value).validate_label();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "label"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+        label_refused("", "the empty string has no label");
+        label_refused("a.b", "a dot is not a label byte");
+        label_refused(&"a".repeat(65), "65 bytes is past the 64-byte label bound");
+        label_refused("\u{e9}", "a non-ascii byte is not a label byte");
+    }
+
+    /// Q-RS1, ruled B: `question` and `ruling` gain a required `title`, the
+    /// new `Title` type shared with the two titles that move off `Short`
+    /// (campaign, cut spec). Each kind round-trips through `prepare`/`decode`
+    /// with its title intact, an empty title is refused for both, and the
+    /// bound is pinned at its edge: 200 bytes accepted, 201 refused (L3 dies
+    /// on the removal of the non-empty check, not on the length bound, since
+    /// `Title`'s length bound is shared with every other `bounded_text!`
+    /// member and already covered by `bounds_refuse_in_utf8_bytes`).
+    #[test]
+    fn question_and_ruling_carry_a_title() -> Result<()> {
+        let cache = schema_cache()?;
+
+        let mut question = question_sample();
+        question.title = t("Who owns the state?");
+        let envelope = PipelineDocument::Question(question.clone()).prepare(&cache)?;
+        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Question(question.clone()));
+
+        let mut ruling = ruling_sample();
+        ruling.title = t("An instance owns its mind");
+        let envelope = PipelineDocument::Ruling(ruling.clone()).prepare(&cache)?;
+        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Ruling(ruling.clone()));
+
+        question.title = Title(String::new());
+        assert_eq!(
+            PipelineDocument::Question(question.clone()).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: String::new() })
+        );
+        ruling.title = Title(String::new());
+        assert_eq!(
+            PipelineDocument::Ruling(ruling.clone()).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "ruling.title".into(), value: String::new() })
+        );
+
+        // F2 second fix batch: a title holds at least one
+        // `char::is_alphanumeric()` character, no `char::is_control()`
+        // character, and no bidi control character. No zero-width denylist:
+        // a zero-width joiner/non-joiner inside real text is allowed, and a
+        // string of nothing but invisible characters is refused because it
+        // has no alphanumeric character, not because those characters are
+        // individually denylisted.
+        let refused = |value: &str| {
+            let mut refused_question = question.clone();
+            refused_question.title = Title(value.into());
+            assert_eq!(
+                PipelineDocument::Question(refused_question).validate(),
+                Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: value.into() }),
+                "{value:?} should be refused"
+            );
+        };
+        refused(" ");
+        refused("\u{7f}");
+        refused("a\u{7f}");
+        refused("\u{0}");
+        refused("\u{9f}");
+        refused("\u{2028}");
+        refused("\u{202e}"); // RLO alone
+        refused("\u{202e}text"); // RLO plus text
+        refused("\u{200e}"); // LRM alone
+        refused("\u{0301}"); // a lone combining mark
+        refused("\u{fe0f}"); // a variation selector alone
+        refused("\u{a0}"); // NBSP alone
+        refused("\u{1f680}"); // emoji only
+
+        // S-3: every one of the twelve bidi control code points is pinned
+        // with an embedded fixture (real alphanumeric text on both sides), so
+        // the alphanumeric rule cannot mask a hole in the bidi match arm the
+        // way a lone-character fixture would.
+        refused("a\u{061C}b"); // ALM
+        refused("a\u{200E}b"); // LRM
+        refused("a\u{200F}b"); // RLM
+        refused("a\u{202A}b"); // LRE
+        refused("a\u{202B}b"); // RLE
+        refused("a\u{202C}b"); // PDF
+        refused("a\u{202D}b"); // LRO
+        refused("a\u{202E}b"); // RLO
+        refused("a\u{2066}b"); // LRI
+        refused("a\u{2067}b"); // RLI
+        refused("a\u{2068}b"); // FSI
+        refused("a\u{2069}b"); // PDI
+
+        // S-4: U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR are
+        // refused inside otherwise-alphanumeric text, not only alone, since
+        // `char::is_control()` does not reach `Zl`/`Zp`.
+        refused("a\u{2028}b");
+        refused("a\u{2029}b");
+
+        let accepted = |value: &str| {
+            let mut accepted_question = question.clone();
+            accepted_question.title = Title(value.into());
+            assert_eq!(
+                PipelineDocument::Question(accepted_question).validate(),
+                Ok(()),
+                "{value:?} should validate"
+            );
+        };
+        accepted("a");
+        accepted("\u{e9}");
+        accepted("\u{200c}\u{647}\u{6cc}"); // Persian text containing ZWNJ
+        accepted("a\u{200d}b");
+        accepted("a \u{1f680}");
+        accepted(" a ");
+        // Discrepancy from the fix spec: HANGUL FILLER (U+3164) is Unicode
+        // General_Category Lo, so `char::is_alphanumeric()` is true for it in
+        // this toolchain; it is not a denylist candidate, since the fix
+        // batch deletes the hand-written exclusion list on purpose. A title
+        // of U+3164 alone is therefore accepted, not refused.
+        accepted("\u{3164}");
+
+        question.title = Title("a".repeat(200));
+        assert_eq!(PipelineDocument::Question(question.clone()).validate(), Ok(()));
+        question.title = Title("a".repeat(201));
+        assert_eq!(
+            PipelineDocument::Question(question).validate(),
+            Err(PipelineRefusal::FieldBound { field: "question.title".into(), limit: 200, actual: 201 })
+        );
+        Ok(())
+    }
+}

From 6d62c2692070160e8795ce991dc8ee627333b723 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 14:56:52 +0200
Subject: [PATCH 06/11] Commit the golden encoded envelopes the wire parity
 test asserts

Derived at 87b6455; provenance in the file header.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/eureka-pipeline/golden/envelopes.txt | 36 +++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/crates/eureka-pipeline/golden/envelopes.txt b/crates/eureka-pipeline/golden/envelopes.txt
index e69de29..f8c1ebe 100644
--- a/crates/eureka-pipeline/golden/envelopes.txt
+++ b/crates/eureka-pipeline/golden/envelopes.txt
@@ -0,0 +1,36 @@
+# Golden encoded envelopes of the pipeline leaf. One line per document:
+#   label key type-id schema-name payload-hex   (payload is the cultcache MessagePack payload)
+# Provenance: derived once by `golden_dump` from this crate at huginn 87b6455
+# (the leaf copied from Epiphany ef956865, renamed). Soul proved that tree's
+# encoding byte-identical to the live mind store and to Epiphany ef956865
+# (eureka-body:verdict:cut-leaf-into-huginn.s1). Never regenerate to make a
+# failing test pass: a diff here is a wire change and needs its own ruling.
+sample.campaign eureka-state:campaign:self epiphany.pipeline.campaign.v2 EpiphanyPipelineCampaignDocument 9185a4736c7567ac657572656b612d7374617465a57469746c65b5457572656b6120706970656c696e65207374617465a57265706f7391b147616d6543756c742f4570697068616e79ae776f726b696e675f6272616e6368bb636f6465782f657572656b612d706970656c696e652d7374617465aa7461726765745f646f6384a470617468d9256e6f7465732f657572656b612d706970656c696e652d73746174652d7461726765742e6d64aa73746172745f6c696e6501a8656e645f6c696e6509a6636f6d6d6974a83566393832323864
+sample.target eureka-state:target:r2 epiphany.pipeline.target.v2 EpiphanyPipelineTargetDocument 9186a863616d706169676eac657572656b612d7374617465a87265766973696f6e02aa696e76617269616e74739182a56c6162656cab6d696e642d61646d697473a973746174656d656e74b64f6e6c792061646d697373696f6e207772697465732eac6e6f745f696e5f73636f706591ac4576652062726f7773696e67b963616e6f6e6963616c5f696d706c656d656e746174696f6e7391a743756c744c6962a3646f6384a470617468d9256e6f7465732f657572656b612d706970656c696e652d73746174652d7461726765742e6d64aa73746172745f6c696e6501a8656e645f6c696e6509a6636f6d6d6974a83566393832323864
+sample.question eureka-state:question:Q1 epiphany.pipeline.question.v2 EpiphanyPipelineQuestionDocument 9189a863616d706169676eac657572656b612d7374617465a56c6162656ca25131a57469746c65b357686f206f776e73207468652073746174653fa87175657374696f6eb357686f206f776e73207468652073746174653fa76f7074696f6e739282a56c6162656ca141a474657874ab616e20696e7374616e636582a56c6162656ca142a474657874a661207265706fab7265636f6d6d656e646564a141a7646570656e647391a6437574203361a97261697365645f696e82a46b696e64a743757453706563a26964bf657572656b612d73746174653a6375745f737065633a6375742d33612e7231a861736b65645f6f6eaa323032362d30392d3135
+sample.ruling eureka-state:ruling:R8 epiphany.pipeline.ruling.v2 EpiphanyPipelineRulingDocument 918aa863616d706169676eac657572656b612d7374617465a56c6162656ca25238a57469746c65b9416e20696e7374616e6365206f776e7320697473206d696e64a7616e7377657273b8657572656b612d73746174653a7175657374696f6e3a5131a663686f696365a141a672756c696e67ba416e20696e7374616e6365206f776e7320697473206d696e642eae6f70657261746f725f71756f7465bd616c6c207265636f6d6d656e646174696f6e732c20676f206168656164a872756c65645f6f6eaa323032362d30392d3135aa707265636564656e74739185a47265706fb147616d6543756c742f4165746865726961a6636f6d6d6974d92861616161616161616161616161616161616161616161616161616161616161616161616161616161a46b696e64a652756c696e67a26964b363756c7463616368653a72756c696e673a5231ae7061796c6f61645f736861323536d94062626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262a9617574686f72697479a84f70657261746f72
+sample.cut_spec eureka-state:cut_spec:cut-3a.r1 epiphany.pipeline.cut_spec.v2 EpiphanyPipelineCutSpecDocument 91de0012a863616d706169676eac657572656b612d7374617465a3637574a23361a87265766973696f6e01a57469746c65b2506970656c696e6520646f63756d656e7473a47265706fb147616d6543756c742f4570697068616e79a66272616e6368bb636f6465782f657572656b612d706970656c696e652d7374617465a462617365a83566393832323864aa646570656e64735f6f6e91a132a5666972737491ae526561642074686520737065632ea764656c657465739183a470617468a66f6c642e7273a56c696e657303a46e6f7465a464656164ab6b656570735f6d6f76657391ac636f6d6d6974206f776e6572a46164647391b5706970656c696e655f646f63756d656e74732e7273ac66696c655f6368616e6765739182a86c6f636174696f6e83a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a46c696e6501a8656e645f6c696e6509a66368616e6765a3616464ad617574686f726974795f6d617087a56f776e6572a4636f7265a6696e7075747391af747970656420646f63756d656e7473a76f75747075747391a9656e76656c6f706573ad646572697665645f737461746591ac64657269766564206b657973b1666f7262696464656e5f7772697465727391a34d4350ac7368617265645f706174687391a961646d697373696f6ead64656c6574696f6e5f6c696e65a36e2f61ac766572696669636174696f6e84a66275696c647391ab636172676f20636865636ba574657374739182a46e616d65a46b657973a470696e73af6f6e652064657269766564206b6579a86e656761746976659182a77061747465726ea75665633c75383ea573636f7065a9646f63756d656e7473a86f70657261746f7291a46e6f6e65a8657374696d61746588ab6c696e65735f6164646564cd0384ad6c696e65735f72656d6f76656400b2646570656e64656e636965735f616464656491a8736368656d617273b4646570656e64656e636965735f72656d6f76656490ad666f726d6174735f616464656491b66570697068616e792e706970656c696e652e2a2e7631af666f726d6174735f72656d6f76656490ad746172676574735f616464656490af746172676574735f72656d6f76656490a772756c696e677391b6657572656b612d73746174653a72756c696e673a5238a97175657374696f6e7391b8657572656b612d73746174653a7175657374696f6e3a5131
+sample.cut_report eureka-state:cut_report:cut-3a.h1 epiphany.pipeline.cut_report.v2 EpiphanyPipelineCutReportDocument 918fa863616d706169676eac657572656b612d7374617465a86375745f73706563bf657572656b612d73746174653a6375745f737065633a6375742d33612e7231a7617474656d707401a47265706fb147616d6543756c742f4570697068616e79a66272616e6368bb636f6465782f657572656b612d706970656c696e652d7374617465a7636f6d6d6974739183a3736861a83566393832323864a77375626a656374ba4164642074686520706970656c696e6520646f63756d656e7473a66275696c6473c3a572616e676582a462617365a83566393832323864a468656164a83566393832323864ac766572696669636174696f6e9183a46b696e64a454657374a76c6f6361746f72aa636172676f2074657374a6726573756c74a26f6ba96d75746174696f6e739187a56c6162656ca24d31a472756c65ae6b65792064657269766174696f6ea86c6f636174696f6e83a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a46c696e6501a8656e645f6c696e6509a66265666f7265bd706172656e745f637574286669656c642c20737065632c20277227293fa56166746572a473706563a6636f6d6d6974a83566393832323864b26661696c65645f61735f6578706563746564c3aa646576696174696f6e739182a477686174a56e616d6573a3776879ac676c6f62206578706f727473a5666f726b7391b8657572656b612d73746174653a7175657374696f6e3a5131b07374727563747572616c5f64656c746188ab6c696e65735f6164646564cd0384ad6c696e65735f72656d6f76656400b2646570656e64656e636965735f616464656491a8736368656d617273b4646570656e64656e636965735f72656d6f76656490ad666f726d6174735f616464656491b66570697068616e792e706970656c696e652e2a2e7631af666f726d6174735f72656d6f76656490ad746172676574735f616464656490af746172676574735f72656d6f76656490ac6c616e6465645f6e616d65739182a46e616d65b0506970656c696e65446f63756d656e74a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a6756e646f6e6591a961646d697373696f6ea870726f6d697365739182a56c6162656ca25031a474657874bd4f6e652064657269766564206b65792070657220646f63756d656e742e
+sample.verdict eureka-state:verdict:cut-3a.s2 epiphany.pipeline.verdict.v2 EpiphanyPipelineVerdictDocument 9185a863616d706169676eac657572656b612d7374617465aa6375745f7265706f7274d921657572656b612d73746174653a6375745f7265706f72743a6375742d33612e6831a47061737302a572616e676582a462617365a83566393832323864a468656164a83566393832323864a6636c61696d739186a5636c61696dbe4120636f6d706f736564206b657920686173206f6e6520736f757263652ea76f7574636f6d65a946616c736966696564a865766964656e63659183a46b696e64a454657374a76c6f6361746f72aa636172676f2074657374a6726573756c74a26f6ba866696e64696e677391d921657572656b612d73746174653a66696e64696e673a6375742d33612e73322e4634a770726f6d697365a25031a96d75746174696f6e7391a24d31
+sample.finding eureka-state:finding:cut-3a.s2.F4 epiphany.pipeline.finding.v2 EpiphanyPipelineFindingDocument 918da863616d706169676eac657572656b612d7374617465a776657264696374be657572656b612d73746174653a766572646963743a6375742d33612e7332a56c6162656ca24634a572616e676582a462617365a83566393832323864a468656164a83566393832323864aa636f6e666964656e6365a9436f6e6669726d6564a87365766572697479a448696768a5636c61696dd9214120646f74746564206c6162656c20636f6d706f7365732074776f206b6579732eaa696e76617269616e747391ab6d696e642d61646d697473a96c6f636174696f6e739183a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a46c696e6501a8656e645f6c696e6509b06661696c7572655f7363656e6172696fbc54776f20646f63756d656e747320636c61696d206f6e65206b65792ea865766964656e63659183a46b696e64a454657374a76c6f6361746f72aa636172676f2074657374a6726573756c74a26f6baa707265636564656e747390a66f726967696eaa496e74726f6475636564
+sample.follow_up eureka-state:follow_up:FU-4 epiphany.pipeline.follow_up.v2 EpiphanyPipelineFollowUpDocument 9188a863616d706169676eac657572656b612d7374617465a56c6162656ca446552d34a6736f7572636582a46b696e64a746696e64696e67a26964d921657572656b612d73746174653a66696e64696e673a6375742d33612e73322e4634a47265706fb147616d6543756c742f4570697068616e79a96c6f636174696f6e739183a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a46c696e6501a8656e645f6c696e6509a46974656db95065722d6b696e642061646d697373696f6e2072756c65732eaf7768795f69745f63616e5f77616974b9546865206f7267616e206f776e732061646d697373696f6e2ea56f776e6572a548616e6473
+sample.resolution eureka-state:resolution:question.Q1.n1 epiphany.pipeline.resolution.v2 EpiphanyPipelineResolutionDocument 9185a77375626a65637482a46b696e64a85175657374696f6ea26964b8657572656b612d73746174653a7175657374696f6e3a5131a873657175656e636501a76f7574636f6d6581a8416e73776572656481a2627982a46b696e64a652756c696e67a26964b6657572656b612d73746174653a72756c696e673a5238a9726174696f6e616c65a852756c656420412eab7265736f6c7665645f6f6eaa323032362d30392d3135
+sample.instance yggdrasil:instance:self epiphany.pipeline.instance.v2 EpiphanyPipelineInstanceDocument 9184a8696e7374616e6365a979676764726173696cac646973706c61795f6e616d65ae59676764726173696c206d696e64aa637265617465645f6174aa323032362d30392d3135a4686f7374a979676764726173696c
+sample.stewardship yggdrasil:stewardship:gamecult_-epiphany.n1 epiphany.pipeline.stewardship.v2 EpiphanyPipelineStewardshipDocument 9185a8696e7374616e6365a979676764726173696ca47265706fb147616d6543756c742f4570697068616e79a873657175656e636501ab61737369676e65645f6f6eaa323032362d30392d3135a46e6f7465b954686520457572656b612063616d706169676e207265706f2e
+sample.hand_off yggdrasil:hand_off:thought-cage.gamecult_-epiphany.2026-09-15 epiphany.pipeline.hand_off.v2 EpiphanyPipelineHandOffDocument 9186ad66726f6d5f696e7374616e6365a979676764726173696cab746f5f696e7374616e6365ac74686f756768742d63616765a47265706fb147616d6543756c742f4570697068616e79a9646f63756d656e747392ac657572656b612d7374617465b6657572656b612d73746174653a72756c696e673a5238a6726561736f6ed92854686520776f726b73746174696f6e206d696e642074616b6573207468652063616d706169676e2ea968616e6465645f6f6eaa323032362d30392d3135
+resolution.superseded eureka-state:resolution:question.Q1.n1 epiphany.pipeline.resolution.v2 EpiphanyPipelineResolutionDocument 9185a77375626a65637482a46b696e64a85175657374696f6ea26964b8657572656b612d73746174653a7175657374696f6e3a5131a873657175656e636501a76f7574636f6d6581aa5375706572736564656481a262799282a46b696e64a652756c696e67a26964b6657572656b612d73746174653a72756c696e673a523882a46b696e64a85175657374696f6ea26964b8657572656b612d73746174653a7175657374696f6e3a5131a9726174696f6e616c65a852756c656420412eab7265736f6c7665645f6f6eaa323032362d30392d3135
+resolution.fixed-by-none eureka-state:resolution:question.Q1.n1 epiphany.pipeline.resolution.v2 EpiphanyPipelineResolutionDocument 9185a77375626a65637482a46b696e64a85175657374696f6ea26964b8657572656b612d73746174653a7175657374696f6e3a5131a873657175656e636501a76f7574636f6d6581a5466978656482a6636f6d6d6974a83566393832323864a26279c0a9726174696f6e616c65a852756c656420412eab7265736f6c7665645f6f6eaa323032362d30392d3135
+resolution.fixed-by-some eureka-state:resolution:question.Q1.n1 epiphany.pipeline.resolution.v2 EpiphanyPipelineResolutionDocument 9185a77375626a65637482a46b696e64a85175657374696f6ea26964b8657572656b612d73746174653a7175657374696f6e3a5131a873657175656e636501a76f7574636f6d6581a5466978656482a6636f6d6d6974a83566393832323864a2627982a46b696e64a94375745265706f7274a26964d921657572656b612d73746174653a6375745f7265706f72743a6375742d33612e6831a9726174696f6e616c65a852756c656420412eab7265736f6c7665645f6f6eaa323032362d30392d3135
+resolution.deferred eureka-state:resolution:question.Q1.n1 epiphany.pipeline.resolution.v2 EpiphanyPipelineResolutionDocument 9185a77375626a65637482a46b696e64a85175657374696f6ea26964b8657572656b612d73746174653a7175657374696f6e3a5131a873657175656e636501a76f7574636f6d6581a8446566657272656481a2746f82a46b696e64a8466f6c6c6f775570a26964bb657572656b612d73746174653a666f6c6c6f775f75703a46552d34a9726174696f6e616c65a852756c656420412eab7265736f6c7665645f6f6eaa323032362d30392d3135
+resolution.recorded eureka-state:resolution:question.Q1.n1 epiphany.pipeline.resolution.v2 EpiphanyPipelineResolutionDocument 9185a77375626a65637482a46b696e64a85175657374696f6ea26964b8657572656b612d73746174653a7175657374696f6e3a5131a873657175656e636501a76f7574636f6d6581a85265636f7264656481a6726561736f6ea64e6f7465642ea9726174696f6e616c65a852756c656420412eab7265736f6c7665645f6f6eaa323032362d30392d3135
+resolution.withdrawn eureka-state:resolution:question.Q1.n1 epiphany.pipeline.resolution.v2 EpiphanyPipelineResolutionDocument 9185a77375626a65637482a46b696e64a85175657374696f6ea26964b8657572656b612d73746174653a7175657374696f6e3a5131a873657175656e636501a76f7574636f6d6581a957697468647261776e81a6726561736f6ea94d697374616b656e2ea9726174696f6e616c65a852756c656420412eab7265736f6c7665645f6f6eaa323032362d30392d3135
+ruling.authority-standing eureka-state:ruling:R8 epiphany.pipeline.ruling.v2 EpiphanyPipelineRulingDocument 918aa863616d706169676eac657572656b612d7374617465a56c6162656ca25238a57469746c65b9416e20696e7374616e6365206f776e7320697473206d696e64a7616e7377657273b8657572656b612d73746174653a7175657374696f6e3a5131a663686f696365a141a672756c696e67ba416e20696e7374616e6365206f776e7320697473206d696e642eae6f70657261746f725f71756f7465bd616c6c207265636f6d6d656e646174696f6e732c20676f206168656164a872756c65645f6f6eaa323032362d30392d3135aa707265636564656e74739185a47265706fb147616d6543756c742f4165746865726961a6636f6d6d6974d92861616161616161616161616161616161616161616161616161616161616161616161616161616161a46b696e64a652756c696e67a26964b363756c7463616368653a72756c696e673a5231ae7061796c6f61645f736861323536d94062626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262a9617574686f72697479a85374616e64696e67
+ruling.authority-defaulted eureka-state:ruling:R8 epiphany.pipeline.ruling.v2 EpiphanyPipelineRulingDocument 918aa863616d706169676eac657572656b612d7374617465a56c6162656ca25238a57469746c65b9416e20696e7374616e6365206f776e7320697473206d696e64a7616e7377657273b8657572656b612d73746174653a7175657374696f6e3a5131a663686f696365a141a672756c696e67ba416e20696e7374616e6365206f776e7320697473206d696e642eae6f70657261746f725f71756f7465bd616c6c207265636f6d6d656e646174696f6e732c20676f206168656164a872756c65645f6f6eaa323032362d30392d3135aa707265636564656e74739185a47265706fb147616d6543756c742f4165746865726961a6636f6d6d6974d92861616161616161616161616161616161616161616161616161616161616161616161616161616161a46b696e64a652756c696e67a26964b363756c7463616368653a72756c696e673a5231ae7061796c6f61645f736861323536d94062626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262a9617574686f72697479a944656661756c746564
+ruling.options-none eureka-state:ruling:R8 epiphany.pipeline.ruling.v2 EpiphanyPipelineRulingDocument 918aa863616d706169676eac657572656b612d7374617465a56c6162656ca25238a57469746c65b9416e20696e7374616e6365206f776e7320697473206d696e64a7616e7377657273c0a663686f696365c0a672756c696e67ba416e20696e7374616e6365206f776e7320697473206d696e642eae6f70657261746f725f71756f7465c0a872756c65645f6f6eaa323032362d30392d3135aa707265636564656e747390a9617574686f72697479a84f70657261746f72
+question.raised-in-none eureka-state:question:Q1 epiphany.pipeline.question.v2 EpiphanyPipelineQuestionDocument 9189a863616d706169676eac657572656b612d7374617465a56c6162656ca25131a57469746c65b357686f206f776e73207468652073746174653fa87175657374696f6eb357686f206f776e73207468652073746174653fa76f7074696f6e739282a56c6162656ca141a474657874ab616e20696e7374616e636582a56c6162656ca142a474657874a661207265706fab7265636f6d6d656e646564a141a7646570656e647391a6437574203361a97261697365645f696ec0a861736b65645f6f6eaa323032362d30392d3135
+cut_spec.authority-map-none eureka-state:cut_spec:cut-3a.r1 epiphany.pipeline.cut_spec.v2 EpiphanyPipelineCutSpecDocument 91de0012a863616d706169676eac657572656b612d7374617465a3637574a23361a87265766973696f6e01a57469746c65b2506970656c696e6520646f63756d656e7473a47265706fb147616d6543756c742f4570697068616e79a66272616e6368bb636f6465782f657572656b612d706970656c696e652d7374617465a462617365a83566393832323864aa646570656e64735f6f6e91a132a5666972737491ae526561642074686520737065632ea764656c657465739183a470617468a66f6c642e7273a56c696e657303a46e6f7465a464656164ab6b656570735f6d6f76657391ac636f6d6d6974206f776e6572a46164647391b5706970656c696e655f646f63756d656e74732e7273ac66696c655f6368616e6765739182a86c6f636174696f6e83a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a46c696e6501a8656e645f6c696e6509a66368616e6765a3616464ad617574686f726974795f6d6170c0ac766572696669636174696f6e84a66275696c647391ab636172676f20636865636ba574657374739182a46e616d65a46b657973a470696e73af6f6e652064657269766564206b6579a86e656761746976659182a77061747465726ea75665633c75383ea573636f7065a9646f63756d656e7473a86f70657261746f7291a46e6f6e65a8657374696d61746588ab6c696e65735f6164646564cd0384ad6c696e65735f72656d6f76656400b2646570656e64656e636965735f616464656491a8736368656d617273b4646570656e64656e636965735f72656d6f76656490ad666f726d6174735f616464656491b66570697068616e792e706970656c696e652e2a2e7631af666f726d6174735f72656d6f76656490ad746172676574735f616464656490af746172676574735f72656d6f76656490a772756c696e677391b6657572656b612d73746174653a72756c696e673a5238a97175657374696f6e7391b8657572656b612d73746174653a7175657374696f6e3a5131
+verdict.claim-holds-promise-none eureka-state:verdict:cut-3a.s2 epiphany.pipeline.verdict.v2 EpiphanyPipelineVerdictDocument 9185a863616d706169676eac657572656b612d7374617465aa6375745f7265706f7274d921657572656b612d73746174653a6375745f7265706f72743a6375742d33612e6831a47061737302a572616e676582a462617365a83566393832323864a468656164a83566393832323864a6636c61696d739186a5636c61696dbe4120636f6d706f736564206b657920686173206f6e6520736f757263652ea76f7574636f6d65a5486f6c6473a865766964656e63659183a46b696e64a454657374a76c6f6361746f72aa636172676f2074657374a6726573756c74a26f6ba866696e64696e677391d921657572656b612d73746174653a66696e64696e673a6375742d33612e73322e4634a770726f6d697365c0a96d75746174696f6e7391a24d31
+verdict.claim-unproven-promise-none eureka-state:verdict:cut-3a.s2 epiphany.pipeline.verdict.v2 EpiphanyPipelineVerdictDocument 9185a863616d706169676eac657572656b612d7374617465aa6375745f7265706f7274d921657572656b612d73746174653a6375745f7265706f72743a6375742d33612e6831a47061737302a572616e676582a462617365a83566393832323864a468656164a83566393832323864a6636c61696d739186a5636c61696dbe4120636f6d706f736564206b657920686173206f6e6520736f757263652ea76f7574636f6d65a8556e70726f76656ea865766964656e63659183a46b696e64a454657374a76c6f6361746f72aa636172676f2074657374a6726573756c74a26f6ba866696e64696e677391d921657572656b612d73746174653a66696e64696e673a6375742d33612e73322e4634a770726f6d697365c0a96d75746174696f6e7391a24d31
+finding.plausible-blocker-preexisting-kinds eureka-state:finding:cut-3a.s2.F4 epiphany.pipeline.finding.v2 EpiphanyPipelineFindingDocument 918da863616d706169676eac657572656b612d7374617465a776657264696374be657572656b612d73746174653a766572646963743a6375742d33612e7332a56c6162656ca24634a572616e676582a462617365a83566393832323864a468656164a83566393832323864aa636f6e666964656e6365a9506c61757369626c65a87365766572697479a7426c6f636b6572a5636c61696dd9214120646f74746564206c6162656c20636f6d706f7365732074776f206b6579732eaa696e76617269616e747391ab6d696e642d61646d697473a96c6f636174696f6e739183a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a46c696e6501a8656e645f6c696e65c0b06661696c7572655f7363656e6172696fbc54776f20646f63756d656e747320636c61696d206f6e65206b65792ea865766964656e63659583a46b696e64a7436f6d6d616e64a76c6f6361746f72a178a6726573756c74a17983a46b696e64a84d75746174696f6ea76c6f6361746f72a178a6726573756c74a17983a46b696e64a550726f6265a76c6f6361746f72a178a6726573756c74a17983a46b696e64aa536f7572636552656164a76c6f6361746f72a178a6726573756c74a17983a46b696e64a743617074757265a76c6f6361746f72a178a6726573756c74a179aa707265636564656e747390a66f726967696eab5072654578697374696e67
+finding.severity-medium eureka-state:finding:cut-3a.s2.F4 epiphany.pipeline.finding.v2 EpiphanyPipelineFindingDocument 918da863616d706169676eac657572656b612d7374617465a776657264696374be657572656b612d73746174653a766572646963743a6375742d33612e7332a56c6162656ca24634a572616e676582a462617365a83566393832323864a468656164a83566393832323864aa636f6e666964656e6365a9436f6e6669726d6564a87365766572697479a64d656469756da5636c61696dd9214120646f74746564206c6162656c20636f6d706f7365732074776f206b6579732eaa696e76617269616e747391ab6d696e642d61646d697473a96c6f636174696f6e739183a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a46c696e6501a8656e645f6c696e6509b06661696c7572655f7363656e6172696fbc54776f20646f63756d656e747320636c61696d206f6e65206b65792ea865766964656e63659183a46b696e64a454657374a76c6f6361746f72aa636172676f2074657374a6726573756c74a26f6baa707265636564656e747390a66f726967696eaa496e74726f6475636564
+finding.severity-low eureka-state:finding:cut-3a.s2.F4 epiphany.pipeline.finding.v2 EpiphanyPipelineFindingDocument 918da863616d706169676eac657572656b612d7374617465a776657264696374be657572656b612d73746174653a766572646963743a6375742d33612e7332a56c6162656ca24634a572616e676582a462617365a83566393832323864a468656164a83566393832323864aa636f6e666964656e6365a9436f6e6669726d6564a87365766572697479a34c6f77a5636c61696dd9214120646f74746564206c6162656c20636f6d706f7365732074776f206b6579732eaa696e76617269616e747391ab6d696e642d61646d697473a96c6f636174696f6e739183a470617468d9216372617465732f657572656b612d706970656c696e652f7372632f6c69622e7273a46c696e6501a8656e645f6c696e6509b06661696c7572655f7363656e6172696fbc54776f20646f63756d656e747320636c61696d206f6e65206b65792ea865766964656e63659183a46b696e64a454657374a76c6f6361746f72aa636172676f2074657374a6726573756c74a26f6baa707265636564656e747390a66f726967696eaa496e74726f6475636564

From 23a132d194fd197c4b34fdaf6aa12306c12736c5 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 14:57:42 +0200
Subject: [PATCH 07/11] Read-back test also asserts stored bytes re-encode
 identically; document the opt-in command

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/eureka-pipeline/README.md  | 22 ++++++++++++++++++++++
 crates/eureka-pipeline/src/lib.rs | 28 ++++++++++++++++++++++------
 2 files changed, 44 insertions(+), 6 deletions(-)
 create mode 100644 crates/eureka-pipeline/README.md

diff --git a/crates/eureka-pipeline/README.md b/crates/eureka-pipeline/README.md
new file mode 100644
index 0000000..87a945c
--- /dev/null
+++ b/crates/eureka-pipeline/README.md
@@ -0,0 +1,22 @@
+# eureka-pipeline
+
+The pipeline leaf: typed documents, bounds, keys and the cultcache wrappers
+that define the mind's wire. Library only.
+
+## Wire parity checks
+
+Committed (runs in `cargo test -p eureka-pipeline`): `encoded_envelopes_match_the_committed_golden`
+asserts key, cultcache type id, schema name and payload bytes of every kind
+and every encoding-relevant variant against `golden/envelopes.txt`. A diff
+there is a wire change; do not regenerate it to make the test pass.
+
+Opt-in, against a real store: `stored_documents_read_back` decodes, validates
+and keys every stored pipeline document and asserts that it re-encodes to the
+stored key, type and payload bytes. Take a copy of the store (the test copies
+the file again before opening it, so the copy may be read-only), never open the
+live one:
+
+```sh
+sudo cp /var/lib/gamecult/huginn/minds/eureka/mind.redb "$SNAP/minds/eureka/mind.redb"
+HUGINN_MIND_SNAPSHOT="$SNAP" cargo test -p eureka-pipeline -- --ignored --exact tests::stored_documents_read_back --nocapture
+```
diff --git a/crates/eureka-pipeline/src/lib.rs b/crates/eureka-pipeline/src/lib.rs
index a3c4b22..d0f709b 100644
--- a/crates/eureka-pipeline/src/lib.rs
+++ b/crates/eureka-pipeline/src/lib.rs
@@ -2449,16 +2449,24 @@ mod tests {
         assert!(!Sha("5f98228a".into()).names_same_commit(&Sha("5f98228b".into())), "equal length, differing");
     }
 
-    /// stored-documents-valid, on the real mind. `HUGINN_MIND_SNAPSHOT` is a
-    /// writable copy of a state root holding `minds/eureka/mind.redb` (the
-    /// store opens read-write). Read through cultcache-rs's own store.
+    /// stored-documents-valid and stored-bytes-reproduce, on the real mind.
+    /// `HUGINN_MIND_SNAPSHOT` is a copy of a state root holding
+    /// `minds/eureka/mind.redb`; the test copies the store file into a scratch
+    /// directory first (redb opens read-write), so the snapshot may be
+    /// read-only. Read through cultcache-rs's own store. Each pipeline
+    /// document must re-prepare to its stored envelope: key, type and payload
+    /// bytes.
     #[test]
-    #[ignore = "needs HUGINN_MIND_SNAPSHOT, a writable copy of a Huginn state root"]
+    #[ignore = "needs HUGINN_MIND_SNAPSHOT, a copy of a Huginn state root; see the crate README"]
     fn stored_documents_read_back() {
         use cultcache_rs::{CacheBackingStore, OwnedRedbMessagePackBackingStore};
         let root = std::env::var("HUGINN_MIND_SNAPSHOT").expect("HUGINN_MIND_SNAPSHOT names the snapshot state root");
-        let store = OwnedRedbMessagePackBackingStore::new(Path::new(&root).join("minds").join("eureka").join("mind.redb"))
-            .expect("the snapshot opens");
+        let scratch = std::env::temp_dir().join(format!("eureka-pipeline-readback-{}", std::process::id()));
+        std::fs::create_dir_all(&scratch).expect("scratch directory");
+        let working = scratch.join("mind.redb");
+        std::fs::copy(Path::new(&root).join("minds").join("eureka").join("mind.redb"), &working).expect("the snapshot copies");
+        let store = OwnedRedbMessagePackBackingStore::new(&working).expect("the snapshot opens");
+        let cache = schema_cache().expect("the registrar registers");
         let envelopes = store.pull_all().expect("the snapshot reads");
         let mut stored = Vec::new();
         for envelope in &envelopes {
@@ -2466,6 +2474,13 @@ mod tests {
                 Ok(document) => {
                     assert_eq!(document.validate(), Ok(()), "{}: valid", envelope.key);
                     assert_eq!(pipeline_key(&document).as_deref(), Ok(envelope.key.as_str()), "{}: key derives byte for byte", envelope.key);
+                    let again = document.prepare(&cache).unwrap_or_else(|error| panic!("{}: does not re-prepare: {error}", envelope.key));
+                    assert_eq!(
+                        (&again.key, &again.r#type, &again.payload),
+                        (&envelope.key, &envelope.r#type, &envelope.payload),
+                        "{}: re-encodes to the stored bytes",
+                        envelope.key
+                    );
                     stored.push((document.kind(), envelope.key.clone()));
                 }
                 Err(PipelineRefusal::ForeignStore { .. }) => {}
@@ -2504,6 +2519,7 @@ mod tests {
             assert!(one.split(':').nth(2).is_some_and(|local| local.len() > SUBJECT_LOCAL_MAX), "{label}: the old bound refused it");
         }
         eprintln!("read back {} pipeline documents, {subjects} subjects", stored.len());
+        let _ = std::fs::remove_dir_all(&scratch);
     }
 
     /// The total bound, in the one place it lives: parts that are each a legal

From c0e383003b26476431204e0818050961ff97d654 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 15:10:38 +0200
Subject: [PATCH 08/11] Restore LF line endings in the leaf (the earlier edit
 rewrote the file as CRLF)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/eureka-pipeline/src/lib.rs | 6702 ++++++++++++++---------------
 1 file changed, 3351 insertions(+), 3351 deletions(-)

diff --git a/crates/eureka-pipeline/src/lib.rs b/crates/eureka-pipeline/src/lib.rs
index d0f709b..3b1eed2 100644
--- a/crates/eureka-pipeline/src/lib.rs
+++ b/crates/eureka-pipeline/src/lib.rs
@@ -1,3351 +1,3351 @@
-//! Eureka pipeline documents: the typed shape of a Eureka campaign's state.
-//!
-//! This is a leaf type library, and deliberately nothing else. It owns document
-//! shape, field bounds, formats, key derivation and the JSON schemas published
-//! under `schemas/cultnet`; it owns no storage, no admission, no process and no
-//! network. That is the whole reason it is a package: the organ that will admit
-//! these documents depends on these types without depending on the harness
-//! that used to hold them.
-//!
-//! Every kind is a plain `serde` + `JsonSchema` value inside a one-slot
-//! `DatabaseEntry` wrapper, always prepared with `prepare_entry_named`, so the
-//! stored payload is `[value]` and the value is the named map the published
-//! schema describes. Keys are semantic: `pipeline_key` derives them from the
-//! value, and the write validator refuses any envelope whose key differs.
-//!
-//! Every key is `<root>:<kind>:<local>`, three segments for every kind with
-//! none excused: the root is a `Slug`, the kind is the literal kind name, and
-//! the local is `Label`s joined by `.`, so no local part carries a dot and a
-//! reader recovers the parts by splitting. A root's local is the constant
-//! `self`; a resolution's local is its subject's kind and local. A
-//! resolution's local ends in its per-subject sequence, `n<N>`, and a
-//! stewardship's in its per-repo sequence, so a subject's resolutions and a
-//! repo's assignments each share a prefix.
-//!
-//! **Validation follows the type.** `value_types!` is the single field list: it
-//! emits the struct and its `Bounded` impl from the same tokens, so a field
-//! cannot be declared without being validated. Format rules live in the field's
-//! type (`Label`, `Slug`, `OrgRepo`, `Sha`, `Sha256Hex`, `Date`), never in a
-//! hand-written impl that a later field can slip past. A `Vec` field must carry
-//! a maximum, because `Vec<T>` has no `Bounded` impl of its own.
-//!
-//! The wrappers are crate-private: outside code registers, prepares and
-//! decodes them through `register_pipeline_document_types`,
-//! `PipelineDocument::prepare` and `PipelineDocument::decode`, and validates a
-//! write through `validate_pipeline_write_envelope`.
-
-// `anyhow` is the cache's own error type, which `prepare` and the registrar
-// pass through; every refusal this crate decides is a `PipelineRefusal`.
-use anyhow::Result;
-use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry};
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-/// Typed refusals of the pipeline documents: bounds, formats and key identity
-/// (D2's document half), and `ForeignStore`, raised by `decode` for an
-/// envelope of any other type. This is every refusal the leaf decides; a
-/// store's identity and its schema epoch are not decided here, since this
-/// crate owns no store, and belong to the organ that will admit these
-/// documents.
-///
-/// Serialised externally tagged, serde's default for an enum: each variant is
-/// a one-key map from the variant's name to its named fields, so `field` and
-/// `value` are on the wire under their own names and a reader of a refusal
-/// carried over a wire reads the same parts a local caller matches on. No
-/// attribute buys that, which is why there is none: an internal or adjacent
-/// tag would move the fields under a content key without making any of them
-/// more visible.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-pub enum PipelineRefusal {
-    FieldBound { field: String, limit: u32, actual: u32 },
-    InvalidFormat { field: String, value: String },
-    InvalidIdentity { kind: PipelineKind, key: String, expected: String },
-    DuplicateRepo { field: String, repo: String },
-    ForeignStore { r#type: String },
-}
-
-impl std::fmt::Display for PipelineRefusal {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(formatter, "pipeline refusal: {self:?}")
-    }
-}
-
-impl std::error::Error for PipelineRefusal {}
-
-pub(crate) trait Bounded {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal>;
-}
-
-impl<T: Bounded> Bounded for Option<T> {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-        self.as_ref().map_or(Ok(()), |value| value.validate(field))
-    }
-}
-
-macro_rules! unbounded_scalars {
-    ($($ty:ty),* $(,)?) => {$(
-        impl Bounded for $ty {
-            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
-                Ok(())
-            }
-        }
-    )*};
-}
-
-unbounded_scalars!(u32, u64, bool);
-
-fn bound(field: &str, limit: usize, actual: usize) -> Result<(), PipelineRefusal> {
-    if actual > limit {
-        return Err(PipelineRefusal::FieldBound {
-            field: field.into(),
-            limit: limit as u32,
-            actual: actual as u32,
-        });
-    }
-    Ok(())
-}
-
-/// List maximums only. Minimum counts are admission rules with their own
-/// refusals (Cut 3b), so a bounds pass never pre-empts them.
-fn list<T: Bounded>(field: &str, items: &[T], max: usize) -> Result<(), PipelineRefusal> {
-    bound(field, max, items.len())?;
-    for (index, item) in items.iter().enumerate() {
-        item.validate(&format!("{field}[{index}]"))?;
-    }
-    Ok(())
-}
-
-fn format_error(field: &str, value: &str) -> PipelineRefusal {
-    PipelineRefusal::InvalidFormat {
-        field: field.into(),
-        value: value.into(),
-    }
-}
-
-fn hex(field: &str, value: &str, lengths: std::ops::RangeInclusive<usize>) -> Result<(), PipelineRefusal> {
-    let lower_hex = value.bytes().all(|byte| matches!(byte, b'0'..=b'9' | b'a'..=b'f'));
-    if !lengths.contains(&value.len()) || !lower_hex {
-        return Err(format_error(field, value));
-    }
-    Ok(())
-}
-
-/// A key label: `[A-Za-z0-9_-]{1,64}`. Dots are excluded so that a composed key
-/// segments unambiguously; see `local`.
-fn label_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
-    let valid = value
-        .bytes()
-        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'));
-    if !valid || value.is_empty() || value.len() > 64 {
-        return Err(format_error(field, value));
-    }
-    Ok(())
-}
-
-/// A dotted key segment: label parts joined by `.`, at most 64 bytes. Every
-/// part must be a label, so `..`, a leading or trailing dot, and an empty part
-/// are all refused.
-fn dotted_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
-    dotted_within(field, value, 64)
-}
-
-/// `dotted_text`'s grammar with the bound as a parameter: the one place a
-/// dotted segment is parsed, whoever owns the bound.
-fn dotted_within(field: &str, value: &str, max: usize) -> Result<(), PipelineRefusal> {
-    if value.is_empty() || value.len() > max {
-        return Err(format_error(field, value));
-    }
-    for part in value.split('.') {
-        label_text(field, part)?;
-    }
-    Ok(())
-}
-
-/// GitHub's own grammar for `owner/repo`, exactly one `/`: the owner is
-/// `[A-Za-z0-9-]`, 1 to 39 bytes, with no leading or trailing hyphen; the repo
-/// is `[A-Za-z0-9._-]`, 1 to 100 bytes, is never `.` or `..`, and does not end
-/// in `.git`, ASCII-case-insensitively (`a/b.GIT` is refused exactly as
-/// `a/b.git` is), so the suffix rule cannot be dodged by a case variant whose
-/// `identity()` is refused. The repo's own byte alphabet excludes `/`, so a
-/// second `/` inside it is already refused by the byte check; no separate
-/// `contains('/')` check is needed.
-fn org_repo_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
-    let valid = value.split_once('/').is_some_and(|(owner, repo)| {
-        (1..=39).contains(&owner.len())
-            && owner.bytes().all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
-            && !owner.starts_with('-')
-            && !owner.ends_with('-')
-            && (1..=100).contains(&repo.len())
-            && repo.bytes().all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
-            && repo != "."
-            && repo != ".."
-            && !(repo.len() >= 4 && repo[repo.len() - 4..].eq_ignore_ascii_case(".git"))
-    });
-    if valid {
-        Ok(())
-    } else {
-        Err(format_error(field, value))
-    }
-}
-
-macro_rules! bounded_text {
-    ($($(#[$doc:meta])* $name:ident = $limit:literal, $check:expr;)*) => {$(
-        #[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
-        #[serde(transparent)]
-        #[schemars(extend("maxLength" = $limit))]
-        $(#[$doc])*
-        pub struct $name(pub String);
-        impl Bounded for $name {
-            fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-                let check: fn(&str, &str) -> Result<(), PipelineRefusal> = $check;
-                check(field, &self.0)
-            }
-        }
-        impl From<&str> for $name {
-            fn from(value: &str) -> Self {
-                Self(value.into())
-            }
-        }
-    )*};
-}
-
-fn within(limit: usize) -> impl Fn(&str, &str) -> Result<(), PipelineRefusal> {
-    move |field: &str, value: &str| bound(field, limit, value.len())
-}
-
-/// A title holds at least one `char::is_alphanumeric()` character, no
-/// `char::is_control()` character, no U+2028 LINE SEPARATOR or U+2029
-/// PARAGRAPH SEPARATOR (both `Zl`/`Zp`, so `is_control()` does not reach
-/// them, and a one-line field should carry no hard line break), and no bidi
-/// control character: `U+061C`, `U+200E`, `U+200F`, `U+202A`-`U+202E`,
-/// `U+2066`-`U+2069`. No denylist of individual zero-width or format
-/// characters is maintained here; a character not covered by one of these
-/// tests is allowed, so ZWJ and ZWNJ still work.
-fn title_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
-    let alphanumeric = value.chars().any(|character| character.is_alphanumeric());
-    let control = value
-        .chars()
-        .any(|character| character.is_control() || matches!(character, '\u{2028}' | '\u{2029}'));
-    let bidi = value.chars().any(|character| {
-        matches!(
-            character,
-            '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}'
-        )
-    });
-    if !alphanumeric || control || bidi {
-        return Err(format_error(field, value));
-    }
-    within(200)(field, value)
-}
-
-bounded_text! {
-    /// Text of at most 200 UTF-8 bytes.
-    Short = 200, |field, value| within(200)(field, value);
-    /// A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema
-    /// length counts characters. Holds at least one alphanumeric character,
-    /// no control character, and no bidi control character (`U+061C`,
-    /// `U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).
-    #[schemars(extend("minLength" = 1))]
-    Title = 200, title_text;
-    /// Text of at most 1,000 UTF-8 bytes.
-    Line = 1000, |field, value| within(1000)(field, value);
-    /// Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.
-    Para = 4000, |field, value| within(4000)(field, value);
-    /// A key label: `[A-Za-z0-9_-]{1,64}`.
-    Label = 64, label_text;
-    /// A campaign slug or key segment: label parts joined by `.`.
-    Slug = 64, dotted_text;
-    /// A git commit id: 7-40 lowercase hex characters.
-    Sha = 40, |field, value| hex(field, value, 7..=40);
-    /// A full git commit id: exactly 40 lowercase hex characters.
-    FullSha = 40, |field, value| hex(field, value, 40..=40);
-    /// A SHA-256 digest: exactly 64 lowercase hex characters.
-    Sha256Hex = 64, |field, value| hex(field, value, 64..=64);
-}
-
-impl Sha {
-    /// The type's identity rule: two spellings name one commit when one is a
-    /// prefix of the other, so a 7-character abbreviation and the full id of
-    /// the same commit are equal here though not `==`. Both are already 7-40
-    /// lowercase hex. Two distinct commits that share a 7-character prefix are
-    /// git's ambiguity, not the mind's.
-    pub fn names_same_commit(&self, other: &Sha) -> bool {
-        self.0.starts_with(&other.0) || other.0.starts_with(&self.0)
-    }
-}
-
-impl Slug {
-    /// The public door onto the slug grammar, for a caller outside this crate
-    /// that holds a bare `Slug` and no way to reach `Bounded`, which is
-    /// crate-private. On the pattern of `PipelineRef::validate_ref`: it
-    /// delegates so the grammar keeps one owner, and it applies exactly the
-    /// `dotted_text` check that every `Slug` field in this crate is held to,
-    /// so a caller that validates a declared name this way and a document
-    /// field of the same type refuse the same inputs. Named `validate_slug`
-    /// rather than a bare `validate`, because an inherent `validate` would
-    /// shadow `Bounded`'s for every in-crate caller holding a `Slug`.
-    pub fn validate_slug(&self) -> Result<(), PipelineRefusal> {
-        Bounded::validate(self, "slug")
-    }
-}
-
-/// A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +
-/// 100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or
-/// trailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never
-/// `.` or `..`, and does not end in `.git`, ASCII-case-insensitively.
-/// Identity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`
-/// are the same repository.
-//
-// The raw string is display-only. `OrgRepo` is not generated by
-// `bounded_text!`: that macro derives `PartialEq`, `Eq`, `Hash`, `PartialOrd`
-// and `Ord` on the raw string, with no per-member override, so a type built
-// from it compares and keys on spelling. `OrgRepo` instead carries
-// hand-written impls of those five traits, every one of them over
-// `identity()` (the ASCII-lowercased value), so `==`, a `BTreeMap` key and a
-// `HashMap` key are all case-insensitive by construction: `GameCult/Epiphany`
-// and `gamecult/epiphany` compare equal, hash equal, order together and
-// collapse to one map entry, and a caller cannot reach the case-sensitive
-// behaviour by accident. `Hash` and `Eq` agree because both are defined over
-// the same `identity()` string. Every other bounded type keeps the macro's
-// derives untouched. This reasoning is a source comment, not a doc comment,
-// so it does not enter the published schema description (RS-L closing fix 2):
-// a consumer needs the grammar, the bound and the case-insensitivity, not the
-// Rust-macro justification for how that got built.
-#[derive(Clone, Debug, Default, Serialize, Deserialize, JsonSchema)]
-#[serde(transparent)]
-#[schemars(extend("maxLength" = 140))]
-pub struct OrgRepo(pub String);
-
-impl Bounded for OrgRepo {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-        org_repo_text(field, &self.0)
-    }
-}
-
-impl From<&str> for OrgRepo {
-    fn from(value: &str) -> Self {
-        Self(value.into())
-    }
-}
-
-impl PartialEq for OrgRepo {
-    fn eq(&self, other: &Self) -> bool {
-        self.identity() == other.identity()
-    }
-}
-
-impl Eq for OrgRepo {}
-
-impl std::hash::Hash for OrgRepo {
-    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
-        self.identity().hash(state);
-    }
-}
-
-impl PartialOrd for OrgRepo {
-    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-impl Ord for OrgRepo {
-    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
-        self.identity().cmp(&other.identity())
-    }
-}
-
-impl OrgRepo {
-    /// The public door onto the `org_repo` grammar, for a caller outside this
-    /// crate that holds a bare `OrgRepo` (the organ's `repo` alias, RS-3) and
-    /// no way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
-    /// delegates to `org_repo_text` through `Bounded::validate`, so the
-    /// grammar keeps one owner and a declared name checked this way refuses
-    /// exactly what a document's own `OrgRepo` field refuses.
-    pub fn validate_org_repo(&self) -> Result<(), PipelineRefusal> {
-        Bounded::validate(self, "org_repo")
-    }
-
-    /// The one canonical key for an `OrgRepo`: the value, ASCII-lowercased.
-    /// Every comparison, hash, ordering and lookup keyed by repository
-    /// identity goes through this — `PartialEq`, `Hash` and `Ord` above are
-    /// all defined in terms of it — so `GameCult/Epiphany` and
-    /// `gamecult/epiphany` are the same repository everywhere, not only where
-    /// a caller remembers to ask.
-    pub fn identity(&self) -> String {
-        self.0.to_ascii_lowercase()
-    }
-}
-
-impl Label {
-    /// The public door onto the label grammar, for a caller outside this
-    /// crate that holds a bare `Label` (the organ's `cut` alias, RS-3) and no
-    /// way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
-    /// delegates to `label_text` through `Bounded::validate`, so the grammar
-    /// keeps one owner and a declared name checked this way refuses exactly
-    /// what a document's own `Label` field refuses.
-    pub fn validate_label(&self) -> Result<(), PipelineRefusal> {
-        Bounded::validate(self, "label")
-    }
-}
-
-/// A calendar date, `YYYY-MM-DD`.
-#[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
-#[serde(transparent)]
-#[schemars(extend("maxLength" = 10))]
-pub struct Date(pub String);
-
-impl Bounded for Date {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-        match chrono::NaiveDate::parse_from_str(&self.0, "%Y-%m-%d") {
-            Ok(_) if self.0.len() == 10 => Ok(()),
-            _ => Err(format_error(field, &self.0)),
-        }
-    }
-}
-
-macro_rules! bounded_field {
-    ($value:expr, $field:expr) => {
-        Bounded::validate(&$value, $field)?
-    };
-    ($value:expr, $field:expr, $max:literal) => {
-        list($field, &$value, $max)?
-    };
-}
-
-/// The single field list: one invocation emits the value struct and its
-/// `Bounded` impl, so a field can never be left out of validation.
-macro_rules! value_types {
-    ($($(#[$attr:meta])* pub struct $name:ident { $($field:ident: $ty:ty $([$max:literal])?),* $(,)? } $(=> $extra:path)?)*) => {$(
-        $(#[$attr])*
-        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-        pub struct $name {
-            $(
-                $(#[schemars(extend("maxItems" = $max))])?
-                pub $field: $ty
-            ),*
-        }
-
-        impl Bounded for $name {
-            fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
-                $(bounded_field!(self.$field, &format!("{at}.{}", stringify!($field)) $(, $max)?);)*
-                $($extra(self, at)?;)?
-                Ok(())
-            }
-        }
-    )*};
-}
-
-macro_rules! unit_enums {
-    ($($name:ident { $($variant:ident),* $(,)? })*) => {$(
-        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
-        pub enum $name { $($variant),* }
-        impl Bounded for $name {
-            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
-                Ok(())
-            }
-        }
-    )*};
-}
-
-/// RS-L closing fix 4: `campaign.repos` refuses two entries naming the same
-/// repository by identity, not by raw spelling, so `GameCult/Epiphany` and
-/// `gamecult/epiphany` in one list refuse exactly as one entry twice would.
-/// This is a cross-element invariant on `PipelineCampaign` alone, not a
-/// per-type format rule any other `value_types!` struct shares, so it is
-/// wired in as that struct's one `=> extra` hook rather than folded into
-/// `Bounded for OrgRepo` or the list bound in `bounded_field!`.
-fn campaign_repos_are_distinct(campaign: &PipelineCampaign, at: &str) -> Result<(), PipelineRefusal> {
-    let mut seen = std::collections::HashSet::new();
-    for repo in &campaign.repos {
-        if !seen.insert(repo.identity()) {
-            return Err(PipelineRefusal::DuplicateRepo {
-                field: format!("{at}.repos"),
-                repo: repo.0.clone(),
-            });
-        }
-    }
-    Ok(())
-}
-
-unit_enums! {
-    EvidenceKind { Command, Test, Mutation, Probe, SourceRead, Capture }
-    ClaimOutcome { Holds, Falsified, Unproven }
-    FindingConfidence { Confirmed, Plausible }
-    FindingSeverity { Blocker, High, Medium, Low }
-    RulingAuthority { Operator, Standing, Defaulted }
-    FindingOrigin { Introduced, PreExisting }
-}
-
-value_types! {
-    pub struct CodeLocation { path: Short, line: u32, end_line: Option<u32> }
-    pub struct CommitRange { base: Sha, head: Sha }
-    pub struct Evidence { kind: EvidenceKind, locator: Line, result: Line }
-    /// A citation of a document in another repo's pipeline store (D6).
-    pub struct ForeignRef { repo: OrgRepo, commit: FullSha, kind: PipelineKind, id: Short, payload_sha256: Sha256Hex }
-    pub struct DocRef { path: Short, start_line: u32, end_line: u32, commit: Sha }
-    pub struct TargetInvariant { label: Label, statement: Line }
-    pub struct QuestionOption { label: Label, text: Line }
-    pub struct CutDelete { path: Short, lines: u32, note: Line }
-    pub struct FileChange { location: CodeLocation, change: Line }
-    pub struct AuthorityMap {
-        owner: Line, inputs: Vec<Line>[16], outputs: Vec<Line>[16], derived_state: Vec<Line>[16],
-        forbidden_writers: Vec<Line>[16], shared_paths: Vec<Line>[16], deletion_line: Line,
-    }
-    pub struct VerificationTest { name: Short, pins: Line }
-    pub struct NegativeCheck { pattern: Short, scope: Line }
-    pub struct CutVerification {
-        builds: Vec<Line>[64], tests: Vec<VerificationTest>[64],
-        negative: Vec<NegativeCheck>[64], operator: Vec<Line>[64],
-    }
-    pub struct ReportCommit { sha: Sha, subject: Line, builds: bool }
-    /// One mutation a report ran: a key-safe label a verdict claim can name,
-    /// the exact edit, and the tree it was applied to.
-    pub struct MutationRecord { label: Label, rule: Line, location: CodeLocation, before: Line, after: Line, commit: Sha, failed_as_expected: bool }
-    pub struct Deviation { what: Line, why: Line }
-    // D1 tables no maximum for these lists, so they take the shared list
-    // default of 64 rather than a number invented for this field alone.
-    pub struct StructuralDelta {
-        lines_added: u32, lines_removed: u32,
-        dependencies_added: Vec<Short>[64], dependencies_removed: Vec<Short>[64],
-        formats_added: Vec<Short>[64], formats_removed: Vec<Short>[64],
-        targets_added: Vec<Short>[64], targets_removed: Vec<Short>[64],
-    }
-    /// A name the cut landed, and where it lives.
-    pub struct LandedName { name: Short, path: Short }
-    /// A promise a report makes about what it landed. Not a document and not
-    /// resolvable: it is identified by its report's id and its label, as a
-    /// `TargetInvariant` is by its target's. Soul measures every one (ruling
-    /// A), and the rule that every one is measured is admission's.
-    pub struct Promise { label: Label, text: Line }
-    /// The promise this claim measured, and the report's mutations it ran. An
-    /// `Unproven` claim with a promise is one Soul could not reach.
-    pub struct VerdictClaim {
-        claim: Line, outcome: ClaimOutcome, evidence: Vec<Evidence>[8], findings: Vec<Short>[16],
-        promise: Option<Label>, mutations: Vec<Label>[8],
-    }
-
-    pub struct PipelineCampaign { slug: Slug, title: Title, repos: Vec<OrgRepo>[8], working_branch: Short, target_doc: DocRef } => campaign_repos_are_distinct
-    pub struct PipelineTarget {
-        campaign: Slug, revision: u32, invariants: Vec<TargetInvariant>[32], not_in_scope: Vec<Line>[32],
-        canonical_implementations: Vec<Line>[16], doc: DocRef,
-    }
-    pub struct PipelineQuestion {
-        campaign: Slug, label: Label, title: Title, question: Para, options: Vec<QuestionOption>[8], recommended: Label,
-        depends: Vec<Line>[8], raised_in: Option<PipelineRef>, asked_on: Date,
-    }
-    pub struct PipelineRuling {
-        campaign: Slug, label: Label, title: Title, answers: Option<Short>, choice: Option<Label>, ruling: Para,
-        operator_quote: Option<Para>, ruled_on: Date, precedents: Vec<ForeignRef>[8], authority: RulingAuthority,
-    }
-    pub struct PipelineCutSpec {
-        campaign: Slug, cut: Label, revision: u32, title: Title, repo: OrgRepo, branch: Short, base: Sha,
-        depends_on: Vec<Short>[8], first: Vec<Line>[16], deletes: Vec<CutDelete>[64], keeps_moves: Vec<Line>[64],
-        adds: Vec<Line>[64], file_changes: Vec<FileChange>[256], authority_map: Option<AuthorityMap>,
-        verification: CutVerification, estimate: StructuralDelta,
-        rulings: Vec<Short>[32], questions: Vec<Short>[16],
-    }
-    pub struct PipelineCutReport {
-        campaign: Slug, cut_spec: Short, attempt: u32, repo: OrgRepo, branch: Short,
-        commits: Vec<ReportCommit>[128], range: CommitRange, verification: Vec<Evidence>[64],
-        mutations: Vec<MutationRecord>[64], deviations: Vec<Deviation>[32], forks: Vec<Short>[8],
-        structural_delta: StructuralDelta, landed_names: Vec<LandedName>[128], undone: Vec<Line>[32],
-        promises: Vec<Promise>[64],
-    }
-    pub struct PipelineVerdict { campaign: Slug, cut_report: Short, pass: u32, range: CommitRange, claims: Vec<VerdictClaim>[64] }
-    pub struct PipelineFinding {
-        campaign: Slug, verdict: Short, label: Label, range: CommitRange, confidence: FindingConfidence,
-        severity: FindingSeverity, claim: Line, invariants: Vec<Label>[8], locations: Vec<CodeLocation>[16],
-        failure_scenario: Para, evidence: Vec<Evidence>[16], precedents: Vec<ForeignRef>[8], origin: FindingOrigin,
-    }
-    pub struct PipelineFollowUp {
-        campaign: Slug, label: Label, source: PipelineRef, repo: OrgRepo, locations: Vec<CodeLocation>[16],
-        item: Line, why_it_can_wait: Line, owner: Short,
-    }
-    /// The record of how a subject was closed and by what. `sequence` is per
-    /// subject and set by the writer, `1` for the first, and it is the last
-    /// part of the key, so a subject's resolutions share a prefix and a
-    /// withdrawn one is kept under its subject rather than overwritten.
-    /// Whether a sequence is the previous plus one, and whether an earlier
-    /// resolution still stands, are admission's rules: this crate refuses
-    /// neither `0` nor a gap, exactly as it refuses neither `revision: 0` nor
-    /// a `revision` with no predecessor.
-    pub struct PipelineResolution { subject: PipelineRef, sequence: u32, outcome: ResolutionOutcome, rationale: Para, resolved_on: Date }
-
-    /// A mind's identity document. A store is canonical to exactly one
-    /// instance, and this says which; identity lives in the state, not in a
-    /// path.
-    pub struct PipelineInstance { instance: Slug, display_name: Short, created_at: Date, host: Short }
-    /// Stewardship over a repo, as an assignment recorded in a mind. One
-    /// instance may steward several repos, so the repo is part of the key.
-    /// `sequence` is per `(instance, repo)`, set by the writer, `1` for the
-    /// first, so a repo transferred away and back is two records under one
-    /// prefix rather than one document overwriting the other. `assigned_on`
-    /// is a field, not a key part. As on a resolution, whether the sequence
-    /// is the previous plus one, and which assignment is in force, are
-    /// admission's rules and not this crate's.
-    pub struct PipelineStewardship { instance: Slug, repo: OrgRepo, sequence: u32, assigned_on: Date, note: Line }
-    /// A reassignment of stewardship, recorded in both minds. `documents` names
-    /// what travels with it.
-    pub struct PipelineHandOff {
-        from_instance: Slug, to_instance: Slug, repo: OrgRepo, documents: Vec<Short>[256],
-        reason: Para, handed_on: Date,
-    }
-}
-
-/// A reference to another document. The id is parsed as a full pipeline id of
-/// the declared `kind`, so the kind and the id's kind segment cannot disagree.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-pub struct PipelineRef {
-    pub kind: PipelineKind,
-    pub id: Short,
-}
-
-impl Bounded for PipelineRef {
-    fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
-        self.id.validate(&format!("{at}.id"))?;
-        pipeline_id(&format!("{at}.id"), &self.id.0, self.kind).map(|_| ())
-    }
-}
-
-impl PipelineRef {
-    /// The grammar's door for a reader holding a bare reference. A read side
-    /// outside this crate is handed a `kind` and an `id` that may disagree, and
-    /// `Bounded` is crate-private, so without this there is no way to ask; a
-    /// reader with no way to ask answers empty, which reads as "no such
-    /// document" rather than "that is not a reference". It delegates, so the
-    /// grammar keeps one owner: this is exactly what a document's own
-    /// `PipelineRef` field is held to, at the field name `ref`. It is kind-deep,
-    /// like every other read of an id: whether the named document exists, and
-    /// whether the local's shape suits the kind, are admission's rules.
-    ///
-    /// A method rather than a free function because it concerns one public
-    /// type, as `prepare` and `decode` do; the two free doors act on a cache or
-    /// an envelope this crate does not own. `validate_ref` rather than a bare
-    /// `validate`, because an inherent `validate` would shadow `Bounded`'s for
-    /// every in-crate caller holding a `PipelineRef`.
-    pub fn validate_ref(&self) -> Result<(), PipelineRefusal> {
-        self.validate("ref")
-    }
-}
-
-/// How a subject was resolved. Every referent is a parsed `PipelineRef`, so a
-/// resolution names its records by ids of the kinds they declare, validated
-/// where every other referent is; a `Fixed` commit is a `Sha` whose referent
-/// is outside the document set (ruling B). Whether a named document exists,
-/// and how many may supersede one subject, are admission's rules.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-pub enum ResolutionOutcome {
-    /// Overturned, in whole or in part, by later records. The list is bounded
-    /// here because the enum is outside `value_types!`, the only place a list
-    /// maximum is emitted automatically.
-    Superseded {
-        #[schemars(extend("maxItems" = 8))]
-        by: Vec<PipelineRef>,
-    },
-    Answered { by: PipelineRef },
-    Fixed { commit: Sha, by: Option<PipelineRef> },
-    Deferred { to: PipelineRef },
-    Recorded { reason: Line },
-    Withdrawn { reason: Line },
-}
-
-impl Bounded for ResolutionOutcome {
-    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
-        match self {
-            Self::Superseded { by } => list(&format!("{field}.by"), by, 8),
-            Self::Answered { by } => by.validate(&format!("{field}.by")),
-            Self::Fixed { commit, by } => {
-                commit.validate(&format!("{field}.commit"))?;
-                by.validate(&format!("{field}.by"))
-            }
-            Self::Deferred { to } => to.validate(&format!("{field}.to")),
-            Self::Recorded { reason } | Self::Withdrawn { reason } => reason.validate(&format!("{field}.reason")),
-        }
-    }
-}
-
-macro_rules! pipeline_kinds {
-    ($($variant:ident($value:ident) => $document:ident, $name:literal, $type_id:tt, $schema:tt;)*) => {
-        $(
-            #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
-            #[cultcache(type = $type_id, schema = $schema)]
-            pub(crate) struct $document {
-                #[cultcache(key = 0)]
-                pub(crate) value: $value,
-            }
-        )*
-
-        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
-        pub enum PipelineKind { $($variant),* }
-
-        impl Bounded for PipelineKind {
-            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
-                Ok(())
-            }
-        }
-
-        /// The envelope enum, adjacently tagged on the kind name: a document
-        /// on a wire is `{ kind, value }`, and `kind` is exactly what
-        /// `PipelineKind::name()` returns, so a reader dispatches on the kind
-        /// segment it already knows from the key and needs no second registry
-        /// mapping variant spellings to kinds. Adjacent rather than internal
-        /// because a value is a named map of its own and an internal tag would
-        /// have to be merged into it; the tag stays beside the value instead.
-        /// This is not a published schema: `schemas/cultnet` publishes the
-        /// thirteen per-kind value documents, and the envelope is the wire's
-        /// shape, not a document's.
-        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-        #[serde(tag = "kind", content = "value", rename_all = "snake_case")]
-        pub enum PipelineDocument { $($variant($value)),* }
-
-        impl PipelineKind {
-            pub const ALL: &'static [PipelineKind] = &[$(Self::$variant),*];
-
-            /// The kind segment of a document key.
-            pub fn name(self) -> &'static str {
-                match self { $(Self::$variant => $name),* }
-            }
-
-            pub fn type_id(self) -> &'static str {
-                match self { $(Self::$variant => <$document as DatabaseEntry>::TYPE),* }
-            }
-
-            #[cfg(test)]
-            pub(crate) fn schema_name(self) -> &'static str {
-                match self { $(Self::$variant => <$document as DatabaseEntry>::SCHEMA_NAME),* }
-            }
-
-            #[cfg(test)]
-            pub(crate) fn derived_schema(self) -> schemars::Schema {
-                match self { $(Self::$variant => schemars::schema_for!($value)),* }
-            }
-        }
-
-        impl PipelineDocument {
-            pub fn kind(&self) -> PipelineKind {
-                match self { $(Self::$variant(_) => PipelineKind::$variant),* }
-            }
-
-            /// Field bounds and formats (D1), in UTF-8 bytes and list maximums.
-            pub fn validate(&self) -> Result<(), PipelineRefusal> {
-                match self { $(Self::$variant(value) => value.validate($name)),* }
-            }
-
-            /// Prepares the envelope to be stored: keyed by `pipeline_key`,
-            /// payload `[value]` through `prepare_entry_named`.
-            pub fn prepare(&self, cache: &CultCache) -> Result<CultCacheEnvelope> {
-                let key = pipeline_key(self)?;
-                Ok(match self {
-                    $(Self::$variant(value) => {
-                        cache.prepare_entry_named(key, &$document { value: value.clone() })?.0
-                    })*
-                })
-            }
-
-            /// Decodes a stored envelope, type-matched both ways: an envelope of
-            /// any other type is `ForeignStore`, never the kind that happens to
-            /// parse its payload. It validates neither bounds nor the key: a
-            /// decoded document is a typed read, and
-            /// `validate_pipeline_write_envelope` is the check before a write.
-            pub fn decode(envelope: &CultCacheEnvelope) -> Result<Self, PipelineRefusal> {
-                let invalid = |error: rmp_serde::decode::Error| format_error("payload", &error.to_string());
-                $(if envelope.r#type == <$document as DatabaseEntry>::TYPE {
-                    let document: $document = rmp_serde::from_slice(&envelope.payload).map_err(invalid)?;
-                    return Ok(Self::$variant(document.value));
-                })*
-                Err(PipelineRefusal::ForeignStore { r#type: envelope.r#type.clone() })
-            }
-        }
-
-        /// Registers every pipeline kind in a cache, and nothing else: the one
-        /// door to the crate-private wrappers, so a caller registers exactly
-        /// what this crate publishes.
-        pub fn register_pipeline_document_types(cache: &mut CultCache) -> Result<()> {
-            $(cache.register_entry_type::<$document>()?;)*
-            Ok(())
-        }
-    };
-}
-
-/// A document that is not a pipeline document, for the decode refusal and the
-/// registrar's count to be pinned against something real. It stands in for
-/// any other document a store may hold beside pipeline documents, a commit
-/// receipt say, which is still not a document this library may decode. The
-/// stand-in carries a receipt-shaped type id and is registered only by the
-/// tests' own cache, never by the live registrar.
-#[cfg(test)]
-#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
-#[cultcache(type = "epiphany.mind_commit_receipt.v1", schema = "ForeignDocument")]
-pub(crate) struct ForeignDocument {
-    #[cultcache(key = 0)]
-    pub(crate) marker: Short,
-}
-
-pipeline_kinds! {
-    Campaign(PipelineCampaign) => EpiphanyPipelineCampaignDocument, "campaign",
-        "epiphany.pipeline.campaign.v2", "EpiphanyPipelineCampaignDocument";
-    Target(PipelineTarget) => EpiphanyPipelineTargetDocument, "target",
-        "epiphany.pipeline.target.v2", "EpiphanyPipelineTargetDocument";
-    Question(PipelineQuestion) => EpiphanyPipelineQuestionDocument, "question",
-        "epiphany.pipeline.question.v2", "EpiphanyPipelineQuestionDocument";
-    Ruling(PipelineRuling) => EpiphanyPipelineRulingDocument, "ruling",
-        "epiphany.pipeline.ruling.v2", "EpiphanyPipelineRulingDocument";
-    CutSpec(PipelineCutSpec) => EpiphanyPipelineCutSpecDocument, "cut_spec",
-        "epiphany.pipeline.cut_spec.v2", "EpiphanyPipelineCutSpecDocument";
-    CutReport(PipelineCutReport) => EpiphanyPipelineCutReportDocument, "cut_report",
-        "epiphany.pipeline.cut_report.v2", "EpiphanyPipelineCutReportDocument";
-    Verdict(PipelineVerdict) => EpiphanyPipelineVerdictDocument, "verdict",
-        "epiphany.pipeline.verdict.v2", "EpiphanyPipelineVerdictDocument";
-    Finding(PipelineFinding) => EpiphanyPipelineFindingDocument, "finding",
-        "epiphany.pipeline.finding.v2", "EpiphanyPipelineFindingDocument";
-    FollowUp(PipelineFollowUp) => EpiphanyPipelineFollowUpDocument, "follow_up",
-        "epiphany.pipeline.follow_up.v2", "EpiphanyPipelineFollowUpDocument";
-    Resolution(PipelineResolution) => EpiphanyPipelineResolutionDocument, "resolution",
-        "epiphany.pipeline.resolution.v2", "EpiphanyPipelineResolutionDocument";
-    Instance(PipelineInstance) => EpiphanyPipelineInstanceDocument, "instance",
-        "epiphany.pipeline.instance.v2", "EpiphanyPipelineInstanceDocument";
-    Stewardship(PipelineStewardship) => EpiphanyPipelineStewardshipDocument, "stewardship",
-        "epiphany.pipeline.stewardship.v2", "EpiphanyPipelineStewardshipDocument";
-    HandOff(PipelineHandOff) => EpiphanyPipelineHandOffDocument, "hand_off",
-        "epiphany.pipeline.hand_off.v2", "EpiphanyPipelineHandOffDocument";
-}
-
-/// Parses a full document id: the grammar read backwards. A key and an id are
-/// the same string, so this accepts exactly what `pipeline_key` derives:
-/// `<root>:<kind>:<local>`, three segments for every kind. The kind segment
-/// must equal `kind`'s name, the root is a `Slug`, and the local is `Label`s
-/// joined by `.` and bounded whole by `local_max(kind)`, so `..`, an empty part, spaces and trailing
-/// junk are all refused. Returns the root and the local; nothing is inferred
-/// from either, and no kind is read any other way.
-fn pipeline_id<'a>(
-    field: &str,
-    id: &'a str,
-    kind: PipelineKind,
-) -> Result<(&'a str, &'a str), PipelineRefusal> {
-    let mut segments = id.split(':');
-    let (Some(root), Some(name), Some(local), None) = (
-        segments.next(),
-        segments.next(),
-        segments.next(),
-        segments.next(),
-    ) else {
-        return Err(format_error(field, id));
-    };
-    if name != kind.name() {
-        return Err(format_error(field, id));
-    }
-    dotted_text(field, root)?;
-    dotted_within(field, local, local_max(kind))?;
-    Ok((root, local))
-}
-
-/// The local segment of a parent id in `campaign`, of the expected kind.
-fn parent_local<'a>(
-    field: &str,
-    id: &'a str,
-    campaign: &str,
-    kind: PipelineKind,
-) -> Result<&'a str, PipelineRefusal> {
-    let (owner, local) = pipeline_id(field, id, kind)?;
-    if owner != campaign {
-        return Err(format_error(field, id));
-    }
-    Ok(local)
-}
-
-/// The cut label inside a parent local `cut-<label>.<marker><N>`: exactly two
-/// parts, the label a `Label` and `<N>` a non-empty run of digits.
-fn parent_cut<'a>(field: &str, local: &'a str, marker: char) -> Result<&'a str, PipelineRefusal> {
-    let invalid = || format_error(field, local);
-    let mut parts = local.split('.');
-    let (Some(head), Some(suffix), None) = (parts.next(), parts.next(), parts.next()) else {
-        return Err(invalid());
-    };
-    let cut = head.strip_prefix("cut-").ok_or_else(invalid)?;
-    label_text(field, cut)?;
-    let digits = suffix.strip_prefix(marker).ok_or_else(invalid)?;
-    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
-        return Err(invalid());
-    }
-    Ok(cut)
-}
-
-/// A `Slug` or an `OrgRepo` entering a local, escaped to one label. `/` is not
-/// a `Label` byte, so it cannot survive into a key, and neither may `.`: no
-/// local part carries the separator, or the boundary before it would have two
-/// readings. A dotted slug and a dotted repo name are both ordinary, so both
-/// bytes are escaped rather than refused. The escape has to be injective or two
-/// values claim one key: replacing `/` with `_` alone is not, since
-/// `GameCult_Epiphany/thing` and `GameCult/Epiphany_thing` both give
-/// `GameCult_Epiphany_thing`. So `_` is escaped as well, and every code is two
-/// bytes starting with `_`: `_` becomes `__`, `/` becomes `_-`, and `.` becomes
-/// `_d`. Every other byte is passed through and is never `_`, so a reader going
-/// left to right takes each `_` together with the byte after it and never has a
-/// choice to make; the encoding is therefore reversible, and distinct values
-/// give distinct segments. The caller validates the value as its own type first
-/// and checks the result against the local's rules, which is where an over-long
-/// or otherwise unlabelled value is refused.
-fn key_segment(value: &str) -> String {
-    value.replace('_', "__").replace('/', "_-").replace('.', "_d")
-}
-
-/// The local of a root. A campaign's or an instance's identity is entirely its
-/// root segment, so its local carries none; a reader never consults it.
-const ROOT_LOCAL: &str = "self";
-
-/// The bound on a composed local of every kind but a resolution, whole, in
-/// UTF-8 bytes. Every stored subject key is within it.
-const SUBJECT_LOCAL_MAX: usize = 64;
-
-/// The longest kind name a resolution can name as its subject (`stewardship`),
-/// checked against `PipelineKind::ALL` by a test.
-const LONGEST_KIND_NAME: usize = "stewardship".len();
-
-/// A `.n<sequence>` part at `u32::MAX`.
-const SEQUENCE_PART_MAX: usize = ".n".len() + "4294967295".len();
-
-/// The bound on a resolution's local: a depth-two chain over a maximal
-/// subject, `resolution.<kind>.<subject local>.n<seq>.n<seq>`, at `u32::MAX`
-/// sequences. Depth is capped at two by admission (Q19), and this bound admits
-/// exactly that for every subject, so no subject is born unresolvable. Derived
-/// from `SUBJECT_LOCAL_MAX` and the kind names, never written as a number.
-const RESOLUTION_LOCAL_MAX: usize = "resolution.".len() + LONGEST_KIND_NAME + ".".len() + SUBJECT_LOCAL_MAX + 2 * SEQUENCE_PART_MAX;
-
-// `<root>:<kind>:<local>` must fit a `Short` wherever an id is cited.
-const _: () = assert!(64 + ":".len() + LONGEST_KIND_NAME + ":".len() + RESOLUTION_LOCAL_MAX <= 200);
-
-/// The bound on a kind's composed local, chosen here and nowhere else.
-fn local_max(kind: PipelineKind) -> usize {
-    match kind {
-        PipelineKind::Resolution => RESOLUTION_LOCAL_MAX,
-        _ => SUBJECT_LOCAL_MAX,
-    }
-}
-
-/// The schema epoch every pipeline store is written at, owned here with the
-/// schemas it names. Evolution is additive and keeps it: a new named field
-/// with a serde default, or a widened `PipelineKind`, since each reader ships
-/// with the variants it knows and refuses an unknown kind on the kind, not on
-/// the epoch. A breaking change bumps it, so that a store written at the old
-/// one can be refused by whoever opens it; this crate owns no store and
-/// refuses none.
-pub const PIPELINE_SCHEMA_EPOCH: &str = "epiphany.pipeline.epoch.v2";
-
-/// Composes and validates a local: every part is a `Label`, and the join is
-/// bounded whole by `local_max(kind)`. Both rules live here because this is the only way a local is
-/// built; `pipeline_key` has no other path to a key string. Parts are a slice,
-/// not a builder, so an arm's arity is written at its call site.
-fn local(field: &str, kind: PipelineKind, parts: &[&str]) -> Result<String, PipelineRefusal> {
-    for part in parts {
-        label_text(field, part)?;
-    }
-    let joined = parts.join(".");
-    if joined.len() > local_max(kind) {
-        return Err(format_error(field, &joined));
-    }
-    Ok(joined)
-}
-
-/// Derives a document's identity key (D1, "Keys: identity, not convenience").
-/// Thirteen arms, one exit: every arm names its root and composes its local
-/// through `local`, and the key is formatted here and nowhere else.
-pub fn pipeline_key(document: &PipelineDocument) -> Result<String, PipelineRefusal> {
-    use PipelineDocument as D;
-    let document_kind = document.kind();
-    let kind = document_kind.name();
-    let key_field = format!("{kind}.key");
-    let campaign_field = format!("{kind}.campaign");
-    let (root_field, root, composed) = match document {
-        D::Campaign(value) => ("campaign.slug", value.slug.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
-        D::Instance(value) => ("instance.instance", value.instance.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
-        // A resolution is keyed inside its subject's root, with the subject's
-        // kind and local as its own local and its per-subject sequence last, so
-        // the subject's resolutions and only they share the prefix
-        // `<root>:resolution:<kind>.<local>.n`. A resolution's own key is an
-        // ordinary id, so it composes as a subject like any other; each nesting
-        // prepends `resolution.` (11 bytes) and appends `.n<s>` (3 bytes for
-        // one digit). Depth is capped at two by admission (Q19), and
-        // `RESOLUTION_LOCAL_MAX` admits exactly a depth-two chain over a
-        // maximal subject, so every subject resolves and its resolution can be
-        // withdrawn.
-        D::Resolution(value) => {
-            let field = "resolution.subject.id";
-            let (subject_root, subject_local) = pipeline_id(field, &value.subject.id.0, value.subject.kind)?;
-            let sequence = format!("n{}", value.sequence);
-            let parts = std::iter::once(value.subject.kind.name()).chain(subject_local.split('.')).chain(std::iter::once(sequence.as_str())).collect::<Vec<_>>();
-            (field, subject_root, local(&key_field, document_kind, &parts)?)
-        }
-        // Stewardship and hand-off hang off an instance rather than a campaign.
-        // The root is the whole difference; the key shape is the same.
-        D::Stewardship(value) => {
-            org_repo_text("stewardship.repo", &value.repo.0)?;
-            let sequence = format!("n{}", value.sequence);
-            (
-                "stewardship.instance",
-                value.instance.0.as_str(),
-                local(&key_field, document_kind, &[&key_segment(&value.repo.identity()), &sequence])?,
-            )
-        }
-        D::HandOff(value) => {
-            dotted_text("hand_off.to_instance", &value.to_instance.0)?;
-            org_repo_text("hand_off.repo", &value.repo.0)?;
-            value.handed_on.validate("hand_off.handed_on")?;
-            (
-                "hand_off.from_instance",
-                value.from_instance.0.as_str(),
-                local(
-                    &key_field,
-                    document_kind,
-                    &[&key_segment(&value.to_instance.0), &key_segment(&value.repo.identity()), &value.handed_on.0],
-                )?,
-            )
-        }
-        D::Target(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&format!("r{}", value.revision)])?),
-        D::Question(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
-        D::Ruling(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
-        D::FollowUp(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
-        D::CutSpec(value) => (
-            campaign_field.as_str(),
-            value.campaign.0.as_str(),
-            local(&key_field, document_kind, &[&format!("cut-{}", value.cut.0), &format!("r{}", value.revision)])?,
-        ),
-        D::CutReport(value) => {
-            let spec = parent_local("cut_report.cut_spec", &value.cut_spec.0, &value.campaign.0, PipelineKind::CutSpec)?;
-            let cut = parent_cut("cut_report.cut_spec", spec, 'r')?;
-            (
-                campaign_field.as_str(),
-                value.campaign.0.as_str(),
-                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("h{}", value.attempt)])?,
-            )
-        }
-        D::Verdict(value) => {
-            let report = parent_local("verdict.cut_report", &value.cut_report.0, &value.campaign.0, PipelineKind::CutReport)?;
-            let cut = parent_cut("verdict.cut_report", report, 'h')?;
-            (
-                campaign_field.as_str(),
-                value.campaign.0.as_str(),
-                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("s{}", value.pass)])?,
-            )
-        }
-        D::Finding(value) => {
-            let verdict = parent_local("finding.verdict", &value.verdict.0, &value.campaign.0, PipelineKind::Verdict)?;
-            parent_cut("finding.verdict", verdict, 's')?;
-            let parts = verdict.split('.').chain(std::iter::once(value.label.0.as_str())).collect::<Vec<_>>();
-            (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &parts)?)
-        }
-    };
-    dotted_text(root_field, root)?;
-    Ok(format!("{root}:{kind}:{composed}"))
-}
-
-/// Bounds, formats, then key recomputation, on the envelope that will be
-/// stored, whoever prepared it. It is the whole of what this crate checks
-/// before a write; per-kind and cross-document rules are not decided here and
-/// belong to the admission path of the organ that will admit these documents,
-/// which is expected to call this first rather than re-derive it.
-pub fn validate_pipeline_write_envelope(envelope: &CultCacheEnvelope) -> Result<(), PipelineRefusal> {
-    let document = PipelineDocument::decode(envelope)?;
-    document.validate()?;
-    let expected = pipeline_key(&document)?;
-    if envelope.key != expected {
-        return Err(PipelineRefusal::InvalidIdentity {
-            kind: document.kind(),
-            key: envelope.key.clone(),
-            expected,
-        });
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::BTreeSet;
-    use std::path::Path;
-
-    const CAMPAIGN: &str = "eureka-state";
-    const INSTANCE: &str = "yggdrasil";
-
-    fn s(value: &str) -> Short {
-        value.into()
-    }
-
-    fn t(value: &str) -> Title {
-        value.into()
-    }
-
-    fn l(value: &str) -> Label {
-        value.into()
-    }
-
-    fn slug(value: &str) -> Slug {
-        value.into()
-    }
-
-    fn id(kind: &str, local: &str) -> Short {
-        Short(format!("{CAMPAIGN}:{kind}:{local}"))
-    }
-
-    fn sha() -> Sha {
-        Sha("5f98228d".into())
-    }
-
-    fn date() -> Date {
-        Date("2026-09-15".into())
-    }
-
-    fn range() -> CommitRange {
-        CommitRange { base: sha(), head: sha() }
-    }
-
-    fn location() -> CodeLocation {
-        CodeLocation { path: s("crates/eureka-pipeline/src/lib.rs"), line: 1, end_line: Some(9) }
-    }
-
-    fn evidence() -> Evidence {
-        Evidence { kind: EvidenceKind::Test, locator: "cargo test".into(), result: "ok".into() }
-    }
-
-    fn doc_ref() -> DocRef {
-        DocRef { path: s("notes/eureka-pipeline-state-target.md"), start_line: 1, end_line: 9, commit: sha() }
-    }
-
-    /// One valid document of every kind, with its expected key.
-    fn samples() -> Vec<(PipelineDocument, String)> {
-        use PipelineDocument as D;
-        let repo = || OrgRepo("GameCult/Epiphany".into());
-        let branch = || s("codex/eureka-pipeline-state");
-        vec![
-            (D::Campaign(PipelineCampaign {
-                slug: slug(CAMPAIGN), title: t("Eureka pipeline state"), repos: vec![repo()],
-                working_branch: branch(), target_doc: doc_ref(),
-            }), format!("{CAMPAIGN}:campaign:self")),
-            (D::Target(PipelineTarget {
-                campaign: slug(CAMPAIGN), revision: 2,
-                invariants: vec![TargetInvariant { label: l("mind-admits"), statement: "Only admission writes.".into() }],
-                not_in_scope: vec!["Eve browsing".into()], canonical_implementations: vec!["CultLib".into()], doc: doc_ref(),
-            }), format!("{CAMPAIGN}:target:r2")),
-            (D::Question(PipelineQuestion {
-                campaign: slug(CAMPAIGN), label: l("Q1"), title: t("Who owns the state?"), question: "Who owns the state?".into(),
-                options: vec![
-                    QuestionOption { label: l("A"), text: "an instance".into() },
-                    QuestionOption { label: l("B"), text: "a repo".into() },
-                ],
-                recommended: l("A"), depends: vec!["Cut 3a".into()],
-                raised_in: Some(PipelineRef { kind: PipelineKind::CutSpec, id: id("cut_spec", "cut-3a.r1") }),
-                asked_on: date(),
-            }), format!("{CAMPAIGN}:question:Q1")),
-            (D::Ruling(PipelineRuling {
-                campaign: slug(CAMPAIGN), label: l("R8"), title: t("An instance owns its mind"), answers: Some(id("question", "Q1")), choice: Some(l("A")),
-                ruling: "An instance owns its mind.".into(), operator_quote: Some("all recommendations, go ahead".into()),
-                ruled_on: date(),
-                precedents: vec![ForeignRef {
-                    repo: OrgRepo("GameCult/Aetheria".into()), commit: FullSha("a".repeat(40)), kind: PipelineKind::Ruling,
-                    id: s("cultcache:ruling:R1"), payload_sha256: Sha256Hex("b".repeat(64)),
-                }],
-                authority: RulingAuthority::Operator,
-            }), format!("{CAMPAIGN}:ruling:R8")),
-            (D::CutSpec(PipelineCutSpec {
-                campaign: slug(CAMPAIGN), cut: l("3a"), revision: 1, title: t("Pipeline documents"), repo: repo(),
-                branch: branch(), base: sha(), depends_on: vec![s("2")], first: vec!["Read the spec.".into()],
-                deletes: vec![CutDelete { path: s("old.rs"), lines: 3, note: "dead".into() }],
-                keeps_moves: vec!["commit owner".into()], adds: vec!["pipeline_documents.rs".into()],
-                file_changes: vec![FileChange { location: location(), change: "add".into() }],
-                authority_map: Some(AuthorityMap {
-                    owner: "core".into(), inputs: vec!["typed documents".into()], outputs: vec!["envelopes".into()],
-                    derived_state: vec!["derived keys".into()], forbidden_writers: vec!["MCP".into()],
-                    shared_paths: vec!["admission".into()], deletion_line: "n/a".into(),
-                }),
-                verification: CutVerification {
-                    builds: vec!["cargo check".into()],
-                    tests: vec![VerificationTest { name: s("keys"), pins: "one derived key".into() }],
-                    negative: vec![NegativeCheck { pattern: s("Vec<u8>"), scope: "documents".into() }],
-                    operator: vec!["none".into()],
-                },
-                // Cut 3a's real numbers, and in this order: the tripwire test
-                // reads them back, so a transposition is a failure, not a typo.
-                estimate: StructuralDelta {
-                    lines_added: 900, lines_removed: 0,
-                    dependencies_added: vec![s("schemars")], dependencies_removed: vec![],
-                    formats_added: vec![s("epiphany.pipeline.*.v1")], formats_removed: vec![],
-                    targets_added: vec![], targets_removed: vec![],
-                },
-                rulings: vec![id("ruling", "R8")], questions: vec![id("question", "Q1")],
-            }), format!("{CAMPAIGN}:cut_spec:cut-3a.r1")),
-            (D::CutReport(PipelineCutReport {
-                campaign: slug(CAMPAIGN), cut_spec: id("cut_spec", "cut-3a.r1"), attempt: 1, repo: repo(), branch: branch(),
-                commits: vec![ReportCommit { sha: sha(), subject: "Add the pipeline documents".into(), builds: true }],
-                range: range(), verification: vec![evidence()],
-                mutations: vec![MutationRecord {
-                    // `.into()` on both, not `l()` and `sha()`: the type-level
-                    // mutations (M19, M20) widen these fields to `Short`, and
-                    // a sample spelled with the narrow constructors would stop
-                    // compiling instead of letting the forgery through.
-                    label: "M1".into(), rule: "key derivation".into(), location: location(),
-                    before: "parent_cut(field, spec, 'r')?".into(), after: "spec".into(), commit: "5f98228d".into(),
-                    failed_as_expected: true,
-                }],
-                deviations: vec![Deviation { what: "names".into(), why: "glob exports".into() }],
-                forks: vec![id("question", "Q1")],
-                structural_delta: StructuralDelta {
-                    lines_added: 900, lines_removed: 0, dependencies_added: vec![s("schemars")],
-                    dependencies_removed: vec![], formats_added: vec![s("epiphany.pipeline.*.v1")],
-                    formats_removed: vec![], targets_added: vec![], targets_removed: vec![],
-                },
-                landed_names: vec![LandedName { name: s("PipelineDocument"), path: s("crates/eureka-pipeline/src/lib.rs") }],
-                undone: vec!["admission".into()],
-                promises: vec![Promise { label: l("P1"), text: "One derived key per document.".into() }],
-            }), format!("{CAMPAIGN}:cut_report:cut-3a.h1")),
-            (D::Verdict(PipelineVerdict {
-                campaign: slug(CAMPAIGN), cut_report: id("cut_report", "cut-3a.h1"), pass: 2, range: range(),
-                claims: vec![VerdictClaim {
-                    claim: "A composed key has one source.".into(), outcome: ClaimOutcome::Falsified,
-                    evidence: vec![evidence()], findings: vec![id("finding", "cut-3a.s2.F4")],
-                    promise: Some(l("P1")), mutations: vec![l("M1")],
-                }],
-            }), format!("{CAMPAIGN}:verdict:cut-3a.s2")),
-            (D::Finding(PipelineFinding {
-                campaign: slug(CAMPAIGN), verdict: id("verdict", "cut-3a.s2"), label: l("F4"), range: range(),
-                confidence: FindingConfidence::Confirmed, severity: FindingSeverity::High,
-                claim: "A dotted label composes two keys.".into(), invariants: vec![l("mind-admits")],
-                locations: vec![location()], failure_scenario: "Two documents claim one key.".into(),
-                evidence: vec![evidence()], precedents: vec![], origin: FindingOrigin::Introduced,
-            }), format!("{CAMPAIGN}:finding:cut-3a.s2.F4")),
-            (D::FollowUp(PipelineFollowUp {
-                campaign: slug(CAMPAIGN), label: l("FU-4"),
-                source: PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") },
-                repo: repo(), locations: vec![location()], item: "Per-kind admission rules.".into(),
-                why_it_can_wait: "The organ owns admission.".into(), owner: s("Hands"),
-            }), format!("{CAMPAIGN}:follow_up:FU-4")),
-            (D::Resolution(PipelineResolution {
-                subject: PipelineRef { kind: PipelineKind::Question, id: id("question", "Q1") }, sequence: 1,
-                outcome: ResolutionOutcome::Answered { by: PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") } },
-                rationale: "Ruled A.".into(), resolved_on: date(),
-            }), format!("{CAMPAIGN}:resolution:question.Q1.n1")),
-            // The mind's own three kinds. They are appended rather than
-            // inserted because the helpers below index this list by position.
-            (D::Instance(PipelineInstance {
-                instance: slug(INSTANCE), display_name: s("Yggdrasil mind"), created_at: date(),
-                host: s("yggdrasil"),
-            }), format!("{INSTANCE}:instance:self")),
-            (D::Stewardship(PipelineStewardship {
-                instance: slug(INSTANCE), repo: repo(), sequence: 1, assigned_on: date(),
-                note: "The Eureka campaign repo.".into(),
-            }), format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")),
-            (D::HandOff(PipelineHandOff {
-                from_instance: slug(INSTANCE), to_instance: slug("thought-cage"), repo: repo(),
-                documents: vec![s(CAMPAIGN), id("ruling", "R8")],
-                reason: "The workstation mind takes the campaign.".into(), handed_on: date(),
-            }), format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.{}", date().0)),
-        ]
-    }
-
-    fn instance_sample() -> PipelineInstance {
-        let PipelineDocument::Instance(instance) = samples().remove(10).0 else { unreachable!() };
-        instance
-    }
-
-    fn stewardship_sample() -> PipelineStewardship {
-        let PipelineDocument::Stewardship(stewardship) = samples().remove(11).0 else { unreachable!() };
-        stewardship
-    }
-
-    fn hand_off_sample() -> PipelineHandOff {
-        let PipelineDocument::HandOff(hand_off) = samples().remove(12).0 else { unreachable!() };
-        hand_off
-    }
-
-    fn campaign_sample() -> PipelineDocument {
-        samples().remove(0).0
-    }
-
-    fn question_sample() -> PipelineQuestion {
-        let PipelineDocument::Question(question) = samples().remove(2).0 else { unreachable!() };
-        question
-    }
-
-    fn ruling_sample() -> PipelineRuling {
-        let PipelineDocument::Ruling(ruling) = samples().remove(3).0 else { unreachable!() };
-        ruling
-    }
-
-    fn report_sample() -> PipelineCutReport {
-        let PipelineDocument::CutReport(report) = samples().remove(5).0 else { unreachable!() };
-        report
-    }
-
-    fn verdict_sample() -> PipelineVerdict {
-        let PipelineDocument::Verdict(verdict) = samples().remove(6).0 else { unreachable!() };
-        verdict
-    }
-
-    fn finding_sample() -> PipelineFinding {
-        let PipelineDocument::Finding(finding) = samples().remove(7).0 else { unreachable!() };
-        finding
-    }
-
-    fn resolution_sample() -> PipelineResolution {
-        let PipelineDocument::Resolution(resolution) = samples().remove(9).0 else { unreachable!() };
-        resolution
-    }
-
-    /// The golden corpus: every sample plus one document per encoding-relevant
-    /// variant (every enum variant, every Option both ways), each under a
-    /// unique label that names what it varies.
-    fn golden_documents() -> Vec<(String, PipelineDocument)> {
-        use PipelineDocument as D;
-        let mut out: Vec<(String, PipelineDocument)> =
-            samples().into_iter().map(|(d, _)| (format!("sample.{}", d.kind().name()), d)).collect();
-        let by = |kind: PipelineKind, kind_name: &str, local: &str| PipelineRef { kind, id: id(kind_name, local) };
-        let resolution = |outcome: ResolutionOutcome| {
-            let mut r = resolution_sample();
-            r.outcome = outcome;
-            D::Resolution(r)
-        };
-        let ruling_ref = || by(PipelineKind::Ruling, "ruling", "R8");
-        out.push(("resolution.superseded".into(), resolution(ResolutionOutcome::Superseded { by: vec![ruling_ref(), by(PipelineKind::Question, "question", "Q1")] })));
-        out.push(("resolution.fixed-by-none".into(), resolution(ResolutionOutcome::Fixed { commit: sha(), by: None })));
-        out.push(("resolution.fixed-by-some".into(), resolution(ResolutionOutcome::Fixed { commit: sha(), by: Some(by(PipelineKind::CutReport, "cut_report", "cut-3a.h1")) })));
-        out.push(("resolution.deferred".into(), resolution(ResolutionOutcome::Deferred { to: by(PipelineKind::FollowUp, "follow_up", "FU-4") })));
-        out.push(("resolution.recorded".into(), resolution(ResolutionOutcome::Recorded { reason: "Noted.".into() })));
-        out.push(("resolution.withdrawn".into(), resolution(ResolutionOutcome::Withdrawn { reason: "Mistaken.".into() })));
-        for (name, authority) in [("standing", RulingAuthority::Standing), ("defaulted", RulingAuthority::Defaulted)] {
-            let mut r = ruling_sample();
-            r.authority = authority;
-            out.push((format!("ruling.authority-{name}"), D::Ruling(r)));
-        }
-        let mut r = ruling_sample();
-        (r.answers, r.choice, r.operator_quote, r.precedents) = (None, None, None, vec![]);
-        out.push(("ruling.options-none".into(), D::Ruling(r)));
-        let mut q = question_sample();
-        q.raised_in = None;
-        out.push(("question.raised-in-none".into(), D::Question(q)));
-        let PipelineDocument::CutSpec(mut spec) = samples().remove(4).0 else { unreachable!() };
-        spec.authority_map = None;
-        out.push(("cut_spec.authority-map-none".into(), D::CutSpec(spec)));
-        for (name, outcome) in [("holds", ClaimOutcome::Holds), ("unproven", ClaimOutcome::Unproven)] {
-            let mut v = verdict_sample();
-            v.claims[0].outcome = outcome;
-            v.claims[0].promise = None;
-            out.push((format!("verdict.claim-{name}-promise-none"), D::Verdict(v)));
-        }
-        let mut f = finding_sample();
-        (f.confidence, f.severity, f.origin) = (FindingConfidence::Plausible, FindingSeverity::Blocker, FindingOrigin::PreExisting);
-        f.locations[0].end_line = None;
-        f.evidence = [EvidenceKind::Command, EvidenceKind::Mutation, EvidenceKind::Probe, EvidenceKind::SourceRead, EvidenceKind::Capture]
-            .into_iter().map(|kind| Evidence { kind, locator: "x".into(), result: "y".into() }).collect();
-        out.push(("finding.plausible-blocker-preexisting-kinds".into(), D::Finding(f)));
-        for (name, severity) in [("medium", FindingSeverity::Medium), ("low", FindingSeverity::Low)] {
-            let mut f = finding_sample();
-            f.severity = severity;
-            out.push((format!("finding.severity-{name}"), D::Finding(f)));
-        }
-        out
-    }
-
-    /// One line per document: `label key type schema payload-hex`.
-    fn golden_lines() -> Result<Vec<String>> {
-        let cache = schema_cache()?;
-        golden_documents()
-            .into_iter()
-            .map(|(label, document)| {
-                document.validate()?;
-                let envelope = document.prepare(&cache)?;
-                let hex: String = envelope.payload.iter().map(|b| format!("{b:02x}")).collect();
-                Ok(format!("{label} {} {} {} {hex}", envelope.key, envelope.r#type, document.kind().schema_name()))
-            })
-            .collect()
-    }
-
-    /// The wire is pinned to bytes. `golden/envelopes.txt` was derived once
-    /// from this crate at its copy of Epiphany ef956865 (huginn 87b6455), which
-    /// was proved byte-identical to the live mind store and to Epiphany; see
-    /// its header. Payload bytes are load-bearing (`ForeignRef.payload_sha256`
-    /// hashes them), and the cultcache type id and schema name are how a store
-    /// resolves a persisted entry. A deliberate wire change re-derives the file
-    /// with `golden_dump` below, in the same commit as a ruling that allows it.
-    #[test]
-    fn encoded_envelopes_match_the_committed_golden() -> Result<()> {
-        let golden = include_str!("../golden/envelopes.txt");
-        let expected: Vec<&str> = golden.lines().filter(|line| !line.starts_with('#') && !line.is_empty()).collect();
-        let actual = golden_lines()?;
-        assert_eq!(actual.len(), expected.len(), "the corpus and the golden file have the same documents");
-        for (actual, expected) in actual.iter().zip(expected) {
-            assert_eq!(actual, expected);
-        }
-        let kinds: BTreeSet<&str> = actual.iter().filter_map(|line| line.split(' ').nth(2)).collect();
-        assert_eq!(kinds.len(), PipelineKind::ALL.len(), "every kind's type id is in the golden");
-        Ok(())
-    }
-
-    /// Prints the golden body to the file named by `GOLDEN_OUT`. Not a check:
-    /// run only for a deliberate wire change, then paste under the header.
-    #[test]
-    #[ignore = "re-derives golden/envelopes.txt; run only for a ruled wire change"]
-    fn golden_dump() -> Result<()> {
-        let out = std::env::var("GOLDEN_OUT").expect("GOLDEN_OUT names the output file");
-        std::fs::write(out, golden_lines()?.join("
-") + "
-")?;
-        Ok(())
-    }
-
-    /// The live registrar plus the foreign stand-in, which only the tests
-    /// register.
-    fn schema_cache() -> Result<CultCache> {
-        let mut cache = CultCache::new();
-        register_pipeline_document_types(&mut cache)?;
-        cache.register_entry_type::<ForeignDocument>()?;
-        Ok(cache)
-    }
-
-    #[test]
-    fn every_pipeline_kind_round_trips_through_named_slot_zero() -> Result<()> {
-        let cache = schema_cache()?;
-        let samples = samples();
-        let kinds = samples.iter().map(|(document, _)| document.kind()).collect::<BTreeSet<_>>();
-        assert_eq!(kinds.len(), PipelineKind::ALL.len(), "every kind has a sample");
-        for (document, _) in samples {
-            document.validate()?;
-            let envelope = document.prepare(&cache)?;
-            assert_eq!(envelope.r#type, document.kind().type_id());
-            assert_eq!(envelope.payload[0], 0x91, "{:?} payload is a one-element array", document.kind());
-            assert!(
-                matches!(envelope.payload[1], 0x80..=0x8f | 0xde | 0xdf),
-                "{:?} slot 0 is a named map",
-                document.kind()
-            );
-            assert_eq!(PipelineDocument::decode(&envelope)?, document);
-            Ok::<_, anyhow::Error>(())?;
-        }
-        Ok(())
-    }
-
-    /// Soul F2: a decode is type-matched in both directions. The round-trip
-    /// test above pins the positive match; this pins the refusal, so an
-    /// envelope belonging to another kind can never be decoded as whichever
-    /// pipeline kind happens to parse its payload. The commit receipt is the
-    /// sharp case: a mind's store may legitimately hold one, and it is still
-    /// not a document; `ForeignDocument` stands in for it here.
-    #[test]
-    fn decode_refuses_an_envelope_of_a_foreign_type() -> Result<()> {
-        let cache = schema_cache()?;
-        let foreign = <ForeignDocument as DatabaseEntry>::TYPE;
-        assert!(!foreign.starts_with("epiphany.pipeline."), "{foreign} is a foreign type id");
-        let mut envelope = campaign_sample().prepare(&cache)?;
-        envelope.r#type = foreign.into();
-        assert_eq!(
-            PipelineDocument::decode(&envelope),
-            Err(PipelineRefusal::ForeignStore { r#type: foreign.into() })
-        );
-        Ok(())
-    }
-
-    #[test]
-    fn bounds_refuse_in_utf8_bytes() {
-        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
-        campaign.title = Title("é".repeat(100));
-        assert_eq!(PipelineDocument::Campaign(campaign.clone()).validate(), Ok(()));
-        campaign.title = Title(format!("{}a", "é".repeat(100)));
-        assert_eq!(
-            PipelineDocument::Campaign(campaign.clone()).validate(),
-            Err(PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 })
-        );
-        campaign.title = t("ok");
-        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 9];
-        assert_eq!(
-            PipelineDocument::Campaign(campaign).validate(),
-            Err(PipelineRefusal::FieldBound { field: "campaign.repos".into(), limit: 8, actual: 9 })
-        );
-    }
-
-    /// RS-L closing fix 4: `campaign.repos` refuses two entries naming one
-    /// repository by identity, not only by raw spelling, so `GameCult/Epiphany`
-    /// and `gamecult/epiphany` in one list refuse exactly as the same spelling
-    /// twice would. Two genuinely distinct repos still validate.
-    #[test]
-    fn campaign_repos_refuse_duplicates_by_identity() {
-        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
-        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("gamecult/epiphany".into())];
-        assert_eq!(
-            PipelineDocument::Campaign(campaign.clone()).validate(),
-            Err(PipelineRefusal::DuplicateRepo {
-                field: "campaign.repos".into(),
-                repo: "gamecult/epiphany".into(),
-            })
-        );
-
-        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 2];
-        assert_eq!(
-            PipelineDocument::Campaign(campaign.clone()).validate(),
-            Err(PipelineRefusal::DuplicateRepo {
-                field: "campaign.repos".into(),
-                repo: "GameCult/Epiphany".into(),
-            })
-        );
-
-        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("GameCult/Aetheria".into())];
-        assert_eq!(PipelineDocument::Campaign(campaign).validate(), Ok(()));
-    }
-
-    #[test]
-    fn repo_fields_must_be_org_slash_repo() {
-        let mut report = report_sample();
-        report.repo = OrgRepo("Epiphany".into());
-        assert_eq!(
-            PipelineDocument::CutReport(report).validate(),
-            Err(PipelineRefusal::InvalidFormat { field: "cut_report.repo".into(), value: "Epiphany".into() })
-        );
-        let PipelineDocument::CutSpec(mut spec) = samples().remove(4).0 else { unreachable!() };
-        spec.repo = OrgRepo("GameCult/Epiphany/extra".into());
-        assert!(matches!(
-            PipelineDocument::CutSpec(spec).validate(),
-            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_spec.repo"
-        ));
-        let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
-        follow_up.repo = OrgRepo("/Epiphany".into());
-        assert!(matches!(
-            PipelineDocument::FollowUp(follow_up).validate(),
-            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "follow_up.repo"
-        ));
-    }
-
-    #[test]
-    fn keys_are_derived_and_mismatch_refuses() -> Result<()> {
-        let cache = schema_cache()?;
-        for (document, key) in samples() {
-            assert_eq!(pipeline_key(&document), Ok(key.clone()));
-            let mut envelope = document.prepare(&cache)?;
-            envelope.key = format!("{key}-forged");
-            assert_eq!(
-                validate_pipeline_write_envelope(&envelope),
-                Err(PipelineRefusal::InvalidIdentity { kind: document.kind(), key: envelope.key, expected: key })
-            );
-        }
-        let mut resolution = resolution_sample();
-        let answered = pipeline_key(&PipelineDocument::Resolution(resolution.clone()));
-        resolution.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Resolution(resolution)),
-            answered,
-            "a subject has one resolution key whatever the outcome"
-        );
-        Ok(())
-    }
-
-    /// F2, and Soul's second pass: a composed local segments one way only. The
-    /// rule -- no local part carries the separator -- is pinned on the composer
-    /// in `no_local_part_carries_the_separator`; the pairs below are the ones
-    /// Soul measured through the documents, and each is a pair only because the
-    /// rule holds.
-    #[test]
-    fn composed_keys_cannot_collide() {
-        let key = |document: PipelineDocument| pipeline_key(&document);
-
-        // Soul's hand-off pair. A dotted slug is ordinary on the receiver side
-        // and a dotted repo name (the part after the mandatory `/`, GitHub's
-        // grammar owns no dot on the owner side) is ordinary on the repo side,
-        // so both are escaped: left unescaped these two both key to
-        // `yggdrasil:hand_off:thought-cage.GameCult.Epiphany_-thing.2026-09-15`.
-        let handed = |to: &str, repo: &str| {
-            let mut hand_off = hand_off_sample();
-            hand_off.to_instance = slug(to);
-            hand_off.repo = OrgRepo(repo.into());
-            key(PipelineDocument::HandOff(hand_off))
-        };
-        let dotted_receiver = handed("thought-cage.GameCult", "Epiphany/thing");
-        let dotted_repo = handed("thought-cage", "GameCult/Epiphany.thing");
-        assert_eq!(
-            dotted_receiver,
-            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.epiphany_-thing.2026-09-15"))
-        );
-        assert_eq!(
-            dotted_repo,
-            Ok(format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany_dthing.2026-09-15"))
-        );
-        assert_ne!(dotted_receiver, dotted_repo, "a dotted repo and a dotted receiver cannot claim one key");
-
-        let mut wide_label = finding_sample();
-        wide_label.label = l("F1.G");
-        assert!(
-            matches!(key(PipelineDocument::Finding(wide_label)), Err(PipelineRefusal::InvalidFormat { .. })),
-            "a finding label carrying a dot is refused, not silently composed"
-        );
-        let mut deep_verdict = finding_sample();
-        deep_verdict.verdict = id("verdict", "cut-3a.s1.F1");
-        deep_verdict.label = l("G");
-        assert!(
-            matches!(key(PipelineDocument::Finding(deep_verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
-            "a verdict local that is not cut-<label>.s<N> is refused"
-        );
-        let mut plain = finding_sample();
-        plain.verdict = id("verdict", "cut-3a.s1");
-        plain.label = l("F1");
-        assert_eq!(key(PipelineDocument::Finding(plain)), Ok(format!("{CAMPAIGN}:finding:cut-3a.s1.F1")));
-
-        let mut deep_spec = report_sample();
-        deep_spec.cut_spec = id("cut_spec", "cut-3a.h1.r1");
-        deep_spec.attempt = 2;
-        assert!(
-            matches!(key(PipelineDocument::CutReport(deep_spec)), Err(PipelineRefusal::InvalidFormat { .. })),
-            "a cut label carrying a dot is refused, so cut-3a.h1.h2 has one source"
-        );
-        let mut attempt_two = report_sample();
-        attempt_two.attempt = 2;
-        assert_eq!(key(PipelineDocument::CutReport(attempt_two)), Ok(format!("{CAMPAIGN}:cut_report:cut-3a.h2")));
-    }
-
-    /// F3: every parent id is parsed strictly. These are the bad parents Soul
-    /// found accepted, plus the wrong-kind and marker rules that mutations S1
-    /// and S3 remove.
-    #[test]
-    fn parent_ids_are_parsed_strictly() {
-        let refused = |parent: &str| {
-            let mut report = report_sample();
-            report.cut_spec = Short(parent.into());
-            let key = pipeline_key(&PipelineDocument::CutReport(report));
-            assert!(
-                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_report.cut_spec"),
-                "parent {parent:?} must be refused, got {key:?}"
-            );
-        };
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:junk"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.rX"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-..r1"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-.r1"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1 "));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r"));
-        refused(&format!("{CAMPAIGN}:cut_report:cut-3a.h1"));
-        // Right kind and a well-formed number, but the marker belongs to
-        // another kind: the marker rule is pinned on its own.
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.h1"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.s1"));
-        // A well-formed number with no marker at all. Only the marker rule
-        // refuses this one: the digits rule is satisfied either way.
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.1"));
-        refused(&format!("{CAMPAIGN}:CUT_SPEC:cut-3a.r1"));
-        refused(&format!("EUREKA-STATE:cut_spec:cut-3a.r1"));
-        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:"));
-        refused(&format!("{CAMPAIGN}::cut-3a.r1"));
-        refused("cut-3a.r1");
-        let mut other_campaign = report_sample();
-        other_campaign.campaign = slug("other-campaign");
-        assert!(
-            matches!(
-                pipeline_key(&PipelineDocument::CutReport(other_campaign)),
-                Err(PipelineRefusal::InvalidFormat { .. })
-            ),
-            "a parent in another campaign is refused"
-        );
-        let mut verdict = verdict_sample();
-        verdict.cut_report = id("cut_report", "cut-3a.r1");
-        assert!(
-            matches!(pipeline_key(&PipelineDocument::Verdict(verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
-            "a verdict's parent must carry the report marker, not the spec marker"
-        );
-    }
-
-    /// F4: a resolution's subject id is a full id of the declared kind.
-    #[test]
-    fn resolution_subject_is_a_full_id_of_its_kind() {
-        let refused = |kind: PipelineKind, subject: &str| {
-            let mut resolution = resolution_sample();
-            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
-            let document = PipelineDocument::Resolution(resolution);
-            assert!(
-                matches!(document.validate(), Err(PipelineRefusal::InvalidFormat { .. })),
-                "subject {subject:?} must fail validation"
-            );
-            assert!(
-                matches!(pipeline_key(&document), Err(PipelineRefusal::InvalidFormat { .. })),
-                "subject {subject:?} must not compose a key"
-            );
-        };
-        refused(PipelineKind::Question, "");
-        refused(PipelineKind::Question, "not an id: spaces and : colons");
-        refused(PipelineKind::Question, "eureka-state:question:1１");
-        refused(PipelineKind::Question, &format!("{CAMPAIGN}:ruling:R8"));
-        refused(PipelineKind::Ruling, &format!("{CAMPAIGN}:question:Q1"));
-        refused(PipelineKind::Question, &format!("{CAMPAIGN}:question:.."));
-
-        let mut valid = resolution_sample();
-        valid.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Resolution(valid)),
-            Ok(format!("{CAMPAIGN}:resolution:ruling.R8.n1"))
-        );
-    }
-
-    /// Soul G2: a resolution is named by the key it has, and a `PipelineRef`
-    /// of kind `Resolution` accepts exactly that id. `PipelineRef` takes any
-    /// kind, so this is reachable; a follow-up sourced from a resolution is the
-    /// live path. The grammar admits `<campaign>:resolution:R8` too: it is
-    /// well-formed, and no resolution derives it, but whether a document with an
-    /// id exists is admission's rule, not the grammar's, so the reader does not
-    /// refuse it and this test does not ask it to.
-    #[test]
-    fn a_resolution_is_named_by_the_key_it_has() {
-        let sourced = |id: &str| {
-            let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
-            follow_up.source = PipelineRef { kind: PipelineKind::Resolution, id: Short(id.into()) };
-            PipelineDocument::FollowUp(follow_up).validate()
-        };
-        let key = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
-        assert_eq!(key, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
-        assert_eq!(sourced(&key), Ok(()), "a resolution is named by the key it has");
-        assert_eq!(sourced(&format!("{CAMPAIGN}:resolution:R8")), Ok(()), "well-formed grammar is not the reader's to refuse");
-
-        for refused in [
-            // The prefix shape the writer used to emit. No resolution carries it.
-            format!("resolution:{CAMPAIGN}:question:Q1"),
-            format!("{CAMPAIGN}:resolution:{CAMPAIGN}:question:Q1"),
-            // No local, a subject local with an empty part, trailing junk, and a
-            // kind segment that is not `resolution`.
-            format!("{CAMPAIGN}:resolution:"),
-            format!("{CAMPAIGN}:resolution:question..Q1"),
-            format!("{CAMPAIGN}:resolution:question.Q1:junk"),
-            format!("{CAMPAIGN}:question:Q1"),
-        ] {
-            assert!(
-                matches!(sourced(&refused), Err(PipelineRefusal::InvalidFormat { .. })),
-                "{refused:?} is not an id any resolution has"
-            );
-        }
-
-        // A root subject reads back too: a resolution of a campaign carries the
-        // campaign's kind and its `self` local.
-        let mut of_campaign = resolution_sample();
-        of_campaign.subject = PipelineRef { kind: PipelineKind::Campaign, id: Short(format!("{CAMPAIGN}:campaign:self")) };
-        let root_key = pipeline_key(&PipelineDocument::Resolution(of_campaign)).expect("a root subject keys");
-        assert_eq!(root_key, format!("{CAMPAIGN}:resolution:campaign.self.n1"));
-        assert_eq!(sourced(&root_key), Ok(()));
-    }
-
-    /// The three kinds a mind is keyed by. The samples above already round-trip
-    /// every kind; this pins the shapes D2 gives these three specifically: an
-    /// instance is a root keyed by its own slug, and the other two hang off an
-    /// instance rather than a campaign, so neither borrows the campaign tail.
-    #[test]
-    fn instance_stewardship_and_hand_off_round_trip() -> Result<()> {
-        let cache = schema_cache()?;
-        let instance = PipelineDocument::Instance(instance_sample());
-        assert_eq!(pipeline_key(&instance), Ok(format!("{INSTANCE}:instance:self")));
-        for document in [
-            instance,
-            PipelineDocument::Stewardship(stewardship_sample()),
-            PipelineDocument::HandOff(hand_off_sample()),
-        ] {
-            document.validate()?;
-            let envelope = document.prepare(&cache)?;
-            assert_eq!(PipelineDocument::decode(&envelope)?, document);
-            let key = pipeline_key(&document)?;
-            assert!(
-                !key.starts_with(&format!("{CAMPAIGN}:")),
-                "{:?} is keyed by its instance, not by a campaign: {key}",
-                document.kind()
-            );
-            validate_pipeline_write_envelope(&envelope)?;
-        }
-        // A bounded list is still bounded: `documents` carries a maximum, as
-        // every `Vec` field must.
-        let mut wide = hand_off_sample();
-        wide.documents = vec![s("x"); 257];
-        assert_eq!(
-            PipelineDocument::HandOff(wide).validate(),
-            Err(PipelineRefusal::FieldBound { field: "hand_off.documents".into(), limit: 256, actual: 257 })
-        );
-        Ok(())
-    }
-
-    /// Soul F3: a key and an id are the same string, so every kind's key reads
-    /// back as an id of that kind. The kinds a mind is keyed by were added to
-    /// the key writer and left out of the id reader, and nothing noticed,
-    /// because the key tests assert strings and never read one back: an
-    /// instance keys to its slug and then fails to parse as an instance id, so
-    /// no `PipelineRef` and no resolution could ever name one. Every kind now
-    /// reads back with no kind excused, a resolution included, and a root kind
-    /// read as the other root kind is refused: the reader checks the kind
-    /// segment for the roots exactly as for every other kind.
-    #[test]
-    fn keys_read_back_as_ids_of_their_kind() -> Result<()> {
-        for (document, expected) in samples() {
-            let kind = document.kind();
-            let key = pipeline_key(&document)?;
-            assert_eq!(key, expected, "{kind:?} keys to its sample's key");
-            assert_eq!(
-                pipeline_id("read_back", &key, kind).map(|_| ()),
-                Ok(()),
-                "{kind:?} key {key} does not read back as an id of its kind"
-            );
-        }
-
-        let campaign_key = pipeline_key(&campaign_sample())?;
-        let instance_key = pipeline_key(&PipelineDocument::Instance(instance_sample()))?;
-        assert_eq!(
-            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
-            Ok((INSTANCE, ROOT_LOCAL)),
-            "an instance key reads back as an instance"
-        );
-        assert_eq!(
-            pipeline_id("read_back", &instance_key, PipelineKind::Campaign),
-            Err(format_error("read_back", &instance_key)),
-            "an instance key is not a campaign id"
-        );
-        assert_eq!(
-            pipeline_id("read_back", &campaign_key, PipelineKind::Instance),
-            Err(format_error("read_back", &campaign_key)),
-            "a campaign key is not an instance id"
-        );
-
-        // Soul X1 and X11: the reader's root and local are each `dotted_text`
-        // whole, so a trailing dot on either is refused by the reader itself,
-        // not only by the writer that never composes one. A leading dot and
-        // an empty part are the same rule on the local.
-        for malformed in ["c.:target:x", "c:target:x.", "c:target:.x", "c:target:a..b"] {
-            let read = pipeline_id("read_back", malformed, PipelineKind::Target);
-            assert!(
-                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "read_back"),
-                "{malformed:?} is not an id of any kind, got {read:?}"
-            );
-        }
-
-        // The instance root's own key segment is validated, not merely bounded.
-        // Nothing else stands between a `Slug` and a key: a space would compose
-        // a store key carrying a byte no `Label` may hold.
-        let mut spaced = instance_sample();
-        spaced.instance = Slug("thought cage".into());
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Instance(spaced)),
-            Err(PipelineRefusal::InvalidFormat {
-                field: "instance.instance".into(),
-                value: "thought cage".into(),
-            }),
-            "an instance slug is validated where the key is composed"
-        );
-        Ok(())
-    }
-
-    /// The repo is one key segment, so its slash is escaped. Left unescaped it
-    /// would both add a segment the reader cannot tell from a real one and put a
-    /// byte in the key that no `Label` may carry; escaped to a bare `_` it would
-    /// let two repos claim one key, which the colliding pair below pins.
-    #[test]
-    fn stewardship_key_escapes_the_repo_slash() {
-        let stewardship = stewardship_sample();
-        assert_eq!(stewardship.repo, OrgRepo("GameCult/Epiphany".into()));
-        let key = pipeline_key(&PipelineDocument::Stewardship(stewardship.clone()));
-        assert_eq!(key, Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")));
-        assert!(!key.unwrap().contains('/'), "no key segment carries a slash");
-
-        // The escape is not a cosmetic substitution, and the pair that proves
-        // it is a pair: GitHub's grammar keeps `.` and `_` out of the owner,
-        // so both live in the repo half here, and under a naive scheme that
-        // collapsed `/`, `.` and `_` all to a bare `_` both of these key to
-        // `GameCult_Epiphany_thing`, and one of the two documents is lost.
-        let keyed = |repo: &str| {
-            let mut value = stewardship.clone();
-            value.repo = OrgRepo(repo.into());
-            pipeline_key(&PipelineDocument::Stewardship(value))
-        };
-        let dotted_repo = keyed("GameCult/Epiphany.thing");
-        let underscored_repo = keyed("GameCult/Epiphany_thing");
-        assert_eq!(
-            dotted_repo,
-            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany_dthing.n1"))
-        );
-        assert_eq!(
-            underscored_repo,
-            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany__thing.n1"))
-        );
-        assert_ne!(dotted_repo, underscored_repo, "two repos cannot claim one key");
-
-        let mut no_org = stewardship.clone();
-        no_org.repo = OrgRepo("Epiphany".into());
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Stewardship(no_org)),
-            Err(PipelineRefusal::InvalidFormat { field: "stewardship.repo".into(), value: "Epiphany".into() })
-        );
-
-        // S-1: key derivation goes through `identity()`, so a case variant of
-        // the same repository is one store key, not two stewardships of what
-        // is really one repo.
-        let mut upper = stewardship.clone();
-        upper.repo = OrgRepo("gamecult/epiphany".into());
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Stewardship(upper)),
-            pipeline_key(&PipelineDocument::Stewardship(stewardship.clone())),
-            "GameCult/Epiphany and gamecult/epiphany must derive one store key"
-        );
-
-        // An escaped repo is still bound by the key's segment rules.
-        let mut long = stewardship;
-        long.repo = OrgRepo(format!("GameCult/{}", "a".repeat(60)));
-        assert!(
-            matches!(
-                pipeline_key(&PipelineDocument::Stewardship(long)),
-                Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "stewardship.key"
-            ),
-            "a repo segment longer than a key segment is refused"
-        );
-    }
-
-    /// A hand-off is recorded in both minds, so both instances are in the key:
-    /// the sender owns the first segment and the receiver the local. Changing
-    /// either one moves the document.
-    #[test]
-    fn hand_off_names_both_instances() {
-        let key = |hand_off: PipelineHandOff| pipeline_key(&PipelineDocument::HandOff(hand_off));
-        let base = key(hand_off_sample()).expect("the sample keys");
-        assert_eq!(base, format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.2026-09-15"));
-
-        let mut other_sender = hand_off_sample();
-        other_sender.from_instance = slug("thought-cage");
-        assert_ne!(key(other_sender), Ok(base.clone()), "the sender is in the key");
-
-        let mut other_receiver = hand_off_sample();
-        other_receiver.to_instance = slug("mimir");
-        assert_ne!(key(other_receiver), Ok(base.clone()), "the receiver is in the key");
-
-        // Two hand-offs of the same repo between the same pair on different
-        // days are different documents.
-        let mut later = hand_off_sample();
-        later.handed_on = Date("2026-09-16".into());
-        assert_ne!(key(later), Ok(base), "the date is in the key");
-
-        // A dotted receiver is a `Slug` entering a local, so it is escaped to
-        // one label rather than widening the local by a part.
-        let mut dotted_receiver = hand_off_sample();
-        dotted_receiver.to_instance = slug("thought-cage.GameCult");
-        assert_eq!(
-            key(dotted_receiver),
-            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.gamecult_-epiphany.2026-09-15"))
-        );
-
-        // The escape's `_` half is not only for repos: a receiver `a_db` and a
-        // receiver `a.b` would both key to `a_db` if the slug's own `_` passed
-        // through raw, so the slug is escaped as `a__db` and the two differ.
-        let mut underscored_receiver = hand_off_sample();
-        underscored_receiver.to_instance = slug("a_db");
-        let mut dotted_twin = hand_off_sample();
-        dotted_twin.to_instance = slug("a.b");
-        let underscored_receiver = key(underscored_receiver).expect("an underscored receiver keys");
-        assert!(underscored_receiver.contains("a__db"), "{underscored_receiver}: the slug's underscore is escaped");
-        assert_ne!(key(dotted_twin), Ok(underscored_receiver), "`a_db` and `a.b` are two receivers");
-
-        // Both instance slugs are validated as key segments, not merely bounded.
-        let mut bad_receiver = hand_off_sample();
-        bad_receiver.to_instance = Slug("thought cage".into());
-        assert_eq!(
-            key(bad_receiver),
-            Err(PipelineRefusal::InvalidFormat {
-                field: "hand_off.to_instance".into(),
-                value: "thought cage".into(),
-            })
-        );
-        let mut bad_date = hand_off_sample();
-        bad_date.handed_on = Date("2026-9-15".into());
-        assert!(
-            matches!(key(bad_date), Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "hand_off.handed_on"),
-            "a malformed date does not compose a key"
-        );
-    }
-
-    /// A resolution whose subject is the given document, keyed.
-    fn resolution_of(kind: PipelineKind, id: &str) -> Result<String, PipelineRefusal> {
-        let mut resolution = resolution_sample();
-        resolution.subject = PipelineRef { kind, id: Short(id.into()) };
-        pipeline_key(&PipelineDocument::Resolution(resolution))
-    }
-
-    /// R1, the grammar's own test: every key is `<root>:<kind>:<local>`, three
-    /// segments with no kind excused, the root a `Slug`, the kind the literal
-    /// name, and every local part a `Label`. A root that would add a segment is
-    /// refused where the key is composed: `pipeline_key` is `pub` and does not
-    /// validate the document first, so this is reachable without one.
-    #[test]
-    fn every_key_has_exactly_three_segments() {
-        let nested = resolution_of(PipelineKind::Resolution, &format!("{CAMPAIGN}:resolution:question.Q1.n1"))
-            .expect("a resolution of a resolution keys");
-        let keys = samples()
-            .into_iter()
-            .map(|(document, _)| (document.kind(), pipeline_key(&document).expect("every sample keys")))
-            .chain([(PipelineKind::Resolution, nested)]);
-        for (kind, key) in keys {
-            let segments = key.split(':').collect::<Vec<_>>();
-            assert_eq!(segments.len(), 3, "{kind:?} key {key} has three segments");
-            assert_eq!(dotted_text("root", segments[0]), Ok(()), "{key}: the root is a slug");
-            assert_eq!(segments[1], kind.name(), "{key}: the kind segment is the literal kind");
-            assert!(PipelineKind::ALL.iter().any(|known| known.name() == segments[1]));
-            for part in segments[2].split('.') {
-                assert_eq!(label_text("local", part), Ok(()), "{key}: local part {part:?} is a label");
-            }
-        }
-
-        // A root that would add a segment, one that would empty a part, and one
-        // wider than a segment are all refused before a key is formatted. The
-        // refusal names the part that failed, so an empty part reports `""`.
-        let trailing_dot = format!("{CAMPAIGN}.");
-        let leading_dot = format!(".{CAMPAIGN}");
-        let over = "a".repeat(65);
-        for root in ["a:b", trailing_dot.as_str(), leading_dot.as_str(), "a..b", over.as_str()] {
-            let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
-            target.campaign = Slug(root.into());
-            let key = pipeline_key(&PipelineDocument::Target(target));
-            assert!(
-                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "target.campaign"),
-                "root {root:?} does not compose a key, got {key:?}"
-            );
-        }
-    }
-
-    /// Defect 1: the two roots are in distinct namespaces because the kind
-    /// segment distinguishes them, the same mechanism that separates every
-    /// other pair of kinds. Both key; only the pair sees a shared namespace.
-    #[test]
-    fn roots_of_different_kinds_do_not_share_a_key() {
-        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
-        campaign.slug = slug(INSTANCE);
-        let campaign = pipeline_key(&PipelineDocument::Campaign(campaign));
-        let instance = pipeline_key(&PipelineDocument::Instance(instance_sample()));
-        assert_eq!(campaign, Ok(format!("{INSTANCE}:campaign:self")));
-        assert_eq!(instance, Ok(format!("{INSTANCE}:instance:self")));
-        assert_ne!(campaign, instance, "a campaign and an instance of one slug are two documents");
-    }
-
-    /// The root is a `Slug`, so a dotted root keys and reads back whole on
-    /// both sides: the writer's root check and the reader's root check are
-    /// each `dotted_text`, not `label_text`. A campaign `game.cult` and an
-    /// instance `ygg.drasil` key, a document under the dotted campaign keys,
-    /// and each reads back through `pipeline_id` recovering the root exactly.
-    #[test]
-    fn dotted_roots_key_and_read_back() {
-        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
-        campaign.slug = slug("game.cult");
-        let campaign_key = pipeline_key(&PipelineDocument::Campaign(campaign)).expect("a dotted campaign keys");
-        assert_eq!(campaign_key, "game.cult:campaign:self");
-        assert_eq!(
-            pipeline_id("read_back", &campaign_key, PipelineKind::Campaign),
-            Ok(("game.cult", ROOT_LOCAL)),
-            "the dotted campaign root reads back whole"
-        );
-
-        let mut instance = instance_sample();
-        instance.instance = slug("ygg.drasil");
-        let instance_key = pipeline_key(&PipelineDocument::Instance(instance)).expect("a dotted instance keys");
-        assert_eq!(instance_key, "ygg.drasil:instance:self");
-        assert_eq!(
-            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
-            Ok(("ygg.drasil", ROOT_LOCAL)),
-            "the dotted instance root reads back whole"
-        );
-
-        let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
-        target.campaign = slug("game.cult");
-        let target_key = pipeline_key(&PipelineDocument::Target(target)).expect("a target under a dotted campaign keys");
-        assert_eq!(target_key, "game.cult:target:r2");
-        assert_eq!(
-            pipeline_id("read_back", &target_key, PipelineKind::Target),
-            Ok(("game.cult", "r2")),
-            "the dotted root and the local both read back"
-        );
-
-        let resolution = resolution_of(PipelineKind::Campaign, &campaign_key).expect("a resolution of a dotted campaign keys");
-        assert_eq!(resolution, "game.cult:resolution:campaign.self.n1");
-        assert_eq!(
-            pipeline_id("read_back", &resolution, PipelineKind::Resolution),
-            Ok(("game.cult", "campaign.self.n1")),
-            "a resolution under a dotted root reads back"
-        );
-    }
-
-    /// Cut 6c: a resolution's referent is a full id of the kind it declares,
-    /// validated through `PipelineRef` like every other referent, so a
-    /// well-formed id of the wrong kind is refused and the refusal names the
-    /// entry. The positive case is Ghostlight's own: a ruling partly
-    /// overturned by two later records, one of them a resolution named by the
-    /// key it has, which only the 6b grammar made nameable. An id no
-    /// resolution derives, `eureka-state:resolution:R8`, still validates:
-    /// whether a document with an id exists is admission's rule.
-    #[test]
-    fn resolution_outcome_referents_are_parsed_ids_of_their_kind() {
-        let resolved = |subject: PipelineRef, outcome: ResolutionOutcome| {
-            let mut resolution = resolution_sample();
-            resolution.subject = subject;
-            resolution.outcome = outcome;
-            PipelineDocument::Resolution(resolution).validate()
-        };
-        let refused = |field: &str, result: Result<(), PipelineRefusal>| {
-            assert!(
-                matches!(&result, Err(PipelineRefusal::InvalidFormat { field: at, .. }) if at == field),
-                "expected InvalidFormat at {field}, got {result:?}"
-            );
-        };
-        let ruling = |label: &str| PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", label) };
-        let question = |label: &str| PipelineRef { kind: PipelineKind::Question, id: id("question", label) };
-        let inner = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
-        let resolution = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
-
-        let superseded = |second: PipelineRef| ResolutionOutcome::Superseded { by: vec![ruling("R9"), second] };
-        assert_eq!(resolved(ruling("R8"), superseded(resolution)), Ok(()));
-        let forged = PipelineRef { kind: PipelineKind::Ruling, id: Short(inner) };
-        refused("resolution.outcome.by[1].id", resolved(ruling("R8"), superseded(forged)));
-        let underived = PipelineRef { kind: PipelineKind::Resolution, id: Short(format!("{CAMPAIGN}:resolution:R8")) };
-        assert_eq!(resolved(ruling("R8"), superseded(underived)), Ok(()), "well-formed grammar is not the shape's to refuse");
-
-        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Answered { by: ruling("R8") }), Ok(()));
-        let forged = PipelineRef { kind: PipelineKind::Question, id: id("ruling", "R8") };
-        refused("resolution.outcome.by.id", resolved(question("Q1"), ResolutionOutcome::Answered { by: forged }));
-
-        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Deferred { to: question("Q2") }), Ok(()));
-        let forged = PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q2") };
-        refused("resolution.outcome.to.id", resolved(question("Q1"), ResolutionOutcome::Deferred { to: forged }));
-
-        let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
-        let fixed = |by: Option<PipelineRef>| ResolutionOutcome::Fixed { commit: sha(), by };
-        assert_eq!(resolved(finding.clone(), fixed(None)), Ok(()));
-        assert_eq!(resolved(finding.clone(), fixed(Some(ruling("R8")))), Ok(()));
-        let forged = PipelineRef { kind: PipelineKind::Finding, id: id("ruling", "R8") };
-        refused("resolution.outcome.by.id", resolved(finding, fixed(Some(forged))));
-
-        // Soul F2: the validator's bound on a supersession is its own, not
-        // only the schema's. Eight referents are the most a subject names;
-        // nine are refused as a count before any item is read.
-        let rulings = |count: usize| (1..=count).map(|n| ruling(&format!("R{n}"))).collect::<Vec<_>>();
-        assert_eq!(resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(8) }), Ok(()));
-        assert_eq!(
-            resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(9) }),
-            Err(PipelineRefusal::FieldBound { field: "resolution.outcome.by".into(), limit: 8, actual: 9 })
-        );
-
-        // Soul F3: the two reason-carrying outcomes are bounded like every
-        // `Line`; the shared arm is pinned on both so neither can drop out.
-        let wide = Line("a".repeat(1001));
-        for outcome in [
-            ResolutionOutcome::Recorded { reason: wide.clone() },
-            ResolutionOutcome::Withdrawn { reason: wide },
-        ] {
-            let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
-            assert_eq!(
-                resolved(finding, outcome),
-                Err(PipelineRefusal::FieldBound { field: "resolution.outcome.reason".into(), limit: 1000, actual: 1001 })
-            );
-        }
-    }
-
-    /// Ruling B: a fix names the tree where the finding stopped being true,
-    /// as a `Sha`. Uppercase hex of a legal length is the forgery a length
-    /// check passes and `hex` refuses.
-    #[test]
-    fn fixed_resolution_requires_a_commit_sha() {
-        let fixed = |commit: &str, by: Option<PipelineRef>| {
-            let mut resolution = resolution_sample();
-            resolution.subject = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
-            resolution.outcome = ResolutionOutcome::Fixed { commit: Sha(commit.into()), by };
-            PipelineDocument::Resolution(resolution).validate()
-        };
-        assert_eq!(fixed("5f98228d9c", None), Ok(()));
-        for forged in ["5F98228D9C", "5f9822", "dirty-worktree", ""] {
-            assert_eq!(
-                fixed(forged, None),
-                Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: forged.into() }),
-                "{forged:?} is not a commit"
-            );
-        }
-        // Soul F1: naming the record that fixed it does not excuse the commit.
-        let ruling = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
-        assert_eq!(
-            fixed("dirty-worktree", Some(ruling)),
-            Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: "dirty-worktree".into() }),
-            "a fix with a named record still names a commit"
-        );
-    }
-
-    /// A mutation record has a key-safe identity a verdict claim can name,
-    /// and is pinned to a tree: its label is a `Label` and its commit a
-    /// `Sha`, so a dotted label and free text where a sha belongs are refused.
-    #[test]
-    fn mutation_records_carry_a_dot_free_label_and_a_commit() {
-        let recorded = |label: &str, commit: &str| {
-            let mut report = report_sample();
-            // Through `From<&str>`, which every text type has, so the
-            // widened types under M19 and M20 still compile and the
-            // forgeries reach validation.
-            report.mutations[0].label = label.into();
-            report.mutations[0].commit = commit.into();
-            PipelineDocument::CutReport(report).validate()
-        };
-        assert_eq!(recorded("M1", "5f98228d"), Ok(()));
-        assert_eq!(
-            recorded("M1.a", "5f98228d"),
-            Err(PipelineRefusal::InvalidFormat { field: "cut_report.mutations[0].label".into(), value: "M1.a".into() })
-        );
-        assert_eq!(
-            recorded("M1", "dirty-worktree"),
-            Err(PipelineRefusal::InvalidFormat {
-                field: "cut_report.mutations[0].commit".into(),
-                value: "dirty-worktree".into(),
-            })
-        );
-    }
-
-    /// Ruling A's shape half: a claim names the promise it measured and the
-    /// mutations it ran, both as `Label`s, and names at most eight mutations.
-    #[test]
-    fn a_verdict_claim_names_the_promise_and_the_mutation_it_measured() {
-        let sample = verdict_sample();
-        assert_eq!(sample.claims[0].promise, Some(l("P1")));
-        assert_eq!(sample.claims[0].mutations, vec![l("M1")]);
-        assert_eq!(PipelineDocument::Verdict(sample).validate(), Ok(()));
-
-        let claimed = |promise: Option<Label>, mutations: Vec<Label>| {
-            let mut verdict = verdict_sample();
-            verdict.claims[0].promise = promise;
-            verdict.claims[0].mutations = mutations;
-            PipelineDocument::Verdict(verdict).validate()
-        };
-        assert_eq!(claimed(None, vec![]), Ok(()), "a claim need not measure a promise");
-        assert_eq!(
-            claimed(Some(l("P1.a")), vec![]),
-            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].promise".into(), value: "P1.a".into() })
-        );
-        assert_eq!(
-            claimed(None, vec![l("M1.a")]),
-            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].mutations[0]".into(), value: "M1.a".into() })
-        );
-        let labels = |count: usize| (1..=count).map(|n| l(&format!("M{n}"))).collect::<Vec<_>>();
-        assert_eq!(claimed(None, labels(8)), Ok(()));
-        assert_eq!(
-            claimed(None, labels(9)),
-            Err(PipelineRefusal::FieldBound { field: "verdict.claims[0].mutations".into(), limit: 8, actual: 9 })
-        );
-    }
-
-    /// A tripwire on the one hazard of retyping the estimate: the delta's two
-    /// `u32` fields are not interchangeable. The sample spec is Cut 3a's, a
-    /// net addition of 900 lines, and the order is asserted.
-    #[test]
-    fn the_sample_cut_spec_estimates_a_net_addition() {
-        let PipelineDocument::CutSpec(spec) = samples().remove(4).0 else { unreachable!() };
-        assert_eq!(spec.estimate.lines_added, 900);
-        assert_eq!(spec.estimate.lines_removed, 0);
-        assert_eq!(spec.estimate, report_sample().structural_delta, "the estimate and the actual are one shape");
-    }
-
-    /// Defect 2: a resolution's key carries its subject's kind as a literal
-    /// part of the local, so nothing infers it and two subjects of one local
-    /// and different kinds resolve to two keys. Each reads back through the
-    /// reader with the subject kind it was built from.
-    #[test]
-    fn a_resolution_names_its_subjects_kind() {
-        let pairs = [
-            (PipelineKind::Question, id("question", "Q1").0, PipelineKind::Ruling, id("ruling", "Q1").0),
-            (
-                PipelineKind::Campaign,
-                format!("{CAMPAIGN}:campaign:self"),
-                PipelineKind::Instance,
-                format!("{CAMPAIGN}:instance:self"),
-            ),
-        ];
-        for (left_kind, left_id, right_kind, right_id) in pairs {
-            let left = resolution_of(left_kind, &left_id).expect("the left subject keys");
-            let right = resolution_of(right_kind, &right_id).expect("the right subject keys");
-            assert_ne!(left, right, "resolutions of {left_id} and {right_id} are two documents");
-            for (kind, key) in [(left_kind, &left), (right_kind, &right)] {
-                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
-                assert_eq!(root, CAMPAIGN);
-                assert_eq!(local.split('.').next(), Some(kind.name()), "{key} names its subject's kind");
-            }
-        }
-    }
-
-    /// Defect 3: a resolution's own key is an ordinary id, so it composes as a
-    /// subject like any other, and the key reads back to the inner key -- the
-    /// whole inner key, sequence included, since the subject is recovered by
-    /// stripping this resolution's own sequence from the end and the kind from
-    /// the front. The depth bound is tested per kind by
-    /// `every_resolvable_kind_resolves_two_deep`.
-    #[test]
-    fn a_resolution_of_a_resolution_reads_back() {
-        let inner = resolution_of(PipelineKind::Question, &id("question", "Q1").0).expect("the inner keys");
-        let mut outer = resolution_sample();
-        outer.subject = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
-        let outer = PipelineDocument::Resolution(outer);
-        assert_eq!(outer.validate(), Ok(()));
-        let key = pipeline_key(&outer).expect("a resolution of a resolution keys");
-        assert_eq!(key, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"));
-        let (root, local) = pipeline_id("read_back", &key, PipelineKind::Resolution).expect("reads back");
-        let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
-        let (subject_local, _sequence) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
-        assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), inner, "the recovered subject is the inner key");
-    }
-
-    /// Each level of a nesting carries its own sequence, and only its own: the
-    /// part appended is this resolution's `sequence` field, never a copy of the
-    /// sequence the subject already ends in. The fixtures elsewhere all sit at
-    /// `1` at every level, where the two are indistinguishable, so the chain
-    /// here differs at every level and reads back level by level.
-    ///
-    /// On spelling, so silence is not read as coverage: the leaf emits `n<N>`
-    /// with `N` as `u32::to_string` writes it, so `n0` and `n12` are emitted
-    /// and `n01` is not. A hand-built id ending `n01`, `n1x`, or no `n<N>` at
-    /// all is still a well-formed reference -- those are legal labels, and a
-    /// grammar that reads keys may not refuse them on spelling. Nothing in the
-    /// leaf canonicalises them either: such an id simply names a document the
-    /// leaf would never key, which admission's A7 sees as a missing referent.
-    #[test]
-    fn every_level_of_a_nesting_keeps_its_own_sequence() {
-        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
-            let mut resolution = resolution_sample();
-            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
-            resolution.sequence = sequence;
-            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
-        };
-        let first = resolved(PipelineKind::Question, &id("question", "Q1").0, 9);
-        let second = resolved(PipelineKind::Resolution, &first, 10);
-        let third = resolved(PipelineKind::Resolution, &second, 0);
-        let fourth = resolved(PipelineKind::Resolution, &third, 12);
-        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n9"));
-        assert_eq!(second, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n9.n10"));
-        assert_eq!(third, format!("{CAMPAIGN}:resolution:resolution.resolution.question.Q1.n9.n10.n0"));
-        assert_eq!(
-            fourth,
-            format!("{CAMPAIGN}:resolution:resolution.resolution.resolution.question.Q1.n9.n10.n0.n12")
-        );
-        for (outer, inner, sequence) in [(&fourth, &third, 12), (&third, &second, 0), (&second, &first, 10)] {
-            let (root, local) = pipeline_id("read_back", outer, PipelineKind::Resolution).expect("reads back");
-            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
-            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
-            assert_eq!(subject_kind, "resolution", "{outer}: the subject of a nesting is a resolution");
-            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), *inner, "{outer}: the subject is the inner key");
-            assert_eq!(last, format!("n{sequence}"), "{outer}: this level's own sequence, not the subject's");
-        }
-    }
-
-    /// A stewardship is the other sequenced kind, and it composes as a subject
-    /// like any other: the subject's whole local, escaped repo and sequence
-    /// both, is the resolution's local, with the resolution's own sequence
-    /// last. So the two assignments of one repo have two resolutions, and a
-    /// resolution of either is itself resolvable.
-    #[test]
-    fn a_resolution_of_a_stewardship_reads_back() {
-        let stewarded = |sequence: u32| {
-            let mut stewardship = stewardship_sample();
-            stewardship.sequence = sequence;
-            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
-        };
-        let first = stewarded(1);
-        let second = stewarded(2);
-        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
-        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
-
-        let resolved = resolution_of(PipelineKind::Stewardship, &first).expect("a resolution of a stewardship keys");
-        let resolved_second = resolution_of(PipelineKind::Stewardship, &second).expect("the second assignment resolves");
-        assert_eq!(resolved, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n1.n1"));
-        assert_eq!(resolved_second, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n2.n1"));
-        assert_ne!(resolved, resolved_second, "each assignment keeps its own resolution");
-
-        for (key, subject) in [(&resolved, &first), (&resolved_second, &second)] {
-            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
-            assert_eq!(root, INSTANCE, "{key}: a stewardship's resolution lives in the mind's root");
-            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
-            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
-            assert_eq!(subject_kind, PipelineKind::Stewardship.name(), "{key} names its subject's kind");
-            assert_eq!(
-                format!("{root}:{subject_kind}:{subject_local}"),
-                *subject,
-                "{key}: the subject's own sequence is part of the recovered key"
-            );
-            assert_eq!(last, "n1", "{key}: this resolution's own sequence");
-
-            // A withdrawal of that resolution nests one out, as it does under
-            // any other subject, and reads back to the resolution it withdraws.
-            let withdrawal = resolution_of(PipelineKind::Resolution, key).expect("a withdrawal keys");
-            let subject_local = key.split(':').nth(2).expect("three segments");
-            assert_eq!(withdrawal, format!("{INSTANCE}:resolution:resolution.{subject_local}.n1"));
-            let (root, local) = pipeline_id("read_back", &withdrawal, PipelineKind::Resolution).expect("reads back");
-            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
-            let (subject_local, _) = rest.rsplit_once('.').expect("the local ends in its own sequence");
-            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), **key, "{withdrawal}: the withdrawn resolution");
-        }
-    }
-
-    /// A legal dotted local of exactly `length` bytes (`a.a.a`, each part a
-    /// label), for bounds wider than one label.
-    fn dotted_local(length: usize) -> String {
-        match length % 2 {
-            1 => format!("{}a", "a.".repeat(length / 2)),
-            _ => format!("{}aa", "a.".repeat(length / 2 - 1)),
-        }
-    }
-
-    /// A resolution of `subject`, at `sequence`, keyed.
-    fn resolved_at(kind: PipelineKind, subject: &str, sequence: u32) -> Result<String, PipelineRefusal> {
-        let mut resolution = resolution_sample();
-        resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
-        resolution.sequence = sequence;
-        pipeline_key(&PipelineDocument::Resolution(resolution))
-    }
-
-    /// every-subject-resolvable: for each kind that can be a subject, at the
-    /// widest subject local (64) and `u32::MAX` sequences, depth one and depth
-    /// two key and read back through `pipeline_id`; depth three is refused on
-    /// the local bound.
-    #[test]
-    fn every_resolvable_kind_resolves_two_deep() {
-        let wide = "a".repeat(SUBJECT_LOCAL_MAX);
-        let mut widest = 0;
-        for kind in PipelineKind::ALL.iter().copied().filter(|kind| *kind != PipelineKind::Resolution) {
-            let subject = format!("{CAMPAIGN}:{}:{wide}", kind.name());
-            assert_eq!(pipeline_id("subject", &subject, kind), Ok((CAMPAIGN, wide.as_str())), "{kind:?}: the subject parses");
-            let one = resolved_at(kind, &subject, u32::MAX).unwrap_or_else(|error| panic!("{kind:?} depth one: {error}"));
-            let two = resolved_at(PipelineKind::Resolution, &one, u32::MAX)
-                .unwrap_or_else(|error| panic!("{kind:?} depth two: {error}"));
-            for key in [&one, &two] {
-                assert!(key.len() <= 200, "{key}: an id fits a Short");
-                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution)
-                    .unwrap_or_else(|error| panic!("{kind:?}: {key} does not read back: {error}"));
-                assert_eq!(root, CAMPAIGN);
-                assert!(local.len() <= RESOLUTION_LOCAL_MAX);
-            }
-            widest = widest.max(two.len() - format!("{CAMPAIGN}:resolution:").len());
-            assert!(
-                matches!(
-                    resolved_at(PipelineKind::Resolution, &two, u32::MAX),
-                    Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "resolution.key"
-                ),
-                "{kind:?}: depth three is refused on the local bound"
-            );
-        }
-        assert_eq!(widest, RESOLUTION_LOCAL_MAX, "the bound is exactly the widest depth-two chain");
-        assert_eq!(RESOLUTION_LOCAL_MAX, 111);
-    }
-
-    #[test]
-    fn the_longest_kind_name_is_the_longest() {
-        let longest = PipelineKind::ALL.iter().map(|kind| kind.name().len()).max();
-        assert_eq!(longest, Some(LONGEST_KIND_NAME));
-    }
-
-    /// The parser bounds an id's local by kind, exactly where the composer does.
-    #[test]
-    fn an_id_local_is_bounded_by_its_kind() {
-        let at = |kind: PipelineKind, length: usize| {
-            pipeline_id("probe", &format!("{CAMPAIGN}:{}:{}", kind.name(), dotted_local(length)), kind).map(|_| ())
-        };
-        assert_eq!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX), Ok(()));
-        assert!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX + 1).is_err());
-        assert_eq!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX), Ok(()));
-        assert!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX + 1).is_err());
-    }
-
-    #[test]
-    fn sha_names_same_commit() {
-        let full = Sha("5f98228d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a69".into());
-        assert!(full.names_same_commit(&Sha("5f98228".into())));
-        assert!(Sha("5f98228".into()).names_same_commit(&full));
-        assert!(full.names_same_commit(&full));
-        assert!(!full.names_same_commit(&Sha("5f98229".into())));
-        assert!(!Sha("5f98228".into()).names_same_commit(&Sha("5f98229".into())));
-        assert!(!Sha("5f98228a".into()).names_same_commit(&Sha("5f98228b".into())), "equal length, differing");
-    }
-
-    /// stored-documents-valid and stored-bytes-reproduce, on the real mind.
-    /// `HUGINN_MIND_SNAPSHOT` is a copy of a state root holding
-    /// `minds/eureka/mind.redb`; the test copies the store file into a scratch
-    /// directory first (redb opens read-write), so the snapshot may be
-    /// read-only. Read through cultcache-rs's own store. Each pipeline
-    /// document must re-prepare to its stored envelope: key, type and payload
-    /// bytes.
-    #[test]
-    #[ignore = "needs HUGINN_MIND_SNAPSHOT, a copy of a Huginn state root; see the crate README"]
-    fn stored_documents_read_back() {
-        use cultcache_rs::{CacheBackingStore, OwnedRedbMessagePackBackingStore};
-        let root = std::env::var("HUGINN_MIND_SNAPSHOT").expect("HUGINN_MIND_SNAPSHOT names the snapshot state root");
-        let scratch = std::env::temp_dir().join(format!("eureka-pipeline-readback-{}", std::process::id()));
-        std::fs::create_dir_all(&scratch).expect("scratch directory");
-        let working = scratch.join("mind.redb");
-        std::fs::copy(Path::new(&root).join("minds").join("eureka").join("mind.redb"), &working).expect("the snapshot copies");
-        let store = OwnedRedbMessagePackBackingStore::new(&working).expect("the snapshot opens");
-        let cache = schema_cache().expect("the registrar registers");
-        let envelopes = store.pull_all().expect("the snapshot reads");
-        let mut stored = Vec::new();
-        for envelope in &envelopes {
-            match PipelineDocument::decode(envelope) {
-                Ok(document) => {
-                    assert_eq!(document.validate(), Ok(()), "{}: valid", envelope.key);
-                    assert_eq!(pipeline_key(&document).as_deref(), Ok(envelope.key.as_str()), "{}: key derives byte for byte", envelope.key);
-                    let again = document.prepare(&cache).unwrap_or_else(|error| panic!("{}: does not re-prepare: {error}", envelope.key));
-                    assert_eq!(
-                        (&again.key, &again.r#type, &again.payload),
-                        (&envelope.key, &envelope.r#type, &envelope.payload),
-                        "{}: re-encodes to the stored bytes",
-                        envelope.key
-                    );
-                    stored.push((document.kind(), envelope.key.clone()));
-                }
-                Err(PipelineRefusal::ForeignStore { .. }) => {}
-                Err(error) => panic!("{}: does not decode: {error}", envelope.key),
-            }
-        }
-        assert!(stored.len() > 200, "{} pipeline documents read", stored.len());
-        let mut subjects = 0;
-        let resolvable = |kind: &PipelineKind| !matches!(kind, PipelineKind::Resolution | PipelineKind::Campaign | PipelineKind::Instance);
-        for (kind, key) in stored.iter().filter(|(kind, _)| resolvable(kind)) {
-            let one = resolved_at(*kind, key, 1).unwrap_or_else(|error| panic!("{key}: no resolution keys: {error}"));
-            let two = resolved_at(PipelineKind::Resolution, &one, 1).unwrap_or_else(|error| panic!("{key}: no withdrawal keys: {error}"));
-            for derived in [&one, &two] {
-                pipeline_id("read_back", derived, PipelineKind::Resolution).unwrap_or_else(|error| panic!("{derived}: does not parse: {error}"));
-            }
-            subjects += 1;
-        }
-        for (_, key) in stored.iter().filter(|(kind, _)| *kind == PipelineKind::Resolution) {
-            resolved_at(PipelineKind::Resolution, key, 1).unwrap_or_else(|error| panic!("{key}: cannot be withdrawn: {error}"));
-        }
-        // The six findings that could not be resolved before this cut.
-        let stuck = [
-            "cut-bifrost-retire-alarm.s2.verb-default-accepts-malformed",
-            "cut-ops-notice-deploy.s2.pinned-bifrost-predates-retry",
-            "cut-bifrost-notice-retry.s1.unknown-test-ignores-backoff",
-            "cut-bifrost-notice-retry.s2.closed-unknown-retry-unpinned",
-            "cut-bifrost-notice-retry.s2.flapping-clock-retries-every-tick",
-            "cut-idunn-topology-lock.s2.boot-reconcile-skipped-on-contention",
-        ];
-        for label in stuck {
-            let found = stored
-                .iter()
-                .find(|(kind, key)| *kind == PipelineKind::Finding && key.ends_with(label))
-                .unwrap_or_else(|| panic!("{label}: not in the snapshot"));
-            let one = resolved_at(PipelineKind::Finding, &found.1, 1).unwrap_or_else(|error| panic!("{label}: still stuck: {error}"));
-            assert!(one.split(':').nth(2).is_some_and(|local| local.len() > SUBJECT_LOCAL_MAX), "{label}: the old bound refused it");
-        }
-        eprintln!("read back {} pipeline documents, {subjects} subjects", stored.len());
-        let _ = std::fs::remove_dir_all(&scratch);
-    }
-
-    /// The total bound, in the one place it lives: parts that are each a legal
-    /// label compose a local wider than 64 bytes and are refused as a whole.
-    #[test]
-    fn a_composed_local_is_bounded_whole() {
-        let mut wide = hand_off_sample();
-        wide.to_instance = Slug("a".repeat(60));
-        assert_eq!(wide.to_instance.validate("hand_off.to_instance"), Ok(()), "the receiver alone is legal");
-        assert_eq!(
-            label_text("part", &key_segment(&wide.repo.0)),
-            Ok(()),
-            "the repo alone is legal"
-        );
-        let key = pipeline_key(&PipelineDocument::HandOff(wide));
-        assert!(
-            matches!(&key, Err(PipelineRefusal::InvalidFormat { field, value }) if field == "hand_off.key" && value.len() > 64),
-            "a local of legal parts is still bounded whole, got {key:?}"
-        );
-
-        // The bound is 64 exactly, on both sides, whether the part that fills
-        // it is a plain label or an escaped repo. A hand-off local is
-        // `<receiver>.<repo>.<date>`, the repo `gamecult_-epiphany` and the
-        // date ten bytes, so the receiver fills the rest; a stewardship local is
-        // `<repo escaped>.n<N>`, so `GameCult_-` and `.n1` bound the name.
-        let hand_off_rest = "gamecult_-epiphany".len() + ".".len() + date().0.len() + ".".len();
-        let stewardship_rest = "GameCult_-".len() + ".n1".len();
-        let received = |receiver: usize| {
-            let mut hand_off = hand_off_sample();
-            hand_off.to_instance = Slug("a".repeat(receiver));
-            pipeline_key(&PipelineDocument::HandOff(hand_off))
-        };
-        let stewarded = |name: usize| {
-            let mut stewardship = stewardship_sample();
-            stewardship.repo = OrgRepo(format!("GameCult/{}", "a".repeat(name)));
-            pipeline_key(&PipelineDocument::Stewardship(stewardship))
-        };
-        for (label, at_64, at_65) in [
-            ("plain label", received(64 - hand_off_rest), received(65 - hand_off_rest)),
-            ("escaped repo", stewarded(64 - stewardship_rest), stewarded(65 - stewardship_rest)),
-        ] {
-            let keyed = at_64.unwrap_or_else(|error| panic!("{label}: a 64-byte local keys: {error}"));
-            assert_eq!(keyed.split(':').nth(2).map(str::len), Some(64), "{label}: {keyed} fills the local exactly");
-            assert!(
-                matches!(&at_65, Err(PipelineRefusal::InvalidFormat { value, .. }) if value.len() == 65),
-                "{label}: a 65-byte local is refused, got {at_65:?}"
-            );
-        }
-    }
-
-    /// The resolution side of the bound: 111 keys and 112 is refused on
-    /// `resolution.key`, filled by a resolution subject (`resolution.<L>.n1`).
-    #[test]
-    fn a_composed_resolution_local_is_bounded_whole() {
-        let overhead = "resolution.".len() + ".n1".len();
-        let subject = |length: usize| format!("{CAMPAIGN}:resolution:{}", dotted_local(length));
-        let at_max = resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead), 1)
-            .expect("a 111-byte resolution local keys");
-        assert_eq!(at_max.split(':').nth(2).map(str::len), Some(RESOLUTION_LOCAL_MAX));
-        assert!(matches!(
-            resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead + 1), 1),
-            Err(PipelineRefusal::InvalidFormat { field, value }) if field == "resolution.key" && value.len() == RESOLUTION_LOCAL_MAX + 1
-        ));
-    }
-
-    /// R2, on the composer every kind goes through: no local part carries the
-    /// separator, the head included. The live case is a hand-off with a dotted
-    /// receiver, which keys to an escaped label rather than a wider local.
-    #[test]
-    fn no_local_part_carries_the_separator() {
-        assert_eq!(
-            local("probe", PipelineKind::Question, &["a.b"]),
-            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "a.b".into() }),
-            "the head may not carry the separator"
-        );
-        assert_eq!(
-            local("probe", PipelineKind::Question, &["a", "b.c"]),
-            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "b.c".into() }),
-            "a tail part may not carry the separator"
-        );
-        assert_eq!(local("probe", PipelineKind::Question, &["a", "b", "c"]), Ok("a.b.c".into()));
-
-        let mut dotted = hand_off_sample();
-        dotted.to_instance = slug("thought-cage.GameCult");
-        let key = pipeline_key(&PipelineDocument::HandOff(dotted)).expect("a dotted receiver keys");
-        let local = key.split(':').nth(2).expect("three segments");
-        assert_eq!(local.split('.').count(), 3, "{key}: the receiver is one part, not two");
-        assert_eq!(local.split('.').next(), Some("thought-cage_dGameCult"));
-    }
-
-    /// Q17 B: a subject's resolutions are distinct records, ordered by a
-    /// per-subject sequence the key carries as its last part, so a withdrawn
-    /// resolution stays under its subject and the next closure is nameable.
-    /// The sequence is a field the writer sets and this crate only composes:
-    /// it bounds nothing beyond `u32` and the local's own width, so `0` and a
-    /// gap both key. Which sequence a document may claim, and whether an
-    /// earlier resolution still stands, are admission's rules, exactly as
-    /// `revision: 0` is.
-    #[test]
-    fn a_subject_keeps_every_resolution_it_had() {
-        let resolved = |sequence: u32| {
-            let mut resolution = resolution_sample();
-            resolution.sequence = sequence;
-            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
-        };
-        let first = resolved(1);
-        let second = resolved(2);
-        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
-        assert_eq!(second, format!("{CAMPAIGN}:resolution:question.Q1.n2"));
-        assert_ne!(first, second, "two resolutions of one subject are two documents");
-        for (sequence, key) in [(1, &first), (2, &second)] {
-            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
-            assert_eq!(root, CAMPAIGN, "{key}: the subject's root");
-            let last = format!("n{sequence}");
-            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
-            assert_eq!(local.split('.').count(), 3, "{key}: subject kind, subject local, sequence");
-        }
-
-        // Outcome-invariance now holds per sequence: one record under two
-        // outcomes is still one key, which is exactly why a second closure of
-        // a subject needs a second sequence and not a second outcome.
-        let mut withdrawn = resolution_sample();
-        withdrawn.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Resolution(withdrawn)),
-            Ok(first.clone()),
-            "one sequence is one key whatever the outcome"
-        );
-
-        // Stated limits. Both are admission's to refuse and neither is the
-        // leaf's, so both compose here.
-        assert_eq!(resolved(0), format!("{CAMPAIGN}:resolution:question.Q1.n0"), "the leaf refuses no sequence value");
-        let mut widest = resolution_sample();
-        widest.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "A") };
-        widest.sequence = u32::MAX;
-        assert_eq!(
-            pipeline_key(&PipelineDocument::Resolution(widest)),
-            Ok(format!("{CAMPAIGN}:resolution:ruling.A.n4294967295")),
-            "the widest sequence is an eleven-byte label, not a refusal"
-        );
-    }
-
-    /// D2: the sequence is the *last* part, so a subject's resolutions and
-    /// only they share the prefix `<root>:resolution:<kind>.<local>.n`. R2 is
-    /// what makes the prefix exact: no local part carries a dot, so
-    /// `question.Q1.n` cannot match `question.Q10.n1`, and the withdrawal of
-    /// `Q1`'s first resolution is a record of that resolution, one nesting
-    /// out and outside `Q1`'s prefix. Pinned as a string property, which is
-    /// what a prefix query is.
-    #[test]
-    fn a_subjects_resolutions_share_a_prefix_no_other_key_has() {
-        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
-            let mut resolution = resolution_sample();
-            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
-            resolution.sequence = sequence;
-            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("the subject keys")
-        };
-        let history = [1, 2, 3].map(|sequence| resolved(PipelineKind::Question, &id("question", "Q1").0, sequence));
-        let others = [
-            resolved(PipelineKind::Question, &id("question", "Q10").0, 1),
-            resolved(PipelineKind::Ruling, &id("ruling", "Q1").0, 1),
-            resolved(PipelineKind::Campaign, &format!("{CAMPAIGN}:campaign:self"), 1),
-            resolved(PipelineKind::Resolution, &history[0], 1),
-        ];
-        assert_eq!(
-            others[3],
-            format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"),
-            "a withdrawal keys under the resolution it withdraws, not under the subject"
-        );
-        let prefix = format!("{CAMPAIGN}:resolution:question.Q1.n");
-        let selected = history
-            .iter()
-            .chain(others.iter())
-            .filter(|key| key.starts_with(&prefix))
-            .collect::<Vec<_>>();
-        assert_eq!(
-            selected,
-            history.iter().collect::<Vec<_>>(),
-            "the prefix selects the subject's resolutions and nothing else"
-        );
-    }
-
-    /// Q18 A and Q20 A: a repo's stewardships on a mind are distinct records,
-    /// ordered by a per-`(instance, repo)` sequence the key carries last, so a
-    /// repo transferred away and later transferred back is two records under
-    /// one prefix rather than one document overwriting the other. The date is
-    /// not in the key: `assigned_on` is validated where every field is, by the
-    /// derived `Bounded` impl, and two assignments differing only in it are
-    /// one document.
-    #[test]
-    fn a_repo_keeps_every_stewardship_it_had() {
-        let stewarded = |repo: &str, sequence: u32, assigned_on: &str| {
-            let mut stewardship = stewardship_sample();
-            stewardship.repo = OrgRepo(repo.into());
-            stewardship.sequence = sequence;
-            stewardship.assigned_on = Date(assigned_on.into());
-            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
-        };
-        let first = stewarded("GameCult/Epiphany", 1, "2026-09-15");
-        let second = stewarded("GameCult/Epiphany", 2, "2026-09-16");
-        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
-        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
-        assert_ne!(first, second, "two assignments of one repo are two documents");
-        for (sequence, key) in [(1, &first), (2, &second)] {
-            let (root, local) = pipeline_id("read_back", key, PipelineKind::Stewardship).expect("reads back");
-            assert_eq!(root, INSTANCE, "{key}: the mind's root");
-            let last = format!("n{sequence}");
-            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
-            assert_eq!(local.split('.').count(), 2, "{key}: the escaped repo and the sequence, nothing else");
-        }
-
-        assert_eq!(
-            stewarded("GameCult/Epiphany", 1, "2026-09-16"),
-            first,
-            "assigned_on is a field, not a key part: one sequence is one key whatever the date"
-        );
-
-        let others = [
-            stewarded("GameCult/Epiphany_thing", 1, "2026-09-15"),
-            stewarded("GameCult/Huginn", 1, "2026-09-15"),
-        ];
-        let prefix = format!("{INSTANCE}:stewardship:gamecult_-epiphany.n");
-        let history = [first, second];
-        let selected = history
-            .iter()
-            .chain(others.iter())
-            .filter(|key| key.starts_with(&prefix))
-            .collect::<Vec<_>>();
-        assert_eq!(
-            selected,
-            history.iter().collect::<Vec<_>>(),
-            "the prefix selects the repo's assignments on this mind and nothing else"
-        );
-
-        assert_eq!(
-            stewarded("GameCult/Epiphany", 0, "2026-09-15"),
-            format!("{INSTANCE}:stewardship:gamecult_-epiphany.n0"),
-            "the leaf refuses no sequence value"
-        );
-    }
-
-    /// Cut 8: the leaf owns the serialisation of the shapes it owns, so a wire
-    /// carrying a document or a refusal reads back the same value rather than
-    /// a mirror definition kept in step by hand in the reader's repo. Both
-    /// encodings are pinned: JSON is what a schema describes, MessagePack is
-    /// what a CultCache payload is written in, and an adjacent tag has to
-    /// survive both. The tag is asserted against `name()` rather than against
-    /// a literal, because the point of the tag is that a reader dispatching on
-    /// a key's kind segment finds the same string here.
-    #[test]
-    fn every_document_and_refusal_serialises_and_reads_back() -> Result<()> {
-        for (document, _) in samples() {
-            let json = serde_json::to_value(&document)?;
-            assert_eq!(json["kind"].as_str(), Some(document.kind().name()), "{json} is tagged with its kind name");
-            assert_eq!(serde_json::from_value::<PipelineDocument>(json.clone())?, document, "{json} reads back");
-            let packed = rmp_serde::to_vec_named(&document)?;
-            assert_eq!(
-                rmp_serde::from_slice::<PipelineDocument>(&packed)?,
-                document,
-                "{:?} reads back through MessagePack",
-                document.kind()
-            );
-        }
-
-        // Every variant, and every one of them carrying its named parts: a
-        // refusal read off a wire names the field it refused, as a local one
-        // does.
-        let refusals = [
-            PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 },
-            PipelineRefusal::InvalidFormat { field: "campaign.slug".into(), value: "a b".into() },
-            PipelineRefusal::InvalidIdentity {
-                kind: PipelineKind::Campaign,
-                key: format!("{CAMPAIGN}:campaign:forged"),
-                expected: format!("{CAMPAIGN}:campaign:self"),
-            },
-            PipelineRefusal::DuplicateRepo { field: "campaign.repos".into(), repo: "gamecult/epiphany".into() },
-            PipelineRefusal::ForeignStore { r#type: <ForeignDocument as DatabaseEntry>::TYPE.into() },
-        ];
-        for refusal in &refusals {
-            let json = serde_json::to_value(refusal)?;
-            assert_eq!(&serde_json::from_value::<PipelineRefusal>(json.clone())?, refusal, "{json} reads back");
-            let packed = rmp_serde::to_vec_named(refusal)?;
-            assert_eq!(
-                &rmp_serde::from_slice::<PipelineRefusal>(&packed)?,
-                refusal,
-                "{refusal:?} reads back through MessagePack"
-            );
-        }
-
-        // The derived schemas list the same two sets. A `const` in the tag
-        // position is what a schema reader dispatches on, so it is read as the
-        // schema writes it and compared to `name()`, not to a literal list.
-        let tag = |variant: &serde_json::Value| {
-            variant["properties"]["kind"]["const"]
-                .as_str()
-                .unwrap_or_else(|| panic!("a document variant schema carries a kind const: {variant}"))
-                .to_owned()
-        };
-        let document_schema = serde_json::to_value(schemars::schema_for!(PipelineDocument))?;
-        let variants = document_schema["oneOf"].as_array().expect("the document schema is a oneOf");
-        assert_eq!(PipelineKind::ALL.len(), 13, "thirteen kinds");
-        assert_eq!(
-            variants.iter().map(tag).collect::<Vec<_>>(),
-            PipelineKind::ALL.iter().map(|kind| kind.name().to_owned()).collect::<Vec<_>>(),
-            "the document schema lists exactly the thirteen kinds, by name"
-        );
-
-        let refusal_schema = serde_json::to_value(schemars::schema_for!(PipelineRefusal))?;
-        let refusal_variants = refusal_schema["oneOf"].as_array().expect("the refusal schema is a oneOf");
-        let named = refusal_variants
-            .iter()
-            .map(|variant| {
-                let properties = variant["properties"].as_object().expect("a refusal variant is an object");
-                assert_eq!(properties.len(), 1, "{variant} is externally tagged");
-                properties.keys().next().expect("one key").to_owned()
-            })
-            .collect::<Vec<_>>();
-        assert_eq!(named, vec!["FieldBound", "InvalidFormat", "InvalidIdentity", "DuplicateRepo", "ForeignStore"]);
-        assert_eq!(named.len(), refusals.len(), "every refusal variant is in the schema and in the round trip");
-        Ok(())
-    }
-
-    #[test]
-    fn pipeline_published_schemas_match_derivation() -> Result<()> {
-        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
-        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
-        // A directory this run alone writes, so everything in it is what this
-        // run derived. A previous run's leftovers -- a mutation run's
-        // especially, since those deliberately derive schemas no committed type
-        // produces -- are not this derivation, and copying one of those into
-        // `schemas/cultnet` publishes a schema no Rust type produces. A shared
-        // directory cleared first would have to defend that clear against a
-        // held handle; an unshared one has nothing to defend. The cost is that
-        // nothing ever removes one. The directory is only created when
-        // something is stale, so a passing run leaves none -- but a failing run
-        // leaves its copies behind for good, one directory per failing run
-        // where the shared design left one however often it failed. That is the
-        // trade: the copies are the evidence the failure message names, and
-        // they outlive the run that wrote them. Whoever reads the failure is
-        // the one who deletes them.
-        let derived_dir = std::env::temp_dir().join(format!(
-            "eureka-pipeline-schemas-{}-{}",
-            std::process::id(),
-            std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_nanos()
-        ));
-        let mut stale = Vec::new();
-        for kind in PipelineKind::ALL {
-            let file = format!("{}.schema.json", kind.type_id());
-            let mut schema = serde_json::to_value(kind.derived_schema())?;
-            schema["$id"] = format!("https://gamecult.dev/epiphany/cultnet/{file}").into();
-            let derived = format!("{}\n", serde_json::to_string_pretty(&schema)?);
-            if std::fs::read(published.join(&file)).ok().as_deref() != Some(derived.as_bytes()) {
-                std::fs::create_dir_all(&derived_dir)?;
-                std::fs::write(derived_dir.join(&file), &derived)?;
-                stale.push(derived_dir.join(&file));
-            }
-            let entry = serde_json::json!({
-                "schemaId": format!("https://gamecult.dev/epiphany/cultnet/{file}"),
-                "kind": "document_payload",
-                "wireContracts": ["cultnet.schema.v0"],
-                "schemaVersion": kind.type_id(),
-                "documentType": kind.type_id(),
-                "title": format!("Epiphany Pipeline {kind:?} v2"),
-                "path": file,
-            });
-            assert!(
-                index["schemas"].as_array().is_some_and(|schemas| schemas.contains(&entry)),
-                "index.json lacks {entry}"
-            );
-        }
-        assert!(stale.is_empty(), "published pipeline schemas differ from the Rust derivation; derived copies: {stale:?}");
-        Ok(())
-    }
-
-    /// A refusal read as text names its variant and its parts, so an operator
-    /// who sees only the message (a log line, an `anyhow` chain) can tell which
-    /// field was refused and why.
-    #[test]
-    fn a_refusal_read_as_text_names_its_variant_and_parts() {
-        let text = PipelineRefusal::FieldBound { field: "title".into(), limit: 200, actual: 201 }.to_string();
-        assert!(text.starts_with("pipeline refusal: "), "{text}");
-        for part in ["FieldBound", "title", "200", "201"] {
-            assert!(text.contains(part), "{part} is missing from {text}");
-        }
-    }
-
-    /// The catalogue is exactly the files beside it: every entry's `path` is a
-    /// schema file in the directory, and every schema file in the directory
-    /// has an entry, so a schema removed from the catalogue (or a file left
-    /// behind by a move) fails here instead of publishing a dangling or
-    /// unlisted contract. Schemas whose owner is another crate (`huginn.*`)
-    /// are published by that crate, not listed here.
-    #[test]
-    fn the_catalogue_lists_exactly_the_schema_files_it_publishes() -> Result<()> {
-        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
-        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
-        let listed = index["schemas"]
-            .as_array()
-            .expect("index.json carries a schemas array")
-            .iter()
-            .map(|entry| entry["path"].as_str().expect("every entry names its file").to_owned())
-            .collect::<std::collections::BTreeSet<_>>();
-        for path in &listed {
-            assert!(published.join(path).is_file(), "index.json lists {path}, which is not in the directory");
-        }
-        let mut files = std::collections::BTreeSet::new();
-        for entry in std::fs::read_dir(&published)? {
-            let name = entry?.file_name().to_string_lossy().into_owned();
-            if name.ends_with(".schema.json") && !name.starts_with("huginn.") {
-                files.insert(name);
-            }
-        }
-        assert_eq!(listed, files, "the catalogue and the schema files beside it disagree");
-        Ok(())
-    }
-
-    /// The epoch is the version every kind is published at: its version
-    /// segment is read from the constant, not restated, and every type id
-    /// carries the same one, so a bumped epoch fails here until the kinds
-    /// move with it. The live registrar registers the kinds and nothing else,
-    /// so the foreign stand-in is not among them.
-    #[test]
-    fn every_kind_is_at_the_epochs_version() -> Result<()> {
-        let (name, version) = PIPELINE_SCHEMA_EPOCH.rsplit_once('.').expect("the epoch carries a version");
-        assert_eq!(name, "epiphany.pipeline.epoch");
-        assert!(
-            version.len() > 1 && version.starts_with('v') && version[1..].bytes().all(|byte| byte.is_ascii_digit()),
-            "{version:?} is not a version segment"
-        );
-        for kind in PipelineKind::ALL {
-            let type_id = kind.type_id();
-            assert!(type_id.ends_with(&format!(".{version}")), "{type_id} is not at the epoch's version {version}");
-        }
-
-        let mut cache = CultCache::new();
-        register_pipeline_document_types(&mut cache)?;
-        let registered = cache.registered_entry_types();
-        assert_eq!(registered.len(), PipelineKind::ALL.len(), "the live registrar registers exactly the kinds: {registered:?}");
-        for kind in PipelineKind::ALL {
-            assert!(registered.iter().any(|name| name == kind.type_id()), "{kind:?} is registered");
-        }
-        Ok(())
-    }
-
-    /// The public door onto the reference grammar, for the read side that
-    /// holds a `kind` and an `id` and no way to reach `Bounded`. Every sample
-    /// document's own key is a reference of its own kind; a kind that is not
-    /// the id's, and a local no writer composes, are `InvalidFormat` at `ref.id`.
-    #[test]
-    fn a_ref_validates_as_an_id_of_the_kind_it_declares() -> Result<()> {
-        for (document, expected) in samples() {
-            let kind = document.kind();
-            let key = pipeline_key(&document)?;
-            assert_eq!(key, expected);
-            assert_eq!(
-                PipelineRef { kind, id: s(&key) }.validate_ref(),
-                Ok(()),
-                "{kind:?}'s own key is not a reference of its kind"
-            );
-        }
-
-        let refused = |reference: PipelineRef, why: &str| {
-            let read = reference.validate_ref();
-            assert!(
-                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "ref.id"),
-                "{why}: {reference:?} was not refused, got {read:?}"
-            );
-        };
-
-        // The kind and the id's kind segment cannot disagree: the whole reason
-        // the door exists, since a reader that cannot ask would look this up
-        // and report the nothing it found.
-        refused(
-            PipelineRef { kind: PipelineKind::Campaign, id: id("question", "Q1") },
-            "a question id is not a campaign reference",
-        );
-        refused(
-            PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q1") },
-            "a question id is not a ruling reference",
-        );
-        // The local is `dotted_text` whole, so a trailing dot is refused by the
-        // reader and not only by the writer that never composes one.
-        refused(
-            PipelineRef { kind: PipelineKind::Question, id: s(&format!("{CAMPAIGN}:question:Q1.")) },
-            "a trailing dot is no local",
-        );
-
-        // The boundary, pinned rather than assumed: a resolution id missing the
-        // per-subject sequence its writer always composes is still a
-        // well-formed id of its kind here. The leaf's grammar is kind-deep, and
-        // the local's per-kind shape belongs to admission; refusing this would
-        // be a new rule in `pipeline_id`, not a door onto the one that exists.
-        assert_eq!(
-            PipelineRef { kind: PipelineKind::Resolution, id: s(&format!("{CAMPAIGN}:resolution:question.Q1")) }
-                .validate_ref(),
-            Ok(()),
-            "the leaf reads a resolution id kind-deep"
-        );
-        Ok(())
-    }
-
-    /// The public door onto the slug grammar, for a caller outside this crate
-    /// holding a bare declared name (Huginn's `require_instance` and
-    /// `Mind::open`, before either reaches admission or the filesystem). It
-    /// applies exactly `dotted_text`: one valid dotted name, and refusals for
-    /// fullwidth characters, `..`, both path separators, the empty string,
-    /// and an empty label.
-    #[test]
-    fn slug_validate_applies_the_dotted_grammar() {
-        assert_eq!(slug("huginn-yggdrasil").validate_slug(), Ok(()));
-        assert_eq!(slug("outer.inner").validate_slug(), Ok(()));
-
-        let refused = |value: &str, why: &str| {
-            let result = slug(value).validate_slug();
-            assert!(
-                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "slug"),
-                "{why}: {value:?} was not refused, got {result:?}"
-            );
-        };
-
-        refused("\u{FF41}\u{FF41}", "fullwidth characters are not ascii alphanumeric");
-        refused("..", "a bare .. is an empty label either side of the dot");
-        refused("../escaped", "a forward-slash path separator is not a label byte");
-        refused("..\\escaped", "a backslash path separator is not a label byte");
-        refused("outer\\inner", "a lone backslash inside one label is not a label byte, with no empty label to hide behind");
-        refused("", "the empty string has no label");
-        refused("outer..inner", "an empty label between two dots is refused");
-        refused(".", "a single dot is one empty label");
-
-        // S5: the 64-byte whole-name bound, pinned with a two-label name
-        // whose parts sit far under 64 bytes each (31 and 32, then 32 and
-        // 32), so only `dotted_text`'s own `value.len() > 64` check -- not
-        // `label_text`'s per-part one -- can be the check that refuses 65.
-        let filler = |n: usize| "a".repeat(n);
-        let at_64 = format!("{}.{}", filler(31), filler(32));
-        let at_65 = format!("{}.{}", filler(32), filler(32));
-        assert_eq!(at_64.len(), 64, "a 64-byte whole name, two labels well under 64 each");
-        assert_eq!(at_65.len(), 65, "one byte past the whole-name bound, same two-label shape");
-        assert_eq!(slug(&at_64).validate_slug(), Ok(()));
-        refused(&at_65, "65 bytes overall is refused, even though neither label alone reaches 64");
-
-        // S5: the 64-byte per-label bound, pinned directly against `Label`
-        // (the type `label_text` guards on its own, with no separate
-        // whole-name wrapper), and with a lone label carrying no dot, so only
-        // `label_text`'s own length check can be the one refusing 65.
-        let label_at_64 = Label::from(filler(64).as_str());
-        let label_at_65 = Label::from(filler(65).as_str());
-        assert_eq!(label_at_64.validate("label"), Ok(()));
-        assert!(
-            matches!(
-                label_at_65.validate("label"),
-                Err(PipelineRefusal::InvalidFormat { ref field, .. }) if field == "label"
-            ),
-            "a 65-byte label was not refused, got {:?}",
-            label_at_65.validate("label")
-        );
-
-        // S5: NUL is refused as a label byte, not merely as one more
-        // non-alphanumeric character that happens to be caught by coincidence.
-        refused("a\u{0}b", "NUL is not a label byte");
-    }
-
-    /// The two doors added beside `Slug::validate_slug` (RS-L), on its
-    /// pattern: each delegates to the grammar its own document field already
-    /// carries, so a declared name checked through the door and a field of
-    /// the same type refuse the same inputs. `OrgRepo` is the `repo` alias's
-    /// domain and `Label` is the `cut` alias's (RS-3's vocabulary table).
-    #[test]
-    fn the_org_repo_and_label_doors_are_the_grammar() {
-        assert_eq!(OrgRepo::from("GameCult/Epiphany").validate_org_repo(), Ok(()));
-        assert_eq!(OrgRepo::from("a/b").validate_org_repo(), Ok(()));
-        assert_eq!(OrgRepo::from("a-b/c.d_e").validate_org_repo(), Ok(()));
-        // Consecutive hyphens stay allowed on both sides; only a leading or
-        // trailing owner hyphen is refused.
-        assert_eq!(OrgRepo::from("a--b/c--d").validate_org_repo(), Ok(()));
-        // S4: a 39-byte owner is accepted, a 100-byte repo is accepted.
-        let owner_at_39 = format!("{}/b", "a".repeat(39));
-        assert_eq!(OrgRepo::from(owner_at_39.as_str()).validate_org_repo(), Ok(()));
-        let repo_at_100 = format!("a/{}", "a".repeat(100));
-        assert_eq!(OrgRepo::from(repo_at_100.as_str()).validate_org_repo(), Ok(()));
-        let repo_refused = |value: &str, why: &str| {
-            let result = OrgRepo::from(value).validate_org_repo();
-            assert!(
-                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "org_repo"),
-                "{why}: {value:?} was not refused, got {result:?}"
-            );
-        };
-        repo_refused("GameCult", "no slash at all");
-        repo_refused("/Repo", "an empty org before the slash");
-        repo_refused("GameCult/", "an empty repo after the slash");
-        repo_refused("a/b/c", "a second slash makes the repo half ambiguous");
-        repo_refused("../..", "an owner of dots is not GitHub's grammar");
-        repo_refused("a/..", "a repo of .. is refused outright");
-        repo_refused("a/.", "a repo of . is refused outright");
-        repo_refused("-a/b", "a leading hyphen is not a valid owner");
-        repo_refused("a-/b", "a trailing hyphen is not a valid owner");
-        repo_refused("a b/c", "a space is not an owner byte");
-        repo_refused("a/b c", "a space is not a repo byte");
-        repo_refused("\u{e9}/\u{fc}", "non-ascii bytes are refused on either side");
-        repo_refused("\0/\0", "NUL is refused on either side");
-        repo_refused("a\n/b", "a newline is not an owner byte");
-        let owner_at_40 = format!("{}/b", "a".repeat(40));
-        repo_refused(&owner_at_40, "40 bytes is past the 39-byte owner bound");
-        let repo_at_101 = format!("a/{}", "a".repeat(101));
-        repo_refused(&repo_at_101, "101 bytes is past the 100-byte repo bound");
-        repo_refused("a//b", "an empty middle segment is still a second slash");
-        repo_refused("/b", "an empty owner is refused");
-        repo_refused("a/", "an empty repo is refused");
-        repo_refused("a.b/c", "a dot is not an owner byte");
-        repo_refused("a_b/c", "an underscore is not an owner byte");
-        // F7 fix batch: a repo name ending in `.git` is refused.
-        repo_refused("a/b.git", "a repo ending in .git is refused");
-        repo_refused("a/.git", "a repo of exactly .git is still a .git suffix");
-        // S-2: the `.git` refusal is ASCII-case-insensitive, so a case variant
-        // cannot dodge it and reach an `identity()` the validator refuses.
-        repo_refused("a/b.GIT", "a repo ending in .GIT is refused like .git");
-        repo_refused("a/.GIT", "a repo of exactly .GIT is still a .git suffix");
-        repo_refused("A/B.GIT", "a mixed-case owner and a .GIT repo both refuse");
-        repo_refused("a/b.GiT", "a mixed-case .git suffix is refused");
-
-        // identity(): the one canonical key, ASCII-lowercased. Every
-        // comparison, hash, ordering and key derivation goes through it.
-        assert_eq!(
-            OrgRepo::from("GameCult/Epiphany").identity(),
-            OrgRepo::from("gamecult/epiphany").identity()
-        );
-        assert_eq!(OrgRepo::from("GameCult/Epiphany").identity(), "gamecult/epiphany");
-
-        // S-1: it is structural, not advisory. `==` on `OrgRepo` compares
-        // identity, not the raw string, so the two spellings are one
-        // repository wherever `OrgRepo` is compared, hashed or ordered.
-        assert_eq!(OrgRepo::from("GameCult/Epiphany"), OrgRepo::from("gamecult/epiphany"));
-        assert_eq!(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany")), std::cmp::Ordering::Equal);
-        assert_eq!(
-            OrgRepo::from("GameCult/Epiphany").partial_cmp(&OrgRepo::from("gamecult/epiphany")),
-            Some(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany"))),
-            "partial_cmp must agree with cmp for an equal pair"
-        );
-
-        // RS-L closing fix 1: every assertion above compares values that
-        // should be equal, so `eq -> true`, `hash -> ()` and `cmp -> Equal`
-        // all survive as mutants. Pin the unequal direction as well: two
-        // different repos must be unequal, hash differently (with
-        // overwhelming probability, not by construction, so this is belt and
-        // suspenders on top of the `!=` and `cmp` checks), and not compare
-        // `Equal`, and `partial_cmp` must agree with `cmp` for an unequal
-        // pair too, per std's own contract that `partial_cmp(a, b) ==
-        // Some(cmp(a, b))`.
-        let a = OrgRepo::from("GameCult/Epiphany");
-        let b = OrgRepo::from("GameCult/Aetheria");
-        assert_ne!(a, b, "two different repos must not compare equal");
-        assert_ne!(
-            a.cmp(&b),
-            std::cmp::Ordering::Equal,
-            "two different repos must not order as Equal"
-        );
-        assert_eq!(
-            a.partial_cmp(&b),
-            Some(a.cmp(&b)),
-            "partial_cmp must agree with cmp for an unequal pair"
-        );
-        let hash_of = |repo: &OrgRepo| {
-            use std::hash::{Hash, Hasher};
-            let mut hasher = std::collections::hash_map::DefaultHasher::new();
-            repo.hash(&mut hasher);
-            hasher.finish()
-        };
-        assert_ne!(
-            hash_of(&a),
-            hash_of(&b),
-            "two different repos must hash differently"
-        );
-
-        let mut hash_map = std::collections::HashMap::new();
-        hash_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
-        hash_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
-        assert_eq!(hash_map.len(), 1, "a HashMap keyed by both spellings holds one entry");
-        assert_eq!(hash_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
-
-        let mut btree_map = std::collections::BTreeMap::new();
-        btree_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
-        btree_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
-        assert_eq!(btree_map.len(), 1, "a BTreeMap keyed by both spellings holds one entry");
-        assert_eq!(btree_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
-
-        // `identity()` is always itself a valid `OrgRepo`: lowercasing never
-        // turns a valid repository into one the grammar refuses, and never
-        // turns a refused one into one it accepts.
-        for value in ["GameCult/Epiphany", "A/B", "a-B/c.D_e", "GameCult/Epiphany.GIT"] {
-            let repo = OrgRepo::from(value);
-            assert_eq!(
-                repo.validate_org_repo().is_ok(),
-                OrgRepo::from(repo.identity().as_str()).validate_org_repo().is_ok(),
-                "identity() of {value:?} disagreed with the value's own validity"
-            );
-        }
-
-        assert_eq!(Label::from("cut-10").validate_label(), Ok(()));
-        let label_refused = |value: &str, why: &str| {
-            let result = Label::from(value).validate_label();
-            assert!(
-                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "label"),
-                "{why}: {value:?} was not refused, got {result:?}"
-            );
-        };
-        label_refused("", "the empty string has no label");
-        label_refused("a.b", "a dot is not a label byte");
-        label_refused(&"a".repeat(65), "65 bytes is past the 64-byte label bound");
-        label_refused("\u{e9}", "a non-ascii byte is not a label byte");
-    }
-
-    /// Q-RS1, ruled B: `question` and `ruling` gain a required `title`, the
-    /// new `Title` type shared with the two titles that move off `Short`
-    /// (campaign, cut spec). Each kind round-trips through `prepare`/`decode`
-    /// with its title intact, an empty title is refused for both, and the
-    /// bound is pinned at its edge: 200 bytes accepted, 201 refused (L3 dies
-    /// on the removal of the non-empty check, not on the length bound, since
-    /// `Title`'s length bound is shared with every other `bounded_text!`
-    /// member and already covered by `bounds_refuse_in_utf8_bytes`).
-    #[test]
-    fn question_and_ruling_carry_a_title() -> Result<()> {
-        let cache = schema_cache()?;
-
-        let mut question = question_sample();
-        question.title = t("Who owns the state?");
-        let envelope = PipelineDocument::Question(question.clone()).prepare(&cache)?;
-        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Question(question.clone()));
-
-        let mut ruling = ruling_sample();
-        ruling.title = t("An instance owns its mind");
-        let envelope = PipelineDocument::Ruling(ruling.clone()).prepare(&cache)?;
-        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Ruling(ruling.clone()));
-
-        question.title = Title(String::new());
-        assert_eq!(
-            PipelineDocument::Question(question.clone()).validate(),
-            Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: String::new() })
-        );
-        ruling.title = Title(String::new());
-        assert_eq!(
-            PipelineDocument::Ruling(ruling.clone()).validate(),
-            Err(PipelineRefusal::InvalidFormat { field: "ruling.title".into(), value: String::new() })
-        );
-
-        // F2 second fix batch: a title holds at least one
-        // `char::is_alphanumeric()` character, no `char::is_control()`
-        // character, and no bidi control character. No zero-width denylist:
-        // a zero-width joiner/non-joiner inside real text is allowed, and a
-        // string of nothing but invisible characters is refused because it
-        // has no alphanumeric character, not because those characters are
-        // individually denylisted.
-        let refused = |value: &str| {
-            let mut refused_question = question.clone();
-            refused_question.title = Title(value.into());
-            assert_eq!(
-                PipelineDocument::Question(refused_question).validate(),
-                Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: value.into() }),
-                "{value:?} should be refused"
-            );
-        };
-        refused(" ");
-        refused("\u{7f}");
-        refused("a\u{7f}");
-        refused("\u{0}");
-        refused("\u{9f}");
-        refused("\u{2028}");
-        refused("\u{202e}"); // RLO alone
-        refused("\u{202e}text"); // RLO plus text
-        refused("\u{200e}"); // LRM alone
-        refused("\u{0301}"); // a lone combining mark
-        refused("\u{fe0f}"); // a variation selector alone
-        refused("\u{a0}"); // NBSP alone
-        refused("\u{1f680}"); // emoji only
-
-        // S-3: every one of the twelve bidi control code points is pinned
-        // with an embedded fixture (real alphanumeric text on both sides), so
-        // the alphanumeric rule cannot mask a hole in the bidi match arm the
-        // way a lone-character fixture would.
-        refused("a\u{061C}b"); // ALM
-        refused("a\u{200E}b"); // LRM
-        refused("a\u{200F}b"); // RLM
-        refused("a\u{202A}b"); // LRE
-        refused("a\u{202B}b"); // RLE
-        refused("a\u{202C}b"); // PDF
-        refused("a\u{202D}b"); // LRO
-        refused("a\u{202E}b"); // RLO
-        refused("a\u{2066}b"); // LRI
-        refused("a\u{2067}b"); // RLI
-        refused("a\u{2068}b"); // FSI
-        refused("a\u{2069}b"); // PDI
-
-        // S-4: U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR are
-        // refused inside otherwise-alphanumeric text, not only alone, since
-        // `char::is_control()` does not reach `Zl`/`Zp`.
-        refused("a\u{2028}b");
-        refused("a\u{2029}b");
-
-        let accepted = |value: &str| {
-            let mut accepted_question = question.clone();
-            accepted_question.title = Title(value.into());
-            assert_eq!(
-                PipelineDocument::Question(accepted_question).validate(),
-                Ok(()),
-                "{value:?} should validate"
-            );
-        };
-        accepted("a");
-        accepted("\u{e9}");
-        accepted("\u{200c}\u{647}\u{6cc}"); // Persian text containing ZWNJ
-        accepted("a\u{200d}b");
-        accepted("a \u{1f680}");
-        accepted(" a ");
-        // Discrepancy from the fix spec: HANGUL FILLER (U+3164) is Unicode
-        // General_Category Lo, so `char::is_alphanumeric()` is true for it in
-        // this toolchain; it is not a denylist candidate, since the fix
-        // batch deletes the hand-written exclusion list on purpose. A title
-        // of U+3164 alone is therefore accepted, not refused.
-        accepted("\u{3164}");
-
-        question.title = Title("a".repeat(200));
-        assert_eq!(PipelineDocument::Question(question.clone()).validate(), Ok(()));
-        question.title = Title("a".repeat(201));
-        assert_eq!(
-            PipelineDocument::Question(question).validate(),
-            Err(PipelineRefusal::FieldBound { field: "question.title".into(), limit: 200, actual: 201 })
-        );
-        Ok(())
-    }
-}
+//! Eureka pipeline documents: the typed shape of a Eureka campaign's state.
+//!
+//! This is a leaf type library, and deliberately nothing else. It owns document
+//! shape, field bounds, formats, key derivation and the JSON schemas published
+//! under `schemas/cultnet`; it owns no storage, no admission, no process and no
+//! network. That is the whole reason it is a package: the organ that will admit
+//! these documents depends on these types without depending on the harness
+//! that used to hold them.
+//!
+//! Every kind is a plain `serde` + `JsonSchema` value inside a one-slot
+//! `DatabaseEntry` wrapper, always prepared with `prepare_entry_named`, so the
+//! stored payload is `[value]` and the value is the named map the published
+//! schema describes. Keys are semantic: `pipeline_key` derives them from the
+//! value, and the write validator refuses any envelope whose key differs.
+//!
+//! Every key is `<root>:<kind>:<local>`, three segments for every kind with
+//! none excused: the root is a `Slug`, the kind is the literal kind name, and
+//! the local is `Label`s joined by `.`, so no local part carries a dot and a
+//! reader recovers the parts by splitting. A root's local is the constant
+//! `self`; a resolution's local is its subject's kind and local. A
+//! resolution's local ends in its per-subject sequence, `n<N>`, and a
+//! stewardship's in its per-repo sequence, so a subject's resolutions and a
+//! repo's assignments each share a prefix.
+//!
+//! **Validation follows the type.** `value_types!` is the single field list: it
+//! emits the struct and its `Bounded` impl from the same tokens, so a field
+//! cannot be declared without being validated. Format rules live in the field's
+//! type (`Label`, `Slug`, `OrgRepo`, `Sha`, `Sha256Hex`, `Date`), never in a
+//! hand-written impl that a later field can slip past. A `Vec` field must carry
+//! a maximum, because `Vec<T>` has no `Bounded` impl of its own.
+//!
+//! The wrappers are crate-private: outside code registers, prepares and
+//! decodes them through `register_pipeline_document_types`,
+//! `PipelineDocument::prepare` and `PipelineDocument::decode`, and validates a
+//! write through `validate_pipeline_write_envelope`.
+
+// `anyhow` is the cache's own error type, which `prepare` and the registrar
+// pass through; every refusal this crate decides is a `PipelineRefusal`.
+use anyhow::Result;
+use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry};
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+/// Typed refusals of the pipeline documents: bounds, formats and key identity
+/// (D2's document half), and `ForeignStore`, raised by `decode` for an
+/// envelope of any other type. This is every refusal the leaf decides; a
+/// store's identity and its schema epoch are not decided here, since this
+/// crate owns no store, and belong to the organ that will admit these
+/// documents.
+///
+/// Serialised externally tagged, serde's default for an enum: each variant is
+/// a one-key map from the variant's name to its named fields, so `field` and
+/// `value` are on the wire under their own names and a reader of a refusal
+/// carried over a wire reads the same parts a local caller matches on. No
+/// attribute buys that, which is why there is none: an internal or adjacent
+/// tag would move the fields under a content key without making any of them
+/// more visible.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum PipelineRefusal {
+    FieldBound { field: String, limit: u32, actual: u32 },
+    InvalidFormat { field: String, value: String },
+    InvalidIdentity { kind: PipelineKind, key: String, expected: String },
+    DuplicateRepo { field: String, repo: String },
+    ForeignStore { r#type: String },
+}
+
+impl std::fmt::Display for PipelineRefusal {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(formatter, "pipeline refusal: {self:?}")
+    }
+}
+
+impl std::error::Error for PipelineRefusal {}
+
+pub(crate) trait Bounded {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal>;
+}
+
+impl<T: Bounded> Bounded for Option<T> {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        self.as_ref().map_or(Ok(()), |value| value.validate(field))
+    }
+}
+
+macro_rules! unbounded_scalars {
+    ($($ty:ty),* $(,)?) => {$(
+        impl Bounded for $ty {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+    )*};
+}
+
+unbounded_scalars!(u32, u64, bool);
+
+fn bound(field: &str, limit: usize, actual: usize) -> Result<(), PipelineRefusal> {
+    if actual > limit {
+        return Err(PipelineRefusal::FieldBound {
+            field: field.into(),
+            limit: limit as u32,
+            actual: actual as u32,
+        });
+    }
+    Ok(())
+}
+
+/// List maximums only. Minimum counts are admission rules with their own
+/// refusals (Cut 3b), so a bounds pass never pre-empts them.
+fn list<T: Bounded>(field: &str, items: &[T], max: usize) -> Result<(), PipelineRefusal> {
+    bound(field, max, items.len())?;
+    for (index, item) in items.iter().enumerate() {
+        item.validate(&format!("{field}[{index}]"))?;
+    }
+    Ok(())
+}
+
+fn format_error(field: &str, value: &str) -> PipelineRefusal {
+    PipelineRefusal::InvalidFormat {
+        field: field.into(),
+        value: value.into(),
+    }
+}
+
+fn hex(field: &str, value: &str, lengths: std::ops::RangeInclusive<usize>) -> Result<(), PipelineRefusal> {
+    let lower_hex = value.bytes().all(|byte| matches!(byte, b'0'..=b'9' | b'a'..=b'f'));
+    if !lengths.contains(&value.len()) || !lower_hex {
+        return Err(format_error(field, value));
+    }
+    Ok(())
+}
+
+/// A key label: `[A-Za-z0-9_-]{1,64}`. Dots are excluded so that a composed key
+/// segments unambiguously; see `local`.
+fn label_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let valid = value
+        .bytes()
+        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'));
+    if !valid || value.is_empty() || value.len() > 64 {
+        return Err(format_error(field, value));
+    }
+    Ok(())
+}
+
+/// A dotted key segment: label parts joined by `.`, at most 64 bytes. Every
+/// part must be a label, so `..`, a leading or trailing dot, and an empty part
+/// are all refused.
+fn dotted_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    dotted_within(field, value, 64)
+}
+
+/// `dotted_text`'s grammar with the bound as a parameter: the one place a
+/// dotted segment is parsed, whoever owns the bound.
+fn dotted_within(field: &str, value: &str, max: usize) -> Result<(), PipelineRefusal> {
+    if value.is_empty() || value.len() > max {
+        return Err(format_error(field, value));
+    }
+    for part in value.split('.') {
+        label_text(field, part)?;
+    }
+    Ok(())
+}
+
+/// GitHub's own grammar for `owner/repo`, exactly one `/`: the owner is
+/// `[A-Za-z0-9-]`, 1 to 39 bytes, with no leading or trailing hyphen; the repo
+/// is `[A-Za-z0-9._-]`, 1 to 100 bytes, is never `.` or `..`, and does not end
+/// in `.git`, ASCII-case-insensitively (`a/b.GIT` is refused exactly as
+/// `a/b.git` is), so the suffix rule cannot be dodged by a case variant whose
+/// `identity()` is refused. The repo's own byte alphabet excludes `/`, so a
+/// second `/` inside it is already refused by the byte check; no separate
+/// `contains('/')` check is needed.
+fn org_repo_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let valid = value.split_once('/').is_some_and(|(owner, repo)| {
+        (1..=39).contains(&owner.len())
+            && owner.bytes().all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+            && !owner.starts_with('-')
+            && !owner.ends_with('-')
+            && (1..=100).contains(&repo.len())
+            && repo.bytes().all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+            && repo != "."
+            && repo != ".."
+            && !(repo.len() >= 4 && repo[repo.len() - 4..].eq_ignore_ascii_case(".git"))
+    });
+    if valid {
+        Ok(())
+    } else {
+        Err(format_error(field, value))
+    }
+}
+
+macro_rules! bounded_text {
+    ($($(#[$doc:meta])* $name:ident = $limit:literal, $check:expr;)*) => {$(
+        #[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        #[serde(transparent)]
+        #[schemars(extend("maxLength" = $limit))]
+        $(#[$doc])*
+        pub struct $name(pub String);
+        impl Bounded for $name {
+            fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+                let check: fn(&str, &str) -> Result<(), PipelineRefusal> = $check;
+                check(field, &self.0)
+            }
+        }
+        impl From<&str> for $name {
+            fn from(value: &str) -> Self {
+                Self(value.into())
+            }
+        }
+    )*};
+}
+
+fn within(limit: usize) -> impl Fn(&str, &str) -> Result<(), PipelineRefusal> {
+    move |field: &str, value: &str| bound(field, limit, value.len())
+}
+
+/// A title holds at least one `char::is_alphanumeric()` character, no
+/// `char::is_control()` character, no U+2028 LINE SEPARATOR or U+2029
+/// PARAGRAPH SEPARATOR (both `Zl`/`Zp`, so `is_control()` does not reach
+/// them, and a one-line field should carry no hard line break), and no bidi
+/// control character: `U+061C`, `U+200E`, `U+200F`, `U+202A`-`U+202E`,
+/// `U+2066`-`U+2069`. No denylist of individual zero-width or format
+/// characters is maintained here; a character not covered by one of these
+/// tests is allowed, so ZWJ and ZWNJ still work.
+fn title_text(field: &str, value: &str) -> Result<(), PipelineRefusal> {
+    let alphanumeric = value.chars().any(|character| character.is_alphanumeric());
+    let control = value
+        .chars()
+        .any(|character| character.is_control() || matches!(character, '\u{2028}' | '\u{2029}'));
+    let bidi = value.chars().any(|character| {
+        matches!(
+            character,
+            '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}'
+        )
+    });
+    if !alphanumeric || control || bidi {
+        return Err(format_error(field, value));
+    }
+    within(200)(field, value)
+}
+
+bounded_text! {
+    /// Text of at most 200 UTF-8 bytes.
+    Short = 200, |field, value| within(200)(field, value);
+    /// A title: 1 to 200 UTF-8 bytes, enforced by admission; JSON Schema
+    /// length counts characters. Holds at least one alphanumeric character,
+    /// no control character, and no bidi control character (`U+061C`,
+    /// `U+200E`, `U+200F`, `U+202A`-`U+202E`, `U+2066`-`U+2069`).
+    #[schemars(extend("minLength" = 1))]
+    Title = 200, title_text;
+    /// Text of at most 1,000 UTF-8 bytes.
+    Line = 1000, |field, value| within(1000)(field, value);
+    /// Text of at most 4,000 UTF-8 bytes; longer narrative is cited by `DocRef`.
+    Para = 4000, |field, value| within(4000)(field, value);
+    /// A key label: `[A-Za-z0-9_-]{1,64}`.
+    Label = 64, label_text;
+    /// A campaign slug or key segment: label parts joined by `.`.
+    Slug = 64, dotted_text;
+    /// A git commit id: 7-40 lowercase hex characters.
+    Sha = 40, |field, value| hex(field, value, 7..=40);
+    /// A full git commit id: exactly 40 lowercase hex characters.
+    FullSha = 40, |field, value| hex(field, value, 40..=40);
+    /// A SHA-256 digest: exactly 64 lowercase hex characters.
+    Sha256Hex = 64, |field, value| hex(field, value, 64..=64);
+}
+
+impl Sha {
+    /// The type's identity rule: two spellings name one commit when one is a
+    /// prefix of the other, so a 7-character abbreviation and the full id of
+    /// the same commit are equal here though not `==`. Both are already 7-40
+    /// lowercase hex. Two distinct commits that share a 7-character prefix are
+    /// git's ambiguity, not the mind's.
+    pub fn names_same_commit(&self, other: &Sha) -> bool {
+        self.0.starts_with(&other.0) || other.0.starts_with(&self.0)
+    }
+}
+
+impl Slug {
+    /// The public door onto the slug grammar, for a caller outside this crate
+    /// that holds a bare `Slug` and no way to reach `Bounded`, which is
+    /// crate-private. On the pattern of `PipelineRef::validate_ref`: it
+    /// delegates so the grammar keeps one owner, and it applies exactly the
+    /// `dotted_text` check that every `Slug` field in this crate is held to,
+    /// so a caller that validates a declared name this way and a document
+    /// field of the same type refuse the same inputs. Named `validate_slug`
+    /// rather than a bare `validate`, because an inherent `validate` would
+    /// shadow `Bounded`'s for every in-crate caller holding a `Slug`.
+    pub fn validate_slug(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "slug")
+    }
+}
+
+/// A GitHub repository as `Org/Repo`, at most 140 UTF-8 bytes (39 + 1 +
+/// 100). The owner is 1 to 39 `[A-Za-z0-9-]` bytes with no leading or
+/// trailing hyphen; the repo is 1 to 100 `[A-Za-z0-9._-]` bytes, is never
+/// `.` or `..`, and does not end in `.git`, ASCII-case-insensitively.
+/// Identity is case-insensitive: `GameCult/Epiphany` and `gamecult/epiphany`
+/// are the same repository.
+//
+// The raw string is display-only. `OrgRepo` is not generated by
+// `bounded_text!`: that macro derives `PartialEq`, `Eq`, `Hash`, `PartialOrd`
+// and `Ord` on the raw string, with no per-member override, so a type built
+// from it compares and keys on spelling. `OrgRepo` instead carries
+// hand-written impls of those five traits, every one of them over
+// `identity()` (the ASCII-lowercased value), so `==`, a `BTreeMap` key and a
+// `HashMap` key are all case-insensitive by construction: `GameCult/Epiphany`
+// and `gamecult/epiphany` compare equal, hash equal, order together and
+// collapse to one map entry, and a caller cannot reach the case-sensitive
+// behaviour by accident. `Hash` and `Eq` agree because both are defined over
+// the same `identity()` string. Every other bounded type keeps the macro's
+// derives untouched. This reasoning is a source comment, not a doc comment,
+// so it does not enter the published schema description (RS-L closing fix 2):
+// a consumer needs the grammar, the bound and the case-insensitivity, not the
+// Rust-macro justification for how that got built.
+#[derive(Clone, Debug, Default, Serialize, Deserialize, JsonSchema)]
+#[serde(transparent)]
+#[schemars(extend("maxLength" = 140))]
+pub struct OrgRepo(pub String);
+
+impl Bounded for OrgRepo {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        org_repo_text(field, &self.0)
+    }
+}
+
+impl From<&str> for OrgRepo {
+    fn from(value: &str) -> Self {
+        Self(value.into())
+    }
+}
+
+impl PartialEq for OrgRepo {
+    fn eq(&self, other: &Self) -> bool {
+        self.identity() == other.identity()
+    }
+}
+
+impl Eq for OrgRepo {}
+
+impl std::hash::Hash for OrgRepo {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.identity().hash(state);
+    }
+}
+
+impl PartialOrd for OrgRepo {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for OrgRepo {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.identity().cmp(&other.identity())
+    }
+}
+
+impl OrgRepo {
+    /// The public door onto the `org_repo` grammar, for a caller outside this
+    /// crate that holds a bare `OrgRepo` (the organ's `repo` alias, RS-3) and
+    /// no way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
+    /// delegates to `org_repo_text` through `Bounded::validate`, so the
+    /// grammar keeps one owner and a declared name checked this way refuses
+    /// exactly what a document's own `OrgRepo` field refuses.
+    pub fn validate_org_repo(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "org_repo")
+    }
+
+    /// The one canonical key for an `OrgRepo`: the value, ASCII-lowercased.
+    /// Every comparison, hash, ordering and lookup keyed by repository
+    /// identity goes through this — `PartialEq`, `Hash` and `Ord` above are
+    /// all defined in terms of it — so `GameCult/Epiphany` and
+    /// `gamecult/epiphany` are the same repository everywhere, not only where
+    /// a caller remembers to ask.
+    pub fn identity(&self) -> String {
+        self.0.to_ascii_lowercase()
+    }
+}
+
+impl Label {
+    /// The public door onto the label grammar, for a caller outside this
+    /// crate that holds a bare `Label` (the organ's `cut` alias, RS-3) and no
+    /// way to reach `Bounded`. On the pattern of `Slug::validate_slug`: it
+    /// delegates to `label_text` through `Bounded::validate`, so the grammar
+    /// keeps one owner and a declared name checked this way refuses exactly
+    /// what a document's own `Label` field refuses.
+    pub fn validate_label(&self) -> Result<(), PipelineRefusal> {
+        Bounded::validate(self, "label")
+    }
+}
+
+/// A calendar date, `YYYY-MM-DD`.
+#[derive(Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+#[serde(transparent)]
+#[schemars(extend("maxLength" = 10))]
+pub struct Date(pub String);
+
+impl Bounded for Date {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        match chrono::NaiveDate::parse_from_str(&self.0, "%Y-%m-%d") {
+            Ok(_) if self.0.len() == 10 => Ok(()),
+            _ => Err(format_error(field, &self.0)),
+        }
+    }
+}
+
+macro_rules! bounded_field {
+    ($value:expr, $field:expr) => {
+        Bounded::validate(&$value, $field)?
+    };
+    ($value:expr, $field:expr, $max:literal) => {
+        list($field, &$value, $max)?
+    };
+}
+
+/// The single field list: one invocation emits the value struct and its
+/// `Bounded` impl, so a field can never be left out of validation.
+macro_rules! value_types {
+    ($($(#[$attr:meta])* pub struct $name:ident { $($field:ident: $ty:ty $([$max:literal])?),* $(,)? } $(=> $extra:path)?)*) => {$(
+        $(#[$attr])*
+        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+        pub struct $name {
+            $(
+                $(#[schemars(extend("maxItems" = $max))])?
+                pub $field: $ty
+            ),*
+        }
+
+        impl Bounded for $name {
+            fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
+                $(bounded_field!(self.$field, &format!("{at}.{}", stringify!($field)) $(, $max)?);)*
+                $($extra(self, at)?;)?
+                Ok(())
+            }
+        }
+    )*};
+}
+
+macro_rules! unit_enums {
+    ($($name:ident { $($variant:ident),* $(,)? })*) => {$(
+        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        pub enum $name { $($variant),* }
+        impl Bounded for $name {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+    )*};
+}
+
+/// RS-L closing fix 4: `campaign.repos` refuses two entries naming the same
+/// repository by identity, not by raw spelling, so `GameCult/Epiphany` and
+/// `gamecult/epiphany` in one list refuse exactly as one entry twice would.
+/// This is a cross-element invariant on `PipelineCampaign` alone, not a
+/// per-type format rule any other `value_types!` struct shares, so it is
+/// wired in as that struct's one `=> extra` hook rather than folded into
+/// `Bounded for OrgRepo` or the list bound in `bounded_field!`.
+fn campaign_repos_are_distinct(campaign: &PipelineCampaign, at: &str) -> Result<(), PipelineRefusal> {
+    let mut seen = std::collections::HashSet::new();
+    for repo in &campaign.repos {
+        if !seen.insert(repo.identity()) {
+            return Err(PipelineRefusal::DuplicateRepo {
+                field: format!("{at}.repos"),
+                repo: repo.0.clone(),
+            });
+        }
+    }
+    Ok(())
+}
+
+unit_enums! {
+    EvidenceKind { Command, Test, Mutation, Probe, SourceRead, Capture }
+    ClaimOutcome { Holds, Falsified, Unproven }
+    FindingConfidence { Confirmed, Plausible }
+    FindingSeverity { Blocker, High, Medium, Low }
+    RulingAuthority { Operator, Standing, Defaulted }
+    FindingOrigin { Introduced, PreExisting }
+}
+
+value_types! {
+    pub struct CodeLocation { path: Short, line: u32, end_line: Option<u32> }
+    pub struct CommitRange { base: Sha, head: Sha }
+    pub struct Evidence { kind: EvidenceKind, locator: Line, result: Line }
+    /// A citation of a document in another repo's pipeline store (D6).
+    pub struct ForeignRef { repo: OrgRepo, commit: FullSha, kind: PipelineKind, id: Short, payload_sha256: Sha256Hex }
+    pub struct DocRef { path: Short, start_line: u32, end_line: u32, commit: Sha }
+    pub struct TargetInvariant { label: Label, statement: Line }
+    pub struct QuestionOption { label: Label, text: Line }
+    pub struct CutDelete { path: Short, lines: u32, note: Line }
+    pub struct FileChange { location: CodeLocation, change: Line }
+    pub struct AuthorityMap {
+        owner: Line, inputs: Vec<Line>[16], outputs: Vec<Line>[16], derived_state: Vec<Line>[16],
+        forbidden_writers: Vec<Line>[16], shared_paths: Vec<Line>[16], deletion_line: Line,
+    }
+    pub struct VerificationTest { name: Short, pins: Line }
+    pub struct NegativeCheck { pattern: Short, scope: Line }
+    pub struct CutVerification {
+        builds: Vec<Line>[64], tests: Vec<VerificationTest>[64],
+        negative: Vec<NegativeCheck>[64], operator: Vec<Line>[64],
+    }
+    pub struct ReportCommit { sha: Sha, subject: Line, builds: bool }
+    /// One mutation a report ran: a key-safe label a verdict claim can name,
+    /// the exact edit, and the tree it was applied to.
+    pub struct MutationRecord { label: Label, rule: Line, location: CodeLocation, before: Line, after: Line, commit: Sha, failed_as_expected: bool }
+    pub struct Deviation { what: Line, why: Line }
+    // D1 tables no maximum for these lists, so they take the shared list
+    // default of 64 rather than a number invented for this field alone.
+    pub struct StructuralDelta {
+        lines_added: u32, lines_removed: u32,
+        dependencies_added: Vec<Short>[64], dependencies_removed: Vec<Short>[64],
+        formats_added: Vec<Short>[64], formats_removed: Vec<Short>[64],
+        targets_added: Vec<Short>[64], targets_removed: Vec<Short>[64],
+    }
+    /// A name the cut landed, and where it lives.
+    pub struct LandedName { name: Short, path: Short }
+    /// A promise a report makes about what it landed. Not a document and not
+    /// resolvable: it is identified by its report's id and its label, as a
+    /// `TargetInvariant` is by its target's. Soul measures every one (ruling
+    /// A), and the rule that every one is measured is admission's.
+    pub struct Promise { label: Label, text: Line }
+    /// The promise this claim measured, and the report's mutations it ran. An
+    /// `Unproven` claim with a promise is one Soul could not reach.
+    pub struct VerdictClaim {
+        claim: Line, outcome: ClaimOutcome, evidence: Vec<Evidence>[8], findings: Vec<Short>[16],
+        promise: Option<Label>, mutations: Vec<Label>[8],
+    }
+
+    pub struct PipelineCampaign { slug: Slug, title: Title, repos: Vec<OrgRepo>[8], working_branch: Short, target_doc: DocRef } => campaign_repos_are_distinct
+    pub struct PipelineTarget {
+        campaign: Slug, revision: u32, invariants: Vec<TargetInvariant>[32], not_in_scope: Vec<Line>[32],
+        canonical_implementations: Vec<Line>[16], doc: DocRef,
+    }
+    pub struct PipelineQuestion {
+        campaign: Slug, label: Label, title: Title, question: Para, options: Vec<QuestionOption>[8], recommended: Label,
+        depends: Vec<Line>[8], raised_in: Option<PipelineRef>, asked_on: Date,
+    }
+    pub struct PipelineRuling {
+        campaign: Slug, label: Label, title: Title, answers: Option<Short>, choice: Option<Label>, ruling: Para,
+        operator_quote: Option<Para>, ruled_on: Date, precedents: Vec<ForeignRef>[8], authority: RulingAuthority,
+    }
+    pub struct PipelineCutSpec {
+        campaign: Slug, cut: Label, revision: u32, title: Title, repo: OrgRepo, branch: Short, base: Sha,
+        depends_on: Vec<Short>[8], first: Vec<Line>[16], deletes: Vec<CutDelete>[64], keeps_moves: Vec<Line>[64],
+        adds: Vec<Line>[64], file_changes: Vec<FileChange>[256], authority_map: Option<AuthorityMap>,
+        verification: CutVerification, estimate: StructuralDelta,
+        rulings: Vec<Short>[32], questions: Vec<Short>[16],
+    }
+    pub struct PipelineCutReport {
+        campaign: Slug, cut_spec: Short, attempt: u32, repo: OrgRepo, branch: Short,
+        commits: Vec<ReportCommit>[128], range: CommitRange, verification: Vec<Evidence>[64],
+        mutations: Vec<MutationRecord>[64], deviations: Vec<Deviation>[32], forks: Vec<Short>[8],
+        structural_delta: StructuralDelta, landed_names: Vec<LandedName>[128], undone: Vec<Line>[32],
+        promises: Vec<Promise>[64],
+    }
+    pub struct PipelineVerdict { campaign: Slug, cut_report: Short, pass: u32, range: CommitRange, claims: Vec<VerdictClaim>[64] }
+    pub struct PipelineFinding {
+        campaign: Slug, verdict: Short, label: Label, range: CommitRange, confidence: FindingConfidence,
+        severity: FindingSeverity, claim: Line, invariants: Vec<Label>[8], locations: Vec<CodeLocation>[16],
+        failure_scenario: Para, evidence: Vec<Evidence>[16], precedents: Vec<ForeignRef>[8], origin: FindingOrigin,
+    }
+    pub struct PipelineFollowUp {
+        campaign: Slug, label: Label, source: PipelineRef, repo: OrgRepo, locations: Vec<CodeLocation>[16],
+        item: Line, why_it_can_wait: Line, owner: Short,
+    }
+    /// The record of how a subject was closed and by what. `sequence` is per
+    /// subject and set by the writer, `1` for the first, and it is the last
+    /// part of the key, so a subject's resolutions share a prefix and a
+    /// withdrawn one is kept under its subject rather than overwritten.
+    /// Whether a sequence is the previous plus one, and whether an earlier
+    /// resolution still stands, are admission's rules: this crate refuses
+    /// neither `0` nor a gap, exactly as it refuses neither `revision: 0` nor
+    /// a `revision` with no predecessor.
+    pub struct PipelineResolution { subject: PipelineRef, sequence: u32, outcome: ResolutionOutcome, rationale: Para, resolved_on: Date }
+
+    /// A mind's identity document. A store is canonical to exactly one
+    /// instance, and this says which; identity lives in the state, not in a
+    /// path.
+    pub struct PipelineInstance { instance: Slug, display_name: Short, created_at: Date, host: Short }
+    /// Stewardship over a repo, as an assignment recorded in a mind. One
+    /// instance may steward several repos, so the repo is part of the key.
+    /// `sequence` is per `(instance, repo)`, set by the writer, `1` for the
+    /// first, so a repo transferred away and back is two records under one
+    /// prefix rather than one document overwriting the other. `assigned_on`
+    /// is a field, not a key part. As on a resolution, whether the sequence
+    /// is the previous plus one, and which assignment is in force, are
+    /// admission's rules and not this crate's.
+    pub struct PipelineStewardship { instance: Slug, repo: OrgRepo, sequence: u32, assigned_on: Date, note: Line }
+    /// A reassignment of stewardship, recorded in both minds. `documents` names
+    /// what travels with it.
+    pub struct PipelineHandOff {
+        from_instance: Slug, to_instance: Slug, repo: OrgRepo, documents: Vec<Short>[256],
+        reason: Para, handed_on: Date,
+    }
+}
+
+/// A reference to another document. The id is parsed as a full pipeline id of
+/// the declared `kind`, so the kind and the id's kind segment cannot disagree.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct PipelineRef {
+    pub kind: PipelineKind,
+    pub id: Short,
+}
+
+impl Bounded for PipelineRef {
+    fn validate(&self, at: &str) -> Result<(), PipelineRefusal> {
+        self.id.validate(&format!("{at}.id"))?;
+        pipeline_id(&format!("{at}.id"), &self.id.0, self.kind).map(|_| ())
+    }
+}
+
+impl PipelineRef {
+    /// The grammar's door for a reader holding a bare reference. A read side
+    /// outside this crate is handed a `kind` and an `id` that may disagree, and
+    /// `Bounded` is crate-private, so without this there is no way to ask; a
+    /// reader with no way to ask answers empty, which reads as "no such
+    /// document" rather than "that is not a reference". It delegates, so the
+    /// grammar keeps one owner: this is exactly what a document's own
+    /// `PipelineRef` field is held to, at the field name `ref`. It is kind-deep,
+    /// like every other read of an id: whether the named document exists, and
+    /// whether the local's shape suits the kind, are admission's rules.
+    ///
+    /// A method rather than a free function because it concerns one public
+    /// type, as `prepare` and `decode` do; the two free doors act on a cache or
+    /// an envelope this crate does not own. `validate_ref` rather than a bare
+    /// `validate`, because an inherent `validate` would shadow `Bounded`'s for
+    /// every in-crate caller holding a `PipelineRef`.
+    pub fn validate_ref(&self) -> Result<(), PipelineRefusal> {
+        self.validate("ref")
+    }
+}
+
+/// How a subject was resolved. Every referent is a parsed `PipelineRef`, so a
+/// resolution names its records by ids of the kinds they declare, validated
+/// where every other referent is; a `Fixed` commit is a `Sha` whose referent
+/// is outside the document set (ruling B). Whether a named document exists,
+/// and how many may supersede one subject, are admission's rules.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum ResolutionOutcome {
+    /// Overturned, in whole or in part, by later records. The list is bounded
+    /// here because the enum is outside `value_types!`, the only place a list
+    /// maximum is emitted automatically.
+    Superseded {
+        #[schemars(extend("maxItems" = 8))]
+        by: Vec<PipelineRef>,
+    },
+    Answered { by: PipelineRef },
+    Fixed { commit: Sha, by: Option<PipelineRef> },
+    Deferred { to: PipelineRef },
+    Recorded { reason: Line },
+    Withdrawn { reason: Line },
+}
+
+impl Bounded for ResolutionOutcome {
+    fn validate(&self, field: &str) -> Result<(), PipelineRefusal> {
+        match self {
+            Self::Superseded { by } => list(&format!("{field}.by"), by, 8),
+            Self::Answered { by } => by.validate(&format!("{field}.by")),
+            Self::Fixed { commit, by } => {
+                commit.validate(&format!("{field}.commit"))?;
+                by.validate(&format!("{field}.by"))
+            }
+            Self::Deferred { to } => to.validate(&format!("{field}.to")),
+            Self::Recorded { reason } | Self::Withdrawn { reason } => reason.validate(&format!("{field}.reason")),
+        }
+    }
+}
+
+macro_rules! pipeline_kinds {
+    ($($variant:ident($value:ident) => $document:ident, $name:literal, $type_id:tt, $schema:tt;)*) => {
+        $(
+            #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+            #[cultcache(type = $type_id, schema = $schema)]
+            pub(crate) struct $document {
+                #[cultcache(key = 0)]
+                pub(crate) value: $value,
+            }
+        )*
+
+        #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, JsonSchema)]
+        pub enum PipelineKind { $($variant),* }
+
+        impl Bounded for PipelineKind {
+            fn validate(&self, _field: &str) -> Result<(), PipelineRefusal> {
+                Ok(())
+            }
+        }
+
+        /// The envelope enum, adjacently tagged on the kind name: a document
+        /// on a wire is `{ kind, value }`, and `kind` is exactly what
+        /// `PipelineKind::name()` returns, so a reader dispatches on the kind
+        /// segment it already knows from the key and needs no second registry
+        /// mapping variant spellings to kinds. Adjacent rather than internal
+        /// because a value is a named map of its own and an internal tag would
+        /// have to be merged into it; the tag stays beside the value instead.
+        /// This is not a published schema: `schemas/cultnet` publishes the
+        /// thirteen per-kind value documents, and the envelope is the wire's
+        /// shape, not a document's.
+        #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+        #[serde(tag = "kind", content = "value", rename_all = "snake_case")]
+        pub enum PipelineDocument { $($variant($value)),* }
+
+        impl PipelineKind {
+            pub const ALL: &'static [PipelineKind] = &[$(Self::$variant),*];
+
+            /// The kind segment of a document key.
+            pub fn name(self) -> &'static str {
+                match self { $(Self::$variant => $name),* }
+            }
+
+            pub fn type_id(self) -> &'static str {
+                match self { $(Self::$variant => <$document as DatabaseEntry>::TYPE),* }
+            }
+
+            #[cfg(test)]
+            pub(crate) fn schema_name(self) -> &'static str {
+                match self { $(Self::$variant => <$document as DatabaseEntry>::SCHEMA_NAME),* }
+            }
+
+            #[cfg(test)]
+            pub(crate) fn derived_schema(self) -> schemars::Schema {
+                match self { $(Self::$variant => schemars::schema_for!($value)),* }
+            }
+        }
+
+        impl PipelineDocument {
+            pub fn kind(&self) -> PipelineKind {
+                match self { $(Self::$variant(_) => PipelineKind::$variant),* }
+            }
+
+            /// Field bounds and formats (D1), in UTF-8 bytes and list maximums.
+            pub fn validate(&self) -> Result<(), PipelineRefusal> {
+                match self { $(Self::$variant(value) => value.validate($name)),* }
+            }
+
+            /// Prepares the envelope to be stored: keyed by `pipeline_key`,
+            /// payload `[value]` through `prepare_entry_named`.
+            pub fn prepare(&self, cache: &CultCache) -> Result<CultCacheEnvelope> {
+                let key = pipeline_key(self)?;
+                Ok(match self {
+                    $(Self::$variant(value) => {
+                        cache.prepare_entry_named(key, &$document { value: value.clone() })?.0
+                    })*
+                })
+            }
+
+            /// Decodes a stored envelope, type-matched both ways: an envelope of
+            /// any other type is `ForeignStore`, never the kind that happens to
+            /// parse its payload. It validates neither bounds nor the key: a
+            /// decoded document is a typed read, and
+            /// `validate_pipeline_write_envelope` is the check before a write.
+            pub fn decode(envelope: &CultCacheEnvelope) -> Result<Self, PipelineRefusal> {
+                let invalid = |error: rmp_serde::decode::Error| format_error("payload", &error.to_string());
+                $(if envelope.r#type == <$document as DatabaseEntry>::TYPE {
+                    let document: $document = rmp_serde::from_slice(&envelope.payload).map_err(invalid)?;
+                    return Ok(Self::$variant(document.value));
+                })*
+                Err(PipelineRefusal::ForeignStore { r#type: envelope.r#type.clone() })
+            }
+        }
+
+        /// Registers every pipeline kind in a cache, and nothing else: the one
+        /// door to the crate-private wrappers, so a caller registers exactly
+        /// what this crate publishes.
+        pub fn register_pipeline_document_types(cache: &mut CultCache) -> Result<()> {
+            $(cache.register_entry_type::<$document>()?;)*
+            Ok(())
+        }
+    };
+}
+
+/// A document that is not a pipeline document, for the decode refusal and the
+/// registrar's count to be pinned against something real. It stands in for
+/// any other document a store may hold beside pipeline documents, a commit
+/// receipt say, which is still not a document this library may decode. The
+/// stand-in carries a receipt-shaped type id and is registered only by the
+/// tests' own cache, never by the live registrar.
+#[cfg(test)]
+#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(type = "epiphany.mind_commit_receipt.v1", schema = "ForeignDocument")]
+pub(crate) struct ForeignDocument {
+    #[cultcache(key = 0)]
+    pub(crate) marker: Short,
+}
+
+pipeline_kinds! {
+    Campaign(PipelineCampaign) => EpiphanyPipelineCampaignDocument, "campaign",
+        "epiphany.pipeline.campaign.v2", "EpiphanyPipelineCampaignDocument";
+    Target(PipelineTarget) => EpiphanyPipelineTargetDocument, "target",
+        "epiphany.pipeline.target.v2", "EpiphanyPipelineTargetDocument";
+    Question(PipelineQuestion) => EpiphanyPipelineQuestionDocument, "question",
+        "epiphany.pipeline.question.v2", "EpiphanyPipelineQuestionDocument";
+    Ruling(PipelineRuling) => EpiphanyPipelineRulingDocument, "ruling",
+        "epiphany.pipeline.ruling.v2", "EpiphanyPipelineRulingDocument";
+    CutSpec(PipelineCutSpec) => EpiphanyPipelineCutSpecDocument, "cut_spec",
+        "epiphany.pipeline.cut_spec.v2", "EpiphanyPipelineCutSpecDocument";
+    CutReport(PipelineCutReport) => EpiphanyPipelineCutReportDocument, "cut_report",
+        "epiphany.pipeline.cut_report.v2", "EpiphanyPipelineCutReportDocument";
+    Verdict(PipelineVerdict) => EpiphanyPipelineVerdictDocument, "verdict",
+        "epiphany.pipeline.verdict.v2", "EpiphanyPipelineVerdictDocument";
+    Finding(PipelineFinding) => EpiphanyPipelineFindingDocument, "finding",
+        "epiphany.pipeline.finding.v2", "EpiphanyPipelineFindingDocument";
+    FollowUp(PipelineFollowUp) => EpiphanyPipelineFollowUpDocument, "follow_up",
+        "epiphany.pipeline.follow_up.v2", "EpiphanyPipelineFollowUpDocument";
+    Resolution(PipelineResolution) => EpiphanyPipelineResolutionDocument, "resolution",
+        "epiphany.pipeline.resolution.v2", "EpiphanyPipelineResolutionDocument";
+    Instance(PipelineInstance) => EpiphanyPipelineInstanceDocument, "instance",
+        "epiphany.pipeline.instance.v2", "EpiphanyPipelineInstanceDocument";
+    Stewardship(PipelineStewardship) => EpiphanyPipelineStewardshipDocument, "stewardship",
+        "epiphany.pipeline.stewardship.v2", "EpiphanyPipelineStewardshipDocument";
+    HandOff(PipelineHandOff) => EpiphanyPipelineHandOffDocument, "hand_off",
+        "epiphany.pipeline.hand_off.v2", "EpiphanyPipelineHandOffDocument";
+}
+
+/// Parses a full document id: the grammar read backwards. A key and an id are
+/// the same string, so this accepts exactly what `pipeline_key` derives:
+/// `<root>:<kind>:<local>`, three segments for every kind. The kind segment
+/// must equal `kind`'s name, the root is a `Slug`, and the local is `Label`s
+/// joined by `.` and bounded whole by `local_max(kind)`, so `..`, an empty part, spaces and trailing
+/// junk are all refused. Returns the root and the local; nothing is inferred
+/// from either, and no kind is read any other way.
+fn pipeline_id<'a>(
+    field: &str,
+    id: &'a str,
+    kind: PipelineKind,
+) -> Result<(&'a str, &'a str), PipelineRefusal> {
+    let mut segments = id.split(':');
+    let (Some(root), Some(name), Some(local), None) = (
+        segments.next(),
+        segments.next(),
+        segments.next(),
+        segments.next(),
+    ) else {
+        return Err(format_error(field, id));
+    };
+    if name != kind.name() {
+        return Err(format_error(field, id));
+    }
+    dotted_text(field, root)?;
+    dotted_within(field, local, local_max(kind))?;
+    Ok((root, local))
+}
+
+/// The local segment of a parent id in `campaign`, of the expected kind.
+fn parent_local<'a>(
+    field: &str,
+    id: &'a str,
+    campaign: &str,
+    kind: PipelineKind,
+) -> Result<&'a str, PipelineRefusal> {
+    let (owner, local) = pipeline_id(field, id, kind)?;
+    if owner != campaign {
+        return Err(format_error(field, id));
+    }
+    Ok(local)
+}
+
+/// The cut label inside a parent local `cut-<label>.<marker><N>`: exactly two
+/// parts, the label a `Label` and `<N>` a non-empty run of digits.
+fn parent_cut<'a>(field: &str, local: &'a str, marker: char) -> Result<&'a str, PipelineRefusal> {
+    let invalid = || format_error(field, local);
+    let mut parts = local.split('.');
+    let (Some(head), Some(suffix), None) = (parts.next(), parts.next(), parts.next()) else {
+        return Err(invalid());
+    };
+    let cut = head.strip_prefix("cut-").ok_or_else(invalid)?;
+    label_text(field, cut)?;
+    let digits = suffix.strip_prefix(marker).ok_or_else(invalid)?;
+    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(invalid());
+    }
+    Ok(cut)
+}
+
+/// A `Slug` or an `OrgRepo` entering a local, escaped to one label. `/` is not
+/// a `Label` byte, so it cannot survive into a key, and neither may `.`: no
+/// local part carries the separator, or the boundary before it would have two
+/// readings. A dotted slug and a dotted repo name are both ordinary, so both
+/// bytes are escaped rather than refused. The escape has to be injective or two
+/// values claim one key: replacing `/` with `_` alone is not, since
+/// `GameCult_Epiphany/thing` and `GameCult/Epiphany_thing` both give
+/// `GameCult_Epiphany_thing`. So `_` is escaped as well, and every code is two
+/// bytes starting with `_`: `_` becomes `__`, `/` becomes `_-`, and `.` becomes
+/// `_d`. Every other byte is passed through and is never `_`, so a reader going
+/// left to right takes each `_` together with the byte after it and never has a
+/// choice to make; the encoding is therefore reversible, and distinct values
+/// give distinct segments. The caller validates the value as its own type first
+/// and checks the result against the local's rules, which is where an over-long
+/// or otherwise unlabelled value is refused.
+fn key_segment(value: &str) -> String {
+    value.replace('_', "__").replace('/', "_-").replace('.', "_d")
+}
+
+/// The local of a root. A campaign's or an instance's identity is entirely its
+/// root segment, so its local carries none; a reader never consults it.
+const ROOT_LOCAL: &str = "self";
+
+/// The bound on a composed local of every kind but a resolution, whole, in
+/// UTF-8 bytes. Every stored subject key is within it.
+const SUBJECT_LOCAL_MAX: usize = 64;
+
+/// The longest kind name a resolution can name as its subject (`stewardship`),
+/// checked against `PipelineKind::ALL` by a test.
+const LONGEST_KIND_NAME: usize = "stewardship".len();
+
+/// A `.n<sequence>` part at `u32::MAX`.
+const SEQUENCE_PART_MAX: usize = ".n".len() + "4294967295".len();
+
+/// The bound on a resolution's local: a depth-two chain over a maximal
+/// subject, `resolution.<kind>.<subject local>.n<seq>.n<seq>`, at `u32::MAX`
+/// sequences. Depth is capped at two by admission (Q19), and this bound admits
+/// exactly that for every subject, so no subject is born unresolvable. Derived
+/// from `SUBJECT_LOCAL_MAX` and the kind names, never written as a number.
+const RESOLUTION_LOCAL_MAX: usize = "resolution.".len() + LONGEST_KIND_NAME + ".".len() + SUBJECT_LOCAL_MAX + 2 * SEQUENCE_PART_MAX;
+
+// `<root>:<kind>:<local>` must fit a `Short` wherever an id is cited.
+const _: () = assert!(64 + ":".len() + LONGEST_KIND_NAME + ":".len() + RESOLUTION_LOCAL_MAX <= 200);
+
+/// The bound on a kind's composed local, chosen here and nowhere else.
+fn local_max(kind: PipelineKind) -> usize {
+    match kind {
+        PipelineKind::Resolution => RESOLUTION_LOCAL_MAX,
+        _ => SUBJECT_LOCAL_MAX,
+    }
+}
+
+/// The schema epoch every pipeline store is written at, owned here with the
+/// schemas it names. Evolution is additive and keeps it: a new named field
+/// with a serde default, or a widened `PipelineKind`, since each reader ships
+/// with the variants it knows and refuses an unknown kind on the kind, not on
+/// the epoch. A breaking change bumps it, so that a store written at the old
+/// one can be refused by whoever opens it; this crate owns no store and
+/// refuses none.
+pub const PIPELINE_SCHEMA_EPOCH: &str = "epiphany.pipeline.epoch.v2";
+
+/// Composes and validates a local: every part is a `Label`, and the join is
+/// bounded whole by `local_max(kind)`. Both rules live here because this is the only way a local is
+/// built; `pipeline_key` has no other path to a key string. Parts are a slice,
+/// not a builder, so an arm's arity is written at its call site.
+fn local(field: &str, kind: PipelineKind, parts: &[&str]) -> Result<String, PipelineRefusal> {
+    for part in parts {
+        label_text(field, part)?;
+    }
+    let joined = parts.join(".");
+    if joined.len() > local_max(kind) {
+        return Err(format_error(field, &joined));
+    }
+    Ok(joined)
+}
+
+/// Derives a document's identity key (D1, "Keys: identity, not convenience").
+/// Thirteen arms, one exit: every arm names its root and composes its local
+/// through `local`, and the key is formatted here and nowhere else.
+pub fn pipeline_key(document: &PipelineDocument) -> Result<String, PipelineRefusal> {
+    use PipelineDocument as D;
+    let document_kind = document.kind();
+    let kind = document_kind.name();
+    let key_field = format!("{kind}.key");
+    let campaign_field = format!("{kind}.campaign");
+    let (root_field, root, composed) = match document {
+        D::Campaign(value) => ("campaign.slug", value.slug.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
+        D::Instance(value) => ("instance.instance", value.instance.0.as_str(), local(&key_field, document_kind, &[ROOT_LOCAL])?),
+        // A resolution is keyed inside its subject's root, with the subject's
+        // kind and local as its own local and its per-subject sequence last, so
+        // the subject's resolutions and only they share the prefix
+        // `<root>:resolution:<kind>.<local>.n`. A resolution's own key is an
+        // ordinary id, so it composes as a subject like any other; each nesting
+        // prepends `resolution.` (11 bytes) and appends `.n<s>` (3 bytes for
+        // one digit). Depth is capped at two by admission (Q19), and
+        // `RESOLUTION_LOCAL_MAX` admits exactly a depth-two chain over a
+        // maximal subject, so every subject resolves and its resolution can be
+        // withdrawn.
+        D::Resolution(value) => {
+            let field = "resolution.subject.id";
+            let (subject_root, subject_local) = pipeline_id(field, &value.subject.id.0, value.subject.kind)?;
+            let sequence = format!("n{}", value.sequence);
+            let parts = std::iter::once(value.subject.kind.name()).chain(subject_local.split('.')).chain(std::iter::once(sequence.as_str())).collect::<Vec<_>>();
+            (field, subject_root, local(&key_field, document_kind, &parts)?)
+        }
+        // Stewardship and hand-off hang off an instance rather than a campaign.
+        // The root is the whole difference; the key shape is the same.
+        D::Stewardship(value) => {
+            org_repo_text("stewardship.repo", &value.repo.0)?;
+            let sequence = format!("n{}", value.sequence);
+            (
+                "stewardship.instance",
+                value.instance.0.as_str(),
+                local(&key_field, document_kind, &[&key_segment(&value.repo.identity()), &sequence])?,
+            )
+        }
+        D::HandOff(value) => {
+            dotted_text("hand_off.to_instance", &value.to_instance.0)?;
+            org_repo_text("hand_off.repo", &value.repo.0)?;
+            value.handed_on.validate("hand_off.handed_on")?;
+            (
+                "hand_off.from_instance",
+                value.from_instance.0.as_str(),
+                local(
+                    &key_field,
+                    document_kind,
+                    &[&key_segment(&value.to_instance.0), &key_segment(&value.repo.identity()), &value.handed_on.0],
+                )?,
+            )
+        }
+        D::Target(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&format!("r{}", value.revision)])?),
+        D::Question(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::Ruling(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::FollowUp(value) => (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &[&value.label.0])?),
+        D::CutSpec(value) => (
+            campaign_field.as_str(),
+            value.campaign.0.as_str(),
+            local(&key_field, document_kind, &[&format!("cut-{}", value.cut.0), &format!("r{}", value.revision)])?,
+        ),
+        D::CutReport(value) => {
+            let spec = parent_local("cut_report.cut_spec", &value.cut_spec.0, &value.campaign.0, PipelineKind::CutSpec)?;
+            let cut = parent_cut("cut_report.cut_spec", spec, 'r')?;
+            (
+                campaign_field.as_str(),
+                value.campaign.0.as_str(),
+                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("h{}", value.attempt)])?,
+            )
+        }
+        D::Verdict(value) => {
+            let report = parent_local("verdict.cut_report", &value.cut_report.0, &value.campaign.0, PipelineKind::CutReport)?;
+            let cut = parent_cut("verdict.cut_report", report, 'h')?;
+            (
+                campaign_field.as_str(),
+                value.campaign.0.as_str(),
+                local(&key_field, document_kind, &[&format!("cut-{cut}"), &format!("s{}", value.pass)])?,
+            )
+        }
+        D::Finding(value) => {
+            let verdict = parent_local("finding.verdict", &value.verdict.0, &value.campaign.0, PipelineKind::Verdict)?;
+            parent_cut("finding.verdict", verdict, 's')?;
+            let parts = verdict.split('.').chain(std::iter::once(value.label.0.as_str())).collect::<Vec<_>>();
+            (campaign_field.as_str(), value.campaign.0.as_str(), local(&key_field, document_kind, &parts)?)
+        }
+    };
+    dotted_text(root_field, root)?;
+    Ok(format!("{root}:{kind}:{composed}"))
+}
+
+/// Bounds, formats, then key recomputation, on the envelope that will be
+/// stored, whoever prepared it. It is the whole of what this crate checks
+/// before a write; per-kind and cross-document rules are not decided here and
+/// belong to the admission path of the organ that will admit these documents,
+/// which is expected to call this first rather than re-derive it.
+pub fn validate_pipeline_write_envelope(envelope: &CultCacheEnvelope) -> Result<(), PipelineRefusal> {
+    let document = PipelineDocument::decode(envelope)?;
+    document.validate()?;
+    let expected = pipeline_key(&document)?;
+    if envelope.key != expected {
+        return Err(PipelineRefusal::InvalidIdentity {
+            kind: document.kind(),
+            key: envelope.key.clone(),
+            expected,
+        });
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::BTreeSet;
+    use std::path::Path;
+
+    const CAMPAIGN: &str = "eureka-state";
+    const INSTANCE: &str = "yggdrasil";
+
+    fn s(value: &str) -> Short {
+        value.into()
+    }
+
+    fn t(value: &str) -> Title {
+        value.into()
+    }
+
+    fn l(value: &str) -> Label {
+        value.into()
+    }
+
+    fn slug(value: &str) -> Slug {
+        value.into()
+    }
+
+    fn id(kind: &str, local: &str) -> Short {
+        Short(format!("{CAMPAIGN}:{kind}:{local}"))
+    }
+
+    fn sha() -> Sha {
+        Sha("5f98228d".into())
+    }
+
+    fn date() -> Date {
+        Date("2026-09-15".into())
+    }
+
+    fn range() -> CommitRange {
+        CommitRange { base: sha(), head: sha() }
+    }
+
+    fn location() -> CodeLocation {
+        CodeLocation { path: s("crates/eureka-pipeline/src/lib.rs"), line: 1, end_line: Some(9) }
+    }
+
+    fn evidence() -> Evidence {
+        Evidence { kind: EvidenceKind::Test, locator: "cargo test".into(), result: "ok".into() }
+    }
+
+    fn doc_ref() -> DocRef {
+        DocRef { path: s("notes/eureka-pipeline-state-target.md"), start_line: 1, end_line: 9, commit: sha() }
+    }
+
+    /// One valid document of every kind, with its expected key.
+    fn samples() -> Vec<(PipelineDocument, String)> {
+        use PipelineDocument as D;
+        let repo = || OrgRepo("GameCult/Epiphany".into());
+        let branch = || s("codex/eureka-pipeline-state");
+        vec![
+            (D::Campaign(PipelineCampaign {
+                slug: slug(CAMPAIGN), title: t("Eureka pipeline state"), repos: vec![repo()],
+                working_branch: branch(), target_doc: doc_ref(),
+            }), format!("{CAMPAIGN}:campaign:self")),
+            (D::Target(PipelineTarget {
+                campaign: slug(CAMPAIGN), revision: 2,
+                invariants: vec![TargetInvariant { label: l("mind-admits"), statement: "Only admission writes.".into() }],
+                not_in_scope: vec!["Eve browsing".into()], canonical_implementations: vec!["CultLib".into()], doc: doc_ref(),
+            }), format!("{CAMPAIGN}:target:r2")),
+            (D::Question(PipelineQuestion {
+                campaign: slug(CAMPAIGN), label: l("Q1"), title: t("Who owns the state?"), question: "Who owns the state?".into(),
+                options: vec![
+                    QuestionOption { label: l("A"), text: "an instance".into() },
+                    QuestionOption { label: l("B"), text: "a repo".into() },
+                ],
+                recommended: l("A"), depends: vec!["Cut 3a".into()],
+                raised_in: Some(PipelineRef { kind: PipelineKind::CutSpec, id: id("cut_spec", "cut-3a.r1") }),
+                asked_on: date(),
+            }), format!("{CAMPAIGN}:question:Q1")),
+            (D::Ruling(PipelineRuling {
+                campaign: slug(CAMPAIGN), label: l("R8"), title: t("An instance owns its mind"), answers: Some(id("question", "Q1")), choice: Some(l("A")),
+                ruling: "An instance owns its mind.".into(), operator_quote: Some("all recommendations, go ahead".into()),
+                ruled_on: date(),
+                precedents: vec![ForeignRef {
+                    repo: OrgRepo("GameCult/Aetheria".into()), commit: FullSha("a".repeat(40)), kind: PipelineKind::Ruling,
+                    id: s("cultcache:ruling:R1"), payload_sha256: Sha256Hex("b".repeat(64)),
+                }],
+                authority: RulingAuthority::Operator,
+            }), format!("{CAMPAIGN}:ruling:R8")),
+            (D::CutSpec(PipelineCutSpec {
+                campaign: slug(CAMPAIGN), cut: l("3a"), revision: 1, title: t("Pipeline documents"), repo: repo(),
+                branch: branch(), base: sha(), depends_on: vec![s("2")], first: vec!["Read the spec.".into()],
+                deletes: vec![CutDelete { path: s("old.rs"), lines: 3, note: "dead".into() }],
+                keeps_moves: vec!["commit owner".into()], adds: vec!["pipeline_documents.rs".into()],
+                file_changes: vec![FileChange { location: location(), change: "add".into() }],
+                authority_map: Some(AuthorityMap {
+                    owner: "core".into(), inputs: vec!["typed documents".into()], outputs: vec!["envelopes".into()],
+                    derived_state: vec!["derived keys".into()], forbidden_writers: vec!["MCP".into()],
+                    shared_paths: vec!["admission".into()], deletion_line: "n/a".into(),
+                }),
+                verification: CutVerification {
+                    builds: vec!["cargo check".into()],
+                    tests: vec![VerificationTest { name: s("keys"), pins: "one derived key".into() }],
+                    negative: vec![NegativeCheck { pattern: s("Vec<u8>"), scope: "documents".into() }],
+                    operator: vec!["none".into()],
+                },
+                // Cut 3a's real numbers, and in this order: the tripwire test
+                // reads them back, so a transposition is a failure, not a typo.
+                estimate: StructuralDelta {
+                    lines_added: 900, lines_removed: 0,
+                    dependencies_added: vec![s("schemars")], dependencies_removed: vec![],
+                    formats_added: vec![s("epiphany.pipeline.*.v1")], formats_removed: vec![],
+                    targets_added: vec![], targets_removed: vec![],
+                },
+                rulings: vec![id("ruling", "R8")], questions: vec![id("question", "Q1")],
+            }), format!("{CAMPAIGN}:cut_spec:cut-3a.r1")),
+            (D::CutReport(PipelineCutReport {
+                campaign: slug(CAMPAIGN), cut_spec: id("cut_spec", "cut-3a.r1"), attempt: 1, repo: repo(), branch: branch(),
+                commits: vec![ReportCommit { sha: sha(), subject: "Add the pipeline documents".into(), builds: true }],
+                range: range(), verification: vec![evidence()],
+                mutations: vec![MutationRecord {
+                    // `.into()` on both, not `l()` and `sha()`: the type-level
+                    // mutations (M19, M20) widen these fields to `Short`, and
+                    // a sample spelled with the narrow constructors would stop
+                    // compiling instead of letting the forgery through.
+                    label: "M1".into(), rule: "key derivation".into(), location: location(),
+                    before: "parent_cut(field, spec, 'r')?".into(), after: "spec".into(), commit: "5f98228d".into(),
+                    failed_as_expected: true,
+                }],
+                deviations: vec![Deviation { what: "names".into(), why: "glob exports".into() }],
+                forks: vec![id("question", "Q1")],
+                structural_delta: StructuralDelta {
+                    lines_added: 900, lines_removed: 0, dependencies_added: vec![s("schemars")],
+                    dependencies_removed: vec![], formats_added: vec![s("epiphany.pipeline.*.v1")],
+                    formats_removed: vec![], targets_added: vec![], targets_removed: vec![],
+                },
+                landed_names: vec![LandedName { name: s("PipelineDocument"), path: s("crates/eureka-pipeline/src/lib.rs") }],
+                undone: vec!["admission".into()],
+                promises: vec![Promise { label: l("P1"), text: "One derived key per document.".into() }],
+            }), format!("{CAMPAIGN}:cut_report:cut-3a.h1")),
+            (D::Verdict(PipelineVerdict {
+                campaign: slug(CAMPAIGN), cut_report: id("cut_report", "cut-3a.h1"), pass: 2, range: range(),
+                claims: vec![VerdictClaim {
+                    claim: "A composed key has one source.".into(), outcome: ClaimOutcome::Falsified,
+                    evidence: vec![evidence()], findings: vec![id("finding", "cut-3a.s2.F4")],
+                    promise: Some(l("P1")), mutations: vec![l("M1")],
+                }],
+            }), format!("{CAMPAIGN}:verdict:cut-3a.s2")),
+            (D::Finding(PipelineFinding {
+                campaign: slug(CAMPAIGN), verdict: id("verdict", "cut-3a.s2"), label: l("F4"), range: range(),
+                confidence: FindingConfidence::Confirmed, severity: FindingSeverity::High,
+                claim: "A dotted label composes two keys.".into(), invariants: vec![l("mind-admits")],
+                locations: vec![location()], failure_scenario: "Two documents claim one key.".into(),
+                evidence: vec![evidence()], precedents: vec![], origin: FindingOrigin::Introduced,
+            }), format!("{CAMPAIGN}:finding:cut-3a.s2.F4")),
+            (D::FollowUp(PipelineFollowUp {
+                campaign: slug(CAMPAIGN), label: l("FU-4"),
+                source: PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") },
+                repo: repo(), locations: vec![location()], item: "Per-kind admission rules.".into(),
+                why_it_can_wait: "The organ owns admission.".into(), owner: s("Hands"),
+            }), format!("{CAMPAIGN}:follow_up:FU-4")),
+            (D::Resolution(PipelineResolution {
+                subject: PipelineRef { kind: PipelineKind::Question, id: id("question", "Q1") }, sequence: 1,
+                outcome: ResolutionOutcome::Answered { by: PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") } },
+                rationale: "Ruled A.".into(), resolved_on: date(),
+            }), format!("{CAMPAIGN}:resolution:question.Q1.n1")),
+            // The mind's own three kinds. They are appended rather than
+            // inserted because the helpers below index this list by position.
+            (D::Instance(PipelineInstance {
+                instance: slug(INSTANCE), display_name: s("Yggdrasil mind"), created_at: date(),
+                host: s("yggdrasil"),
+            }), format!("{INSTANCE}:instance:self")),
+            (D::Stewardship(PipelineStewardship {
+                instance: slug(INSTANCE), repo: repo(), sequence: 1, assigned_on: date(),
+                note: "The Eureka campaign repo.".into(),
+            }), format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")),
+            (D::HandOff(PipelineHandOff {
+                from_instance: slug(INSTANCE), to_instance: slug("thought-cage"), repo: repo(),
+                documents: vec![s(CAMPAIGN), id("ruling", "R8")],
+                reason: "The workstation mind takes the campaign.".into(), handed_on: date(),
+            }), format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.{}", date().0)),
+        ]
+    }
+
+    fn instance_sample() -> PipelineInstance {
+        let PipelineDocument::Instance(instance) = samples().remove(10).0 else { unreachable!() };
+        instance
+    }
+
+    fn stewardship_sample() -> PipelineStewardship {
+        let PipelineDocument::Stewardship(stewardship) = samples().remove(11).0 else { unreachable!() };
+        stewardship
+    }
+
+    fn hand_off_sample() -> PipelineHandOff {
+        let PipelineDocument::HandOff(hand_off) = samples().remove(12).0 else { unreachable!() };
+        hand_off
+    }
+
+    fn campaign_sample() -> PipelineDocument {
+        samples().remove(0).0
+    }
+
+    fn question_sample() -> PipelineQuestion {
+        let PipelineDocument::Question(question) = samples().remove(2).0 else { unreachable!() };
+        question
+    }
+
+    fn ruling_sample() -> PipelineRuling {
+        let PipelineDocument::Ruling(ruling) = samples().remove(3).0 else { unreachable!() };
+        ruling
+    }
+
+    fn report_sample() -> PipelineCutReport {
+        let PipelineDocument::CutReport(report) = samples().remove(5).0 else { unreachable!() };
+        report
+    }
+
+    fn verdict_sample() -> PipelineVerdict {
+        let PipelineDocument::Verdict(verdict) = samples().remove(6).0 else { unreachable!() };
+        verdict
+    }
+
+    fn finding_sample() -> PipelineFinding {
+        let PipelineDocument::Finding(finding) = samples().remove(7).0 else { unreachable!() };
+        finding
+    }
+
+    fn resolution_sample() -> PipelineResolution {
+        let PipelineDocument::Resolution(resolution) = samples().remove(9).0 else { unreachable!() };
+        resolution
+    }
+
+    /// The golden corpus: every sample plus one document per encoding-relevant
+    /// variant (every enum variant, every Option both ways), each under a
+    /// unique label that names what it varies.
+    fn golden_documents() -> Vec<(String, PipelineDocument)> {
+        use PipelineDocument as D;
+        let mut out: Vec<(String, PipelineDocument)> =
+            samples().into_iter().map(|(d, _)| (format!("sample.{}", d.kind().name()), d)).collect();
+        let by = |kind: PipelineKind, kind_name: &str, local: &str| PipelineRef { kind, id: id(kind_name, local) };
+        let resolution = |outcome: ResolutionOutcome| {
+            let mut r = resolution_sample();
+            r.outcome = outcome;
+            D::Resolution(r)
+        };
+        let ruling_ref = || by(PipelineKind::Ruling, "ruling", "R8");
+        out.push(("resolution.superseded".into(), resolution(ResolutionOutcome::Superseded { by: vec![ruling_ref(), by(PipelineKind::Question, "question", "Q1")] })));
+        out.push(("resolution.fixed-by-none".into(), resolution(ResolutionOutcome::Fixed { commit: sha(), by: None })));
+        out.push(("resolution.fixed-by-some".into(), resolution(ResolutionOutcome::Fixed { commit: sha(), by: Some(by(PipelineKind::CutReport, "cut_report", "cut-3a.h1")) })));
+        out.push(("resolution.deferred".into(), resolution(ResolutionOutcome::Deferred { to: by(PipelineKind::FollowUp, "follow_up", "FU-4") })));
+        out.push(("resolution.recorded".into(), resolution(ResolutionOutcome::Recorded { reason: "Noted.".into() })));
+        out.push(("resolution.withdrawn".into(), resolution(ResolutionOutcome::Withdrawn { reason: "Mistaken.".into() })));
+        for (name, authority) in [("standing", RulingAuthority::Standing), ("defaulted", RulingAuthority::Defaulted)] {
+            let mut r = ruling_sample();
+            r.authority = authority;
+            out.push((format!("ruling.authority-{name}"), D::Ruling(r)));
+        }
+        let mut r = ruling_sample();
+        (r.answers, r.choice, r.operator_quote, r.precedents) = (None, None, None, vec![]);
+        out.push(("ruling.options-none".into(), D::Ruling(r)));
+        let mut q = question_sample();
+        q.raised_in = None;
+        out.push(("question.raised-in-none".into(), D::Question(q)));
+        let PipelineDocument::CutSpec(mut spec) = samples().remove(4).0 else { unreachable!() };
+        spec.authority_map = None;
+        out.push(("cut_spec.authority-map-none".into(), D::CutSpec(spec)));
+        for (name, outcome) in [("holds", ClaimOutcome::Holds), ("unproven", ClaimOutcome::Unproven)] {
+            let mut v = verdict_sample();
+            v.claims[0].outcome = outcome;
+            v.claims[0].promise = None;
+            out.push((format!("verdict.claim-{name}-promise-none"), D::Verdict(v)));
+        }
+        let mut f = finding_sample();
+        (f.confidence, f.severity, f.origin) = (FindingConfidence::Plausible, FindingSeverity::Blocker, FindingOrigin::PreExisting);
+        f.locations[0].end_line = None;
+        f.evidence = [EvidenceKind::Command, EvidenceKind::Mutation, EvidenceKind::Probe, EvidenceKind::SourceRead, EvidenceKind::Capture]
+            .into_iter().map(|kind| Evidence { kind, locator: "x".into(), result: "y".into() }).collect();
+        out.push(("finding.plausible-blocker-preexisting-kinds".into(), D::Finding(f)));
+        for (name, severity) in [("medium", FindingSeverity::Medium), ("low", FindingSeverity::Low)] {
+            let mut f = finding_sample();
+            f.severity = severity;
+            out.push((format!("finding.severity-{name}"), D::Finding(f)));
+        }
+        out
+    }
+
+    /// One line per document: `label key type schema payload-hex`.
+    fn golden_lines() -> Result<Vec<String>> {
+        let cache = schema_cache()?;
+        golden_documents()
+            .into_iter()
+            .map(|(label, document)| {
+                document.validate()?;
+                let envelope = document.prepare(&cache)?;
+                let hex: String = envelope.payload.iter().map(|b| format!("{b:02x}")).collect();
+                Ok(format!("{label} {} {} {} {hex}", envelope.key, envelope.r#type, document.kind().schema_name()))
+            })
+            .collect()
+    }
+
+    /// The wire is pinned to bytes. `golden/envelopes.txt` was derived once
+    /// from this crate at its copy of Epiphany ef956865 (huginn 87b6455), which
+    /// was proved byte-identical to the live mind store and to Epiphany; see
+    /// its header. Payload bytes are load-bearing (`ForeignRef.payload_sha256`
+    /// hashes them), and the cultcache type id and schema name are how a store
+    /// resolves a persisted entry. A deliberate wire change re-derives the file
+    /// with `golden_dump` below, in the same commit as a ruling that allows it.
+    #[test]
+    fn encoded_envelopes_match_the_committed_golden() -> Result<()> {
+        let golden = include_str!("../golden/envelopes.txt");
+        let expected: Vec<&str> = golden.lines().filter(|line| !line.starts_with('#') && !line.is_empty()).collect();
+        let actual = golden_lines()?;
+        assert_eq!(actual.len(), expected.len(), "the corpus and the golden file have the same documents");
+        for (actual, expected) in actual.iter().zip(expected) {
+            assert_eq!(actual, expected);
+        }
+        let kinds: BTreeSet<&str> = actual.iter().filter_map(|line| line.split(' ').nth(2)).collect();
+        assert_eq!(kinds.len(), PipelineKind::ALL.len(), "every kind's type id is in the golden");
+        Ok(())
+    }
+
+    /// Prints the golden body to the file named by `GOLDEN_OUT`. Not a check:
+    /// run only for a deliberate wire change, then paste under the header.
+    #[test]
+    #[ignore = "re-derives golden/envelopes.txt; run only for a ruled wire change"]
+    fn golden_dump() -> Result<()> {
+        let out = std::env::var("GOLDEN_OUT").expect("GOLDEN_OUT names the output file");
+        std::fs::write(out, golden_lines()?.join("
+") + "
+")?;
+        Ok(())
+    }
+
+    /// The live registrar plus the foreign stand-in, which only the tests
+    /// register.
+    fn schema_cache() -> Result<CultCache> {
+        let mut cache = CultCache::new();
+        register_pipeline_document_types(&mut cache)?;
+        cache.register_entry_type::<ForeignDocument>()?;
+        Ok(cache)
+    }
+
+    #[test]
+    fn every_pipeline_kind_round_trips_through_named_slot_zero() -> Result<()> {
+        let cache = schema_cache()?;
+        let samples = samples();
+        let kinds = samples.iter().map(|(document, _)| document.kind()).collect::<BTreeSet<_>>();
+        assert_eq!(kinds.len(), PipelineKind::ALL.len(), "every kind has a sample");
+        for (document, _) in samples {
+            document.validate()?;
+            let envelope = document.prepare(&cache)?;
+            assert_eq!(envelope.r#type, document.kind().type_id());
+            assert_eq!(envelope.payload[0], 0x91, "{:?} payload is a one-element array", document.kind());
+            assert!(
+                matches!(envelope.payload[1], 0x80..=0x8f | 0xde | 0xdf),
+                "{:?} slot 0 is a named map",
+                document.kind()
+            );
+            assert_eq!(PipelineDocument::decode(&envelope)?, document);
+            Ok::<_, anyhow::Error>(())?;
+        }
+        Ok(())
+    }
+
+    /// Soul F2: a decode is type-matched in both directions. The round-trip
+    /// test above pins the positive match; this pins the refusal, so an
+    /// envelope belonging to another kind can never be decoded as whichever
+    /// pipeline kind happens to parse its payload. The commit receipt is the
+    /// sharp case: a mind's store may legitimately hold one, and it is still
+    /// not a document; `ForeignDocument` stands in for it here.
+    #[test]
+    fn decode_refuses_an_envelope_of_a_foreign_type() -> Result<()> {
+        let cache = schema_cache()?;
+        let foreign = <ForeignDocument as DatabaseEntry>::TYPE;
+        assert!(!foreign.starts_with("epiphany.pipeline."), "{foreign} is a foreign type id");
+        let mut envelope = campaign_sample().prepare(&cache)?;
+        envelope.r#type = foreign.into();
+        assert_eq!(
+            PipelineDocument::decode(&envelope),
+            Err(PipelineRefusal::ForeignStore { r#type: foreign.into() })
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn bounds_refuse_in_utf8_bytes() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.title = Title("é".repeat(100));
+        assert_eq!(PipelineDocument::Campaign(campaign.clone()).validate(), Ok(()));
+        campaign.title = Title(format!("{}a", "é".repeat(100)));
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 })
+        );
+        campaign.title = t("ok");
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 9];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign).validate(),
+            Err(PipelineRefusal::FieldBound { field: "campaign.repos".into(), limit: 8, actual: 9 })
+        );
+    }
+
+    /// RS-L closing fix 4: `campaign.repos` refuses two entries naming one
+    /// repository by identity, not only by raw spelling, so `GameCult/Epiphany`
+    /// and `gamecult/epiphany` in one list refuse exactly as the same spelling
+    /// twice would. Two genuinely distinct repos still validate.
+    #[test]
+    fn campaign_repos_refuse_duplicates_by_identity() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("gamecult/epiphany".into())];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::DuplicateRepo {
+                field: "campaign.repos".into(),
+                repo: "gamecult/epiphany".into(),
+            })
+        );
+
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()); 2];
+        assert_eq!(
+            PipelineDocument::Campaign(campaign.clone()).validate(),
+            Err(PipelineRefusal::DuplicateRepo {
+                field: "campaign.repos".into(),
+                repo: "GameCult/Epiphany".into(),
+            })
+        );
+
+        campaign.repos = vec![OrgRepo("GameCult/Epiphany".into()), OrgRepo("GameCult/Aetheria".into())];
+        assert_eq!(PipelineDocument::Campaign(campaign).validate(), Ok(()));
+    }
+
+    #[test]
+    fn repo_fields_must_be_org_slash_repo() {
+        let mut report = report_sample();
+        report.repo = OrgRepo("Epiphany".into());
+        assert_eq!(
+            PipelineDocument::CutReport(report).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "cut_report.repo".into(), value: "Epiphany".into() })
+        );
+        let PipelineDocument::CutSpec(mut spec) = samples().remove(4).0 else { unreachable!() };
+        spec.repo = OrgRepo("GameCult/Epiphany/extra".into());
+        assert!(matches!(
+            PipelineDocument::CutSpec(spec).validate(),
+            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_spec.repo"
+        ));
+        let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
+        follow_up.repo = OrgRepo("/Epiphany".into());
+        assert!(matches!(
+            PipelineDocument::FollowUp(follow_up).validate(),
+            Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "follow_up.repo"
+        ));
+    }
+
+    #[test]
+    fn keys_are_derived_and_mismatch_refuses() -> Result<()> {
+        let cache = schema_cache()?;
+        for (document, key) in samples() {
+            assert_eq!(pipeline_key(&document), Ok(key.clone()));
+            let mut envelope = document.prepare(&cache)?;
+            envelope.key = format!("{key}-forged");
+            assert_eq!(
+                validate_pipeline_write_envelope(&envelope),
+                Err(PipelineRefusal::InvalidIdentity { kind: document.kind(), key: envelope.key, expected: key })
+            );
+        }
+        let mut resolution = resolution_sample();
+        let answered = pipeline_key(&PipelineDocument::Resolution(resolution.clone()));
+        resolution.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(resolution)),
+            answered,
+            "a subject has one resolution key whatever the outcome"
+        );
+        Ok(())
+    }
+
+    /// F2, and Soul's second pass: a composed local segments one way only. The
+    /// rule -- no local part carries the separator -- is pinned on the composer
+    /// in `no_local_part_carries_the_separator`; the pairs below are the ones
+    /// Soul measured through the documents, and each is a pair only because the
+    /// rule holds.
+    #[test]
+    fn composed_keys_cannot_collide() {
+        let key = |document: PipelineDocument| pipeline_key(&document);
+
+        // Soul's hand-off pair. A dotted slug is ordinary on the receiver side
+        // and a dotted repo name (the part after the mandatory `/`, GitHub's
+        // grammar owns no dot on the owner side) is ordinary on the repo side,
+        // so both are escaped: left unescaped these two both key to
+        // `yggdrasil:hand_off:thought-cage.GameCult.Epiphany_-thing.2026-09-15`.
+        let handed = |to: &str, repo: &str| {
+            let mut hand_off = hand_off_sample();
+            hand_off.to_instance = slug(to);
+            hand_off.repo = OrgRepo(repo.into());
+            key(PipelineDocument::HandOff(hand_off))
+        };
+        let dotted_receiver = handed("thought-cage.GameCult", "Epiphany/thing");
+        let dotted_repo = handed("thought-cage", "GameCult/Epiphany.thing");
+        assert_eq!(
+            dotted_receiver,
+            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.epiphany_-thing.2026-09-15"))
+        );
+        assert_eq!(
+            dotted_repo,
+            Ok(format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany_dthing.2026-09-15"))
+        );
+        assert_ne!(dotted_receiver, dotted_repo, "a dotted repo and a dotted receiver cannot claim one key");
+
+        let mut wide_label = finding_sample();
+        wide_label.label = l("F1.G");
+        assert!(
+            matches!(key(PipelineDocument::Finding(wide_label)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a finding label carrying a dot is refused, not silently composed"
+        );
+        let mut deep_verdict = finding_sample();
+        deep_verdict.verdict = id("verdict", "cut-3a.s1.F1");
+        deep_verdict.label = l("G");
+        assert!(
+            matches!(key(PipelineDocument::Finding(deep_verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a verdict local that is not cut-<label>.s<N> is refused"
+        );
+        let mut plain = finding_sample();
+        plain.verdict = id("verdict", "cut-3a.s1");
+        plain.label = l("F1");
+        assert_eq!(key(PipelineDocument::Finding(plain)), Ok(format!("{CAMPAIGN}:finding:cut-3a.s1.F1")));
+
+        let mut deep_spec = report_sample();
+        deep_spec.cut_spec = id("cut_spec", "cut-3a.h1.r1");
+        deep_spec.attempt = 2;
+        assert!(
+            matches!(key(PipelineDocument::CutReport(deep_spec)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a cut label carrying a dot is refused, so cut-3a.h1.h2 has one source"
+        );
+        let mut attempt_two = report_sample();
+        attempt_two.attempt = 2;
+        assert_eq!(key(PipelineDocument::CutReport(attempt_two)), Ok(format!("{CAMPAIGN}:cut_report:cut-3a.h2")));
+    }
+
+    /// F3: every parent id is parsed strictly. These are the bad parents Soul
+    /// found accepted, plus the wrong-kind and marker rules that mutations S1
+    /// and S3 remove.
+    #[test]
+    fn parent_ids_are_parsed_strictly() {
+        let refused = |parent: &str| {
+            let mut report = report_sample();
+            report.cut_spec = Short(parent.into());
+            let key = pipeline_key(&PipelineDocument::CutReport(report));
+            assert!(
+                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "cut_report.cut_spec"),
+                "parent {parent:?} must be refused, got {key:?}"
+            );
+        };
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:junk"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.rX"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-..r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-.r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1 "));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r"));
+        refused(&format!("{CAMPAIGN}:cut_report:cut-3a.h1"));
+        // Right kind and a well-formed number, but the marker belongs to
+        // another kind: the marker rule is pinned on its own.
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.h1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.s1"));
+        // A well-formed number with no marker at all. Only the marker rule
+        // refuses this one: the digits rule is satisfied either way.
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.1"));
+        refused(&format!("{CAMPAIGN}:CUT_SPEC:cut-3a.r1"));
+        refused(&format!("EUREKA-STATE:cut_spec:cut-3a.r1"));
+        refused(&format!("{CAMPAIGN}:cut_spec:cut-3a.r1:"));
+        refused(&format!("{CAMPAIGN}::cut-3a.r1"));
+        refused("cut-3a.r1");
+        let mut other_campaign = report_sample();
+        other_campaign.campaign = slug("other-campaign");
+        assert!(
+            matches!(
+                pipeline_key(&PipelineDocument::CutReport(other_campaign)),
+                Err(PipelineRefusal::InvalidFormat { .. })
+            ),
+            "a parent in another campaign is refused"
+        );
+        let mut verdict = verdict_sample();
+        verdict.cut_report = id("cut_report", "cut-3a.r1");
+        assert!(
+            matches!(pipeline_key(&PipelineDocument::Verdict(verdict)), Err(PipelineRefusal::InvalidFormat { .. })),
+            "a verdict's parent must carry the report marker, not the spec marker"
+        );
+    }
+
+    /// F4: a resolution's subject id is a full id of the declared kind.
+    #[test]
+    fn resolution_subject_is_a_full_id_of_its_kind() {
+        let refused = |kind: PipelineKind, subject: &str| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            let document = PipelineDocument::Resolution(resolution);
+            assert!(
+                matches!(document.validate(), Err(PipelineRefusal::InvalidFormat { .. })),
+                "subject {subject:?} must fail validation"
+            );
+            assert!(
+                matches!(pipeline_key(&document), Err(PipelineRefusal::InvalidFormat { .. })),
+                "subject {subject:?} must not compose a key"
+            );
+        };
+        refused(PipelineKind::Question, "");
+        refused(PipelineKind::Question, "not an id: spaces and : colons");
+        refused(PipelineKind::Question, "eureka-state:question:1１");
+        refused(PipelineKind::Question, &format!("{CAMPAIGN}:ruling:R8"));
+        refused(PipelineKind::Ruling, &format!("{CAMPAIGN}:question:Q1"));
+        refused(PipelineKind::Question, &format!("{CAMPAIGN}:question:.."));
+
+        let mut valid = resolution_sample();
+        valid.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(valid)),
+            Ok(format!("{CAMPAIGN}:resolution:ruling.R8.n1"))
+        );
+    }
+
+    /// Soul G2: a resolution is named by the key it has, and a `PipelineRef`
+    /// of kind `Resolution` accepts exactly that id. `PipelineRef` takes any
+    /// kind, so this is reachable; a follow-up sourced from a resolution is the
+    /// live path. The grammar admits `<campaign>:resolution:R8` too: it is
+    /// well-formed, and no resolution derives it, but whether a document with an
+    /// id exists is admission's rule, not the grammar's, so the reader does not
+    /// refuse it and this test does not ask it to.
+    #[test]
+    fn a_resolution_is_named_by_the_key_it_has() {
+        let sourced = |id: &str| {
+            let PipelineDocument::FollowUp(mut follow_up) = samples().remove(8).0 else { unreachable!() };
+            follow_up.source = PipelineRef { kind: PipelineKind::Resolution, id: Short(id.into()) };
+            PipelineDocument::FollowUp(follow_up).validate()
+        };
+        let key = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
+        assert_eq!(key, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
+        assert_eq!(sourced(&key), Ok(()), "a resolution is named by the key it has");
+        assert_eq!(sourced(&format!("{CAMPAIGN}:resolution:R8")), Ok(()), "well-formed grammar is not the reader's to refuse");
+
+        for refused in [
+            // The prefix shape the writer used to emit. No resolution carries it.
+            format!("resolution:{CAMPAIGN}:question:Q1"),
+            format!("{CAMPAIGN}:resolution:{CAMPAIGN}:question:Q1"),
+            // No local, a subject local with an empty part, trailing junk, and a
+            // kind segment that is not `resolution`.
+            format!("{CAMPAIGN}:resolution:"),
+            format!("{CAMPAIGN}:resolution:question..Q1"),
+            format!("{CAMPAIGN}:resolution:question.Q1:junk"),
+            format!("{CAMPAIGN}:question:Q1"),
+        ] {
+            assert!(
+                matches!(sourced(&refused), Err(PipelineRefusal::InvalidFormat { .. })),
+                "{refused:?} is not an id any resolution has"
+            );
+        }
+
+        // A root subject reads back too: a resolution of a campaign carries the
+        // campaign's kind and its `self` local.
+        let mut of_campaign = resolution_sample();
+        of_campaign.subject = PipelineRef { kind: PipelineKind::Campaign, id: Short(format!("{CAMPAIGN}:campaign:self")) };
+        let root_key = pipeline_key(&PipelineDocument::Resolution(of_campaign)).expect("a root subject keys");
+        assert_eq!(root_key, format!("{CAMPAIGN}:resolution:campaign.self.n1"));
+        assert_eq!(sourced(&root_key), Ok(()));
+    }
+
+    /// The three kinds a mind is keyed by. The samples above already round-trip
+    /// every kind; this pins the shapes D2 gives these three specifically: an
+    /// instance is a root keyed by its own slug, and the other two hang off an
+    /// instance rather than a campaign, so neither borrows the campaign tail.
+    #[test]
+    fn instance_stewardship_and_hand_off_round_trip() -> Result<()> {
+        let cache = schema_cache()?;
+        let instance = PipelineDocument::Instance(instance_sample());
+        assert_eq!(pipeline_key(&instance), Ok(format!("{INSTANCE}:instance:self")));
+        for document in [
+            instance,
+            PipelineDocument::Stewardship(stewardship_sample()),
+            PipelineDocument::HandOff(hand_off_sample()),
+        ] {
+            document.validate()?;
+            let envelope = document.prepare(&cache)?;
+            assert_eq!(PipelineDocument::decode(&envelope)?, document);
+            let key = pipeline_key(&document)?;
+            assert!(
+                !key.starts_with(&format!("{CAMPAIGN}:")),
+                "{:?} is keyed by its instance, not by a campaign: {key}",
+                document.kind()
+            );
+            validate_pipeline_write_envelope(&envelope)?;
+        }
+        // A bounded list is still bounded: `documents` carries a maximum, as
+        // every `Vec` field must.
+        let mut wide = hand_off_sample();
+        wide.documents = vec![s("x"); 257];
+        assert_eq!(
+            PipelineDocument::HandOff(wide).validate(),
+            Err(PipelineRefusal::FieldBound { field: "hand_off.documents".into(), limit: 256, actual: 257 })
+        );
+        Ok(())
+    }
+
+    /// Soul F3: a key and an id are the same string, so every kind's key reads
+    /// back as an id of that kind. The kinds a mind is keyed by were added to
+    /// the key writer and left out of the id reader, and nothing noticed,
+    /// because the key tests assert strings and never read one back: an
+    /// instance keys to its slug and then fails to parse as an instance id, so
+    /// no `PipelineRef` and no resolution could ever name one. Every kind now
+    /// reads back with no kind excused, a resolution included, and a root kind
+    /// read as the other root kind is refused: the reader checks the kind
+    /// segment for the roots exactly as for every other kind.
+    #[test]
+    fn keys_read_back_as_ids_of_their_kind() -> Result<()> {
+        for (document, expected) in samples() {
+            let kind = document.kind();
+            let key = pipeline_key(&document)?;
+            assert_eq!(key, expected, "{kind:?} keys to its sample's key");
+            assert_eq!(
+                pipeline_id("read_back", &key, kind).map(|_| ()),
+                Ok(()),
+                "{kind:?} key {key} does not read back as an id of its kind"
+            );
+        }
+
+        let campaign_key = pipeline_key(&campaign_sample())?;
+        let instance_key = pipeline_key(&PipelineDocument::Instance(instance_sample()))?;
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
+            Ok((INSTANCE, ROOT_LOCAL)),
+            "an instance key reads back as an instance"
+        );
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Campaign),
+            Err(format_error("read_back", &instance_key)),
+            "an instance key is not a campaign id"
+        );
+        assert_eq!(
+            pipeline_id("read_back", &campaign_key, PipelineKind::Instance),
+            Err(format_error("read_back", &campaign_key)),
+            "a campaign key is not an instance id"
+        );
+
+        // Soul X1 and X11: the reader's root and local are each `dotted_text`
+        // whole, so a trailing dot on either is refused by the reader itself,
+        // not only by the writer that never composes one. A leading dot and
+        // an empty part are the same rule on the local.
+        for malformed in ["c.:target:x", "c:target:x.", "c:target:.x", "c:target:a..b"] {
+            let read = pipeline_id("read_back", malformed, PipelineKind::Target);
+            assert!(
+                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "read_back"),
+                "{malformed:?} is not an id of any kind, got {read:?}"
+            );
+        }
+
+        // The instance root's own key segment is validated, not merely bounded.
+        // Nothing else stands between a `Slug` and a key: a space would compose
+        // a store key carrying a byte no `Label` may hold.
+        let mut spaced = instance_sample();
+        spaced.instance = Slug("thought cage".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Instance(spaced)),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "instance.instance".into(),
+                value: "thought cage".into(),
+            }),
+            "an instance slug is validated where the key is composed"
+        );
+        Ok(())
+    }
+
+    /// The repo is one key segment, so its slash is escaped. Left unescaped it
+    /// would both add a segment the reader cannot tell from a real one and put a
+    /// byte in the key that no `Label` may carry; escaped to a bare `_` it would
+    /// let two repos claim one key, which the colliding pair below pins.
+    #[test]
+    fn stewardship_key_escapes_the_repo_slash() {
+        let stewardship = stewardship_sample();
+        assert_eq!(stewardship.repo, OrgRepo("GameCult/Epiphany".into()));
+        let key = pipeline_key(&PipelineDocument::Stewardship(stewardship.clone()));
+        assert_eq!(key, Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1")));
+        assert!(!key.unwrap().contains('/'), "no key segment carries a slash");
+
+        // The escape is not a cosmetic substitution, and the pair that proves
+        // it is a pair: GitHub's grammar keeps `.` and `_` out of the owner,
+        // so both live in the repo half here, and under a naive scheme that
+        // collapsed `/`, `.` and `_` all to a bare `_` both of these key to
+        // `GameCult_Epiphany_thing`, and one of the two documents is lost.
+        let keyed = |repo: &str| {
+            let mut value = stewardship.clone();
+            value.repo = OrgRepo(repo.into());
+            pipeline_key(&PipelineDocument::Stewardship(value))
+        };
+        let dotted_repo = keyed("GameCult/Epiphany.thing");
+        let underscored_repo = keyed("GameCult/Epiphany_thing");
+        assert_eq!(
+            dotted_repo,
+            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany_dthing.n1"))
+        );
+        assert_eq!(
+            underscored_repo,
+            Ok(format!("{INSTANCE}:stewardship:gamecult_-epiphany__thing.n1"))
+        );
+        assert_ne!(dotted_repo, underscored_repo, "two repos cannot claim one key");
+
+        let mut no_org = stewardship.clone();
+        no_org.repo = OrgRepo("Epiphany".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Stewardship(no_org)),
+            Err(PipelineRefusal::InvalidFormat { field: "stewardship.repo".into(), value: "Epiphany".into() })
+        );
+
+        // S-1: key derivation goes through `identity()`, so a case variant of
+        // the same repository is one store key, not two stewardships of what
+        // is really one repo.
+        let mut upper = stewardship.clone();
+        upper.repo = OrgRepo("gamecult/epiphany".into());
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Stewardship(upper)),
+            pipeline_key(&PipelineDocument::Stewardship(stewardship.clone())),
+            "GameCult/Epiphany and gamecult/epiphany must derive one store key"
+        );
+
+        // An escaped repo is still bound by the key's segment rules.
+        let mut long = stewardship;
+        long.repo = OrgRepo(format!("GameCult/{}", "a".repeat(60)));
+        assert!(
+            matches!(
+                pipeline_key(&PipelineDocument::Stewardship(long)),
+                Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "stewardship.key"
+            ),
+            "a repo segment longer than a key segment is refused"
+        );
+    }
+
+    /// A hand-off is recorded in both minds, so both instances are in the key:
+    /// the sender owns the first segment and the receiver the local. Changing
+    /// either one moves the document.
+    #[test]
+    fn hand_off_names_both_instances() {
+        let key = |hand_off: PipelineHandOff| pipeline_key(&PipelineDocument::HandOff(hand_off));
+        let base = key(hand_off_sample()).expect("the sample keys");
+        assert_eq!(base, format!("{INSTANCE}:hand_off:thought-cage.gamecult_-epiphany.2026-09-15"));
+
+        let mut other_sender = hand_off_sample();
+        other_sender.from_instance = slug("thought-cage");
+        assert_ne!(key(other_sender), Ok(base.clone()), "the sender is in the key");
+
+        let mut other_receiver = hand_off_sample();
+        other_receiver.to_instance = slug("mimir");
+        assert_ne!(key(other_receiver), Ok(base.clone()), "the receiver is in the key");
+
+        // Two hand-offs of the same repo between the same pair on different
+        // days are different documents.
+        let mut later = hand_off_sample();
+        later.handed_on = Date("2026-09-16".into());
+        assert_ne!(key(later), Ok(base), "the date is in the key");
+
+        // A dotted receiver is a `Slug` entering a local, so it is escaped to
+        // one label rather than widening the local by a part.
+        let mut dotted_receiver = hand_off_sample();
+        dotted_receiver.to_instance = slug("thought-cage.GameCult");
+        assert_eq!(
+            key(dotted_receiver),
+            Ok(format!("{INSTANCE}:hand_off:thought-cage_dGameCult.gamecult_-epiphany.2026-09-15"))
+        );
+
+        // The escape's `_` half is not only for repos: a receiver `a_db` and a
+        // receiver `a.b` would both key to `a_db` if the slug's own `_` passed
+        // through raw, so the slug is escaped as `a__db` and the two differ.
+        let mut underscored_receiver = hand_off_sample();
+        underscored_receiver.to_instance = slug("a_db");
+        let mut dotted_twin = hand_off_sample();
+        dotted_twin.to_instance = slug("a.b");
+        let underscored_receiver = key(underscored_receiver).expect("an underscored receiver keys");
+        assert!(underscored_receiver.contains("a__db"), "{underscored_receiver}: the slug's underscore is escaped");
+        assert_ne!(key(dotted_twin), Ok(underscored_receiver), "`a_db` and `a.b` are two receivers");
+
+        // Both instance slugs are validated as key segments, not merely bounded.
+        let mut bad_receiver = hand_off_sample();
+        bad_receiver.to_instance = Slug("thought cage".into());
+        assert_eq!(
+            key(bad_receiver),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "hand_off.to_instance".into(),
+                value: "thought cage".into(),
+            })
+        );
+        let mut bad_date = hand_off_sample();
+        bad_date.handed_on = Date("2026-9-15".into());
+        assert!(
+            matches!(key(bad_date), Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "hand_off.handed_on"),
+            "a malformed date does not compose a key"
+        );
+    }
+
+    /// A resolution whose subject is the given document, keyed.
+    fn resolution_of(kind: PipelineKind, id: &str) -> Result<String, PipelineRefusal> {
+        let mut resolution = resolution_sample();
+        resolution.subject = PipelineRef { kind, id: Short(id.into()) };
+        pipeline_key(&PipelineDocument::Resolution(resolution))
+    }
+
+    /// R1, the grammar's own test: every key is `<root>:<kind>:<local>`, three
+    /// segments with no kind excused, the root a `Slug`, the kind the literal
+    /// name, and every local part a `Label`. A root that would add a segment is
+    /// refused where the key is composed: `pipeline_key` is `pub` and does not
+    /// validate the document first, so this is reachable without one.
+    #[test]
+    fn every_key_has_exactly_three_segments() {
+        let nested = resolution_of(PipelineKind::Resolution, &format!("{CAMPAIGN}:resolution:question.Q1.n1"))
+            .expect("a resolution of a resolution keys");
+        let keys = samples()
+            .into_iter()
+            .map(|(document, _)| (document.kind(), pipeline_key(&document).expect("every sample keys")))
+            .chain([(PipelineKind::Resolution, nested)]);
+        for (kind, key) in keys {
+            let segments = key.split(':').collect::<Vec<_>>();
+            assert_eq!(segments.len(), 3, "{kind:?} key {key} has three segments");
+            assert_eq!(dotted_text("root", segments[0]), Ok(()), "{key}: the root is a slug");
+            assert_eq!(segments[1], kind.name(), "{key}: the kind segment is the literal kind");
+            assert!(PipelineKind::ALL.iter().any(|known| known.name() == segments[1]));
+            for part in segments[2].split('.') {
+                assert_eq!(label_text("local", part), Ok(()), "{key}: local part {part:?} is a label");
+            }
+        }
+
+        // A root that would add a segment, one that would empty a part, and one
+        // wider than a segment are all refused before a key is formatted. The
+        // refusal names the part that failed, so an empty part reports `""`.
+        let trailing_dot = format!("{CAMPAIGN}.");
+        let leading_dot = format!(".{CAMPAIGN}");
+        let over = "a".repeat(65);
+        for root in ["a:b", trailing_dot.as_str(), leading_dot.as_str(), "a..b", over.as_str()] {
+            let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
+            target.campaign = Slug(root.into());
+            let key = pipeline_key(&PipelineDocument::Target(target));
+            assert!(
+                matches!(&key, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "target.campaign"),
+                "root {root:?} does not compose a key, got {key:?}"
+            );
+        }
+    }
+
+    /// Defect 1: the two roots are in distinct namespaces because the kind
+    /// segment distinguishes them, the same mechanism that separates every
+    /// other pair of kinds. Both key; only the pair sees a shared namespace.
+    #[test]
+    fn roots_of_different_kinds_do_not_share_a_key() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.slug = slug(INSTANCE);
+        let campaign = pipeline_key(&PipelineDocument::Campaign(campaign));
+        let instance = pipeline_key(&PipelineDocument::Instance(instance_sample()));
+        assert_eq!(campaign, Ok(format!("{INSTANCE}:campaign:self")));
+        assert_eq!(instance, Ok(format!("{INSTANCE}:instance:self")));
+        assert_ne!(campaign, instance, "a campaign and an instance of one slug are two documents");
+    }
+
+    /// The root is a `Slug`, so a dotted root keys and reads back whole on
+    /// both sides: the writer's root check and the reader's root check are
+    /// each `dotted_text`, not `label_text`. A campaign `game.cult` and an
+    /// instance `ygg.drasil` key, a document under the dotted campaign keys,
+    /// and each reads back through `pipeline_id` recovering the root exactly.
+    #[test]
+    fn dotted_roots_key_and_read_back() {
+        let PipelineDocument::Campaign(mut campaign) = campaign_sample() else { unreachable!() };
+        campaign.slug = slug("game.cult");
+        let campaign_key = pipeline_key(&PipelineDocument::Campaign(campaign)).expect("a dotted campaign keys");
+        assert_eq!(campaign_key, "game.cult:campaign:self");
+        assert_eq!(
+            pipeline_id("read_back", &campaign_key, PipelineKind::Campaign),
+            Ok(("game.cult", ROOT_LOCAL)),
+            "the dotted campaign root reads back whole"
+        );
+
+        let mut instance = instance_sample();
+        instance.instance = slug("ygg.drasil");
+        let instance_key = pipeline_key(&PipelineDocument::Instance(instance)).expect("a dotted instance keys");
+        assert_eq!(instance_key, "ygg.drasil:instance:self");
+        assert_eq!(
+            pipeline_id("read_back", &instance_key, PipelineKind::Instance),
+            Ok(("ygg.drasil", ROOT_LOCAL)),
+            "the dotted instance root reads back whole"
+        );
+
+        let PipelineDocument::Target(mut target) = samples().remove(1).0 else { unreachable!() };
+        target.campaign = slug("game.cult");
+        let target_key = pipeline_key(&PipelineDocument::Target(target)).expect("a target under a dotted campaign keys");
+        assert_eq!(target_key, "game.cult:target:r2");
+        assert_eq!(
+            pipeline_id("read_back", &target_key, PipelineKind::Target),
+            Ok(("game.cult", "r2")),
+            "the dotted root and the local both read back"
+        );
+
+        let resolution = resolution_of(PipelineKind::Campaign, &campaign_key).expect("a resolution of a dotted campaign keys");
+        assert_eq!(resolution, "game.cult:resolution:campaign.self.n1");
+        assert_eq!(
+            pipeline_id("read_back", &resolution, PipelineKind::Resolution),
+            Ok(("game.cult", "campaign.self.n1")),
+            "a resolution under a dotted root reads back"
+        );
+    }
+
+    /// Cut 6c: a resolution's referent is a full id of the kind it declares,
+    /// validated through `PipelineRef` like every other referent, so a
+    /// well-formed id of the wrong kind is refused and the refusal names the
+    /// entry. The positive case is Ghostlight's own: a ruling partly
+    /// overturned by two later records, one of them a resolution named by the
+    /// key it has, which only the 6b grammar made nameable. An id no
+    /// resolution derives, `eureka-state:resolution:R8`, still validates:
+    /// whether a document with an id exists is admission's rule.
+    #[test]
+    fn resolution_outcome_referents_are_parsed_ids_of_their_kind() {
+        let resolved = |subject: PipelineRef, outcome: ResolutionOutcome| {
+            let mut resolution = resolution_sample();
+            resolution.subject = subject;
+            resolution.outcome = outcome;
+            PipelineDocument::Resolution(resolution).validate()
+        };
+        let refused = |field: &str, result: Result<(), PipelineRefusal>| {
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field: at, .. }) if at == field),
+                "expected InvalidFormat at {field}, got {result:?}"
+            );
+        };
+        let ruling = |label: &str| PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", label) };
+        let question = |label: &str| PipelineRef { kind: PipelineKind::Question, id: id("question", label) };
+        let inner = pipeline_key(&PipelineDocument::Resolution(resolution_sample())).expect("the sample keys");
+        let resolution = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
+
+        let superseded = |second: PipelineRef| ResolutionOutcome::Superseded { by: vec![ruling("R9"), second] };
+        assert_eq!(resolved(ruling("R8"), superseded(resolution)), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Ruling, id: Short(inner) };
+        refused("resolution.outcome.by[1].id", resolved(ruling("R8"), superseded(forged)));
+        let underived = PipelineRef { kind: PipelineKind::Resolution, id: Short(format!("{CAMPAIGN}:resolution:R8")) };
+        assert_eq!(resolved(ruling("R8"), superseded(underived)), Ok(()), "well-formed grammar is not the shape's to refuse");
+
+        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Answered { by: ruling("R8") }), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Question, id: id("ruling", "R8") };
+        refused("resolution.outcome.by.id", resolved(question("Q1"), ResolutionOutcome::Answered { by: forged }));
+
+        assert_eq!(resolved(question("Q1"), ResolutionOutcome::Deferred { to: question("Q2") }), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q2") };
+        refused("resolution.outcome.to.id", resolved(question("Q1"), ResolutionOutcome::Deferred { to: forged }));
+
+        let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+        let fixed = |by: Option<PipelineRef>| ResolutionOutcome::Fixed { commit: sha(), by };
+        assert_eq!(resolved(finding.clone(), fixed(None)), Ok(()));
+        assert_eq!(resolved(finding.clone(), fixed(Some(ruling("R8")))), Ok(()));
+        let forged = PipelineRef { kind: PipelineKind::Finding, id: id("ruling", "R8") };
+        refused("resolution.outcome.by.id", resolved(finding, fixed(Some(forged))));
+
+        // Soul F2: the validator's bound on a supersession is its own, not
+        // only the schema's. Eight referents are the most a subject names;
+        // nine are refused as a count before any item is read.
+        let rulings = |count: usize| (1..=count).map(|n| ruling(&format!("R{n}"))).collect::<Vec<_>>();
+        assert_eq!(resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(8) }), Ok(()));
+        assert_eq!(
+            resolved(ruling("R8"), ResolutionOutcome::Superseded { by: rulings(9) }),
+            Err(PipelineRefusal::FieldBound { field: "resolution.outcome.by".into(), limit: 8, actual: 9 })
+        );
+
+        // Soul F3: the two reason-carrying outcomes are bounded like every
+        // `Line`; the shared arm is pinned on both so neither can drop out.
+        let wide = Line("a".repeat(1001));
+        for outcome in [
+            ResolutionOutcome::Recorded { reason: wide.clone() },
+            ResolutionOutcome::Withdrawn { reason: wide },
+        ] {
+            let finding = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+            assert_eq!(
+                resolved(finding, outcome),
+                Err(PipelineRefusal::FieldBound { field: "resolution.outcome.reason".into(), limit: 1000, actual: 1001 })
+            );
+        }
+    }
+
+    /// Ruling B: a fix names the tree where the finding stopped being true,
+    /// as a `Sha`. Uppercase hex of a legal length is the forgery a length
+    /// check passes and `hex` refuses.
+    #[test]
+    fn fixed_resolution_requires_a_commit_sha() {
+        let fixed = |commit: &str, by: Option<PipelineRef>| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind: PipelineKind::Finding, id: id("finding", "cut-3a.s2.F4") };
+            resolution.outcome = ResolutionOutcome::Fixed { commit: Sha(commit.into()), by };
+            PipelineDocument::Resolution(resolution).validate()
+        };
+        assert_eq!(fixed("5f98228d9c", None), Ok(()));
+        for forged in ["5F98228D9C", "5f9822", "dirty-worktree", ""] {
+            assert_eq!(
+                fixed(forged, None),
+                Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: forged.into() }),
+                "{forged:?} is not a commit"
+            );
+        }
+        // Soul F1: naming the record that fixed it does not excuse the commit.
+        let ruling = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "R8") };
+        assert_eq!(
+            fixed("dirty-worktree", Some(ruling)),
+            Err(PipelineRefusal::InvalidFormat { field: "resolution.outcome.commit".into(), value: "dirty-worktree".into() }),
+            "a fix with a named record still names a commit"
+        );
+    }
+
+    /// A mutation record has a key-safe identity a verdict claim can name,
+    /// and is pinned to a tree: its label is a `Label` and its commit a
+    /// `Sha`, so a dotted label and free text where a sha belongs are refused.
+    #[test]
+    fn mutation_records_carry_a_dot_free_label_and_a_commit() {
+        let recorded = |label: &str, commit: &str| {
+            let mut report = report_sample();
+            // Through `From<&str>`, which every text type has, so the
+            // widened types under M19 and M20 still compile and the
+            // forgeries reach validation.
+            report.mutations[0].label = label.into();
+            report.mutations[0].commit = commit.into();
+            PipelineDocument::CutReport(report).validate()
+        };
+        assert_eq!(recorded("M1", "5f98228d"), Ok(()));
+        assert_eq!(
+            recorded("M1.a", "5f98228d"),
+            Err(PipelineRefusal::InvalidFormat { field: "cut_report.mutations[0].label".into(), value: "M1.a".into() })
+        );
+        assert_eq!(
+            recorded("M1", "dirty-worktree"),
+            Err(PipelineRefusal::InvalidFormat {
+                field: "cut_report.mutations[0].commit".into(),
+                value: "dirty-worktree".into(),
+            })
+        );
+    }
+
+    /// Ruling A's shape half: a claim names the promise it measured and the
+    /// mutations it ran, both as `Label`s, and names at most eight mutations.
+    #[test]
+    fn a_verdict_claim_names_the_promise_and_the_mutation_it_measured() {
+        let sample = verdict_sample();
+        assert_eq!(sample.claims[0].promise, Some(l("P1")));
+        assert_eq!(sample.claims[0].mutations, vec![l("M1")]);
+        assert_eq!(PipelineDocument::Verdict(sample).validate(), Ok(()));
+
+        let claimed = |promise: Option<Label>, mutations: Vec<Label>| {
+            let mut verdict = verdict_sample();
+            verdict.claims[0].promise = promise;
+            verdict.claims[0].mutations = mutations;
+            PipelineDocument::Verdict(verdict).validate()
+        };
+        assert_eq!(claimed(None, vec![]), Ok(()), "a claim need not measure a promise");
+        assert_eq!(
+            claimed(Some(l("P1.a")), vec![]),
+            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].promise".into(), value: "P1.a".into() })
+        );
+        assert_eq!(
+            claimed(None, vec![l("M1.a")]),
+            Err(PipelineRefusal::InvalidFormat { field: "verdict.claims[0].mutations[0]".into(), value: "M1.a".into() })
+        );
+        let labels = |count: usize| (1..=count).map(|n| l(&format!("M{n}"))).collect::<Vec<_>>();
+        assert_eq!(claimed(None, labels(8)), Ok(()));
+        assert_eq!(
+            claimed(None, labels(9)),
+            Err(PipelineRefusal::FieldBound { field: "verdict.claims[0].mutations".into(), limit: 8, actual: 9 })
+        );
+    }
+
+    /// A tripwire on the one hazard of retyping the estimate: the delta's two
+    /// `u32` fields are not interchangeable. The sample spec is Cut 3a's, a
+    /// net addition of 900 lines, and the order is asserted.
+    #[test]
+    fn the_sample_cut_spec_estimates_a_net_addition() {
+        let PipelineDocument::CutSpec(spec) = samples().remove(4).0 else { unreachable!() };
+        assert_eq!(spec.estimate.lines_added, 900);
+        assert_eq!(spec.estimate.lines_removed, 0);
+        assert_eq!(spec.estimate, report_sample().structural_delta, "the estimate and the actual are one shape");
+    }
+
+    /// Defect 2: a resolution's key carries its subject's kind as a literal
+    /// part of the local, so nothing infers it and two subjects of one local
+    /// and different kinds resolve to two keys. Each reads back through the
+    /// reader with the subject kind it was built from.
+    #[test]
+    fn a_resolution_names_its_subjects_kind() {
+        let pairs = [
+            (PipelineKind::Question, id("question", "Q1").0, PipelineKind::Ruling, id("ruling", "Q1").0),
+            (
+                PipelineKind::Campaign,
+                format!("{CAMPAIGN}:campaign:self"),
+                PipelineKind::Instance,
+                format!("{CAMPAIGN}:instance:self"),
+            ),
+        ];
+        for (left_kind, left_id, right_kind, right_id) in pairs {
+            let left = resolution_of(left_kind, &left_id).expect("the left subject keys");
+            let right = resolution_of(right_kind, &right_id).expect("the right subject keys");
+            assert_ne!(left, right, "resolutions of {left_id} and {right_id} are two documents");
+            for (kind, key) in [(left_kind, &left), (right_kind, &right)] {
+                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+                assert_eq!(root, CAMPAIGN);
+                assert_eq!(local.split('.').next(), Some(kind.name()), "{key} names its subject's kind");
+            }
+        }
+    }
+
+    /// Defect 3: a resolution's own key is an ordinary id, so it composes as a
+    /// subject like any other, and the key reads back to the inner key -- the
+    /// whole inner key, sequence included, since the subject is recovered by
+    /// stripping this resolution's own sequence from the end and the kind from
+    /// the front. The depth bound is tested per kind by
+    /// `every_resolvable_kind_resolves_two_deep`.
+    #[test]
+    fn a_resolution_of_a_resolution_reads_back() {
+        let inner = resolution_of(PipelineKind::Question, &id("question", "Q1").0).expect("the inner keys");
+        let mut outer = resolution_sample();
+        outer.subject = PipelineRef { kind: PipelineKind::Resolution, id: Short(inner.clone()) };
+        let outer = PipelineDocument::Resolution(outer);
+        assert_eq!(outer.validate(), Ok(()));
+        let key = pipeline_key(&outer).expect("a resolution of a resolution keys");
+        assert_eq!(key, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"));
+        let (root, local) = pipeline_id("read_back", &key, PipelineKind::Resolution).expect("reads back");
+        let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+        let (subject_local, _sequence) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+        assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), inner, "the recovered subject is the inner key");
+    }
+
+    /// Each level of a nesting carries its own sequence, and only its own: the
+    /// part appended is this resolution's `sequence` field, never a copy of the
+    /// sequence the subject already ends in. The fixtures elsewhere all sit at
+    /// `1` at every level, where the two are indistinguishable, so the chain
+    /// here differs at every level and reads back level by level.
+    ///
+    /// On spelling, so silence is not read as coverage: the leaf emits `n<N>`
+    /// with `N` as `u32::to_string` writes it, so `n0` and `n12` are emitted
+    /// and `n01` is not. A hand-built id ending `n01`, `n1x`, or no `n<N>` at
+    /// all is still a well-formed reference -- those are legal labels, and a
+    /// grammar that reads keys may not refuse them on spelling. Nothing in the
+    /// leaf canonicalises them either: such an id simply names a document the
+    /// leaf would never key, which admission's A7 sees as a missing referent.
+    #[test]
+    fn every_level_of_a_nesting_keeps_its_own_sequence() {
+        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
+        };
+        let first = resolved(PipelineKind::Question, &id("question", "Q1").0, 9);
+        let second = resolved(PipelineKind::Resolution, &first, 10);
+        let third = resolved(PipelineKind::Resolution, &second, 0);
+        let fourth = resolved(PipelineKind::Resolution, &third, 12);
+        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n9"));
+        assert_eq!(second, format!("{CAMPAIGN}:resolution:resolution.question.Q1.n9.n10"));
+        assert_eq!(third, format!("{CAMPAIGN}:resolution:resolution.resolution.question.Q1.n9.n10.n0"));
+        assert_eq!(
+            fourth,
+            format!("{CAMPAIGN}:resolution:resolution.resolution.resolution.question.Q1.n9.n10.n0.n12")
+        );
+        for (outer, inner, sequence) in [(&fourth, &third, 12), (&third, &second, 0), (&second, &first, 10)] {
+            let (root, local) = pipeline_id("read_back", outer, PipelineKind::Resolution).expect("reads back");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+            assert_eq!(subject_kind, "resolution", "{outer}: the subject of a nesting is a resolution");
+            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), *inner, "{outer}: the subject is the inner key");
+            assert_eq!(last, format!("n{sequence}"), "{outer}: this level's own sequence, not the subject's");
+        }
+    }
+
+    /// A stewardship is the other sequenced kind, and it composes as a subject
+    /// like any other: the subject's whole local, escaped repo and sequence
+    /// both, is the resolution's local, with the resolution's own sequence
+    /// last. So the two assignments of one repo have two resolutions, and a
+    /// resolution of either is itself resolvable.
+    #[test]
+    fn a_resolution_of_a_stewardship_reads_back() {
+        let stewarded = |sequence: u32| {
+            let mut stewardship = stewardship_sample();
+            stewardship.sequence = sequence;
+            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
+        };
+        let first = stewarded(1);
+        let second = stewarded(2);
+        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
+        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
+
+        let resolved = resolution_of(PipelineKind::Stewardship, &first).expect("a resolution of a stewardship keys");
+        let resolved_second = resolution_of(PipelineKind::Stewardship, &second).expect("the second assignment resolves");
+        assert_eq!(resolved, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n1.n1"));
+        assert_eq!(resolved_second, format!("{INSTANCE}:resolution:stewardship.gamecult_-epiphany.n2.n1"));
+        assert_ne!(resolved, resolved_second, "each assignment keeps its own resolution");
+
+        for (key, subject) in [(&resolved, &first), (&resolved_second, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+            assert_eq!(root, INSTANCE, "{key}: a stewardship's resolution lives in the mind's root");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, last) = rest.rsplit_once('.').expect("the local ends in this resolution's sequence");
+            assert_eq!(subject_kind, PipelineKind::Stewardship.name(), "{key} names its subject's kind");
+            assert_eq!(
+                format!("{root}:{subject_kind}:{subject_local}"),
+                *subject,
+                "{key}: the subject's own sequence is part of the recovered key"
+            );
+            assert_eq!(last, "n1", "{key}: this resolution's own sequence");
+
+            // A withdrawal of that resolution nests one out, as it does under
+            // any other subject, and reads back to the resolution it withdraws.
+            let withdrawal = resolution_of(PipelineKind::Resolution, key).expect("a withdrawal keys");
+            let subject_local = key.split(':').nth(2).expect("three segments");
+            assert_eq!(withdrawal, format!("{INSTANCE}:resolution:resolution.{subject_local}.n1"));
+            let (root, local) = pipeline_id("read_back", &withdrawal, PipelineKind::Resolution).expect("reads back");
+            let (subject_kind, rest) = local.split_once('.').expect("the local names a subject");
+            let (subject_local, _) = rest.rsplit_once('.').expect("the local ends in its own sequence");
+            assert_eq!(format!("{root}:{subject_kind}:{subject_local}"), **key, "{withdrawal}: the withdrawn resolution");
+        }
+    }
+
+    /// A legal dotted local of exactly `length` bytes (`a.a.a`, each part a
+    /// label), for bounds wider than one label.
+    fn dotted_local(length: usize) -> String {
+        match length % 2 {
+            1 => format!("{}a", "a.".repeat(length / 2)),
+            _ => format!("{}aa", "a.".repeat(length / 2 - 1)),
+        }
+    }
+
+    /// A resolution of `subject`, at `sequence`, keyed.
+    fn resolved_at(kind: PipelineKind, subject: &str, sequence: u32) -> Result<String, PipelineRefusal> {
+        let mut resolution = resolution_sample();
+        resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+        resolution.sequence = sequence;
+        pipeline_key(&PipelineDocument::Resolution(resolution))
+    }
+
+    /// every-subject-resolvable: for each kind that can be a subject, at the
+    /// widest subject local (64) and `u32::MAX` sequences, depth one and depth
+    /// two key and read back through `pipeline_id`; depth three is refused on
+    /// the local bound.
+    #[test]
+    fn every_resolvable_kind_resolves_two_deep() {
+        let wide = "a".repeat(SUBJECT_LOCAL_MAX);
+        let mut widest = 0;
+        for kind in PipelineKind::ALL.iter().copied().filter(|kind| *kind != PipelineKind::Resolution) {
+            let subject = format!("{CAMPAIGN}:{}:{wide}", kind.name());
+            assert_eq!(pipeline_id("subject", &subject, kind), Ok((CAMPAIGN, wide.as_str())), "{kind:?}: the subject parses");
+            let one = resolved_at(kind, &subject, u32::MAX).unwrap_or_else(|error| panic!("{kind:?} depth one: {error}"));
+            let two = resolved_at(PipelineKind::Resolution, &one, u32::MAX)
+                .unwrap_or_else(|error| panic!("{kind:?} depth two: {error}"));
+            for key in [&one, &two] {
+                assert!(key.len() <= 200, "{key}: an id fits a Short");
+                let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution)
+                    .unwrap_or_else(|error| panic!("{kind:?}: {key} does not read back: {error}"));
+                assert_eq!(root, CAMPAIGN);
+                assert!(local.len() <= RESOLUTION_LOCAL_MAX);
+            }
+            widest = widest.max(two.len() - format!("{CAMPAIGN}:resolution:").len());
+            assert!(
+                matches!(
+                    resolved_at(PipelineKind::Resolution, &two, u32::MAX),
+                    Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "resolution.key"
+                ),
+                "{kind:?}: depth three is refused on the local bound"
+            );
+        }
+        assert_eq!(widest, RESOLUTION_LOCAL_MAX, "the bound is exactly the widest depth-two chain");
+        assert_eq!(RESOLUTION_LOCAL_MAX, 111);
+    }
+
+    #[test]
+    fn the_longest_kind_name_is_the_longest() {
+        let longest = PipelineKind::ALL.iter().map(|kind| kind.name().len()).max();
+        assert_eq!(longest, Some(LONGEST_KIND_NAME));
+    }
+
+    /// The parser bounds an id's local by kind, exactly where the composer does.
+    #[test]
+    fn an_id_local_is_bounded_by_its_kind() {
+        let at = |kind: PipelineKind, length: usize| {
+            pipeline_id("probe", &format!("{CAMPAIGN}:{}:{}", kind.name(), dotted_local(length)), kind).map(|_| ())
+        };
+        assert_eq!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX), Ok(()));
+        assert!(at(PipelineKind::Question, SUBJECT_LOCAL_MAX + 1).is_err());
+        assert_eq!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX), Ok(()));
+        assert!(at(PipelineKind::Resolution, RESOLUTION_LOCAL_MAX + 1).is_err());
+    }
+
+    #[test]
+    fn sha_names_same_commit() {
+        let full = Sha("5f98228d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a69".into());
+        assert!(full.names_same_commit(&Sha("5f98228".into())));
+        assert!(Sha("5f98228".into()).names_same_commit(&full));
+        assert!(full.names_same_commit(&full));
+        assert!(!full.names_same_commit(&Sha("5f98229".into())));
+        assert!(!Sha("5f98228".into()).names_same_commit(&Sha("5f98229".into())));
+        assert!(!Sha("5f98228a".into()).names_same_commit(&Sha("5f98228b".into())), "equal length, differing");
+    }
+
+    /// stored-documents-valid and stored-bytes-reproduce, on the real mind.
+    /// `HUGINN_MIND_SNAPSHOT` is a copy of a state root holding
+    /// `minds/eureka/mind.redb`; the test copies the store file into a scratch
+    /// directory first (redb opens read-write), so the snapshot may be
+    /// read-only. Read through cultcache-rs's own store. Each pipeline
+    /// document must re-prepare to its stored envelope: key, type and payload
+    /// bytes.
+    #[test]
+    #[ignore = "needs HUGINN_MIND_SNAPSHOT, a copy of a Huginn state root; see the crate README"]
+    fn stored_documents_read_back() {
+        use cultcache_rs::{CacheBackingStore, OwnedRedbMessagePackBackingStore};
+        let root = std::env::var("HUGINN_MIND_SNAPSHOT").expect("HUGINN_MIND_SNAPSHOT names the snapshot state root");
+        let scratch = std::env::temp_dir().join(format!("eureka-pipeline-readback-{}", std::process::id()));
+        std::fs::create_dir_all(&scratch).expect("scratch directory");
+        let working = scratch.join("mind.redb");
+        std::fs::copy(Path::new(&root).join("minds").join("eureka").join("mind.redb"), &working).expect("the snapshot copies");
+        let store = OwnedRedbMessagePackBackingStore::new(&working).expect("the snapshot opens");
+        let cache = schema_cache().expect("the registrar registers");
+        let envelopes = store.pull_all().expect("the snapshot reads");
+        let mut stored = Vec::new();
+        for envelope in &envelopes {
+            match PipelineDocument::decode(envelope) {
+                Ok(document) => {
+                    assert_eq!(document.validate(), Ok(()), "{}: valid", envelope.key);
+                    assert_eq!(pipeline_key(&document).as_deref(), Ok(envelope.key.as_str()), "{}: key derives byte for byte", envelope.key);
+                    let again = document.prepare(&cache).unwrap_or_else(|error| panic!("{}: does not re-prepare: {error}", envelope.key));
+                    assert_eq!(
+                        (&again.key, &again.r#type, &again.payload),
+                        (&envelope.key, &envelope.r#type, &envelope.payload),
+                        "{}: re-encodes to the stored bytes",
+                        envelope.key
+                    );
+                    stored.push((document.kind(), envelope.key.clone()));
+                }
+                Err(PipelineRefusal::ForeignStore { .. }) => {}
+                Err(error) => panic!("{}: does not decode: {error}", envelope.key),
+            }
+        }
+        assert!(stored.len() > 200, "{} pipeline documents read", stored.len());
+        let mut subjects = 0;
+        let resolvable = |kind: &PipelineKind| !matches!(kind, PipelineKind::Resolution | PipelineKind::Campaign | PipelineKind::Instance);
+        for (kind, key) in stored.iter().filter(|(kind, _)| resolvable(kind)) {
+            let one = resolved_at(*kind, key, 1).unwrap_or_else(|error| panic!("{key}: no resolution keys: {error}"));
+            let two = resolved_at(PipelineKind::Resolution, &one, 1).unwrap_or_else(|error| panic!("{key}: no withdrawal keys: {error}"));
+            for derived in [&one, &two] {
+                pipeline_id("read_back", derived, PipelineKind::Resolution).unwrap_or_else(|error| panic!("{derived}: does not parse: {error}"));
+            }
+            subjects += 1;
+        }
+        for (_, key) in stored.iter().filter(|(kind, _)| *kind == PipelineKind::Resolution) {
+            resolved_at(PipelineKind::Resolution, key, 1).unwrap_or_else(|error| panic!("{key}: cannot be withdrawn: {error}"));
+        }
+        // The six findings that could not be resolved before this cut.
+        let stuck = [
+            "cut-bifrost-retire-alarm.s2.verb-default-accepts-malformed",
+            "cut-ops-notice-deploy.s2.pinned-bifrost-predates-retry",
+            "cut-bifrost-notice-retry.s1.unknown-test-ignores-backoff",
+            "cut-bifrost-notice-retry.s2.closed-unknown-retry-unpinned",
+            "cut-bifrost-notice-retry.s2.flapping-clock-retries-every-tick",
+            "cut-idunn-topology-lock.s2.boot-reconcile-skipped-on-contention",
+        ];
+        for label in stuck {
+            let found = stored
+                .iter()
+                .find(|(kind, key)| *kind == PipelineKind::Finding && key.ends_with(label))
+                .unwrap_or_else(|| panic!("{label}: not in the snapshot"));
+            let one = resolved_at(PipelineKind::Finding, &found.1, 1).unwrap_or_else(|error| panic!("{label}: still stuck: {error}"));
+            assert!(one.split(':').nth(2).is_some_and(|local| local.len() > SUBJECT_LOCAL_MAX), "{label}: the old bound refused it");
+        }
+        eprintln!("read back {} pipeline documents, {subjects} subjects", stored.len());
+        let _ = std::fs::remove_dir_all(&scratch);
+    }
+
+    /// The total bound, in the one place it lives: parts that are each a legal
+    /// label compose a local wider than 64 bytes and are refused as a whole.
+    #[test]
+    fn a_composed_local_is_bounded_whole() {
+        let mut wide = hand_off_sample();
+        wide.to_instance = Slug("a".repeat(60));
+        assert_eq!(wide.to_instance.validate("hand_off.to_instance"), Ok(()), "the receiver alone is legal");
+        assert_eq!(
+            label_text("part", &key_segment(&wide.repo.0)),
+            Ok(()),
+            "the repo alone is legal"
+        );
+        let key = pipeline_key(&PipelineDocument::HandOff(wide));
+        assert!(
+            matches!(&key, Err(PipelineRefusal::InvalidFormat { field, value }) if field == "hand_off.key" && value.len() > 64),
+            "a local of legal parts is still bounded whole, got {key:?}"
+        );
+
+        // The bound is 64 exactly, on both sides, whether the part that fills
+        // it is a plain label or an escaped repo. A hand-off local is
+        // `<receiver>.<repo>.<date>`, the repo `gamecult_-epiphany` and the
+        // date ten bytes, so the receiver fills the rest; a stewardship local is
+        // `<repo escaped>.n<N>`, so `GameCult_-` and `.n1` bound the name.
+        let hand_off_rest = "gamecult_-epiphany".len() + ".".len() + date().0.len() + ".".len();
+        let stewardship_rest = "GameCult_-".len() + ".n1".len();
+        let received = |receiver: usize| {
+            let mut hand_off = hand_off_sample();
+            hand_off.to_instance = Slug("a".repeat(receiver));
+            pipeline_key(&PipelineDocument::HandOff(hand_off))
+        };
+        let stewarded = |name: usize| {
+            let mut stewardship = stewardship_sample();
+            stewardship.repo = OrgRepo(format!("GameCult/{}", "a".repeat(name)));
+            pipeline_key(&PipelineDocument::Stewardship(stewardship))
+        };
+        for (label, at_64, at_65) in [
+            ("plain label", received(64 - hand_off_rest), received(65 - hand_off_rest)),
+            ("escaped repo", stewarded(64 - stewardship_rest), stewarded(65 - stewardship_rest)),
+        ] {
+            let keyed = at_64.unwrap_or_else(|error| panic!("{label}: a 64-byte local keys: {error}"));
+            assert_eq!(keyed.split(':').nth(2).map(str::len), Some(64), "{label}: {keyed} fills the local exactly");
+            assert!(
+                matches!(&at_65, Err(PipelineRefusal::InvalidFormat { value, .. }) if value.len() == 65),
+                "{label}: a 65-byte local is refused, got {at_65:?}"
+            );
+        }
+    }
+
+    /// The resolution side of the bound: 111 keys and 112 is refused on
+    /// `resolution.key`, filled by a resolution subject (`resolution.<L>.n1`).
+    #[test]
+    fn a_composed_resolution_local_is_bounded_whole() {
+        let overhead = "resolution.".len() + ".n1".len();
+        let subject = |length: usize| format!("{CAMPAIGN}:resolution:{}", dotted_local(length));
+        let at_max = resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead), 1)
+            .expect("a 111-byte resolution local keys");
+        assert_eq!(at_max.split(':').nth(2).map(str::len), Some(RESOLUTION_LOCAL_MAX));
+        assert!(matches!(
+            resolved_at(PipelineKind::Resolution, &subject(RESOLUTION_LOCAL_MAX - overhead + 1), 1),
+            Err(PipelineRefusal::InvalidFormat { field, value }) if field == "resolution.key" && value.len() == RESOLUTION_LOCAL_MAX + 1
+        ));
+    }
+
+    /// R2, on the composer every kind goes through: no local part carries the
+    /// separator, the head included. The live case is a hand-off with a dotted
+    /// receiver, which keys to an escaped label rather than a wider local.
+    #[test]
+    fn no_local_part_carries_the_separator() {
+        assert_eq!(
+            local("probe", PipelineKind::Question, &["a.b"]),
+            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "a.b".into() }),
+            "the head may not carry the separator"
+        );
+        assert_eq!(
+            local("probe", PipelineKind::Question, &["a", "b.c"]),
+            Err(PipelineRefusal::InvalidFormat { field: "probe".into(), value: "b.c".into() }),
+            "a tail part may not carry the separator"
+        );
+        assert_eq!(local("probe", PipelineKind::Question, &["a", "b", "c"]), Ok("a.b.c".into()));
+
+        let mut dotted = hand_off_sample();
+        dotted.to_instance = slug("thought-cage.GameCult");
+        let key = pipeline_key(&PipelineDocument::HandOff(dotted)).expect("a dotted receiver keys");
+        let local = key.split(':').nth(2).expect("three segments");
+        assert_eq!(local.split('.').count(), 3, "{key}: the receiver is one part, not two");
+        assert_eq!(local.split('.').next(), Some("thought-cage_dGameCult"));
+    }
+
+    /// Q17 B: a subject's resolutions are distinct records, ordered by a
+    /// per-subject sequence the key carries as its last part, so a withdrawn
+    /// resolution stays under its subject and the next closure is nameable.
+    /// The sequence is a field the writer sets and this crate only composes:
+    /// it bounds nothing beyond `u32` and the local's own width, so `0` and a
+    /// gap both key. Which sequence a document may claim, and whether an
+    /// earlier resolution still stands, are admission's rules, exactly as
+    /// `revision: 0` is.
+    #[test]
+    fn a_subject_keeps_every_resolution_it_had() {
+        let resolved = |sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("a sequenced resolution keys")
+        };
+        let first = resolved(1);
+        let second = resolved(2);
+        assert_eq!(first, format!("{CAMPAIGN}:resolution:question.Q1.n1"));
+        assert_eq!(second, format!("{CAMPAIGN}:resolution:question.Q1.n2"));
+        assert_ne!(first, second, "two resolutions of one subject are two documents");
+        for (sequence, key) in [(1, &first), (2, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Resolution).expect("reads back");
+            assert_eq!(root, CAMPAIGN, "{key}: the subject's root");
+            let last = format!("n{sequence}");
+            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
+            assert_eq!(local.split('.').count(), 3, "{key}: subject kind, subject local, sequence");
+        }
+
+        // Outcome-invariance now holds per sequence: one record under two
+        // outcomes is still one key, which is exactly why a second closure of
+        // a subject needs a second sequence and not a second outcome.
+        let mut withdrawn = resolution_sample();
+        withdrawn.outcome = ResolutionOutcome::Withdrawn { reason: "moot".into() };
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(withdrawn)),
+            Ok(first.clone()),
+            "one sequence is one key whatever the outcome"
+        );
+
+        // Stated limits. Both are admission's to refuse and neither is the
+        // leaf's, so both compose here.
+        assert_eq!(resolved(0), format!("{CAMPAIGN}:resolution:question.Q1.n0"), "the leaf refuses no sequence value");
+        let mut widest = resolution_sample();
+        widest.subject = PipelineRef { kind: PipelineKind::Ruling, id: id("ruling", "A") };
+        widest.sequence = u32::MAX;
+        assert_eq!(
+            pipeline_key(&PipelineDocument::Resolution(widest)),
+            Ok(format!("{CAMPAIGN}:resolution:ruling.A.n4294967295")),
+            "the widest sequence is an eleven-byte label, not a refusal"
+        );
+    }
+
+    /// D2: the sequence is the *last* part, so a subject's resolutions and
+    /// only they share the prefix `<root>:resolution:<kind>.<local>.n`. R2 is
+    /// what makes the prefix exact: no local part carries a dot, so
+    /// `question.Q1.n` cannot match `question.Q10.n1`, and the withdrawal of
+    /// `Q1`'s first resolution is a record of that resolution, one nesting
+    /// out and outside `Q1`'s prefix. Pinned as a string property, which is
+    /// what a prefix query is.
+    #[test]
+    fn a_subjects_resolutions_share_a_prefix_no_other_key_has() {
+        let resolved = |kind: PipelineKind, subject: &str, sequence: u32| {
+            let mut resolution = resolution_sample();
+            resolution.subject = PipelineRef { kind, id: Short(subject.into()) };
+            resolution.sequence = sequence;
+            pipeline_key(&PipelineDocument::Resolution(resolution)).expect("the subject keys")
+        };
+        let history = [1, 2, 3].map(|sequence| resolved(PipelineKind::Question, &id("question", "Q1").0, sequence));
+        let others = [
+            resolved(PipelineKind::Question, &id("question", "Q10").0, 1),
+            resolved(PipelineKind::Ruling, &id("ruling", "Q1").0, 1),
+            resolved(PipelineKind::Campaign, &format!("{CAMPAIGN}:campaign:self"), 1),
+            resolved(PipelineKind::Resolution, &history[0], 1),
+        ];
+        assert_eq!(
+            others[3],
+            format!("{CAMPAIGN}:resolution:resolution.question.Q1.n1.n1"),
+            "a withdrawal keys under the resolution it withdraws, not under the subject"
+        );
+        let prefix = format!("{CAMPAIGN}:resolution:question.Q1.n");
+        let selected = history
+            .iter()
+            .chain(others.iter())
+            .filter(|key| key.starts_with(&prefix))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            selected,
+            history.iter().collect::<Vec<_>>(),
+            "the prefix selects the subject's resolutions and nothing else"
+        );
+    }
+
+    /// Q18 A and Q20 A: a repo's stewardships on a mind are distinct records,
+    /// ordered by a per-`(instance, repo)` sequence the key carries last, so a
+    /// repo transferred away and later transferred back is two records under
+    /// one prefix rather than one document overwriting the other. The date is
+    /// not in the key: `assigned_on` is validated where every field is, by the
+    /// derived `Bounded` impl, and two assignments differing only in it are
+    /// one document.
+    #[test]
+    fn a_repo_keeps_every_stewardship_it_had() {
+        let stewarded = |repo: &str, sequence: u32, assigned_on: &str| {
+            let mut stewardship = stewardship_sample();
+            stewardship.repo = OrgRepo(repo.into());
+            stewardship.sequence = sequence;
+            stewardship.assigned_on = Date(assigned_on.into());
+            pipeline_key(&PipelineDocument::Stewardship(stewardship)).expect("a sequenced stewardship keys")
+        };
+        let first = stewarded("GameCult/Epiphany", 1, "2026-09-15");
+        let second = stewarded("GameCult/Epiphany", 2, "2026-09-16");
+        assert_eq!(first, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n1"));
+        assert_eq!(second, format!("{INSTANCE}:stewardship:gamecult_-epiphany.n2"));
+        assert_ne!(first, second, "two assignments of one repo are two documents");
+        for (sequence, key) in [(1, &first), (2, &second)] {
+            let (root, local) = pipeline_id("read_back", key, PipelineKind::Stewardship).expect("reads back");
+            assert_eq!(root, INSTANCE, "{key}: the mind's root");
+            let last = format!("n{sequence}");
+            assert_eq!(local.rsplit('.').next(), Some(last.as_str()), "{key} ends in its sequence");
+            assert_eq!(local.split('.').count(), 2, "{key}: the escaped repo and the sequence, nothing else");
+        }
+
+        assert_eq!(
+            stewarded("GameCult/Epiphany", 1, "2026-09-16"),
+            first,
+            "assigned_on is a field, not a key part: one sequence is one key whatever the date"
+        );
+
+        let others = [
+            stewarded("GameCult/Epiphany_thing", 1, "2026-09-15"),
+            stewarded("GameCult/Huginn", 1, "2026-09-15"),
+        ];
+        let prefix = format!("{INSTANCE}:stewardship:gamecult_-epiphany.n");
+        let history = [first, second];
+        let selected = history
+            .iter()
+            .chain(others.iter())
+            .filter(|key| key.starts_with(&prefix))
+            .collect::<Vec<_>>();
+        assert_eq!(
+            selected,
+            history.iter().collect::<Vec<_>>(),
+            "the prefix selects the repo's assignments on this mind and nothing else"
+        );
+
+        assert_eq!(
+            stewarded("GameCult/Epiphany", 0, "2026-09-15"),
+            format!("{INSTANCE}:stewardship:gamecult_-epiphany.n0"),
+            "the leaf refuses no sequence value"
+        );
+    }
+
+    /// Cut 8: the leaf owns the serialisation of the shapes it owns, so a wire
+    /// carrying a document or a refusal reads back the same value rather than
+    /// a mirror definition kept in step by hand in the reader's repo. Both
+    /// encodings are pinned: JSON is what a schema describes, MessagePack is
+    /// what a CultCache payload is written in, and an adjacent tag has to
+    /// survive both. The tag is asserted against `name()` rather than against
+    /// a literal, because the point of the tag is that a reader dispatching on
+    /// a key's kind segment finds the same string here.
+    #[test]
+    fn every_document_and_refusal_serialises_and_reads_back() -> Result<()> {
+        for (document, _) in samples() {
+            let json = serde_json::to_value(&document)?;
+            assert_eq!(json["kind"].as_str(), Some(document.kind().name()), "{json} is tagged with its kind name");
+            assert_eq!(serde_json::from_value::<PipelineDocument>(json.clone())?, document, "{json} reads back");
+            let packed = rmp_serde::to_vec_named(&document)?;
+            assert_eq!(
+                rmp_serde::from_slice::<PipelineDocument>(&packed)?,
+                document,
+                "{:?} reads back through MessagePack",
+                document.kind()
+            );
+        }
+
+        // Every variant, and every one of them carrying its named parts: a
+        // refusal read off a wire names the field it refused, as a local one
+        // does.
+        let refusals = [
+            PipelineRefusal::FieldBound { field: "campaign.title".into(), limit: 200, actual: 201 },
+            PipelineRefusal::InvalidFormat { field: "campaign.slug".into(), value: "a b".into() },
+            PipelineRefusal::InvalidIdentity {
+                kind: PipelineKind::Campaign,
+                key: format!("{CAMPAIGN}:campaign:forged"),
+                expected: format!("{CAMPAIGN}:campaign:self"),
+            },
+            PipelineRefusal::DuplicateRepo { field: "campaign.repos".into(), repo: "gamecult/epiphany".into() },
+            PipelineRefusal::ForeignStore { r#type: <ForeignDocument as DatabaseEntry>::TYPE.into() },
+        ];
+        for refusal in &refusals {
+            let json = serde_json::to_value(refusal)?;
+            assert_eq!(&serde_json::from_value::<PipelineRefusal>(json.clone())?, refusal, "{json} reads back");
+            let packed = rmp_serde::to_vec_named(refusal)?;
+            assert_eq!(
+                &rmp_serde::from_slice::<PipelineRefusal>(&packed)?,
+                refusal,
+                "{refusal:?} reads back through MessagePack"
+            );
+        }
+
+        // The derived schemas list the same two sets. A `const` in the tag
+        // position is what a schema reader dispatches on, so it is read as the
+        // schema writes it and compared to `name()`, not to a literal list.
+        let tag = |variant: &serde_json::Value| {
+            variant["properties"]["kind"]["const"]
+                .as_str()
+                .unwrap_or_else(|| panic!("a document variant schema carries a kind const: {variant}"))
+                .to_owned()
+        };
+        let document_schema = serde_json::to_value(schemars::schema_for!(PipelineDocument))?;
+        let variants = document_schema["oneOf"].as_array().expect("the document schema is a oneOf");
+        assert_eq!(PipelineKind::ALL.len(), 13, "thirteen kinds");
+        assert_eq!(
+            variants.iter().map(tag).collect::<Vec<_>>(),
+            PipelineKind::ALL.iter().map(|kind| kind.name().to_owned()).collect::<Vec<_>>(),
+            "the document schema lists exactly the thirteen kinds, by name"
+        );
+
+        let refusal_schema = serde_json::to_value(schemars::schema_for!(PipelineRefusal))?;
+        let refusal_variants = refusal_schema["oneOf"].as_array().expect("the refusal schema is a oneOf");
+        let named = refusal_variants
+            .iter()
+            .map(|variant| {
+                let properties = variant["properties"].as_object().expect("a refusal variant is an object");
+                assert_eq!(properties.len(), 1, "{variant} is externally tagged");
+                properties.keys().next().expect("one key").to_owned()
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(named, vec!["FieldBound", "InvalidFormat", "InvalidIdentity", "DuplicateRepo", "ForeignStore"]);
+        assert_eq!(named.len(), refusals.len(), "every refusal variant is in the schema and in the round trip");
+        Ok(())
+    }
+
+    #[test]
+    fn pipeline_published_schemas_match_derivation() -> Result<()> {
+        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
+        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
+        // A directory this run alone writes, so everything in it is what this
+        // run derived. A previous run's leftovers -- a mutation run's
+        // especially, since those deliberately derive schemas no committed type
+        // produces -- are not this derivation, and copying one of those into
+        // `schemas/cultnet` publishes a schema no Rust type produces. A shared
+        // directory cleared first would have to defend that clear against a
+        // held handle; an unshared one has nothing to defend. The cost is that
+        // nothing ever removes one. The directory is only created when
+        // something is stale, so a passing run leaves none -- but a failing run
+        // leaves its copies behind for good, one directory per failing run
+        // where the shared design left one however often it failed. That is the
+        // trade: the copies are the evidence the failure message names, and
+        // they outlive the run that wrote them. Whoever reads the failure is
+        // the one who deletes them.
+        let derived_dir = std::env::temp_dir().join(format!(
+            "eureka-pipeline-schemas-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_nanos()
+        ));
+        let mut stale = Vec::new();
+        for kind in PipelineKind::ALL {
+            let file = format!("{}.schema.json", kind.type_id());
+            let mut schema = serde_json::to_value(kind.derived_schema())?;
+            schema["$id"] = format!("https://gamecult.dev/epiphany/cultnet/{file}").into();
+            let derived = format!("{}\n", serde_json::to_string_pretty(&schema)?);
+            if std::fs::read(published.join(&file)).ok().as_deref() != Some(derived.as_bytes()) {
+                std::fs::create_dir_all(&derived_dir)?;
+                std::fs::write(derived_dir.join(&file), &derived)?;
+                stale.push(derived_dir.join(&file));
+            }
+            let entry = serde_json::json!({
+                "schemaId": format!("https://gamecult.dev/epiphany/cultnet/{file}"),
+                "kind": "document_payload",
+                "wireContracts": ["cultnet.schema.v0"],
+                "schemaVersion": kind.type_id(),
+                "documentType": kind.type_id(),
+                "title": format!("Epiphany Pipeline {kind:?} v2"),
+                "path": file,
+            });
+            assert!(
+                index["schemas"].as_array().is_some_and(|schemas| schemas.contains(&entry)),
+                "index.json lacks {entry}"
+            );
+        }
+        assert!(stale.is_empty(), "published pipeline schemas differ from the Rust derivation; derived copies: {stale:?}");
+        Ok(())
+    }
+
+    /// A refusal read as text names its variant and its parts, so an operator
+    /// who sees only the message (a log line, an `anyhow` chain) can tell which
+    /// field was refused and why.
+    #[test]
+    fn a_refusal_read_as_text_names_its_variant_and_parts() {
+        let text = PipelineRefusal::FieldBound { field: "title".into(), limit: 200, actual: 201 }.to_string();
+        assert!(text.starts_with("pipeline refusal: "), "{text}");
+        for part in ["FieldBound", "title", "200", "201"] {
+            assert!(text.contains(part), "{part} is missing from {text}");
+        }
+    }
+
+    /// The catalogue is exactly the files beside it: every entry's `path` is a
+    /// schema file in the directory, and every schema file in the directory
+    /// has an entry, so a schema removed from the catalogue (or a file left
+    /// behind by a move) fails here instead of publishing a dangling or
+    /// unlisted contract. Schemas whose owner is another crate (`huginn.*`)
+    /// are published by that crate, not listed here.
+    #[test]
+    fn the_catalogue_lists_exactly_the_schema_files_it_publishes() -> Result<()> {
+        let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
+        let index: serde_json::Value = serde_json::from_slice(&std::fs::read(published.join("index.json"))?)?;
+        let listed = index["schemas"]
+            .as_array()
+            .expect("index.json carries a schemas array")
+            .iter()
+            .map(|entry| entry["path"].as_str().expect("every entry names its file").to_owned())
+            .collect::<std::collections::BTreeSet<_>>();
+        for path in &listed {
+            assert!(published.join(path).is_file(), "index.json lists {path}, which is not in the directory");
+        }
+        let mut files = std::collections::BTreeSet::new();
+        for entry in std::fs::read_dir(&published)? {
+            let name = entry?.file_name().to_string_lossy().into_owned();
+            if name.ends_with(".schema.json") && !name.starts_with("huginn.") {
+                files.insert(name);
+            }
+        }
+        assert_eq!(listed, files, "the catalogue and the schema files beside it disagree");
+        Ok(())
+    }
+
+    /// The epoch is the version every kind is published at: its version
+    /// segment is read from the constant, not restated, and every type id
+    /// carries the same one, so a bumped epoch fails here until the kinds
+    /// move with it. The live registrar registers the kinds and nothing else,
+    /// so the foreign stand-in is not among them.
+    #[test]
+    fn every_kind_is_at_the_epochs_version() -> Result<()> {
+        let (name, version) = PIPELINE_SCHEMA_EPOCH.rsplit_once('.').expect("the epoch carries a version");
+        assert_eq!(name, "epiphany.pipeline.epoch");
+        assert!(
+            version.len() > 1 && version.starts_with('v') && version[1..].bytes().all(|byte| byte.is_ascii_digit()),
+            "{version:?} is not a version segment"
+        );
+        for kind in PipelineKind::ALL {
+            let type_id = kind.type_id();
+            assert!(type_id.ends_with(&format!(".{version}")), "{type_id} is not at the epoch's version {version}");
+        }
+
+        let mut cache = CultCache::new();
+        register_pipeline_document_types(&mut cache)?;
+        let registered = cache.registered_entry_types();
+        assert_eq!(registered.len(), PipelineKind::ALL.len(), "the live registrar registers exactly the kinds: {registered:?}");
+        for kind in PipelineKind::ALL {
+            assert!(registered.iter().any(|name| name == kind.type_id()), "{kind:?} is registered");
+        }
+        Ok(())
+    }
+
+    /// The public door onto the reference grammar, for the read side that
+    /// holds a `kind` and an `id` and no way to reach `Bounded`. Every sample
+    /// document's own key is a reference of its own kind; a kind that is not
+    /// the id's, and a local no writer composes, are `InvalidFormat` at `ref.id`.
+    #[test]
+    fn a_ref_validates_as_an_id_of_the_kind_it_declares() -> Result<()> {
+        for (document, expected) in samples() {
+            let kind = document.kind();
+            let key = pipeline_key(&document)?;
+            assert_eq!(key, expected);
+            assert_eq!(
+                PipelineRef { kind, id: s(&key) }.validate_ref(),
+                Ok(()),
+                "{kind:?}'s own key is not a reference of its kind"
+            );
+        }
+
+        let refused = |reference: PipelineRef, why: &str| {
+            let read = reference.validate_ref();
+            assert!(
+                matches!(&read, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "ref.id"),
+                "{why}: {reference:?} was not refused, got {read:?}"
+            );
+        };
+
+        // The kind and the id's kind segment cannot disagree: the whole reason
+        // the door exists, since a reader that cannot ask would look this up
+        // and report the nothing it found.
+        refused(
+            PipelineRef { kind: PipelineKind::Campaign, id: id("question", "Q1") },
+            "a question id is not a campaign reference",
+        );
+        refused(
+            PipelineRef { kind: PipelineKind::Ruling, id: id("question", "Q1") },
+            "a question id is not a ruling reference",
+        );
+        // The local is `dotted_text` whole, so a trailing dot is refused by the
+        // reader and not only by the writer that never composes one.
+        refused(
+            PipelineRef { kind: PipelineKind::Question, id: s(&format!("{CAMPAIGN}:question:Q1.")) },
+            "a trailing dot is no local",
+        );
+
+        // The boundary, pinned rather than assumed: a resolution id missing the
+        // per-subject sequence its writer always composes is still a
+        // well-formed id of its kind here. The leaf's grammar is kind-deep, and
+        // the local's per-kind shape belongs to admission; refusing this would
+        // be a new rule in `pipeline_id`, not a door onto the one that exists.
+        assert_eq!(
+            PipelineRef { kind: PipelineKind::Resolution, id: s(&format!("{CAMPAIGN}:resolution:question.Q1")) }
+                .validate_ref(),
+            Ok(()),
+            "the leaf reads a resolution id kind-deep"
+        );
+        Ok(())
+    }
+
+    /// The public door onto the slug grammar, for a caller outside this crate
+    /// holding a bare declared name (Huginn's `require_instance` and
+    /// `Mind::open`, before either reaches admission or the filesystem). It
+    /// applies exactly `dotted_text`: one valid dotted name, and refusals for
+    /// fullwidth characters, `..`, both path separators, the empty string,
+    /// and an empty label.
+    #[test]
+    fn slug_validate_applies_the_dotted_grammar() {
+        assert_eq!(slug("huginn-yggdrasil").validate_slug(), Ok(()));
+        assert_eq!(slug("outer.inner").validate_slug(), Ok(()));
+
+        let refused = |value: &str, why: &str| {
+            let result = slug(value).validate_slug();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "slug"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+
+        refused("\u{FF41}\u{FF41}", "fullwidth characters are not ascii alphanumeric");
+        refused("..", "a bare .. is an empty label either side of the dot");
+        refused("../escaped", "a forward-slash path separator is not a label byte");
+        refused("..\\escaped", "a backslash path separator is not a label byte");
+        refused("outer\\inner", "a lone backslash inside one label is not a label byte, with no empty label to hide behind");
+        refused("", "the empty string has no label");
+        refused("outer..inner", "an empty label between two dots is refused");
+        refused(".", "a single dot is one empty label");
+
+        // S5: the 64-byte whole-name bound, pinned with a two-label name
+        // whose parts sit far under 64 bytes each (31 and 32, then 32 and
+        // 32), so only `dotted_text`'s own `value.len() > 64` check -- not
+        // `label_text`'s per-part one -- can be the check that refuses 65.
+        let filler = |n: usize| "a".repeat(n);
+        let at_64 = format!("{}.{}", filler(31), filler(32));
+        let at_65 = format!("{}.{}", filler(32), filler(32));
+        assert_eq!(at_64.len(), 64, "a 64-byte whole name, two labels well under 64 each");
+        assert_eq!(at_65.len(), 65, "one byte past the whole-name bound, same two-label shape");
+        assert_eq!(slug(&at_64).validate_slug(), Ok(()));
+        refused(&at_65, "65 bytes overall is refused, even though neither label alone reaches 64");
+
+        // S5: the 64-byte per-label bound, pinned directly against `Label`
+        // (the type `label_text` guards on its own, with no separate
+        // whole-name wrapper), and with a lone label carrying no dot, so only
+        // `label_text`'s own length check can be the one refusing 65.
+        let label_at_64 = Label::from(filler(64).as_str());
+        let label_at_65 = Label::from(filler(65).as_str());
+        assert_eq!(label_at_64.validate("label"), Ok(()));
+        assert!(
+            matches!(
+                label_at_65.validate("label"),
+                Err(PipelineRefusal::InvalidFormat { ref field, .. }) if field == "label"
+            ),
+            "a 65-byte label was not refused, got {:?}",
+            label_at_65.validate("label")
+        );
+
+        // S5: NUL is refused as a label byte, not merely as one more
+        // non-alphanumeric character that happens to be caught by coincidence.
+        refused("a\u{0}b", "NUL is not a label byte");
+    }
+
+    /// The two doors added beside `Slug::validate_slug` (RS-L), on its
+    /// pattern: each delegates to the grammar its own document field already
+    /// carries, so a declared name checked through the door and a field of
+    /// the same type refuse the same inputs. `OrgRepo` is the `repo` alias's
+    /// domain and `Label` is the `cut` alias's (RS-3's vocabulary table).
+    #[test]
+    fn the_org_repo_and_label_doors_are_the_grammar() {
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").validate_org_repo(), Ok(()));
+        assert_eq!(OrgRepo::from("a/b").validate_org_repo(), Ok(()));
+        assert_eq!(OrgRepo::from("a-b/c.d_e").validate_org_repo(), Ok(()));
+        // Consecutive hyphens stay allowed on both sides; only a leading or
+        // trailing owner hyphen is refused.
+        assert_eq!(OrgRepo::from("a--b/c--d").validate_org_repo(), Ok(()));
+        // S4: a 39-byte owner is accepted, a 100-byte repo is accepted.
+        let owner_at_39 = format!("{}/b", "a".repeat(39));
+        assert_eq!(OrgRepo::from(owner_at_39.as_str()).validate_org_repo(), Ok(()));
+        let repo_at_100 = format!("a/{}", "a".repeat(100));
+        assert_eq!(OrgRepo::from(repo_at_100.as_str()).validate_org_repo(), Ok(()));
+        let repo_refused = |value: &str, why: &str| {
+            let result = OrgRepo::from(value).validate_org_repo();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "org_repo"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+        repo_refused("GameCult", "no slash at all");
+        repo_refused("/Repo", "an empty org before the slash");
+        repo_refused("GameCult/", "an empty repo after the slash");
+        repo_refused("a/b/c", "a second slash makes the repo half ambiguous");
+        repo_refused("../..", "an owner of dots is not GitHub's grammar");
+        repo_refused("a/..", "a repo of .. is refused outright");
+        repo_refused("a/.", "a repo of . is refused outright");
+        repo_refused("-a/b", "a leading hyphen is not a valid owner");
+        repo_refused("a-/b", "a trailing hyphen is not a valid owner");
+        repo_refused("a b/c", "a space is not an owner byte");
+        repo_refused("a/b c", "a space is not a repo byte");
+        repo_refused("\u{e9}/\u{fc}", "non-ascii bytes are refused on either side");
+        repo_refused("\0/\0", "NUL is refused on either side");
+        repo_refused("a\n/b", "a newline is not an owner byte");
+        let owner_at_40 = format!("{}/b", "a".repeat(40));
+        repo_refused(&owner_at_40, "40 bytes is past the 39-byte owner bound");
+        let repo_at_101 = format!("a/{}", "a".repeat(101));
+        repo_refused(&repo_at_101, "101 bytes is past the 100-byte repo bound");
+        repo_refused("a//b", "an empty middle segment is still a second slash");
+        repo_refused("/b", "an empty owner is refused");
+        repo_refused("a/", "an empty repo is refused");
+        repo_refused("a.b/c", "a dot is not an owner byte");
+        repo_refused("a_b/c", "an underscore is not an owner byte");
+        // F7 fix batch: a repo name ending in `.git` is refused.
+        repo_refused("a/b.git", "a repo ending in .git is refused");
+        repo_refused("a/.git", "a repo of exactly .git is still a .git suffix");
+        // S-2: the `.git` refusal is ASCII-case-insensitive, so a case variant
+        // cannot dodge it and reach an `identity()` the validator refuses.
+        repo_refused("a/b.GIT", "a repo ending in .GIT is refused like .git");
+        repo_refused("a/.GIT", "a repo of exactly .GIT is still a .git suffix");
+        repo_refused("A/B.GIT", "a mixed-case owner and a .GIT repo both refuse");
+        repo_refused("a/b.GiT", "a mixed-case .git suffix is refused");
+
+        // identity(): the one canonical key, ASCII-lowercased. Every
+        // comparison, hash, ordering and key derivation goes through it.
+        assert_eq!(
+            OrgRepo::from("GameCult/Epiphany").identity(),
+            OrgRepo::from("gamecult/epiphany").identity()
+        );
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").identity(), "gamecult/epiphany");
+
+        // S-1: it is structural, not advisory. `==` on `OrgRepo` compares
+        // identity, not the raw string, so the two spellings are one
+        // repository wherever `OrgRepo` is compared, hashed or ordered.
+        assert_eq!(OrgRepo::from("GameCult/Epiphany"), OrgRepo::from("gamecult/epiphany"));
+        assert_eq!(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany")), std::cmp::Ordering::Equal);
+        assert_eq!(
+            OrgRepo::from("GameCult/Epiphany").partial_cmp(&OrgRepo::from("gamecult/epiphany")),
+            Some(OrgRepo::from("GameCult/Epiphany").cmp(&OrgRepo::from("gamecult/epiphany"))),
+            "partial_cmp must agree with cmp for an equal pair"
+        );
+
+        // RS-L closing fix 1: every assertion above compares values that
+        // should be equal, so `eq -> true`, `hash -> ()` and `cmp -> Equal`
+        // all survive as mutants. Pin the unequal direction as well: two
+        // different repos must be unequal, hash differently (with
+        // overwhelming probability, not by construction, so this is belt and
+        // suspenders on top of the `!=` and `cmp` checks), and not compare
+        // `Equal`, and `partial_cmp` must agree with `cmp` for an unequal
+        // pair too, per std's own contract that `partial_cmp(a, b) ==
+        // Some(cmp(a, b))`.
+        let a = OrgRepo::from("GameCult/Epiphany");
+        let b = OrgRepo::from("GameCult/Aetheria");
+        assert_ne!(a, b, "two different repos must not compare equal");
+        assert_ne!(
+            a.cmp(&b),
+            std::cmp::Ordering::Equal,
+            "two different repos must not order as Equal"
+        );
+        assert_eq!(
+            a.partial_cmp(&b),
+            Some(a.cmp(&b)),
+            "partial_cmp must agree with cmp for an unequal pair"
+        );
+        let hash_of = |repo: &OrgRepo| {
+            use std::hash::{Hash, Hasher};
+            let mut hasher = std::collections::hash_map::DefaultHasher::new();
+            repo.hash(&mut hasher);
+            hasher.finish()
+        };
+        assert_ne!(
+            hash_of(&a),
+            hash_of(&b),
+            "two different repos must hash differently"
+        );
+
+        let mut hash_map = std::collections::HashMap::new();
+        hash_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
+        hash_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
+        assert_eq!(hash_map.len(), 1, "a HashMap keyed by both spellings holds one entry");
+        assert_eq!(hash_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
+
+        let mut btree_map = std::collections::BTreeMap::new();
+        btree_map.insert(OrgRepo::from("GameCult/Epiphany"), 1);
+        btree_map.insert(OrgRepo::from("gamecult/epiphany"), 2);
+        assert_eq!(btree_map.len(), 1, "a BTreeMap keyed by both spellings holds one entry");
+        assert_eq!(btree_map.get(&OrgRepo::from("GAMECULT/EPIPHANY")), Some(&2));
+
+        // `identity()` is always itself a valid `OrgRepo`: lowercasing never
+        // turns a valid repository into one the grammar refuses, and never
+        // turns a refused one into one it accepts.
+        for value in ["GameCult/Epiphany", "A/B", "a-B/c.D_e", "GameCult/Epiphany.GIT"] {
+            let repo = OrgRepo::from(value);
+            assert_eq!(
+                repo.validate_org_repo().is_ok(),
+                OrgRepo::from(repo.identity().as_str()).validate_org_repo().is_ok(),
+                "identity() of {value:?} disagreed with the value's own validity"
+            );
+        }
+
+        assert_eq!(Label::from("cut-10").validate_label(), Ok(()));
+        let label_refused = |value: &str, why: &str| {
+            let result = Label::from(value).validate_label();
+            assert!(
+                matches!(&result, Err(PipelineRefusal::InvalidFormat { field, .. }) if field == "label"),
+                "{why}: {value:?} was not refused, got {result:?}"
+            );
+        };
+        label_refused("", "the empty string has no label");
+        label_refused("a.b", "a dot is not a label byte");
+        label_refused(&"a".repeat(65), "65 bytes is past the 64-byte label bound");
+        label_refused("\u{e9}", "a non-ascii byte is not a label byte");
+    }
+
+    /// Q-RS1, ruled B: `question` and `ruling` gain a required `title`, the
+    /// new `Title` type shared with the two titles that move off `Short`
+    /// (campaign, cut spec). Each kind round-trips through `prepare`/`decode`
+    /// with its title intact, an empty title is refused for both, and the
+    /// bound is pinned at its edge: 200 bytes accepted, 201 refused (L3 dies
+    /// on the removal of the non-empty check, not on the length bound, since
+    /// `Title`'s length bound is shared with every other `bounded_text!`
+    /// member and already covered by `bounds_refuse_in_utf8_bytes`).
+    #[test]
+    fn question_and_ruling_carry_a_title() -> Result<()> {
+        let cache = schema_cache()?;
+
+        let mut question = question_sample();
+        question.title = t("Who owns the state?");
+        let envelope = PipelineDocument::Question(question.clone()).prepare(&cache)?;
+        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Question(question.clone()));
+
+        let mut ruling = ruling_sample();
+        ruling.title = t("An instance owns its mind");
+        let envelope = PipelineDocument::Ruling(ruling.clone()).prepare(&cache)?;
+        assert_eq!(PipelineDocument::decode(&envelope)?, PipelineDocument::Ruling(ruling.clone()));
+
+        question.title = Title(String::new());
+        assert_eq!(
+            PipelineDocument::Question(question.clone()).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: String::new() })
+        );
+        ruling.title = Title(String::new());
+        assert_eq!(
+            PipelineDocument::Ruling(ruling.clone()).validate(),
+            Err(PipelineRefusal::InvalidFormat { field: "ruling.title".into(), value: String::new() })
+        );
+
+        // F2 second fix batch: a title holds at least one
+        // `char::is_alphanumeric()` character, no `char::is_control()`
+        // character, and no bidi control character. No zero-width denylist:
+        // a zero-width joiner/non-joiner inside real text is allowed, and a
+        // string of nothing but invisible characters is refused because it
+        // has no alphanumeric character, not because those characters are
+        // individually denylisted.
+        let refused = |value: &str| {
+            let mut refused_question = question.clone();
+            refused_question.title = Title(value.into());
+            assert_eq!(
+                PipelineDocument::Question(refused_question).validate(),
+                Err(PipelineRefusal::InvalidFormat { field: "question.title".into(), value: value.into() }),
+                "{value:?} should be refused"
+            );
+        };
+        refused(" ");
+        refused("\u{7f}");
+        refused("a\u{7f}");
+        refused("\u{0}");
+        refused("\u{9f}");
+        refused("\u{2028}");
+        refused("\u{202e}"); // RLO alone
+        refused("\u{202e}text"); // RLO plus text
+        refused("\u{200e}"); // LRM alone
+        refused("\u{0301}"); // a lone combining mark
+        refused("\u{fe0f}"); // a variation selector alone
+        refused("\u{a0}"); // NBSP alone
+        refused("\u{1f680}"); // emoji only
+
+        // S-3: every one of the twelve bidi control code points is pinned
+        // with an embedded fixture (real alphanumeric text on both sides), so
+        // the alphanumeric rule cannot mask a hole in the bidi match arm the
+        // way a lone-character fixture would.
+        refused("a\u{061C}b"); // ALM
+        refused("a\u{200E}b"); // LRM
+        refused("a\u{200F}b"); // RLM
+        refused("a\u{202A}b"); // LRE
+        refused("a\u{202B}b"); // RLE
+        refused("a\u{202C}b"); // PDF
+        refused("a\u{202D}b"); // LRO
+        refused("a\u{202E}b"); // RLO
+        refused("a\u{2066}b"); // LRI
+        refused("a\u{2067}b"); // RLI
+        refused("a\u{2068}b"); // FSI
+        refused("a\u{2069}b"); // PDI
+
+        // S-4: U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR are
+        // refused inside otherwise-alphanumeric text, not only alone, since
+        // `char::is_control()` does not reach `Zl`/`Zp`.
+        refused("a\u{2028}b");
+        refused("a\u{2029}b");
+
+        let accepted = |value: &str| {
+            let mut accepted_question = question.clone();
+            accepted_question.title = Title(value.into());
+            assert_eq!(
+                PipelineDocument::Question(accepted_question).validate(),
+                Ok(()),
+                "{value:?} should validate"
+            );
+        };
+        accepted("a");
+        accepted("\u{e9}");
+        accepted("\u{200c}\u{647}\u{6cc}"); // Persian text containing ZWNJ
+        accepted("a\u{200d}b");
+        accepted("a \u{1f680}");
+        accepted(" a ");
+        // Discrepancy from the fix spec: HANGUL FILLER (U+3164) is Unicode
+        // General_Category Lo, so `char::is_alphanumeric()` is true for it in
+        // this toolchain; it is not a denylist candidate, since the fix
+        // batch deletes the hand-written exclusion list on purpose. A title
+        // of U+3164 alone is therefore accepted, not refused.
+        accepted("\u{3164}");
+
+        question.title = Title("a".repeat(200));
+        assert_eq!(PipelineDocument::Question(question.clone()).validate(), Ok(()));
+        question.title = Title("a".repeat(201));
+        assert_eq!(
+            PipelineDocument::Question(question).validate(),
+            Err(PipelineRefusal::FieldBound { field: "question.title".into(), limit: 200, actual: 201 })
+        );
+        Ok(())
+    }
+}

From 09e1b9792b348eb1e41c6252fe3ef54aed3f0da6 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 15:15:10 +0200
Subject: [PATCH 09/11] Relicense the workspace AGPL-3.0-only, own the CultLib
 rev once, index every schema

Add the AGPL-3.0 text as LICENSE and set the workspace license to
AGPL-3.0-only (rulings license-split, leaf-relicensed-agpl); the leaf's
provenance (Epiphany ef956865, PolyForm Noncommercial, relicensed by its sole
copyright holder 2026-10-09) is recorded in its Cargo.toml and README.

One [workspace.dependencies] entry per CultLib crate now owns the revision;
the crates inherit it. index.json lists Huginn's two wire schemas too, and the
catalogue test drops its huginn. prefix exclusion: every schema file is listed.
README and AGENTS stop naming Epiphany notes as the owner of the cut.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 AGENTS.md                         |  11 +-
 Cargo.toml                        |   8 +-
 LICENSE                           | 661 ++++++++++++++++++++++++++++++
 README.md                         |   9 +-
 crates/eureka-pipeline/Cargo.toml |  10 +-
 crates/eureka-pipeline/README.md  |   7 +
 crates/eureka-pipeline/src/lib.rs |   6 +-
 crates/eureka-state/Cargo.toml    |   2 +-
 crates/huginn-daemon/Cargo.toml   |   2 +-
 crates/huginn-mind/Cargo.toml     |  12 +-
 schemas/cultnet/README.md         |   5 +-
 schemas/cultnet/index.json        |  20 +
 12 files changed, 727 insertions(+), 26 deletions(-)
 create mode 100644 LICENSE

diff --git a/AGENTS.md b/AGENTS.md
index e217d3f..3182f10 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -18,9 +18,8 @@ Studio's job, not Huginn's.
   keys and the schemas published under `schemas/cultnet`. `huginn-mind` is
   live: it persists, admits and reads back an instance's mind, queries and
   derived status included, over `cultcache-rs` and `eureka-pipeline`.
-  `huginn-daemon` serves one mind over CultNet RUDP through `cultnet-rs` at
-  the same rev, and reaches the leaf and the store type through `huginn-mind`
-  so one crate pins each revision. `eureka-state` is the client core: one call
+  `huginn-daemon` serves one mind over CultNet RUDP through `cultnet-rs`, and reaches the leaf and the store type through `huginn-mind`
+  so the workspace's one CultLib revision (root `[workspace.dependencies]`) decides both. `eureka-state` is the client core: one call
   to a daemon over CultNet, holding no state.
 - Owned: an instance's memory documents, their admission and the read side
   that derives their status, in `huginn-mind`,
@@ -28,7 +27,8 @@ Studio's job, not Huginn's.
   and their CultNet surface in `huginn-daemon`, which owns the socket, the
   sessions and the process, and no rule; the operation envelope is
   `huginn-mind`'s. The two wire
-  schemas are published from `schemas/cultnet/`. There is no index yet.
+  schemas are published from `schemas/cultnet/` and listed, with the
+  pipeline schemas, in its `index.json`.
 - To depend on: Qdrant, directly, once retrieval exists. Unreachable Qdrant is
   to be a loud refusal, never a fallback store. No crate connects to it yet.
 - Forbidden: a second writer of mind state; mind state in version control;
@@ -38,7 +38,8 @@ Studio's job, not Huginn's.
 
 - Prefer CultLib's typed Rust APIs over ad hoc decoding. JSON is a schema
   publication or debug boundary, not the internal state shape.
-- The Eureka cut map in `Epiphany/notes/eureka-pipeline-state-cut.md` owns
+- The campaign's cut specs in the mind (`eureka-body`, read through
+  `eureka-state`) and `docs/eureka-body-map.md` own
   what each crate does next. Read the cut before the crate.
 - Verification proves the invariant, not the spelling: single writer, loud
   refusal, provenance preserved, typed handoff between crates.
diff --git a/Cargo.toml b/Cargo.toml
index 1f717e1..d1001dd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,5 +9,11 @@ resolver = "3"
 
 [workspace.package]
 edition = "2024"
-license = "MIT"
+license = "AGPL-3.0-only"
 publish = false
+
+# The one CultLib revision the workspace speaks. Every crate inherits these
+# entries; a bump is a change to this table and nowhere else.
+[workspace.dependencies]
+cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultcache-rs" }
+cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultnet-rs" }
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..be3f7b2
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/README.md b/README.md
index 9110adc..41a6815 100644
--- a/README.md
+++ b/README.md
@@ -69,12 +69,11 @@ method plus `whoami`, whose payload is the mind's own types as named
 MessagePack. A refusal is an answer with a `rejected` status, never a
 transport error; an envelope that does not decode is answered with a typed
 failure and reaches no mind. The two schemas it publishes live in
-`schemas/cultnet/` and are pinned to their derivation by a test. There is no
-index yet.
+`schemas/cultnet/`, listed in its `index.json`, and are pinned to their
+derivation by a test.
 
-`eureka-state` has no MCP surface yet; the campaign's cut map in
-`Epiphany/notes/eureka-pipeline-state-cut.md` owns what each crate must do
-next.
+The campaign's cut specs in the mind (`eureka-body`) and
+`docs/eureka-body-map.md` own what each crate does next.
 
 ```powershell
 cargo check --workspace
diff --git a/crates/eureka-pipeline/Cargo.toml b/crates/eureka-pipeline/Cargo.toml
index 1b077a7..73d983c 100644
--- a/crates/eureka-pipeline/Cargo.toml
+++ b/crates/eureka-pipeline/Cargo.toml
@@ -1,10 +1,16 @@
 [package]
 name = "eureka-pipeline"
 version = "0.1.0"
-edition = "2024"
+edition.workspace = true
+license.workspace = true
 publish = false
 autobins = false
 
+# Provenance: this crate was copied once from GameCult/Epiphany at ef956865,
+# where it was licensed PolyForm Noncommercial. Its sole copyright holder
+# relicensed it AGPL-3.0-only on 2026-10-09, as the rest of the workspace is
+# (ruling eureka-body:ruling:leaf-relicensed-agpl).
+
 [lib]
 name = "eureka_pipeline"
 path = "src/lib.rs"
@@ -17,7 +23,7 @@ path = "src/lib.rs"
 [dependencies]
 anyhow = "1"
 chrono = "0.4.44"
-cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultcache-rs" }
+cultcache-rs.workspace = true
 rmp-serde = "1"
 schemars = "1"
 serde = { version = "1", features = ["derive"] }
diff --git a/crates/eureka-pipeline/README.md b/crates/eureka-pipeline/README.md
index 87a945c..d6097b8 100644
--- a/crates/eureka-pipeline/README.md
+++ b/crates/eureka-pipeline/README.md
@@ -3,6 +3,13 @@
 The pipeline leaf: typed documents, bounds, keys and the cultcache wrappers
 that define the mind's wire. Library only.
 
+## Provenance and license
+
+Copied once from GameCult/Epiphany at `ef956865`, where it was licensed
+PolyForm Noncommercial. Its sole copyright holder relicensed it AGPL-3.0-only
+on 2026-10-09; the root `LICENSE` is the AGPL-3.0 text and covers this crate
+like the rest of the workspace.
+
 ## Wire parity checks
 
 Committed (runs in `cargo test -p eureka-pipeline`): `encoded_envelopes_match_the_committed_golden`
diff --git a/crates/eureka-pipeline/src/lib.rs b/crates/eureka-pipeline/src/lib.rs
index 3b1eed2..056c9ae 100644
--- a/crates/eureka-pipeline/src/lib.rs
+++ b/crates/eureka-pipeline/src/lib.rs
@@ -2910,8 +2910,8 @@ mod tests {
     /// schema file in the directory, and every schema file in the directory
     /// has an entry, so a schema removed from the catalogue (or a file left
     /// behind by a move) fails here instead of publishing a dangling or
-    /// unlisted contract. Schemas whose owner is another crate (`huginn.*`)
-    /// are published by that crate, not listed here.
+    /// unlisted contract. The one rule: every `*.schema.json` in the directory,
+    /// Huginn's own wire schemas included, is listed.
     #[test]
     fn the_catalogue_lists_exactly_the_schema_files_it_publishes() -> Result<()> {
         let published = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../schemas/cultnet");
@@ -2928,7 +2928,7 @@ mod tests {
         let mut files = std::collections::BTreeSet::new();
         for entry in std::fs::read_dir(&published)? {
             let name = entry?.file_name().to_string_lossy().into_owned();
-            if name.ends_with(".schema.json") && !name.starts_with("huginn.") {
+            if name.ends_with(".schema.json") {
                 files.insert(name);
             }
         }
diff --git a/crates/eureka-state/Cargo.toml b/crates/eureka-state/Cargo.toml
index 9a0d37a..71ddd71 100644
--- a/crates/eureka-state/Cargo.toml
+++ b/crates/eureka-state/Cargo.toml
@@ -15,7 +15,7 @@ publish.workspace = true
 # consumer: four tools over stdio, one per wire operation, holding no state.
 [dependencies]
 anyhow = "1"
-cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultnet-rs" }
+cultnet-rs.workspace = true
 huginn-mind = { path = "../huginn-mind" }
 rmcp = { version = "2.2.0", default-features = false, features = ["server", "macros", "transport-io"] }
 rmp-serde = "1"
diff --git a/crates/huginn-daemon/Cargo.toml b/crates/huginn-daemon/Cargo.toml
index b2cb3fd..4d94238 100644
--- a/crates/huginn-daemon/Cargo.toml
+++ b/crates/huginn-daemon/Cargo.toml
@@ -21,7 +21,7 @@ path = "src/main.rs"
 anyhow = "1"
 base64 = "0.22"
 chrono = "0.4.44"
-cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultnet-rs" }
+cultnet-rs.workspace = true
 huginn-mind = { path = "../huginn-mind" }
 rmp-serde = "1"
 serde = { version = "1", features = ["derive"] }
diff --git a/crates/huginn-mind/Cargo.toml b/crates/huginn-mind/Cargo.toml
index 999a7b2..104665f 100644
--- a/crates/huginn-mind/Cargo.toml
+++ b/crates/huginn-mind/Cargo.toml
@@ -7,19 +7,19 @@ publish.workspace = true
 
 # The organ's rule engine: storage, identity and admission of one instance's
 # mind. Document shape, bounds, formats and keys come from this workspace's
-# `eureka-pipeline` (crates/eureka-pipeline, copied once from Epiphany ef956865);
-# the store comes from CultLib's Rust CultCache at the rev `eureka-pipeline`
-# also uses, so the leaf's wrappers and this crate's cache are one `cultcache-rs`. The
+# `eureka-pipeline` (crates/eureka-pipeline);
+# the store comes from CultLib's Rust CultCache at the workspace's one CultLib
+# revision, so the leaf's wrappers and this crate's cache are one `cultcache-rs`. The
 # read side selects through CultNet's typed selection (`cultnet-rs`, the same
-# rev the daemon pins): the selection's vocabulary and evaluator are the
+# revision): the selection's vocabulary and evaluator are the
 # substrate's, this crate supplies the rows. No socket, no index: those are the
 # daemon's (Cut 10, Cut 11).
 [dependencies]
 anyhow = "1"
 base64 = "0.22"
 chrono = "0.4.44"
-cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultcache-rs" }
-cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "8fc74c709444b884a2bd339e0c306bf9484d99d2", package = "cultnet-rs" }
+cultcache-rs.workspace = true
+cultnet-rs.workspace = true
 eureka-pipeline = { path = "../eureka-pipeline" }
 rmp-serde = "1"
 schemars = "1"
diff --git a/schemas/cultnet/README.md b/schemas/cultnet/README.md
index 3a83839..8f7f76d 100644
--- a/schemas/cultnet/README.md
+++ b/schemas/cultnet/README.md
@@ -12,8 +12,9 @@ compares file to derivation byte for byte.
 
 ## The pipeline catalogue
 
-`index.json` is the publication manifest for the thirteen
-`epiphany.pipeline.*.v2` schemas and `gamecult.persona_state.v0`. The pipeline
+`index.json` is the publication manifest for every schema here: the thirteen
+`epiphany.pipeline.*.v2` schemas, `gamecult.persona_state.v0` and the two
+`huginn.mind_*` wire schemas. The pipeline
 schemas are derived from the value types in `crates/eureka-pipeline` and checked
 byte for byte by its `pipeline_published_schemas_match_derivation` test. Each
 document payload is `[value]`, a one-element MessagePack array whose element is
diff --git a/schemas/cultnet/index.json b/schemas/cultnet/index.json
index 6c2b992..0d421f6 100644
--- a/schemas/cultnet/index.json
+++ b/schemas/cultnet/index.json
@@ -154,6 +154,26 @@
       "documentType": "epiphany.pipeline.hand_off.v2",
       "title": "Epiphany Pipeline HandOff v2",
       "path": "epiphany.pipeline.hand_off.v2.schema.json"
+    },
+    {
+      "schemaId": "huginn.mind_request.v1",
+      "kind": "wire_message",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "huginn.mind_request.v1",
+      "title": "Huginn mind request",
+      "path": "huginn.mind_request.v1.schema.json"
+    },
+    {
+      "schemaId": "huginn.mind_response.v1",
+      "kind": "wire_message",
+      "wireContracts": [
+        "cultnet.schema.v0"
+      ],
+      "schemaVersion": "huginn.mind_response.v1",
+      "title": "Huginn mind response",
+      "path": "huginn.mind_response.v1.schema.json"
     }
   ]
 }

From 4d3db4142347a2dcf9f7b5847fee29896f4029f6 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 15:28:14 +0200
Subject: [PATCH 10/11] LICENSE: byte-identical official AGPL-3.0 text; golden
 header states exact provenance

LICENSE is the gnu.org agpl-3.0.txt verbatim (LF). The golden header now
names 44be4cd as the dump commit, the four kinds (cut_spec, cut_report,
finding, follow_up) whose source-path string was renamed relative to
Epiphany ef956865, and that 87b6455 differs only in test code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/eureka-pipeline/golden/envelopes.txt | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/crates/eureka-pipeline/golden/envelopes.txt b/crates/eureka-pipeline/golden/envelopes.txt
index f8c1ebe..5b63c7f 100644
--- a/crates/eureka-pipeline/golden/envelopes.txt
+++ b/crates/eureka-pipeline/golden/envelopes.txt
@@ -1,11 +1,14 @@
 # Golden encoded envelopes of the pipeline leaf. One line per document:
 #   label key type-id schema-name payload-hex   (payload is the cultcache MessagePack payload)
-# Provenance: derived once by `golden_dump` from this crate at huginn 87b6455
-# (the leaf copied from Epiphany ef956865, renamed). Soul proved that tree's
-# encoding byte-identical to the live mind store and to Epiphany ef956865
-# (eureka-body:verdict:cut-leaf-into-huginn.s1). Never regenerate to make a
-# failing test pass: a diff here is a wire change and needs its own ruling.
-sample.campaign eureka-state:campaign:self epiphany.pipeline.campaign.v2 EpiphanyPipelineCampaignDocument 9185a4736c7567ac657572656b612d7374617465a57469746c65b5457572656b6120706970656c696e65207374617465a57265706f7391b147616d6543756c742f4570697068616e79ae776f726b696e675f6272616e6368bb636f6465782f657572656b612d706970656c696e652d7374617465aa7461726765745f646f6384a470617468d9256e6f7465732f657572656b612d706970656c696e652d73746174652d7461726765742e6d64aa73746172745f6c696e6501a8656e645f6c696e6509a6636f6d6d6974a83566393832323864
+# Provenance: the payload lines were dumped once by `golden_dump` from this
+# crate at huginn 44be4cd. 87b6455 differs from 44be4cd only in test code
+# (cfg(test) items; no encoding path). They match the encoder of Epiphany
+# ef956865 byte for byte after one substitution: the sample source-path string
+# was renamed in four kinds (cut_spec, cut_report, finding, follow_up), where it
+# sits in a CodeLocation path. Soul proved the encoding byte-identical to the
+# live mind store (eureka-body:verdict:cut-leaf-into-huginn.s1) and to
+# Epiphany ef956865 modulo that rename (verdict ...s2). Never regenerate to make
+# a failing test pass: a diff here is a wire change and needs its own ruling.
 sample.target eureka-state:target:r2 epiphany.pipeline.target.v2 EpiphanyPipelineTargetDocument 9186a863616d706169676eac657572656b612d7374617465a87265766973696f6e02aa696e76617269616e74739182a56c6162656cab6d696e642d61646d697473a973746174656d656e74b64f6e6c792061646d697373696f6e207772697465732eac6e6f745f696e5f73636f706591ac4576652062726f7773696e67b963616e6f6e6963616c5f696d706c656d656e746174696f6e7391a743756c744c6962a3646f6384a470617468d9256e6f7465732f657572656b612d706970656c696e652d73746174652d7461726765742e6d64aa73746172745f6c696e6501a8656e645f6c696e6509a6636f6d6d6974a83566393832323864
 sample.question eureka-state:question:Q1 epiphany.pipeline.question.v2 EpiphanyPipelineQuestionDocument 9189a863616d706169676eac657572656b612d7374617465a56c6162656ca25131a57469746c65b357686f206f776e73207468652073746174653fa87175657374696f6eb357686f206f776e73207468652073746174653fa76f7074696f6e739282a56c6162656ca141a474657874ab616e20696e7374616e636582a56c6162656ca142a474657874a661207265706fab7265636f6d6d656e646564a141a7646570656e647391a6437574203361a97261697365645f696e82a46b696e64a743757453706563a26964bf657572656b612d73746174653a6375745f737065633a6375742d33612e7231a861736b65645f6f6eaa323032362d30392d3135
 sample.ruling eureka-state:ruling:R8 epiphany.pipeline.ruling.v2 EpiphanyPipelineRulingDocument 918aa863616d706169676eac657572656b612d7374617465a56c6162656ca25238a57469746c65b9416e20696e7374616e6365206f776e7320697473206d696e64a7616e7377657273b8657572656b612d73746174653a7175657374696f6e3a5131a663686f696365a141a672756c696e67ba416e20696e7374616e6365206f776e7320697473206d696e642eae6f70657261746f725f71756f7465bd616c6c207265636f6d6d656e646174696f6e732c20676f206168656164a872756c65645f6f6eaa323032362d30392d3135aa707265636564656e74739185a47265706fb147616d6543756c742f4165746865726961a6636f6d6d6974d92861616161616161616161616161616161616161616161616161616161616161616161616161616161a46b696e64a652756c696e67a26964b363756c7463616368653a72756c696e673a5231ae7061796c6f61645f736861323536d94062626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262a9617574686f72697479a84f70657261746f72

From e516c58b171e545c812a65e34b6427bc07c1c140 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 9 Oct 2026 15:28:28 +0200
Subject: [PATCH 11/11] Golden: restore the sample.campaign payload line
 dropped by the header edit

Payload lines are now byte-identical to 09e1b97; only header comments differ.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/eureka-pipeline/golden/envelopes.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crates/eureka-pipeline/golden/envelopes.txt b/crates/eureka-pipeline/golden/envelopes.txt
index 5b63c7f..1ab31b1 100644
--- a/crates/eureka-pipeline/golden/envelopes.txt
+++ b/crates/eureka-pipeline/golden/envelopes.txt
@@ -9,6 +9,7 @@
 # live mind store (eureka-body:verdict:cut-leaf-into-huginn.s1) and to
 # Epiphany ef956865 modulo that rename (verdict ...s2). Never regenerate to make
 # a failing test pass: a diff here is a wire change and needs its own ruling.
+sample.campaign eureka-state:campaign:self epiphany.pipeline.campaign.v2 EpiphanyPipelineCampaignDocument 9185a4736c7567ac657572656b612d7374617465a57469746c65b5457572656b6120706970656c696e65207374617465a57265706f7391b147616d6543756c742f4570697068616e79ae776f726b696e675f6272616e6368bb636f6465782f657572656b612d706970656c696e652d7374617465aa7461726765745f646f6384a470617468d9256e6f7465732f657572656b612d706970656c696e652d73746174652d7461726765742e6d64aa73746172745f6c696e6501a8656e645f6c696e6509a6636f6d6d6974a83566393832323864
 sample.target eureka-state:target:r2 epiphany.pipeline.target.v2 EpiphanyPipelineTargetDocument 9186a863616d706169676eac657572656b612d7374617465a87265766973696f6e02aa696e76617269616e74739182a56c6162656cab6d696e642d61646d697473a973746174656d656e74b64f6e6c792061646d697373696f6e207772697465732eac6e6f745f696e5f73636f706591ac4576652062726f7773696e67b963616e6f6e6963616c5f696d706c656d656e746174696f6e7391a743756c744c6962a3646f6384a470617468d9256e6f7465732f657572656b612d706970656c696e652d73746174652d7461726765742e6d64aa73746172745f6c696e6501a8656e645f6c696e6509a6636f6d6d6974a83566393832323864
 sample.question eureka-state:question:Q1 epiphany.pipeline.question.v2 EpiphanyPipelineQuestionDocument 9189a863616d706169676eac657572656b612d7374617465a56c6162656ca25131a57469746c65b357686f206f776e73207468652073746174653fa87175657374696f6eb357686f206f776e73207468652073746174653fa76f7074696f6e739282a56c6162656ca141a474657874ab616e20696e7374616e636582a56c6162656ca142a474657874a661207265706fab7265636f6d6d656e646564a141a7646570656e647391a6437574203361a97261697365645f696e82a46b696e64a743757453706563a26964bf657572656b612d73746174653a6375745f737065633a6375742d33612e7231a861736b65645f6f6eaa323032362d30392d3135
 sample.ruling eureka-state:ruling:R8 epiphany.pipeline.ruling.v2 EpiphanyPipelineRulingDocument 918aa863616d706169676eac657572656b612d7374617465a56c6162656ca25238a57469746c65b9416e20696e7374616e6365206f776e7320697473206d696e64a7616e7377657273b8657572656b612d73746174653a7175657374696f6e3a5131a663686f696365a141a672756c696e67ba416e20696e7374616e6365206f776e7320697473206d696e642eae6f70657261746f725f71756f7465bd616c6c207265636f6d6d656e646174696f6e732c20676f206168656164a872756c65645f6f6eaa323032362d30392d3135aa707265636564656e74739185a47265706fb147616d6543756c742f4165746865726961a6636f6d6d6974d92861616161616161616161616161616161616161616161616161616161616161616161616161616161a46b696e64a652756c696e67a26964b363756c7463616368653a72756c696e673a5231ae7061796c6f61645f736861323536d94062626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262a9617574686f72697479a84f70657261746f72