Audit map doctrine boundaries

AGENTS.md

@@ -21,6 +21,8 @@ diagnostics good enough to catch when we are lying to ourselves.
 - Treat `docs/implementation-plan.md` as the forward plan.
 - Treat `docs/lean-optimizer-algorithm-map.md` as the source-grounded live
   algorithm map.
+- Treat `docs/hosted-auth-architecture.md` as a future architecture note for
+  hosted auth work, not as proof that auth machinery already exists.
 - Update `state/map.yaml` when project understanding changes.
 - Add evidence after meaningful research, implementation, verification, or
   rejected paths, but keep it distilled. Routine "I just did this" proof belongs
@@ -32,6 +34,7 @@ diagnostics good enough to catch when we are lying to ourselves.
 - Project root: `E:\Projects\repixelizer`
 - Implementation plan: `E:\Projects\repixelizer\docs\implementation-plan.md`
 - Algorithm map: `E:\Projects\repixelizer\docs\lean-optimizer-algorithm-map.md`
+- Hosted auth architecture: `E:\Projects\repixelizer\docs\hosted-auth-architecture.md`
 - Handoff summary: `E:\Projects\repixelizer\notes\fresh-workspace-handoff.md`
 - State CLI: `E:\Projects\repixelizer\tools\repixelizer_state.py`
 - Pre-compaction helper: `E:\Projects\repixelizer\tools\repixelizer_prepare_compaction.py`

docs/hosted-auth-architecture.md

@@ -1,5 +1,21 @@
 # Repixelizer Hosted Auth Architecture
 
+## What this file is
+
+This file is a future architecture note for hosted-demo authentication and
+entitlement work.
+
+It is not a map of code that already exists in the repo. Current live hosted
+demo behavior is still just:
+
+- hosted-demo runtime limits and UI flags in `src/repixelizer/gui.py`
+- the local single-process queue in `src/repixelizer/gui.py`
+- frontend consumption of `hostedDemo` runtime config in `frontend/src/app.ts`
+
+If future auth work lands and this note drifts away from the code, trust the
+code first and either update this document or cut the stale parts instead of
+pretending the architecture already exists.
+
 ## Summary
 
 The hosted Repixelizer demo should support both:
@@ -405,3 +421,21 @@ Keep these sacred:
 - linking identities must never merge two existing local users implicitly
 
 If we violate those rules, the auth system will become a damp little pit of edge cases almost immediately.
+
+## Audit Result
+
+This design is still compatible with the current Epiphany workflow after one
+important correction: it must be treated as future architecture, not current
+truth.
+
+That boundary is now explicit. The note can keep its job if it stays focused on:
+
+- the proposed local-user plus linked-identity model
+- the `discord_allowed || patreon_allowed` entitlement rule
+- the implementation phases and invariants for future auth work
+
+It should not quietly become:
+
+- a handoff note
+- a claim that auth is already landed
+- a duplicate of the live queue behavior already described by the code

docs/implementation-plan.md

@@ -1,5 +1,16 @@
 # Repixelizer Implementation Plan
 
+## What this file is
+
+This file is the forward plan and active hypothesis ledger for Repixelizer.
+
+It is not the authoritative stage-by-stage control-flow map. That lives in
+`docs/lean-optimizer-algorithm-map.md`.
+
+If these two notes disagree about what the code does right now, trust the
+algorithm map and the source, then fix this plan instead of hand-waving about
+intent.
+
 ## Current machine
 
 Repixelizer now has one live reconstruction engine:

docs/lean-optimizer-algorithm-map.md

@@ -566,3 +566,28 @@ These are the categories of complexity that would change the nature of the solve
 - repeated structural score families that appear in more than one stage
 
 The whole point of this machine is that it stays one field, one loss, one final sample.
+
+## Audit Result
+
+This map is compatible with the current Epiphany workflow as long as it keeps
+doing one job: describing the live machine the repo actually runs.
+
+Right now it passes that test:
+
+- it names the current pipeline instead of a future fantasy machine
+- it anchors every stage to real source files
+- it keeps the prose explanation attached to the control flow instead of
+  replacing it
+- it identifies the current seams and the forbidden complexity that would turn
+  the solver back into a Jenga tower
+
+The important boundary is simple:
+
+- live control-flow truth belongs here
+- active hypotheses and next cuts belong in `docs/implementation-plan.md`
+- compact re-entry instructions belong in `notes/fresh-workspace-handoff.md`
+- durable project truth belongs in `state/map.yaml`
+
+If a future pass adds directional edge awareness, anisotropic behavior, or
+another real control-flow change, update this map after the code lands. If the
+change is still a hypothesis, keep it out of this file.

notes/fresh-workspace-handoff.md

@@ -33,6 +33,7 @@ Do not trust this file for the exact live HEAD. Always check git.
 - The current tracked weakness is the widened dark contour near the badge sword tip on tapered shapes.
 - `source_structure` exists because lattice-only `source_fidelity` could call visibly better outputs worse.
 - The old tray optimizer is dead and should stay dead unless the entire machine map changes for a real reason.
+- `docs/hosted-auth-architecture.md` is a future design note for a not-yet-landed hosted auth system; current hosted-demo truth is still just the queue and limit machinery in `src/repixelizer/gui.py` plus the frontend runtime-config plumbing.
 
 ## Critical Doctrine
 
@@ -89,6 +90,7 @@ Rules now in force:
 - this handoff is a compact re-entry packet.
 - `docs/implementation-plan.md` is the forward plan.
 - `docs/lean-optimizer-algorithm-map.md` is the source-grounded control-flow map.
+- `docs/hosted-auth-architecture.md` is future auth design, not live implementation truth.
 
 Do not let any one note become all of those things. That is how the tower grows
 sideways and starts calling itself architecture.

state/evidence.jsonl

@@ -1,3 +1,4 @@
 {"ts":"2026-04-26T00:00:00Z","type":"design","status":"accepted","note":"Repixelizer now has one live reconstruction engine: phase-field in src/repixelizer/phase_field.py. The old tray-based optimizer is gone."}
 {"ts":"2026-04-26T00:00:00Z","type":"metric","status":"accepted","note":"source_structure is tracked alongside source_fidelity because lattice-only scoring could rank visibly better outputs as worse."}
 {"ts":"2026-04-26T00:00:00Z","type":"regression","status":"rejected","note":"The d9fa411 phase-field tuning pass was a real regression on the pinned badge case; reverting it restores the known-good badge result exactly."}
+{"ts": "2026-04-26T03:57:11+00:00", "type": "docs", "status": "ok", "note": "Audit pass clarified note boundaries: the algorithm map remains the live control-flow truth, the implementation plan remains the forward hypothesis ledger, and hosted-auth-architecture is explicitly future design rather than landed auth machinery."}