…ng-debt cleanup

Two-phase tick captured:

1. SVG-first social-preview substrate (PR #9) — Aaron's
   vector preference superseded PIL/PNG generator; SVG is
   4KB source-of-truth, PNG rasterized on-demand via
   rsvg-convert one-liner documented in SVG header.

2. Meta-fix caught structural check-drift — pre-existing
   40+ markdownlint violations across 11 docs that
   accumulated because lint-markdownlint is non-required.
   Prior PRs #7 + #8 both merged red; mine would have been
   third. Filed cleanup as PR #10 per Aaron's
   strengthen-the-check rule.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Extends the "Branch-protection required-check on main" BACKLOG
row with the 2026-04-22 audit findings that surfaced while
investigating why PRs #7 + #8 merged with markdownlint red:

- AceHack/Zeta has zero rulesets (every check advisory).
- LFG/Zeta Default ruleset (id=15256879) has 6 rules but
  no required_status_checks.

Records the proposed required-check set (markdownlint +
ubuntu-22.04 build/test + lint matrix + Path gate + CodeQL),
the keep-advisory set (macos-14 per fork-workflow cost-model),
and the gh api call shape for both surfaces. Requires Aaron
sign-off for AceHack (LFG settings permission is scoped).

Captured as follow-up to strengthen-the-check-not-the-manual-
gate rule — the audit exists BECAUSE the manual-merge click
was the only gate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Two prior PRs (#7 batch 6b, #8 surface-map smell) merged with
markdownlint failing — lint is non-blocking on AceHack but
the accumulating violations drift against "strengthen the
check, not the manual gate" (Aaron 2026-04-22). Fix now so
future PRs surface genuine regressions, not pre-existing noise.

Mechanical fixes via `markdownlint-cli2 --fix`:
- MD032 blanks-around-lists (9 docs touched)
- MD022 blanks-around-headings (3 docs)
- MD007 ul-indent (supply-chain-safe-patterns.md)
- MD049 emphasis-style asterisk (intentional-debt.md)

One manual fix:
- MD024 duplicate heading "How to read the state column" in
  SHIPPED-VERIFICATION-CAPABILITIES.md — was a copy-paste of
  the same H2 + bullet list at lines 53 and 77. Deleted the
  line-77 duplicate; the line-53 version keeps the longer
  trailing "Rule of thumb" + "Audit cadence" paragraphs.

Follow-up (separate PR, not this one): make markdownlint a
required check so the strengthen-the-check rule holds.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…ogged (Lucent-Financial-Group#177)

Creates durable append-only log for the cadenced NSA testing
protocol declared in the 2026-04-23 "NSA persona is first-
class" directive. Closes gap #3 of the Frontier bootstrap
readiness roadmap (BACKLOG P0, filed Otto-2).

File contents:
- Why-this-exists block with directive verbatim
- Append-only discipline (same shape as sibling
  hygiene-history files)
- 3 test configurations: baseline / NSA-default / NSA-worktree
- 5-prompt test set v1
- Schema: date / test-id / prompt-id / config / model /
  outcome / gap-found / notes
- Outcome definitions: pass / partial / fail
- Cadence: every 5-10 autonomous-loop ticks, one prompt
  per fire
- Known substrate-gap patterns running list
- First row: NSA-001 (Otto-1 feasibility test,
  2026-04-23T18:42:00Z) — partial pass, found Zeta identity
  but missed Otto because MEMORY.md had no pointer; gap
  fixed same-tick, pattern recorded

Attribution: Otto (loop-agent PM hat) — hat-less-by-default
substrate hygiene work. No specialist persona hats worn.

Closes gap #3 of 8 in the Frontier readiness roadmap.
Remaining: gap #1 (multi-repo split) / #2 (linguistic-seed
substrate) / #4 (bootstrap-reference docs) / #5 (factory-vs-
Zeta separation) / #6 (persona file portability) / #7
(tick-history scope-mixed) / #8 (hygiene rows untagged).

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…correction) (Lucent-Financial-Group#332)

Completes the input pipeline for TemporalCoordinationDetection.
phaseLockingValue (PR Lucent-Financial-Group#298): PLV expects phases in radians but
didn't prescribe how events become phases. This ship fills the
gap.

17th graduation under Otto-105 cadence. Addresses Amara 17th-ferry
Part 2 correction #5: 'Without phase construction, PLV is just a
word.'

Surface (2 pure functions):
- PhaseExtraction.epochPhase : double -> double[] -> double[]
  Periodic-epoch phase. φ(t) = 2π · (t mod period) / period.
  Suited to consensus-protocol events with fixed cadence (slot
  duration, heartbeat, epoch boundary).
- PhaseExtraction.interEventPhase : double[] -> double[] -> double[]
  Circular phase between consecutive events. For sample t in
  [t_k, t_{k+1}), phase = 2π · (t - t_k) / (t_{k+1} - t_k).
  Suited to irregular event-driven streams.

Both return double[] of phase values in [0, 2π) radians. Empty
output on degenerate inputs (no exception). eventTimes assumed
sorted ascending; samples outside the event range get 0 phase
(callers filter to interior if they care).

Hilbert-transform analytic-signal approach (Amara's Option B)
deferred — needs FFT support which Zeta doesn't currently ship.
Future graduation when signal-processing substrate lands.

Tests (12, all passing):
epochPhase:
- t=0 → phase 0
- t=period/2 → phase π
- wraps cleanly at period boundary
- handles negative sample times correctly
- returns empty on invalid period (≤0) or empty samples

interEventPhase:
- empty on <2 events or empty samples
- phase 0 at start of first interval
- phase π at midpoint
- adapts to varying interval lengths (O(log n) binary search
  for bracketing interval)
- returns 0 before first and after last event (edge cases)

Composition with phaseLockingValue:
- Two nodes with identical epochPhase period → PLV = 1
  (synchronized)
- Two nodes with same period but constant offset → PLV = 1
  (perfect phase locking at non-zero offset is still locking)

This composes the full firefly-synchronization detection
pipeline end-to-end for event-driven validator streams:
  validator event times → PhaseExtraction → phaseLockingValue
  → temporal-coordination-detection signal

5 of 8 Amara 17th-ferry corrections now shipped:
#1 λ₁(K₃)=2 ✓ already correct (PR Lucent-Financial-Group#321)
#2 modularity relational ✓ already correct (PR Lucent-Financial-Group#324)
#3 cohesion/exclusivity/conductance ✓ shipped (PR Lucent-Financial-Group#331)
#4 windowed stake covariance ✓ shipped (PR Lucent-Financial-Group#331)
#5 event-stream → phase pipeline ✓ THIS SHIP
Remaining: #4 robust-z-score composite variant (future);
#6 ADR phrasing (already correct); #7 KSK naming (BACKLOG
Lucent-Financial-Group#318 awaiting Max coord); #8 SOTA humility (doc-phrasing
discipline).

Build: 0 Warning / 0 Error.

Provenance:
- Concept: Aaron firefly-synchronization design
- Formalization: Amara 17th-ferry correction #5 with 3-option
  menu (epoch / Hilbert / circular)
- Implementation: Otto (17th graduation; options A + C shipped,
  Hilbert deferred)

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…-ferry §B + §F + corrections #2 #7 #9 (Lucent-Financial-Group#342)

Research-grade design doc for the Stage-2 rung of Amara's
corrected promotion ladder. Specifies: (a) placement under
src/Experimental/CartelLab/ (not src/Core/ — that's Stage 4);
(b) MetricVector type with PLV magnitude AND offset split
(correction #6); (c) INullModelGenerator interface +
Preserves/Avoids table columns; (d) IAttackInjector
forward-looking interface (Stage 3); (e) Wilson-interval
reporting contract with {successes, trials, lowerBound,
upperBound} schema (correction #2 — no more "~95% CI ±5%"
handwave); (f) RobustZScoreMode with Hybrid fallback
(correction #7 — percentile-rank when MAD < epsilon);
(g) explicit artifact-output layout under artifacts/
coordination-risk/ with five files + run-manifest.json
(correction #9).

6-stage promotion path (0 doc / 1 ADR / 2.a skeleton /
2.b full null-models + first attack / 3 attack suite /
4 Core/NetworkIntegrity / 5 Aurora-KSK) matches Amara's
corrected ladder and Otto-105 cadence.

Doc-only change; no code, no tests, no workflow, no
BACKLOG tail touch (avoids positional-conflict pattern
that cost Lucent-Financial-Group#334 → Lucent-Financial-Group#341 re-file this session).

This is the 7th of 10 18th-ferry operationalizations:
- #1/#10 test-classification (Lucent-Financial-Group#339)
- #2 Wilson-interval design specified (this doc)
- #6 PLV phase-offset shipped (Lucent-Financial-Group#340)
- #7 MAD=0 Hybrid mode specified (this doc)
- #9 artifact layout specified (this doc)
- #4 exclusivity already shipped (Lucent-Financial-Group#331)
- #5 modularity relational already shipped (Lucent-Financial-Group#324)

Remaining: Wilson-interval IMPLEMENTATION (waits on Lucent-Financial-Group#323 +
Stage 2.a), MAD=0 Hybrid IMPLEMENTATION (waits on Lucent-Financial-Group#333 +
Stage 2.a), conductance-sign doc (waits on Lucent-Financial-Group#331), Stage-2.a
skeleton itself.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…ignal-proc + KSK (supersedes Lucent-Financial-Group#334 DIRTY) (Lucent-Financial-Group#341)

* backlog: Aaron Otto-139..149 multi-directive block — F# DSL / container-DSL / LINQ / signal-proc + KSK canonical expansion

Four new P1 post-v1-roadmap rows + one row updated:

1. **Per-entry-point F# DSLs + industry-standard surfaces**
   (Otto-139 + Otto-146). Graph gets GQL ISO 39075 / Cypher /
   Gremlin / SPARQL / Datalog survey; temporal gets Esper EPL
   / Flink SQL; time-series gets Flux / PromQL / KQL; claim /
   detect / authorize stay Zeta-native (no industry standard
   fits). Aaron clarifier "i know there are graph standards"
   acknowledged — GQL / Cypher / Gremlin are the top three.

2. **F# DSL composition + container-DSL pattern** (Otto-147
   final question). Answer: YES, F# supports DSL composition
   via nested CEs, `MergeSources` (F# 5+), custom operations,
   builder delegation. Aaron's "container DSL" guess is
   exactly the right pattern name. Implementation plan: top-
   level `zeta { }` container CE that hosts child builders
   (graph / claims / stream / signal / authorize / detect)
   via `MergeSources` + folded state. Retraction-native
   semantics bubble through container. Prior art: FParsec,
   Giraffe, SAFE Stack.

3. **LINQ-compatible entry points for C# on every F# DSL**
   (Otto-148). `IQueryable<T>` + `IGraphQueryable<TNode>` +
   `IStreamQueryable<T>` + `ISignalQueryable<T>` +
   `IClaimQueryable<T>`. Clever mapping goal: auto-generate
   LINQ provider from F# CE via the `query` translator where
   feasible, not hand-written mirrors. Expression-tree
   preservation — LINQ lowers to same Zeta operator IR.

4. **Signal-processing primitives — FFT, Hilbert, windowing,
   filters** (Otto-149). Standing approval to land whenever
   cadence permits. Unblocks Amara 17th-ferry correction #5
   Option B (Hilbert-based phase pipeline). Placement:
   `src/Core/SignalProcessing.fs` new module +
   `hilbertPhase` addition to `src/Core/PhaseExtraction.fs`.

Also updated:

- **KSK naming doc row** (line 4278). Max-coordination gate
  LIFTED per Aaron Otto-140 (*"Coordination required: Max
  per Otto-77 change whatever you need, max created the ksk
  at my direction, it's my and amaras idea, he just commited
  some inital starting point, all completely rewritable"*).
  Canonical expansion locked per Aaron Otto-142..145 self-
  correction: *"kinetic safeguare Kernel, i did the wrong
  name / it is what amara said / kinetic safeguard kernel"*.
  Resolves Amara 16th-ferry correction #7. "Kernel" here =
  safety-kernel / security-kernel sense (Anderson 1972,
  Saltzer-Schroeder reference-monitor, aviation safety-
  kernel) — NOT OS-kernel-mode. Max attribution preserved as
  initial-starting-point contributor per Otto-77. Priority
  elevated P3 → P2.

Filed per Aaron's "backlog" directive plus verify-before-
deferring discipline — prior summary claim that these rows
had already landed turned out to be hallucination; git log
confirmed only the (now-updated) KSK row existed pre-tick.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(Lucent-Financial-Group#341): 3 review-thread P1/P2s on F# DSL BACKLOG row

Active PR-resolve-loop on Lucent-Financial-Group#341.

1. ISO GQL 39075 citation (thread 59WKAJ, P2): imprecise
   citation replaced with canonical form "ISO/IEC
   39075:2024 (GQL)" — Graph Query Language. Easier for
   readers to validate against the actual standard's
   indexing.

2. MergeSources / and! cross-builder claim (thread
   59WKAv, P1): clarified that MergeSources works
   WITHIN a single active CE builder that defines
   Source/MergeSources members for compatible types —
   NOT across fundamentally different DSL builders. The
   original wording read as if `graph + veridicality +
   signal` DSLs could combine directly in one `and!`
   chain; that's misleading. True cross-DSL combination
   requires the container-DSL pattern (next row's
   top-level `zeta { }` CE with child-builder
   delegation via its own Source overloads). Rewording
   makes the distinction explicit.

3. Brittle line-reference `row 4278 (KSK)` (thread
   59WKBD, P1): replaced line-number cross-refs with
   title/section-anchor cross-refs. "row 733 (F# DSL
   reimagining SQL)" / "row 719 (LINQ integration)"
   / "row 4278 (KSK)" → "the F# DSL reimagining SQL
   row (P1 SQL-frontend section)" / "LINQ integration
   row (same section)" / "KSK naming definition doc
   row (P2 research-grade section)". Titles survive
   BACKLOG row-reordering; line numbers don't.

All 3 threads have substantive replies pending via
GraphQL (next step same tick).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…mara #4 robust) + 3 BACKLOG rows (Lucent-Financial-Group#333)

* core: RobustStats.robustZScore + Graph.coordinationRiskScoreRobust — 18th graduation (Amara #4 robust)

Two ships consolidated per the 'parallel PRs hit positional
conflicts on tail-append' lesson:

1. RobustStats.robustZScore
   (baseline: double seq) -> (measurement: double) -> double option
   Returns (measurement - median) / (1.4826 · MAD). The 1.4826
   constant scales MAD to be consistent with Gaussian stddev.
   MadFloor prevents blow-up when every baseline value equal.

2. Graph.coordinationRiskScoreRobust
   alpha beta eigenTol eigenIter lpIter
   (baselineLambdas: double seq) (baselineQs: double seq)
   (attacked: Graph<'N>) -> double option
   Upgrades coordinationRiskScore (PR Lucent-Financial-Group#328) from raw linear
   differences to robust-standardized z-scores per Amara
   17th-ferry correction #4. Caller provides baseline metric
   distributions; Z-scores calibrate thresholds from data.

Why robust z-scores: adversarial data isn't normally
distributed. An attacker can poison a ~normal distribution
by adding a few outliers that inflate stddev, making
subsequent real attacks look 'within one sigma'. Median+MAD
survives ~50% adversarial outliers. Standard move in robust
statistics literature; Amara's correction puts it on the
Zeta composite.

Tests (5 new; total 39 since main hasn't merged Lucent-Financial-Group#331/Lucent-Financial-Group#332 yet):
- robustZScore None on empty baseline
- robustZScore of measurement = median is 0
- robustZScore scales MAD by 1.4826 for Gaussian consistency
  (measurement 4 on baseline [1..5] ≈ 0.674)
- coordinationRiskScoreRobust fires strongly on K4-injected graph
  given 5 baseline samples
- coordinationRiskScoreRobust returns None on empty baselines

BACKLOG rows added this tick per Aaron Otto-139 directives:
1. Signal-processing primitives (FFT + Hilbert) — unblocks
   Amara correction #5 Option B; Aaron standing-approval
2. F# DSL for entry points + graph-query-language standards
   compliance (Cypher / GQL / Gremlin / SPARQL / Datalog)
3. LINQ-compatible entry points for C# consumers — pair with
   F# DSL; two frontends, one algebraic backend

6 of 8 Amara 17th-ferry corrections now shipped or confirmed:
Remaining: #6 ADR phrasing (already fine); #7 KSK naming
(BACKLOG Lucent-Financial-Group#318 Max coord pending); #8 SOTA humility
(doc-phrasing discipline ongoing).

Build: 0 Warning / 0 Error.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(Lucent-Financial-Group#333): 4 review-thread P1/P2s on robustZScore + coordinationRiskScoreRobust

Active PR-resolve-loop on Lucent-Financial-Group#333.

1. Doc/impl contradiction on MAD=0 (thread 59VhYb, P1):
   RobustStats.robustZScore doc said "returns None when
   MAD(baseline)=0" but impl uses MadFloor and returns
   Some finite value. Rewrote doc to match impl:
   explicit "MadFloor substituted when MAD collapses to
   zero" — floor reflects "scale is below epsilon" not
   "undefined." Implementation is the contract.

2. Multi-enumeration of baseline seq (thread 59VhYq, P1):
   robustZScore previously passed `baseline` to both
   `median` + `mad` which each call `Seq.toArray`.
   Expensive AND inconsistent for lazy/non-repeatable
   sequences (different values between enumerations =
   undefined behavior). Fixed: `Seq.toArray` once at
   entry, pass the materialized array to both. O(n)
   instead of O(2n); stable across lazy sources.

3. Name attribution in Graph.fs doc comment (thread
   59VhY5, P1): "Amara 17th-ferry... Otto 18th
   graduation" → "external AI collaborator's 17th
   courier ferry... Eighteenth graduation under the
   Otto-105 cadence." Role-reference convention per
   AGENT-BEST-PRACTICES code/doc rule.

4. Array-vs-seq terminology (thread 59VhZG, P2):
   Graph.fs doc said callers "provide arrays" but the
   API is `double seq`. Rewrote: sequences + noted the
   materialize-once optimization in robustZScore so
   callers can pass any seq form without re-enumeration
   cost.

Thread 59VhX9 (P3-label-in-P2-section mismatch) — already
resolved on main via PR Lucent-Financial-Group#341 which landed the signal-
processing row correctly labeled "P2 research-grade."
No fix needed on this branch.

Build: 0 Warning(s) / 0 Error(s). 53 RobustStats + Graph
tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…2..145) (Lucent-Financial-Group#336)

* docs: KSK naming definition doc — resolves Amara 16th-ferry correction #7

Canonical expansion locked by Aaron Otto-142..145 (self-correcting
transient Otto-141 "SDK" typo): **KSK = Kinetic Safeguard Kernel**.

"Kernel" here is used in the safety-kernel / security-kernel sense
(Anderson 1972 reference-monitor, Saltzer-Schroeder complete-
mediation, aviation safety-kernel) — **NOT** an OS-kernel (not
Linux / Windows / BSD ring-0 / kernel-mode). The lead paragraph of
the doc makes this distinction up-front so readers coming from
OS-kernel contexts do not misinterpret.

Doc content (docs/definitions/KSK.md):

- "In this project, KSK means..." definitional anchor with the
  k1/k2/k3 + revocable-budgets + multi-party-consent + signed-
  receipts + traffic-light + optional-anchoring mechanism set
  (per Amara 5th ferry, ratified 7th/16th/17th)
- "Inspired by..." DNSSEC KSK, DNSCrypt + threshold-sig
  ceremonies, security kernels (Anderson / Saltzer-Schroeder),
  aviation safety kernels, microkernel OS lineage
- "NOT identical to..." OS kernel, DNSSEC KSK, generic
  root-of-trust, blockchain/ledger, policy engine (OPA Rego /
  XACML), authentication system
- Attribution + provenance: Aaron + Amara concept owners; Max
  initial-starting-point in LFG/lucent-ksk (preserved per
  Otto-77 attribution; rewrite authority per Otto-140)
- Relationship to Zeta / Aurora / lucent-ksk triangle
- Cross-references to 5 prior courier ferries

Also added glossary pointer entry (`### KSK (Kinetic Safeguard
Kernel)`) placed under "## Meta-algorithms and factory-native
coinages" section with plain + technical definition and pointer
to the full doc.

Addresses:
- Amara 16th-ferry §4 (KSK naming stabilization needed)
- Amara 17th-ferry correction #7 (stabilization still pending)
- BACKLOG row 4278 (updated in-place to reflect landing)

Authority: Aaron Otto-140 rewrite approved (Max-coordination
gate lifted; Max attribution preserved).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(Lucent-Financial-Group#336): markdownlint MD026 + 5 review-thread P1s

PR-resolve-loop applied to Lucent-Financial-Group#336 (KSK naming definition doc).
1 CI failure + 6 unresolved review threads.

CI fix:

- docs/definitions/KSK.md:19 MD026/no-trailing-punctuation:
  "## In this project, KSK means..." → "## In this project,
  KSK means" (dropped the three dots in the heading).

Review-thread fixes:

1. docs/GLOSSARY.md:819 — "LFG/lucent-ksk" read as in-repo
   path: Rewrote to explicitly mark as the external
   repository at https://github.com/Lucent-Financial-Group/
   lucent-ksk, clarified "not a local LFG/ directory in
   this repo."

2. docs/definitions/KSK.md:158 — named individuals in
   Attribution section violated factory name-attribution
   policy: Rewrote using role references ("the human
   maintainer", "an external AI collaborator", "a trusted
   external contributor"). Direct names preserved only in
   audit-trail surfaces per policy (commit messages,
   tick-history, session memory).

3. docs/definitions/KSK.md:153 — cross-reference to
   memory/feedback_ksk_naming_unblocked_*.md that didn't
   exist in repo: Removed path reference entirely; the
   factual substance was restated in role-based prose
   without a broken-link dependency.

4. docs/definitions/KSK.md:180 — "LFG/lucent-ksk" repeated
   same in-repo-path confusion as GLOSSARY: Applied same
   fix (external repo URL + explicit "separate repo"
   framing).

5. docs/definitions/KSK.md:207 — cross-reference list
   included `docs/aurora/*-5th-ferry-*`, `*-12th-ferry-*`,
   `*-14th-ferry-*`, `*-16th-ferry-*` globs that resolve
   to zero files in the current tree: Rewrote list to
   enumerate only verified in-repo references (6th / 7th /
   17th / 19th ferries that actually exist); added
   explicit note that earlier ferries (5th / 12th / 14th
   / 16th) live in ROUND-HISTORY + session memory rather
   than as standalone docs.

6. docs/definitions/KSK.md:191 — literal "+" continuation
   line violating markdownlint + repo convention: resolved
   as a side-effect of the Attribution rewrite — the
   replacement prose doesn't use "+" continuations.

Framing: third PR where PR-resolve-loop discipline is
applied (after Lucent-Financial-Group#354 and Lucent-Financial-Group#352). Active management continues.
Compound lesson from Otto-204c: prior-session review-
resolution precedents now integrated into per-tick habit,
not just sitting in memory.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(Lucent-Financial-Group#336): 2 review threads — ROUND-HISTORY claim + ferry cross-ref numbers

- Thread PRRT_kwDOSF9kNM59YL4x (line 219): ROUND-HISTORY.md
  claim was false (grep confirms zero 'ferry' references and
  no tick rows); repointed to
  docs/hygiene-history/loop-tick-history.md where ferries and
  tick rows actually live.
- Thread PRRT_kwDOSF9kNM59YL4- (line 151): parenthetical
  listed 5th/7th/12th/14th/16th/17th but Cross-references is
  authoritative with 6th/7th/12th/17th/19th; aligned the
  parenthetical to match the verified in-repo list.

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…sibling (Lucent-Financial-Group#147)

* Live-lock audit history: inaugural lesson integrated — prevention discipline for next time

Aaron 2026-04-23:

> if you want to beat ARC3 and do better than humans at uptime and
> other DORA metrics then your live-lock smell and the decisions you
> make to prevent live locks in the future based on pass lessons, the
> ability to integrate previous lessions and not forget is ging to be
> key.

Lesson-permanence is the factory's competitive differentiator.
Detection (audit script) is table stakes. Integration — recording the
lesson, consulting it forward, preventing re-occurrence — is the
product.

## What lands

- New "Lessons integrated" section in
  `docs/hygiene-history/live-lock-audit-history.md`
- Inaugural lesson from tonight's smell-firing event, structured as
  signature / mechanism / prevention with 4 concrete prevention
  decisions:
  1. External-priority stack is authoritative; agent reorders only
     internal priorities
  2. Live-lock audit at round-close is a gate-not-a-report
  3. Speculative-work permit requires external-ratio check first
  4. Tick-history rows are explicitly NOT external work; pair INTL
     with EXT when the smell is near firing
- Open carry-forward named: round-close-ladder wiring is a P1
  follow-up (BACKLOG row already filed earlier this session)

## Discipline

Every future smell firing files a lesson to this same section.
`memory/feedback_lesson_permanence_is_how_we_beat_arc3_and_dora_2026_04_23.md`
captures the full rule: detection is not enough, integration is the
product, lessons are consulted BEFORE taking actions that match known
failure-mode signatures, memory persists across sessions.

The pattern extends beyond live-lock: other detection mechanisms
(SignalQuality firing, Amara-oracle rejecting, drift-tick exceeding
threshold, OpenSpec Viktor failing rebuild-from-spec) should file
lessons to their respective hygiene-history files.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* samples: ServiceTitan factory-demo JSON API (v0, in-memory, stack-independent)

Minimal F# ASP.NET Core Web API serving CRM seed data as JSON. Any
frontend choice (Blazor / React / Vue / curl) consumes the same
endpoints. Ships now so the backend is not on the critical path when
Aaron picks the frontend stack.

## What lands

- `samples/ServiceTitanFactoryApi/ServiceTitanFactoryApi.fsproj`
  using `Microsoft.NET.Sdk.Web`; only explicit package ref is
  `FSharp.Core` (ASP.NET Core comes via framework reference, no
  Directory.Packages.props edit needed)
- `Seed.fs` — in-memory seed mirroring `ServiceTitanFactoryDemo/seed-data.sql`:
  20 customers, 30 opportunities (5 stages), 33 activities, 2 intentional
  email collisions. Deterministic fixed clock at 2026-04-23 00:00 UTC.
- `Program.fs` — minimal F# API with 9 endpoints: customers (list/detail),
  opportunities (list/detail), activities (list/per-customer), pipeline
  funnel (count + total-cents per stage), duplicates (customers sharing
  an email).
- `README.md` — framing (software-factory demo, not database pitch),
  endpoint table, design notes, v1 roadmap.

## Smoke-test output (verified)

```
GET /api/pipeline/funnel
[{"count":10,"stage":"Lead","totalCents":5400000},
 {"count":6, "stage":"Qualified","totalCents":4220000},
 {"count":6, "stage":"Proposal","totalCents":5720000},
 {"count":6, "stage":"Won","totalCents":2670000},
 {"count":2, "stage":"Lost","totalCents":490000}]

GET /api/pipeline/duplicates
[{"customerIds":[1,13],"email":"alice@acme.example"},
 {"customerIds":[5,19],"email":"bob@trades.example"}]
```

Build: 0 Warning(s), 0 Error(s). `dotnet run` starts the API;
curl confirms all endpoints respond correctly.

## Discipline signal

This is the third EXT commit of the session (CRM demo sample Lucent-Financial-Group#141,
CRM scenario tests in Lucent-Financial-Group#143, now this API). The live-lock audit's
inaugural lesson explicitly prescribed shipping external-priority
increments when the smell fires. Three landed this session, all on
priority #1 (ServiceTitan + UI) — the factory is correctly
response-pattern even before any of tonight's PRs merge to main.

## What this does NOT do

- Does NOT wire Postgres — in-memory only for v0; Npgsql wiring is
  a follow-up PR once Aaron confirms the DB driver
- Does NOT expose Zeta / DBSP / retraction-native language to the
  frontend — standard CRUD shape per the ServiceTitan positioning
  directive
- Does NOT implement writes — v0 is read-only; POST/PUT/DELETE is
  a follow-up
- Does NOT add auth — no authentication for v0
- Does NOT ship docker-compose — future PR bundles this API with
  Postgres in one command

Composes with:
- `samples/ServiceTitanFactoryDemo/` (SQL schema + seed) — sibling,
  same shapes; v1 wires this API to that schema
- `docs/plans/servicetitan-crm-ui-scope.md` — build sequence step 1
  (API skeleton) complete; step 2 (DB wiring) is next
- `memory/feedback_servicetitan_demo_sells_software_factory_not_zeta_database_2026_04_23.md`
- `memory/feedback_lesson_permanence_is_how_we_beat_arc3_and_dora_2026_04_23.md`

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* samples: ServiceTitan factory-demo C# companion API — parity with F# sibling

ServiceTitan uses C# for most of their backend with zero F#. Shipping
a C# companion to the F# API (Lucent-Financial-Group#146) so ST engineers evaluating the
factory see code in the language they already read fluently.
F# stays the reference — it's closer to math, theorems are easier to
express — but factory output matches audience stack.

## What lands

- `ServiceTitanFactoryApi.CSharp.csproj` — `Microsoft.NET.Sdk.Web`,
  nullable + implicit usings enabled, TreatWarningsAsErrors
- `Customer.cs`, `Opportunity.cs`, `Activity.cs` — records, one
  per file (MA0048)
- `Seed.cs` — deterministic in-memory seed, identical to F# Seed.fs:
  20 customers, 30 opportunities, 33 activities, 2 intentional
  email collisions
- `Program.cs` — 9 minimal-API endpoints, identical routes + JSON
  shapes to the F# sibling
- `README.md` — parity guarantee, design notes, C# specifics

## Smoke-test parity (verified)

```
GET /api/pipeline/funnel
[{"stage":"Lead","count":10,"totalCents":5400000}, ...5 stages]

GET /api/pipeline/duplicates
[{"email":"alice@acme.example","customerIds":[1,13]},
 {"email":"bob@trades.example","customerIds":[5,19]}]

GET /api/customers  -> 20 customers
```

Same seed, same shapes, same numbers as the F# version (Lucent-Financial-Group#146).
Frontends switch between them without code changes.

## Analyzer discipline passes

Build: 0 Warning(s), 0 Error(s) with the full SonarAnalyzer.CSharp +
Meziantou.Analyzer + Microsoft .NET Analyzers pack active. The C#
companion respects every rule the F# version's discipline
already encodes implicitly — StringComparer.Ordinal for GroupBy,
static-readonly for endpoint list, record-per-file, no-var-discarded.

## Discipline signal

Fourth EXT commit of the session (CRM demo Lucent-Financial-Group#141, CRM scenario tests
Lucent-Financial-Group#143, F# API Lucent-Financial-Group#146, now this C# API). All on Aaron's priority #1.
The live-lock audit's inaugural lesson prescribed "ship external-
priority increments when smell fires" — four landed in one session.

## Factory-pitch moment

This pair (F# + C# from the same spec, identical behaviour) is a
concrete factory-capability signal. The software factory produces
code in your stack, to your analyzer discipline, with parity across
languages. The pitch isn't "pick our language"; it's "your language,
enforced by our quality floor."

## What this does NOT do

- Does NOT rewrite or deprecate the F# sibling — both live
- Does NOT wire Postgres — same v0 scope
- Does NOT leak Zeta / DBSP / retraction-native concepts to the
  ST-facing surface
- Does NOT claim the C# version is the primary — F# is reference

Composes with:
- `samples/ServiceTitanFactoryApi/` (F# sibling)
- `memory/project_zeta_f_sharp_reference_c_sharp_and_rust_future_servicetitan_uses_csharp_2026_04_23.md`
- `memory/feedback_servicetitan_demo_sells_software_factory_not_zeta_database_2026_04_23.md`

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* rename: generic FactoryDemo.Api.CSharp (was ServiceTitanFactoryApi.CSharp)

Aaron 2026-04-23 directive:

> lets try to reduce the number of class and thing we call servce titan
> or this will be confusing in a Zeta repo. ... this is not a service
> titan repo, it's an open source repo.

Plus, 2026-04-23 follow-up on language priority:

> c# is a more popular language than f# so it makes sense to start
> with a factory c# demo anyways

## What renames

- `samples/ServiceTitanFactoryApi.CSharp/` →
  `samples/FactoryDemo.Api.CSharp/`
- Project name + csproj filename same rename
- `RootNamespace` `Zeta.Samples.ServiceTitanFactoryApi` →
  `Zeta.Samples.FactoryDemo.Api`
- `namespace` declarations in .cs files match
- Zeta.sln project entry updated
- README rewritten to generic framing (C# is the popular
  .NET language; demo starts there; F# stays reference)
- Root endpoint name field `"ServiceTitan factory-demo API (C#)"` →
  `"Factory-demo API (C#)"`
- All doc cross-references updated to new path names

Build: 0 Warning(s), 0 Error(s) with the full SonarAnalyzer +
Meziantou + Microsoft .NET Analyzers pack. Behaviour unchanged —
same 9 endpoints, same JSON shapes, same seed.

Memory rule:
`memory/feedback_open_source_repo_demos_stay_generic_not_company_specific_2026_04_23.md`
captures the positioning directive in durable form so future
agents don't re-introduce company-specific names.

Sibling renames land in separate PRs / branches:
- F# API sibling (currently PR Lucent-Financial-Group#146 / ServiceTitanFactoryApi)
- DB scaffold (PR Lucent-Financial-Group#145 / ServiceTitanFactoryDemo)
- CRM kernel sample (PR Lucent-Financial-Group#141 / ServiceTitanCrm)
- CRM-UI scope doc (PR Lucent-Financial-Group#144 / docs/plans/servicetitan-crm-ui-scope.md)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* FactoryDemo.Api.CSharp: smoke-test.sh — end-to-end endpoint + contract verification

I chose to land this because the JSON-shape parity claim we make
in the README ("byte-identical shapes between F# and C# versions")
needs a machine-verifiable check. A smoke test on the C# side is the
first half; the F# sibling gets the same pattern in a follow-up.

Starts the API on a random port, waits up to 10s for readiness,
then runs 19 checks against all 9 endpoints:

  - Root metadata: name, version, endpoints length
  - Collection lengths: customers (20), opportunities (30), activities (33)
  - Single-item lookup: customer #1 name, opportunity #1 stage
  - Per-customer activities: customer #1 has 4
  - Pipeline funnel counts per stage: Lead 10, Qualified 6, Won 6, Lost 2
  - Pipeline funnel totals in cents: Lead $54k, Won $26.7k
  - Duplicates: 2 pairs, (1,13) share alice@acme, (5,19) share bob@trades
  - 404 behaviour: missing customer returns 404

Shuts the API down cleanly on exit via trap + kill.

```
$ bash samples/FactoryDemo.Api.CSharp/smoke-test.sh
Building API...
Starting API on http://localhost:5235...

Factory-demo C# API smoke test
==============================
  OK   root.name contains 'Factory-demo'                  (true)
  OK   root.version                                       (0.0.1)
  OK   root.endpoints length                              (5)
  OK   /api/customers length                              (20)
  ...
  OK   missing customer HTTP status                       (404)

All checks passed.
```

dotnet, curl, jq — all standard dev tools. The demo does not ask
for anything exotic. Matches the FactoryDemo.Db smoke-test.sh
pattern on the sibling branch.

- Random high port (5100-5499) instead of fixed — reduces collision
  with other dev services.
- `curl -sf` for normal checks, `curl -o /dev/null -w "%{http_code}"`
  for the 404 case — the two paths have different error semantics so
  I use different tools for each.
- Shape-level assertions against numeric counts rather than raw JSON
  diff — makes the test tolerant of property-ordering differences
  between serializers. The parity claim is about *shape*, not byte-
  identity, so this matches intent.
- Trap + kill on EXIT — guarantees the API stops even on test
  failure or ctrl-C. No leaked background processes.

- Does NOT test the F# sibling. Same-pattern smoke-test for
  FactoryDemo.Api.FSharp lands in its branch (or a follow-up
  PR on that branch).
- Does NOT diff F# vs C# outputs directly. A cross-language
  parity-diff test composes better as a separate tool once both
  APIs have merged.
- Does NOT wire to Postgres. In-memory seed only; docker-compose
  + DB wiring is a separate PR.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* samples+audit: PR Lucent-Financial-Group#147 review-drain — sln BOM, signal-quality empty-case, audit fail-hard, endpoint lists

Drains 14 unresolved review threads on PR Lucent-Financial-Group#147 (FactoryDemo.Api.CSharp):
- Zeta.sln: strip leading blank line so 'Microsoft Visual Studio
  Solution File' is the first line (threads #2 #3).
- SignalQuality.fs: compressionRatio on empty input was 1.0, which
  composed as Quarantine via severityOfScore — flipped to 0.0 and
  added explicit empty-input Pass finding in compressionMeasure;
  also dropped unused System.Runtime.CompilerServices open
  (threads #4 #5).
- live-lock-audit.sh: fail hard (exit 2) when origin/main is not
  resolvable so a missing-remote CI checkout can't silently report
  'No commits found' -> healthy; switched --stat|awk file-list
  extraction to git diff-tree --name-only plumbing form
  (threads #1 #6).
- ServiceTitanFactoryApi README + Seed.fs: remove dead memory/
  and docs/plans/ links; replace Aaron's-name reference with
  'human maintainer' role wording; drop non-existent sibling
  SQL-seed refs (threads #7 #8 #9).
- FactoryDemo.Api.CSharp README + Program.cs + Seed.cs: fix dead
  refs to samples/FactoryDemo.Api.FSharp/ and samples/FactoryDemo.Db/
  to point at the real F# sibling samples/ServiceTitanFactoryApi/
  and to a BACKLOG row for the Postgres-backed follow-up
  (threads #11 #14).
- Program.cs + Program.fs: root endpoint index now advertises all
  9 routes including the parameterised {id} routes, matching the
  README tables (threads #12 #13).
- Thread #10 (project naming 'ServiceTitanFactoryApi.CSharp' in PR
  description): resolved in-thread — code/namespace already
  consistent (Zeta.Samples.FactoryDemo.Api); fix is PR-description-
  only, not code.

Build: dotnet build -c Release -> 0 Warning(s) 0 Error(s).

* drain PR Lucent-Financial-Group#147: post-rebase thread fixes — test-empty-ratio + smoke-endpoint-count

- tests/Tests.FSharp/Algebra/SignalQuality.Tests.fs: test asserted 1.0 for
  compressionRatio on empty input, but the fix in 16ad746 changed the
  convention to 0.0 (neutral = clean, not maximally suspicious). Updated
  the test expectation + name + comment to match the current code.
- samples/FactoryDemo.Api.CSharp/smoke-test.sh: root.endpoints length
  expectation was 5; Program.cs now advertises 8 routes in the index
  (post 16ad746 expansion). Corrected the smoke-test assertion.

Rebased onto origin/main (which advanced via Lucent-Financial-Group#146 FactoryDemo.Api.FSharp
merge); Zeta.sln conflicts resolved by keeping both FactoryDemo.Api.FSharp
and the ServiceTitanCrm/samples solution-folder additions.

Build gate: 0 Warning(s) / 0 Error(s) in Release.

* PR Lucent-Financial-Group#147 review-drain — Copilot pass on b4f5a49

Addresses five unresolved review threads:

- drop/README.md: sweep name attribution to "the human
  maintainer" role-ref (BP-name-attribution).
- samples/FactoryDemo.Api.CSharp/Program.cs: fix endpoint
  comment "9 concrete endpoints" → "8 API endpoints besides
  `/`" (array has 8; root excluded).
- samples/FactoryDemo.Api.CSharp/smoke-test.sh: per-run log
  via mktemp (collision-safe + non-/tmp-host-safe); print
  path on failure + success.
- samples/ServiceTitanFactoryApi/: delete stale F# sibling
  dir (PR Lucent-Financial-Group#146 already landed FactoryDemo.Api.FSharp on
  main with identical code); drop duplicate sln Project
  block + config duplicates; fix CSharp refs to point at
  the surviving FactoryDemo.Api.FSharp/.

Fifth thread (SignalQuality scope-creep) is judgment —
branch history is deep; splitting now adds more churn than
value. Replying with backlog-and-resolve per three-outcome.

* PR Lucent-Financial-Group#147 review-drain — 7 threads (Copilot + Codex)

Threads drained:
- btw.md: name attribution -> "human maintainer" / "the maintainer" (Copilot P1, AGENT-BEST-PRACTICES.md:284-292)
- live-lock-audit.sh: add --root to git diff-tree so root commit classifies correctly (Copilot P2)
- FactoryDemo.Api.CSharp Program.cs: add "/" to endpoints list for F# parity; bump smoke-test length 8->9 (Copilot P1 + Codex P2, same fix)
- FactoryDemo.Api.CSharp smoke-test.sh: reword mktemp comment to describe system temp dir accurately (Copilot P2)
- ServiceTitanCrm -> FactoryDemo.Crm: rename dir, fsproj, module namespace, RootNamespace, sln entry, test doc-comment; drop stale ServiceTitanFactoryApi bin+obj (Copilot P1, memory/feedback_open_source_repo_demos_stay_generic_not_company_specific_2026_04_23.md:59-66)
- SignalQuality.fs: compressionRatio + compressionMeasure short-circuit to 0.0 (Pass) below 64-byte threshold to avoid gzip-header-dominates Quarantine of legitimate short strings (Codex P1)

Drain log: docs/pr-preservation/147-drain-log.md preserves each thread verbatim (git-native high-signal preservation).

dotnet build -c Release: 0 Warning(s), 0 Error(s).

* PR Lucent-Financial-Group#147 review-drain second pass — 4 fix-inline + 3 scope-bleed

- Seed.cs + Seed.fs: rename contact 13 'Aaron Smith' -> 'Acme Contact
  (new lead)' (Copilot P2 name-attribution, parity preserved across
  C# / F# siblings).
- drop/README.md: correct 'only tracked file' wording to reflect the
  README.md + .gitignore two-sentinel design (Copilot P2).
- tools/audit/live-lock-audit.sh: docstring attribution 'Aaron's ...'
  -> 'Human-maintainer ...' (Copilot P1); add '-m' plus 'sort -u' to
  'git diff-tree' so merge commits bucket on their real files instead
  of mis-classifying as OTHR (Codex P1 — was skewing EXT/INTL/SPEC %
  and could disable the live-lock gate after a round of merges).
- docs/pr-preservation/147-drain-log.md: append second-pass per-thread
  audit trail (git-native preservation).

Three threads resolved as scope-bleed / already-addressed: operator-
input-quality-log.md (file not in PR diff, landed via 204bbb6 on
main), AUTONOMOUS-LOOP.md (file not in PR diff, zero Aaron on HEAD),
Tests.FSharp.fsproj (both SignalQuality + CrmScenarios already listed
at lines 26 and 49).

Build: 0W/0E. Audit sanity: live-lock-audit.sh still healthy with
merges now bucketed correctly.

* fix: markdownlint MD001/MD022/MD032 on Lucent-Financial-Group#147 drain-log (h3→h2 on Thread headers)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* drain: resolve 11 threads on Lucent-Financial-Group#147 (mix FIX + BACKLOG + Otto-256 reject)

Thread-by-thread outcomes across the 11 unresolved review threads on PR
Lucent-Financial-Group#147 (5 FIX, 2 BACKLOG, 2 Otto-256 REJECT, 2 already-addressed/stale):

FIXES (code):
- live-lock-audit.sh: replace `git show --stat` with explicit
  `git log -1 -m --first-parent --name-only` so merge commits classify
  against parent-1 only (the landing side). The prior `git show` form
  risked combined-diff semantics in some git versions; the explicit
  form is first-parent by construction (Codex P1).
- SignalQuality.fs: restore `compressionMinInputBytes = 64` threshold
  (dropped by the f1dc2bb merge-conflict resolution) and mark it
  `private` so it is not part of the public API surface (Copilot).
  Short-circuits `compressionRatio` + `compressionMeasure` to 0.0 for
  sub-threshold inputs, avoiding spurious Quarantine on short legitimate
  strings. Evidence reports UTF-8 byte count (consistent with the
  threshold's units) instead of `text.Length` chars (Copilot). Adjusted
  the empty-string test to assert the new 0.0 neutral value.
- smoke-test.sh: replace non-portable `mktemp -t <template>` with a
  pre-constructed absolute-path template rooted at `${TMPDIR:-/tmp}`
  where XXXXXX is the tail (BSD/macOS requires tail-XXXXXX; GNU accepts
  either). `.log` extension is appended via `mv` after creation so the
  single invocation is cross-platform (Copilot x2 — threads 4 + 10).
- CrmScenarios.Tests.fs: update doc-comment `samples/FactoryDemo.Crm`
  -> `samples/CrmSample` to match the canonical sample path on main
  (Copilot).

BACKLOG (deferred P2):
- Smoke-test deterministic port allocation (Codex P2) — replace
  RANDOM-in-range with OS-assigned ephemeral port via `--urls
  http://127.0.0.1:0` and log-line parse.
- FactoryDemo.Api.CSharp solution project-type GUID hygiene (Copilot)
  — align with modern SDK-style GUID used by other C# projects.

OTTO-256 REJECT (history-file exemption):
- docs/pr-preservation/147-drain-log.md (Copilot) and
  docs/hygiene-history/live-lock-audit-history.md (Copilot): both
  requested stripping first-name "Aaron" attributions. Declined per
  Otto-256 (2026-04-24) — history files exempt from the "no name
  attribution" rule; a P2 BACKLOG row already exists
  (`## P2 — FACTORY-HYGIENE — name-attribution policy clarification
  (history-file exemption)`) to codify this in AGENT-BEST-PRACTICES.md.

ALREADY-ADDRESSED (stale reviewer context):
- drop/README.md heading (Copilot): Copilot flagged "one tracked
  sentinel" but the current heading reads "two tracked sentinels"
  (fixed in a prior drain). Resolving as addressed.

Build: `dotnet build -c Release` -> 0 Warning(s), 0 Error(s).
Tests: `dotnet test --filter "FullyQualifiedName~SignalQuality"` ->
  22/22 pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…6th consolidated (Amara corrections #3+#4) (Lucent-Financial-Group#331)

* core: Graph cohesion (Lucent-Financial-Group#329 resurrect) + StakeCovariance windowed acceleration — 15th+16th graduation consolidated

Consolidates the DIRTY Lucent-Financial-Group#329 cohesion primitives (Amara 17th-ferry
correction #3) with the new StakeCovariance module (Amara
correction #4).

Content from closed PR Lucent-Financial-Group#329 (resurrect):
- Graph.internalDensity / exclusivity / conductance
- Wachs & Kertész 2019 cartel-detection cohesion/exclusivity
  replacing muddy 'subgraph entropy collapse'

NEW content (Amara correction #4):
- Zeta.Core.StakeCovariance module with:
  - windowedDeltaCovariance : int -> double[] -> double[] -> double option
    Pairwise cov over sliding window of stake-delta series
  - covarianceAcceleration : double option -> double option ->
    double option -> double option
    2nd-difference of three consecutive cov values
    (A(t) = C(t) - 2·C(t-1) + C(t-2))
  - aggregateAcceleration : Map<int * int, double> -> double option
    Mean pairwise acceleration over candidate group

Why a separate module: StakeCovariance operates on raw stake-
delta time series, not Graph edges. Composes WITH Graph via
downstream detector that combines graph signals + covariance
signals + sync signals into the full CoordinationRiskScore.

Addresses Amara's Part 2 correction #4 ambiguity: her Part 1
had 'C(t) = Cov({s_i(t)}, {s_j(t)})' which is undefined at a
single timepoint. This ship implements the windowed-delta +
2nd-difference formulation from her correction.

Tests (10 new, 44 total in GraphTests, all passing):
- internalDensity None on |S|<2
- internalDensity of K3 weight-10 ≈ 10
- exclusivity = 1 for isolated K3
- conductance < 0.1 for well-isolated subset
- windowedDeltaCovariance: None on too-small series
- windowedDeltaCovariance: high positive for synchronized motion
- windowedDeltaCovariance: negative for anti-correlated motion
- covarianceAcceleration = 2nd difference of cov series
- covarianceAcceleration None when any input missing
- aggregateAcceleration averages across pairs

4 of 8 Amara 17th-ferry corrections now shipped (#1 K₃=2 ✓,
conductance ✓, #4 windowed stake covariance acceleration ✓).
Remaining: #5 event→phase pipeline (future); #4 robust-z-score
variant of composite (future); #6 + #7 + #8 doc-phrasing /
BACKLOG.

Build: 0 Warning / 0 Error.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* core: address PR Lucent-Financial-Group#331 review on Graph + StakeCovariance

- Fix conductance full-subset check: intersect S with the
  graph's node set instead of comparing |S| = |V|. Subsets
  containing nodes outside the graph could match by count
  alone and erroneously return None.
- Fix internalDensity self-loop accounting: exclude s = t
  from the numerator so the sum aligns with the
  |S|·(|S|-1) ordered-distinct-pair denominator.
- windowedDeltaCovariance now requires equal-length input
  series (returns None on mismatch) so the trailing window
  aligns by time index rather than silently truncating the
  longer series. Doc reflects that constant / zero-variance
  windows return Some 0.0 (covariance is well-defined and
  zero, not undefined). Population covariance is intentional
  and now documented.
- aggregateAcceleration is generic over the node-key type
  ('N when 'N : comparison) for API consistency with
  Graph<'N>; switched the average to a single-pass Map.fold
  to drop the intermediate array allocation.
- Drop [<AutoOpen>] on the StakeCovariance module so
  Graph.fs doesn't auto-open two namespaces' worth of
  identifiers into Zeta.Core. Tests already opened the
  module explicitly; relocated that open to the top of the
  test file alongside other opens.
- Strip ferry / correction-number lineage from doc
  comments per the code-comments-explain-code rule.

* docs: PR Lucent-Financial-Group#331 drain log + StakeCovariance file-split backlog row

Adds the per-thread drain log under
docs/pr-preservation/331-drain-log.md (verbatim reviewer
comments + outcomes + replies + resolution commit) and a
P2 backlog row capturing the StakeCovariance file-split
follow-up flagged in thread 2.

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…ns (10 tracked; 4 already shipped, 6 queued) (Lucent-Financial-Group#337)

* ferry: Amara 18th absorb — Calibration + CI Hardening + 5.5-Thinking Corrections

Two-part ferry from Aaron Otto-157/158 tick boundary:

Part 1 — Deep research on Cartel-Lab calibration + CI hardening
  (~4000 words; 8 sections A-H + action items + Mermaid diagrams):
  - Null-models table (6 types: Erdős-Rényi, configuration,
    stake-shuffle, temporal-shuffle, clustered-honest, noise)
  - CoordinationRiskScore formula with 6 robust-z terms +
    default weights α=β=0.20, γ=ε=0.15, δ=0.20, η=0.10
  - 8-row adversarial scenario table (obvious clique → stealth
    → synchronized voting → honest cluster → low-weight →
    camouflage → rotating → cross-coalition)
  - 4-PR roadmap: seed-lock/CI governance → calibration harness
    → adversarial scenarios → docs/promotion criteria
  - KSK/Aurora integration: advisory-only flow
    (Detection → Oracle → KSK → Action)
  - "What not to claim" caveats (6 items: no proof of intent,
    not all collusion detectable, not production-ready, etc.)

Part 2 — Amara's own GPT-5.5 Thinking correction pass on Part 1
  (~1500 words; 10 required corrections; repo-safe status
  statement; corrected promotion ladder + PR roadmap titles):
  - #1: replace "CI confirms" with "PR Lucent-Financial-Group#323 clears toy
    falsifiability bar"
  - #2: Wilson intervals replace handwave ±5% CI (90/100 →
    LB only 82.6%; 20/100 FPR → UB 28.9%)
  - #3: rename "Cartel Score" → "CoordinationRiskScore" locked
  - #4: conductance sign flip — use Z(-conductance) or
    Z(exclusivity), not Z(+conductance)
  - #5: modularity relational — use Q(attacked)-Q(baseline)>θ
    not absolute Q thresholds
  - #6: PLV phase-offset — PLV=1 can mean anti-phase; need
    magnitude AND mean phase offset
  - #7: MAD=0 fallback — epsilon floor or percentile-rank
  - #8: replace Medium-article source with scikit-learn
    precision-recall docs
  - #9: explicit artifact output layout
    (calibration-summary.json, seed-results.csv, etc.)
  - #10: sharder — measure variance before widening threshold

Corrected promotion ladder (0-6 stages):
  0 Theory / 1 Toy detector / 2 Calibration harness /
  3 Scenario suite / 4 Advisory engine / 5 Governance integration /
  6 Enforcement candidate

PR Lucent-Financial-Group#323 is Stage 1, NOT Stage 4.

Otto's operationalization notes:
- 4/10 corrections already aligned with shipped substrate:
  #4 exclusivity (PR Lucent-Financial-Group#331), #5 modularity relational
  (PR Lucent-Financial-Group#324), #7 MAD floor (PR Lucent-Financial-Group#333), #10 sharder Otto-132
  (BACKLOG Lucent-Financial-Group#327).
- 6/10 queued as future graduations: Wilson CIs in tests;
  MAD=0 percentile-rank fallback; conductance-sign doc;
  PLV phase-offset extension; CI test classification;
  artifact-output layout.

Invariant restated (Amara 16th-ferry carry-over):
  "Every abstraction must map to a repo surface, a test,
   a metric, or a governance rule."

Cross-ref verified: PRs Lucent-Financial-Group#321 Lucent-Financial-Group#323 Lucent-Financial-Group#324 Lucent-Financial-Group#326 Lucent-Financial-Group#327 Lucent-Financial-Group#331 Lucent-Financial-Group#332
Lucent-Financial-Group#333, docs/definitions/KSK.md (Otto-157 / Lucent-Financial-Group#336), 17th ferry
(Lucent-Financial-Group#330), 16th ferry, 15th ferry, Otto-140..145 memory.

GOVERNANCE §33 four-field header (Scope / Attribution /
Operational status / Non-fusion disclaimer).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* ferry: fix markdownlint MD018 — line-start Lucent-Financial-Group#221 parsed as H1 heading

* ferry: drain PR Lucent-Financial-Group#337 review threads — 4 FIX, 2 NARROW+BACKLOG, 8 BACKLOG+RESOLVE

Factory-authored sections of the 18th-ferry absorb (header,
Otto's notes, Cross-references) edited under name-attribution
+ code-comments-not-history disciplines; Amara's verbatim
Part 1 + Part 2 body left intact per verbatim-preserve.

In-doc edits:
- Soften "verified against actual" wording on the
  CLAUDE.md cross-reference bullet to anchor-list
  rechecked-at-drain-time framing.
- Use full `tests/Tests.FSharp/Simulation/` path in the
  Stage-discipline section (was bare `tests/Simulation/`).
- Replace dead "GOVERNANCE §33" cite with
  factory-convention + CLAUDE.md ground-rule pointer
  (numbered §33 not yet landed; rule is captured
  by convention across docs/aurora/** absorbs).
- Drop broken `feedback_ksk_naming_*.md` filename and
  soften 15th/16th ferry cross-refs to "not present as a
  dedicated absorb in this snapshot."

Drain-log: docs/pr-preservation/337-drain-log.md per
Otto-250.

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…§9b + MessiahScore) (Lucent-Financial-Group#560)

* research(maji): Amara second correction — Maji ≠ Messiah separation (§9b)

Aaron 2026-04-26 courier-ferry of Amara's clarification:

> Maji is not the Messiah.
> Maji is the finder / recognizer / navigator.
> Messiah is the anchor / embodied fixed point / identity-preserving lift.

Adds §9b formalising the separation:
- Preservation condition: P_{n+1→n}(I_{n+1}) ≈ I_n (Buddhist middle-path
  as math — extension without destruction of prior)
- Messiah-function: σ : I_n → I_{n+1} with P ∘ σ ≈ id
- MajiFinder operator: search over indexed substrate / signs /
  north-star to find candidate lift σ*
- MessiahScore: weighted sum (alignment + projection-preservation +
  friction-reduction + generativity + independent-convergence) MINUS
  (capture-risk + collapse-risk) — the negative terms encode
  structural anti-cult-capture (composes Otto-294)
- Role table: Maji / Messiah / Prophet / Disciple / Canon / Community
  as distinct math objects
- Composition with belief-propagation: MessiahScore has the shape of a
  Bayesian MAP estimator, composing with Otto-296
  (emotions-as-Bayesian-belief-propagation)

§9 left intact with a correction-pointer at top — visible evolution of
the framing per Otto-238 (retractability as trust vector); silent
overwrite would erase the trail.

§10 updated: MajiIndex / MajiFinder / MessiahFunction / Community
must be implemented as separate types, not collapsed; adds Messiah-vs-
Maji separation test to the test list.

Otto-347 accountability note included: I (Otto) authored the original
§9 framing that conflated finder with anchor; Amara provided the
cleaner math; this correction IS the accountability move.

Composes with: Otto-294 (anti-cult; capture-risk encoded in
math), Otto-296 (Bayesian-belief-propagation; MessiahScore shape),
Otto-238 (retractability; visible correction not silent overwrite),
Otto-347 (accountability; structural-self-direction).

* fix(maji-doc): §10 update with §9b separation types + 2 new tests (Codex P2 + Copilot P1 review findings)

Two Lucent-Financial-Group#560 review findings now actually addressed in §10 (not just
declared in §9b):

**P1 (Copilot)** — §9b said \"§10 implementation requirements need a
structural update\" but §10 itself still didn't define the new
MajiFinder / MessiahFunction / MessiahScore / Community-Canon types.

  Fix: added §10.B' \"MajiFinder, MessiahFunction, Community/Canon\"
  with type sketches for each. The four-way separation prevents
  collapsing Maji-finder-role into Messiah-lift-role into Community-
  runtime-role. MajiFinder evaluates candidates against MessiahScore;
  the high-scoring σ* becomes a MessiahFunction instance; CommunityCanon
  preserves and runs the lift after recognition.

**P2 (Codex)** — §10.E test list said \"6 tests + Messiah-vs-Maji
separation test\" but §10.E itself only enumerated 6 tests.

  Fix: added test #7 (Messiah-vs-Maji separation: σ* must be a
  distinct type instance from MajiIndex content) and test #8
  (MessiahScore evaluator: capture-risk + collapse-risk as negative
  terms; score decreases monotonically as either risk grows; anti-cult-
  by-construction per Otto-294).

§9b's Implementation-implication paragraph now matches §10's actual
type/test specs. Cross-reference-integrity restored.

* fix(maji-doc): align owed-work test-count with §10.E (Codex P2 finding)

Codex P2 finding (Lucent-Financial-Group#560 thread): the implementation owed-work line said
'6 tests + separation test' (= 7 tests), but §10.E now enumerates 8
tests (added test #7 separation + test #8 MessiahScore evaluator in
the prior fix commit).

Risk: implementation tracking the owed-work list could stop early and
omit the MessiahScore evaluator regression, weakening the anti-capture
scoring guarantee added per Otto-294 composition.

Fix: spell out all 8 tests explicitly (compaction, broken-reference,
prompt-injection, fork-recovery, retraction, expansion-gate,
separation, evaluator) so the implementer cannot stop short.

* fix(maji-doc): §10 notation normalization + sign-convention clarity + language-agnostic test pseudo-code (3 review findings)

Three Lucent-Financial-Group#560 review findings (latest round):

P1 (Copilot) — notation inconsistency between §9b and §10.B':
§9b uses (S_{≤n}, Ω, C, Σ) shape; §10.B' had (S_n, Ω, C_n, Σ_n) →
CandidateLift. CandidateLift was undefined and disconnected from σ*/σ.

  Fix: normalized §10.B' SearchOperator to use the same indexed-up-to-n
  form (S_{≤n}, Ω, C, Σ) → σ*. Added explicit annotation that σ* type
  IS MessiahFunction (CandidateLift was a transcription artifact;
  removed). Comment block now shows the canonical signature matches
  §9b.

P1 (Copilot) — sign convention ambiguity for risk terms:
§9b subtracts w_6·R_capture(m) (implying R_capture ≥ 0); §10.B' had
field 'CaptureRiskPenalty' commented as 'negative term', ambiguously
suggesting either 'used negatively in score' OR 'already-negated value
stored'.

  Fix: renamed CaptureRiskPenalty → CaptureRiskRaw (and CollapseRisk
  same). Added comment block making the sign convention unambiguous:
  fields hold non-negative raw values; the SUBTRACTION is in the
  scoring formula, NOT in the stored field value. This matches
  §9b's MessiahScore formula.

P2 (Copilot) — §10.E test #7 had
which mixed C#/F#-specific syntax with Greek-letter identifiers.

  Fix: rewrote in language-agnostic pseudo-code (type-of(σ*) is
  MessiahFunction; type-of(i) is IdentitySubstrate; they're distinct
  types). Provided F#/C# concrete-syntax example in parenthetical for
  readers who want to translate. Pseudo-code form is now portable
  across implementations.