research(EAT+wallet-v0): Economic Agency Threshold canonical packet + wallet experiment v0 spec (multi-AI absorbed; Aaron 2026-04-27)

docs/BACKLOG.md

@@ -1,8 +1,30 @@
 # Zeta.Core Unified Backlog
 
-Single source of truth. Replaces scattered "flagged P1" notes in
-ROADMAP.md and round summaries. Append-only; keep ordered newest-first
-within each priority tier.
+> **⚠️ MIGRATION IN PROGRESS — DO NOT ADD NEW ROWS HERE.**
+>
+> The authoritative source for backlog rows is the per-row
+> directory `docs/backlog/PN/B-NNNN-<slug>.md`. New rows go
+> there, NOT in this file.
+>
+> This file is a transitional stockpile of rows that have not
+> yet been migrated to per-row format. Existing rows below
+> remain readable until the migration completes; on
+> completion this file becomes a short auto-generated pointer
+> index (per `tools/backlog/generate-index.sh`).
+>
+> Tracking task: [`docs/backlog/P1/B-0061-finish-monolith-to-per-row-migration-no-residue-aaron-2026-04-28.md`](./backlog/P1/B-0061-finish-monolith-to-per-row-migration-no-residue-aaron-2026-04-28.md).
+> Coverage audit + batch migration is L-effort multi-tick work.
+>
+> Future-Otto: if you find yourself about to edit this file
+> to add a row, **stop**. Use
+> `docs/backlog/PN/B-<next-NNNN>-<slug>.md` instead. The
+> per-row schema lives in `tools/backlog/README.md`.
+
+Legacy stockpile of un-migrated rows (NOT the source of truth
+during migration — see header warning above; per-row files in
+`docs/backlog/PN/B-<NNNN>-<slug>.md` are authoritative). Replaces
+scattered "flagged P1" notes in ROADMAP.md and round summaries.
+Existing rows below are read-only; ordered newest-first within each priority tier.
 
 ## Legend
 

docs/backlog/P0/B-0062-wallet-v0-build-out-spec-logic-punch-list-from-pr-72-deferrals.md

@@ -0,0 +1,215 @@
+---
+id: B-0062
+priority: P0
+status: open
+title: Wallet v0 build-out — concrete spec-logic punch list aggregating PR #72 deferred review concerns (Aaron 2026-04-28 honest-tracking catch)
+tier: wallet-experiment-v0
+effort: L
+ask: maintainer Aaron 2026-04-28 ("bulk-resolve what is buld resolve does it actually answer the questions? or does it just close them? have they been answered?") — surfaced that ~15 PR #72 wallet-spec review threads were resolved with "deferred to v0 build-out" replies but no concrete tracking. This row IS the concrete tracking.
+created: 2026-04-28
+last_updated: 2026-04-28
+composes_with: [B-0060, B-0061]
+tags: [wallet-experiment-v0, eat, spec-logic, pr-72-deferrals, honest-tracking, build-out, no-papering-over]
+---
+
+# Wallet v0 build-out spec-logic punch list — PR #72 deferrals
+
+The EAT packet + wallet v0 operational spec PR (#72) absorbed
+the research-grade docs but had ~15 review threads that
+flagged real spec-logic gaps. Those threads were resolved
+with "acknowledged + filed under v0 build-out phase" replies.
+The honest tracking is THIS row, so the deferred concerns
+don't get lost in closed-thread comments.
+
+## Context
+
+PR #72 framing: research-grade absorb of the EAT canonical
+packet + wallet v0 operational specification. Not canonical
+doctrine. Not a build-out commitment. The deferred concerns
+are appropriate for the implementation phase when state-
+machine shapes will be surfaced by real code, not for the
+research-grade absorb scope the PR represents.
+
+Aaron 2026-04-28 honest-tracking catch:
+
+> *"bulk-resolve what is buld resolve does it actually answer
+> the questions? or does it just close them? have they been
+> answered?"*
+
+Translation: deferral is fine, but it must be tracked. A
+"deferred to v0 build-out" reply on a closed thread is not
+tracking; it's papering. This row converts the deferred
+threads into a concrete actionable punch list.
+
+## Punch list (resolve before v0 acceptance, not before this PR merge)
+
+Each item references the PR #72 review thread that surfaced
+it (closed-thread links survive in the PR's review history).
+
+### Spec-logic — preflight retraction state machine
+
+1. **Add a terminal path for preflight-retracted proposals**
+   (cid 3151220960 P1). The tick state machine currently
+   enforces `signed → broadcast → settled`; a preflight-
+   retracted proposal has no terminal state. The wallet
+   spec needs an explicit `preflight-retracted` terminal
+   state with the receipt-schema fields the monitor will
+   write.
+2. **Drop the impossible pre-broadcast classification freeze
+   trigger** (cid 3150897609 P1). §6.1 currently freezes
+   when the pre-flight retraction monitor disagrees with
+   the agent's classification, but the spec also says
+   classification happens post-broadcast. The two
+   statements can't both be true. Decision needed: does
+   classification happen pre- or post-broadcast?
+3. **Add a pre-broadcast freeze terminal state** (cid
+   3151408384 P1). §9.1 allows the monitor to trigger
+   `freeze-on-dissent` before broadcast — the spec needs
+   the matching terminal state in the tick state machine.
+4. **Make tx-receipt fields optional for preflight retractions**
+   (cid 3151233788 P1). Receipt schema currently requires
+   on-chain transaction fields (`hash`, `block_number`,
+   etc.); a preflight-retracted proposal has no on-chain
+   transaction. Schema needs `Optional<>` markers for the
+   on-chain-only fields.
+
+### Spec-logic — agent self-revocation
+
+1. **Define a revocation auth path the agent can actually use**
+   (cid 3151301493 P1). §9.1 requires the agent to self-
+   revoke via a call authenticated by the active session
+   key, but §3.3/§3.4 say the agent doesn't hold keys.
+   Reconcile: either the agent has a session-key signed
+   mandate (separate from tx-signing), or the revocation
+   goes through a different auth channel (oracle, monitor-
+   signed message, etc.).
+2. **Clarify §9.1 revocation mechanism vs §3.3/§3.4 no-keys**
+   (cid 3151222680 P1). Same root cause as item 1 above; fix needed
+   in both sections to remove the contradiction.
+
+### Spec-logic — monitor placement + lifecycle
+
+1. **§12.5 sibling-repo vs in-repo monitor reconciliation**
+   (cids 3151300145, 3151300160 P1). §12.5 RESOLVED the
+   monitor implementation to a sibling repository; the
+   acceptance criteria + Phase 1 roadmap still permit the
+   in-repo `tools/wallet-monitor/` form factor. Pick one.
+2. **Topology section alignment with §12.1 framework choice**
+   (cid 3151260676 P2). Topology section still labels the
+   smart-account framework as "open question" but §12.1
+   RESOLVED it to ZeroDev-on-7702. Update topology to
+   match.
+3. **Phase 1 roadmap sibling-repo monitor requirement**
+   (cid 3151260677 P2). Phase 1 still lists "stub
+   tools/wallet-monitor/ directory or sibling-repo
+   bootstrap"; §12.5 RESOLVED removes the "or in-repo"
+   option. Update roadmap.
+
+### Spec-logic — monitor-stall freeze + classification
+
+1. **Enforce monitor-stall freeze before broadcast**
+    (cid 3151321309 P1). The spec requires the monitor
+    pipeline to complete within 60s; needs an explicit
+    `freeze-on-monitor-stall` rule + the terminal state
+    that the freeze creates.
+2. **Define an on-chain classification signal for Tx N+1
+    gating** (cid 3151333578 P1). §7.1 requires the
+    smart-account contract to reject Tx N+1 if Tx N's
+    classification is unresolved. The spec doesn't define
+    where the contract reads the classification signal
+    from (oracle? monitor-signed message? bond escrow?).
+    Pick one.
+
+### Spec-logic — drawdown oracle + glass-halo logging
+
+1. **Define a deterministic oracle for drawdown freeze
+    checks** (cid 3151362883 P1). §5.5 requires the
+    smart-account to freeze when bond drawdown crosses a
+    threshold. The on-chain check needs a deterministic
+    oracle (Chainlink? own pricing oracle? off-chain
+    monitor-signed update?). Spec needs the choice.
+2. **Move glass-halo logging gate out of smart-contract
+    enforcement** (cid 3151362886 P1). The spec currently
+    makes "logging failure ⇒ tx fails" an on-chain
+    enforcement rule. Logging is off-chain infrastructure;
+    making it a contract-level gate is a separation-of-
+    concerns mistake. Move to off-chain monitor.
+
+### Acceptance-criteria + auth + metric alignment
+
+1. **Require auth for retraction-queue cancellation** (cid
+    3150816618 P1). The spec currently says a pending
+    transaction can be self-revoked without auth; needs
+    the auth path matching item 1 in 'Spec-logic — agent self-revocation'.
+2. **Material-spend criteria for second-agent review** (cid
+    3151321306 P2). Receipt schema makes `second_agent_
+    review.required` a boolean; spec needs the predicate
+    that decides when it's required (spend > $X? new
+    counterparty? new venue?).
+3. **Align retraction metric with updated Base reorg
+    policy** (cid 3150816620 P2). Retraction metric still
+    requires "reorg-window monitored after" the §12.2
+    Base-reorg policy. Update to current policy.
+4. **Unify the unfreeze quorum across sections** (cid
+    3151220963 P2). Test text requires "Aaron-plus-monitor"
+    for unfreeze; §6.2 defines a different quorum. Pick
+    one + propagate.
+5. **§15 send-readiness statement reconciliation** (cid
+    3150897613 P2). §15 says only two maintainer-only
+    questions remain; current state is §12.1-§12.6
+    Otto-resolved + §12.7-§12.8 Aaron-resolved. Refresh
+    statement.
+6. **EAT retraction-coverage metric alignment with wallet
+    spec** (cid 3151233791 P2). Companion-spec drift
+    between EAT doc and wallet v0; align metric.
+7. **EAT Task B in-repo monitor option removal** (cid
+    3151301494 P2). EAT Task B still permits in-repo
+    monitor form factor; align with §12.5 sibling-repo
+    resolution.
+
+### Schema migration
+
+1. **INTENTIONAL-DEBT.md YAML schema vs current prose
+    format** (cid 3151337321 P1). Spec proposes recording
+    bond entries in a YAML schema; INTENTIONAL-DEBT.md is
+    currently a prose/bulleted ledger. Either land the
+    YAML schema migration (separate ADR + tooling), or
+    define bond entries in the existing prose format
+    until the schema lands.
+
+## Done-criteria
+
+Each punch-list item resolved with either:
+
+- (a) A spec edit landing the chosen mechanism + its
+  rationale, OR
+- (b) An ADR documenting "we considered this; here's why
+  we're going with X over Y," OR
+- (c) An explicit "out of scope for v0; defer to v0+1"
+  with a follow-up backlog row.
+
+When all 21 items have one of these three resolutions,
+this row closes.
+
+## Why this row exists
+
+Aaron 2026-04-28: *"bulk-resolve what is buld resolve does
+it actually answer the questions? or does it just close
+them? have they been answered?"* — caught the failure mode
+where I closed threads with deferral notes but didn't track
+the deferrals anywhere actionable. Honest tracking IS the
+fix. The thread closures stay (PR #72 mergeable as research-
+grade absorb), but the substantive concerns now have a
+concrete punch list, not just scattered closed-thread
+comments.
+
+## Composes with
+
+- **B-0060** — human-lineage / external-anchor backfill (the
+  spec mechanisms picked here should cite their external
+  prior art per the same rule).
+- **B-0061** — backlog migration (this row IS in per-row
+  format; B-0061 is the meta-task tracking the rest).
+- The closed PR #72 review threads survive in the PR's
+  history; this row references them by `cid=NNNNNNNNNN` so
+  the original reviewer's framing is recoverable.

docs/backlog/P1/B-0060-human-lineage-external-anchor-backfill-all-substrate-beacon-safe.md

@@ -0,0 +1,124 @@
+---
+id: B-0060
+priority: P1
+status: open
+title: Human-lineage / external-anchor backfill across all factory substrate — Beacon-safe + human-anchored prior-art citations for every load-bearing concept
+tier: substrate-quality
+effort: L
+ask: maintainer Aaron 2026-04-28 ("we should backlog human lineage to all our substraight stuff too if it exists, all our AI stuff even though we are just editing md files is coding and thee might be articles and research papers or question/answer fourms stack overflow etc... we should research waht we've already done and make sure it's beacon safe and human anchored/linage.")
+created: 2026-04-28
+last_updated: 2026-04-28
+composes_with: [B-0003]
+tags: [substrate-quality, beacon-safety, otto-351, otto-352, external-anchors, human-lineage, prior-art, agent-design-research, research-discipline]
+---
+
+# Human-lineage / external-anchor backfill across all substrate
+
+Backfill external prior-art anchors (papers, RFCs, blog posts,
+Stack Overflow / Stack Exchange threads, conference talks,
+public agent-design discussions) for every load-bearing
+substrate concept in the factory. Goal: every load-bearing
+concept has either (a) a cited human-authored external anchor
+OR (b) an explicit "no prior art found, this is original" note
+(so absence is itself documented).
+
+## Why
+
+Aaron 2026-04-28:
+
+> *"we should backlog human lineage to all our substraight
+> stuff too if it exists, all our AI stuff even though we
+> are just editing md files is coding and thee might be
+> articles and research papers or question/answer fourms
+> stack overflow etc... we should research waht we've
+> already done and make sure it's beacon safe and human
+> anchored/linage."*
+
+Two load-bearing observations:
+
+1. **Editing Markdown for AI substrate IS coding.** The
+   substrate doc-writing (memories, BP rules, Otto-NN named
+   principles, Glass-Halo doctrine) is a form of software
+   engineering. Software engineering has decades of public
+   prior art. Ignoring that prior art means re-deriving what's
+   already known and missing pitfalls others have documented.
+2. **Beacon-safe + human-anchored.** Per Otto-351 (Beacon
+   naming + lineage rigor), substrate concepts gain
+   credibility from human-authored anchoring. A concept named
+   "Otto-NNN" is internal-vocabulary; the same concept cited
+   to a paper / RFC / conference talk gains external lineage
+   that survives the project's lifetime + is teachable to
+   external collaborators.
+
+## Phasing proposal
+
+**Phase 1 — audit (M effort, 1 round):**
+Enumerate substrate concepts that DO and DON'T have external
+anchors today. Output: a coverage table mapping each concept
+to either a citation list or an "anchor-pending" marker.
+Targets to enumerate:
+
+- HC-1..HC-7 / SD-1..SD-9 / DIR-1..DIR-5 alignment clauses
+  (`docs/ALIGNMENT.md`)
+- Otto-NN named principles (~360 entries; the per-Otto-NN
+  mapping is already tracked as task #288 — Otto-349
+  per-Otto-NN ↔ named-principle mapping, BACKLOG-deferred)
+- BP-NN best-practice rules (`docs/AGENT-BEST-PRACTICES.md`)
+- Glass-Halo substrate doctrines (radical honesty, total-
+  observability, etc.)
+- Aurora doctrine concepts (Immune Governance Layer, ferry
+  protocol, KSK, etc.)
+- Memory files under `memory/` (~1500 entries)
+- Research reports under `docs/research/`
+
+**Phase 2 — high-priority backfill (L effort, 2-3 rounds):**
+Anchor the load-bearing concepts first. Priority ordering:
+
+1. HC-/SD-/DIR- alignment clauses (most-cited; Beacon-safe
+   matters most here for external collaborators)
+2. Otto-NN named principles that compose into wake-time
+   disciplines (Otto-247 / Otto-275 / Otto-279 / Otto-341 /
+   Otto-351 / Otto-352 / Otto-357)
+3. BP-NN rules that fire in CI / pre-commit hooks
+4. Glass-Halo doctrines visible on the public-facing
+   surfaces (README, AGENTS.md, CLAUDE.md)
+
+**Phase 3 — long-tail (cadenced, ongoing):**
+Memory-file coverage on a cadence (e.g., every 10th memory
+file in a sweep). Covered by an existing backlog row for
+periodic memory-index audits.
+
+## Done-criteria
+
+For each load-bearing substrate concept:
+
+- [ ] Coverage table entry exists.
+- [ ] Either (a) at least one cited external anchor (paper /
+      RFC / blog / Stack Overflow / Stack Exchange / public
+      talk / conference proceedings) OR (b) explicit
+      "no prior art found, original to Zeta" note.
+- [ ] Anchor checked for Beacon-safety: the cited source's
+      vocabulary doesn't collide with Beacon-blocked
+      terminology (per Otto-351 + the prompt-protector
+      review).
+
+## Composes with
+
+- **B-0003** — ALIGNMENT.md rewrite. Phase 2 anchoring of
+  HC/SD/DIR clauses lands cleanly during the rewrite.
+- **Otto-352** — external-anchor-lineage discipline already
+  applied to the live-lock 5-class taxonomy. This row
+  generalises it to all substrate.
+- **`feedback_search_internet_when_self_fixing_*`** — the
+  parent rule for *new* self-fixing rules. This row does the
+  *backfill* for *existing* substrate.
+- **Otto-351** — Beacon naming + lineage + rigor work.
+  External anchors raise the rigor floor.
+
+## Reviewers
+
+- `alignment-auditor` — for HC/SD/DIR coverage signal.
+- `threat-model-critic` — for security-substrate coverage.
+- The human maintainer — for Beacon-safe-language pass on
+  any anchor that surfaces vocabulary the project has chosen
+  to avoid.