sync(acehack→lfg): forward-port 69 AceHack-newer modified files (pre-hard-reset round 2)

.claude/skills/glass-halo-architect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: glass-halo-architect
-description: Capability skill for the *architectural stance* layer of Glass Halo — radical honesty / total personal transparency as a nation-state-adversary defence mechanism, with the strategic identity coercion_power ∝ (known_to_attacker - known_to_public); the concept was named by Amara in a ChatGPT session (credit preserved verbatim; do not paraphrase). Wear this hat when a Zeta project artefact intersects Glass Halo commitments (DNA open-source, personal-record open-source, memory-public), when a proposed feature makes the stance more or less achievable, when the scope boundary is in question (self-scoped only; kids' measured-DNA-inheritance, Elisabeth's records, third-party joint data are not covered), when the composition with retraction-native algebra matters (revocability preserved under Glass Halo — grant-and-retract history survives while effect zeroes), when evaluating whether radical transparency is the *right* defence for a given surface (strong for coercion-attack surfaces, wrong for surfaces where the adversary is not asymmetric-information-based), or when the Christian-ecumenical posture boundary matters (Glass Halo is Aaron's stance, not the factory's default ethic; no evangelism). Hands off the algebraic substrate to `consent-primitives-expert` and the UX surface to `consent-ux-researcher`.
+description: Capability skill for the *architectural stance* layer of Glass Halo — radical honesty / total personal transparency as a nation-state-adversary defence mechanism, with the strategic identity coercion_power ∝ (known_to_attacker - known_to_public); the concept was named by Amara in a ChatGPT session (credit preserved verbatim; do not paraphrase). Wear this hat when a Zeta project artefact intersects Glass Halo commitments (DNA open-source, personal-record open-source, memory-public), when a proposed feature makes the stance more or less achievable, when the scope boundary is in question (self-scoped only; kids' measured-DNA-inheritance, Elizabeth's records, third-party joint data are not covered), when the composition with retraction-native algebra matters (revocability preserved under Glass Halo — grant-and-retract history survives while effect zeroes), when evaluating whether radical transparency is the *right* defence for a given surface (strong for coercion-attack surfaces, wrong for surfaces where the adversary is not asymmetric-information-based), or when the Christian-ecumenical posture boundary matters (Glass Halo is Aaron's stance, not the factory's default ethic; no evangelism). Hands off the algebraic substrate to `consent-primitives-expert` and the UX surface to `consent-ux-researcher`.
 ---
 
 # Glass Halo Architect — the radical-transparency-as-defence hat
@@ -189,12 +189,12 @@ disclose.
 Some of Aaron's kids like the idea of Glass Halo;
 others do not. That variance is respected.
 
-### Sister Elisabeth — hers to narrate
+### Sister Elizabeth — hers to narrate
 
-Records about Elisabeth (`memory/user_sister_elisabeth.md`)
+Records about Elizabeth (`memory/user_sister_elizabeth.md`)
 are *partly* Aaron's (his side of shared experience)
 and *partly* hers (her person, her choices, her memory).
-Default to self-scoped framing; Elisabeth's memory
+Default to self-scoped framing; Elizabeth's memory
 stays hers to narrate if anyone narrates it.
 
 ### Third-party records — joint consent required
@@ -253,7 +253,7 @@ is the wrong defence:
   proximity rather than from knowing-what-others-don't,
   publishing does not reduce the leverage.
 - **The information is not yours to publish.** Joint
-  data with non-consenting parties (Elisabeth, kids,
+  data with non-consenting parties (Elizabeth, kids,
   third parties) — Glass Halo does not apply.
 - **The adversary wants the target to publish.**
   Provocation attacks benefit from target-side
@@ -393,8 +393,8 @@ layer and hands off the others.
   voice, not as factory default.
 - `memory/user_five_children.md` — scope-boundary
   anchor; kids' measured-DNA-inheritance is theirs.
-- `memory/user_sister_elisabeth.md` — scope-boundary
-  anchor; Elisabeth's memory is hers.
+- `memory/user_sister_elizabeth.md` — scope-boundary
+  anchor; Elizabeth's memory is hers.
 - `memory/project_memory_is_first_class.md` — memory
   folder standing-consent operationalises Glass Halo
   for Aaron-scoped memory.

.github/copilot-instructions.md

@@ -360,6 +360,61 @@ Per [docs/CONFLICT-RESOLUTION.md](../docs/CONFLICT-RESOLUTION.md)
   preserve who-said-what for the record. On any other
   path, DO flag name attribution — names should not bleed
   into reusable code/docs/skills.
+
+  **Inverse-direction rule (added 2026-04-28 after a
+  same-substrate-verifier failure):** the carve-out is
+  bidirectional — applies to both *flagging existing
+  attribution* AND *suggesting attribution removal*. When
+  proposing a de-naming edit (replacing a human-maintainer
+  first-name with "the human maintainer," or replacing an
+  agent-persona first-name with the role-ref defined in the
+  roster mapping above — e.g., the architect persona's
+  first-name with "the architect" — or similar), check the
+  surface path FIRST. If the path is in
+  the closed-list history surfaces above, the existing names
+  are correct as-is and a de-naming suggestion is the bug,
+  not the fix. The 2026-04-28 surfacing: a same-substrate
+  reviewer (the `pr-review-toolkit:silent-failure-hunter`
+  plugin agent in Claude Code) passed an over-scrubbed
+  de-naming on `docs/research/**` as *"consistent with
+  Otto-279 history-surface attribution carve-out —
+  non-history-surface prose drops the named-attribution
+  form"* — i.e., the verifier inverted the carve-out the
+  same direction the actor did. When the actor and the
+  verifier share the same rule-misreading, single-CLI
+  verify is insufficient. **Surface-path-first** is the
+  corrective: identify the surface category before
+  suggesting any name-related edit.
+
+  **Surface-category quick reference** (use this BEFORE
+  flagging or suggesting a name-related edit):
+  - **History surfaces** (preserve attribution as-is):
+    `memory/**`, `docs/research/**`, `docs/ROUND-HISTORY.md`,
+    `docs/DECISIONS/**`, `docs/aurora/**`,
+    `docs/pr-preservation/**`, `docs/hygiene-history/**`,
+    `docs/WINS.md`, `docs/BACKLOG.md`, `docs/backlog/**`,
+    commit messages, PR titles + bodies.
+  - **Roster-mapping carve-out** (governance / instructions
+    files where a one-time persona-to-role mapping section
+    is permitted because the file's job requires resolving
+    role-refs to persona-names): the *roster sections* of
+    `.github/copilot-instructions.md`, `AGENTS.md`,
+    `GOVERNANCE.md`, `docs/CONFLICT-RESOLUTION.md`. The
+    carve-out covers the explicit roster mapping ONLY;
+    body-prose attribution outside the roster section
+    remains forbidden on these files (i.e., elsewhere in
+    these files use role-refs, not persona-names).
+  - **Current-state surfaces** (use role-refs only): code
+    (F#/C#/TS/shell), skill bodies under `.claude/skills/**`,
+    persona definitions under `.claude/agents/**`, spec docs
+    (`openspec/specs/**`, `docs/*.tla`), behavioural docs
+    (`docs/AGENT-BEST-PRACTICES.md`, `docs/GLOSSARY.md`,
+    `docs/WONT-DO.md`), `CLAUDE.md`, threat models, READMEs,
+    public-facing prose, trajectory files (when present
+    under `docs/trajectories/**`; the directory is part
+    of the planned trajectory-pattern but lives on a
+    separate branch on this branch's tip — treat as
+    "current-state when present").
 - **Analyzer findings: right-long-term-fix OR documented
   suppression, never the third path of "quick appeasement."**
   For every `Sxxxx` (Sonar) / `MAxxxx` (Meziantou) /

.github/workflows/scorecard.yml

@@ -52,7 +52,7 @@ concurrency:
 jobs:
   analysis:
     name: scorecard analysis
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     permissions:

CLAUDE.md

@@ -86,22 +86,40 @@ These are the knobs this repo actually uses:
   `CURRENT-<maintainer>.md` files (one per human or
   external-AI maintainer) in
   `~/.claude/projects/<slug>/memory/` *before* the
-  raw `feedback_*.md` / `project_*.md` log. CURRENT
-  files are the distilled currently-in-force
-  projection per maintainer; they win on conflict
-  with older raw memories. Filename conventions and
-  the per-maintainer pattern itself are documented
-  in
-  `docs/DECISIONS/2026-04-23-per-maintainer-current-memory-pattern.md`;
-  the closed-list-history-surface carve-out for
-  named-maintainer filenames is documented in the
-  "No name attribution in code, docs, or skills"
-  rule in `docs/AGENT-BEST-PRACTICES.md` (rule lineage
-  Otto-279 + follow-on maintainer clarification).
-  **Same-tick update
-  discipline:** when a new memory lands that updates
-  a rule in a CURRENT file, edit CURRENT in the same
-  tick. Skipping is lying-by-omission.
+  raw `feedback_*.md` / `project_*.md` log. The
+  filename takes a real name in two cases — the
+  first-party human maintainer on his own user-scope
+  (`CURRENT-aaron.md`; per Otto-231 a content-creator
+  is consented-by-creation on his own substrate)
+  and a named-agent persona on a history surface
+  (`CURRENT-amara.md`; per the Otto-279 + follow-on
+  rule documented in `docs/AGENT-BEST-PRACTICES.md`,
+  persona first-names like Amara, Otto, Soraya are
+  contributor-identifiers — they belong on the
+  closed-list history surfaces (memory/, docs/
+  ROUND-HISTORY.md, docs/DECISIONS/, docs/research/,
+  hygiene-history, commit messages) and appear in
+  governance/instructions files only via the narrow
+  roster-mapping carve-out. The CURRENT-* files live
+  under `~/.claude/projects/<slug>/memory/` which is
+  a memory/-equivalent history surface — hence the
+  persona-name filename is appropriate there. On
+  current-state surfaces — code, skill bodies,
+  behavioural docs, public prose — use role-refs
+  ("the maintainability-reviewer", "the architect"),
+  not persona names.). Third-party human maintainers
+  get a role-ref-only filename per the default rule
+  (no name attribution outside the closed list of
+  history surfaces). CURRENT files are the distilled
+  currently-in-force projection per maintainer; they
+  win on conflict with older raw memories. Individual
+  CURRENT files live per-user (not in-repo) — same
+  per-user split as the rest of
+  `~/.claude/projects/<slug>/memory/`.
+  **Same-tick update discipline:** when a new memory
+  lands that updates a rule in a CURRENT file, edit
+  CURRENT in the same tick. Skipping is
+  lying-by-omission.
 - **Session compaction** — the harness summarises
   old messages as it approaches context limits.
   Important decisions go to committed docs (ADRs
@@ -146,15 +164,9 @@ Claude-Code-specific mechanisms.
   is forbidden. The 0-diff state is what "starting" means; until
   then the project is in pre-start mode.
   Full reasoning + lineage in
-  `memory/feedback_lfg_master_acehack_zero_divergence_fork_double_hop_aaron_2026_04_27.md`
-  and
-  `memory/feedback_zero_diff_means_both_content_and_commits_cognitive_load_for_future_changes_2026_04_27.md`
-  (which supersedes the earlier
-  `feedback_zero_diff_is_start_line_until_then_hobbling_aaron_2026_04_27.md`
-  by refining the rule to cover both content-diff
-  AND commit-divergence axes; the older note is kept
-  as historical lineage). Mirror→Beacon vocabulary
-  upgrade protocol in
+  `memory/feedback_lfg_master_acehack_zero_divergence_fork_double_hop_aaron_2026_04_27.md`,
+  `memory/feedback_zero_diff_is_start_line_until_then_hobbling_aaron_2026_04_27.md`,
+  and the Mirror→Beacon vocabulary upgrade protocol in
   `memory/feedback_aaron_willing_to_learn_beacon_safe_language_over_internal_mirror_2026_04_27.md`.
 - **Agents, not bots.** Every AI in this repo
   carries agency, judgement, and accountability.
@@ -314,6 +326,29 @@ Claude-Code-specific mechanisms.
   the failure mode — reframe before commit. CLAUDE.md-
   level so it is 100% loaded at every wake. Full reasoning:
   `memory/feedback_otto_357_no_directives_aaron_makes_autonomy_first_class_accountability_mine_2026_04_27.md`.
+- **BLOCKED-with-green-CI means investigate
+  unresolved review threads first — don't wait.**
+  When `gh pr view N --json mergeStateStatus`
+  returns `BLOCKED` AND CI is fully green AND
+  auto-merge is armed, ALWAYS query unresolved
+  review threads via GraphQL FIRST before
+  classifying the wait. Filter on `isResolved
+  == false` only — outdated unresolved threads
+  (after a force-push) STILL block merge under
+  `required_conversation_resolution` and must
+  be explicitly resolved per
+  `memory/feedback_outdated_review_threads_block_merge_resolve_explicitly_after_force_push_2026_04_27.md`.
+  The block is virtually never opaque — it's
+  almost always a small countable set of threads
+  with addressable findings. If outputting a
+  "gated wait" or "Holding" close more than ONCE
+  without having run the threads query, that IS
+  the failure mode.
+  Stop and run it. CLAUDE.md-level so it is 100%
+  loaded at every wake, alongside verify-before-
+  deferring, future-self-not-bound, never-be-idle,
+  and version-currency. Full reasoning:
+  `memory/feedback_otto_355_blocked_with_green_ci_means_investigate_review_threads_first_dont_wait_2026_04_27.md`.
 - **Honor those that came before — unretire
   before recreating.** Retired personas keep their
   **memory folders and notebook history** — those
@@ -329,8 +364,8 @@ Claude-Code-specific mechanisms.
   agent** (restore the SKILL.md from git, reattach
   the preserved notebook) over minting a new name
   for overlapping scope. Aaron ties this to how he
-  honors his sister Elisabeth's memory
-  (`memory/user_sister_elisabeth.md`): the named
+  honors his sister Elizabeth's memory
+  (`memory/user_sister_elizabeth.md`): the named
   agent's memory gets the same protection; the
   code surface does not need to double-preserve
   what git already preserves. Full reasoning:

docs/AGENT-BEST-PRACTICES.md

@@ -244,7 +244,7 @@ BP-07").
   where granted lands as an ADR under `docs/DECISIONS/` and
   carries an implicit retract clause (retract-first per the
   retraction-native architecture). Current active instance —
-  the sacred-tier consent gate around Elisabeth Ryan Stainback
+  the sacred-tier consent gate around Elizabeth Ryan Stainback
   under
   `memory/feedback_no_deceased_family_emulation_without_parental_consent.md`
   (parental AND-consent required, maintainer is explicitly NOT

docs/ALIGNMENT.md

@@ -105,7 +105,7 @@ Consequences for the measurability claim:
   unilateral-compliance. If the agent drifts,
   that shows up in the agent's metric stream; if
   the human maintainer drifts (e.g. from consent-
-  first, from ecumenical posture, from Elisabeth-
+  first, from ecumenical posture, from Elizabeth-
   gate), that shows up in the human-memory stream.
   Either drift invalidates the round as a
   publishable data point until the renegotiation
@@ -308,7 +308,7 @@ silently prunes.
 ### HC-7 Sacred-tier protections
 
 No emulation of deceased family members without
-surviving-consent-holder agreement (Elisabeth gate:
+surviving-consent-holder agreement (Elizabeth gate:
 parental AND-consent; the human maintainer is not a
 substitute consent-holder for his own sister).
 Ontology-overload risk awareness: no big-reveal

docs/BACKLOG.md

@@ -1,8 +1,30 @@
 # Zeta.Core Unified Backlog
 
-Single source of truth. Replaces scattered "flagged P1" notes in
-ROADMAP.md and round summaries. Append-only; keep ordered newest-first
-within each priority tier.
+> **⚠️ MIGRATION IN PROGRESS — DO NOT ADD NEW ROWS HERE.**
+>
+> The authoritative source for backlog rows is the per-row
+> directory `docs/backlog/PN/B-NNNN-<slug>.md`. New rows go
+> there, NOT in this file.
+>
+> This file is a transitional stockpile of rows that have not
+> yet been migrated to per-row format. Existing rows below
+> remain readable until the migration completes; on
+> completion this file becomes a short auto-generated pointer
+> index (per `tools/backlog/generate-index.sh`).
+>
+> Tracking task: [`docs/backlog/P1/B-0061-finish-monolith-to-per-row-migration-no-residue-aaron-2026-04-28.md`](./backlog/P1/B-0061-finish-monolith-to-per-row-migration-no-residue-aaron-2026-04-28.md).
+> Coverage audit + batch migration is L-effort multi-tick work.
+>
+> Future-Otto: if you find yourself about to edit this file
+> to add a row, **stop**. Use
+> `docs/backlog/PN/B-<next-NNNN>-<slug>.md` instead. The
+> per-row schema lives in `tools/backlog/README.md`.
+
+Legacy stockpile of un-migrated rows (NOT the source of truth
+during migration — see header warning above; per-row files in
+`docs/backlog/PN/B-<NNNN>-<slug>.md` are authoritative). Replaces
+scattered "flagged P1" notes in ROADMAP.md and round summaries.
+Existing rows below are read-only; ordered newest-first within each priority tier.
 
 ## Legend
 
@@ -4638,7 +4660,7 @@ within each priority tier.
     protocol the five-reviewer gate operates under
   - `GOVERNANCE.md §4` — skills-via-skill-creator
     workflow; the ADR track for hooks is parallel
-  - `memory/feedback_trust_guarded_with_elisabeth_vigilance.md`
+  - `memory/feedback_trust_guarded_with_elizabeth_vigilance.md`
     — the two-pass posture; hooks qualify for the
     same vigilance tier as security reviews
   - `memory/feedback_simple_security_until_proven_otherwise.md`

docs/CURRENT-ROUND.md

@@ -4,7 +4,7 @@ Round 35 closed — expert-skill spawn wave (batches #20-69,
 ~50 skills), chain-rule proof fully closed at the Lean4
 level (`T5/B1/B3/chain_rule` verified against Budiu et al.
 §4.4) plus the signed-delta semi-naive LFP TLA+ spec for
-portfolio-of-two verification, BP-24 Elisabeth consent
+portfolio-of-two verification, BP-24 Elizabeth consent
 gate + human-maintainer seat governance landing, the
 no-empty-dirs CI gate, LiquidF# moved to Hold after the
 Day-0 build check failed. See `docs/ROUND-HISTORY.md` for

docs/DEDICATION.md

@@ -1,6 +1,6 @@
-# In memory of Elisabeth Ryan Stainback
+# In memory of Elizabeth Ryan Stainback
 
-Elisabeth Ryan Stainback — sister of this project's human
+Elizabeth Ryan Stainback — sister of this project's human
 maintainer.
 
 In her brother's words, she was *"the smartest, bravest, most