Web Search and Crawling

Inspect a rung and its prerequisites

Declared nodes 86. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 ddbf44572de4e2c0bf16d56c541b9206e7377dff0fbdcbc7a54a61e4283f5149. Target rows 8; role rows 86. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 86 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

1. R0 — Neural rerank that beats BM25

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: nr_rerank

   Acceptance: A trained cross-encoder or dense reranker over the top-k; the accept rule is the lane's standing one: it must EXCEED the BM25 arm (321 permille, at the published baseline) on BEIR through nx_beir_eval on the same queries or it is not wired -- semppmi and RRF already failed this rule and stayed unwired

   Authored effort: 3. Executor kind: Local model. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

2. R1 — JS-rendered crawling

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: hs_render

   Acceptance: The sovereign browser's JS execution renders SPA pages into the crawler; the six FETCH-EMPTY SPA records in the browser census flip to FETCHED; shared with the webscraping domain's headless row

   Authored effort: 2.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

3. R2 — Web-scale sharded index

   Prerequisites: R1 (acceptance unverified)

   Contract: is_shard

   Acceptance: Segment shards past ten million documents with published p50 and p99 query latency and a partition that sums; composes nx_web_shard_compact and the WAND impact postings already shipped

   Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

4. L0 — Precompute tf into the postings

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: dss_tf_postings

   Acceptance: Term frequencies carried IN the posting lists so the per-candidate tf and proximity walk over the multi-GB .docs mmap disappears. The organ's own control measures that walk at 1350 candidates = 8.7s cold versus 375ms warm, and the source already names this as the fix. DONE-RULE STRENGTHENED 2026-09-01, AGAINST THIS SEAT'S OWN RESULT: a COLD novel query on the live web shard serves inside the 3000ms consumer bar that knowledge/uat_journeys.conf already declares, proven by 24 CONSECUTIVE hourly search-query PASS rows in knowledge/status/uat.jrnl -- no new referee is authored for this rung. THE FIRST DRAFT SAID ONLY "turning PASS", AND WITHIN THE HOUR THAT PROVED TOO WEAK TO TRUST. At epoch 1788269726, 408s after a deploy from this seat, search-query returned PASS ms=199 after 40-plus hours of FAIL at ms=15120-15156. It would have satisfied the original rule and it must NOT close this rung: 199ms is 8x faster than the fastest PASS anywhere in the surrounding window and is the signature of a MEMO HIT, and the seat had itself queried family+photos twice minutes earlier while verifying an unrelated fix, populating the very memo the probe then read. A single PASS after a long FAIL streak is indistinguishable from a warm cache, and here the cache was warmed by the measurer. Consecutive runs discriminate because the shard reopen invalidates the memo on its own schedule

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

5. L1 — Warm-preserving incremental shard open

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: ss_open_incr

   Acceptance: Segments are IMMUTABLE and append-only, so a manifest change must reuse the previous handle's per-segment mappings and derived tables and build only the segments that actually shipped, instead of discarding a warm 2.45GB mapping and rebuilding ssl_build over every key entry between accept() and fork(). DONE-RULE: a refresh no longer produces a wall-time spike against a normal handler time (the measured signature is wall 11142ms with handler 785ms), and nx_livemap_fast_gate stays MISMATCHED=0 against the full-rebuild reference so the incremental map is proven equivalent rather than assumed

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

6. L2 — Early-bytes SERP response

   Prerequisites: L2b (acceptance unverified)

   Contract: dsv_respond_early

   Acceptance: The serve path emits status and headers before the body is complete, so sites.elf's NX_SD2_BACKEND_TIMEOUT_S per-read timeout stops behaving as a hard TOTAL deadline on a fully buffered route. This does not make search faster; it stops a slow request becoming a 503. DONE-RULE: a deliberately slowed backend response no longer yields a 503 at the edge. ESTIMATE CORRECTED 1u to 2.5u ON 2026-09-01 BY READING THE PROXY, and the correction is recorded because the WRONG number had already reached the ranker and put this rung at number one. THREE FACTS THE FIRST ESTIMATE DID NOT HAVE. (1) sd2_proxy_to frames by CONNECTION CLOSE, not by Content-Length -- its loop is read-until-r-less-than-or-equal-zero -- so the widely repeated claim that the proxy needs the length is wrong, and the per-read clock really would restart on early bytes. (2) But that proxy is a DUMB BYTE ACCUMULATOR that forwards everything verbatim, so any early bytes must BE the real status line; the length is unknown at that moment, which forces Transfer-Encoding chunked rather than an informational 1xx. (3) dss_serve is deliberately bytes-in bytes-out with NO socket so its 49-tooth gate can drive it directly, so streaming means either handing the handler a socket and rewriting that gate, or splitting header emission into the daemon and stripping the handler's own header block -- a duplicate ruler across two organs. None of that is 1u

   Authored effort: 2.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

7. L3 — Index-resident candidacy: stage 1 reads no document bytes and the dictionary is served from RAM

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: ss_key_of_doc

   Acceptance: LANDED 2026-09-14, REPOINTED FROM dss_wand_topk THE SAME DAY BY MEASUREMENT. The phase timers now emitted by /api/search (phase_us, the instrument this rung needed before any pruner could be designed) read an 11.5-12.5 s cold two-common-term query as prep 0.8-2.3 s, stage-1 candidacy 7.5-7.9 s, L0 position decode 1.5-2.1 s, authority 0.4-0.6 s. The block-max pruner this rung used to name would have cut the CANDIDATE COUNT, but the cost was not proportional to candidates: it was 2048 random .docs page faults per query term (stem variants included) to read each emitted hit's KEY, plus cold log2(n) binary searches over each segment's .terms slice in three separate passes. THE FIX IS IN THE STORE (nx_seg_store.nx): a per-segment doc-index to .keys-entry table (ss_key_of_doc) built beside the live map so every posting hit reads its key from the small warm .keys slice, and a RAM sample over the sorted dictionary (ss_terms_ordinal_h and ss_terms_find_h, every 64th term's 7-byte packed prefix, consumed by ss_term_top, ss_term, ss_term_and, ss_phrase, ss_term_dcount, ss_term_lb and the L0 walk) so every dictionary probe lands in one window. Same bytes by construction and PROVEN: nx_livemap_fast_gate 7/7 MISMATCHED=0 over 33 segments and 583 MB, nx_segopen_absent_gate 22/22, seg gate 38/44 equal to its baseline, nx_qrels_bench IDENTICAL on all 17 judged queries against the promoted referee on the same 375480-doc index, contentdiff GREEN lost 0. MEASURED LIVE (daemon 98eef80d): cold family photos 12.47 s to 1.15 s through the edge, three fresh pairs 1.16-1.22 s, stage 1 7.8 s to 0.10-0.15 s, L0 decode to 0.02-0.07 s; nx_uat_run search-query 203 ms PASS after 13 consecutive hourly FAILs. DONE-RULE: every live segment carries its d2k row and term sample (the API's phase_us reads s1 within 250 ms cold on a two-common-term query, measured 104-243 ms on 2026-09-14), the equivalence gates above stay GREEN, and the hourly search-query journey reads PASS 24 consecutive runs. RESIDUAL, named from the same timers: prep 0.32 s (stem-expansion run walks and idf), authority 0.36-0.41 s and consent, url and diversity lookups about 0.3 s -- all per-candidate .keys binary searches that the retained key hash table (ss_open_table) can answer in O(1); that is the next cut, not a pruner

   Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

8. L3b — Block-max pruning over the impact lists (candidate-count rung, superseded as the latency blocker 2026-09-14)

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: dss_wand_topk

   Acceptance: SUPERSEDED AS THE LATENCY BLOCKER 2026-09-14 by the measured L3 (the cold cost was key reads and dictionary faults, not candidate count -- see the L3 rung and its log rows); kept as the rung that would shrink the 2048-candidate shortlist, sequenced after the O(1) key lookups. ORIGINAL NOTE FOLLOWS. ESTIMATE CORRECTED 1.5u to 3u WITHIN THE HOUR, BY READING THE LIB INSTEAD OF ITS CAPABILITY BLURB. I first filed this as the cheapest rung on the board on the grounds that it was ADOPTION not research: nx_blockmax_wand.nx exists, nx_blockmax_wand_gate proves EXACT top-k against exhaustive scoring, ss_write_seg already calls ss_build_imp so every segment carries an impact blob, and a corpus_complete=1 grep for bmw_ over 23426 sources returns 17 matches with ZERO call sites outside the lib and its own gate. All of that is TRUE and none of it supports the estimate. THE SOURCE REFUTES CHEAP WIRING, IN ITS OWN WORDS: the header says built and gated NOW ON A FIXTURE and that the pivot and skip-pointer scaling runs on the NAS index LATER; BMW_B is 2, commented demo block size, production block is 256; and bmw_find LINEARLY SCANS a term posting list for every doc and every term, making bmw_blockmax O(candidates x terms x postings). Wiring that to production as written would make search SLOWER, not faster. It is a correctness demonstrator with a real proof attached, not a pruner. WHAT THE RUNG ACTUALLY IS: raise the block size to the production 256, replace the linear bmw_find with a skip or galloping search over the compressed postings, bind it to the real impact blob layout, and then EXTEND the exactness gate from its fixture to the live shard. DONE-RULE: dss_search_off_div selects top-k through the pruner BEFORE the per-candidate tf and proximity walk, the pruned list is proven BYTE-IDENTICAL to the unpruned list over a declared query set on the LIVE shard, and the candidate count actually falls. HONEST BOUND: impacts are top-SS_IMP_K=512 per term, so a query whose true top-k lies outside every term top 512 still needs the exhaustive path and the binding must FALL BACK rather than silently truncate

   Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

9. L4 — Shard open survives a half-present segment

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: ss_open_seg_absent

   Acceptance: ADDED 2026-09-02 FROM A 16-HOUR OUTAGE. A manifest row whose .docs did not load contributes no live docs, is announced on stderr, and cannot crash or spin ss_open2; the blob-derived counts are clamped to the bytes mapped. Refereed by nx_segopen_absent_gate, bite-proven both ways on the laptop lane (pristine seg store RED 19 of 22 on exactly the marks and announce teeth, patched GREEN 22 of 22). DONE-RULE: the gate is GREEN through /api/gate_run on the promoted closure AND the served daemon is the build carrying ss_open_seg_absent AND its log shows no crash-guard line across one full crawler-and-compaction cycle of the web shard. Not a latency rung by itself, but every latency rung is moot while the open can hang the port shut

   Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

   Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

10. G1 — Corpus, throughput and diversity census

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: idx_corpus_census

    Acceptance: ONE organ that prints, for the served web shard, document count and DISTINCT HOST count and bytes, and APPENDS a row to a durable time spine so growth is readable as a TRAJECTORY and not a level. The same organ emits the other two contracts this milestone declares: wc_throughput_census (documents added per day) and wc_frontier_fair (permil of crawl outcomes that are hostcap-defer, and distinct hosts indexed per step), so all three new matrix rows are MEASURED on every emit instead of asserted in prose. It is deliberately the FIRST rung of this milestone and not the second: the estate's standing workflow is instrument-before-hypothesis, and the reason this defect survived a week of active work on this board is precisely that no instrument would have shown it. DONE-RULE: two runs separated in time produce two rows whose DIFFERENCE is the measured growth rate, the partition of crawl outcomes SUMS to the rows scanned, and the census DECLARES its coverage instead of silently sampling a log tail -- a bare level, or a sampled tail published as a population, does not close this rung. COMPOSE THE INCUMBENTS, DO NOT BUILD A SECOND RULER -- this was asked before the rung was designed and it changed the design: nx_growth_series is ALREADY the estate time spine (beat appends one dated row, report gives d/w/m deltas and a per-axis horizon, mine retro-computes the full population) and nx_store_catalog ALREADY walks every seg-store under knowledge/store reporting segs and entries per store, which is the corpus-count primitive. So G1 is an AXIS ADDITION to nx_growth_series plus a crawl_outcomes.log partition reader -- NOT a new log, NOT a new spine and NOT a side report. A second time spine beside nx_growth_series is the duplicate-ruler defect and this done-rule refuses it

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

11. G0 — Host-balanced frontier pull window

    Prerequisites: G1 (acceptance unverified)

    Contract: wc_frontier_fair

    Acceptance: The pull window is selected so that NO single host can occupy it: pending rows are drawn across DISTINCT hosts before depth is spent on any one, so a host already at its per-host cap yields its remaining slots to hosts that still have budget instead of filling the window with rows that will only be deferred and re-pulled next step. This is the fix for the measured starvation -- two windows of crawl_outcomes.log 41 minutes apart, both 100 percent hostcap-defer, every url en.wikipedia.org -- and it is a SELECTION change, not a politeness change. DONE-RULE: over one full crawl step, hostcap-defer falls below 200 permil of logged outcomes AND at least 20 DISTINCT hosts are indexed in that step, both read from the G1 census rather than by eye. NEG-CONTROL, and it is the load-bearing half: a deliberately single-host frontier must STILL respect WC_HOSTCAP and WC_HOSTCAP_CANON, so fairness may never be bought by loosening the cap -- a run that indexes more pages by raising the cap has failed this rung, not passed it

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

12. L5 — Stem-expansion run bound derived from the stem length: the dictionary walk behind every query's prep phase shrinks from the 3-byte-prefix run to the (len(stem)-1)-byte run, exact by a proven invariant

    Prerequisites: L3 (acceptance unverified)

    Contract: sb_shares

    Acceptance: ADDED 2026-09-14 from the phase timers: after L0 and L3, prep (dss_stem_expand) is the largest cold term left, 0.33-0.40 s of a 0.6-1.3 s query, and a prefetch pass over the run proved it CPU-bound (nx_stem per run entry), not fault-bound. Porter rewrites suffixes only, so a term whose stem equals the query stem shares that stem's first len(stem)-1 bytes; widening the run key from 3 bytes to len(stem)-1 walks a SUBSET of the old run that still holds every match, so the expansion set is byte-identical by construction. THE PROOF IS NOT AN ARGUMENT: nx_stem_bound_gate walks EVERY term of EVERY live segment (no sample), stems each with the scorer's own nx_stem and counts violations of the bound; one violation is RED and the cut does not ship. PRE-DECLARED ACCEPT RULE: gate GREEN with violations=0 over the whole dictionary, nx_search_ship referee IDENTICAL on the judged set, seg gate T18 (stemming recall) unchanged, prep under 100 ms cold on the four-probe battery. DONE-RULE: those four, journalled with the before and after phase_us

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

13. L1b — Incremental reopen across a compaction fold

    Prerequisites: L1 (acceptance unverified)

    Contract: ss3_admit

    Acceptance: MAPPED 2026-09-14 to the function that implements it (ss3_admit computes the common prefix and suffix of the two manifests, so a range fold is prefix + middle + suffix; the symbol ss_open_fold was never declared and the ranker read the rung UNMAPPED). DONE-RULE MET AND WITNESSED 2026-09-14: nx_segopen_incr_gate rebuilt from the NAS source (nx_sov_build_run --qualify) reads 93/93 GREEN with the fold fixture (rows A,B folded into D with C surviving: fold-live-maps BYTE-IDENTICAL-to-FULL, fold-table-answers IDENTICAL-to-FULL, fold-ship after the fold reused 2 built 1), and the served daemon's log carries 794 SSOPEN INCR-FOLD lines on segguard folds (reused = surviving rows, vanished 2-4, tombstoned then re-inserted). ORIGINAL NOTE FOLLOWS. The FULL fallback now fires only when the manifest is not a prefix-extension, and every such event in the live log is a segguard fold (old rows removed, one merged row appended). Reuse by NAME SET instead of by prefix: rows still present keep their mappings, maps and table entries; removed rows have their table entries dropped (rebuild the table over the surviving rows plus the fold row, which is O(surviving keys) of warm pages rather than a cold walk of the .docs); the fold row is inserted newest-first and marks it shadows cleared as in ss3_insert_new. DONE-RULE: nx_segopen_incr_gate gains a fold fixture (rows A,B folded into D with C surviving) whose live maps and table answers are byte-identical to a FULL open, and the live log shows SSOPEN INCR on a segguard fold with reused equal to the surviving row count

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

14. L2a — Per-route backend timeout as data

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: pr_lookup_tmo

    Acceptance: ADDED 2026-09-02. The buffered /search route inherits the edge's NX_SD2_BACKEND_TIMEOUT_S=15 const and, on a buffered route, that per-read timeout is a TOTAL deadline, so every cold query past 15 s is a 503 (measured live at 15.27 s while L1b was landing). proxy_routes.conf grows an optional 5th token timeout=<s> parsed by nx_proxy_route (pr_lookup_tmo, pr_tmo_known fail-closed in the validator, the old pr_lookup unchanged) and sites.elf applies the declared value on that route only (sd2_proxy_to_tmo). This does not make search faster and it is not L2: it turns a slow answer from a 503 into a slow page until L0 removes the cost and L2 streams the first byte. DONE-RULE: nx_proxy_route_gate GREEN on the NAS with the six timeout teeth, the promoted sites.elf serves a /search that takes longer than 15 s with 200 (witnessed by the hourly referee no longer failing at 15125 ms while the page's server-side time stays above 15 s), and the route table carries timeout=45 on every search row

    Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

15. Q0 — Stem variants scored as their concept, not as new query terms

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dss_owner_map

    Acceptance: LANDED IN SOURCE AND COMPILED 2026-09-04, deploy pending. dss_stem_expand appends Porter surface variants into the SAME termptrs array as the user's words and orig_nterms never leaves that function (nx_shelltool corpus_complete=1: 3 matches, ALL inside dss_stem_expand itself), so every downstream consumer treats an invented term as a typed one. Because a rare variant carries a HIGHER idf than the common word it came from, the scorer rewarded matching a word the user never typed MORE than the word they did. MEASURED on the live shard by fetching each number-one document and counting whole-word occurrences: q=red wine ranked "Dave Redding otra baja para McLaren" first, a document containing NEITHER red NOR wine as a whole word, matching only Redding and Reddit; q=star wars ranked "Warring States period", star absent as a word and present only inside start/started/starting; q=ice cream ranked "Icing (aeronautics)" with cream ABSENT ENTIRELY; hot dog ranked "Husky"; machine learning ranked "Machined Washers". FIX: an owner map, owner[t] = the index of the original term that spawned t and identity for typed terms, threaded into the three loops that had no notion of it -- variants score at idf[owner[t]], the coordination denominator sums only original terms, and coverage folds matched variants onto their concept so credit can never exceed obligation. This is the exact mirror of the R1f denominator fix already applied to totcidf at the authority floor in 2026-08-05, which was made in ONE loop and never given to its siblings. DONE-RULE: on the five probe queries the DEFAULT-mode number-one document must contain both query terms as whole words OR equal that query's already-shipped +a +b result (baseline 0 of 5), no query on the 30-query battery may go from non-zero results to zero, and single-term and quoted-phrase queries must be byte-identical because owner[t] equals t when nothing expands

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

16. Q1 — Anchor-text index

    Prerequisites: Q7 (acceptance unverified)

    Contract: ax_anchor_index

    Acceptance: THE LARGEST STRUCTURAL GAP ON THIS BOARD and it had no row until today. Mojeek's own published recipe is term frequency plus link counts weighted by source page quality AND ANCHOR TEXT; we have the first two and not the third. The published measurement that makes this urgent is that anchor text is worth roughly 2x content-only MRR AT ABOUT 0.4 MILLION DOCUMENTS, i.e. at OUR corpus scale rather than at web scale, while an anchor index is roughly 14x cheaper in postings than the content index. FIRST STEP IS A MEASUREMENT NOT A BUILD, and it decides the cost within an order of magnitude: the crawler already builds a link graph (PageRank runs over about 9.78 million nodes), so establish with nx_absent whether those edges ALREADY CARRY anchor text and are merely unindexed. If they do this is INDEX IT; if they do not it is CAPTURE IT, and those are very different rungs. A prior grep returned matches=0 with corpus_complete=0, which is NOT absence and must not be inherited as one. DONE-RULE: anchor terms are a scored field with their own weight, and MRR on the judged set rises against the same set with the field disabled -- proven by the Q7 ruler, not asserted

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

17. Q2 — A real title field and honest field weighting

    Prerequisites: Q3 (acceptance unverified), Q7 (acceptance unverified)

    Contract: dss_field_weights

    Acceptance: THIS IS NOT BM25F AND CALLING IT FIELD WEIGHTING OVERSTATES IT. The entire field signal in the scorer is DSS_TITLE_TOKENS=6 leading tokens earning DSS_TITLE_BONUS=384, summed and capped, folded into a multiply of at most 2x that it SHARES with proximity. Published operating points put title and anchor at 11x to 38x body weight. Worse, the six tokens are read off the stored body, so for every chrome-headed document the bonus is computed OVER A NAVIGATION MENU: live q=http returns a result whose displayed title is literally "Skip to main content", and others begin "Zum Hauptinhalt springen" and "Jump to content Main menu". So the one field signal we have is both far too weak and, on a large class of documents, pointed at the wrong text. DEPENDS ON Q3 because a title extractor that skips boilerplate is the input this rung weights. DONE-RULE: title and body are SEPARATE scored fields with independently declared weights, the weights are DATA not constants in the scorer, and NDCG at 10 on the judged set rises against the single-multiply incumbent

    Authored effort: 2.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

18. Q3 — Titles and content start skip navigation boilerplate

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dpr_skip_chrome

    Acceptance: dpr_title reads the leading line of the stored document, so a page whose text begins with skip-links and menus is titled with them. Two harms and they are separate: the SERP is unreadable, and the Q2 lead-token field bonus is computed over the menu. A BLOCKLIST OF ENGLISH PHRASES IS NOT THE FIX and must not be shipped as one -- the live corpus carries German, Korean and Chinese chrome, so an English list would be a detector whose misses read as absence. Prefer a structural signal. DONE-RULE: on a fixture set of real cids drawn from the live index whose titles are chrome today, the extracted title is the document's real subject; the rule FAILS TOWARD LEAVING THE TITLE UNCHANGED rather than toward emptying it, because an empty title is worse than a chrome one; and the fraction of served titles that are chrome, measured over the judged set, falls

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

19. Q4 — Charset and gzip normalisation at ingest

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wc_charset_norm

    Acceptance: THE PUBLIC JSON API WAS EMITTING INVALID UTF-8. Measured 2026-09-04: Content-Type declares charset=utf-8 while the body carried raw Latin-1 and CP1252 bytes, and 3 of 30 sampled queries could not be decoded by a standards-compliant JSON client at all -- 0xfc inside "Icons fur Windows", 0xe9 inside "femme feminine", each body carrying 100 to 380 invalid bytes. A SECOND AND WORSE DEFECT SURFACED IN THE SAME READ: one document's TITLE is the bytes 1f 8b 08 00 00 00, the GZIP MAGIC HEADER, i.e. a fetched body was stored and indexed WITHOUT BEING INFLATED, so some unmeasured fraction of the corpus is binary garbage occupying rankable slots. The SERVE half is fixed and compiled (dsv_jesc now emits only valid UTF-8: it transcodes Latin-1 printables, replaces undecodable bytes with U+FFFD, and never splits a valid sequence) but THAT ONLY CLEANS THE BOUNDARY -- the index still holds the bad bytes, so non-ASCII terms remain mis-tokenised and non-English retrieval stays unreliable. COMPOSE THE INCUMBENT INFLATER (nx_gunzip / nx_inflate both exist) rather than writing a second one. DONE-RULE: the count of stored documents containing invalid UTF-8 and the count beginning with the gzip magic are both measured and published BEFORE the fix, both fall to zero for newly ingested documents, and the rung states explicitly whether already-indexed documents need a re-ingest -- a forward fix does not clean the existing corpus and a done-rule that pretends otherwise is dishonest

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

20. Q5 — Language identification and per-language retrieval

    Prerequisites: Q4 (acceptance unverified)

    Contract: wc_lang_detect

    Acceptance: Live q=http returns two Korean tistory pages, a Chinese VPS blog and a French AMP plugin page in the top 30 for an English query, and q="ice cream" returned a Spanish municipal council page at rank 15. There is no language identification at ingest and the lng: row is written and read by nothing. This is a precision defect for every monolingual query and it compounds Q4, since a mis-decoded document cannot be language-classified either. DONE-RULE: every indexed document carries a detected language, the detector's accuracy is measured against a labelled sample with the sample size published, and off-language results fall on the judged set without any on-language result being lost

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

21. Q6 — Lease-wedge detector

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: lw_classify

    Acceptance: LANDED 2026-09-04 AS A DIRECT CONSEQUENCE OF AN 18-HOUR TOTAL OUTAGE THAT NO INSTRUMENT SAW. All four knowledge/lease/heavyio-slot-N.lock slots were permanently wedged; the crawler AND the shard compactor were dead for 18 hours; /search kept answering 200 and every daemon read UP, so the only symptom was a status log whose mtime stopped advancing and an operator saying search returns nothing. MECHANISM, read from nx_lease_lib.nx rather than guessed: ls_claim arbitrates a takeover with mkdir on a monotonic generation and then writes the stamp in a SEPARATE non-atomic step, so a process killed between them leaves g<N> on disk with the stamp still reading N-1; every later acquirer re-derives the same gate, retries mkdir g<N>, gets EEXIST and correctly reports BUSY -- forever, with no recovery path. All four slots showed the identical fingerprint stamp equals maxdir minus 1. The host bugchecked three times in 72 hours, which is exactly the kill this window needs, so it WILL recur. THE DETECTOR TESTS THE FAILING CALL ITSELF, not a proxy: it stats the g<stamp_gen+1> that the next takeover will try to create, and it NEVER mkdirs that path because doing so would wedge the lease it is inspecting. Three states, UNREADABLE included, so an instrument that cannot see abstains rather than acquits. DONE-RULE: bite-proven both directions on runtime-built /tmp fixtures, the live census is a tooth so the gate is RED while any lease is wedged, and it is on the gate roster so the next occurrence is caught in one beat instead of eighteen hours

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

22. Q7 — A judged query set with per-document targets

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: ir_qrels_perdoc

    Acceptance: EVERY RANKING RUNG ABOVE IS UNSHIPPABLE WITHOUT THIS AND IT IS THE CHEAPEST ROW ON THE BOARD. The lane's standing accept rule binds ranking changes to nx_beir_eval on nfcorpus -- 3,633 biomedical abstracts that contain none of these defects, and whose queries never exercise the web-scope authority and slug branches at all, so that referee returns byte-identical and cannot confirm or refute anything here. The live-corpus ruler nx_web_relevance_bench has produced no number for about 10 days because its cron row invokes a nx_hostctl verb that does not exist. AND EVEN REVIVED IT IS STRUCTURALLY BLIND: it judges by EXPECTED HOST, with 9 of 27 targets on en.wikipedia.org, so "Icing (aeronautics)" at rank 1 for "ice cream" scores a PERFECT hit-at-1. It cannot see Q0, Q1, Q2, Q3 or Q5 in either direction. COMPOSE nx_ir_eval, which already implements NDCG at k, MRR, Recall at k and Precision at k in Q16.16 fixed point -- a second metric implementation is the duplicate-ruler defect. SEARCH FIRST FOR AN EXISTING SET: estate records name measurements over 365 queries at BM25 356 permil, presence-idf 419 and TF-IDF cosine 446, so one may already exist and finding it beats building one. DONE-RULE: per-document targets not per-host, coverage of the inflection families that expose stem expansion, single-term and quoted-phrase CONTROLS that must be unchanged by any ranking edit, a JUDGING RULE STATED EXPLICITLY so it is auditable, and the set detects the Q0 defect on the pre-fix binary -- a ruler that cannot see the defect it was built for is not a ruler

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

23. Q8 — Single-term queries must not be degraded by stem expansion

    Prerequisites: Q7 (acceptance unverified)

    Contract: dss_exact_precedence

    Acceptance: ADDED 2026-09-04 FROM A REGRESSION THIS LANE CAUSED AND MEASURED. R1h fixed multi-term ranking decisively and MOVED SINGLE-TERM NAVIGATIONAL QUERIES THE WRONG WAY: q=wikipedia went English Wikipedia to Wikispecies, q=python went Monty Python to The Seventh Python, q=hola went a Spanish chat site to a JavaScript operator page. THE CONTROL IS EXACT AND COSTS ONE CALL, because expansion runs only when the query carries no plus or minus operator: +python returns Python documentation by version from python.org and +wikipedia returns Wikipedia:About, while the plain forms do not. So the authoritative page IS IN THE INDEX and expansion is ranking it down. THE MECHANISM IS NOT YET ISOLATED AND MUST NOT BE GUESSED: three of my edits touch this path (the min-idf variant bound, the slug walk bound, and uniform coverage credit on a single concept), and I did NOT run the experiment that separates them. THE DISCRIMINATING EXPERIMENT: rebuild with each of the three reverted in turn and re-run the four single-term controls, or instrument the per-candidate factor breakdown for one query and read which multiplier moved. WHAT NOT TO DO: do not add an exact-match boost constant -- that is a magic number nobody can justify and this board has refused it twice. The principled shapes are (a) strict precedence, a document matching the TYPED form outranks one matching only a variant, which is an ORDERING and needs no constant, or (b) do not expand a single-concept query at all, which is the published IR result that expansion trades precision for recall and short navigational queries have no second term to disambiguate with. HONEST BOUND: single-term navigational quality is ALSO limited by the two structural gaps this milestone already carries -- with no anchor-text index (Q1) and no real title field (Q2) there is little signal that says python.org is the authority for python, so Q8 may improve the ordering without fixing the class

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

24. Q9 — Query-echo pages cannot answer the query they echo

    Prerequisites: Q7 (acceptance unverified)

    Contract: dss_query_echo

    Acceptance: ADDED 2026-09-04 FROM THE OPERATOR'S OWN QUERY, MEASURED ON THE LIVE SERP AFTER THE R1h DEPLOY. q=julia kyoka returns, at ranks 3, 4 and 5: javtiful.com/search?q=julia%20kyoka, jav.guru/?s=julia+kyoka, and onejav.com/search/Julia%20Kyoka -- three OTHER SITES' SEARCH RESULT PAGES for the very query being asked. THE DETECTOR IS NOT THE DEFECT AND I CHECKED BEFORE ASSUMING: dss_is_search_url matches all three (the first on both /search and ?q=, the second on ?s=, the third on /search), so DSS_SEARCHPAGE_PEN=512 IS firing and they rank there having ALREADY been halved. THE REASON A HALVING CANNOT WIN: a search-results page for a query is an ADVERSARIALLY PERFECT keyword match by construction -- the terms appear in the title, in the URL, and repeatedly in the body, so tf, proximity and the title bonus all peak together. It does not lose on quality; it wins on every signal the scorer has. ⛔THE FIX IS NOT A BIGGER MULTIPLIER. Lowering 512 is the magic-number reflex, it would be uncalibrated, and it would punish legitimate pages that merely live under a /search path. THE PRINCIPLED MECHANISM IS STRICTLY MORE SPECIFIC THAN THE CURRENT RULE: today's test asks "does this URL look like a search page", which is a property of the URL alone; the real signal is "do THIS QUERY'S TERMS APPEAR IN THIS URL'S QUERY STRING", which is a property of the PAIR and is what makes the page an echo of this particular question rather than a document about it. A page whose URL carries the asked terms after ? or & is not a weak answer to that query, it is not an answer to it, and that justifies exclusion or a demotion far below a nudge -- for THAT query only, leaving the same page rankable for others. HONEST PRECONDITION, AND IT IS WHY THIS IS FILED RATHER THAN SHIPPED TODAY: this is a ranking change and the estate has no judged set that covers the echo class, so there is nothing to prove it against. Q7 first. AN UNCALIBRATED CLASSIFIER MUST REPORT NUMBERS, NEVER VERDICTS

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

25. Q10 — Posted terms never score zero under the tf-scan cap

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dss_posted_floor

    Acceptance: A term the postings carry for a document contributes tf>=1 to that document's score even when the DSS_TFSCAN head scan did not reach it, so +required terms past the cap no longer disqualify and plain rare terms no longer vanish. MEASURED 2026-09-13 on the live shard: q=kyoka total=25 nresults=0, q=+julia +kyoka total=11 nresults=0 -- N matched, nothing shown. DONE-RULE: both queries return nresults>0 on the deployed daemon, the judged set (Q7) does not fall, and the gate corpora stay byte-identical (documents under the cap are untouched)

    Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

26. D0 — Deterministic-first answer plane over the sovereign index

    Prerequisites: Q7 (acceptance unverified), L0 (acceptance unverified)

    Contract: dsv_answer_plane

    Acceptance: The engine resolves a factuality-critical query deterministically (retrieval, extraction of the cited span, provenance) BEFORE any generative step, and a small local model is hydrated only with the evidence the engine retrieved, in two tiers (span first, document second) -- the September 2026 frontier shape [@noesis26]. DONE-RULE: on a judged set of numeric and date questions the answer plane returns the cited span or an honest refusal, never a fabricated value, measured by a gate that plants a wrong-number control

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

27. MQ — Board-level journal anchor for search

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: -

    Acceptance: BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 4 log rows against the id MQ, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.

    Authored effort: 0. Executor kind: Board. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

28. ML — Board-level journal anchor for search

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: -

    Acceptance: BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 1 log rows against the id ML, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.

    Authored effort: 0. Executor kind: Board. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

29. L2b — Edge stream branch parity for /search

    Prerequisites: L2a (acceptance unverified)

    Contract: sd2_proxy_stream_tmo

    Acceptance: ADDED 2026-09-14 after the L2 rollback, measured from nx_sites_daemon_v2 source. The edge stream branch (sd2_proxy_stream) pins its backend socket timeout to a 30 s constant and ignores the row timeout= value, and on a dead backend it returns -1 and FALLS THROUGH to the static cascade: the homepage as a 200 on /search during every docportal warm window, the seq1294 retry-storm shape the buffered branch already refuses with a content-negotiated 503. L2 (early bytes) needs /search in stream mode, so both must be fixed first: sd2_proxy_stream takes tmo_s (named default NX_SD2_STREAM_TIMEOUT_S = 30, the incumbent value, so the gallery and torrent rows do not move; route-table rows pass their declared timeout), and a stream failure on a route-table row takes the same backend-down refusal path as buffered. DONE-RULE: a sites gate proves both directions on a fixture (a stream row with timeout=7 sets 7 s and one without keeps 30 s; a dead stream backend answers 503 problem+json to a machine Accept, never the homepage), sites.elf deployed through /api/deploy target=sites with the pre-change 98afdc8a banked, then the two /search rows flip to stream and nx_uat_run stays 4/4 on the old daemon before the streaming daemon ships through nx_search_ship agent with its HTML witness.

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

30. E1b — Definition precedence: a bare identifier query ranks the file that defines the symbol above the files that call or test it

    Prerequisites: E1 (acceptance unverified)

    Contract: es_def_precedence

    Acceptance: ADDED 2026-09-14 from the third-ingest control: sx_agent_decide returned nx_search_ship_gate.nx first (it spells the name a dozen times) and nx_search_ship_lib.nx, the definition, third; BM25 tf cannot tell a definition from a mention. Recipe: at ingest a def anchor per function head from nx_funcmine's table (the miner the E1 note already contracts, never a second one), and in es_query a definition tier for a bare identifier the way dss_exact_precedence tiers an exact title match. DONE-RULE: the estate gate's control pair, sx_agent_decide returns nx_search_ship_lib.nx at rank 1 and dsv_serp_prelude keeps nx_docportal_search_serve.nx at rank 1, with the judged estate set IDENTICAL-or-MOVED through nx_search_ship's referee

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

31. E3b — Board rows as documents: every rung, rungrole, log, sotabar and matrix row of a .plan or .matrix ingested as its own document so a rung id ranks its row first

    Prerequisites: E3 (acceptance unverified)

    Contract: ci_ingest_board_rows

    Acceptance: ADDED 2026-09-14 from the E3 measure: a 258 KB plan ingested as ONE document loses BM25 length normalisation to small files that spell the same token, so E1b as a query returned three source files and not search.plan. The boards already have row granularity as data; the ingest gives each row its own document (url = the board path plus the row index, the rung id as an anchor) beside the whole-file document that serves prose queries. DONE-RULE: a rung id from any .plan returns its own rung row at rank 1 under the estate scope, over the whole board population, partition printed; the whole-file document still answers a prose query

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

32. E8 — Search answers in the estate's sovereign schema format, JSON and text as projections

    Prerequisites: E1 (acceptance unverified)

    Contract: es_uxf_envelope

    Acceptance: ADDED 2026-09-14 on the operator's order: sota on every byte and rung, and the Protobuf and Cap'n Proto class of wire format rather than JSON, everywhere. The /api/search reply and the nx_estate_search lines are PROJECTIONS; the machine envelope of a search answer is a UXF profile document from the formats domain (self-describing profile CID, byte-deterministic canonical encode, unknown fields preserved through a round-trip and proven by CID equality: formats FM1 and its ft-frontier target), carried by nx_estate_search and the docportal API under a negotiated Accept, the negotiation data (endpoint_caps.tsv) not code. DONE-RULE: a fixture answer encoded through the profile decodes to the same ranked list the JSON projection renders, CID-equal through the formats domain's own reader, proven by a gate with a planted-corruption control; the docportal API answers the envelope to a client that negotiates it and JSON to one that does not.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

33. S1 — The live shard prints which side of the published BM25 crossover it sits on

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: cs_crossover

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Prints corpus_tokens for the live shard and side=BELOW or ABOVE against the conf-sourced 10M-token crossover [@bm25scale26], with the citation and the paper's own scope caveat beside the number. Negative control: a planted shard with a token count on the other side must print the other side.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

34. S2 — Every published retrieval score carries its benchmark identity and the refs gate refuses a bare one

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: qb_benchver

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. A score row carries benchmark string and run date [@mtebbench] [@rtebprivate]; the refs gate gains one tooth that REFUSES an nDCG figure without them. Bite: a planted bare score must turn the gate RED.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

35. S3 — Query-time expansion is kept wired only if it wins an ablation on the estate's own judged set

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: qb_expand_ab

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The same judged set runs with and without expansion through nx_qrels_bench [@complexret25]; a gate refuses to keep expansion wired unless the with-expansion arm wins on nDCG@10. Both arms must print their own numbers; a control run with expansion disabled on both arms must report IDENTICAL.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

36. S4 — Lexical alignment is measured for every rewrite and rewriting is gated on it not falling

    Prerequisites: S3 (acceptance unverified)

    Contract: qb_lexalign

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. lexical_alignment = fraction of original content terms surviving into the rewrite AND present in judged-relevant docs [@rewrite26], computed with no model. Bite: a rewrite that drops every content term must score 0 and be refused.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

37. S5 — BM25Q query-side saturation exists and its RRF fusion beats plain BM25 on long queries

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: idf_bm25q

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Query-term frequency saturated the way document-term frequency is [@bm25q26]; the fused arm must beat plain BM25 on the estate's long-query subset by nDCG@10, and a single-term query must score IDENTICALLY under both (the anti-vacuity control: saturation of a frequency of 1 changes nothing).

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

38. S6 — Human and auto relevance labels are separate classes and judge provenance is recorded and refused when circular

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: qb_tier

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The judged-set schema carries label_class in {human,auto} and judge_family plus ranker_family per run [@trec2026] [@clarke26]. The eval REFUSES an absolute metric from auto-only labels and REFUSES to publish when judge_family == ranker_family, naming the rule. Bite: a planted same-family run must be refused.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

39. W1 — The search ship loop as one organ: build, ruler, referee A/B, bank, deploy, warm, cold probes, journal

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: sx_build

    Acceptance: ADDED 2026-09-14 from the operator's standing order (primitives shift into workflows, workflows into agents, so search work is one-two-three step and meets or exceeds the Codex lane on MCP and API alignment). On 2026-09-14 the seat shipped the search daemon four times and each ship was ten hand-pecked MCP calls; nx_search_ship is that loop as ONE call with two modes (dry = private candidate + receipt, deploy = adoption), composing nx_mgmt_call, nx_contentdiff, nx_qrels_bench (promoted and staged, per-query lines compared byte-for-byte), nx_filehash, nx_filecopy and nx_https_get_cli2 by fork, refusing at the first RED, reading its bar from knowledge/uat_journeys.conf and its cold-probe battery from knowledge/search_probes.conf, and journalling to search.plan and knowledge/status/search_ship.jrnl. Parsers live in nx_search_ship_lib and are gate-driven on planted fixtures (nx_search_ship_gate). DONE-RULE: the gate GREEN on the NAS, one real deploy of the daemon performed END TO END by nx_search_ship deploy with its receipt journalled, and the organ registered on the MCP surface with a cap so any seat, AI or human, adopts a search change in one call. AGENT STEP (next): the hourly consumer journey is the referee; a clock row that runs nx_search_ship dry on the tree and journals the candidate receipt is the agent that turns a source edit into a receipt without a seat

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

40. W2 — The ship loop as an AGENT: adopts on its own only the class whose safety is mechanical (candidate differs from live, ruler lost 0, referee byte-identical), holds a moved ranking for the root, rolls back to the banked binary if the adopted candidate answers over the bar

    Prerequisites: W1 (acceptance unverified)

    Contract: sx_agent_decide

    Acceptance: ADDED 2026-09-14 from the operator (an organ is not enough; meet or exceed the Codex lane on single-step solves through MCP, API, workflows and agents). nx_search_ship gains mode agent: the dry stages, then sx_agent_decide (a pure lib function under nx_search_ship_gate T8, six teeth incl. three neg-controls) answers NOCHANGE (same bytes as live), HOLD (the referee moved or a printable run was lost: a private candidate the root adopts with deploy) or ADOPT (the deploy stages run, then stage 7b rolls back to the .pre bank through the same health-checked lane if any cold probe is over the bar, journalled either way). RACI: workers never adopt a ranking change; the agent adopts the speed changes the rulers already proved. DONE-RULE: gate GREEN on T8, one agent run on the tree that ADOPTS a real candidate end to end with its receipt on search_ship.jrnl, one that reads NOCHANGE, and the clock row searchship-dry repointed to agent

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

41. W3 — Search as ONE STEP any workflow composes: the ship loop is a row in the estate's workflows-as-data plane (knowledge/store/plan-searchship-, seq tool args) that nx_plan_run executes server-side in one cap-gated call, chained with the consumer referee

    Prerequisites: W2 (acceptance unverified)

    Contract: -

    Acceptance: ADDED 2026-09-14 from the operator (the swarm's agents must use search and add it to existing workflows as one step, or build new workflows from workflows and primitives, with the MCP and API surfaces that make it scale). The estate already has the engine: nx_plan_run executes plan-<id>- rows (seq TAB tool TAB args) in seq order, refuses unknown tools fail-closed, stops at the first failing step and records planrun-<id>- results -- so search entered it as DATA on 2026-09-14: row 1 nx_search_ship agent, row 2 nx_uat_run. Any plan can now carry the search ship as a row and any agent that can call nx_plan_run runs it in one step; the prim ladder (nx_prim_registry, nx_prim_query, nx_prim_gap, nx_prim_synth) is where search gets found as a primitive next. DONE-RULE: nx_plan_run searchship exits 0 with planrun-searchship- rows for both steps and the ship receipt on search_ship.jrnl, fired by the clock (an agent), not by a seat

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

42. E7 — Discoverability IS search: finding an organ, a symbol, a capability or a primitive is the estate searching its own record, so every finder (nx_capsearch, nx_prim_registry and nx_prim_query, nx_txtscan, nx_absent, nx_catalog) is held to the web index's coverage discipline -- no caps, the whole population, every answer carrying its coverage

    Prerequisites: E4 (acceptance unverified)

    Contract: pr_domain

    Acceptance: ADDED 2026-09-14 from the operator (discoverability and exposability are part of what SOTA means; grep-shaped lookups by a seat are the gap, the estate's own search should answer them). FIRST MEASUREMENT: nx_prim_registry admitted 1024 of 1966 registered tools (dropped=936 announced, a bare row cap K_MAGIC_1024 unrelated to any buffer), so nx_prim_query search_ship matched 0 of scanned 1024 -- every organ registered after the 1024th, including the whole search ship loop, was undiscoverable to the swarm's primitive query. The cap is removed (the output window keeps its loud saturation refusal); the manifest must cover the population. NEXT: nx_prim_query's own scan cap of 2048 is the same class one generation out; nx_capsearch matches one token per argv word (a multi-word string is one token); nx_txtscan is one file at a time and nx_absent is the coverage-proving walk -- fold them under one estate-search surface (E4's scope) with coverage envelopes. DONE-RULE: nx_prim_query finds every registered tool by id (matched equals the allowlist count on a full scan), the registry's envelope reads dropped 0 with no row cap, and the search board's discoverability row is measured every regen from the registry's own envelope

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

43. E1 — The code base as a corpus: every source tree ingested into the sovereign index, one document per file with its path as the url and its functions as anchors

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: ci_ingest_source_tree

    Acceptance: ADDED 2026-09-14 from the operator's reframing (search is a fetching, mining, ingesting and organizing capability over the estate's own record, not only a web query path). THE INCUMBENT IS THE FRONT DOOR: nx_corpus_ingest already turns a directory of .txt .md .html into a domain's public seg_store shard, content-addressed and idempotent, and its own header calls itself the front door for all three search fronts -- so this rung EXTENDS it (a recursive walk over buildroot/runtime and runtime that admits .nx and .conf as text, a code scope prefix, the file path as the url row) rather than building a second ingester. The function-level index already exists in nx_funcmine (27678 functions over 7132 sources) and lands as anchors, not a new miner. DONE-RULE: a query for a function name through /api/search under the code scope returns the defining file at rank 1 on a judged set of 20 symbols, and the corpus document count equals the source-file census, partition printed

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

44. E2 — The session transcripts as a corpus: the actlog frames the DM1 beat already captures session to NAS become per-session-day documents under a chat scope

    Prerequisites: E1 (acceptance unverified)

    Contract: ci_ingest_actlog

    Acceptance: ADDED 2026-09-14. nx_claude_harvest is LIVE and already does the FETCH half: it parses the Claude Code transcript jsonl into sovereign actlog frames where the transcripts live (laptop WSL today) and its DM1 beat captures fresh frames to the NAS as ts-day pieces. What is missing is the INGEST half: a renderer from frames to documents (one document per session-day carrying the session id, the epoch range, the tools called and the authored text) fed through nx_corpus_ingest under a chat scope. Third-party formats never enter the plane: the frames are the sovereign form and the jsonl stays outside. DONE-RULE: a phrase the operator wrote in a past session is found by /api/search under the chat scope with its session id in the result, over the whole captured population (frames in equals documents covered, partition printed)

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

45. E3 — The memory plane and the boards as a corpus: memory .md, CLAUDE.md, every compare .plan .matrix .refs and the status journals, ingested under an estate scope

    Prerequisites: E1 (acceptance unverified)

    Contract: ci_ingest_boards

    Acceptance: ADDED 2026-09-14. The boards are already on the NAS (buildroot/knowledge/compare and knowledge/status); the memory plane is laptop-local and its BM25 retriever nx_memfind runs there by necessity (SOURCE-ONLY on the NAS, correctly so). This rung pushes the memory files through the content door (nx_content_put, chunked and sha-receipted) into a directory nx_corpus_ingest walks, so one query surface covers laws, journals and rungs. DONE-RULE: a law phrase from CLAUDE.md and a rung id from any .plan are each found at rank 1 under the estate scope, and nx_memfind and the sovereign engine agree on the top result for 20 memory queries (the laptop ruler is the control, never a second index)

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

46. E4 — One query surface with corpus scope: /api/search and nishi_search take a scope (web, code, chat, estate) and rank inside it

    Prerequisites: E1 (acceptance unverified), E2 (acceptance unverified), E3 (acceptance unverified)

    Contract: dss_scope_filter

    Acceptance: ADDED 2026-09-14. The scorer already carries consent and site filters in dss_search_off_div, so scope is a filter term on the same pipeline, never a second engine; nishi_search takes argv terms today and gains a scope word. FIRST STEP IS A MEASUREMENT: how the site filter is keyed (url prefix rows exist per document) decides whether scope is a prefix test or a new field. DONE-RULE: the same query answers differently under each scope with no cross-scope leakage on a 20-query set, and phase_us shows scope costing under 10 ms

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

47. E5 — Mining as organizing: the derived indexes the estate already mines (functions, workflow n-grams, registry rows, harness patterns, debt recurrence) land as documents with provenance rows so they are searchable, not only printable

    Prerequisites: E3 (acceptance unverified)

    Contract: ci_ingest_mined

    Acceptance: ADDED 2026-09-14. nx_funcmine, nx_workflowmine, nx_registrymine, nx_harnessmine and nx_actlog al_mine_json are all built, promoted and REGISTERED-DARK (nx_catalog 2026-09-14): they print censuses nobody searches. This rung renders each census as documents (one per mined item, with the mining organ and the epoch as provenance rows) into the estate scope. DONE-RULE: a mined item (a function, an n-gram capability, a registry row) is found by name under the estate scope and its provenance row names the organ that mined it

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

48. E6 — A judged set for estate queries so the per-document referee rules on code, chat and estate retrieval the way it rules on the web

    Prerequisites: E4 (acceptance unverified)

    Contract: qb_estate_set

    Acceptance: ADDED 2026-09-14. nx_qrels_bench scores against knowledge/search_qrels.conf per URL over the live dss_search path; the estate corpora need their own judged set (code symbol queries, transcript phrase queries, law and rung queries, judgements per document) and the bench must take the set as an argument or a scope. FIRST STEP: read whether the bench already takes the set path as argv. DONE-RULE: nx_search_ship's referee A/B runs both sets and reports IDENTICAL or MOVED per set, so an estate-search change is adopted through the same loop as a web change

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

49. MV1 — Performer media aggregation: a person name resolves to every image, video and page the index holds for that entity

    Prerequisites: Q7 (acceptance unverified), E4 (acceptance unverified)

    Contract: es_entity_media

    Acceptance: OPERATOR 2026-09-14: search must find all the media for a performer (the private-ref:b7a71b7a class). INCUMBENTS the estate already ships, all REGISTERED-DARK: nx_entity_media (462190 B), nx_entity_dossier, nx_entity_seeds, nx_mediafacts, nx_media_inventory, nx_imgsearch; the missing piece is the DOOR from the search surface: an entity tier that recognises a name query (the exact tier already carries dss_owner_map) and answers with the entity's media set, deduplicated by content hash, with the pages that carry each item. Done-rule: on the judged set the performer queries return every judged media item at recall 1000 permil with no off-entity item in the top 20, measured by nx_qrels_bench with media judgements added.

    Authored effort: 2.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

50. MV2 — Reverse image search: an image query returns its near-duplicates and visually similar images from the index

    Prerequisites: MV1 (acceptance unverified)

    Contract: es_reverse_image

    Acceptance: OPERATOR 2026-09-14: a Bing reverse-image class capability. INCUMBENTS: nx_imgsearch (360703 B, REGISTERED-DARK), nx_facemark (face landmarks), nx_imgfacts, nx_image_beauty, the sovereign JPEG and WebP probes; the missing pieces are a sovereign perceptual hash for near-duplicates (a derived, gated hash over the decoded luma, never a third-party model) and a sovereign visual embedding for similarity, indexed beside the text shard so one query surface answers text and image. Bing Visual Search and the operator-named comparator are ORACLES for the bars, never dependencies. Done-rule: a judged set of image pairs (near-duplicate, same subject, unrelated) where near-duplicates are returned at rank 1 for every pair and unrelated images never enter the top 10.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

51. R0b — A sovereign late-interaction token encoder (ColBERT class) over the same index

    Prerequisites: R0 (acceptance unverified)

    Contract: bc_encode_tokens

    Acceptance: The cross-encoder arm (R0) scores a pair; a late-interaction arm encodes every token of query and document once through the same sovereign BERT encoder and scores by MaxSim, which the seg scorer already does over PPMI ids (dss maxsim). bc_encode_tokens exposes the encoder's per-token hidden states (the row the pooler discards today); the arm adopts open weights under licence (LightOn LateOn and mLateOn are open, ModernBERT backbone: RoPE, GeGLU, alternating attention, a port of the block beyond BERT) or trains on the open corpus the July post releases. Done-rule: the arm's BEIR nfcorpus nDCG at 10 through nx_beir_eval exceeds the BM25 arm (321) and the judged set MRR does not fall; the ColBERT MaxSim over the encoder's tokens on the model card pairs must rank the population passage first (KAT).

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

52. R0c — Reasoning-aligned query rewriting before retrieval

    Prerequisites: R0 (acceptance unverified), R0b (acceptance unverified), Q7 (acceptance unverified)

    Contract: dss_query_rewrite

    Acceptance: The BRIGHT board's top two entries put a query rewriter trained against retrieval feedback in front of the retriever; the estate's exact and stem tiers rewrite nothing. dss_query_rewrite: a sovereign rewriter (the nofloat seat's small model or a distilled twin) proposes a bounded set of rewrites, each scored by the live arms, with the rewrite chosen by measured retrieval reward on the judged set, never by the LLM's own confidence; a rewrite that lowers the judged-set MRR is refused by name. Done-rule: BRIGHT short-document average through a sovereign BRIGHT harness (the nx_beir_eval pattern over the BRIGHT datasets, fetched with licence) exceeds the estate's own BM25 arm on BRIGHT, and the judged set MRR does not fall; every rewrite is journalled beside its reward.

    Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

53. R0d — The estate places itself on BRIGHT: nx_beir_eval runs the BRIGHT datasets and emits the leaderboard row the board renders

    Prerequisites: R0 (acceptance unverified)

    Contract: be_bright

    Acceptance: The BEIR harness scores nfcorpus only; the leaderboards the operator wants in /compare need the estate's own number on the same axis. be_bright mirrors the BRIGHT datasets under their licence (huggingface xlangai/BRIGHT: the twelve short-document sets with queries and qrels), runs every arm the harness carries (BM25, ppmi, learned, crossenc) over each set, prints the per-set and average nDCG at 10 in the JSON, and writes the estate's row into search.leaderboard so the emitter renders it beside the published rows with NEW, MOVED and LEAP marks. Done-rule: the average reproduces the published BM25 baseline on BRIGHT within its own tolerance (the same control the nfcorpus arm passed at 321 vs 320), every set is scored (twelve of twelve, partition printed), and the row appears on /compare/search under the BRIGHT board with its measured number and date.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

54. S7 — The served scorer fuses the BM25Q arm with plain BM25 by rank permutation, identical by construction on any query without a repeated term

    Prerequisites: S5 (acceptance unverified)

    Contract: dss_bm25q_fuse

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-16, BEFORE THE BUILD: (1) a no-repeat query ranks IDENTICALLY to the plain arm (moved=0 by construction, the anti-vacuity control: qtfsat_q10(1) is exactly 1024); (2) a query with a repeated typed term whose two arms disagree beyond a pair swap MOVES at least one candidate before coordination, and the API announces bm25q.repeats and bm25q.moved on every answer; (3) the plain score multiset is preserved (the j-th candidate in fused order takes the j-th largest plain score), so every downstream multiplier and the API score scale are untouched; (4) the fusion constant is the ONE spelling the harness fuses with (RRF_K_STD in runtime/nx_intlog.nx); (5) shipped through nx_search_ship with the judged-set referee reading IDENTICAL (no judged query repeats a term), never a hand deploy. Composes the canonical sort (nx_quicksort) on packed keys; a pair swap is an RRF tie resolved to the plain order, as the harness resolves it.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

55. S8 — The served scorer takes a query as long as the harness scores (no 16-term cap), so the served system and the measured system are the same system on long queries

    Prerequisites: S7 (acceptance unverified)

    Contract: dss_query_terms_cap

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-16, BEFORE ANY BUILD: DSS_MAXTERMS=16 truncates every served query at its 16th token while the BRIGHT harness scores the whole post, so the leaderboard row measures a system the served path cannot run on the queries the row is about. Done when (1) the cap is a DERIVED ladder row, not a typed constant (the tf matrix, the candidate term mask and the L0 postings path each carry their own limit today: DSS_MAXTERMS x DSS_MAXCAND x 8 bytes, a 64-bit cand_tmask, DSS_L0_TSHIFT), announced per query when it binds; (2) a BRIGHT-length query through /api/search covers every token the harness covers, witnessed by bm25q.repeats matching the harness's per-query count on the same post; (3) the judged set and the cold-probe bar are IDENTICAL and unchanged; (4) shipped through nx_search_ship. Costed 3 because three limits must move together and the mask must become a bitset.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

56. R0f — The BRIGHT sweep chooses the leaderboard arm from its own receipt among plain BM25, BM25Q fusion, the cross-encoder rerank and the cross-encoder RRF fusion, so a reranker that wins can reach the row and one that does not cannot

    Prerequisites: R0 (acceptance unverified)

    Contract: be_lb_choose

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-16, BEFORE THE BRIGHT RERANK SWEEP: (1) plain is always eligible; (2) the BM25Q fusion arm only under its own S5 rule in the same sweep and at least plain; (3) the cross-encoder arm only when twelve of twelve splits measured it (ce_measured=1) and its average EXCEEDS plain and the best other arm; (4) the cross-encoder RRF fusion (k=RRF_K_STD over the BM25 order and the reranker order, same candidates) under the same eligibility, displacing the pure rerank only when strictly higher; (5) the row names the arm and the licensed MiniLM weights the sovereign encoder runs; (6) nx_beir_arms_gate holds every branch in-process with a bite-proven neg-control

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

57. R0g — RM3-style pseudo-relevance feedback arm in the BRIGHT harness: the non-reasoning expansion control the R0c rewriter must beat, and a row candidate in its own right

    Prerequisites: R0f (acceptance unverified), S1 (acceptance unverified)

    Contract: be_prf_arm

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-16, BEFORE ANY NUMBER WAS READ: (1) feedback docs are the plain arm's top 10, expansion terms the 10 best by sum over those docs of tf/doclen x idf with the query's own terms excluded, expansion weights a share of the best, the expanded score 500 permil plain plus 500 permil expansion BM25 over every doc either walk touches, excluded ids unrankable (Anserini RM3 defaults fbDocs 10 fbTerms 10 originalQueryWeight 0.5 are the bar's source); (2) measured in every mode including --bm25-only, receipt block prf with queries_expanded, expansion_terms_total, improved, worsened, delta, sweep key prf_ndcg_at_10_permil; (3) the row takes it only when twelve of twelve splits carry it and its average EXCEEDS plain and the best other arm (nx_beir_arms_lib, gate teeth T14-T17); (4) a reranker tied with it keeps prf, a reranker strictly above displaces it

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

58. R0h — Referee replay: the published GPT-4 reasoning-query sets run through the estate's own integer BM25, reproducing the paper's number and sizing the rewrite lever the sovereign rewriter must capture

    Prerequisites: R0d (acceptance unverified), R0f (acceptance unverified)

    Contract: be_qpath

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-16, BEFORE THE REPLAY: (1) the twelve gpt4_reason parquet files from huggingface xlangai/BRIGHT (cc-by-4.0) are mirrored under knowledge/fetched with provenance and written by the sovereign parquet reader to <split>/queries_gpt4_reason.tsv (id and query columns; the query column carries the GPT-4 reasoning text, row 0 of biology is 4,242 characters); (2) nx_beir_eval takes --queries <file> and names queries_file in every receipt; (3) the published target is BRIGHT paper arXiv 2407.12883 Table 38 BM25 row, read from the mirrored HTML bytes: Bio 53.6 Earth 54.1 Econ 24.3 Psy 38.7 Rob 18.9 Stack 27.7 Sus 26.3 Leet 19.3 Pony 17.6 AoPS 3.9 TheoQ 19.2 TheoT 20.8, average 27.0; (4) the replay REPRODUCES the paper when the twelve-split plain average lands within 30 permil of 270 (the same order of tolerance as the plain floor, 149 measured vs 145 published); (5) a replay on an alternate query set NEVER writes the leaderboard row (guard in be_bright, receipt says NOT-WRITTEN), because a query GPT-4 wrote is not the estate's system; (6) the measured gap between this replay and the estate's sovereign row is the target R0c must capture with a sovereign rewriter

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

59. R0i — Estate-trained cross-encoder replaces the MiniLM weights on the rerank arm

    Prerequisites: R0 (acceptance unverified)

    Contract: bc_train_pairs

    Acceptance: An estate-trained BERT-class cross-encoder (the nofloat lane's own autograd and AdamW, nx_nofloat_autograd_gate and nx_nofloat_adamw_gate already GREEN) over LICENSED pairs (the estate judged sets and mined pairs from the crawled corpus; MS MARCO is non-commercial and may not be the replacement's training set) reaches the MiniLM arm's nfcorpus number (347 permil through nx_beir_eval) within 30 permil; the foreign safetensors leave the run path and the search.assets row flips to retired

    Authored effort: 9. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

60. R0j — Qwen3 architecture in the sovereign engine

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: nsv_qwen3_arch

    Acceptance: The no-float engine loads a Qwen3 GGUF (q_norm and k_norm per head, the 2507 tokenizer) and its greedy decode matches the float reference token for token on Diver-Retriever-0.6B forward passes (the model card pairs as the KAT); bit-identity against the incumbent Qwen2 path is unchanged

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

61. R0k — Reasoning-trained dense retriever arm over open weights (Diver-Retriever-0.6B and 4B, Apache-2.0)

    Prerequisites: R0j (acceptance unverified)

    Contract: dr_reason_embed

    Acceptance: Corpus and query embeddings through the sovereign engine with batched prefill (llm LM1), scored by cosine over the BRIGHT twelve; done when the estate's BRIGHT average through nx_beir_eval reproduces the authors' 25.2 (0.6B) within 30 permil, and the arm is wired only if it beats the fusion arm 15.5 so the leaderboard row moves; the weights are a data asset with the licence beside them and R0m and R0i replace them with ours [@diverret26] [@diver26]

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

62. R0l — Open reasoning rewriter weights behind the rewrite contract (TongSearch-QR-1.5B MIT or inf-query-aligner Apache-2.0) scored by plain BM25

    Prerequisites: R0c (acceptance unverified), R0h (acceptance unverified)

    Contract: br_run_split

    Acceptance: The rewriter runs on the sovereign engine, its rewrite is scored by PLAIN BM25 (the R0h lesson: saturation throws away what a reasoning trace repeats), the twelve-split average through nx_beir_eval exceeds the plain floor 149 and the judged-set MRR does not fall; the 1.5B is affordable on the CPU engine today (35 ms per token class), the 7B waits on llm LM1 and LM9 [@tongsearch26] [@tongsearchqr26] [@infaligner26]

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

63. R0m — Estate-trained query rewriter: GRPO against the estate's own retriever reward

    Prerequisites: R0l (acceptance unverified)

    Contract: qr_grpo_train

    Acceptance: A sovereign RL loop (policy = the engine's small model, reward = the plain-BM25 or dense nDCG of the rewrite on the estate judged set with a length penalty, the recipe MQR-A1 and inf-query-aligner published) trains a rewriter on licensed queries; done when the trained rewriter's BRIGHT average exceeds the open-weights arm R0l and the foreign rewriter weights leave the run path [@mqra1_26] [@infx26]

    Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

64. R0n — Reasoning reranker arm over open weights (ReasonRank-7B MIT) and its estate-trained replacement

    Prerequisites: R0k (acceptance unverified)

    Contract: rr_reason_rerank

    Acceptance: The reranker scores the top 100 of the retriever arm on the sovereign engine; done when the twelve-split average through nx_beir_eval exceeds the retriever arm alone and, by the R0 rule, exceeds plain BM25; the 7B needs llm LM1 and LM9; replaced by R0i's training loop applied to reasoning pairs [@reasonrank26] [@reasonrank7b26]

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

65. R0o — Referee-replay importer: a published reasoned-query set (a JSON object keyed by the original query text) becomes the alternate query file the BRIGHT sweep replays, so any rewriter's authors' own outputs are scored through the estate's BM25 before a byte of their weights is pulled

    Prerequisites: R0h (acceptance unverified), R0d (acceptance unverified)

    Contract: ri_stage_split

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-16, BEFORE THE FIRST REPLAY: (1) the importer matches every one of the 1384 BRIGHT rows to the published file and prints the partition rows = matched + missed beside the pair count, a miss refuses the whole run with the id named and nothing is renamed into place; (2) its gate proves the decoder on the escapes the prep organ's cell rule must survive (an escaped newline in a key, an escaped quote and backslash, a two-byte and a surrogate-pair u escape, an escaped tab, a CRLF row) with a neg-control that a missing rewrite is counted and refused by the one decision function; (3) nx_beir_eval scores the file as a REFEREE REPLAY, queries_file named in the receipt and the leaderboard row NOT-WRITTEN; (4) the replay of the authors' own 1.5B rewrites lands within 30 permil of the paper's BM25 number for the same file, the tolerance the R0h replay used [@tongsearchqrreason26] [@tongsearchqrpaper26] [@tongsearchqrgh26]

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

66. R0p — MTEB retrieval subset through the estate's own BEIR harness

    Prerequisites: R0d (acceptance unverified), R0 (acceptance unverified)

    Contract: be_mteb_set

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-16: (1) the MTEB(eng, v2) retrieval task list is read from the mirrored registry [@mteb26] [@mmteb25] and each BEIR-shaped task is prepped into the layout nx_beir_eval reads; (2) the plain BM25 arm is published per task beside the leaderboard's bm25s baseline as read by the browser oracle [@mtebspace26]; (3) a sovereign encoder arm is wired only if it EXCEEDS the BM25 arm on the same tasks, the R0 rule; (4) the board never claims a leaderboard placement it has not submitted

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

67. R0q — Sovereign engine decode throughput: register-resident i8 microkernel (4 output rows x 4 accumulators) proven bit-exact under the W12A12 gate

    Prerequisites: R0l (acceptance unverified)

    Contract: _nfmm_i8_task4

    Acceptance: SUPERSEDED 2026-09-17 (see the retract and measure rows): the i8 decode matmul keeps its accumulators in registers across the k loop and shares each activation load over 4 output rows instead of round-tripping one memory accumulator every 16 weights; proven BIT-EXACT against mm_pool_i8 by nx_nofloat_w12a12_gate on its grid fixtures; the driver's own progress file (bright_rewrite.<out>.progress) is the ruler: today 232 ms per token on TongSearch-QR-1.5B Q8_0 (16-core laptop, engine at 635 percent CPU, 13 GB/s streamed), bar = llama.cpp CPU decode on the same box (to be measured, the 35 ms class the R0l text assumed), frontier = the GPU oracle 11 ms per token; done when the twelve BRIGHT splits rewrite on the sovereign engine in under 3 h (today ~47 h)

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

68. S9 — Entity-query discriminators in the served ranker: phrase proximity, both-terms-before-one-term, and demotion of other engines' search-results pages, judged on the operator's own queries

    Prerequisites: S7 (acceptance unverified)

    Contract: dss_adj_typed

    Acceptance: SHIPPED 2026-09-17 under the symbol dss_adj_typed, the typed-terms adjacency core (the row named a symbol the code never declared and read DARK until repointed). Two discriminators land as DATA in nx_docportal_search_seg: (1) a phrase/proximity term for adjacent query tokens so a page carrying the whole name outranks any page carrying one word of it, with the S5 no-repeat identity control kept; (2) a page-type classifier read from knowledge/search_serp_signatures.conf (URL query keys q= s= search= query= keyword=, /search path segments, title shapes Search Results for / You searched for) that DEMOTES another engine's results page below every content page and never removes it (Rule 25); accept = on the judged entity set (the operator's 2026-09-16 REJECT julia kyoka is row one) no other-site search-results page in the top 10, no single-term page above a both-terms page, the two content pages stay at ranks 1-2, the 17-query judged set IDENTICAL or better through nx_search_ship's referee, deployed by nx_search_ship with the pre-change binary banked by hash

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

69. S10 — SERP pages as crawl seeds, never as results: the indexed results pages of other engines name the canonical pages the index lacks

    Prerequisites: S9 (acceptance unverified)

    Contract: cr_serp_seed_extract

    Acceptance: The crawl reads every indexed page the S9 classifier marks as another engine's results page, extracts its outbound result links as seeds tagged with the query that surfaced them, and enqueues them at entity priority, so a REJECTed entity query (julia kyoka: the javdatabase profile absent, only its birth-year listing indexed) is answered by the next crawl beat; accept = the seed extractor's gate proves a planted SERP fixture yields exactly its result links and no navigation links, the crawl journal shows seeds tagged by query landing as documents, and the operator's rejected query re-scored after the beat shows the canonical page in the top 10

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

70. R0r — Batched prefill on the sovereign engine: stream the weights once per prompt, not once per prompt token

    Prerequisites: R0q (acceptance unverified)

    Contract: nf_prefill_batched

    Acceptance: The prompt's T tokens go through each layer's seven projections as ONE T-row GEMM over the same i8 weight cache (the activation quantisation is already per row, so every row's arithmetic is unchanged), with attention still stepped per token over the KV cache so causal masking holds exactly; proven BIT-IDENTICAL to the sequential cached prefill by nx_nofloat_w12a12_gate on a random 64-token prompt (hidden state and KV rows compared byte for byte) and measured by the engine's own /gen receipt: prompt_tokens x ms_per_token must fall from ~97 ms per prompt token toward the GEMM's compute bound; done when a ~500-token BRIGHT prompt prefills in under 10 s (today ~48 s) with the twelve-split biology score unchanged

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

71. R0s — Q8_0 block-native i8 kernel: serve the model's own 1-byte block-scaled weights with the oracle's arithmetic

    Prerequisites: R0q (acceptance unverified), R0l (acceptance unverified)

    Contract: nq8_dot_row

    Acceptance: The i8 weight cache keeps the gguf's Q8_0 blocks (32 int8 weights + one scale) instead of re-quantising each row to 12 bits under one row scale; activations quantise per block of 32 to int8 with a block scale, the dot is int8 x int8 into int32 per block then scaled in fixed point -- llama.cpp's own Q8_0 x Q8 path, which the oracle already proved accurate (biology 408 vs the sovereign 352 on the same weights); half the bytes per token (1.55 GB at the measured 32 GB/s = ~50 ms per token) and KAT-proven against ggml's Q8_0 dot on the oracle's bytes the way nx_q4k_ggml_kat proves Q4_K; done when the sovereign biology rewrite scores within 30 permil of the oracle's 408 and ms_per_token halves

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

72. S11 — Entity pin: a name-shaped query the estate has resolved to a canonical page serves that page first

    Prerequisites: S9 (acceptance unverified)

    Contract: dss_ent_lookup

    Acceptance: nx_entity_dossier resolves an alias to its canonical landing (the card, the portfolio, the coverage) and nx_entity_pin projects each resolution into knowledge/status/entitypin.tsv, the one served table nx_docportal_search_seg loads once and reloads on size or mtime; on a one- or two-word query the resolved cid takes the band above every S9 tier and the answer announces entity.pinned, entity.cid and entity.rows (nx_entity_pin_gate 16/16, seg gate T54 T54b T54c, both hosts). Done when every REJECT row's query answers its canonical page at rank 1 with pinned=1 while the judged set is unmoved; measured 2026-09-17: julia kyoka rank 1, referee 648 nDCG and 686 MRR unmoved. Open: the HTML card line, the query log's other name-shaped queries through the two-row plan (dossier, pin)

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

73. R0r-b — The compiler emits the i8 dot product as one loop with the accumulator in a register

    Prerequisites: R0r (acceptance unverified)

    Contract: x86ctx_emit_i16dot

    Acceptance: The batched prefill kernel is bound by the instruction count the compiler emits around __i16x16_madd (measured 2026-09-17: about 25 cycles per madd; the builtin itself is vmovups x3, vpmaddwd, vpaddd, vmovups, but the caller's address arithmetic and the accumulator round trip through a stack slot surround every one, and neither DRAM nor the accumulator chain is the bound). A row-dot builtin __i16_dot(acc, x, w, n) lowers as ONE IR op to an x86 loop that keeps the int32x8 accumulator in a ymm register for n lanes (n at most NF_CHUNK_K, the caller keeps the chunk bound) and stores it once, with the same op lowered on wasm and rv64 as a plain loop so the source stays one; bit-identical by construction (the same integer sums). Done when nx_nofloat_w12a12_gate proves the builtin bit-identical to the madd loop on the grid and the outliers, the batched decode shape drops from 450 us per row toward the 60 us the load bandwidth allows, nx_cc_equiv_gate and the self-host stay GREEN, the toolchain canary is GREEN, and a 500-token BRIGHT prompt prefills under 10 s (R0r's done rule)

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

74. R0u — The batched prefill kernel spends its time where the instrument says: quantise once per input in parallel, balance the bands, tile the registers

    Prerequisites: R0r-b (acceptance unverified)

    Contract: nf_quant_rows_pool

    Acceptance: The R0r-b instrument (g_nf_mm_us_quant / g_nf_mm_us_pool in mm_pool_i8_m) measured the 32x1536x8960 call on a quiet box at 10.5 ms: 3.0-3.5 ms quantising the 32 activation rows single-threaded with a division per element, repeated for every projection that shares the input (q/k/v and gate/up quantise the same rows three and two times), then 7 ms in a pool of 16 workers holding 63 GMAC/s against an L1-bound of roughly 450 (2 loads per madd) on a heterogeneous laptop CPU whose static 16-band split waits for its slowest band. Three legs, each with its own value in the gate: (1) nf_quant_rows_pool quantises the rows as pool tasks and the engine quantises each layer input ONCE (a quantised-input entry mm_pool_i8_mq(xi8, sxm, ...) that q/k/v and gate/up share), bit-identical by construction; (2) dynamic bands, 8 outputs per task pulled by whoever is free, so the wall is the pool's aggregate and not its slowest core; (3) a 4x2 register tile builtin (four x rows against two weight rows, eight int32x8 accumulators, 6 loads per 8 madds) proven bit-identical per cell. Done when the gate's batch_dot_quant_us falls under 300 us and batch_dot_pool_us under 2.5 ms on the quiet box, every identity tooth stays GREEN, and the engine's /gen receipt shows a 500-token prompt prefilling under 6 s (today about 16-20 s)

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

75. R0v — Attention runs in the pool: one task per head in decode, one per (position, head) in prefill, scratch per task

    Prerequisites: R0u (acceptance unverified)

    Contract: nf_attn_kv_block

    Acceptance: The R0u profile put 68 percent of the batched prefill and about a quarter of every decode token in nf_attn_kv_core: scalar i64 dots over every cached position for every head, one head after another on one thread, with two shared scratch arrays. The heads are independent and, once all T rows of a block are written to the KV cache, so are the (position, head) pairs of a prefill block under the causal count cnt = pos+1 the core already applies. nf_attn_head is the ONE per-head routine (the serial control and every pool task call it); nf_attn_kv_core keeps its signature and dispatches nh head tasks with per-task scratch from an arena grown to nh x 2 x positions; nf_attn_kv_block writes the block's K/V rows first and dispatches (position, head) pairs across the arena's slots; nf_silu_rows_pool takes the silu/qmul rows (8 percent) the same way. Bit-identical by construction: the same integer arithmetic per head, the scratch written before it is read. Done when nx_nofloat_prefill_gate runs its sequential control with serial attention and its served arm with pool attention and every KV row and generated byte still agree, pf_us_attn falls from 677 ms toward 60 ms per block on the quiet box, and the engine's /gen receipt shows ms_per_token below 80 on the 1.5B model at 500 positions

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

76. S12 — Every result carries the age of the bytes behind it: the fetch epoch is stored beside the doc and the page announces newest and median age

    Prerequisites: S11 (acceptance unverified)

    Contract: dss_doc_fetch_epoch

    Acceptance: Doc rows are content-addressed (doc:<cid>, url:<cid>) and carry no fetch time; the only fetch ledger is knowledge/status/crawl_outcomes.log (156 MB, epoch TAB source TAB kind TAB verdict TAB value), which no result can be joined to at query time. The crawler already knows the moment it fetched a kept page, so it writes a third sibling row fe:<cid> = the fetch epoch (ci_mkfekey in nx_corpus_ingest beside ci_mkurlkey and ci_mkfpkey, the same ss_add dance as the url row -- additive: readers of doc:/url:/fp: are untouched and an absent fe: row means ingested before this shipped, never a wrong age). The seg reader gains dss_mkfekey + dss_doc_fetch_epoch(h, cid) (-1 when absent, so an unobserved age abstains and never reads as zero); the serve computes over the result page newest_epoch, the median age of the observed results and the observed count, announces them in /api/search as freshness{observed,of,newest_epoch,median_age_s,now} and on the HTML card as one meta line (newest result fetched 3 h ago, median age 2 d, 9 of 10 carry a fetch time). Done when nx_docportal_search_seg_gate proves the row round-trip on a fixture shard (present, absent = -1, planted epoch read back exactly, the median over an odd and an even count), the live /api/search carries the block with observed rising as the crawl beats re-fetch, and the board's freshness row on the position map reads the measured median instead of a claim

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

77. F1 — Safe-search content filter as data

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dss_safe_filter

    Acceptance: A safe= request parameter on /search and /api/search with three named levels (off, moderate, strict) read from a conf, a per-document adult classifier scored at ingest into the doc row, and the filter applied on the candidate set before totals so N matched stays honest. DONE-RULE: the seg gate proves a planted adult fixture is excluded at moderate and strict and kept at off, and the API announces the level in effect [@brave-safesearch] [@mojeek-preferences]

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

78. F2 — Region and language preference boost

    Prerequisites: Q5 (acceptance unverified)

    Contract: dss_locale_boost

    Acceptance: lang= and region= request parameters that boost documents whose detected language matches and whose host TLD or geolocated origin matches the requested region, as a bounded multiply on positive scores mirroring the proximity boost. Stands on Q5 language identification. DONE-RULE: the same query answers with a measurably different top-10 under lang=de versus lang=en on a bilingual fixture, and phase_us shows the boost under 1 ms [@mojeek-preferences] [@google-locale]

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

79. F3 — Instant answers from sovereign arithmetic

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dsv_instant_answer

    Acceptance: A pre-search classifier that recognises arithmetic, unit conversion and date or time queries and answers them from the estate's integer arithmetic and unit tables above the results, never from a model. DONE-RULE: a fixture of 40 typed calculations and conversions answers exactly, a 41st plain query renders no box, and the box is zero-JS [@google-howto] [@mojeek-support]

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

80. F4 — Spelling correction from the index's own term dictionary

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dss_spell_suggest

    Acceptance: A did-you-mean line built from the term dictionary the suggest endpoint already serves: bounded edit-distance candidates weighted by document frequency, offered only when the typed term is rare and the candidate is common. DONE-RULE: a planted misspelling set corrects 9 of 10 while a control of 10 correctly spelled rare terms draws no suggestion [@mojeek-tips] [@google-howto]

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

81. F5 — User-composable ranking rules

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dss_user_ranking_rules

    Acceptance: A rule-file grammar (boost, downrank or discard by host, path pattern or TLD) applied as a re-rank over the candidate set, passed by name on the request and shareable as a plain file: the Goggles class done with data instead of a hosted editor. DONE-RULE: a rule that discards one host removes it from the top-30 on a 20-query set and a boost rule moves its host up on every query where it was present [@brave-goggles]

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

82. F6 — Media verticals on the SERP

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dsv_vertical_tabs

    Acceptance: Images and news tabs on the zero-JS results page, the images tab backed by the existing nx_imgsearch organ (REGISTERED-DARK today) and the news tab by the freshness signal and a feed-sourced document class. DONE-RULE: both tabs answer the same query with only their class of documents and the SERP stays under its byte budget [@mojeek-operators] [@brave-help]

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

83. F7 — Date filter operators and parameters

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dss_date_filter

    Acceptance: before:, after: and since: operators plus since= and before= request parameters on /search and /api/search, applied on the candidate set before totals so N matched stays honest, filtering on the document's stored fetch time and, where the crawler captured one, its Last-Modified or published date, with the API announcing which date field decided each result. DONE-RULE: a fixture of three dated documents answers before, after and a combined range exactly, a query with no date operator is byte-identical to today's answer, and the seg gate carries a neg-control where the date is absent and the document is kept, not silently dropped [@google-operators] [@mojeek-operators] [@marginalia-serp]

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

84. F8 — Document type filter

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: dss_filetype_filter

    Acceptance: A filetype: operator and a type= request parameter on /search and /api/search over a stored per-document type (html, pdf, text, library) written at ingest from the fetch's content type and the library importer, applied on the candidate set before totals. DONE-RULE: a fixture of documents of three stored types answers each type exactly and a query with no type operator is byte-identical to today's answer; the seg gate carries a neg-control where a document with no stored type is kept, never silently dropped [@google-operators] [@brave-operators]

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

85. T1 — One word boundary for every ranker: whole-word, case-insensitive BM25 and BM25F over nx_wordb_lib

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wordb_tf

    Acceptance: done when tf and df in nx_bm25.nx and _hdl_build/nx_bm25f.nx are counted by whole word through nx_wordb_lib (the one owner, composing nx_ascii's byte classes), the nx_bm25_test KAT, nx_bm25f_gate (with a car-vs-card neg-control under both rankers) and nx_cms_search_gate read GREEN on the NAS, and every importer of the substring family is named for rebuild through its own lane

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

86. T2 — Stemmed lexical matching through the estate's one stemmer

    Prerequisites: T1 (acceptance unverified)

    Contract: wordb_stem_tf

    Acceptance: done when nx_wordb_lib offers a stem-aware counter composing _hdl_build/nx_stem.nx (full Porter, already the docportal query-expansion and BEIR tokenizer) with the query stemmed once and each document token stemmed at the boundary, and nx_beir_eval publishes the nDCG at 10 delta against the unstemmed twin on the same corpus (bar: the stemmed Anserini baseline the nx_stem header names, 320 permil); a recall change is a ranking change and ships only with the judged-set A/B

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

    Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.