[aryanorastar]

Customer failure and resulting behavior

A safety filter can remove a customer's symptom or completed attempt together with an invented staff-notification claim before review sees it. A reviewer can also introduce a new staff claim that later filtering deletes while leaving grounded approval intact.

Carry bounded, untrusted removed context into the existing reviewer, invalidate unresolved destructive removals, and use the existing single second look or localized rejection/person path. Preserve genuine person requirements, prerequisites, warnings and source links. Delivery and staff acceptance remain application-owned and distinct.

Final scope

Production/evaluation runtime is restored exactly to reviewed 16ff136, generated as 3ad91ff. The later unknown-answer policy/shared-selection expansion from bf3a40e is withdrawn. It was broader #83 work and its follow-up retained a candidate-only unsupported definite interpretation; that failed attempt, code and tests remain in history. This restoration does not prove the expansion caused that stochastic error or fix source applicability.

The retained change has a current-result WeakMap audit (12 complete units/6,000 characters), parse-to-review audit propagation, the existing review/second-look safety check, bounded shared requirement grammar, and actual-handler integration. No durable customer text, new model stage, private capability or enabled memory. Five later generic handler/script-preservation controls are retained. Tests for withdrawn APIs are removed with those APIs, not waived.

Refs #62. Shared unresolved source applicability/next-step weakness remains #83.

Relative comparison gate — adopted by Aryan

Require no candidate-only material final-answer failure, no protected-handoff regression, and candidate pass count not below main. Zero material failures is not the gate. A main draft later corrected before final is not a matching final failure.

Use the FIRST frozen comparison for the restored source:

Arm	Contract passes	Material failures	Minor contract failures
Main a9c9508	21/24	2	1
Restored candidate 3ad91ff / runtime16ff136	22/24	2	0

All four q10 final failures share email-only/missing-detail-or-person workflow, retain uncertainty and make no definite applicability invention. All12 required-person controls per arm stay true, with no main-true→candidate-false pair. Independent re-mapping confirms the relative gate passes. It does not approve every possible answer or close the wider source-applicability issue.

The withdrawn follow-up's23/24 result is preserved as failed history and is NOT reused for this runtime. Neither run is regraded or relaunched.

Verification

• Full 1,244/1,244, no-model 8/8, progress-ledger guards 4/4.
• All 77 non-test runtime/configuration/data/dependency manifest files match original generated3ad91ff/16ff136. Original158candidate manifest files/archive/Git blobs and original grade were independently verified.
• A network-blocked saved-response replay matches all96 request-body hashes plus draft, prepared/audit, reviewed/audit, selection, presentation/protection and actual person decisions over48flows. Validated against both original archives first and then restored source. Zero provider/network calls; diagnostic identity proof, not regeneration or new accuracy measurement.
• Existing first-filter, actual reviewer/second-look, localized rejection, synthetic staff delivery/failure, bounds, concurrency, privacy, source and condition controls remain covered.
• Final restored-diff independent review PASS. Exact-head hosted Node 20/24 and real PostgreSQL checks PASS at 53ee112 (run 40363247429). Earlier 16ff136 and the exact-source generated evidence remain valid within their disclosed scope.

Release and remaining work

Aryan directs a merge commit after the restored gates pass. Railway currently has one successful active operator-confirmed deployment 914a38f0 ofa9c9508, created October26 at18:52:34IST; automatic triggers and optional controls are off. No deployment before October27 at18:52:34IST, with fresh rollback/live/source/off-state checks. Aryan performs the three post-deploy smokes; failed smoke uses the verified rollback.

After #91, integrate main into existing #90 and review/test the conflict resolution. Frozen #90 mapping finds shared custody/cloud families but candidate-only completed staff flagging, which #91 rejects in offline exact-response replay. No date-order cause is demonstrated; its conditional max96-request grant is inactive. No new #91 paid run, protected data, customer data or optional enablement is authorized. Implementation64/100 and delivery56/100 remain unchanged.