One Surface

Three premises in the 1.3 docs do not survive contact with the code.

Nine ground-truth lanes re-verified the 2026-08-13 audit against HEAD, then five adversarial passes attacked the results. 242 findings came back where the audit counted about 120. Thirty were claimed closed. Fifty corrections survived review, and three of them re-sequence the release.

One request, two opposite treatments of one predicate.

Nine items, down from thirty-five claimed.

The adversarial passes deflated far more than they escalated. Of 16 tier-2/3/4 findings marked 1.3-blocking, 14 did not survive. Six of 29 tier-0 items had no named attacker and no boundary crossing. The CORS entry filed as blocking is a false alarm, because all eight set_cookie sites are SameSite=Lax so no cookie ever rides the cross-site fetch. What remains is smaller and much sharper.

51.0% is a cliff, not a slope.

LAFS gain is the integral of reachable accuracy over log-scaled latency budgets from 1s to 200s, scored against a fixed reference frontier. Because RAG: query to slice + notes sits at 51.0% and 0.2s, the entire region from 1s to 26.9s is already held at 51.0. Any system at or below that scores exactly zero no matter how fast it runs. There is no partial credit and no first-mover credit for showing up at 40%.

The board, read live from the deployed JS

The top entry does not reconcile. Our reimplementation of LAFS reproduces the other two gains to six decimal places, but 2.8231 computes to 0.0572 from its own displayed operating point, a 49x discrepancy, and the ceiling at 130.54s even at 100% accuracy is 2.0211. Multi-point submission is officially permitted and the scorer takes the union, so the row is a lossy display of a submission whose gain comes from undisplayed faster points. Note also that 2.8231 is a hand-typed four-decimal literal while the other two carry full float64 precision.

Where we could land

Accuracy is exposure times conversion. Today that is 0.652 times 0.48 for 31.3%, against 31.26% measured, so the model is trustworthy enough to price levers with. The 82.6% figure is a measured ceiling on selection, so exposure cannot exceed it without new acquisition.

We are the compact one by a factor of ten, and it buys us nothing.

The official harness ships every baseline's source, so this is a code read rather than a paper read. Five lanes read it against the real corpus and two adversarial passes killed 21 of 32 proposed transfers, including three the readers fabricated outright.

Ordered by expected gain per unit of work, survivors only.

Twenty-one of thirty-two proposed transfers died in review. These are what is left, with the killed ones and their reasons recorded in the traps section. Nothing above rank 13 requires a corpus rebuild.

1.3 is "One Surface". Everything else waits for a real number.

Three separate agendas were each deferred into 1.3: the roadmap's "Lead It" with TeamMemBench and the coalescence engine, the benchmark chase moved whole from 1.2, and the rethink's own Phase 0 through 3 plus the debt ledger. They cannot all ship. Coalescence has zero lines of code in the repo and gets an explicit deferral with a written reason rather than silent omission.

Fourteen PRs, in dependency order, from a clean tree.

Each lands independently. The first four are uncontroversial and clear the queue the user asked to see handled.

1. Merge #404 alone, then dry-run the publish workflow

   Its CLEAN status means nothing ran: the file it edits is dispatch-only, so no PR-triggered job can exercise it, and every other suite skipped. Both major-version breaking changes are default flips with nothing removed and the call site passes no inputs, so it is safe on the evidence. It lands in the irreversible publish job, so the dry-run is the only way to exercise it before it matters.

   merge as-is, then gh workflow run publish.yml -f dry_run=true

2. Consolidate the three clean python bumps into one commit and one lock

   All three contend on uv.lock and two on the same pyproject, so serial merging buys three rebases and three CI cycles for three patch-to-minor moves. Before merging, run the check CI cannot: pydantic-ai 2.30 moved provider imports to construction time and build_model constructs all three. Add the uvicorn upper bound as ordinary pin hygiene, matching mcp, authlib, pyjwt, and surrealdb.

   nova/deps-python-lock-consolidation · closes #398, #400, #401

3. Merge the web pair, #403 first, then rebase #402

   Both regenerate the pnpm lock with the same peer churn, so they conflict. #403 first because the Storybook job actually ran and passed on it, which is the strongest real evidence in the queue. Before #402, boot the app and load login plus an authenticated page by hand: 16.3.1 backports a fix restoring the live headers view, the server-side auth path reads cookies from that API, and the e2e suite cannot see a render break.

   merge #403, @dependabot rebase, merge #402

4. Fix #394 and the sibling drift one file over

   The backfill calls a method removed from EntityManager and exits 0 with a generic warning. Do not reach for list_all: it hydrates, and the row builder promotes exactly the columns the detection tests for, so the repair would become a silent 100% already-set no-op. Add a raw-row pager instead. One file over, a probe reaches for a name that exists nowhere, so graph restore has silently lost its bulk write path while twelve mock sites assert against a method production cannot call.

   nova/fix-denormalized-backfill-and-bulk-probe

5. Gate the lifecycle on every retrieval surface

   The worst live defect at HEAD and it is on every default path. It also unblocks measurement, because the benchmark hits the pack route whose evidence lane is the ungated one, so no arm result is interpretable until this lands.

   nova/gate-lifecycle-on-every-retrieval-surface

6. One predicate table, plus CONTRADICTS, plus the rescue-lane guard

   One request currently exercises both tables with opposite treatment of the same predicate. CONTRADICTS is declarable and writable on all three surfaces and gated as suppressing at write, while scoring the untyped baseline at read, so #391's vocabulary is three predicates that pay rather than five.

   nova/one-predicate-table-plus-contradicts

7. Gate MCP writes on org role

   A live intra-tenant authorization bypass. The role is already resolved on the JWT path and handed to the policy context; nothing anywhere compares it to a write-role set. While there, raise on the dead client-supplied-project fallback rather than leaving it as a trap for the first entry point that admits an org-only credential.

   nova/mcp-write-role-gate

8. Repair the bench screen path and the two receipt liars

   Replay before paid is protocol law and both cheap entry points refuse the arm today. Bundle the swallowed vector lane that reports a completed search and the context-compile swallow that biases the arm, because both would poison the race before it runs.

   nova/bench-screen-path-repair

9. Bump the harness pin and fix the adapter override

   The pin is three commits stale at a pre-metadata-leak revision whose baseline modules were then substantially rewritten, so an anchor cut on it gets thrown away. Not a one-line ref change: the upstream signature went keyword-only. Worth noting in the receipt that our adapter sanitized query context 25 days before upstream did.

   nova/lme-harness-pin-bump

10. Classify the release surface in CI and render the charts

    Every asset needed already exists and already passes on CI runners. Only a trigger is missing. Fail-closed matters because the last fix added arms for five paths and still missed charts, VERSION, the installer, and six workflow files.

    nova/ci-classify-release-surface-and-render-charts

11. Make the e2e suite capable of failing

    All five browser tests follow redirects and accept any 3xx while the proxy redirects unauthenticated requests to login, so the suite has two outcomes, skip or pass. Until this lands, "E2E green" means the server booted and nothing more.

    nova/e2e-can-actually-fail

12. Readiness that sees a dead broker, and auto that selects redis

    Four startup handlers swallow into warnings, their flags are read nowhere, and readiness checks only Surreal. The default queue is in-process and persists nothing across a restart.

    nova/readiness-sees-dead-broker

13. Inheritance expresses removal as None, plus quality-metadata precedence

    #393 inverted the semantics underneath these helpers: omission used to clear a key and now preserves it, and span ids are deterministic so reprojection lands on the duplicate path. Bundle the metadata precedence inversion, where legacy shadow names rank first so a patch that sets importance is silently reverted on the next read, on the ranking input that decides retention.

    nova/inheritance-expresses-removal-as-none

14. Live 3.2.3 coverage for the merge semantics

    Every entity write's preservation semantics rest on duplicate-key resolution verified only on the bundled 2.x embedded engine while production runs 3.2.3, and the nightly live suite never writes the same uuid twice. If the production engine ever resolves duplicates the other way, every write inverts into stale-value-wins with no error anywhere.

    nova/live-merge-semantics-on-32

Five forks, each with a recommendation attached.

Things that look transferable and are not.

Twenty-one of thirty-two proposed transfers died in adversarial review. Three were fabricated by the reading agents, which is worth recording as its own lesson about accepting a mechanism because it sounds like something a strong system would do.

• Do not add a passage entity type to the served lanes on the theory that the session lane is lossy. It is not. The projection returns the byte-exact tree as the content of its only session row, and the bench chunk emits the accessibility tree verbatim. The lossy deduplicated inventory has exactly one call site and it feeds the note lane. Serving passages is slice-serving geometry, which already died at 6K chars with paired state recall of 6.3% and 0.0% against a 25.0% baseline. The bytes are lost at render, not at ingest.
• Do not raise the item ceiling before the character total. At a fixed 60,000 chars, 28 items receive 2,143 each, which is below the compact threshold, so every item flips into the compact regime. That is worse per-item exposure than the killed 28K-budget arm. Chars lead, items ride.
• Do not move note distillation off the clock to save query time. It is already off the clock twice over: the bench submits it from insert, whose time is measured separately and never scored, and production already runs it as a queued job. There is no query budget to free. If the intent is to spend more because it is free, that is already true, and the place to spend it is the digest starvation.
• Do not build a four-value evidence-status enum as a validated output gate. Grepping the entire harness checkout for the flag and all four enum values returns zero hits. The taxonomy does not exist, which means both the argument for it and the "the leader turns it off" argument against it were invented.
• Do not render a corpus census into the reader's context. The winning system's digest lives in a sandbox filesystem and is read by the search agent; the reader never sees it. Inventory-in-the-pack is the killed abstention chain that moved abstention 1 of 13 across 45 contexts. A census is a retrieval-side routing artifact or it is nothing.
• Do not inject the action spine into any chunk content. The trajectory header is prepended to every chunk and is what gets embedded, so a shared spine makes every chunk of a trajectory lexically nearer every other chunk of it, flattening the discrimination a selection lever needs. It also changes content hashes and forces a full re-ingest.
• Do not ship the digest role additions without the scaled line budget. The line total is global with a dedupe set spanning observations, so adding seven abundant interactive roles at the same weight tier strictly displaces the content lines that were the web-gate NO-GO mechanism. The one-liner can reopen a closed regression while fixing the other domain.
• Do not price the additive note lane off the cross-system subtraction. The official notes are vision-distilled from every state's screenshot with no line budget and no accessibility text at all; ours come from a role-filtered digest through a small model. Part of that gap is the digest defect a separate lever proposes to fix, so the subtraction banks the same points twice.
• Do not stack a slow operating point above 26.9s. The reference bar there is 58.6%, and a second point at 55, 56, 58, or even 58.6% at 30s adds exactly 0.0000. Our only slower mode scored zero and is Pareto-dominated by our own fast mode.
• Do not imitate the accuracy leaders. The 81.37% entry earns 0.3223 where the same accuracy at 26.9s would have earned 6.7364. Latency past roughly 30s destroys the integral. What those systems teach is format and evidence budget, nothing about spending seconds.
• Do not optimize latency below about 1.5s. The integral is clamped at 1.0s, so nothing under it buys anything. The 1.5 to 2s band is the target and there is no reward for going faster.
• Do not mutate the memory context list inside the post-query hook. It receives the same list object the harness then renders, so an in-place edit would land in the reader's prompt off the clock. That is metric gaming against an immutable harness.
• Do not read question metadata, and do not simplify away the override that prevents it. The pinned harness still hands question id, question type, and the raw record including the gold answer to every backend. The only thing keeping us clean is our own override. Treat it as a protected invariant with a test.
• Do not re-buy ranking or re-ranking before pools measurably widen. The miss set was measured as pool-boundary limited rather than rank-buried, and the cross-encoder's revival condition is explicit and unmet: gold present in the pool but ranked below the cut.
• Do not screen the small render levers as solo arms. Each is plausibly worth 0 to 3 points against a 3-point noise floor, so a solo gate spends a paid run to learn nothing.
• Do not trust a fetch that cannot execute JavaScript to prove absence. Two SOTA sweeps concluded the leaderboard was empty from a tool that structurally could not see its contents. The existence oracle runs in reverse too.