session 2026-07-10: PENDING-53 landed (engine hash-locality) + PENDING-54 pre-processor build-in; REVIEWED-52/53/54 drafted; session file + ledger + KG(+5) + skill-harvest + MEMORY index rotate

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015jYS1tpR4P4NBxui4FSgfv

REVIEWED.md

@@ -451,3 +451,38 @@ DONE + DEPLOYED (a9e5196).
 - **Lane CONFIRMED:** v2.0.1 → v2.0.2 patch supersession (rationale text, no gate change, no consumer re-verification). Placement §I, immediately after the A2 partiality preamble.
 
 **If AUTHORIZED:** **LANDED** — committed `7d1d8d3` (local; Gitea push is the steward's call). `chamber-library-specification.md` bumped v2.0.1 → v2.0.2 (subsection added + v2.0.2 header supersession note); v2.0.1 archived immutable (`chamber-library-specification-v2.0.1.md`, byte-identical, `cmp`-verified); chamber `CLAUDE.md` version pointer updated. Bounded-diff verified (canonical change = exactly the header note + the new subsection; nothing else). Governance record: PENDING-51. **Closes A4 + B(iii)** of the REVIEWED-49 action-list. Remaining tail: **A1** registry (answer the `retrieve.py` hot-path question first), **A3** self-audit PROPOSAL, **B(i)/(ii)** (licence field · PREMIS vocab), **C** VIAF/ISNI/Wikidata reconciliation (→ targets the A1 registry). Tag any follow-on with REVIEWED-51.
+
+## REVIEWED-52 — PENDING-52 — Source-archiving wired into graduation (gate zero)
+**Date:** 2026-07-09
+**Decision:** AUTHORIZED (jurist-ruled, steward-authorized)
+*[Executor-drafted from the build + ruling record for the governance trail — steward to confirm against the original PENDING-52 ruling.]*
+**Notes:** Make source-archiving an *enforced* precondition of graduation, closing the 2026-07-02 "archiving IS a step of graduation" directive that was never enforced (the Handke graduation proved the gap — archiving nearly deferred as a "loose end"). Authorized commitments as ruled:
+- **§1 — match on `canonical_slug` ONLY** (never the filename, never the author-first staging slug). `resolve_pending_source(canonical_slug)` resolves a candidate's staged source via `pending-manifest.json`'s `canonical_slug` field — the mechanism the repo-evidence *forced* once the two slug conventions turned out to differ.
+- **§3.3 — verify-landed, never trust the return:** `source_gate()` = gate zero — already-archived (`manifest_has`) satisfies it; else resolve → **archive-first** (`--add`) → **verify the entry actually landed** → only then proceed; refuse (`SOURCE-REFUSED`) otherwise.
+- **§4 — idempotency:** `--add` no-ops on sha256 MATCH, **REFUSES (exit 2, `ARCHIVE CONFLICT`)** on same-slug / different content.
+- Change-class **PROPOSAL** (adds a precondition to *what graduation accepts*).
+**If AUTHORIZED:** LANDED — `archive_sources.py` (resolve + idempotency), `graduate_to_canonical.py` (`source_gate` gate zero), `graduation-spec.yaml` (`preconditions: source_archived`); 2 test fixtures, fleet 68→73. Parked as its own thread (§3): is the graduated corpus title-first or genuinely mixed (2 data points is thin; the per-candidate mechanism is robust either way). Tag follow-ons REVIEWED-52.
+
+## REVIEWED-53 — PENDING-53 — Engine source-binding completion (re-anchor spans both repos)
+**Date:** 2026-07-10
+**Decision:** AUTHORIZED — Ratified (draft §5, disambiguation option (b), with one required wording correction). Jurist ruling, steward-relayed.
+**Notes:** Completes the graduation-spec `layers` hash-locality principle to name the studium-engine source-binding surface a chamber-canonical re-hash invalidates. The diagnosis holds as a **completion, not a correction**: the `voice_manifest` line is TRUE about the object it names; the defect is an *omission* (the engine source-binding surface unmentioned) compounded by a *shared-word collision* ("manifest" / "voice" on both the hash-free and the hash-binding objects).
+- **Option (b) confirmed** over (a) and (c): (a) leaves `voice_manifest` bare — the incident replayed in miniature; (b)'s inline warning plants the redirect where the mistake occurs; (c) (rename to kill the shared word) is doctrinally complete but out of scope for a doc-gap patch.
+- **`engine_source_binding` kept as ONE entry** (names a relationship across three files that move together; fragmenting recreates the failure). **Dual warning kept** (inline ⚠ + block comment — two reading grains).
+- **Required correction (applied):** "…re-anchors ACROSS BOTH REPOS" (descriptive) → **"…REQUIRES re-anchoring across both repos"** (prescriptive — the gate catches the failure; nothing does it automatically; that IS the incident).
+- **Change-class FIX** (downgraded from the filed [PROPOSAL] default — documents an already-existing, already-enforced mechanism; adds no gate predicate). **Lane: lightweight in-place edit**, `PENDING.md`/`REVIEWED.md` audit trail sufficient.
+- **Durable lane-rule (jurist proposed, executor responded):** ACCEPT "lane tracks change-class" for `graduation-spec.yaml` (machine-data). **NARROW the `.md` generalization** — A2/A4 (REVIEWED-50/51) are FIX-class doctrinal `.md` additions that correctly took the *heavier* freeze+semver lane, because the operative axis for the constitution is *doctrinal-traceability* (a successor must trace doctrine to a dated marker), not change-class; the two coincide only for machine-data files. *[Awaiting jurist accept/narrow of this refinement.]*
+- **PENDING-47 generalized principle: ratification DECLINED** (relayed text truncated — jurist won't ratify unread text). Stays `[awaiting jurist ratification]`; relay the full principle text to close.
+**If AUTHORIZED:** LANDED — `_curation/graduation-spec.yaml` `layers:` block (voice_manifest annotated ⚠ + single `engine_source_binding` key + shared-word comment). YAML re-parses; bounded 6-ins/1-del. Governance record: PENDING-53. Tag commits REVIEWED-53.
+
+## REVIEWED-54 — PENDING-54 — EPUB footnote pre-processor (verbatim-safe conversion stage) + mega-EPUB split-convert
+**Date:** 2026-07-10
+**Decision:** AUTHORIZED IN PRINCIPLE — ship now for the bidirectional-mirror class, conditioned. Jurist ruling, steward-relayed. Build-in authorized.
+**Notes:** Architecture sound (§1) — moving the intervention *before* pandoc, onto raw XHTML where footnote structure is uniform, removes the reason the regex-family pile needed to exist (a fix to the problem class, not a bigger patch). Recognizer is a mirror-pair *first*, positional rule only disambiguating within a verified pair — closes the "numbered prose misread as a note" risk. Honest-refuse demonstrated (Polastron 95 / Jung ~20k untouched), not asserted.
+- **§2 — markers CONFIRMED apparatus under §V** (not a new precedent — pandoc already renumbers natively for every Kafka-class book; if marker preservation were required, the ratified pipeline would already be in violation). Settles an assumption `clean_epub_residue` ran on implicitly.
+- **§3 — proof standard: multiset is the right tool** (a whole-doc sequence diff would flag legitimate relocation). **REQUIRED before canon: per-pair check** — DONE: id-matched by (destination-file, id); re-proven G&G 27 / Mauss 628 / Polastron 140 / Jung 1086, 0 mismatch, teeth demonstrated. Surfaced Jung's cross-volume id reuse.
+- **§4 — change-class PROPOSAL confirmed** (sharpened test: PROPOSAL if it alters a gate's stated criteria *or* the trusted mechanism a critical gate's meaning depends on — this inserts a new component into §V's production chain; distinct from PENDING-53's FIX, same underlying principle).
+- **§5 — ship for the mirror class now, CONDITIONED:** the existing regex tools (`clean_epub_residue` A–D, `clean_pandoc_html_residue`) stay in place, untouched, as the fallback for uncovered classes — **addition, not replacement**.
+- **§6 — governance placement: yes** (fleet tool + `test_tools` fixtures + `graduation-spec.yaml` `converted_with` note).
+- **§7 — mega-EPUB provenance (Jung): OPEN, non-blocking, steward+jurist together.** Jurist leans per-volume (Jung is cited by CW volume; single file fights use) provided the safeguard is airtight (each volume `source`/`source_verified` → the single megavolume sha256; frontmatter states extraction, never poses as a standalone Bollingen edition). Executor fact-check: the corpus does BOTH; **per-volume precedent EXISTS** (Alexander *Nature of Order* 4 files · Lacroux 2 · Habermas/Burney/Camus vol-named). Split is proven content-neutral, so the choice carries no conversion risk — a usability/honesty question. *[Steward + jurist to settle; governs re-converting the legacy Jung `.md`, 0 notes / pre-spec frontmatter.]*
+**If AUTHORIZED:** BUILD-IN DONE under fleet discipline — `scripts/inject_epub_footnotes.py` (+ `--validate`, refuse-on-mismatch) + `scripts/convert_mega_epub.py`; `test_tools` fixture (fleet 73→77); `graduation-spec.yaml` + `conversion-runbook.yaml` (`policy.footnote_preprocessor`) + `tool-evolution-log.md`. Full brief: `docs/epub-footnote-preprocessor-FOR-JURIST-2026-07-10.md`. Deferred: recognizer coverage of remaining families; per-volume boundary detection (§7); ratified-spec §V cross-ref (runs the `.md` amendment lane, NOT landed here); re-convert legacy Jung/Donne. Tag follow-ons REVIEWED-54.