Who owns what

Deep record Project Documentation/AUDIO_PIPELINE.md (+ CAPTURE_RELIABILITY.md)

Maturity hardened core, actively stabilizing. The engine survived a dense high/critical defect run (DEF-470→604) followed by three adversarial whole-module reviews (2026-07-27, AUDIT CAPTURE-ADV-1/2/3); post-review engine defects have been low-severity (DEF-672/673). Severity migrated to the status-display seam (DEF-688/691 high) — which is exactly why the seam is now inside this domain.

Top risks (1) status display asserting a state the engine isn't in (the current high-severity cluster); (2) distributed-state drift across the many mechanisms the adversarial reviews inventoried (DEF-601's class); (3) upload-queue edge states (DEF-706).

Watchlist recording-status truthfulness on device; recurrence counter (recurrence_owed.py capture, threshold 2).

Deep record Project Documentation/EXTRACTION.md

Maturity functioning end-to-end with an eval net; quality is actively tuned (TUNING.md register live, tune-drain automated). The enforcement-ladder doctrine (rung 0–4) governs rule changes.

Top risks (1) rule dilution — every added prompt rule lowers adherence to the rest; (2) pipeline/device coupling — an app-side change silently altering the deployed Worker (CI guards exist, the coupling itself remains); (3) re-processing semantics vs device sync (DEF-714's class — prune undone by sync).

Watchlist golden-set recall + determinism; TUNING.md inflow rate.

Deep record Project Documentation/DOMAINS.md § data-layer (no standalone dossier yet)

Maturity single-user solid, multi-user immature by design — C-workstream back-office is explicitly deferred until B3 multi-user infra. Sync is the sensitive organ: device-authoritative semantics have already interacted badly with server-side deletes (DEF-714).

Top risks (1) sync-vs-server-mutation semantics (who wins, and when a server delete sticks); (2) the two account exits do not carry the same teardown — deleteAccount runs none of signOut's five compensations, so a deleted account's purchase identity and entitlement tier wait on the device for whoever signs in next ([[DEF-1136]], IDENTITY.md §6 F1); (3) ~~the recording-consent gate is install-scoped, so the second account on a phone is never asked and inherits the first user's answer ([[DEF-1138]], F2 — Q-L1's surface)~~ — RETIRED 2026-09-06, twice over: S-B-192(i) made the flags per-uid (which closed [[DEF-1138]]), and S-B-221 then deleted the consent gate, its flag, its key and both accessors outright once Nate's counsel advised the acknowledgement is not required (Q-L1 resolved). There is no consent surface left to inherit. The per-account *shape* of the concern survives on onboarded, which is per-uid and covered by its own tests — it is no longer a top risk; (4) restore-from-empty paths (S-D-184 territory), where the "this account is brand new" signal is wired only to a dead path ([[DEF-1147]]). Risk 2 replaces the generic "multi-user readiness is unproven" that stood here: it is still true, and now it is specific.

Watchlist DEF-714 resolution shape; B3 kickoff (this domain's maturity question becomes load-bearing then); the identity recurrence counter (threshold 2, widened by measurement at DEEP-3 — it counted 3 entries on the old words and 15 on the new ones, because "there is no user here" lands as an infra tag); the disposition of the five DEEP-3 proposals at Nate's gate. No carve — IDENTITY.md §9 recommends against one and says what would change that: identity is a lens over this domain, not a second domain, and its counter is the promotion mechanism if the inflow ever justifies a boundary.

Deep record Project Documentation/TESTING.md

Maturity three-tier net (node unit / jest component / Maestro e2e) established and CI-gated for the first two; e2e stays a sim-local gate. A recent cluster of test infrastructure defects (DEF-646/648/658/659/661/662/666) shows flow/fixture rot outpacing upkeep.

Top risks (1) flow rot — flows asserting stale UI shapes; (2) fixture-design debt (DEF-666's three-instance finding); (3) the e2e tier's proof living only on dev machines.

Watchlist the open test-infrastructure defect cluster's drain.

Deep record docs/ (the CRM site itself) + Project Documentation/DOMAINS.md § business-ops

Maturity live and load-bearing for the human loop (inbox actions, build cards, capture viewer, release buttons) — all class-5 derived, regenerated never hand-edited. The Weekly Review ritual that fed parts of it is paused indefinitely per Nate.

Top risks (1) derived-file rot when a generator changes without regeneration; (2) wrongful publication — this domain is core_path: true as of 2026-09-14 ([[DEF-1570]]), having carried false on the words “nothing a user owns lives here”. That was wrong: docs/ holds the bundle viewer and the capture viewer, which render full session transcripts plus GPS, and the same Pages project serves docs/ at talewater.pages.dev with no Access in front — so anything a generator or a viewer change writes INTO a committed docs/ file is published unauthenticated and permanently. The serving code is not here (functions/** is data-layer); what is here is the client and the generators. The retired sentence is the origin of [[DEF-1423]].

Watchlist release-action queue drain (manual per DEF-584); any generator that starts reading live user content into docs/ — today they emit build, cost and pipeline-health figures only, and that is the property worth keeping.

Deep record Project Documentation/DOMAINS.md § integrations (doubles as the cross-domain external-service index)

Maturity working but individually fragile in the way all upstream dependencies are: schema/field drift (DEF-717's class — asserting fields the tool doesn't emit — has an integrations sibling: DEF-653, cdecStationIsLive reading state that wasn't there), quotas/throttles (nominatim-throttle exists for a reason), and outages that present as product bugs ("the gauge is wrong").

Top risks —

Watchlist the migration count — an eighth UPDATE fisheries SET flow_source … means the re-shaped S-B-122 (resolver-version stamp) has not landed; the next name-gate cut rule shipping without the corpus test; DEF-1120 (a second, unguarded writer of the flow pick on the Waters list). *Closed as watched-and-defended:* the DEF-653 class. *Answered:* provider-fixture contract tests — no as framed, yes to realism fixtures at the parse boundary + a weekly live shape probe, filed in the DEEP-2 capture block and sequenced as S-B-107's acceptance evidence. The fixtures half landed 2026-09-05 (S-B-189 (a), sprint SWEEP-5) as seven realism fixture (S-B-189) cases in the four provider test files — six inside the existing null-vs-empty guard describes, F3 inside the S-D-126 selection guard; the probe half rides S-B-107 with a liveness assertion.

Deep record Project Documentation/WATER_DAY_BINDING.md (design record, DEEP-1) + DOMAINS.md § day-water-binding

Maturity the core is sound — a pure, convergent, whole-date reducer (S-B-114) with 55 unit tests on the decision half. Its edges are where every defect landed: three writers of days.fishery_id with no provenance, two representations of "this day holds a recording", and a matcher whose strongest tiers depend on a device-local cache populated by an unrelated screen. The reconcile's WRITE path has no direct coverage (AUDIT.md S-B-114-R7 — R1/R2/R4 all lived there).

Top risks (1) a hand-assigned water is undone by the next re-file — no provenance, and S-D-189 (hand merge/move, Next up) builds on the same primitive (DEF-1113); (2) a wrongly-bound day survives as a ghost because the never-remove guard reads join rows the reconcile leaves stale (DEF-1114); (3) the matcher's authority rests on fisheries.geometry, written only on Waters-tab focus and never synced (DEF-1115); (4) the server clusters a day's learnings before the device has bound its water, so a day's first recording never tags its own water (DEF-1118). ~~Open product fork: DEF-1070(b), should the phone-path resolver mint~~ — RULED by Nate 2026-09-03: option B, it mints through autodetect's identity path (with the existing-water check). No open fork here any more. Options and costs as put to him: WATER_DAY_BINDING.md §7; ruling of record: DEF-1070's 2026-09-03 note; build: S-B-185 (Scoped). Accepted cost: the DEF-685 duplicate class can return on map naming variance, no undo until S-D-189.

Watchlist the recurrence counter (recurrence_owed.py day-water-binding, threshold 2, marked through DEF-1119 at this read — its own filings included — with words widened to catch the day-membership / landmark-day / geometry-resolution / day-boundary tags); DEF-1082 — hold until the next build delivers DEF-1070(a) and one foreground has run, then read the day's window against its recordings' spans for 2026-09-01 (~~the day_recordings count~~ — that table was DROPPED at migration v84, S-B-183 2026-09-03; membership is derived, so the read is now days.started_at/ended_at vs recordings.started_at/ended_at, and a disagreement is no longer representable; runbook, WATER_DAY_BINDING.md §9); ~~S-D-189's ordering against DEF-1113~~ — settled by Nate 2026-09-03: S-B-182 (provenance) lands BEFORE S-D-189, else every hand merge is undone on the next launch.

Deep record Project Documentation/DOMAINS.md § map-spatial + SPEC.md (map sections) + Design/ (visual SOR)

Maturity feature-rich and defect-dense — carved out precisely because it is the largest app-side defect cluster: 65 of 590 register headers match the cluster (map/pin/placement/landmark/basemap, measured by the recurrence matcher at the carve, 2026-08-21). Recent instances: DEF-715 (anchor off-water), DEF-722, DEF-727. The DEF-715 review record (AUDIT) carries load-bearing placement lessons: transitive clustering is unbounded by construction; off-water infrastructure types must be excluded from anchoring.

Top risks (1) placement/anchoring correctness — the recurring class; (2) geometry edge cases (transitive run chains, hairpins, off-water anchors); (3) layer/camera state interactions on the live map screen.

Watchlist recurrence counter (recurrence_owed.py map-spatial, threshold 3, initialized at DEF-727) — this counter is the promotion mechanism: sustained firing is the evidence that buys a dossier or standing agent. One boundary note: glyph-*tooling* defects (tools/glyphs/, tagged tooling /) are inside the domain but outside the counter by design — the counter watches app-side spatial defects.

Deep record Project Documentation/BUILD_LOOP.md

Maturity powerful and defect-dense. The machinery's category cluster (build-loop/release/OTA/tooling/worktree under process /) is the register's largest — 117 of 579 headers at seeding, measured by the recurrence matcher (the literal process / build-loop tag alone: 87, itself the single largest category) — and still the top process category in the most recent hundred; the evidence that earned this domain its tier-2 owner.

Top risks (1) guard-on-guard drift — guards disagreeing with each other (DEF-650's class: hygiene-sweep vs untouched-claim); (2) lifecycle scripts editing shared state on merge (finish-story-on-merge's recurring class); (3) silent no-op automation — a scheduled job that stops doing its job without failing.

Watchlist recurrence counter (recurrence_owed.py build-loop, threshold 3, initialized at DEF-724); OPEN process/build-loop backlog drain rate.

Deep record Project Documentation/SPEC.md (product behavior) + DOMAINS.md § consumer-surfaces

Maturity broad and actively built (four concurrent D-slot stories at the time of this revision). With the map carve, the residual defect profile is content-view correctness (day/journal composition, water/fishery detail, gauge display).

Top risks (1) still the largest domain by file count (~374) at tier 0; (2) the gauge display/acquisition seam with integrations — a wrong reading can originate on either side (the sheet-noted seam question: is the number wrong, or is the *fetch* wrong?).

Watchlist whether the post-carve defect inflow here quiets (it should — the volume leader left); next carve candidate if not: day/journal composition.