# AGENT-PROMPT-v5-P1-1b — O10 amendment: honest historical snapshots, review-blocker remediation, reviewed re-implementation

**Date:** 2026-08-06
**Follows:** `docs/AGENT-PROMPT-v5-P1-1b.md` and its C8/O8/O9 amendments,
`docs/p1-1b-status.md` (the step-3 Reject / O10 stop record), `docs/PROJECT-STATE.md`
**Authority:** Miguel. This amendment records the two Miguel-owned decisions that close **O10**,
converts the five independent-review findings on rejected `b324a3e…` into binding remediation
requirements, and authorizes the reviewed re-implementation of the O9 amendment's step 3,
followed by the Scope 1 restart. **It authorizes zero prototype writes.** O9-P and O9-D1…D5
remain closed and are not reopened; every fail-closed identity control and stop-and-report rule
not explicitly addressed here remains fully in force. The rejected commit `b324a3e…` stays
neutralized: it is evidence of what failed, never code to resurrect.

## The decisions (O10-D1, O10-D2)

**O10-D1 — the S2 snapshot generalizes under per-field provenance: absence snapshots as
absence.** A DOCFLG snapshot records what was governed at the moment of detection or import.
When the referenced imported DOCEFL rule's `ItemClass` is honest `NULL`/`absent` under O9-D3,
the honest snapshot of that state is itself `NULL`/`absent` — inventing a class to satisfy a
constraint is exactly what O9-P forbids. Therefore, by additive corrective migration:

- DOCFLG snapshot `ItemClass` becomes **nullable**. Every imported historical instance whose
  parent rule carries no governed `ItemClass` imports with snapshot `ItemClass = NULL`,
  provenance `absent`.
- The accepted composite FK `(EFCode, ItemClass, ReviewPriority, BlockingLevel)` **stays as
  declared**; under SQL `MATCH SIMPLE` semantics it self-scopes — a row with any NULL member is
  not checked — so it binds fully-valued rows and exempts honest historical ones without a
  special case.
- Because the composite FK is vacuous for those rows, instance→rule linkage must not be: ensure
  a **plain FK on `EFCode` alone** to DOCEFL exists (add it if the accepted schema does not
  already provide it), so every instance always resolves to its rule.
- A new CHECK makes the exemption prospective-only: a **non-imported** instance must carry all
  snapshot members non-null (`Imported = true OR (ItemClass IS NOT NULL AND ReviewPriority IS
  NOT NULL AND BlockingLevel IS NOT NULL)` — use the existing import marker, no new flag). Every
  Sibyla-era detection snapshots fully and is enforced by the composite FK.
- New named data-quality finding: **`DOCFLG snapshot ItemClass absent`**, expected baseline
  **2,787** (every imported instance, since all 52 parent rules are unassigned at import).
  Measured at import; a differing measured value is recorded and flagged, not a stop.

**O10-D2 — the governed assignment command completes absent snapshots, and never overwrites a
value.** S2's "snapshot, never recomputed" protects recorded values from changing underneath a
decision; it does not mandate that a recorded *absence* stay absent forever — O9-P explicitly
makes absences workable-down through governed audited commands. Therefore, when the governed
`AssignDOCEFLItemClass`-shaped command assigns a rule's `ItemClass`, the same atomic, audited,
actor-stamped operation **also completes the snapshot of that rule's instances whose snapshot
`ItemClass` is `NULL`** (NULL → assigned value, provenance `absent` → `authored`), and **must
never modify any non-null snapshot** — a snapshot value, once present, is immutable exactly as
S2 says. The audit record states the rule, the value, the actor, and the count of completed
instance snapshots; the data-quality finding shrinks by exactly that audited count. No per-rule
`ItemClass` value is authored by this amendment — the 52 assignments remain the over-time work
O9-D3 defined.

## Binding remediation of the five review findings

The independent review's findings on `b324a3e…` are accepted in full and become requirements of
the re-implementation. Green build and tests are, as the review stated, insufficient semantic
proof — each item below needs its own explicit test evidence:

1. **Contract impossibility** — resolved by O10-D1/D2 above; the disposable suite must prove an
   imported instance with NULL snapshot inserts cleanly while a non-imported instance with any
   NULL snapshot member is rejected.
2. **Command authority** — no governed command trigger may trust caller-controlled GUCs.
   Authorization binds to the accepted server-side trusted principal keyed by `session_user`
   (the P1-1a `RuntimePrincipal` pattern). The disposable tests must execute from a
   **non-owner role** and include the forged-GUC denial case: caller-set `sibyla.actor` /
   `sibyla.authorities` grant nothing.
3. **`ImportEvidenceRow` predicate** — the DOCFLG terminal-integrity CHECK's evidence predicate
   must be **company-scoped** and use the stronger evidence identity already present in the
   accepted schema, with a test proving a same-code row from another company cannot satisfy it.
4. **Migration cycle integrity** — `Down` must drop exactly the names `Up` creates; prove it
   with an Up/Down/Up cycle test in the disposable suite.
5. **Closed-vocabulary gate is identity-class for every row** — an unknown **non-null**
   `ItemClass` literal fails closed whether the row is imported or not; only `NULL`/`absent` is
   the completeness finding. Test both directions.

## Ordered execution

1. **Preflight — stop and report if any fails.** Sibyla clean on `feature/p1-1b` at the pushed
   stop-record tip (the commit that neutralized `b324a3e…`) or a descendant, in sync with its
   remote. Prototype read-only check (metadata and `git show` only): local `HEAD`, local
   `origin/main`, and live `refs/heads/main` all still equal the immutable pin
   `b91768513fc638381fbde91f0b576b08220a98f6`; 49/49 roster blobs resolve; the direct
   `Editor/Data` surface is exactly the 48 rostered files.

2. **Governed records commit (one commit, push before code).** Record O10-D1/D2 and the five
   remediation requirements in `docs/p1-1b-status.md`; close **O10** in `docs/PROJECT-STATE.md`
   (open-items table — leaving only O5 — header, phase table, changelog); add the new
   `DOCFLG snapshot ItemClass absent` baseline (2,787) beside the four existing findings in
   `docs/project-todo.md`; update the current-facing evolution page state; include this prompt
   file if not already tracked.

3. **Re-implement step 3 fresh from the stop-record tip.** One additive corrective migration
   (`P11bImportContractAlignment` shape) now carrying: the three O9 nullability relaxations, the
   six-literal `ReviewPriority` CHECK, the terminal-evidence re-scope with the remediated
   company-scoped predicate, the O10-D1 DOCFLG snapshot nullability + plain `EFCode` FK +
   prospective CHECK, the governed command surfaces with O10-D2 completion semantics under the
   server-side principal, and the validator scoping with the five named findings and the
   remediated identity-class vocabulary gate. The accepted P1-1a migration stays untouched;
   `Down` reverses only what this migration adds. TDD first; update the accepted P1-1a fixture
   from historical `EF0000046` to `EF0000053` before seeding; build 0 warnings; ordinary,
   focused, and disposable suites green including the Up/Down/Up and non-owner adversarial
   cases; 0 residual containers; commit and push.

4. **Independent review gate — mandatory, before any restart.** Submit the re-implementation to
   a fresh independent adversarial review round with an explicit Accept/Reject verdict recorded
   in the repository. On Reject: neutralize fail-closed at the branch tip exactly as before,
   record the findings, stop and report. On Accept: record the verdict and proceed.

5. **Restart Scope 1 at its preflight** against the unchanged pin `b917685…` and run the
   ordered Scopes 1–6 of the standing prompt as amended by O8, O9, and this amendment —
   disposable rehearsal first, live pass only after green plus a verified fresh backup. The
   expected data-quality baselines are 119 / 119 / 52 / 221 / **2,787**, plus the two `Routine`
   rows importing verbatim; measured deltas are recorded findings, not stops. Identity-class
   conflicts still stop the scope.

6. **Scopes 7–8** stay behind their own review gates, exactly as before.

## What this amendment does not authorize

Any prototype write. Resurrecting `b324a3e…` or cherry-picking from it. Authoring any of the 52
`ItemClass` values. Overwriting any non-null snapshot, ever. Editing the accepted P1-1a
migration or any P1-0 draft beyond the governed records in step 2. Weakening any identity-class
control. Any shared/live database write before the complete disposable rehearsal passes and a
verified fresh backup exists. Production go-live (O5 remains open, and remains the only item
open once step 2 lands). P1-2+ work. History rewrite in either repository. If the source, the
roster, the counts, or the accepted schema differ in any way this amendment does not govern:
stop and report, never adapt.

## Report at the end

Commit hashes per stage including the review verdict record; the re-implemented migration's
test evidence mapped item-by-item to the five remediation requirements; the data-quality
register with expected vs measured counts (now six named findings); per-table import controls
(*Initial + Expected = Result*) once Scope 1 runs; validator results; parity outcome or
deferral; join-test numbers; and the exact list of what still separates the project from P1-1
acceptance.