AMA-TRUST

Ranked by what a user would notice first. The spreadsheet cluster sorted first because Regina asks a question about her own spreadsheets and gets nothing back — the track's own impact statement. Re-read 2026-09-02: that entire cluster has since closed — the render defect, the aggregation root cause, the ratio operation, the undetected-tail detector, the visible-degradation set (truncation notice, number formatting), and the cross-snapshot stitching defect the tail work uncovered. What a user would notice today is just the coverage LEDGER (#2900, the last p1 — hedging that is structured rather than prose), which is why it is now the whole track's head. Answer-correctness degradations come second, then structural/choke-point work, then decisions and directions last.

What it ignores: priority labels (the live render defect is p2 and sits first), filing order and age, cost or ease, and the needs:ruling flag as a reordering lever — a ruling that blocks work sorts with its work, not above it.

The 2026-08-29 and 09-01 reconciliations — the last three spreadsheet-cluster items verified and closed. Three issues that a landed PR had only partly addressed were re-censused against a live caller and closed once the wiring was confirmed, not just the code: #3320 (typed column metadata) — Deliverable A (the unconditional schema half, PR #3369) was already fully live: TableBlock.column_types carries the declared per-column type derived from the extractor's stored cell kinds, not text guessing; Deliverable B (materialized columnar projection) stays out of scope, deliberately never built. #3322 (LLM tail detection) — raw_sheet_fingerprint/is_cache_eligible confirmed imported by a live caller (spreadsheet_schema.py:44), closing the state:not-in-effect label from PR #3536's traffic gate. #3450 (cross-snapshot stitching) — snapshot_collision_notice() confirmed imported and called inside find_attachment.py's _render_result, a wired production caller. Separately, #3182 (shown-vs-matched under-reporting) closed via commit d6cc95b21 on the #3171 line — all four flagged sites now compare a pre-filter count against the substrate's real read bound. #2881 (rows shown vs rows matched) was briefly reopened when an adversarial review caught an over-claimed closure — 12 of 13 flagged tools route through the _result_header.py choke-point, but get_person_card.py does not and still shows six per-category caps with no matched-vs-shown signal — then re-closed once that was the acknowledged remaining scope rather than new work.

The 2026-08-19→24 batch — fleet waves 2-3, nine PRs merged, two issues closed in-window. In merge order: the per-group ratio operation (PR #3467, closing #3460 — the issue's close landed 2026-08-22, days after the merge) · the LLM tail-detection lane (PR #3536, #3322 — fingerprint + bounded fallback + cache; two panel rounds, 2 majors fixed in round 1, clean round 2) · the truncation notice (PR #3539, #3090 — all four lenses NO FINDING, single round) · the choke-point lesson fold-in (PR #3540, #3183 — verified both rules already widened; docs-only) · the prefix-collision guard (PR #3541, #3186 item 2) · the turn-time instrumentation (PR #3552, no issue) · the backfill provenance stamping (PR #3545, #3314 — its CI re-run survived three unrelated infra-red runs before merging) · number formatting (PR #3563, closing #2903 — 15 call sites collapsed, one real 4-lens panel after the lane self-disclosed it had skipped RULE ONE) · series recognition (PR #3564, #2902 — union-resolved a rebase against #3563; the retrieval-breadth residue stays open on the issue). Two process notes worth keeping: #3547's statement-timeout lift landed under this track's prefix but belongs to the REGINA-DEDUP repair (see that page), and two dedup-judge quality issues (#3551, #3553) are cross-listed onto REGINA-DEDUP where the judge is being consumed. Detail on two of that batch's closures: #2903 (number formatting) collapsed 15 bracketed-title call sites plus the ratio-computation site into one number_format.py module (signed_variance/format_variance_clause, so the sign and the word can never disagree, plus wrap_bidi_isolate) and reproduces the owner's screenshot figures exactly in unit tests. #3183 (evadable choke-point AST rules) closed on investigation rather than a fix — both named rules were already fully widened on main from earlier waves, so the only remaining item was folding the lesson into .ai/choke-points.md Part 5.

(the earlier) 2026-08-19 batch — Fleet 1 wave 1, four PRs merged, three rulings closed. In merge order: PR #3454 (human-safe, bounded spreadsheet grids for the entity surfaces, closing #3381 + #3382) · PR #3455 (deterministic spreadsheet aggregation — resolves the dual conflicting-prompt-instruction root cause of #3448) · PR #3458 (disclose the caps tools actually hit, closing #2881's get_person_card and #2878's now_feed sites) · PR #3457 (refuse INVISIBLE unconditionally on the renderable media path, closing #3096). Rulings the same day: #3309 (ADR-144 stays proposed, closed-lane-only authorized), #3185 (convert the SQL lane via a producer-written column, one-way), #2899 (cut, superseded by #3321/#3385), #2907 + #2909 (parked). Two new rows split out of #3448's repro: #3450 (cross-snapshot stitching) and #3460 (missing ratio operation). Separately measured: 7 days of prod tool-execution timing validated the owner's tool-latency × round-count suspicion, folded into the tabled tooling-PoC ruling above. Detail on three of that wave's closures: #3448 (aggregation tools deployed but never invoked) found the same conflicting routing instruction duplicated in two prompt locations — the system-prompt bullets and attachment_block.py's routing block — so the model never took the second hop into describe_spreadsheet/aggregate_spreadsheet after find_attachment returned rendered rows; prod-validated post-fix at 50.6s, correct. #3096 (renderable-attachment leak on disclosure rollback) now refuses INVISIBLE unconditionally on the renderable media path. #2878 (now_feed four-times-silent cut) now cuts once at the render point with a single disclosed marker. #3313 (message keeps only its first attachment) is fixed going forward — message_attachments now stores every attachment per connector — but Regina's own already-ingested invoice PDF stays unstored until the maildir recovery (issue #3327, still open, see Open Work) actually runs.

The 2026-08-16/17 batch — five of the six spreadsheet items moved. In order of merge: the entity-projection render fix (PR #3363, server half of #3193, whole-grid not bounded) · the ground-truth corpus and scoring harness (PR #3364, #3318) · heuristic detection plus a structural fingerprint (PR #3365, #3319) · per-cell types served and declared per-column types (PR #3369, Deliverable A of #3320) · the type-free detection fallback and six scored fixes (PR #3370, taking header recall 0.292 → 0.875) · the tier/tenant-scoped fetch-by-id resolver (PR #3380, the disclosure prerequisite for #3321). Reconciled 2026-08-17: #3193, #3318 and #3319 were closed against their own acceptance criteria; #3320 and #3321 stay open because each PR shipped a named half and said which (Deliverable A without B; the resolver prerequisite without the builder). The two things the batch created rather than closed — the client-side raw-markdown render and the list_by_type payload cliff — sat recorded in a panel writeup and unfiled until 2026-08-17, and are now #3381 and #3382. 🔑 Worth naming as a pattern: a panel finding recorded in a merged PR body is invisible to every queue in this repo. Filing is what makes it work.

Merged in the cycle before — all verified as ancestors of main: the plan (PR #3145, 2026-08-07) · the choke-point pass (PR #3171, 2026-08-08, six built / four registered open) · the search-surface split (PR #3287, 2026-08-14, closing #3255) · the tsvector byte budget (PR #3303, 2026-08-14, closing #3288). Closed since the last pass: #3127, #3255 (state:not-in-effect), #3288, #3184, #3181 (ruled), and #3317 (the float binary-repr defect, completed 2026-08-15 — this page last listed it "Live"). Three earlier fixes also landed this cycle: reading the attachment for data questions, sizing the attachment budget, and the declined-salvage citability fix — whose metered-refund half was built, reviewed and deleted, because Regina's enterprise deployment never reaches the meter.

The census that founded the track (2026-08-07). 74 spreadsheets truncated, 51 of 74 lose real content, and 50,244,172 characters dropped — a lower bound, not exact (it subtracts two counts that are not the same unit). Three clippers: the per-sheet row cap (1,000 rows, 36 docs), the workbook character budget (250,000, 21 docs), and the budget dying inside the last sheet (20 docs, silent — the worst class, cut mid-row with no marker and reporting full coverage). The markers cannot be trusted as a census in either direction: the row cap genuinely binds 60 docs but only 36 say so, and the character budget binds 52 but only 21 do; the silent twenty sit between 250,448 and 250,822 characters, the budget expiring on the last sheet so the loop never reaches the marker-writing check the code comment at xlsx_extractor.py:324-330 predicts. Uncapped these render 127.4M characters against 12.4M stored, of which 64.9M (50.9%) is padding from sheets padded to Excel's 1,048,576-row ceiling. The denominator was also wrong — 2,198 spreadsheets, not 6,039 document kinds.

Three fixes, all measured, all dead. Raise the budget: 132,660 substantive rows carrying 33.1M characters sit beyond row 1,000, so no budget reaches them — it plateaus at 45 of 74. Filter the filler rows: 0.7% of the budget actually spent, zero documents completed (an earlier "3 docs" was refuted). Paginate past the cliff: reading is O(rows) and the answer is O(1) — you cannot read your way to an aggregate. One document alone holds 2,337,469 substantive characters against a 250,000 budget.

The design. Lossless capture: one row per worksheet in a side table, no embedding, no tsvector, not new nodes — both caps, the truncated suffix and every marker deleted. The search profile (sheet names, headers, labels, row counts) carries further than intended: searchable_text has four downstream consumers — the full-text generated column, the node embedding, the sensitivity tier classifier, and the fallback arm of two content chains. The split (PR #3287): searchable_text = profile + summary + roster, the embedded surface = profile + summary. The "length dilutes the embedding" theory is refuted — the variable is TOPICALITY. The profile is written at extraction — sheet names, column headers, label values, row counts — and ranking should improve, because 250k of numeric cells today dilute term weighting and the code already calls the current value "an unparseable digit run". No migration and no materializer change — both already land in node properties. A summary stage ships with it, because a spreadsheet's mechanical title was "Spreadsheet: Sheet2" — which is why images, whose vision model writes them one, outranked spreadsheets on every topical question.

Re-extraction is lazy, not a sweep. The bump ships with the code (PR #3287, xlsx-extractor v2 → v3); a workbook re-extracts on the next enrichment pass of its own source, so a dormant tenant's sheets stay at v2. Re-measured 2026-08-15: 1,940 of 2,672 nodes at v3, 572 at v2, 60 at v1, one hundred unversioned; 2,507 documents hold lossless grids (6,373 sheets, 28 MB). The bump also turned a latent defect live: 2,612 of 2,672 nodes now carry an empty body_text — the inline-render row above. Median indexed characters recovered from the v2 trough of 313 to 1,707 (v1: 2,278). The embedding half needs no re-extraction: v2 nodes already carry a profile, so the read-time composer took the profile branch the moment this deployed.

Table detection. Header found on 94.7% of sheets, but only 39.6% on row 0; label column first 73.7%; both 53.5% — detect, don't assume. Prior art is not shippable: TableSense publishes annotations only (no model, no weights), ExcelTableCNN self-reports 40.3% recall. The "~71%" coverage figure is plausibility, not accuracy. Typing is nearly free once boundaries are known — 0.998 median column-type purity, 76% median of columns numeric — so labels really are the small minority worth indexing.

Storage reality. Node table 2,317 MB: embedding 469 MB, HNSW indexes 1,085 MB, trigram 57 MB, full-text 39 MB, all searchable text 26 MB. A vector is 6 KB whether the node holds 500 characters or 250,000, so node count is the expensive axis — why sheets get a side table, not nodes. Regina's rows sit in two indexes, ~21.9 KB per node marginal.

The tsvector budget (PR #3303). Ceiling 1,048,575 bytes; to_tsvector raises rather than truncating. A character budget never overflowed — it peaked at 89.0% (CJK 2-char tokens) — so the case for UTF-8 bytes is the margin (89.0% → 45.8%), not a demonstrated overflow. Cost re-measured in bytes: 26 rows exceed 200,000 bytes (2 pdf, 24 xlsx), one more than by characters. The largest production PDF carries 959,521 characters and builds only 81,068 bytes (0.0845 per character) because prose repeats, while the worst real ratio is 2.1193. Truncation is not free even for surviving terms: ts_rank_cd cover density and an absolute-score filter both move.

Choke-points and the second census. Eleven questions named; six have a choke-point. The gates: two rulings — the document-body expressions (#3185, open) and the turn ceiling (#3181, ruled unbounded); the citation regex made unbounded (#3184); the prefix→media_type table deleted rather than guarded; the budget rule made name-blind and given its first test file. The pass itself refuted six claims (citability was decided from per-turn tool identity but gated on thread-scoped text; the per-turn character figure was 120,000, not 84,000). A second census found the fallback-order expression across five sites — document_scope_classifier, stage_inputs._cached_node_text, node_document_repository, entity_projection_service and sensitivity_classification_phase — each choosing among a node's content fields; two return nothing for a spreadsheet, and one of those gates conversation analysis — latent until the bump ran, live the moment it did. The one-looking-defect that is not: two chains are exact reverses, and the property whitelists are disjoint so the order cannot change the answer.

What this page does not claim. Post-merge production telemetry has not been measured. Corpus-wide re-extraction cost is estimated from 74 documents, not the 2,306 on production. The structural census covers Regina only. The template-signature count keys on sheet names (collisions unchecked). The search index is configured for English on Arabic content — pre-existing, out of scope. Corrected 2026-08-17: this section used to say the one-attachment-per-message limit had never been sized. It has — 57% of Regina's document-carrying maildir messages lost at least one file, ≥71,440 documents recoverable — and the model fix has since shipped forward-only. What is still unclaimed is any measurement of the 2026-08-16/17 batch on production: the detection scores come from a 22-sheet labelled sample, and no post-merge telemetry has been read for the render fix or the typed read path.