Mindbridge · track status

WIRE-TRUTH

WhatsApp fidelity — senders unnamed, replies and @-mentions the parser threw away — and the disclosure rule it exposed: every disclosure item is the same rule broken in a different place, a serving read that filters on the tier axis and leaves the audience axis to whoever remembers.

Opened 2026-08-04 · re-measured 2026-08-16, Next call re-checked 2026-08-17, page re-derived 2026-08-25 (the #3128 row flipped back to open that week — see below) · 🛑 verify state before starting any row below — this page says of itself it is the most likely thing on it to be wrong, and its Next call was already stale by one day.

Next → code — the deep-dive ruling on #3554 (11 content-node types skipped by dedup since the #3128 cutover — intentional or regression), then the owner-scheduled repairs #3335 (671-person) and #3334 (floor-invariant re-run) — which is what this track is now down to. The #3128 row below reopened 2026-08-24 and its remediation has since run; its remaining follow-ups live on AMA-DISCLOSE and REGINA-DEDUP. decision — the choke-point rule: the predicate is restated 17 times, one current, no detector — rule it into a single home

3 open on the label (re-derived 2026-08-25: the #3490/#3128-era content-identity work REOPENED this label's founding row and added #3554) — the closed ledger stands at 9 closed by the 2026-08-16 PR batch, 4 more closed off-label, 2 follow-ups filed, and 1 row reopened. The rows below are the full history, open and closed; the open ones are marked.

3open on the label

7,041open-asks rows, gated

0nudge exposure, measured

1 of 17restatements current

7,091connection rows gated

Enterprise disclosure Mizo fidelity Latent Tooling Why this order Rulings History

The rule has no choke-point for the PREDICATE. Censused 2026-08-07 by encoding, not name: 17 places build an evaluation batch, 9 gates decide survival (5 keyed on INVISIBLE, 4 demanding FULL), 13 spell the structural passthrough — and exactly one of the 17 knows about the VERBATIM_TEXT_NODE_TYPES carve-out. entity_projection_service carries byte-for-byte duplicates and calls evaluate_candidates directly, so its decisions emit no telemetry and no audit row. No detector would fail if any two disagreed.

Enterprise disclosure — launch-blocking

p0 #3128 TypedItemMaterializer reduces a multi-message node's audience to one arbitrary carrier (stable_min_uuid) — under-gating live on Regina ↩️ REOPENED 2026-08-24 — remediation applied 08-25 Enterpriseoff-label

↩️ Reopened. Fixed 2026-08-16 via PR #3355 — Option 3, owner-confirmed: content-node identity is (type, canonical text, conversation) — and closed off-label with state:not-in-effect pending the one-time backfill. The backfill healed only part of the population: PR #3560's exposure census (2026-08-24) found Regina 1,685 / Hassan Abozeid 15 / Sudqi 2 at-risk bare content nodes still under-gating live, so the issue is open again as a p0. The remediation then ran as an ops action on 2026-08-25 — scope nulled fail-closed on 1,702 nodes fleet-wide (leak ends as over-hiding, not exposure), 21,368 SAME_CONTENT_AS sibling edges written, 13,138 duplicate bare nodes deleted; a 4,187-row doc_need_matches-blocked follow-up remains. The full story lives on the AMA-DISCLOSE and REGINA-DEDUP pages; this row keeps the wire-truth lineage: the arbitrary-carrier reduction was this track's founding disclosure finding.

p1 #3554 graph_dedup skips 11 content-node types entirely (opportunity/need/problem/solution/…) since the #3128 cutover — intentional or regression? needs deep-dive — filed 2026-08-24 Enterprise

Filed 2026-08-24, cross-listed on REGINA-DEDUP where the repair campaign lives. Since the #3128 conversation-scoped identity cutover, graph_dedup processes none of the 11 typed content-node classes — nobody has ruled whether that is an intended consequence of per-conversation identity (same text in two conversations is now supposed to be two nodes) or a regression that quietly re-fragments the graph. The sibling-linker lane measured the fragmentation it would act on: 67% of 69,396 content nodes are same-text fragments across conversations, ~24,600 of which would collapse to one group each — but that measurement is an argument for LINKING (SAME_CONTENT_AS, shipped as PR #3567), not for merging. The deep-dive owes a ruling, not a fix.

— #3334 Re-run the deterministic floor-invariant policy over the 138 legacy rows (follow-up to #3245) 138 legacy rows need re-run Enterprisenew

Follow-up filed at the 2026-08-16 close-out. PR #3261 (merged 2026-08-09) clamps the malformed floor-invariant combination (never_leave_floor=true with clearance_floor=0) at classification time only; the 138 legacy stored rows still read raw floor=0 through disclose(). Owner ruling: schedule the re-run, tracked not forgotten; owner decides when. No priority label.

Mizo WhatsApp fidelity — not launch-blocking

— #3335 Repair the 671 Unknown-WhatsApp-user people: nodes_v2 re-materialization + attempt-cap reset + backfill (follow-up to #3054) repair 671 people, re-materialize Mizonew

Follow-up filed at the 2026-08-16 close-out. AMA resolves person names from nodes_v2 (not person_display_resolved), so a person_identities-only fix changes nothing a user sees — which is exactly why the surface this names was measured directly on 2026-08-30: nodes_v2 now carries 0 of 5,115 person nodes with the placeholder, down from 671. 🛑 The outcome is verified, the mechanism is not. Nothing recorded here says the re-materialization, attempt-cap reset or backfill ever ran, so the zero may be the ordinary fold re-materializing healed names rather than this repair. Needs a call: close it as satisfied, or establish what cleared the rows first. Do not close it on the count alone.

Latent — zero rows today, and now zero open items too

Both rows this cohort ever held are closed — see History. Nothing latent is currently open on this track.

Tooling & tracking — zero open items

Both rows this cohort ever held are closed — see History. Nothing tooling-related is currently open on this track.

Why is it in this order?

Irreversibility → leverage → exposure → degradation → latent → tooling. Each rung only breaks ties left by the one above it.

Irreversibility. Silent data loss outranks everything — a leak can be closed, a discarded message cannot be recovered.
Leverage. A choke-point that makes a whole class unexpressible outranks any member — #3141 closed two items on its own.
Measured live exposure, weighted by launch. A confirmed hole on Regina (the tenant with a launch date) outranks one elsewhere. Enterprise-only by construction.
Measured live degradation. Content wrong, missing or unattributed for real users — Mizo included — but not disclosure.
Latent. 0 rows today sinks regardless of shape; a regression guard, not a fix.
Tooling, then tracking. Things that corrupt our measurements, then issues that close only when their children do.

🛑 What it deliberately ignores: issue age, filing order, how well understood, how cheap. Within rung 3, a sized item outranks an unsized one. #3025 earns no rung (an improvement, not a defect) and sorts below every measured defect. Several rows within rungs 3 and 4 are mutually tied under every rule above — their internal order is inherited, not derived.

What the audit found — generated

⚠︎ The prose above cites 1 issue that is no longer open

#3128. A closed issue named as current work is the drift this section exists to surface — re-derive the prose, or move the reference into History.

Evidence below is generated from the read-only audit of 2026-08-29 and reconciled against the open issues at build time. Every claim cites the issue it came from. Nothing here is a decision — rulings stay in the prose above, which is written by hand.

#3335 [L2-g3-w5] Repair the 671 Unknown-WhatsApp-user people: nodes_v2 re-materialization +…prodhigh confidence

Repair has not run; the population is smaller than the title. Prod, 2026-08-29: whatsapp_jid_mappings total = 1,143. Rows with no usable name at all (push_name, verified_name and profile_name all null/blank) = **289**, not 671; of those, 287 sit at profile_attempts = 3 (the cap) — 231 with display_name_source='raw_jid', 56 with 'phone_number' — and only 2 at profile_attempts = 0. Every one of the 289 has person_node_id resolving to a NULL nodes_v2 display_name in the left join, i.e. no linked person node. So step 2 (attempt-cap reset) has demonstrably not been performed. Separately 689 of 1,143 mappings overall are at profile_attempts >= 3, and 35 sit at profile_fetch_status='pending'. Naming residue elsewhere is near-zero: nodes_v2 person rows with display_name/canonical_name matching 'Unknown%' = 0; person_identities matching = 2.

#3554 graph_dedup skips 11 content-node types entirely (opportunity/need/problem/solution/...)…codehigh confidence

origin/main:backend/app/slices/graph_building/constants.py:364-374 — V2_NODE_DEDUP_THRESHOLD still holds exactly 8 keys (company, person, topic, skill, location, product, interest, trait); none of the 11 content types. origin/main:backend/app/slices/graph_building/phases/graph_dedup_phase.py:562 still reads `dedup_types = [t for t in present_types if t in V2_NODE_DEDUP_THRESHOLD]`, so those types are silently filtered out of every dedup pass. Prod re-measurement (supabase execute_sql, schema-qualified public.nodes_v2, 2026-08-29): the 11 types now total 46,276 nodes; grouping by canonical_name with the trailing `::<uuid>` conversation discriminator stripped gives 5,137 nodes sitting in a group with a sibling (11%). The leak half: bare (non-suffixed) nodes = 3,185, of which only 17 carry >1 provenance_conversations; only 2 nodes fleet-wide carry the `properties.leak_fix_batch` stamp (both with source_message_id NULL), so the null-the-anchor remediation described in the comments was never run at scale — the population it targeted has instead shrunk on its own (2,373 bare multi-conversation nodes at filing vs 17 now).

Open questions — what the audit could not settle

#3335 Whether all 289 are the same cohort as #3054's 671 (the issue names no ids). Close it with the #3054 population query if it recorded one, or bound it with `select tenant_id, count(*) from whatsapp_jid_mappings where profile_attempts>=3 and coalesce(nullif(trim(push_name),''),nullif(trim(verified_name),''),nullif(trim(profile_name),'')) is null group by 1;` and confirm against the tenants #3054 named.
#3554 WHAT retired the ~2,350 bare multi-conversation nodes between 2026-08-24 and now is not established — no leak_fix stamp accounts for it (2 stamped nodes only), so a re-materialize/prune pass is the candidate but unproven. Close with: `select date_trunc('day', updated_at), count(*) from public.graph_merge_snapshots where created_at > '2026-08-24' group by 1 order by 1;` plus `git log --since=2026-08-24 --oneline origin/main -- backend/scripts/ops/leak_fix backend/app/slices/graph_building/repositories/node_prune_repository.py`. Also unclosed: whether the 17 residual bare multi-conversation nodes are still served (needs the audience_gate trace per node).

Not yet assessed — filed after the audit

#4956 Graph person nodes go stale after a WhatsApp person split or merge: nothing…

3 assessed issues closed since the audit and are not shown — a closed issue's evidence is history, and printing it as current is how a page starts lying.

Standing rulings

The track-order.json decided column records this track's standing owner rulings, cited below alongside the page's other notes:

The external-viewer precondition is deferred by the owner (2026-08-09) — Regina has 33 launch-relevant staff without a HAS_JOB_FUNCTION edge, about a dozen of them machine accounts.
The nightly-nudge track is on hold by owner decision — the event-extraction gating gap it recorded (#3116) closed 2026-09-01 (see History); the track itself has not restarted.
The floor-invariant re-run (#3334) and the 671-person repair (#3335) are each "scheduled later, tracked not forgotten" by owner ruling (2026-08-16).
The conversation-scoped content-node identity (issue #3128, Option 3) — owner-confirmed 2026-08-16, shipped as PR #3355; the one-time structural backfill is its not-in-effect step.
The conversation-feed aggregate restriction (issue #3194, Option 1) — derive + materialise + gate, shipped as PR #3349; its one-time backfill is the not-in-effect step.
The viewer role-edge resolution (issue #3285) — SECURITY DEFINER, tenant-guarded (the narrow option), shipped as PR #3341.
WhatsApp empty-stub senders (issue #3054) — ship fix-forward now, repair later: PR #3342 forward, issue #3335 repair.

History & forensics

Closed on the label (18) — 9 prior plus the 2026-08-16 PR batch:

The WIRE-TRUTH PR batch (2026-08-16). PR #3336 (the Hidden Connections card, issue #3283), PR #3339 (the three matchers, issue #3284), PR #3340 (the scope backlog, issue #3124), PR #3349 (the feed aggregate, issue #3194), PR #3345 (the SQL lane chips, issue #3170), PR #3346 (the scope-precision audit, issue #3264), PR #3342 (the pushName fix-forward, issue #3054), PR #3343 (file-export replies, issue #3051), PR #3344 (LID mentions, issue #3012), PR #3347 (reply-edge attribution, issue #3025). Off-label: PR #3338 (issue #3135), PR #3341 (issue #3285), PR #3337 (issue #3141), PR #3355 (issue #3128, since reopened — see the Enterprise cohort). PR #3362 closed issue #3118 (answer-node carrier) the following day, 2026-08-17. Issue #3190 (the done-condition tracker) closed the same day as the batch once its three named surfaces — #3170, #3187, #3188 — were all gated. The status-track redesign (PR #3357) restructured this page the same day.

#2999 contextInfo on 0% of text — closed 2026-08-16, fix #3019 landed (0 of 23,544 pre-deploy rows recoverable).
#3053 unresolved @lid sender — the only irreversible item, fixed three days before it closed (PR #3078, a3a4c29af).
#3138 + #3136 — both closed without anyone working them, fixed as a side effect of the #3141 GatedRows type change (neither closure referenced its number).
#3167 — the 17/9/13 choke-point census; where the banner's numbers came from.
#3209 revived the nightly nudge's dead reach-out leg (PR #3221); #3211 fixed the disclose_simulator crash.
#3187 + #3188 — two of #3190's three named surfaces; the condition now rests on #3170 alone.

#3138 close-out figures. 7,041 of 7,460 reachable ask rows carry a restrictive audience; the 419 remainder split into 282 with no source_message_id (the population #3118 must rule on) and 137 with an unrestricted carrier (needing no ruling). Only 7,460, 7,041 and 282 were measured; 137 is derived by subtraction.

Fixed, issue stayed open. #3117 (FindBridges profile) — the gate shipped in PR #3134 (0f13aedd) but the issue is still OPEN on track:ama-disclose; exposure was 27× larger than first recorded (41,490 of 74,660 reachable Regina pairs, measured 2026-08-07).

What shipped. #2906 (Q&A splice), #3019 (contextInfo declaration), #3022 (forensic record — raw_payload now stores the verbatim body), #3023 + #3024 (reply resolution).

What this page does not claim. Regina's open-asks surface is unobserved (all three audit rows are a personal tenant); the 0/4 FULL telemetry is #3276 on VIEWER-TRUTH; the bridge figure is a reachable pool, not per-request exposure; the choke-point census is a floor (Python only — SQL strings, prompt templates and the client would not appear); post-fix telemetry is still thin.

#3245 (the floor-invariant no-op) closed 2026-08-16 via PR #3261 (prospective only) — its legacy-row step is #3334.

Nightly-nudge gating — closed 2026-09-01. Issue #3116 (event extraction had no tier or disclosure gating) stayed open past the 2026-08-16 batch pending live-exposure evidence: a 2026-08-07 prod measurement found the gap real but exposure structurally zero (no scope-classified tenant had nudges enabled). It closed at the 2026-08-29 track reconciliation once proactive/disclosure.py shipped and was wired into the nudge substrate (substrate.py:345,477) — the NUDGE track itself remains on hold by owner decision, but the gating hole this issue tracked is fixed.