Mindbridge · track status

WIRE-TRUTH

WhatsApp fidelity — senders unnamed, replies and @-mentions the parser threw away — and the disclosure rule it exposed: every disclosure item is the same rule broken in a different place, a serving read that filters on the tier axis and leaves the audience axis to whoever remembers.

Opened 2026-08-04 · re-measured 2026-08-16 · 🛑 verify state before starting any row below — this page says of itself it is the most likely thing on it to be wrong.

Next → code — #3118 the answer-node carrier: an ANSWER node's own text is permanently ungateable until it carries its conversation's message — unblocked 2026-08-16 by the conversation-scoped identity PR (issue #3128, PR #3355). Not yet started. decision — the choke-point rule: the predicate is restated 17 times, one current, no detector — rule it into a single home

3 open on the label · 20 rows below · 10 enterprise disclosure · 6 Mizo fidelity · 2 latent · 2 tooling — 9 closed by the 2026-08-16 PR batch, 4 more closed off-label, 2 new follow-ups

3open on the label

7,041open-asks rows, gated

0nudge exposure, measured

1 of 17restatements current

7,091connection rows gated

Enterprise disclosure Mizo fidelity Latent Tooling Why this order Rulings History

The rule has no choke-point for the PREDICATE. Censused 2026-08-07 by encoding, not name: 17 places build an evaluation batch, 9 gates decide survival (5 keyed on INVISIBLE, 4 demanding FULL), 13 spell the structural passthrough — and exactly one of the 17 knows about the VERBATIM_TEXT_NODE_TYPES carve-out. entity_projection_service carries byte-for-byte duplicates and calls evaluate_candidates directly, so its decisions emit no telemetry and no audit row. No detector would fail if any two disagreed.

Enterprise disclosure — launch-blocking

p1 #3141 No choke-point for 'a serving traversal's rows must clear an audience check' — 10 call sites, 2 confirmed holes ten remembered call sites, two holes Alloff-labelclosed

Leverage. The parent of #3135 and #3138 — one rule, broken in many places. PR #3290 (merged 2026-08-14) gated the semantic-connections serving reads and closed ONE hole, not the rule. Census: 10 call sites, 3 methods; 2 confirmed holes (#3135, #3138), one unverified, and five gated only because a human remembered — three by a gate a layer away in another file. Fixing the symptoms individually adds a seventh and eighth copy of "remember to gate". Now carries track:ama-disclose only. Fixed 2026-08-16 via PR #3337 — the serving-traversal-audience build hook + GatedRows carrier. Closed off-label.

p0 #3283 The Hidden Connections feed card renders offer/need titles with no audience check — live on /api/feed/intelligence, and ungateable as written only client-reachable disclosure leak Enterpriseclosed

Live · Regina · sized. The only client-reachable one: client/hooks/use-feed.ts → GET /api/feed/intelligence. One of five row sets is audience-gated four lines apart; the Hidden Connections card reads denormalized titles from the connections table with no carrier pointer, so disclose() has nothing to rule on — ungateable as written, not merely ungated. Needs a decision: give the table provenance, or gate elsewhere. enforcement_enabled=true in prod. Fixed 2026-08-16 via PR #3336 — the card gates on the audience axis; legacy connection provenance healed.

p0 #3135 The batched scoring prompt shows the LLM every retrieved candidate ungated; only the winners are gated at render prompt shows candidates ungated Enterpriseoff-labelclosed

Live · Regina · sized. The scoring prompt feeds the LLM every retrieved candidate before the gate; only the winners are gated at render. The text angle stays ungated — the _retrieve_node_neighbors call site in #3141's census. Now carries track:ama-disclose only. Fixed 2026-08-16 via PR #3338 — candidates are gated before the scoring prompt reads them. Closed off-label.

p2 #3284 Three of the four connection matchers are ungated on the audience axis — and nodes_v2 RLS has no audience predicate to fall back on three matchers skip audience check Enterpriseclosed

Live · Regina. Three of the four connection matchers are ungated on the audience axis, and nodes_v2 RLS carries no audience predicate to fall back on. Fixed 2026-08-16 via PR #3339 — all four matchers gate on the audience axis.

p0 #3128 TypedItemMaterializer reduces a multi-message node's audience to one arbitrary carrier (stable_min_uuid) — under-gating live on Regina audience collapses to one carrier Enterpriseoff-labelclosed

Live · Regina. TypedItemMaterializer groups specs by canonical key and upserts ONE node whose audience carrier is stable_min_uuid — a stability reduction load-bearing for safety without ever being argued as one. Measured 2026-08-07: 155 groups with >1 distinct contributing message, 232 ignored audiences (a prior 497/776 figure over-stated it 3.3× by counting conversations, not audiences). Now carries track:ama-disclose only. Fixed 2026-08-16 via PR #3355 — Option 3, owner-confirmed: content-node identity is (type, canonical text, conversation); the arbitrary-carrier tiebreak (stable_min_uuid) is deleted. state:not-in-effect — the one-time structural backfill must still run at deploy (dry-run, then --apply) before pre-cutover rows read the new identity. Closed off-label.

p1 #3118 ADR needed: an ANSWER node's own text is permanently ungateable under disclose()'s NULL-provenance model answer text permanently ungateable Enterpriseoff-label

Live · blocked by #3128. The structural passthrough keys on source_message_id IS NULL meaning "structural node, tier-governed, always renders" — wrong for an answer node whose display_name is full verbatim text. Measured: all 2,023 answer nodes have source_message_id IS NULL. #2906 closed the question side (1,627 rows); it cannot close this side. The ADR must decide: provenance + backfill, fail-closed by type, or what happens to the 2,023 existing rows. Now carries track:ama-disclose only. Unblocked 2026-08-16 by the #3128 merge — now the track's next code pick-up.

p2 #3124 Drain the scope-classification backlog: 1,243 Q&A pairings are withheld for being unscored, not sensitive backlog withholds 1,243 pairings Enterpriseclosed

Live · Regina · sized · availability. 1,243 Q&A pairings are withheld for being unscored, not sensitive — an availability loss, not a disclosure hole. Fixed 2026-08-16 via PR #3340 — the backlog drains by keyset page.

p1 #3194 Conversation feed cards render a derived summary tier-gated only — an aggregate has no scope to inherit, but its inputs do summary tier-gated, inputs scoped Enterpriseclosed

Live · Regina · not sized (its own body says nobody has sized it). The aggregate has no scope to inherit, but its inputs do. Carries state:not-in-effect. Fixed 2026-08-16 via PR #3349 — Option 1, owner-confirmed: derive + materialise + gate (the restriction column and the disclose-gated aggregate).

p2 #3285 disclose_current_viewer() is SECURITY INVOKER, so a viewer whose own job_function node sits above their tier resolves to no audience identity and is shown nothing viewer resolves no audience identity Enterpriseoff-labelclosed

Live · 12 of 2,106 edges. Over-suppression, not disclosure: RLS hides the viewer's own role edge, job_function resolves NULL, and the audience check short-circuits — every gated row withheld, including wildcard content the viewer is entitled to. 12 of 2,106 role edges point above tier 0. A ruling is owed: SECURITY DEFINER (narrow) vs stop defaulting job_function nodes to tier 3. Now carries track:ama-disclose only. Fixed 2026-08-16 via PR #3341 — the narrow SECURITY DEFINER ruling this row asked for, tenant-guarded. Closed off-label.

— #3334 Re-run the deterministic floor-invariant policy over the 138 legacy rows (follow-up to #3245) 138 legacy rows need re-run Enterprisenew

Follow-up filed at the 2026-08-16 close-out. PR #3261 (merged 2026-08-09) clamps the malformed floor-invariant combination (never_leave_floor=true with clearance_floor=0) at classification time only; the 138 legacy stored rows still read raw floor=0 through disclose(). Owner ruling: schedule the re-run, tracked not forgotten; owner decides when. No priority label.

Mizo WhatsApp fidelity — not launch-blocking

p1 #3054 WhatsApp senders with no usable pushName render as "Unknown WhatsApp user" — 671 people in prod 671 senders render unnamed Mizo

Degradation. 671 people in prod render as "Unknown WhatsApp user" — senders with no usable pushName. The fix-forward PR heals empty-stub JID mappings going forward; the repair (nodes_v2 re-materialization + attempt-cap reset + per-tenant backfill) is tracked as #3335. Carries state:not-in-effect. The fix-forward PR is #3342, merged 2026-08-16.

p2 #3051 WhatsApp file-export replies never resolve to a person — the name fallback misses 100% (0/36 on prod) file-export replies resolve zero Mizoclosed

Degradation. The name fallback misses 100% — 0/36 on prod. Fixed 2026-08-16 via PR #3343 — file-export replies resolve through the shared resolution funnel.

p1 #2999 WhatsApp text replies and @mentions never reach us — contextInfo is on 100% of media and 0% of text text replies and mentions lost Mizoclosed

Degradation · root of #3012 and #3025. 0 of 17,999 plain-text messages carried contextInfo; extendedTextMessage (the only shape that can carry a text reply / @mention / preview) appears zero times in 23,689 events. Closed 2026-08-16 — the contextInfo fix (#3019) landed; 0 of 23,544 pre-deploy rows recoverable. See history.

p2 #3012 Recover WhatsApp @-mentions from LIDs in message text (mentionedJid never arrives) mentions unrecoverable without contextInfo Mizoclosed

Degradation · downstream of #2999. mentionedJid never arrives, so mentions are unrecoverable from message text until contextInfo is captured. Carries state:not-in-effect (fix landed, backfill owed). Fixed 2026-08-16 via PR #3344 — @-mentions recovered from LIDs in message text.

p2 #3025 Use WhatsApp reply edges for answer attribution — we currently infer what the wire states reply edges unused for attribution Mizoclosed

No rung — an improvement, not a defect. Sorts below every measured defect and above the latent ones. Fixed 2026-08-16 via PR #3347 — attribution prefers the reply-linked counterpart.

— #3335 Repair the 671 Unknown-WhatsApp-user people: nodes_v2 re-materialization + attempt-cap reset + backfill (follow-up to #3054) repair 671 people, re-materialize Mizonew

Follow-up filed at the 2026-08-16 close-out. AMA resolves person names from nodes_v2 (not person_display_resolved), so a person_identities-only fix changes nothing a user sees. Owner ruling: fix-forward PR now, repair scheduled later, tracked not forgotten. No priority label.

Latent — zero rows today

p2 #3170 The audience predicate's SQL lane: viewer_needs_you renders an EVENT's verbatim text with no disclosure gate (latent, 0 rows today) SQL lane ungated, zero rows Latentclosed

Latent — 0 rows. A regression guard, not a fix; measured at 0 rows today. Now the sole remaining item in #3190's done-condition (the other two, #3187 and #3188, closed). Fixed 2026-08-16 via PR #3345 — EVENT dropped from the related chips, tier clamp applied, the SQL lane pinned. #3190's done-condition is now met.

p1 #3116 Nightly-nudge event extraction has no tier or disclosure gating at all push surface ungated, unmeasured Latentoff-label

Latent — 0 rows measured. An ungated splice on a push surface (the viewer does not have to ask). Not measured how often a card carries content the viewer's audience excludes. The NUDGE track is on hold by owner decision; recorded, not started. Now carries track:nightly-nudge only.

Tooling & tracking

p2 #3264 The scope-precision audit is the fourth tool the clearance_floor rename broke — and the only one that runs clean while biasing its own verdicts audit runs clean while biased Dev onlyclosed

Tooling. Corrupts our own measurements: the audit runs clean while biasing its own verdicts. Fixed 2026-08-16 via PR #3346 — clearance_floor read with the legacy fallback.

p1 #3190 WIRE-TRUTH cannot be called done until the three ungated audience surfaces are closed (#3170, #3187, #3188) done-condition now rests on #3170 Dev onlyclosed

Closed 2026-08-16 — all three named surfaces are gated: #3170 (PR #3345) plus #3187 and #3188 (closed earlier).

Why is it in this order?

Irreversibility → leverage → exposure → degradation → latent → tooling. Each rung only breaks ties left by the one above it.

Irreversibility. Silent data loss outranks everything — a leak can be closed, a discarded message cannot be recovered.
Leverage. A choke-point that makes a whole class unexpressible outranks any member — #3141 closed two items on its own.
Measured live exposure, weighted by launch. A confirmed hole on Regina (the tenant with a launch date) outranks one elsewhere. Enterprise-only by construction.
Measured live degradation. Content wrong, missing or unattributed for real users — Mizo included — but not disclosure.
Latent. 0 rows today sinks regardless of shape; a regression guard, not a fix.
Tooling, then tracking. Things that corrupt our measurements, then issues that close only when their children do.

🛑 What it deliberately ignores: issue age, filing order, how well understood, how cheap. Within rung 3, a sized item outranks an unsized one. #3025 earns no rung (an improvement, not a defect) and sorts below every measured defect. Several rows within rungs 3 and 4 are mutually tied under every rule above — their internal order is inherited, not derived.

Standing rulings

The track-order.json decided column records this track's standing owner rulings, cited below alongside the page's other notes:

The external-viewer precondition is deferred by the owner (2026-08-09) — Regina has 33 launch-relevant staff without a HAS_JOB_FUNCTION edge, about a dozen of them machine accounts.
The nightly-nudge track is on hold by owner decision — the event-extraction issue (#3116) is recorded, not started.
The floor-invariant re-run (#3334) and the 671-person repair (#3335) are each "scheduled later, tracked not forgotten" by owner ruling (2026-08-16).
The conversation-scoped content-node identity (issue #3128, Option 3) — owner-confirmed 2026-08-16, shipped as PR #3355; the one-time structural backfill is its not-in-effect step.
The conversation-feed aggregate restriction (issue #3194, Option 1) — derive + materialise + gate, shipped as PR #3349; its one-time backfill is the not-in-effect step.
The viewer role-edge resolution (issue #3285) — SECURITY DEFINER, tenant-guarded (the narrow option), shipped as PR #3341.
WhatsApp empty-stub senders (issue #3054) — ship fix-forward now, repair later: PR #3342 forward, issue #3335 repair.

History & forensics

Closed on the label (18) — 9 prior plus the 2026-08-16 PR batch:

The WIRE-TRUTH PR batch (2026-08-16). PR #3336 (the Hidden Connections card, issue #3283), PR #3339 (the three matchers, issue #3284), PR #3340 (the scope backlog, issue #3124), PR #3349 (the feed aggregate, issue #3194), PR #3345 (the SQL lane chips, issue #3170), PR #3346 (the scope-precision audit, issue #3264), PR #3342 (the pushName fix-forward, issue #3054), PR #3343 (file-export replies, issue #3051), PR #3344 (LID mentions, issue #3012), PR #3347 (reply-edge attribution, issue #3025). Off-label: PR #3338 (issue #3135), PR #3341 (issue #3285), PR #3337 (issue #3141), PR #3355 (issue #3128). The status-track redesign (PR #3357) restructured this page the same day.

#2999 contextInfo on 0% of text — closed 2026-08-16, fix #3019 landed (0 of 23,544 pre-deploy rows recoverable).
#3053 unresolved @lid sender — the only irreversible item, fixed three days before it closed (PR #3078, a3a4c29af).
#3138 + #3136 — both closed without anyone working them, fixed as a side effect of the #3141 GatedRows type change (neither closure referenced its number).
#3167 — the 17/9/13 choke-point census; where the banner's numbers came from.
#3209 revived the nightly nudge's dead reach-out leg (PR #3221); #3211 fixed the disclose_simulator crash.
#3187 + #3188 — two of #3190's three named surfaces; the condition now rests on #3170 alone.

#3138 close-out figures. 7,041 of 7,460 reachable ask rows carry a restrictive audience; the 419 remainder split into 282 with no source_message_id (the population #3118 must rule on) and 137 with an unrestricted carrier (needing no ruling). Only 7,460, 7,041 and 282 were measured; 137 is derived by subtraction.

Fixed, issue stayed open. #3117 (FindBridges profile) — the gate shipped in PR #3134 (0f13aedd) but the issue is still OPEN on track:ama-disclose; exposure was 27× larger than first recorded (41,490 of 74,660 reachable Regina pairs, measured 2026-08-07).

What shipped. #2906 (Q&A splice), #3019 (contextInfo declaration), #3022 (forensic record — raw_payload now stores the verbatim body), #3023 + #3024 (reply resolution).

What this page does not claim. Regina's open-asks surface is unobserved (all three audit rows are a personal tenant); the 0/4 FULL telemetry is #3276 on VIEWER-TRUTH; the bridge figure is a reachable pool, not per-request exposure; the choke-point census is a floor (Python only — SQL strings, prompt templates and the client would not appear); post-fix telemetry is still thin.

#3245 (the floor-invariant no-op) closed 2026-08-16 via PR #3261 (prospective only) — its legacy-row step is #3334.