Examples in the curated opening: an exemplar item kind, one provenance projection, and the manual proof (integration under #193)

[holden]

Scope revision, 27 September 2026. This replaces the body posted earlier today. The audit found that the earlier text restated constraints already owned by #181, #190, #196, #197 and #203, and named no schema, seam or wireframe. Three things move out: the bot nomination adapter goes to #197 (the paragraph to add there is under Handoffs); the cross-issue wording fixes go to #190, #198 and #201/#194; the discovery "candidate adapter" is withdrawn, because the seam it wanted already exists (#181 S3) and the open product decision it assumed is #193's to make. What stays is the work only this issue can do. A second audit of the earlier body (27 September) asked for four clarifications; two were already answered by this rewrite (the exemplar item kind; keeping bot persistence out), and two are taken below: Prerequisites and sequencing, and the one named discovery path under Discovery.

Purpose

An exemplar (#181 layer 2: a person, a work, a passage that someone cited as an example of a meaning, with a rationale and evidence) cannot be selected into a saved composition today, and nothing on the page tells a reader where an example came from beyond one sentence. This issue adds the one item kind the composition schema lacks, one provenance shape that every surface draws from, and proves the whole path by hand: a human nominates, a reviewer accepts, an operator composes and publishes, the page renders it with inference and providers offline, and the card says why it is there.

It fits the one model the site already has. Every "X is an example of Y" is an assertion_revisions row between two objects, told apart by predicate, method, actor kind and source: WordNet's instance_of under method: "source", a person's illustrates under "curated", later a persona's under "persona:<slug>@<v>" and, when #189 lands, votes on the same revisions. A composition is not a fourth kind of claim. It is a selection of eligible claims and content, with its own approval. This issue adds no predicate, no actor kind, no vote, no candidate store and no event log.

Verified starting point (origin/main @ c6bd882, devils_dictionary_v2, 27 September 2026)

Fact	Where
editorial_composition_items.item_kind IN ('content', 'sense_quotation', 'work'); assertion_revision_id is an optional annotation with ON DELETE SET NULL and no shape rule. No item kind can hold an entity subject.	20260926233642_create_curation_foundation.exs lines 407–476
Curation.Eligibility accepts a claim that is current, active and passes Claims.visible(:public). It does not require accepted.	curation/eligibility.ex:370-379
Claims.visible(:public) hides rejected/withdrawn, and hides an unaccepted nomination only when the subject is entity/person. The illustrates-wide gate is #190, unbuilt.	claims.ex:434-470
Claims.Contributions.propose/6 takes a user scope only and hardcodes method: "curated". No code creates a bot actor.	claims/contributions.ex:86-133
Examples.for_page/3 items already carry claim.{method, rationale, nominated_by, evidence, review_state, manifest} and sources[]; signals.featured_at is always nil.	examples.ex:385-460, 655-690
The seeder writes metadata manifest, manifest_checksum, row, row_key, curator and the resolved sense external_key on the revision.	examples/seeder.ex:355-367
Published.current/1 returns %{composition, version, receipt, lead, highlights, withheld} and withholds without substituting. Nothing in the web layer calls it.	curation/published.ex:39-59
PR #202 (accepted, unmerged): Curation.Opening with Highlight{kind: :artwork | :quotation}, Reason{kind: :policy | :source_match | :editorial, author}, Review{state, selected_by, reviewed_by}.	branch codex/consolidation-2026-09-27
PR #210 (unmerged): Runtime.Packet is built from Bierce entries, definitions and sense quotations only. It carries no exemplar and no discovery result.	same branch, curation/runtime/packet.ex
Discovery: a result promotes to the register only through /connect, prefilled with subject, object (the sense), evidence_revision and evidence_locator for a corpus candidate that has an object_id and a sense_id; an Artsy card prefills subject alone. ConnectionLive reads those params. The metadata.from_result provenance #181 S3 described is not written today.	components/culture.ex:1617-1633, artwork.ex:105, live/connection_live.ex:172-206
Providers that leave a durable identity record behind a result (identity_record/1): CineGraph, Commons, the Met, Open Library, PoetryDB, Wikiquote. The news, stock-photo, GIF and music providers do not, by design (README promise 6).	discovery/providers/*.ex

Live counts: instance_of current active 66,573; illustrates current active 5 (all test rows), 10 revisions in all; assertion_reviews 2; assertion_votes 0; no community source row; actors: import 11, user 2, unknown 1, bot 0; curation_configurations, curator_profiles, editorial_compositions all 0; discovery_results 1,729, of which 639 carry an object_id.

The dev database also carries the unmerged runtime migrations from PR #210, applied in the 13:11Z incident on #194 and awaiting the owner's rollback decision. Nothing here depends on them; all tests run on an isolated MIX_TEST_PARTITION.

Vocabulary

Three assertions that share a subject and must never be confused:

• source-listed (Examples backbone: the record's instances (WordNet, Wikidata P31) as the pre-adjudicated layer under the cited exemplars (#105), one read model, one section, two registers — so /define/war names its 43 wars now and /define/coward can carry an attributed example later #181 layer 1): a source filed the thing under a meaning. instance_of, no rationale, no actor. Chip.
• cited (Examples backbone: the record's instances (WordNet, Wikidata P31) as the pre-adjudicated layer under the cited exemplars (#105), one read model, one section, two registers — so /define/war names its 43 wars now and /define/coward can carry an attributed example later #181 layer 2): a person or bot attached the thing to a meaning with a why. illustrates, rationale, evidence, its own review. Card.
• selected (Curation persistence: versioned panels, ballots and reviewed page compositions #196): a composition version placed an eligible thing in a slot, with an attributed note. Opening tile. Selecting never cites; citing never selects.

A provenance is the answer to "why is this on the page", assembled from those records and only those. It is a read projection with no table of its own.

What this issue owns

Owns	Does not own (and who does)
The exemplar item kind and its eligibility	Bot nominations, propose/6 bot scope, curation_nominations, no-reopen of rejected claims: #197, gated by #190
Examples.Provenance, drawn on the card, the chip, the person page and the opening	The public illustrates gate: #190
The manual proof: nominate → accept → compose → publish → read offline	Runs, ballots, decisions, selection-v1: #196/#197/#203
The exemplar mapping into Opening.Highlight	The reader reading compositions at all (#156 Phase 2) and the page binding (#194)
Deterministic tests for the above	Refresh, freshness, leases: #198

Schema: one additive migration

Read against the live editorial_composition_items. Nothing existing changes; the new kind is a fourth value of the existing column with its own shape rules. mix ecto.gen.migration add_exemplar_composition_items.

Change	Rule
item_kind CHECK gains 'exemplar'	in editorial_composition_items_shape
item_object_id	required for an exemplar at insert (the existing trigger already demands it). It is the claim's subject: an entity/* or content/* object.
assertion_revision_id	required for an exemplar at insert. New composite FK (assertion_revision_id, item_object_id) → assertion_revisions (id, subject_object_id) so the claim is about the object shown, the way content_revision_id is tied to content_id. Needs a unique index on assertion_revisions (id, subject_object_id), which is free because id is the key. ON DELETE SET NULL (assertion_revision_id); required_references already records it, so a deleted claim withholds the item (:claim_deleted).
content_revision_id	allowed for an exemplar only when the subject is a content object (a passage or quotation): pins the words shown, through the existing composite FK. NULL for an entity subject; entities have no revisions, and the label and image are read from the registry at read time under the existing retire/split check.
sense_revision_id, locator, words_sha256, catalog columns, source_record_revision_id	NULL for an exemplar (CHECK)
meaning_sense_revision_id / meaning_lexeme_id	as today, exactly one; must agree with the claim's object (below)
role	highlight only. The lead stays a content definition (K10 unchanged).
selection_origin	manual today; panel_recommendation/human_override/human_added arrive with #197 for every kind, not here

No table for candidates, nominations or provenance. No change to assertions, assertion_revisions, assertion_reviews, predicates or predicate_endpoint_rules.

Eligibility of an exemplar item (Curation.Eligibility)

An exemplar item stands when all of these hold, else it is withheld with the named reason:

Check	Reason when it fails
the revision is current and active, predicate illustrates	:claim_not_current
its latest review is accepted (not merely visible)	:claim_not_accepted
it passes Claims.visible(:public) and Claims.Visibility rights redaction	:claim_not_visible
its object sense is the item's meaning_sense_revision_id's sense, or its object concept is refers_to by the item's meaning_lexeme_id	:meaning_mismatch
the review context's fingerprint still matches the endpoints (the card's changed since review)	:claim_context_changed (decision 2)
the subject object is active, and a content subject's revision is current	existing :object_deleted / :content_not_current

The fingerprint the reviewer accepts includes the claim revision id and the review-context fingerprint, so a re-worded claim or a moved sense needs a new composition review (#196 rule 4). This is stricter than the public gate on purpose: a highlight that leans on a claim waits for a reviewer even while the page's card does not. It does not depend on #190: accepted is required here regardless of what the public gate does.

Display identity

Within one arrangement, no two items may show the same thing: an exemplar item and a work item for the same object, or two exemplars of one object under two meanings. The key is the subject object id, plus the content revision's words for a content subject. Compositions.create_version/3 refuses with {:duplicate_display_identity, object_id} (check whether slice 1's arrangement rule already covers this before adding it).

The provenance projection

One function, Examples.Provenance.of/2, over an Examples item, a CompositionItem or an Opening.Highlight, for a viewer. It returns typed stages, with :unknown where the record is silent and :none where the record says nothing happened. It reads only through Claims.visible/2 and Claims.Visibility, so a hidden nomination has no stage at all, and no count, tombstone or label betrays it.

%Examples.Provenance{
  id: "ex:<assertion_id>" | "inst:<family>" | "sel:<composition_item_id>",
  source: [%{slug, name, tier, assertion_id, record_url | nil}] | :none,      # every source, kept apart; never merged into one
  nomination: %{by: %{kind: :user | :bot, label, actor_id}, origin: :form | :manifest | :agent | :unknown,
                manifest: %{slug, checksum, row} | nil, rationale, meaning: %{sense_key, gloss, sense_revision_id},
                evidence: [%{role, url | nil, attribution | nil, locator | nil}], at} | :none,
  agent: %{profile: %{slug, version}, model: %{digest, config}, run_id, proposal_id, note} | :none | :unknown,  # :none for human work; filled by #197
  review: %{state, by: %{label} | nil, decided_at | nil, context_changed?: boolean} | :none,
  selection: %{kind: :ranked, signals: %{...}}                                   # the examples section: Rank.order/1, nothing else
           | %{kind: :composed, composition_id, version, position, selection_origin, selected_by: %{kind, label}, note | nil}
           | :none,
  publication: %{receipt_id, authority_kind, actor: %{label}, committed_at, superseded_at | nil, withdrawn_at | nil} | :none
}

Stage	Read from	:none means	:unknown means
source	assertions.source_id, origin_key, source_records.url	not source-listed (an exemplar)	never
nomination	assertions.{origin_actor_id, submitted_by_actor_id}, assertion_revisions.{rationale, metadata, method, inserted_at}, assertion_evidence	not cited (an instance)	a claim with no actor and no manifest metadata (the five test rows)
agent	method prefix; curation_nominations and its run when #197 lands	method: "curated"	method: "persona:…" before #197's records exist
review	assertion_reviews latest, review_contexts.fingerprint vs current endpoints	no review yet	never
selection	Rank.order/1 signals, or editorial_composition_items + version author	not in a composition (ordinary list inclusion is ranking, not an event)	never
publication	editorial_composition_publications receipt for the item's version	unpublished	never

Rules the projection must keep:

• A page view is not an event; a manifest replay is not a nomination. Nothing is written by reading, and :held replays leave nomination.at alone.
• Row update time is never a publication time. Only committed_at on a receipt is.
• Public display identities only: actor label, never user_id, email or IP. Never a rationale, evidence URL or title of a claim the viewer may not see.
• The same struct feeds every surface. The card, the chip, the person page, the opening disclosure and Curation transparency: equal votes, reproducible selection, profiles and version history #203's history read one function, so attribution cannot disagree.

Wireframes

Exemplar card in #examples, disclosure open (the card and its copy exist; the disclosure is new):

┌─────────────────────────────────────────────────────────────────────┐
│ [thumb]  Jeff Bezos · person                                        │
│          cited as an example of  sense 1 · a person who lacks…      │
│          "Owns the Washington Post and, in 2025, …"                 │
│          evidence · The Guardian, 3 March 2025 ↗                    │
│          · nominated by holden · accepted                           │
│          ▸ Why this example is here                                 │
│          ┌───────────────────────────────────────────────────────┐  │
│          │ Nominated   by holden, from manifest first-v1 row 3,  │  │
│          │             on 25 Sep 2026, under sense 1 of coward   │  │
│          │ Model       none involved                             │  │
│          │ Reviewed    accepted by <reviewer> on 26 Sep 2026     │  │
│          │ Shown here  ranked by 1 supporting citation           │  │
│          │ Opening     selected by holden (v2), published 27 Sep │  │
│          │             ↗ How this was curated                    │  │
│          └───────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────────┘

Instance chip: no new UI. The chip's title already carries the reason sentence; its provenance link is the existing /connections/:id for each contributing assertion, one per source, never merged:

[ Korean War ]  title: "WordNet and Wikidata name it under a sense of war."
   ↳ /connections/812 (wordnet)   ↳ /connections/40211 (wikidata)

Opening highlight for an exemplar (PR #202's tile, kind: :exemplar), reasons split by register:

┌──────────────────────────────┐
│ [image]                      │
│ Jeff Bezos                   │
│ as an example of  coward, 1  │
│ ─ source ─ Wikidata · CC0    │
│ ─ cited  ─ "Owns the…" holden│
│ ─ note   ─ "…" selected by   │
│            holden, reviewed  │
│ ▸ Why this is here           │
└──────────────────────────────┘

Person page, cited as group, gains one line per composition that features the claim:

Cited as an example of  coward (sense 1) · by holden · accepted
  featured in the opening of /define/coward since 27 Sep 2026

Contracts

• C1 Separation. Creating, reviewing or publishing a composition version writes no assertions, assertion_revisions or assertion_reviews row. The existing slice-1 test asserts this; extend it to the exemplar kind.
• C2 Accepted, not visible. An exemplar item is eligible only on an accepted latest review. Pending, disputed, rejected and withdrawn claims of every subject kind are withheld from Published.current/1 and never counted, whatever Claims.visible/2 says.
• C3 No inheritance. A new claim revision, a moved sense or a changed review context withholds the item until a new composition review. Approval never transfers.
• C4 Deletion. Deleting the claim revision nulls the reference and withholds the item for good (required_references, slice-1 R7). Deletion cannot make a withheld item eligible.
• C5 Both histories. A human nomination later selected by an operator (or, after Persona panel pilot: five versioned editors, fixed quorum and ten-page evaluation #197, by a panel) keeps nomination and selection as separate stages with separate actors and times. Nothing rewrites the nomination.
• C6 One display identity per arrangement (above).
• C7 Offline. Published.current/1 and the provenance projection make no provider call and no inference call. A test runs them with the discovery registry empty and Req stubbed to raise.
• C8 Ordering untouched. Rank.order/1 and the instance chip order do not change. A composition selects; it does not reorder #examples.
• C10 The bot boundary is closed, and tested closed. Contributions.propose/6 refuses any scope that is not an internal user ({:error, :unauthorized}), and a test asserts this for a bot actor scope. The agent stage of the projection is the input contract Persona panel pilot: five versioned editors, fixed quorum and ten-page evaluation #197's adapter must satisfy: profile and version, model digest and config, run and proposal ids, and a note. This issue defines that stage and reads it as :none or :unknown; it adds no code that accepts a bot nomination.
• C9 Visibility everywhere. The disclosure, the person page line and the opening apply the same Claims.visible/2 and rights redaction as the card. A hidden adverse nomination leaves no trace in any of them.

Discovery, restated in one table (no adapter)

Seam	What exists	This issue
Shelf → register	/connect prefilled from a corpus candidate card (subject, sense, evidence revision, locator) on a result with an object_id (639 of 1,729 on dev)	unchanged, plus: ConnectionLive writes metadata.from_result and provider on the revision when the prefill came from a shelf, so the projection can say found on the Quotes shelf under nomination.origin: :form
Result without an object_id	cannot be a subject; minting is #105 step 5, unbuilt	out of scope; #193's open decision on transient items stands
Refresh or expiry of a result	the claim and the composition item hold registry ids, never result ids	already true; a test proves a deleted discovery_results row changes nothing
Instances → shelves	never (PageEvidence reads refers_to only)	unchanged

The one supported path for the acceptance test. A quotation from a provider with identity_record/1 (PoetryDB, Wikiquote or the public-domain corpus) on a word's Quotes shelf → its card's connect link → ConnectionLive with subject, sense, evidence_revision and evidence_locator prefilled → propose/6 → a reviewer accepts → Build 1's exemplar item with content_revision_id pinning the words → published → Published.current/1. The records reused: the result's object_id (the content object), its source_record_revision_id (the evidence), the sense revision (the meaning). Nothing is copied from discovery_results, and the result row may be deleted by retention at any point after the claim exists without changing anything. A Met artwork follows the existing work item kind and needs no claim. Results with no registry object (Guardian, Bing, Pexels, Unsplash, Openverse, GIPHY, Spotify) are not offered the link today and are refused by Compositions.create_version/3 with {:ineligible, :no_registry_object}; minting them is #105 step 5, not this issue. There is no "deferred" state: an item is eligible or it is not, with the reason.

There is no "candidate boundary" here. When #197 builds a packet, its exemplar candidates come from Examples.exemplars/3 filtered by the eligibility above; that is one function call, not a new object.

Prerequisites and sequencing

What must be on main before each build starts, and what this issue may deliver itself in a coordinated PR when the owner of a seam has not started it. Closure does not wait for any umbrella issue to finish.

Build	Needs on main first	May deliver here, coordinated	Blocked by
1	nothing beyond c6bd882 (#206 merged)	the migration, Eligibility, Compositions, the proof test	nothing
2	nothing beyond c6bd882	Examples.Provenance, the card disclosure, the person-page line	nothing
3	PR #202 (accepted, unmerged) for the Opening structs	Opening.Highlight kind: :exemplar; an OpeningReader over Published.current/1 if #156 Phase 2 has not started, with #156 keeping ownership of the view model; a dev-only gate to render it, like #202's ?opening=fixture	#202's merge only. Not #194's binding, not #198, not the whole of #156

Nothing here waits for #190, #197, #209 or the PR #210 audit. Every test runs on an isolated MIX_TEST_PARTITION; no build writes to the shared dev database. The #209 storage move gates heavy runs, and there are none here.

This issue closes when Builds 1 and 2 are merged and Build 3 is merged or, if #202 is still unmerged at that point, delivered as a PR stacked on it with its record-backed test green. "Rendered on a real page" means the dev-gated published reader on a page whose composition was published through Publications; the public binding is #194's.

Builds

Build 1: the item kind and the manual proof. The migration, Eligibility, Compositions.create_version/3 accepting %{kind: :exemplar, assertion_revision_id:, meaning:}, Published.current/1 returning it, and one integration test on an isolated partition: propose/6 (user) → Claims.review accept → provision → version → operator review → publish → current/1 shows it → each of rejected, withdrawn, superseded, deleted, context-changed, meaning-mismatched and unaccepted withholds it with its reason → no claim row written. No UI.

Build 2: the provenance projection and the disclosure. Examples.Provenance.of/2; the card disclosure; the person page line; the five legacy test rows render :unknown honestly; leakage tests with a fictional adverse person and a pending non-person work (the #84 fixtures) across card, count, person page and disclosure.

Build 3: the opening mapping. Opening.Highlight gains kind: :exemplar and reads the same projection; lands with #156 Phase 2 once PR #202 merges. Its struct change and a record-backed unit test can ship first behind the existing dev-only gate.

Acceptance

• Build 1: a human-nominated, accepted exemplar is published in a saved composition and read back by Published.current/1 with inference and providers unavailable; every withhold reason above has a test; mix precommit on an isolated partition.
  • Exemplar composition items and the manual proof (#212, Build 1) #218, merged 6286ced. exemplar_items_test.exs: 29 tests. Precommit on main after the merge: 19 doctests, 2,621 tests, 0 failures.
• Build 1: the migration rolls back and re-applies; existing content, sense_quotation and work items are untouched.
  • Up → down → up on a test partition: the down leaves the schema identical to the working database's, and the up is identical to the first. The down refuses while an exemplar is stored. Applied to devils_dictionary_v2 on 7 October; the schema diff is exactly the four objects, and the database holds 0 composition items.
• Build 2: card, person page and (when Build 3 lands) opening show the same stages for one claim; a legacy claim says unknown rather than inventing a nominator; no fabricated model, run or timestamp anywhere.
  • Examples.Provenance and 'Why this example is here' (#212, Build 2) #223 (merged 1ffd4b9) and Map an accepted exemplar into the curated opening (#212 build 3) #235 (merged 3fe1cd1). The opening's Source, Nominated, Model and Reviewed rows are asserted equal, as text, to the card's for the same claim.
• Build 2: pending, disputed, rejected and withdrawn nominations of every subject kind are absent from every surface and count for the public, present and marked for contributors.
  • Done as decision 1 scopes it. Absent for the public, whatever the subject, from every surface this issue added: the disclosure (Examples.Provenance and 'Why this example is here' (#212, Build 2) #223, which also removed the legacy-row exception), the person-page line, and the opening (Map an accepted exemplar into the curated opening (#212 build 3) #235, proved with a pending work whose card is public). Contributors see them on the card, marked.
  • Deferred to Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190: the existing public card and count keep the person-only gate until Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190 lands.
• Discovery-to-curation proof on the named path: with the discovery result deleted by retention and Req stubbed to raise, the published exemplar still reads, the projection names the shelf it was found on, and no second registry object, evidence row or claim exists for the same quotation.
  • Proved from the connect form onward (Examples.Provenance and 'Why this example is here' (#212, Build 2) #223, exemplar_provenance_live_test.exs): the result is purged, every provider is off, the shelf is named, and nothing is duplicated.
  • Deferred to Quote-shelf connect link and provider-evidence prefill (deferred from #212) #222: the quote card's connect link and the provider-evidence prefill.
• propose/6 with a bot actor scope is {:error, :unauthorized}, asserted by a test that Persona panel pilot: five versioned editors, fixed quorum and ten-page evaluation #197 will replace when it opens the path.
  • Exemplar composition items and the manual proof (#212, Build 1) #218: "propose/6 refuses a bot actor's scope".
• A replayed manifest and a repeated publish are idempotent: no new claim, revision, receipt or nomination time.
  • Repeated publish: Exemplar composition items and the manual proof (#212, Build 1) #218. Manifest replay, with nomination.at unchanged: Examples.Provenance and 'Why this example is here' (#212, Build 2) #223's provenance_test.exs.
• Before/after screenshots at 375 and 1280, light and dark; the page-height cost recorded under Word page height and shelf templates: fold the prose, one template per content type, the world above the fold — measured on /define/love, phased #111.
  • docs/design/issue-212/: Build 2's 20 captures and Build 3's 8. The page-height cost of both is on Word page height and shelf templates: fold the prose, one template per content type, the world above the fold — measured on /define/love, phased #111.
• A short service reuse map in docs/curation/ naming the functions each surface calls, and the exact seam Persona panel pilot: five versioned editors, fixed quorum and ten-page evaluation #197's packet will use.
  • docs/curation/exemplar-items.md, with the opening's rows added by Map an accepted exemplar into the curated opening (#212 build 3) #235.

Decisions owed by the owner

1. Accepted-only for highlights while the public gate is person-only (recommended: yes; C2). The alternative, "visible is enough", would let a pending nomination of a work into the opening.
2. Changed since review withholds, or labels? In #examples the card stays up with a label (Examples backbone: the record's instances (WordNet, Wikidata P31) as the pre-adjudicated layer under the cited exemplars (#105), one read model, one section, two registers — so /define/war names its 43 wars now and /define/coward can carry an attributed example later #181 R3). In a composition, recommended: withhold (:claim_context_changed), because the operator accepted a specific claim text.
3. Should the person page say "featured in the opening of…"? Recommended: yes, in Build 2; it is the reverse of selection and costs one query.
4. Chip provenance: link to /connections/:id per source (recommended, no new UI), or a disclosure like the card's.

Handoffs

• To Persona panel pilot: five versioned editors, fixed quorum and ten-page evaluation #197, add: "The bot nomination path is Contributions.propose/6 with the bot scope Examples backbone: the record's instances (WordNet, Wikidata P31) as the pre-adjudicated layer under the cited exemplars (#105), one read model, one section, two registers — so /define/war names its 43 wars now and /define/coward can carry an attributed example later #181 R4 specified (%{actor: %Actor{actor_kind: :bot}}, method whitelisted to persona:<slug>@<v>, metadata kept whole, returns :created | :held | :endorsed). A curation_nominations row links the run, candidate and participant to the resulting assertion_revision_id. A rejected or withdrawn claim is never re-proposed by a bot; only a human reopens it. The bot actor's bot_source_id is the profile's source. Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190 lands first."
• To Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190: nothing new. This issue does not depend on it (C2), and it must still land before Persona panel pilot: five versioned editors, fixed quorum and ten-page evaluation #197's first write.
• To Visit-driven curation refresh: coalesced jobs, fenced leases and atomic publication #198: the "human approval verifies… then atomically switches the pointer" paragraph predates the panel-decision authority; align it with docs/curation/persistence-slice-1.md.
• To Routing before launch: On overviews, standards-informed namespaces, and stable subject URLs #194/Curation configurations: global default, domain panels and future personal views #201: the ADR 0004 "one active default binding" amendment, already recorded there.
• To Curation transparency: equal votes, reproducible selection, profiles and version history #203: Examples.Provenance is the examples-specific lineage its history projection consumes; it adds no second projection.

Out of scope

Bot or assessor nominations (#197, #101), the illustrates-wide gate (#190), votes and tallies (#189), runs, ballots and selection-v1 (#196/#197/#203), refresh (#198), the page binding (#194), minting subjects from shelf results (#105 step 5), personal or domain panels (#201), and any change to instance ordering. Do not reopen #181 or seed its draft sample claims to complete this issue.

Done means: an accepted exemplar can be a highlight in a real saved composition, is withheld the moment its claim stops being accepted, and every surface that shows an example answers "why is this here" from the same records, saying unknown where the record is silent.

[holden]

Build 1 has started. The body and main @ c6bd882 disagree in several places. Items 1–3 block parts of Build 2 until you answer. None blocks Build 1, which I am building under the four recommended decisions (there are no owner comments here yet). Items 4–8 are how I am reading the rest; say if any is wrong.

Blocking parts of Build 2

1. "Absent for the public, every subject kind" conflicts with the person-only gate.

• Build 2's acceptance says pending, disputed, rejected and withdrawn nominations "of every subject kind are absent from every surface and count for the public".
• Claims.visible/2 hides an unaccepted nomination only when its subject is entity/person (lib/devils_dictionary/claims.ex:459-470).
• Two tests pin that behaviour: test/devils_dictionary_web/live/word_exemplars_test.exs:174 ("a pending nomination of a work is public, and its card says so honestly") and test/devils_dictionary/examples/exemplars_test.exs:441.
• The body also says this issue must not touch Claims.visible/2 and does not depend on Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190.

All three cannot hold at once. The options:

• (a) (recommended): Build 2's leakage tests assert that the pending fictional adverse person leaves no trace on any surface. For the pending non-person work, they assert no trace only on the new surfaces: the disclosure, the "featured in" line and the opening. The card and the count stay as Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190 leaves them.
• (b): Build 2 filters pending non-person nominations out of Examples for :public. That would be Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190's gate in all but name.

2. "Present and marked for a contributor" cannot happen on the person page. The entity page has no current_scope and is a public read by design:

• lib/devils_dictionary_web/live/entity_live.ex:16;
• the route sits outside any live_session (router.ex:46);
• Examples.cited_as(family) is called with the default :public viewer (lib/devils_dictionary/encyclopedia/entity_page.ex:169).

A contributor therefore sees exactly what the public sees there. Recommended:

• the person page stays public, and its leakage test asserts absence for everyone;
• "present, marked, for a contributor" is asserted on the word-page card and its disclosure, where a viewer exists (word_live.ex:141).

3. The named discovery path has no link to follow. The body describes "a quotation … on a word's Quotes shelf → its card's connect link → ConnectionLive with subject, sense, evidence_revision and evidence_locator prefilled". On main:

• The only shelf link to /connect is components/culture.ex:1580-1588, guarded by connect_path/1 (culture.ex:1617-1636). That needs a sense_id, and only artwork catalog-corpus items carry one (artworks.ex:248). The quote card (culture.ex:872) has no connect link, and a Discovery.Result has no sense.
• ConnectionLive drops a preselected evidence_revision unless its source is artsy (connection_live.ex:230-266). So a Wikiquote record cannot be prefilled as evidence even by URL.
• PoetryDB's identity_record/1 makes an entity/work poem on the :text shelf (providers/poetrydb.ex:163, 547-553), not a quotation. The public-domain corpus writes no discovery_results rows. Wikiquote (providers/wikiquote.ex:848-854) is the only live provider whose result is a content/quotation.

So no shelf link carries a result id today that metadata.from_result could record. Recommended:

• Build 2 threads from_result and provider through the existing prefill into propose/6's metadata. On the catalog-corpus link that gives a provider but never a result id.
• The named-path test drives /connect by URL with a Wikiquote result's subject, a sense, from_result and provider. Evidence is added in the form, not prefilled from Wikiquote.
• A connect link on quote cards, and preselected_evidence accepting sources other than artsy, are form changes I would leave to a follow-up. Say if you want either in Build 2.

Not blocking: how Build 1 reads these

4. :content_not_current. The body names it as an existing reason, but Eligibility has no such reason. A pinned content revision that is no longer current is :revision_superseded or :revision_withdrawn (curation/eligibility.ex:216-218). The exemplar kind reuses those two.
5. {:ineligible, :no_registry_object}.
   • create_version/3 refuses as {:ineligible, [{role, position, reason}]} (compositions.ex:335-338), and an item without an object is :object_missing (eligibility.ex:155, 169, 199).
   • An exemplar spec takes its object from the claim's subject, which always exists, so Build 1 adds no new atom.
   • No spec can name a result that has no registry object.
6. The composite FK binds every item that names both columns, not only exemplars. PostgreSQL has no per-kind foreign key, so (assertion_revision_id, item_object_id) → assertion_revisions (id, subject_object_id) applies to all kinds.
   • Slice 1's only use of the optional claim already satisfies it: a defines claim on its own content item (test/devils_dictionary/curation/audit_findings_test.exs:165).
   • Dev has no composition rows.
   • If you want that annotation left unconstrained on the other kinds, the alternative is an exemplar-only check in the insert trigger.
7. An accepting review needs a context.
   • An acceptance with no review context reads as changed since review (claims.ex:679-693, 761). Under decision 2 that withholds the item as :claim_context_changed.
   • The proof therefore accepts through Contributions.review/6, which opens the context, rather than Claims.review/3.
   • To keep C3 at read time, the version records, in its immutable resolution, the claim-context fingerprint that its eligibility fingerprint was computed from. A claim re-accepted under a different context then stays withheld until a new composition version is reviewed.
8. The "Make encyclopedia connections reliable: identity changes, exact evidence, general entities and authoring #84 fixtures" are not a named pair in test/.
   • There is no fictional adverse person.
   • The nearest pending-work fixtures are the two tests in item 1.
   • Build 2 adds a fictional adverse-person fixture.

#202 is still open (gh pr view 202: OPEN, no review decision), so Build 3 waits, as the brief says.

[holden]

Build 1 is up for review: PR #218, head 4839c6f.

• MIX_TEST_PARTITION=_212 mix precommit: exit 0, 19 doctests, 2,298 tests, 0 failures.
• exemplar_items_test.exs: 29 tests. test/devils_dictionary/curation/: 93 tests, 0 failures.
• On _212, migrate → rollback → migrate leaves the trigger function, the constraints and the indexes byte-identical to before.
• 17 single-point mutations of the new code were each caught by the tests.
• Five independent reviewers found three problems, all fixed in 4839c6f:
  • the service raised on the claim-subject key instead of refusing;
  • C6 missed a catalog-only work;
  • the concept meaning's two conditions had no test.
• The invariant map is docs/curation/exemplar-items.md.

Read-only counts from devils_dictionary_v2, 2026-09-27 21:05 UTC:

illustrates current and active / all revisions	5 / 10
instance_of current and active	66,573
assertion_reviews / assertion_votes / review_contexts	2 / 0 / 2
community source row	none
actors	import 11, user 2, unknown 1, bot 0
configurations, profiles, compositions, composition items	0, 0, 0, 0
discovery_results (with an object_id)	2,056 (788)
assertion_revisions	~4.24M rows, 656 MB, which the new unique index covers

What this gives Build 1's acceptance lines:

• Build 1: a human-nominated, accepted exemplar is published in a saved composition and read back by Published.current/1 with inference and providers unavailable; every withhold reason has a test; mix precommit on an isolated partition.
• Build 1: the migration rolls back and re-applies. Existing items keep their shapes, and dev has none. Their optional claim is now bound to their object (item 6 above), and Eligibility refuses a mismatch with :claim_not_about_object.
• propose/6 with a bot actor scope is {:error, :unauthorized}, in a test Persona panel pilot: five versioned editors, fixed quorum and ten-page evaluation #197 will replace.
• Replayed manifest and repeated publish: the repeated publish is tested. The manifest replay and nomination time come with Build 2.
• Discovery-to-curation proof: a purged result changes nothing, and the published exemplar reads offline. Naming the shelf needs Build 2 and an answer to item 3.

One more point for Build 2. The body says "the five legacy illustrates test rows must come out nomination: :unknown". On dev, only two of the five have no actor and no manifest: 3901639 and 3901643. The other three have a user submitter:

• 3901638: submitted by Account #1, claimant Unknown claimant (an unknown actor);
• 3901644: Account #2;
• 3901667: Account #1.

My reading: nomination.by names the recorded submitting account's label for those three, with origin: :unknown since no manifest or shelf is recorded, and a claimant of kind unknown is shown as unknown. So the two actorless rows come out nomination: :unknown, and no row gets an invented nominator. Say if you meant all five to read :unknown.

Build 2 starts once #218 is green. The parts that depend on items 1–3 above wait for your answer.

[holden]

Build 2 is up for review: PR #223, head a89c2ff, stacked on #218.

It includes the fixes from the progress audit forwarded on 2026-09-28 and from an independent review of 8edfbcc. The PR body lists them.

Scope decisions, as forwarded with the audit

1. Visibility.
   • The card and the count keep the existing person-only public gate (Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190's).
   • Composition highlights require an accepted claim (C2, Build 1).
   • For the new surfaces (the disclosure, the person-page line and the opening), Build 2 hides every nomination nobody has accepted from the public, whatever its subject. That is option (a) above.
   • Still open: the audit asks you to settle this explicitly, so I have not ticked the visibility line below.
2. Person pages stay public-only. A contributor sees there what the public sees. "Present and marked for a contributor" is checked on the word-page card and its disclosure.
3. The named discovery path is partial. The test starts at the form with the shelf's parameters. The quote card's connect link and the provider-evidence prefill are deferred to Quote-shelf connect link and provider-evidence prefill (deferred from #212) #222, which owns them. That acceptance line is not ticked.

And one follow-on from item 8: the nominator is the submitting account, or a manifest's curator. A cited claimant is shown apart ("citing an unknown claimant"), and the card follows the same rule. The dev rows now read as follows:

• 3901638: by Account Bump importmap-rails from 2.0.3 to 2.1.0 #1, citing an unknown claimant;
• 3901644: by Account Bump image_processing from 1.12.2 to 1.13.0 #2;
• 3901667: by Account Bump importmap-rails from 2.0.3 to 2.1.0 #1;
• 3901639 and 3901643: nomination: :unknown.

Evidence

• MIX_TEST_PARTITION=_212 mix precommit at a89c2ff: exit 0, 19 doctests, 2,324 tests, 0 failures.
• The three focused files: 55 tests.
• 18 mutations across the two rounds, all caught.
• Screenshots at 1280 and 375, light and dark, before, closed and open, plus the person page, are in docs/design/issue-212/.
• devils_dictionary_v2 was not written. The captures use a scratch database built from empty migrations and fixtures. The page-height cost is recorded under Word page height and shelf templates: fold the prose, one template per content type, the world above the fold — measured on /define/love, phased #111.

Acceptance lines this build can speak to

• Build 2: card, person page and (when Build 3 lands) the opening show the same stages for one claim. A legacy claim says unknown rather than inventing a nominator. No model, run or timestamp is fabricated anywhere. The card and the person page read one projection. A legacy claim reads unknown, and agent is :unknown for anything but curated work. The opening waits for Build 3 and Curated opening section, Phase 1: manual fixture, Bierce-first lead, sourced highlights (#156) #202, so I have not ticked this.
• Build 2: pending, disputed, rejected and withdrawn nominations of every subject kind are absent from every surface and count for the public, and present and marked for contributors. True for the new surfaces and for a pending person everywhere. A pending or disputed non-person work still has its public card and count, which is Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190's gate. Not ticked until you settle item 1.
• Discovery-to-curation proof on the named path. Partial; Quote-shelf connect link and provider-evidence prefill (deferred from #212) #222.
• A replayed manifest and a repeated publish are idempotent: no new claim, revision, receipt or nomination time. Repeated publish: Build 1's proof. Manifest replay held, with counts and nomination.at unchanged: provenance_test.exs.
• Before and after screenshots at 375 and 1280, light and dark; the page-height cost recorded under Word page height and shelf templates: fold the prose, one template per content type, the world above the fold — measured on /define/love, phased #111.
• A short service reuse map in docs/curation/, naming the functions each surface calls and the seam Persona panel pilot: five versioned editors, fixed quorum and ten-page evaluation #197's packet will use (docs/curation/exemplar-items.md).

Build 3 waits for #202 (still open). #219's /on change will move the one ~p"/define/…" link style this PR shares with the rest of the page. Its copy carries no paths. The combined head has not been tested.

[holden]

Independent stage audit, 28 September 10:15 (+02): Build 2 of 3, about 60 % of the issue done, grade B

Read-only against the PR heads: #218 4839c6f, #223 a89c2ff (which contains #218). Nothing merged or changed.

Executed here

Check	Result
mix precommit on a89c2ff, partition _audit212	19 doctests, 2,324 tests, 0 failures, exit 0; formatter changed nothing
Migration 20260927204902 on a fresh partition: up → rollback one → up	clean; 23 → 22 → 23 migrations; the down is guarded and refuses to drop a stored exemplar
Dry-run merge into today's main 16e35ca	#218 clean. #223 conflicts: 4 hunks in components/examples.ex, live/connection_live.ex and live/entity_live.ex, all from #225's On-reader rewrite; #223 is 75 commits behind
#223's tests against today's routes	its new live tests open ~p"/define/coward"; /define no longer exists on main, so they must move to /on in the same merge
Open review threads	#218 none; #223 one CodeRabbit thread open (the article before a provider name in the "Nominated" row)

Against the acceptance list

Line	Status	Basis
Build 1 published and read back offline; every withhold reason tested; precommit	done	exemplar_items_test.exs: rejected, disputed, withdrawn (review and revision), superseded, deleted, context changed, meaning mismatch, unaccepted, not visible, restricted words
Build 1 migration rolls back and re-applies	done	round trip above
Build 2 same stages on card, person page and opening	2 of 3	opening waits for Build 3
Build 2 unaccepted nominations absent for the public on every surface	partial	true for the new surfaces and for pending persons; a pending non-person work keeps its public card and count under #190's gate, by design, until the owner settles decision 1
Discovery-to-curation proof on the named path	partial	test C7 reads a shelf-prefilled nomination back after retention with every provider off; the quote card's connect link and the evidence prefill are deferred to #222
bot propose/6 is {:error, :unauthorized}	done	tested
Replayed manifest and repeated publish idempotent	done	tested
Screenshots 375/1280, light/dark; page height under #111	done	21 files in docs/design/issue-212/, page-height section in its README
Service reuse map with #197's seam	done	docs/curation/exemplar-items.md

Verdict

Build 1 is complete and mergeable as is. Build 2 is complete at its head but stale against main, with small conflicts, stale route references and one open thread. Build 3, the opening mapping, is unwritten and is now unblocked (#202 merged as e1d60b0). Weighted by build, about 60 % of #212 is done and nothing is merged. Grade B: the delivered code is sound and its evidence reproduces, and the remaining work is integration, one decision and one small build.

To finish

1. Owner: decision 1 (recommended: keep what Build 2 implemented, unaccepted nominations hidden from every new surface, and let Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190 close the card gate) and decision 4 (recommended default: chips link to /connections/:id).
2. Merge Exemplar composition items and the manual proof (#212, Build 1) #218 after validating main + Exemplar composition items and the manual proof (#212, Build 1) #218 (precommit on the merged tree). It adds 20260927204902 to the migrations main expects after the move; the Repeatable dictionary migration: prove external setup against the retained working baseline #211 handoff then lists three, not two.
3. Bring Examples.Provenance and 'Why this example is here' (#212, Build 2) #223 onto main: merge main in, resolve the four hunks, move its tests from /define/coward to /on/coward, answer the CodeRabbit thread, precommit, merge.
4. Build 3: Opening.Highlight gains kind: :exemplar reading Examples.Provenance, rendered behind the existing dev-only gate with a record-backed test. No migration, so it does not touch the move's baseline.
5. Close Examples in the curated opening: an exemplar item kind, one provenance projection, and the manual proof (integration under #193) #212; Quote-shelf connect link and provider-evidence prefill (deferred from #212) #222 stays open for the connect link.

[holden]

Finishing #212 (7 October): decision 1 defaulted; the work and the merges now

Decision 1, taken by default unless the owner objects here before the merge: the recommendation stands. Unaccepted nominations are hidden from every surface Build 2 added (the disclosure, the person-page line, and the opening when Build 3 lands), whatever the subject; the existing public card and count keep #190's person-only gate until #190 lands. Decision 4 takes its recommended default: chips keep /connections/:id.

Sequencing with #211. The dictionary now runs from the external drive (cluster 7693849764459364596 on 5434, checkout /Volumes/LLM Models/dictionary/src/dictionary). #211's 48-hour hold gates only the deletion of the old database and checkout; it does not gate this issue. The earlier pre-authorisation to keep #218 and #223 unmerged until then is lifted (owner, 7 October): merging to main leaves the old checkout at 16e35ca untouched, so the rollback path is unchanged. Merge as soon as the audits pass. #224 (CP4) follows #212, because its catch-up needs the corpus quiet.

Prompt

Work in razrfly/dictionary on issue #212 to finish it: Builds 1, 2 and 3 merged, the issue closed, #222 left open. Open the project from /Volumes/LLM Models/dictionary/src/dictionary and work in a worktree under it; never from ~/Code/projects-2026/dictionary, which still points at the old database. Read #212 in full with its two audit comments of 28 September and this comment, PRs #218 and #223 with their descriptions and review threads, #222, and docs/curation/exemplar-items.md on #223's branch. Decision 1 is taken as recorded above unless the owner has objected on #212.

Gate. main is at or after 7b731f5; with nothing set, mix dd.doctor reports devils_dictionary_v2 on cluster 7693849764459364596 (5434). Never connect to 5432.

1. Exemplar composition items and the manual proof (#212, Build 1) #218, Build 1. Independent final-head audit: read Curation.Eligibility's exemplar rules against Examples in the curated opening: an exemplar item kind, one provenance projection, and the manual proof (integration under #193) #212's list of withhold reasons, the migration 20260927204902 (additive, guarded down), Compositions.create_version/3 and Published.current/1; run test/devils_dictionary/curation/exemplar_items_test.exs and mix precommit on a private MIX_TEST_PARTITION (tests reach 5434 by default now). Post the audit on Exemplar composition items and the manual proof (#212, Build 1) #218. It merges clean into main.
2. Examples.Provenance and 'Why this example is here' (#212, Build 2) #223, Build 2. Merge main into its branch and resolve the four conflict hunks in components/examples.ex, live/connection_live.ex and live/entity_live.ex (all from the On-reader rewrite, On replaces Define, and subjects open at their own addresses (#219 B) #225); move its new tests from /define/coward to /on/coward and any other /define reference to the On or exact-word routes; fix the one open CodeRabbit thread (the article before a provider name in the "Nominated" row); apply decision 1 wherever it is not already the behaviour; re-run the three focused files and mix precommit; independent final-head audit posted on Examples.Provenance and 'Why this example is here' (#212, Build 2) #223. Retarget its base to main once Exemplar composition items and the manual proof (#212, Build 1) #218 has merged.
3. Build 3, the opening mapping. Opening.Highlight gains kind: :exemplar reading Examples.Provenance.of/2, rendered behind the existing dev-only ?opening=fixture gate with a record-backed test: one accepted exemplar appears as a highlight with the same six stages the card shows; a nomination nobody accepted does not. No migration, no new approval path, Curation.Published wiring stays out of scope. Open it as a PR stacked on Examples.Provenance and 'Why this example is here' (#212, Build 2) #223.
4. Merge as each audit passes, in order, with merge commits and branches kept: Exemplar composition items and the manual proof (#212, Build 1) #218 → Examples.Provenance and 'Why this example is here' (#212, Build 2) #223 → Build 3. After each merge, mix precommit on main from the external checkout.
5. Apply the one migration to the working database as a recorded step from the external checkout (mix ecto.migrate with nothing set reaches 5434), confirm editorial_composition_items accepts the exemplar kind there and that nothing else changed, and restart the dev server from the external checkout if it was running.
6. Tick Examples in the curated opening: an exemplar item kind, one provenance projection, and the manual proof (integration under #193) #212's acceptance lines with evidence, note the two deferred items (the quote-shelf connect link in Quote-shelf connect link and provider-evidence prefill (deferred from #212) #222; the Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190 gate), and close Examples in the curated opening: an exemplar item kind, one provenance projection, and the manual proof (integration under #193) #212.

Constraints: MIX_ENV=test and a private partition on every mix ecto.* and mix test; never touch 5432 or the old checkout; no corpus records minted for tests; secrets never in issues; the catch-up, population, reviewers and #224 are not this issue's work.

Finish with: both audits, test counts per merge, the migration record, the screenshots Build 3 adds under docs/design/issue-212/, and what #222 still owes.

[holden]

#212 finished, 7 October: Builds 1, 2 and 3 merged, the migration applied, closing

Done from the external checkout (/Volumes/LLM Models/dictionary/src/dictionary) and worktrees under it, on cluster 7693849764459364596 (5434). Decision 1 was applied as recorded; no objection had been posted.

Merges, in order, each with a merge commit and its branch kept

PR	Merge	Audit	mix precommit on main after the merge
#218, Build 1	6286ced	audit	19 doctests, 2,621 tests, 0 failures
#223, Build 2	1ffd4b9	audit	19 doctests, 2,647 tests, 0 failures
#235, Build 3	3fe1cd1	audit	19 doctests, 2,658 tests, 0 failures

Every run used a private MIX_TEST_PARTITION on 5434, and mix format --check-formatted was clean on each.

What changed while finishing:

• Examples.Provenance and 'Why this example is here' (#212, Build 2) #223:
  • main was merged in, resolving the four hunks;
  • its tests moved to /on/coward;
  • the CodeRabbit thread was fixed;
  • decision 1 now also covers legacy rows: an unreviewed claim no account submitted has no public disclosure.
• Map an accepted exemplar into the curated opening (#212 build 3) #235 (Build 3, new):
  • Opening.Highlight gains kind: :exemplar, read through Examples.Provenance.of/2 behind ?opening=fixture;
  • the fixture reader asks Build 1's Eligibility.check/3;
  • an independent review and CodeRabbit added passage subjects (with their source's credit and licence), a pending work as the "not shown" proof, and an accepted-first claim lookup.

The migration, recorded

When	2026-10-07 13:50:48–13:50:49Z, Migrated 20260927204902 in 0.7s
How	The dev server was stopped first (pid 42062, Oban on), because the migration builds a unique index over assertion_revisions in its transaction. The external checkout was fast-forwarded 7b731f5 → 3fe1cd1. Then mise exec -- mix ecto.migrate ran with nothing set; it printed its target first: dev, devils_dictionary_v2, localhost:5434.
Before	26 migrations (head 20260927220937), 20260927204902 the only one down; 0 composition items; assertion_revisions about 4.37M rows
After	27 migrations, none down. editorial_composition_items_shape now admits 'exemplar'. 0 composition items. The new index is 131 MB.
Nothing else changed	A full pg_dump --schema-only before and after differs in exactly four objects: the shape check, the editorial_composition_items_complete() trigger function, assertion_revisions_id_subject_index and editorial_composition_items_claim_subject_fkey. The only other lines are pg_dump 18's per-dump \restrict tokens. The probe of those objects equals a test partition's after the same migration.
Dev server	Restarted from the external checkout in a Terminal tab (mise exec -- mix phx.server, pid 8730): 11 connections to v2 on 5434 and none elsewhere. /on/coward and /on/love return 200. The wordhoard.eu.ngrok.io tunnel still forwards to 4007.

One incident during the #218 audit (no harm)

At 14:26 (+02), a head-only test run of #218 used PGPORT=5434. The branch's own config/test.exs has no port, and ecto_sql's pool puts in 5432 before Postgrex reads PGPORT. So ecto.create made the database on 5434, while the Repo pool's connections went to 5432: 11 startups, each refused with database "devils_dictionary_test_212head" does not exist. No database on 5432 was opened and nothing was written; the old devils_dictionary_v2 was not touched. The rerun used an explicit port. The details are on #218's audit.

Screenshots Build 3 adds (docs/design/issue-212/)

• issue-212-build3-coward-{1280,375}-{light,dark}-closed.png: the exemplar tile, with the opening's disclosures closed.
• issue-212-build3-coward-{1280,375}-{light,dark}-open.png: "Why this is here" (the reason given and the six stages) and "How this was chosen" (highlights 2 and 3 withheld, nobody named) open.

They come from a scratch database of fixtures on 5434, devils_dictionary_test_212shots. The page-height cost is on #111.

Deferred, and still open

• Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190: the public examples card and count keep the person-only gate. A pending non-person nomination is still public on its card, and only there; every surface this issue added hides it.

• Quote-shelf connect link and provider-evidence prefill (deferred from #212) #222 still owes, unchanged:

  1. a connect link on the quote card for a result that resolved to a registry object, shown to contributors;
  2. ConnectionLive preselecting the provider's record as evidence, verified server-side from the result row (widening preselected_evidence/3 beyond Artsy for that case);
  3. the end-to-end test that clicks that link, submits, accepts, composes, publishes, purges and reads back.

  What it can now build on: from_result and provider are recorded (Examples.Provenance and 'Why this example is here' (#212, Build 2) #223), and the opening can draw a quotation exemplar with its source's credit (Map an accepted exemplar into the curated opening (#212 build 3) #235).

Closing #212. #222 stays open.

[holden]

Independent final review, 7 October 16:05 (+02): #212 is done as closed, grade A−

Read-only against main 3fe1cd1, the external checkout, both clusters and the running server, then reproduced from the external checkout. Nothing was written to either devils_dictionary_v2.

Reproduced

Check	Result
main	6286ced (#218) → 1ffd4b9 (#223) → 3fe1cd1 (#235), each a merge commit whose first parent is the previous main; the three claude/212-* branches are kept on origin
mix precommit on main 3fe1cd1, external checkout, MIX_ENV=test, partition _audit212f on 5434	exit 0 · 19 doctests, 2,658 tests, 0 failures (335 s) · the formatter changed nothing (checkout clean after) · the partition dropped afterwards
The migration on devils_dictionary_v2 / 5434	27 versions, 20260927204902 recorded; editorial_composition_items_shape admits 'exemplar' and holds (item_kind <> 'exemplar' OR role = 'highlight'); editorial_composition_items_claim_subject_fkey present; assertion_revisions_id_subject_index 131 MB over 4,373,877 rows; 0 composition items
The old devils_dictionary_v2 on 5432	0 sessions; counters 47,617,920 / 61,366,997 / 8,675,172, the same as #211's gate read at 13:17
The server	pid 8730, cwd /Volumes/LLM Models/dictionary/src/dictionary, 11 connections to 5434 and none to 5432; /on/coward, /on/love, /on/love?opening=fixture 200, /define/coward 404; https://wordhoard.eu.ngrok.io/on/love 200
Evidence	28 PNGs and a README under docs/design/issue-212/ (Build 2 and Build 3, 375 and 1280, light and dark); all nine acceptance lines ticked; the page-height note on #111

Read at 3fe1cd1

• Decision 1 is the code's behaviour. Provenance.load/2 keeps a claim for the public only when its latest review is accepted (disclosed?/2); a claim with no submitting account and no manifest is nomination: :unknown, and the card and person page say "nominator unknown" rather than invent one. The examples card and count are untouched, so Gate every illustrates nomination until accepted before bots or the public can nominate (#181 decision 6, deferred) #190's person-only gate still governs them, as recorded.
• Build 3 adds no approval path. ManualFixture builds the item a composition would hold and asks Eligibility.check/3; the subject must also be in Examples.exemplars(_, :public); Provenance.in_fixture/2 changes only the two placement stages. curated_opening_fixtures is set in config/dev.exs and config/test.exs only. No migration.
• Eligibility runs in the moduledoc's order: current illustrates → accepted → public and displayable → on scope → meaning agrees → review context unchanged (and the one the version recorded, C3) → subject active or words current. References.exemplar_claim/2 excludes hidden decisions and prefers an accepted claim, oldest among equals.
• The connect form records a shelf only when the result row names the prefilled subject (provider read from the run) or the registry says the work is that catalog's; a malformed id records nothing.
• The migration is guarded for PostgreSQL 15, builds the composite key's index in its own transaction, and its down restores the v1 check first, so a stored exemplar refuses the rollback.

Findings, none blocking

1. The old checkout moved. ~/Code/projects-2026/dictionary's main was fast-forwarded 16e35ca → 7b731f5 at 14:16 (+02), four minutes after this issue's finishing session began; the session's report does not mention it. Repeatable dictionary migration: prove external setup against the retained working baseline #211's record says the old checkout stays at 16e35ca. Effect: a server started from the old path now defaults to 5434 too, so the rollback path needs DD_DATABASE_PORT=5432 set by hand. Nothing was written anywhere. Noted on Repeatable dictionary migration: prove external setup against the retained working baseline #211; the reclaim deletes that checkout.
2. The coward fixture is not reproducible on the corpus. Its three subjects are fictional QIDs that exist only in a scratch database, so on v2 /on/coward?opening=fixture renders no opening at all (no lead, all three withheld). The fixture's own about says so, and the screenshots come from devils_dictionary_test_212shots on 5434, which is kept. The proof is honest; it is just not a live one.
3. The PGPORT run (11 refused connections to 5432, nothing opened) was found, explained and recorded by the session itself.
4. Left as is: CodeRabbit's trivial nitpick on Provenance.load/2; GitGuardian did not run on the docstring-only f479b36.

Grade A−. The work is complete, independently audited at each head, merged in order with the record kept, and the migration landed on the working installation as a recorded step with the schema diff proven. The minus is finding 1, a deviation from the prompt's one hard rule about the old checkout, harmless but unrecorded. Closed stands; #222 and #190 carry what was deferred.