docs(intelligence): audit merge candidate decisions

ROADMAP.md

@@ -401,6 +401,10 @@ now owns installed-artifact and combined-gate evidence. The milestone remains **
 merged-source review, public release artifacts, compatibility/security/release acceptance, and
 explicit release-owner resolution or re-dating of issue #49 F1, F3, and F5. Those three items are
 open release gates; they are not silently waived, deferred, or implemented here.
+The follow-on
+[merge-candidate audit](docs/design/measured-intelligence-v0.6.0-merge-candidate-audit-work-packet-v1.md)
+binds a World direct-to-live-main integration candidate and presents bounded F1/F3/F5 owner choices.
+It does not select those choices or advance the milestone beyond **Next**.
 
 ### 0.7.0 — Domain and Extension Platform
 

docs/capability-maturity.md

@@ -211,6 +211,11 @@ explicitly recorded as open 0.6 release gates—not waived, deferred, or resolve
 remains blocked on an owner disposition even if all candidate verification is green.
 The exact point-in-time results and environment splits are in the
 [release-convergence candidate evidence](evidence/measured-intelligence-v0.6.0-release-convergence-candidate-v1.md).
+The later
+[merge-candidate audit](design/measured-intelligence-v0.6.0-merge-candidate-audit-work-packet-v1.md)
+reconciles the World journey onto live World `main` and turns issue #49 F1/F3/F5 into explicit
+owner choices. The capability remains experimental until those choices, reviewed merges, final
+artifacts, and release acceptance are complete.
 
 ## Implemented architecture beyond the compatibility contract
 

docs/design/measured-intelligence-v0.6.0-merge-candidate-audit-work-packet-v1.md

@@ -0,0 +1,86 @@
+# ACE 0.6.0 Measured Intelligence merge-candidate audit work packet (v1)
+
+**Status:** bounded release-owner decision candidate. This packet does not merge a pull request,
+change package versions, tag or publish an artifact, close issue
+[#38](https://github.com/augmented-cognition-engine/core/issues/38), resolve issue
+[#49](https://github.com/augmented-cognition-engine/core/issues/49), pass SI4, or declare ACE 0.6.0
+complete.
+
+**Core candidate:** `37e6c8a6da0fc95e378c1be50d8704c00dd96415` over live `main`
+`be5e76c79715bb34bcbdcae9a0471a5c317fafe7`.
+
+**World direct-main candidate:** PR
+[#17](https://github.com/augmented-cognition-engine/domain-world-intelligence/pull/17), executable
+source `87625d55c717a9c649d4f44a06d1767b52fed255`, evidence head
+`2d7a0ace72bed4d175b0884c8a9b81b6ec063d56`.
+
+## Objective
+
+Turn the implementation and artifact-convergence results into one inspectable release-owner audit:
+
+```text
+Core #88 -> #89 -> #90 -> #91
+  + independent Market candidate
+  + World measured stack reconciled directly on live World main (#17)
+  + exact artifact and verification receipts
+  + explicit issue #49 owner decisions
+  -> reviewed merge order or bounded corrective packet
+```
+
+## Acceptance
+
+This packet must:
+
+1. refresh live PR, review-thread, issue, branch, and CI state rather than relying on stale local
+   dispatch;
+2. prove the Core stack is a strict live-main descendant and every inspected Core PR is open,
+   draft, and mergeable;
+3. identify the World stack's live-main divergence honestly and bind the separate direct-main
+   integration candidate that resolves it without rewriting the old review branches;
+4. bind the direct-main World source, repeated wheel hashes, canonical JSON hash, and combined test
+   results;
+5. give the release owner concrete implementation or re-date choices for issue #49 F1, F3, and F5;
+6. recommend a choice without recording it as accepted; and
+7. keep roadmap and capability maturity at candidate state.
+
+## Issue #49 decision matrix
+
+The following are proposals for the authenticated release owner. They are not decisions until the
+owner records one on issue #49.
+
+| Item | Recommended 0.6 disposition | Bounded implementation option | Explicit re-date option |
+|---|---|---|---|
+| F1 — cognition generation race and receipt reconciliation | **Implement before 0.6 closeout.** The next-minor deadline has arrived and governed revision activation is adjacent to the 0.6 promise. | Add an in-transaction generation guard or a two-connection real-SurrealDB concurrency proof, then reconcile the exact winning review/head/proposal state from durable receipts after conflict or restart. Require one winner, zero partial revision, stable replay, and divergent conflict. | Re-date no later than `2026-11-05` only with an owner rationale that retains the v169 unique activation-generation index, documents rollback, and states why 0.6 proposal-only behavior does not widen the accepted exposure. |
+| F3 — trusted registration ceilings and partial rollback/reporting | **Re-date to `2026-11-05` unless 0.6 expands the extension surface.** Correct atomic staging spans Core registries plus delegated instrument/sentinel registration and should not be improvised inside a measured-impact release. | Introduce extension-scoped staging, validate ceilings for every mutable registration surface, publish atomically, and emit a bounded failure report; prove a late registration failure leaves every registry byte/identity-equivalent to its pre-registration snapshot. | Record `2026-11-05` plus containment: trusted installed packages only, no wider supported extension claim, retained `ACE_DISABLE_EXTENSIONS=1` kill switch, compatibility matrix, and operator disablement on unexpected partial state. |
+| F5 — legacy optimizer record-type confusion | **Implement before 0.6 closeout.** The fix is narrow and independently testable. | Parse the route identity into a bounded key and load/update only `type::record('self_optimizer_proposal', $record_key)` under the exact product. Add negative controls for a same-product foreign-table record and malformed identity; no legacy projection may touch either. | Re-date only with explicit owner acceptance of the deprecated-facade containment and a dated removal or fix target; do not call the table-confusion surface resolved. |
+
+The recommended split is therefore **implement F1 and F5; explicitly re-date F3 to 2026-11-05
+with containment**. This packet does not perform any of those mutations.
+
+## Ownership and exclusions
+
+Core continues to own durable state, provenance, authority, Decision, Action, Outcome, and release
+gates. Intelligence owns domain-neutral evaluation and proposal contracts. World and Market own
+their nouns, sources, policy, controls, and outcome meaning.
+
+This audit does not add proposal application, change effective state, widen extensions, implement
+security debt, change schemas, alter the eleven-tool MCP contract, or revise external deadlines.
+It does not establish causality, general benefit, live monitoring, or supported 0.6 behavior.
+
+## Owned files and rollback
+
+- this work packet;
+- its point-in-time evidence record;
+- one evidence-index entry; and
+- restrained roadmap and maturity references.
+
+Rollback removes those documentation-only additions. All implementation and external artifact
+branches remain unchanged.
+
+## Next bounded packets
+
+After an authenticated issue #49 decision, the implementation order should be F5, F1, then either
+the owner-approved F3 hardening packet or the owner-approved dated containment record. A final
+merge-source audit must then rerun Core/World/Market compatibility, security, exact artifact
+binding, public-index installation, and release checks. It still may not merge, tag, or publish
+without a separate release-owner action.

docs/evidence/README.md

@@ -41,6 +41,8 @@ superseded by later work and is kept for audit trail only.
   — stacked candidate, local; exact accept/reject Decision with no proposal application
 - [Measured Intelligence release-convergence candidate](measured-intelligence-v0.6.0-release-convergence-candidate-v1.md)
   — installed-artifact World reproduction and explicit open #49 release gates; not release closeout
+- [Measured Intelligence merge-candidate audit](measured-intelligence-v0.6.0-merge-candidate-audit-v1.md)
+  — live-main World integration, exact artifact receipts, and explicit F1/F3/F5 owner choices; not release closeout
 - [State Engine TP0 current-runtime baseline](state-engine-tp0-runtime-baseline-v1.md)
 - [State Engine TP1A truthful observation outcomes](state-engine-tp1a-truthful-observation-outcomes-v1.md)
 - [State Engine TP1 reliable memory lifecycle](state-engine-tp1-reliable-memory-lifecycle-v1.md)

docs/evidence/measured-intelligence-v0.6.0-merge-candidate-audit-v1.md

@@ -0,0 +1,101 @@
+# ACE 0.6.0 Measured Intelligence merge-candidate audit evidence (v1)
+
+**Status:** bounded candidate evidence. This is not a merge, issue closeout, package-version
+decision, tag, publication, SI4 pass, or ACE 0.6.0 release claim.
+
+**Recorded:** 2026-08-11
+
+## Live source and review state
+
+The audit refreshed GitHub and both remotes after the convergence drafts opened.
+
+| Surface | Exact live result |
+|---|---|
+| Core source | `be5e76c79715bb34bcbdcae9a0471a5c317fafe7` -> `37e6c8a6da0fc95e378c1be50d8704c00dd96415`; strict ancestry |
+| Core PRs | #88 -> #89 -> #90 -> #91; all open, draft, mergeable; zero submitted reviews and zero inline review threads |
+| Core issues | #38 and #49 open; neither had an issue comment at audit time |
+| Original World stack | #6 -> #7 -> #8 -> #9 -> #10 -> #11 -> #12 -> #13 -> #15; all open drafts with zero submitted reviews and zero inline review threads |
+| World divergence | Live `main` advanced to `8de1027c4c995582b42c4a1f936a72e2c42878a0`; bottom PR #6 is not mergeable against that new base even though later internal stack links remain mergeable |
+| World direct-main candidate | [PR #17](https://github.com/augmented-cognition-engine/domain-world-intelligence/pull/17), head `2d7a0ace72bed4d175b0884c8a9b81b6ec063d56`, base `main`; open, draft, mergeable; [release-readiness run 31503593324](https://github.com/augmented-cognition-engine/domain-world-intelligence/actions/runs/31503593324) passed |
+
+No existing PR branch was rebased, force-pushed, merged, closed, or retargeted.
+
+## Direct-main World artifact result
+
+The World candidate replayed the thirteen measured-intelligence commits over the exact new live
+base and retained the merged AI Command Center lineage proof. The only replay conflict was
+documentation; both evidence links and claim boundaries were preserved.
+
+| Artifact | SHA-256 |
+|---|---|
+| Core wheel | `29752aa751570286794ff2abd1071a43f622883d4778e161687e10363f76f6c3` |
+| Reference action-adapter wheel | `9c600d4b3e0d19525f1e04629bd231d8d6913d2ad11bc63fa2858e7da396f8f1` |
+| World Federal Register source-adapter wheel | `1b80cc598b467a8ab0f47aabb5f01bd0cb1c7709b48aa02352a0ef802988b4fe` |
+| World wheel | `a067b3106772437d2dcfee890dc7d89005d3f7afd9e6dc0cbed027327bea9cae` |
+| Canonical World convergence JSON | `b70f972e6b7e86ddce09eb3feaa3cd89eede2b236d3e592ee5417dda4d3e95f7` |
+
+The two repeated World-owned wheel builds were byte-identical. Two fresh installed-artifact journey
+runs emitted byte-identical canonical JSON. Repeated sdist gzip containers were not byte-identical,
+so no reproducible-sdist claim is made and final release artifacts remain an open gate.
+
+World verification after live-main reconciliation:
+
+```text
+combined AI lineage + P2C3-P2C10 + convergence: 37 passed
+complete candidate-Core World suite: 120 passed
+Federal Register adapter suite: 62 passed
+release contract: 7 passed
+post-format AI/source controls: 66 passed
+Ruff check/format and git diff --check: pass
+```
+
+## Core verification inheritance
+
+This audit changes documentation only; Core implementation remains exactly
+`433e3d16c5458c975557dcd1552824fb959d4d12`. Its frozen convergence evidence remains:
+
+```text
+focused Core impact/disposition/boundary: 45 passed, 2 sandbox-only DB skips
+kernel boundary: 4 passed
+locked non-E2E/non-extension lane: 7456 passed, 50 skipped, 260 deselected
+ordinary-clone historical baseline: 7 passed
+loopback checks outside sandbox: 4 passed
+clean candidate-wheel catalog check: 1 passed
+Ruff check/format, whitespace, and pip-audit: pass; no known vulnerabilities
+```
+
+The audit packet reran the focused documentation-adjacent Core gates: `45 passed, 2 skipped` where
+both skips were the restricted sandbox denying the local SurrealDB socket; kernel boundary was
+`4 passed`. Whitespace passed and a scoped credential-pattern scan found no match. This packet does
+not relabel the inherited full result as a new implementation run.
+
+## Issue #49 disposition required
+
+The code audit found:
+
+- F1 still preflights `cognition_head` generation before its transaction and relies on the v169
+  unique activation-generation index as the atomic race backstop; exact loser reconciliation from
+  durable review/head/proposal receipts is not yet a demonstrated real-database path.
+- F3 has ceilings for recipes, routes, resources, task actions, and grounded-state adapters, but
+  tools, verify checks, briefing sections, unsupported registrations, and delegated registration
+  remain non-atomic; a late extension failure can leave earlier global mutations behind.
+- F5 still selects and updates `ONLY <record>$id`, so a caller-controlled record coordinate is not
+  pinned to the `self_optimizer_proposal` table before the same-product check.
+
+Recommended owner disposition: implement F1 and F5 before 0.6; re-date F3 to `2026-11-05` with the
+trusted-package, kill-switch, compatibility, and disable-on-partial containment recorded in the
+work packet. These are recommendations, not accepted decisions. F1, F3, and F5 remain **open 0.6
+release gates; not waived, deferred, resolved, or re-dated** until the authenticated owner updates
+issue #49.
+
+## What is now proved and what remains
+
+The exact Core candidate and live-main World integration candidate are technically converged for
+review. The public World artifact still classifies the frozen correction rule as useful and emits
+only a non-effective, non-selectable, unapplied promotion proposal. The independent Market
+candidate remains separately expressible through the unchanged neutral contract.
+
+ACE 0.6 remains blocked on review/merge order, issue #49 owner decisions and any selected hardening,
+merged-source Core/World/Market compatibility and security, final version/artifact identities,
+public-index installation, publication, and final release-owner acceptance. No causal, population,
+human-benefit, live-monitoring, proposal-application, SI4-pass, or release claim is made.