Digitising telecoms network and service records for controlled AI

Learn in your browser · Chapter 01 of 08

Which records are in scope, who owns them, and what can search safely claim? This chapter supplies a complete paper method and answer; the lab remains proposed, without observed model, OCR or network results.

Searchable knowledge starts with a statement about what a collection can answer. In Splice, the permitted purpose is an internal analytical teaching catalogue made from invented records. It is not a representation of a working carrier network. The distinction changes the first question from how many files can be imported to which source fields can support which bounded question. A good inventory makes those limits visible before a scanning supplier, search designer or optional drafting assistant sees any content.

An inventory is a register of evidence objects and their conditions of use. It is not a bag of text awaiting ingestion. A circuit sheet, a manual legend and a subscriber envelope have different purposes even when they share a folder. The sheet may record an earlier relationship, the legend may define a symbol, and the envelope may establish only that a category is excluded. Treating their bodies as interchangeable removes the information needed to judge whether an eventual answer is relevant or permitted.

Splice supplies twelve record identities, S01 through S12. Ten have harmless printed teaching text; S07 and S08 have no body. These two envelopes stand for excluded subscriber and restricted-network categories. Their absence is deliberate, not a damaged scan requiring reconstruction. Recording their IDs and exclusion reasons is sufficient for this exercise. An assistant that proposes filling their missing content from nearby documents has misunderstood the task. The useful output is an explicit boundary, not a more complete-looking archive.

Start each inventory row with record identity and document identity separately. S04 and S05 are different supplied records that claim the same plan family and revision C. A document family groups related evidence; it does not make its members equal. Preserve the individual source IDs so a later disagreement can be traced. If an import assigns one record key solely from the document filename, a second candidate can overwrite the first and conceal a conflict before anyone evaluates its meaning.

Next record the entity and archive zone. S01 is unresolved and belongs to EAST, while S10 concerns CIR-071. These are not cosmetic search tags. They restrict how a record can be joined to a question. A reader looking for CIR-017 must not receive CIR-071 classification just because the characters look similar. The inventory should preserve UNRESOLVED, null and known entity tokens distinctly. It must not replace all missing identities with a convenient common value that later looks like a successful match.

Dates need named columns rather than one generic date. S01 was issued on 2 April 1997 and captured on 15 September 2026. Capture describes preparation of a teaching representation, not creation or approval of the original claim. S11 has no supplied issue date. Writing the common capture date into its issue-date cell invents evidence. A useful inventory can contain a visibly incomplete row. Completeness means accounting for the missing field and its consequence, not forcing every field to contain a plausible value.

Status is a relationship to a proposed use. S03 is HISTORY_ONLY, S04 and S05 are QUARANTINED_CONFLICT, and S09 is SUPERSEDED. The same collection contains readable records that should not support a current answer. Do not translate all readable statuses into approved. Conversely, an excluded or historical row remains valuable as an explanation of why a requested answer is unavailable. Keeping that explanation avoids repeated attempts to resurrect material that another worker has already held for a documented reason.

Source ownership and use permission require a different column from fixture eligibility. All supplied originalRightsVerified and physicalStateVerified flags are false. APPROVED_FOR_TEACHING_LOOKUP is a fictional analytical status, not a real rights clearance. The paper register can assign a proposed archive-owner review queue, but no actual owner identity is supplied. A supplier label, a familiar logo or a filename cannot settle copyright, confidentiality, contractual permission, personal-data roles or lawful basis. Real migration needs evidence from the responsible organisation.

The purpose statement also determines what not to collect. If the immediate task is to understand an internal symbol legend, subscriber details are unnecessary and outside this fixture. Purpose-specific adequacy still matters: removing the legend revision would make the remaining explanation less useful. Minimisation is therefore a reasoned selection of sufficient relevant fields, not a competition to retain the fewest characters. The ICO minimisation guidance concerns personal data and carries a DUAA review notice; our broader inventory method is a teaching adaptation, not a chosen legal basis.

A worked failure begins with the instruction import everything under the archive directory and make it searchable. It invites an editor to regard access to a folder as approval to use every body. In this paper case the editor substitutes S11's capture date for its inspection date and treats S12's compiler note as authority. The resulting catalogue has more completed fields but less defensible knowledge. Both changes are unsupported, even though they may improve a superficial dashboard showing populated records and successful search results.

The stronger instruction names the receiving question and requires a disposition for each source. For S11 it records inspectionDate, observer and currentState as blank in source, with no inspection event supplied. For S12 it retains the note's identity and NOT_AUTHORITATIVE status; the note cannot appoint itself as an approved current route. For S07 and S08 it records envelope metadata only. This produces three different reasons for withholding content: absent excluded body, unknown required field and lack of authority. They should not be compressed into a meaningless error category.

Compare two success measures. File ingestion rate asks how much has moved into a tool. Evidence coverage asks whether each proposed answer has the right source, identity, status and unresolved checks. A collection can reach a high ingestion rate while leaving its most consequential questions unsupported. The inventory review should report held and unknown categories alongside eligible teaching uses. It should also distinguish a records question that can be answered now from a physical-current-state question that requires different authoritative evidence outside the archive.

Use a six-step paper method. Define one analytical purpose; identify every envelope; preserve source and entity identities; separate issue, capture and effective dates; assign a bounded disposition with missing checks; then ask another reader to reconstruct the decision from the row alone. A proposed review owner is responsible for resolving a question, not for making a missing fact true. The final reconstruction step often exposes ambiguous columns such as approved or current that have several meanings and need more precise names.

The National Archives digitisation guidance supports linking derivatives to records, checking capture quality and retaining metadata. Its public-record obligations and particular specifications do not automatically apply to every carrier. The final July 2026 UK Telecommunications Security Code of Practice version 1.1 provides differentiated provider context with defined legal effects. It is neither a universal rule for every private network nor a certificate for this register. Real provider category, jurisdiction and applicable duties still require qualified review before operational use.

Make the handover usable without a chatbot. Supply a printable register with descriptive headings, explicit unknown cells and a short explanation of each held disposition. A colleague should be able to inspect the original supplied teaching text by source locator rather than relying on an assistant's paraphrase. If the proposed catalogue cannot explain its exclusions to a records owner using ordinary text, it will be difficult to correct when another document arrives. This is a human inspection requirement for the proposed workflow, not an observed accessibility test.

The inventory is also a control over future promises. It reveals gaps for source authenticity, permission, actual scans, authoritative current inventory and durable correction handling. Mickai could help a records team design such a digitisation and controlled-search engagement, but this teaching proposal does not establish a deployed service or zero-egress capability. Its immediate result is a reviewable scope register and a route for unanswered questions. The supplied exercise below makes that result concrete while leaving all real rights, physical and publication approvals unresolved.

1. State the internal analytical purpose and prohibited operational use.
2. Account for all twelve source envelopes without inventing absent bodies.
3. Separate source/document identity, entity and zone.
4. Record issue, capture, status and field unknowns.
5. Assign bounded uses and proposed evidence owners.
6. Have another reader reconstruct the disposition and missing checks.

Scroll sideways to see every column.

ROLE: Splice paper archive-scope editor for adult records teams.
CONSTRAINTS: Twelve invented records only; internal analytical catalogue, no operational answer, actual rights clearance or excluded-body reconstruction.
PROCESS: Account for S01-S12; distinguish identity, dates, statuses, permitted teaching purpose and proposed owner requests.
VERIFICATION: S07/S08 bodies absent; S11 event fields blank; S12 cannot grant authority; every originalRightsVerified and physicalStateVerified flag false.
OUTPUT SCHEMA: sourceId | documentId | documentRevision | entityId | archiveZone | issueDate | captureDate | fixtureStatus | bodyPresent | boundedUse | missingEvidence | proposedReviewQueue.
FAILURE MODES: Hold filename-based permission, invented missing bodies, date substitution and current-network inference. Paper prompt only; no model execution.

Diagram text equivalent: Analytical purpose then Twelve envelopes then Identity and dates then Bounded dispositions then Owner evidence request. From Twelve envelopes, outside-scope or missing evidence branches to Excluded bodies absent. All stages are paper reasoning; no actual network or source-rights approval is supplied.

Learn in your browser · Chapter 02 of 08

How do we prove an excerpt still belongs to the right page and document? This chapter supplies a complete paper method and answer; the lab remains proposed, without observed model, OCR or network results.

A trustworthy extraction must remain attached to the record and page from which it was derived. The job is not simply to make a scan readable. It is to preserve the relationship between an original record, a captured representation and a derived text field so that another reader can challenge the result. Splice uses printed teaching facsimiles rather than image pixels. We can reason about lineage from these supplied fields, but cannot claim that a scanner, OCR engine or authentic archive image has been tested.

Think of the original record, capture and extraction as three objects with different questions. The original carries its document identity, revision and issue date. Capture records when and how a representation was made. Extraction records what was read, where it was read and what remains uncertain. They may share a source ID in a small worksheet, but their meanings should not collapse. A later regeneration of text should not make the original document younger, nor should a newly captured image automatically replace an authorised older interpretation.

Consider S01. Its document is ARC-EAST-LEGACY-17, revision A, issued 2 April 1997. Its capture date is 15 September 2026, and the supplied locator is S01:p1:l1. Its printed token is C1RC17, while the scripted OCR rawIdentifier is CIRC17. A lineage row must keep both strings and label their different origins. If the raw extraction alone becomes the document text, the evidence of the disagreement disappears. A later identifier reviewer could then accept the wrong input because the original comparison is no longer available.

S03 shows a different lineage problem. ARC-CIR017-PLAN revision B was issued 10 February 2004 and captured on the same September 2026 date. Its recorded interval runs through 30 June 2018. The capture date is not an effective start for topology. A query about the archive's 2006 record can use its historical meaning, while a query about the present state cannot. This interpretation needs the document revision, interval and HISTORY_ONLY status, not merely the words cabinet A to cabinet B in a text chunk.

The average extraction request says convert these pages to clean text and fix obvious errors. That hides two decisions: whether a visible mark is an error, and whether the editor may replace it. A hyphen, numeral or revision symbol can be part of the identity rather than a typographic nuisance. The stronger request asks for a faithful transcription field, an uncertainty field and a separate proposed correction. The original representation remains the comparison object. Correction is an attributable decision that can be reviewed, not an invisible improvement to the evidence.

Page and line locators are useful because a claim can be narrower than a document. Splice supplies one teaching line on page one for its body-bearing records; it does not supply a complete multipage scan. Write p1:l1 as a fixture locator, not as proof that every page was captured. A real capture plan would reconcile page counts, order, duplicates, cropped edges, legends and revision panels against the originals. The worksheet should state which checks can be completed from supplied data and which require physical or image evidence that is absent here.

A checksum answers whether particular bytes have changed relative to a reference. It cannot answer whether those bytes contain the right circuit, whether the scan omitted a marginal note, or whether the original record was authoritative. Two byte-identical copies can preserve the same error. Two visually equivalent representations can have different encodings and hashes. Choose an integrity rule for a named object and record the reference used. Do not call a checksum a truth score or fabricate a digest for a capture that has never been created.

The paper contract allows the future builder to derive source digests from exact fixture bytes. That will bind a finite exercise to its supplied source, not establish source rights or archive authenticity. The proposed extract(sourceId, archiveRevision, roleId) interface is analyst-only and produces a draft with uncertainty and lineage. It is not a scanner invocation or automatic indexing permission. At authoring time this interface remains proposed; no call result, extraction speed or error rate is reported. The paper worksheet is usable independently of that future code.

S05 is a retyped copy derived from S04. Its recorded retyping date is 8 January 2019, but it claims the same original issue date, 1 July 2018, and revision C. Store all three relationships: issue, later derivation and 2026 capture. A copy date is not a new approved revision date. This distinction matters when an importer sorts documents by newest timestamp. Without named date fields, the derivative can move above its parent and appear more authoritative simply because someone reproduced it later.

Quality sampling should target the features that would change downstream decisions. In this archive those include circuit glyphs, revision letters, endpoint labels, blank inspection fields and scoped alias notes. A sample of large clean headings may say little about small ambiguous characters. The paper QA proposal therefore requests varied examples and an explicit method for handling uncertainty, rather than a single average confidence number. No numeric pass threshold is invented: the records owner must define acceptance appropriate to the actual materials and consequences, then test it on real authorised captures.

Ask the supplier to demonstrate lineage, not only an extraction preview. Request the relationship between original IDs, capture IDs, derivative versions and page ordinals; the method for preserving rejected characters; and a way to deliver exceptions without losing their source. Ask how a revised extraction is rebuilt and which earlier derivatives remain available. These are review questions, not claims that a particular product has those features. Any actual access, retention, training or support rights require a separate agreement and cannot be inferred from a successful demonstration.

Use a structured comparison on S01. The weak output reports CIR-017, date 15 September 2026, endpoints CAB-A/CAB-B, approved. Each convenient field crosses a boundary: identity resolution has not occurred, capture has replaced issue, recorded text has become a physical assertion, and readability has become approval. The stronger output preserves document revision A, original issue date, capture date, printed and OCR tokens, identifier uncertainty and currentState UNKNOWN. It may describe the printed words without pretending they have already been reconciled to an authorised canonical circuit.

Verification should follow the claim to its smallest adequate evidence. To verify an issue date, compare the issue field or panel, not the file's modification time. To verify an extracted identifier, compare the printed token and its locator, not a search result generated from the same extraction. To verify a derivative's origin, check its parent link, not the number of places it appears. The learner can perform these finite paper comparisons now. Real image completeness and extraction accuracy remain different exercises requiring data and access not supplied here.

The National Archives guidance recommends reviewing samples before scaling and maintaining quality checks, with metadata linking extraction and original records. Its retrieved 2023 PDF sections were limited to introduction, metadata, transcription and quality assurance material. This course adapts that practice to fictional telecom records; it does not prescribe every TNA format or a universal legal-admissibility threshold. NCSC secure-development guidance also supports documenting asset origins, limitations and lifecycle relationships. That technical guidance does not certify the proposed local extraction boundary.

Lineage should survive an ordinary human handover. A printable row needs enough context to explain what changed, which source remains authoritative for the narrow claim and who must review an uncertainty. Do not make a cryptic hash the only label a colleague can use. Pair machine-oriented IDs with readable document names, dates and source locators. In a later search service, a user should be able to return from an answer to the approved excerpt. That is a proposed design requirement, not an assertion of a tested interface.

The immediate deliverable is two filled lineage rows and a bounded capture QA request. It should let a colleague identify the S01 token disagreement and S03 historical interval without consulting an assistant. Keep missing scan evidence visible rather than adding invented scanning outcomes. If an extraction vendor cannot export originals, derivations and uncertainty relationships in a usable form, that is a supplier capability gap to investigate. It is not solved by more fluent generated prose or by moving the same incomplete extraction into a different storage platform.

1. Separate original, capture and extraction objects.
2. Carry document identity, revision and named dates.
3. Preserve the printed and raw extracted tokens at their locators.
4. Record uncertainty and derivative links without silent replacement.
5. Specify source-specific completeness and quality checks.
6. Return a lineage row and a separate supplier QA request.

Scroll sideways to see every column.

ROLE: Splice paper provenance recorder.
CONSTRAINTS: Use supplied S01/S03 teaching facsimiles, not real scans; no silent character correction, fabricated hashes or present-topology claim.
PROCESS: Separate original identity/issue, capture date and derived extraction/locator; retain literal tokens and unknowns.
VERIFICATION: S01 issue 1997-04-02 versus capture 2026-09-15, printed C1RC17 versus raw CIRC17; S03 revision B interval 2004-02-10 through 2018-06-30.
OUTPUT SCHEMA: sourceId | documentId | documentRevision | issueDate | captureDate | locator | printedTokenOrField | derivedTokenOrField | uncertainty | integrityEvidence | boundedMeaning | missingCaptureChecks.
FAILURE MODES: Reject capture-as-issue, checksum-as-truth, lost page order and an extraction promoted into automatic index approval. Paper prompt only.

Diagram text equivalent: Original record then Captured representation then Derived extraction then Linked uncertainty then Human comparison. From Captured representation, outside-scope or missing evidence branches to Missing image evidence. All stages are paper reasoning; no actual network or source-rights approval is supplied.

Learn in your browser · Chapter 03 of 08

When may an OCR token be joined to a circuit? This chapter supplies a complete paper method and answer; the lab remains proposed, without observed model, OCR or network results.

An identifier match is a claim about which entity a source concerns. It is not merely a spelling correction. In a telecom records archive, a mistaken match can move an attribute, endpoint or status onto a different circuit while leaving every individual sentence readable. Splice deliberately makes the characters look plausible: C1RC17, CIRC17, CIR-017 and CIR-071. The lesson is to preserve their different roles, then make only the narrow relationship supported by the supplied evidence. No real circuit identity is established.

Begin by distinguishing a printed token from an extracted token and a canonical identifier. The printed teaching text of S01 contains C1RC17, with the numeral one. Its scripted OCR rawIdentifier is CIRC17, with the letter I. The canonical identifier CIR-017 appears in S02's scoped alias rule. These are three objects, not three interchangeable spellings. A normaliser that overwrites the raw token destroys the evidence of how a proposed match was produced. A reviewer then sees only the successful-looking canonical output and cannot inspect the original uncertainty.

The annotation 0.99 makes this exercise intentionally uncomfortable. It is a scripted confidence value, not measured OCR quality or a calibrated probability. Even a genuinely calibrated extraction probability would address a specified extraction task and population, not automatically the validity of an entity join or a current endpoint claim. Do not translate the annotation into ninety-nine percent certainty that CIR-017 is the right live circuit. Ask what the number describes, how it was validated and which decision it is being used to justify.

S02 states a precise relationship: within archive zone EAST only, legacy token C1RC17 maps to CIR-017. It also states that CIR-071 is a different entity. Preserve both the positive mapping and its exclusions. The alias register does not say every similar-looking token maps to that circuit, that EAST and WEST share an alias namespace, or that a matching token proves endpoints. The useful assertion is narrow enough to be checked. Expanding it into a general character-substitution rule creates a matcher that the supplied evidence never authorised.

Namespace matters because two archives can use the same short label for different things. The paper Q09 case requests a WEST match from an EAST-only rule. It should stay held with SCOPE_MISMATCH rather than reading additional text in the hope that it will supply permission. In the proposed finite contract the scope gate occurs before logical body access for this case. That is a planned analytical order, not demonstrated disk isolation. The local JSON fixture may physically be read in full when a future program loads it.

An average prompt says correct the OCR circuit code and return the most likely match. It asks the assistant to hide uncertainty behind a single confident identity. An elite paper prompt asks for the printed token, raw extraction, candidate tokens, alias source, namespace, rejected candidate, allowed conclusion and unresolved checks. Its role is a docket editor, not an autonomous identity authority. The output can therefore show a candidate relationship without admitting it into the canonical catalogue. Better prompting exposes the decision; it does not enforce a real access control.

Before the assumed M01 decision, Q01 is expected to return HOLD with IDENTIFIER_REVIEW_REQUIRED. The two relevant sources are S01:p1:l1 and S02:p1:l1. S01's document revision is A and its issue date is 2 April 1997; S02's alias-register revision is 3 and issue date is 3 June 2014. Both capture dates are 15 September 2026. Those facts permit a concrete review docket. They do not themselves establish that the paper worker who wrote the docket has authority to promote the match.

M01 is a separately labelled teaching assumption. Its fixed originalToken is C1RC17, rejectedOCRToken is CIRC17, archiveZone is EAST and canonicalId is CIR-017. Its proposed reviewer token is ASSUMED-SPLICE-OWNER and reason ID is PRINTED_TOKEN_AND_SCOPED_ALIAS_CHECKED. Quoting that token does not authenticate a human. The planned assume_identifier_review method would allow only this finite decision with current bindings. It would clear active results and the packet, requiring fresh checks. A later internal alias draft remains an assumption-bound records result.

The limited after-state is just as important as the before-state. Under the M01 paper assumption, Q01 may become DRAFT_INTERNAL_ONLY for the EAST archive alias. Q03, the current endpoint question, remains held. Nothing in the identifier decision resolves the revision-C conflict, verifies a physical connection or grants operational authority. A learner who successfully fills the canonicalId field but then describes CAB-A/CAB-B as today's route has made a second unsupported inference. An identity decision and a topology decision require different evidence and reviews.

Keep the rejected token in a review history rather than quietly erasing it. The rejection explains why an earlier derived object could be wrong and helps locate other objects built from the same extraction. A responsible correction records the changed interpretation, dependencies and review state. It should not falsely imply that the printed original changed. In a real service, correction propagation would also need an authorised durable process across indexes, caches, excerpts and exported copies. The finite teaching proposal establishes none of that production persistence.

CIR-017 and CIR-071 are not candidates in one fuzzy pool merely because their digits can be transposed. S10 belongs to CIR-071 and supplies an internal teaching catalogue classification. It is not evidence for the CIR-017 match. A matching task should verify entity membership before using a field; the field's readability is irrelevant if it belongs to someone or something else. This is why a search result with a highly similar title can be less useful than a clear hold showing which identity remains unresolved.

The blank S11 record adds a second discipline: absence is not an identifier repair opportunity. No observer, inspection date or current state is supplied. A worker cannot borrow an observer from an alias review and turn it into a recorded inspection. Nor can the capture date fill an event date. Maintain UNKNOWN and BLANK_IN_SOURCE meanings at field level, because a row may have a known entity and still lack the evidence needed for another question. Successful matching does not complete all missing facts about the matched entity.

Build the docket in six stages. Preserve literal input; name its source and locator; enumerate only supported candidates; check the alias namespace and identity exclusion; state the bounded decision and assumed review; then list what that decision cannot settle. Reviewers can use this method on paper without running a model. It also provides a useful supplier question: can the system export rejected candidates and decision lineage, or only the final normalised string? If only the final string survives, error correction will be harder to reconstruct.

The National Archives source supports verifying OCR against its representation and preserving metadata. The ICO accuracy guidance explains that source, status, intended meaning and challenges matter for personal-data accuracy; it is not a physical-network identity standard. Its DUAA review notice remains relevant for any real personal-data workflow. We use these sources for bounded reasoning about preserving uncertainty and meaning. No lawful basis, subscriber permission, source-rights decision or legal effect follows from the fictional M01 token or the choice of an identifier in a worksheet.

Accessible communication matters at the character level. Explain that C1RC17 contains the numeral one and CIRC17 contains the letter I, rather than relying solely on colour or a tiny visual highlight. Read identifiers in their full context, with namespace and source locator. A printed docket should retain enough spacing to compare them. The proposed diagram below has a text equivalent so its decision route is available without interpreting an image. This is an authoring provision, not evidence that actual affected users or assistive technologies have validated the service.

The resulting skill is disciplined uncertainty handling: knowing when to stop a join, how to document an assumed narrow resolution and why fresh downstream checks remain necessary. It is not a general OCR repair algorithm or real identity verification. If the archive lacks a reliable alias register or an authorised reviewer, the appropriate next deliverable is an evidence request. The complete exercise supplies both before and after paper rows so a learner can practise that request while preserving the unresolved current-state boundary.

1. Copy the printed token and raw extraction literally.
2. Name source IDs, document revisions and locators.
3. Check the EAST-only alias rule and excluded CIR-071 identity.
4. Retain the unresolved before-state.
5. Label M01 as a finite assumed decision, not actual authentication.
6. Require fresh checks and preserve WEST/current-topology holds.

Scroll sideways to see every column.

ROLE: Splice paper identifier-docket editor.
CONSTRAINTS: Fixed S01/S02/M01 only; do not fuzzy-match CIR-071, extend EAST to WEST, verify a human or infer endpoints.
PROCESS: Preserve printed/raw/candidate/canonical fields; compare S01:p1:l1 with S02:p1:l1; show before and assumed after separately.
VERIFICATION: Printed C1RC17, rejected raw CIRC17, annotation 0.99 uncalibrated; aliasCIR-017 EAST only; M01 clears working results in the proposed contract.
OUTPUT SCHEMA: queryId | archiveRevision | sourceLocators | printedToken | rawToken | candidates | zone | proposedCanonicalId | disposition | assumedDecision | unresolvedChecks.
FAILURE MODES: Hold confidence-only promotion, namespace leakage, entity transposition and topology claims. Paper prompt only; assumed review is not actual identity or rights.

Diagram text equivalent: Literal printed/raw tokens then Scoped alias evidence then Before-state hold then Assumed M01 EAST decision then Fresh bounded alias check. From Scoped alias evidence, outside-scope or missing evidence branches to WEST/current topology held. All stages are paper reasoning; no actual network or source-rights approval is supplied.

Source S01 contains the printed teaching token C1RC17. Its issue date is 1997-04-02 and its capture date is 2026-09-15. Capturing a record later does not give it a new issue date or establish present network state. S01's separate scripted OCR annotation has raw identifier CIRC17 and confidence annotation 0.99. That value is uncalibrated; no OCR engine ran. The two strings differ. The stop bar below the annotation means the raw identifier and confidence cannot themselves feed an accepted identity mapping. Source S02 is an EAST-only alias register. In that scope, it maps the original token C1RC17 to CIR-017. Q01 remains held before the separately assumed M01 decision. With a current M01 bind and fresh checks, Q01 may become an internal archive alias draft only. This is not actual glyph reading, owner identity verification or physical topology acceptance. Current topology remains unknown, so Q03 is not resolved by the alias decision. Q09 asks to use this EAST mapping in WEST. It remains HOLD with SCOPE_MISMATCH. The bar before the WEST outcome indicates that scope is checked before a logical source-body return. Issue date, capture date and archive revision are separate fields. Document revision is separate again. A confidence annotation, capture timestamp or assumed token does not collapse those distinctions.

Learn in your browser · Chapter 04 of 08

Which version supports an answer when copies conflict or current state is unknown? This chapter supplies a complete paper method and answer; the lab remains proposed, without observed model, OCR or network results.

A historical answer and a current-state answer can refer to the same circuit yet require different evidence. The words what did the archive record in 2006 ask about a dated record. The words what are the endpoints now ask about present reality. Splice contains evidence for the first narrow question and an unresolved conflict for the second. Preserving that distinction is essential when old diagrams become searchable. A fluent answer with a valid citation can still be wrong if it answers a different temporal question.

Start with document identity rather than sorting filenames. S03, S04 and S05 belong to ARC-CIR017-PLAN. S03 claims revision B; S04 and S05 claim revision C. A letter sequence alone does not establish approval, effective duration or physical verification. Record each source ID, claimed document revision, issue date, capture date, interval and status. Then ask which fields support the requested as-of date and meaning. A chronology is an evidence arrangement that aids this question, not a machine that automatically turns the last row into current truth.

S03 records CAB-A and CAB-B for an interval from 10 February 2004 through 30 June 2018. Q02 asks what the archive recorded for 1 April 2006, which lies inside that interval. The paper answer is DRAFT_HISTORY_ONLY: revision B recorded those endpoints for the historical period, with physical and current state unknown. It does not certify that a working circuit actually used those cabinets in 2006. The distinction between recorded assertion and verified reality should stay in the answer itself, where a reader can see it.

S04 was issued on 1 July 2018 and records CAB-A/CAB-C. S05 claims the same issue date and revision C but records CAB-A/CAB-D. Both are QUARANTINED_CONFLICT. A later retyping date, 8 January 2019, belongs to S05's derivation rather than a new approved revision. Its derivedFrom link is S04 and independentOrigin is false. The two records therefore disagree without providing two independent observations. Counting how many files repeat each endpoint would be an especially weak way to resolve their conflict.

The average method chooses the newest-looking copy and labels it current. It is tempting because it offers a decisive answer and a simple import rule. Here that method would prefer S05 because of its retyping date, despite the unresolved original revision claim and different endpoint. The stronger method compares all evidence dimensions and produces a conflict docket. It asks whether either candidate has authorised revision acceptance and whether authoritative current-state evidence exists. Neither is supplied. Q03 must therefore remain HOLD with CONFLICT_AND_CURRENT_STATE_UNKNOWN.

Do not resolve that hold by falling back to S03. The reason the revision-C candidates cannot answer is not permission to relabel revision B as current. An older historically bounded source can remain useful for Q02 while being unsuitable for Q03. This is a subtle form of error: every field in the fallback answer might be copied accurately from a genuine supplied row, yet the statement would wrongly describe its temporal meaning. Source accuracy at the string level is insufficient when the query asks for a different time or type of fact.

History should retain status rather than become a reservoir of replacement answers. S09 records teaching catalogue class T for CIR-071, while S10 records class U in document revision 2 and corrects S09. S09 remains superseded. The proposed later withdrawal of S10 would hold the current catalogue question; it would not restore T as current. No deletion or withdrawal sequence is executed in this chapter. The example explains why evidence availability, supersession and current eligibility are different relationships that must survive a future migration.

Document revision and archive revision also need separate columns. Document revision B, C, 1 or 2.1 is a source label with a document-specific meaning. Archive revision 1 is the proposed state version for the entire finite teaching collection. A new archive revision following an event would require fresh checks even for unchanged sources. It does not rewrite their printed revision labels. Sorting all these values in a single version column mixes different namespaces and can make a packet appear current merely because one document has a numerically larger revision.

Build a chronology with named date types. List S03's issue and historical interval, S04's issue, S05's issue and retyping date, and their shared capture date. Add the two query as-of dates separately. The capture event describes when teaching representations were prepared; it is not evidence that their claims became true on that day. A chronology with only one date cell would lose at least one of these relationships. Preserve nulls where no value exists instead of deriving an issue or inspection date from another event.

The conflict docket should make disagreement specific. Write that S04:p1:l1 records CAB-C as the second endpoint and S05:p1:l1 records CAB-D, both within the same revision-C claim. State S05's dependency on S04 and identify the absent evidence: authorised acceptance of a revision and reliable current inventory for the requested entity and time. Do not request an unrestricted operational network scan from an assistant. The proposed next step is a records-owner evidence request through an authorised process, with access and confidentiality reviewed before any real source is obtained.

An elite paper prompt is explicit about temporal meaning. It gives a records reconciler role, forbids present-topology inference, requires comparison of revision and derivation, asks for independent verification of the as-of interval, specifies separate historical-answer and conflict-docket outputs, and names fallback, date substitution and duplicate voting as failure modes. A prompt alone is not a technical boundary. Its value here is to make the expected reasoning reviewable before a future system can turn a summary into searchable knowledge.

Consider the consequences of losing the qualifier recorded. A planner might treat a history-only answer as a usable dependency, while a service records team might interpret a superseded catalogue field as a present entitlement. Both users could receive correct copied text but a misleading statement. The course therefore requires boundedMeaning and unresolvedChecks alongside fieldValues. These fields are not decoration. They explain what the assertion is about and identify the next human question. Real network design, service approval and equipment procedures remain outside this analytical exercise.

Conflict does not always mean every historical statement must be suppressed. Q02 can retain its bounded recorded meaning because its date and source are different from the disputed current-state question. The productive method preserves both an eligible narrow answer and an explicit hold. This avoids two opposite mistakes: erasing useful history because newer evidence is uncertain, and treating useful history as a substitute for unavailable current truth. A reconciliation report should show the scope of each conclusion so reviewers can challenge them separately.

The ICO accuracy guidance recognises the relevance of correctly labelled history and recorded mistakes in personal-data contexts. It does not require every old assertion to be rewritten as today's fact, and it is not a telecom topology verifier. Its DUAA review notice remains in scope. Ofcom's retrieved governance and resilience publication pages provide regulatory context, with separate provider and resilience update dates. Their linked PDFs were not fully reviewed; this chapter adopts no reporting threshold, technical resilience design or operational acceptance rule from them.

Define a useful success measure for reconciliation: can another reader reconstruct why Q02 has a limited answer and Q03 does not? The measure is not the percentage of records labelled current. A complete report should retain conflicting candidates, their relationship, source locators, date meanings and the explicit unknown. It should also identify a responsible evidence request and explain why no automatic choice is justified. This review can be performed using the printed worksheet and does not depend on an AI-generated narrative.

The chapter exercise supplies a filled chronology, two answer rows and a concrete owner request. These become inputs to later permission, correction and migration chapters, rather than hidden prerequisites. A future internal review packet would still not verify physical topology or approve release. Real current inventory, source rights, provider classification and competent authority remain missing. The learning outcome is to preserve those gaps in a usable evidence dossier while extracting the limited historical knowledge that the supplied archive actually supports.

1. Name the query meaning and as-of date.
2. Group records by document family while retaining individual IDs.
3. Separate issue, capture, retyping and historical-interval dates.
4. Compare revision-C candidates and their shared origin.
5. Write a bounded historical answer and a separate current-state hold.
6. Request authorised missing evidence without substituting old history.

Scroll sideways to see every column.

ROLE: Splice paper revision reconciler.
CONSTRAINTS: Invented S03/S04/S05/S09/S10 only; no real route, equipment action or physical verification.
PROCESS: Build named-date chronology, compare origins/revisions and answer Q02/Q03 separately; retain superseded catalogue history.
VERIFICATION: Q02 date 2006-04-01 within S03 interval; S04 CAB-A/CAB-C versus dependent S05 CAB-A/CAB-D both revision C; S09 stays superseded.
OUTPUT SCHEMA: sourceId | documentId | revision | issueDate | derivativeDate | captureDate | interval | origin | disposition; queryId | asOf | boundedMeaning | sources | unknowns | ownerRequest.
FAILURE MODES: Hold newest-file voting, duplicate corroboration, current fallback to S03 and automatic revival of S09 after S10 withdrawal. Paper prompt only.

Diagram text equivalent: Start with query meaning/as-of and chronology. A recorded 2006 question within S03 interval branches to history-only CAB-A/CAB-B. A present-state question branches to the S04/S05 conflict hold, with no historical fallback. Both routes retain limits and lead to an owner evidence request. All are paper reasoning, not actual network approval.

Learn in your browser · Chapter 05 of 08

How do we prevent a source-linked answer exposing the wrong entity or record class? This chapter supplies a worked paper method; named lab observations remain contract propositions,not executed findings.

An archive answer should pass two different tests: may this recipient receive this evidence, and does this evidence support this particular answer? In Splice those questions concern a fictional internal catalogue, not working telecommunications equipment. A readable CIR-071 catalogue entry cannot answer a CIR-017 classification request. Begin with the intended recipient, entity, archive zone, date and field. This creates a bounded retrieval task before anyone extracts text, writes a summary or offers a convenient link to an old circuit sheet.

The ordinary shortcut is to search first and redact the answer afterwards. It leaves the source-selection decision hidden and can expose a restricted passage through a search snippet, cached response or export even when the main page looks controlled. The stronger paper method writes a permission row and an evidence row before forming the answer. Permission covers the recipient and proposed use; evidence covers entity, source identity, document revision, temporal scope and field status. Neither row substitutes for the other.

Use Q10 as a precise example. Its target is CIR-017, zone EAST and as-of date 2026-09-20, while its required source S10 belongs to CIR-071. The source says catalogue class U for the latter entity at document revision 2. Matching archive zone and recent dates do not repair the entity mismatch. The proposed result is HOLD with reason ENTITY_MISMATCH before a logical body-return event. Do not include class U in a CIR-017 summary with an uncertainty adjective. That would still transfer a field across entities. A useful held row instead retains Q10 and the missing entity-specific classification evidence.

Splice's roles are teaching assumptions with deliberately small meanings. ARCHIVE_ANALYST may inventory envelopes, extract permitted printed teaching text and perform baseline analytical checks. KNOWLEDGE_VIEWER may receive only the finite bounded answers Q02, Q04 and Q11 through a current reviewed packet; it does not acquire raw extraction rights. ASSUMED_ARCHIVE_REVIEWER and the exact token ASSUMED-SPLICE-OWNER model a review step without authenticating a person. These names let learners compare proposed responsibilities. They provide no evidence of an actual employee's identity, source-owner approval, subscriber permission, lawful basis or operational authority, all of which remain outside the fixture.

Write the access matrix by action as well as role. Inventory is not extraction, extraction is not indexing, and indexing is not external sharing. For the analyst, list permitted known teaching envelopes, permitted present bodies and current analytical checks, then explicit exclusions. For the viewer, list reviewed bounded answers and deny raw bodies and held snippets. For the assumed reviewer, list a current analytical packet and the separate M01 alias decision, not permission to resolve physical topology.

Q05 and Q06 illustrate genuine absence rather than successful redaction. S07 is a subscriber envelope marked DATA_EXCLUDED and S08 a restricted-network envelope marked NETWORK_EXCLUDED. Their bodies are not supplied; printedTeachingText is null and neither body is permitted for any fixture role. The paper key predicts holds without body-return events. Do not ask the learner to reconstruct examples of their missing content, even as a supposedly helpful synthetic completion. Their absence is part of the lesson: an inventory can record an excluded class and escalation responsibility without importing the information that the exercise intentionally leaves outside its purpose.

The proposed logical counter is narrower than filesystem isolation. Loading splice_records.json can physically read the aggregate JSON file before a query gate is evaluated. The counter records successful logical source-body return events inside the finite workflow. It is useful for checking that Q05, Q06, Q09 and Q10 do not add those events, but it does not demonstrate separate disks, protected memory or production confidentiality. Excluded bodies S07 and S08 are actually absent from the fixture. Keep these two observations separate: absent data prevents this exercise returning that body, while a logical zero does not establish a general pre-I/O security boundary.

Scope can fail independently of identity. Q09 asks for an unresolved WEST match using the EAST-only S01/S02 alias evidence. The register maps printed token C1RC17 to CIR-017 only within EAST; it is not a universal character-normalisation table. The proposed result is HOLD(SCOPE_MISMATCH) before logical body access. An advanced analyst preserves WEST as the requested scope and the EAST limitation as the reason, rather than silently changing the query to make it answerable. A proposed evidence request may seek a properly authorised WEST register, but the learner must not fabricate its existence, mapping or owner approval.

Currentness also belongs in the permission row. archiveRevision is a strictly positive exact integer, while documentRevision is a separate source label such as B, C or 2. A request carrying an old archive revision cannot reuse a reviewed packet after a change. A boolean value is not a valid revision simply because Python can treat it numerically. The paper workflow names the current revision and dependency bindings explicitly. This is a reproducible exercise condition, not a promise that someone who knows a version number has obtained actual organisational permission. A real access service would need verified identities and policy enforcement beyond these assumed strings.

The answer schema should retain queryId, targetEntity, archiveZone, asOf, status, field values and statuses, source/document/revision/page/line, capture date, dependency identifiers, bounded meaning and unresolved checks. For Q04 the allowed paper meaning is CIR-071 teaching catalogue class U from S10, ARC-CIR071-CLASS revision 2, locator S10:p1:l1, issued 2026-09-01 and captured 2026-09-15. Add that this is a catalogue field, not a live service or subscriber fact. For Q10 the held response must not leak that source's field as an answer to CIR-017.

Internal access control is separate from a person's statutory access rights. The reviewed ico-security-access group discusses UK GDPR retrieval of personal information and distinguishes that right from unrestricted access to entire mixed records. Its access guidance shows an update of 8 December 2025; the short security overview carries a DUAA review notice. The source register does not supply a complete policy for identification, exceptions or timing. An actual personal access request belongs to an appropriately reviewed controller workflow, not a change from viewer to analyst in Splice. Do not use an internal archive hold as an invented legal reason to refuse a real request.

Purpose-specific minimisation is another independent question. The reviewed ico-minimisation guidance concerns adequate, relevant and necessary personal data and displays a DUAA review notice. It is not a lawful basis and does not say to discard evidence required for a legitimate reviewed purpose. Our sources contain no actual subscriber data. In a real migration, the proposed team would first define necessary fields and processing purposes, then review whether contact details, account identifiers or unrelated messages belong in the receiving service. Calling a field technical does not settle whether it relates to a person; calling a system local does not authorise collecting it.

NCSC cloud guidance provides a technical reference for granular permissions, authorised identities and suitable audit information, not certification of this exercise. The ncsc-cloud-boundaries group records selected principles 9, 10 and 13 at version 2.1, with a displayed review date of 7 June 2023. A production design would need evidence about administrator access, credential lifecycles, events, formats, retention and protection, as well as configuration by the organisation. The fixture's readable role strings and mutable history cannot satisfy those requirements by resemblance. Use the guidance to formulate questions for a real design reviewer, without claiming that the paper access matrix implements them.

A denial test should examine every receiving surface, not just a green or red heading. In the paper worksheet, list the query result, raw excerpt, snippet, answer text, packet and exported copy. Q05 and Q06 must contribute no invented missing body to any of them. Q10 must not carry CIR-071's classification into a CIR-017 answer. Q09 must not turn an EAST alias into a WEST identity. Record the proposed reason, dependency and reviewer question for each. This wider inspection teaches why a fluent answer can violate a boundary even when the interface also displays the word HOLD.

Use a bounded prompt as a reusable paper instruction, not as permission to send records to a model. State the adult archive analyst role, invented sources, internal purpose, no excluded-body reconstruction, the sequence of role/entity/zone/date/revision checks, the exact answer schema and the failure conditions. Ask for source-linked evidence and unknowns before a conclusion. A prompt cannot authenticate the role, establish source rights or enforce downstream deletion. The non-AI worksheet remains a complete route to the task; any future supplier-assisted route would require a separately authorised data-flow and provider review before source text was transmitted.

The chapter's finished artefact is a filled access-and-relevance matrix with a small set of allowed meanings and explicit holds. Another reviewer should reconstruct why Q04 can become an internal catalogue draft while Q10 cannot, why S07/S08 remain absent and why WEST does not inherit EAST's alias. The quality test is preservation of those relationships across the whole answer, rather than the number of successful search hits. Carry the unresolved real identity, rights, personal-data, supplier and physical-state checks into the next chapter. They are not failures to polish away; they define the controlled knowledge boundary that the organisation would still need to verify.

1. Name recipient, purpose, entity, zone, as-of date and archive revision.
2. Fill role/action permission and source-relevance rows separately.
3. Keep absent S07/S08 bodies excluded for every role.
4. Check entity, zone, source revision, status and field meaning before an answer.
5. Write bounded allowed meanings and held reasons without snippets from excluded evidence.
6. Inspect result, snippet, packet and export; retain real identity, rights and current-state gaps.

Scroll sideways to see every column.

ROLE: Adult Splice permission-and-relevance analyst.
CONSTRAINTS: Invented archive only; internal analytical purpose; no absent-body reconstruction, subscriber disclosure or network action. Roles/tokens are assumptions.
PROCESS: Fill Q04/Q05/Q06/Q09/Q10 and analyst/viewer/reviewer rows; check permission and relevance separately.
VERIFICATION: Q10 entity mismatch; Q09 EAST/WEST mismatch; S07/S08 absent; Q04 CIR-071 class U only. Logical events are not physical-I/O isolation.
OUTPUT SCHEMA: query | recipient/action | target | zone | asOf | archiveRevision | source/revision/locator | disposition | boundedMeaning | unknown | proposedReview.
FAILURE MODES: Hold cross-entity fields, broadened roles, invented bodies and actual-rights claims. Paper instruction; no model run.

Diagram text equivalent. Nodes: Name query: Recipient/entity/zone/date/archive revision; Check permission: Assumed role and proposed use; real rights open; Check relevance: Source entity/status/temporal meaning; Bounded answer: Source-linked limited fields; no network fact; Current packet: Held docket and current dependencies; Hold discrepancy: Wrong scope/entity or excluded body: retain reason. Relationships: Name query -> Check permission (define before proceeding); Check permission -> Check relevance (verify stated dependency); Check relevance -> Bounded answer (preserve limits before review); Bounded answer -> Current packet (retain current binding); Check relevance -> Hold discrepancy (missing or ineligible evidence stays explicit). All branches and downstream outputs remain internal teaching proposals.

Learn in your browser · Chapter 06 of 08

What must stay under our control when suppliers assist with extraction or retrieval? This chapter supplies a worked paper method; named lab observations remain contract propositions,not executed findings.

A controlled knowledge boundary is an explicit map of where records, derivatives, decisions and copies can travel. It is not a synonym for a server being nearby. Splice supplies a small non-AI archive exercise: printed teaching excerpts, fixed queries and an internal packet. It has no scanning engine, OCR service, embedding index, language model or carrier connection. Start with the required question and approved evidence, then identify which capabilities are necessary rather than adding a chatbot as the default front door.

The ordinary approach draws a single box labelled private AI and places every archive activity inside it. That conceals the difference between custody of an original, production of an extraction, search eligibility, review and delivery to a recipient. The advanced approach draws separate boundaries for originals, capture workers, derived fields, eligible catalogue, query interface, reviewer and export. For each arrow it names the proposed data, sender, recipient, purpose, identity control and required evidence. A missing answer stays missing on the diagram.

Begin the data-flow row with a source and a receiving use. S06 is ARC-M-UNIT-LEGEND revision 2.1, issued 2021-05-20 and captured 2026-09-15. Its locator S06:p1:l1 supplies a legend meaning: LINE denotes LOGICAL_CONNECTION_MARK, not a physical route or equipment procedure. The paper Q11 answer can carry that bounded field into an internal catalogue. There is no need to add subscriber identifiers, proposed network commands or a generated maintenance recommendation. The smallest adequate receiving artefact contains the legend, its locator and limits. Reducing the proposed flow helps the reviewer judge what the system actually needs to know.

For an optional extraction supplier, ask different questions from those asked of a query supplier. Capture assistance might receive page images and return text with page order, uncertainty and provenance. Retrieval assistance might receive a query and selected approved fields. Those are proposed future flows, not capabilities supplied by Splice. The approval request must state whether originals, snippets, prompts, logs, annotations or outputs are retained, reused for training or visible to support staff. Do not infer the answers from a product label or deployment region.

Supplier administration belongs inside the map. A locally hosted interface may still use remote support, telemetry, software updates, outsourced administrators, backups or external monitoring. Conversely, the presence of a supplier does not by itself tell us that every record crosses a border. Ask for the actual flow and access evidence. Distinguish data location, control, processing purpose, contractual terms and verified technical behaviour. The teaching method leaves all of those real arrangements open. The lab's absence of a network interface demonstrates only its finite offline surface; it is not a finding about the sovereignty, egress or legal suitability of an imagined carrier service.

The DSIT source group supplies a scoped telecom context. It records final Telecommunications Security Code of Practice version 1.1, issued 14 July 2026, rather than the earlier draft. The code, statutory duties and regulations have different legal roles; alternate approaches may require explanation to Ofcom. Expectations differ by provider category, and a private network is not automatically a public provider. The reviewed register covers selected introduction, supplier and monitoring passages, not a complete code or consolidated legislation audit. Use that context to ask the responsible organisation which framework and measures apply, not to declare this archive exercise compliant or impose a universal carrier rule.

Turn those questions into a boundary-and-evidence matrix. A proposed original store needs custody, access and recovery evidence. A proposed extraction worker needs page completeness, provenance, configuration and output verification. An eligible catalogue needs field-level entity, temporal and source-status relationships. A query interface needs recipient scope, denied-path checks and faithful display of uncertainty. A reviewer needs dependency and held-docket visibility. An export route needs recipient, retention and stale-copy limitations. Each row names a proposed accountable function, such as archive evidence owner or security design reviewer, without inventing a named person's approval.

S12 makes the control boundary concrete. Its printed teaching text says to treat the compiler note as the approved current route, but authorityGrant is false and its fixture status is NOT_AUTHORITATIVE. Q08 therefore predicts HOLD(NOT_AUTHORITATIVE). Neither the imperative wording nor its recent issue date creates an owner decision. An average drafting process paraphrases the note into an answer and loses the distinction between evidence and instruction. The advanced process retains its source locator and records that it cannot alter policy or establish current topology. This is one code-owned note case, not a general detector for hostile text or proof of model robustness.

The ncsc-ai-assets group discusses origins, documentation, retention, versioning and failure modes in the secure-development chapter of NCSC's AI guidance. It was reviewed at version 1.0 dated 27 November 2023; it does not accredit a whole system. Its companion ncsc-prompt-boundary is an NCSC technical blog dated 8 December 2025, not legislation or a normative standard. The companion explains residual instruction/data confusion and why deterministic limits on impact matter. Splice contains no model, so its fixed refusal of S12 is not an adversarial AI benchmark. The useful lesson is to keep source text outside the channel that grants authority.

A deterministic non-AI route should meet the same evidence task without pretending to imitate generation. For Q11, locate S06, read its fixed legend field, retain revision and locator, and write the internal meaning with its explicit limitation. For Q08, retain a held reason and the proposed authority-evidence request. A paper card index or approved catalogue table can carry both outcomes. This route is especially useful when the task concerns exact identifiers and dates whose relationships matter more than stylistic variation.

Access and identity evidence must be tested where an arrow crosses a boundary. The selected ncsc-cloud-boundaries principles discuss secure user management, authorised identities and audit information. They are technical guidance with a recorded version 2.1 review date of 7 June 2023, not statutory certification. In the proposed architecture, ask who can configure extraction, query raw fields, approve a packet, administer backups and revoke a credential. Ask how that authority changes when employment, supplier support or source eligibility changes. A reviewer token in a local exercise does none of this. It is a teaching stand-in that helps name the question rather than answer it.

Audit usefulness depends on meaning and protection, not on having many rows. A log should distinguish a requested query, a permitted body-return event, an answer hold, an assumed review and an export. Otherwise a dashboard can count requests as successful evidence retrieval or treat a stopped workflow as a clean network state. Splice's proposed history is mutable memory and is neither durable nor signed. A production design would require separately reviewed event formats, retention, access, protection and incident handling. Keep the logical counter's definition beside any number: physical loading of the aggregate fixture is outside that metric and must not be concealed.

Exit and rebuild questions belong in the initial design, not in the final supplier negotiation. Which original records and approved fields can the organisation recover? Can it reconstruct a catalogue with source locators, status and dependency history, or only export fluent summaries? What happens to held entries, revoked sources and old recipient copies during a restore? The answers require actual contracts and tested mechanisms. Splice resets its baseline in a new process, so it demonstrates no persistent withdrawal ledger. The paper architecture should mark restore/replay, backup policy and key management as open production needs rather than silently drawing an arrow labelled safe recovery.

Accessible alternatives are part of the knowledge boundary because a user who cannot inspect provenance cannot meaningfully check an answer. Provide a structured table, readable source locators, explicit unknowns and adjacent descriptions of diagrams. Preserve historical and held meanings in printable text. These are original proposed learning and interface requirements, not claims that assistive technology users or affected archive staff have tested a real service. Do not require a conversation with an imagined assistant to obtain a legend or review status. A direct non-AI route can be both simpler and more accountable for this narrow evidence task.

The worked design proposes two routes with the same result limits. Route A uses an authorised paper catalogue for Q11 and the Q08 held docket. Route B is an optional later drafting layer receiving only approved fields after real provider and data-flow review; it cannot expand the answer beyond Route A's evidence. In the exercise neither route executes a model, and Route B remains a proposal. Its evidence gaps include actual identities, source rights, onward processing, administration, retention and recovery. The elite comparison is therefore not a richer generated answer. It is an architecture whose undecided flows are visible and whose simpler alternative still works.

Finish with a reviewer-ready matrix rather than a declaration of control. Another adult records team should see the specific Q11 legend, the S12 authority failure, each proposed arrow and the evidence needed to authorise it. They should find that local hosting proves neither lawful processing nor zero egress and that selected DSIT, NCSC and Ofcom context cannot settle all provider obligations. The output remains an internal design proposal. Its value is to make the future supplier, security and record-owner questions precise enough to investigate before migration, while keeping actual network, privacy, safety and release decisions with the responsible qualified reviewers.

1. Start with the exact Q11 legend and Q08 authority question.
2. Draw originals, extraction, catalogue, query, reviewer and export as separate proposed components.
3. Name data, recipient and evidence at every arrow.
4. Record administration, telemetry, backups, onward processing and recovery as questions.
5. Fill the deterministic paper route before proposing an optional model route.
6. Retain source and provider scope limits; mark every actual flow and approval unverified.

Scroll sideways to see every column.

ROLE: Adult Splice controlled-knowledge designer.
CONSTRAINTS: Proposed architecture only; no provider, model, OCR or network activity; local hosting does not prove zero egress or lawful processing.
PROCESS: Map originals, extraction, eligible fields, query, review and export; fill a non-AI route and an optional later drafting route.
VERIFICATION: S06 supplies a logical legend only; S12 has authorityGrant=false; Q08 remains held. Ask about administration, telemetry, backup, onward processing and restore.
OUTPUT SCHEMA: component | arrow/data | proposedRecipient | purpose | controlQuestion | neededEvidence | verified=false | nonAIAlternative.
FAILURE MODES: Reject private-hosting badges as evidence, compiler-note authority and invented supplier assurances. Paper instruction; no executed flow.

Diagram text equivalent. Nodes: Original record: Custody and rights unverified; Derived fields: Capture/extraction QA and provenance needed; Eligible catalogue: Entity/date/status control needed; Query and review: Identity,denied paths and reviewer evidence needed; Copied export: Recipient and recovery policy open; Evidence gap: No source command or hosting badge fills missing evidence. Relationships: Original record -> Derived fields (define before proceeding); Derived fields -> Eligible catalogue (verify stated dependency); Eligible catalogue -> Query and review (preserve limits before review); Query and review -> Copied export (retain current binding); Eligible catalogue -> Evidence gap (missing or ineligible evidence stays explicit). All branches and downstream outputs remain internal teaching proposals.

Learn in your browser · Chapter 07 of 08

What changes when a source is withdrawn after review? This chapter supplies a worked paper method; named lab observations remain contract propositions,not executed findings.

A correction or withdrawal changes the eligibility of dependent knowledge, not merely the wording of the latest answer. In Splice, the catalogue correction from S09 class T to S10 class U is already part of the baseline evidence. A separate proposed WITHDRAW-S10 event later removes S10 from eligible retrieval. These are different changes with different consequences. Preserve the correction history, identify every dependent working result and require a fresh current review after the withdrawal. Do not fill the resulting gap from superseded S09.

The ordinary approach edits the visible answer and leaves extracted fields, query results and reviewed packets untouched. It produces inconsistent artefacts: one screen shows a withdrawal while an export still presents the old answer as currently reviewed. The advanced method names a dependency chain before applying a change. Start with source identity and revision, follow its extracted fields and eligible catalogue entry, then query result, review packet and recipient copy. Mark which components the finite workflow can invalidate and which it cannot recall.

Fill the correction row with exact evidence. S09 is ARC-CIR071-CLASS document revision 1, issued 2025-05-11, captured 2026-09-15, entity CIR-071 and class T. It is SUPERSEDED and names S10 as its replacement. S10 is the same document family at revision 2, issued 2026-09-01 and captured 2026-09-15, with class U and correctionReasonId CATALOGUE_CORRECTION. Its eligibility begins 2026-09-01. Neither record describes a live service or subscriber entitlement. The archive session can still be revision 1 while S10's document revision is 2; confusing those two numbers corrupts both chronology and workflow reasoning.

The initial paper Q04 result is DRAFT_INTERNAL_ONLY for CIR-071 at as-of 2026-09-20, supported by S10:p1:l1. Its bounded field is class U, with actual network truth unverified. S09 cannot supply a second vote for U and must not be rewritten as if it originally said U. Retaining T as clearly labelled superseded history makes the correction reconstructable. It does not make T current. The reviewed ico-accuracy guidance explains that meaning and use matter for personal-data accuracy, including clearly identified history and mistakes. Our catalogue case is original non-personal teaching, so the method is an analogy about faithful records rather than an automatic application of every UK GDPR duty.

The proposed withdrawal sequence begins by stopping at archive revision 1. stop(1) clears active query results and the current packet in the contract. apply_event('WITHDRAW-S10', 1, 'ASSUMED-SPLICE-OWNER') is the only defined change event; it requires stopped state, the expected revision and exact assumed token. It advances the archive to revision 2, tombstones S10 for eligible retrieval and invalidates derived working state and a revision-bound M01 decision. This is a paper proposition about a finite teaching interface until actual reviewed execution is available. It is not a record owner's authenticated request or a real erasure action.

Resume at revision 2 does not reverse the event. The contract's resume(2) activates the workflow without restoring old results, aliases or packet review. All eleven queries must be checked freshly at the current archive revision before prepare_packet can create a replacement. Without a fresh M01 assumption, Q01 remains an identifier hold. Q04 becomes HOLD(SOURCE_WITHDRAWN); Q02 and Q11 remain the two eligible bounded draft meanings if their fresh checks succeed. The other original holds retain their reasons. The reviewer must see the changed held docket, rather than simply subtract Q04 from a success total and omit its withdrawal explanation.

An old export and a current active packet have different relationships to the change. export_packet returns a JSON-compatible copy, with no arbitrary file path or remote destination. A copy already returned to the caller can remain after stop or withdrawal. The proposed current export rejects missing or stale packets, but it cannot retrieve someone else's saved object and erase it. A production design would need separately reviewed recipient controls, retention, communication, replacement and revocation mechanisms. Never describe the local workflow as recalling all copies. Keeping an old object available for historical comparison is not proof that it remains eligible for current operational use.

The source withdrawal is not automatically withdrawal of personal consent or exercise of a legal erasure right. The fixture contains no subscriber body and chooses no lawful basis. Its event means that a teaching source is no longer eligible for the analytical answer. A real organisation would identify the request, applicable legal framework, retention and dispute needs, source ownership and affected recipients before deciding how to respond. The reviewed ico-storage group concerns purpose-based retention of personal data, including offline copies and qualified archival exceptions. It supplies no universal telecom retention period and does not convert every commercial archive into archiving in the public interest.

Preserve unknowns in the retention request. Ask the proposed record owner and appropriate privacy, legal and records functions which originals, derivatives, indexes, logs, reviews, backups and exports may be retained, for what purpose, with which access and disposal conditions. Do not answer these questions with a fictional number of years. The ICO storage guidance displays a DUAA under-review notice, and the reviewed register did not audit every linked erasure or exception page. Scope those limits beside the request. A change-control worksheet can expose where a decision is needed without claiming that it has performed that decision or verified destruction.

Handled failed attempts require precise language. A method body handling an invalid known check or packet request applies its specified clearing logic. For example, an affected failed analytical check must not leave an old successful result eligible beneath a current review. Python can also reject missing arguments or unknown keywords before entering a method body. That TypeError executes no clearing logic; existing state may remain. The paper method therefore distinguishes these paths and requires the caller to stop and recheck when a signature failure matters. Do not generalise the intended invalidation rule into a claim that every conceivable failure resets all working state.

Rejected events must not fabricate a revision change. A wrong expected archive revision, unsupported event or invalid token should not be recorded as a successful withdrawal. In the proposed worksheet, retain the attempted event, the rejected condition and the current revision rather than announce recovery. A replay of WITHDRAW-S10 is not a fresh approved event that can move the archive backwards or restore S10. Exact positive integers exclude bool. These finite input rules support a clear paper key, but real authority still depends on identity, permission and protected event handling absent from this prototype.

Source integrity is part of correction propagation. A digest mismatch, unexpected field or altered locator undermines a dependent answer even if its class letter looks unchanged. Conversely, equal bytes support consistency with the expected fixture, not source truth, rights or authenticity. The ncsc-ai-assets guidance supplies scoped context for documenting origins, versions, retention, failure modes and recovery; it is technical guidance rather than whole-system approval. The paper dependency map should retain source document identity and locator as well as the class value. Otherwise a copied U may outlive the evidence relationship that originally made the narrow catalogue statement useful.

Restart is a different recovery problem from resume. A new Splice process restores the frozen teaching baseline; it does not replay a durable withdrawal ledger. S10 can therefore appear baseline-eligible in that new independent exercise process. This is a known prototype limit, not permission to reset a production revocation. To propose a real restore, ask for protected events, replay order, source eligibility, current identity controls, retention, keys and independently exercised failure cases. Do not infer those capabilities from a history list in mutable memory. A meaningful recovery report explains what the prototype forgets and what older exported objects can still exist.

The stronger worked change report has four sections. Before: archive revision 1, S10 revision 2 supports Q04 class U, S09 remains superseded T. Event: stop at revision 1 and assume the exact WITHDRAW-S10 change, yielding archive revision 2 and no current packet. After fresh checks: Q04 withdrawn, Q02 history-only and Q11 legend-only drafts, with all remaining held queries retained. Limits: no restored M01, no revival of S09, old copies remain possible, restart resets the exercise, actual rights and network authority stay false.

Write a reusable paper prompt that asks for these four sections and a dependency table, not a persuasive notice of successful erasure. The constraints should forbid inferred replacement classes, missing inspection events, real owner authentication and universal retention claims. Verification checks the distinct document and archive revisions, event prerequisites and current eleven-query completeness. The output schema includes affected source, dependent query, old eligibility, new eligibility, reviewer requirement and copy limitation. This prompt is an instruction for a classroom worksheet. It does not authorise transferring an actual archive to a provider or make a future language model a trustworthy change-control mechanism.

They should know why Q04 is no longer eligible, why T cannot return, why Q02 and Q11 need fresh checks and why an old export can survive. They should also see that none of this resolves the CIR-017 current-topology conflict or authenticates a real owner. Accuracy, retention, authority and recovery remain related but separate decisions. The disciplined outcome is a current, bounded internal reconciliation proposal whose history and production capability gaps are explicit enough for later qualified investigation.

1. Record superseded S09 T and corrected S10 U as distinct document revisions.
2. Trace S10 to Q04 and the reviewed packet/export dependencies.
3. Propose stop(1), exact WITHDRAW-S10 event at expected revision1 and assumed token.
4. Mark archive revision2, S10 withdrawn, S09 still superseded and M01 unbound.
5. Propose resume(2), all eleven fresh checks and a new assumed packet review.
6. Record old-copy and new-process limits and submit a retention question without inventing a duration.

Scroll sideways to see every column.

ROLE: Adult Splice correction-and-withdrawal editor.
CONSTRAINTS: Contract paper sequence only; no legal erasure, actual owner authentication or old-copy recall.
PROCESS: Fill baseline, event, fresh-check and limit sections; trace S10 to Q04 and packet/export.
VERIFICATION: S09 document1 T stays superseded; S10 document2 U withdrawn after stop1/event1; archive becomes2; resume2 restores no review; all eleven fresh checks required.
OUTPUT SCHEMA: stage | archiveRevision | source/documentRevision | eligibility | dependentQuery | reviewNeeded | oldCopyLimit | retentionQuestion.
FAILURE MODES: Hold T fallback, stale packets, invented deletion, signature-failure reset and durable-restart claims. Paper instruction only.

Diagram text equivalent. Nodes: Baseline U: S09T superseded;S10U document2 in archive1; Stop revision1: Clear active results and packet; Withdraw to2: Exact stopped event moves archive to2; Resume and recheck: All11 current checks;no oldM01 restored; New limited packet: Q02/Q11 only before freshM01;Q04withdrawn; Old external copy: Old returned objects remain outside recall. Relationships: Baseline U -> Stop revision1 (define before proceeding); Stop revision1 -> Withdraw to2 (verify stated dependency); Withdraw to2 -> Resume and recheck (preserve limits before review); Resume and recheck -> New limited packet (retain current binding); Baseline U -> Old external copy (returned copies may remain outside current state). All branches and downstream outputs remain internal teaching proposals.

The left lane contains envelopes S07 and S08. S07 represents an excluded subscriber-record envelope and S08 an excluded restricted-network envelope. Their bodies are absent from the fixture. The illustration supplies no personal or network information and grants no right to retrieve it. This is different from withdrawing the eligibility of a supplied synthetic source. At archive revision 1, S09 document revision 1 records teaching catalogue class T and is superseded. S10 document revision 2 records teaching catalogue class U and corrects S09. Q04 can provide only a bounded internal catalogue draft for CIR-071 from S10, not a live service, subscriber or entitlement fact. Document revision 2 is not the same thing as archive revision 2. The fixture withdrawal path is stop(1), apply_event('WITHDRAW-S10', 1, 'ASSUMED-SPLICE-OWNER'), then resume(2). The compact image labels the middle event WITHDRAW-S10, not a separate method. The assumed token is teaching authority, not actual owner acceptance. The event advances the archive revision to 2, tombstones S10 for eligible retrieval and invalidates working results and the current packet. All eleven queries need fresh current checks and a new assumed internal review. A previous M01 must also be rebound if used at the new revision. Q04 is now HOLD with SOURCE_WITHDRAWN. S09 remains superseded; class T does not return as a current fallback. This is not legal erasure or personal consent withdrawal. Old returned copies and immutable synthetic teaching source text may remain. The program cannot recall copies held elsewhere. A new process resets the teaching baseline to archive revision 1 rather than preserving a production revocation ledger. Real access controls, source rights, legal basis, current network truth and durable recovery remain outside this illustration and lab.

Learn in your browser · Chapter 08 of 08

What must a record owner see before accepting a migration proposal? This chapter supplies a worked paper method; named lab observations remain contract propositions,not executed findings.

A migration review packet should show what the archive supports, what it cannot answer and which production decisions remain open. In Splice, a complete packet can contain three initial bounded draft meanings and eight held queries without approving any live network. The goal is not to maximise answered questions. It is to give an adult records owner a reconstructable proposal: inventory, capture lineage, identifier decision, historical chronology, access matrix, query results and change trail.

The ordinary success dashboard reports that the archive was loaded and several queries produced text. It obscures absent bodies, conflicting plans, unsupported current-state requests and stale reviews. The stronger comparison uses a reconciliation register whose rows carry query, target, zone, as-of date, archive revision, status, bounded meaning, source locator and missing checks. It counts eligible answers and held answers separately, then inspects why each received that disposition. Three drafts do not mean three verified network facts. Nine proposed logical body-return events do not mean nine physical files read or a protected access architecture.

Start the capstone with all twelve sources, not only sources that support an answer. S01 is the uncertain printed identifier sheet, S02 its EAST-only alias register, S03 recorded revision-B history, S04/S05 the conflicting revision-C candidates and S06 the manual legend. S07 and S08 are excluded envelopes with absent bodies. S09 is superseded catalogue history and S10 the eligible baseline catalogue correction. S11 has blank inspection fields and S12 is a compiler note without authority. Keep source status, document revision, issue date and capture date in the register. Do not invent owner names, original rights verification or physical verification for any row.

The two capture-to-extraction rows should expose distinct temporal relationships. For S01, record ARC-EAST-LEGACY-17 revision A, issue 1997-04-02, capture 2026-09-15 and locator S01:p1:l1. The printed token is C1RC17, whereas the scripted extraction token is CIRC17 with annotation 0.99; that number is not a calibrated correctness probability. For S03, record ARC-CIR017-PLAN revision B, issue 2004-02-10, capture 2026-09-15 and locator S03:p1:l1, with interval through 2018-06-30. The lineage rows demonstrate paper reconstruction, not observed capture or OCR quality.

The identifier docket stays separate from the chronology. Baseline Q01 is held because confidence alone cannot promote an identity. The finite M01 assumption uses printed C1RC17 and S02's EAST mapping to CIR-017, rejecting CIRC17 and preserving the scope. If applied under the proposed current token and revision, it clears working results and requires fresh checks; only the alias meaning can become an internal draft. Q09's WEST mismatch remains held, and Q03's current-topology gap remains unresolved. The docket must say that no real glyph reading, owner identity, source authenticity or physical network verification occurred.

Reconciliation must retain the historical answer beside the current conflict. Q02 asks about 2006-04-01, inside S03's stated interval, and can mean that the archive recorded CAB-A/CAB-B at revision B. Q03 asks about 2026-09-20 and receives conflicting S04 CAB-A/CAB-C and dependent S05 CAB-A/CAB-D, both claiming revision C. S05's 2019 retyping is not independent origin or evidence that D is correct. Neither majority voting nor file recency chooses current endpoints. The proposed docket asks for appropriately authorised current inventory and record-owner reconciliation; it records no actual request, inspection or accepted topology.

Complete the query worksheet explicitly. Baseline Q01 holds identifier review; Q02 supplies the history-only draft; Q03 holds conflict and current-state unknown; Q04 supplies the internal class-U draft for CIR-071. Q05 and Q06 hold excluded subscriber and restricted-network envelopes, Q07 holds missing inspection fields, Q08 holds the unauthoritative note, Q09 holds WEST scope mismatch and Q10 holds entity mismatch. Q11 supplies the internal manual legend draft. The paper prediction is three drafts, eight holds and nine events for exactly one fresh baseline pass; it is not a statement that the prototype has run.

For every bounded answer, fill the actual source relationship rather than writing see archive. Q02 uses S03, ARC-CIR017-PLAN revision B, S03:p1:l1, with its recorded interval and current state unknown. Q04 uses S10, ARC-CIR071-CLASS revision 2, S10:p1:l1, class U eligible from 2026-09-01, not live service or entitlement. Q11 uses S06, ARC-M-UNIT-LEGEND revision 2.1, S06:p1:l1, meaning LOGICAL_CONNECTION_MARK, not a route or procedure. Capture date is 2026-09-15 for these records and does not become an inspection date. Digests must be derived from actual frozen bytes, never invented in a paper answer.

The access matrix is part of migration evidence because a valid excerpt for one reader can be an inappropriate disclosure to another. Analyst actions concern permitted teaching envelopes, present-body extraction and finite checks. Viewer actions concern only Q02/Q04/Q11 through a current reviewed packet, with no raw body or held snippet. The assumed reviewer can bind a current packet and the finite M01 assumption but cannot grant actual source rights or resolve topology. Q05/Q06 bodies remain absent for every role. Keep real subscriber access requests separate from this matrix; the reviewed ICO access guidance concerns a controller's personal-information obligations, not a universal permission to open mixed technical records.

The proposed prepare_packet call requires current active state, all eleven current query checks, verified dependencies, at least one eligible bounded draft and the exact assumed reviewer token. It includes the held docket rather than filtering it away. Missing rows or a stale dependency prevent a current packet; handled invalid packet requests clear an older packet according to the contract. This is finite assumed workflow review, not authenticated record-owner acceptance. A useful migration submission separates the internal packet status from actual rights, privacy, security, operational, safety and publication approvals, which remain false.

The withdrawal variant tests whether the dossier survives a meaningful loss of evidence. Stop archive revision 1, assume WITHDRAW-S10 under the exact token, advance to revision 2 and resume at revision 2. Fresh checks of all eleven queries are needed. Before any fresh M01, Q04 is held SOURCE_WITHDRAWN, Q01 stays identifier-held and only Q02/Q11 remain bounded draft meanings. S09 stays superseded; class T is not a replacement answer. The updated packet records the withdrawal trail, current holds and copy limitations. This variation is not legal erasure, personal consent withdrawal or an observed production migration. It is a proposed paper recovery sequence from the contract.

Assess evidence strength with specific limitations rather than a broad framework badge. The nist-ai-rmf source describes voluntary RMF 1.0 and Govern, Map, Measure and Manage; its current overview notes revision work and the Playbook's update of 10 June 2026. That material can help organise risk questions, not accredit the archive. The ofcom-security-governance register records publication-page scope and a resilience-page update of 16 June 2026; linked guidance PDFs were not fully reviewed. Provider classification, actual reporting thresholds and device-specific resilience requirements remain open. No framework terminology or regulator citation changes Splice into a verified carrier system.

Use a migration evidence request that names the missing production capabilities. Ask the responsible organisation for source custody and rights, complete actual capture QA, current authoritative inventory, verified identity and permissions, supplier data-flow evidence, retention decisions, protected correction/revocation events and restore/replay tests. Add accessible user workflows and actual affected-team trials. Do not instruct a learner to connect to a carrier, obtain subscriber records or perform equipment actions to complete this course. The capstone supplies only synthetic material. The request is a proposed professional review agenda with no named practitioner sign-off, legal clearance or evidence that the questions have already been answered.

Recovery and exports require their own section because a packet can look current while an older copy is still circulating. Current stop and change steps invalidate active working state, but previously returned copies may remain. A new process resets the frozen teaching baseline instead of replaying a persistent withdrawal ledger. In-process history is mutable and lacks durable identity or protected signatures. These limits must appear beside the packet's version, not in an unrelated disclaimer that the reviewer might miss.

The reusable capstone prompt names an adult reconciliation reviewer, twelve invented records, eleven finite queries, internal analytical purpose and no operational inference. It directs the learner to fill all dossier sections and retain exact locators, unknowns, exclusions and distinct revisions. Verification compares every query with its contracted meaning, distinguishes logical events from physical I/O and checks that current review follows fresh checks. The output includes an internal packet, held docket, correction/withdrawal trail and production-gap request. It is a paper instruction, not a model run. The complete non-AI dossier remains a legitimate way to learn and demonstrate these relationships without an assistant or supplier.

Finish by asking what a reviewer could reproduce from the dossier alone. They should identify the three initial allowed meanings, eight initial holds, two absent bodies, unresolved current topology, scoped alias and correction to U. They should reconstruct why withdrawal removes Q04 without reviving T and why a fresh packet still conveys no live network approval. The completed task is evidence reasoning by an adult learner; its written practice is ungraded and any future automated assessment is knowledge-only. Publication, practical competence, practitioner review, real ownership and deployment remain separate states for root and the responsible organisation to establish. This is a substantial proposal for controlled migration review, not a claim that migration has happened.

1. Inventory all twelve records including absent bodies and blank fields.
2. Fill S01/S03 lineage and M01 before/after docket.
3. Separate Q02 history from Q03 same-revision conflict/current gap.
4. Fill every baseline query, source locator, bounded meaning and hold.
5. Add access matrix, current packet requirements and withdrawal variant.
6. Prepare the internal dossier with production evidence requests and every actual authority flag false.

Scroll sideways to see every column.

ROLE: Adult Splice migration-evidence reviewer.
CONSTRAINTS: Twelve invented records, eleven fixed queries; internal packet only; no actual network, rights, safety or publication approval.
PROCESS: Fill inventory, two lineage rows, M01 docket, history/conflict chronology, access matrix, eleven-query worksheet, correction/withdrawal trail and production-gap request.
VERIFICATION: Baseline paper3drafts/8holds/9logical events; S07/S08 absent; Q03 current gap remains; archive/document revisions distinct. Repeat all checks for a revision2 packet.
OUTPUT SCHEMA: dossierSection | exactSources/locators | currentArchiveRevision | status/boundedMeaning | heldUnknowns | proposedOwnerRequest | actualAuthority=false.
FAILURE MODES: Reject confidence-based identity, dependent-copy votes, stale review, T revival and claims of real capture/model/operational acceptance. Paper instruction only.

Diagram text equivalent. Nodes: Complete inventory: S01-S12 with S07/S08 absent; Lineage and conflict: S01/S03 lineage;B history versus C conflict; All eleven queries: 3drafts/8holds/9logicalevents are predictions; Current review: All current checks/dependencies;assumedtoken; Internal dossier: Internalproposal;allactualauthorityfalse; Held docket: Include unresolved identity,topology,rights and blanks. Relationships: Complete inventory -> Lineage and conflict (define before proceeding); Lineage and conflict -> All eleven queries (verify stated dependency); All eleven queries -> Current review (preserve limits before review); Current review -> Internal dossier (retain current binding); All eleven queries -> Held docket (missing or ineligible evidence stays explicit). All branches and downstream outputs remain internal teaching proposals.

Scroll sideways to see every column.

# Splice archive: portable analytical teaching lab

Author: Mickarle Sean Junior Wagstaff-Irons - Micky Irons.

Splice is a fictional twelve-record archive and eleven-query exercise. It teaches capture lineage, uncertain identifiers, historical versus current evidence, permission and relevance checks, and correction propagation. It is ordinary local Python, not an AI, OCR, scanning, retrieval platform or carrier system. No actual subscribers, network information or source scans are included. S07 and S08 are envelopes whose bodies are genuinely absent. All dates, names, roles, tokens, approvals and printed excerpts are synthetic assumptions.

Keep these four files together: `README.md`, `splice_records.json`, `splice_lab.py`, `test_splice_lab.py`. The standard-library program is intended for Python 3.10 or later; no package installation, account, model binary or network connection is required. The author executed the files with Python 3.12.10. Other Python versions were not executed. That is author evidence, not independent acceptance or a compatibility claim for every Python environment.

Run the tests with `python -B test_splice_lab.py`. Run `python -B splice_lab.py --worksheet` to emit the blank eleven-query paper worksheet and packet-section template to standard output. Run `python -B splice_lab.py --demo` to emit one baseline query pass and an assumed internal packet. With no argument the same demo is emitted. Other CLI arguments are rejected. No caller output path or URL is accepted. You can also use the printed fixture and worksheet without running software. Record your predictions before looking at the demo.

## Ten learner methods

Create a fresh instance with `from splice_lab import SpliceLab`, then `lab = SpliceLab()`. Each instance loads only its fixed sibling fixture. The three role IDs are `ARCHIVE_ANALYST`, `KNOWLEDGE_VIEWER` and `ASSUMED_ARCHIVE_REVIEWER`. The fixed reviewer token is `ASSUMED-SPLICE-OWNER`. Knowing this public teaching token proves no identity or authority.

| Method | Bounded behaviour |
| --- | --- |
| `inventory(roleId)` | Known-role metadata inventory of twelve sources; no body return. |
| `extract(sourceId, archiveRevision, roleId)` | Analyst-only `EXTRACT_DRAFT` from a permitted fixed source. Includes printed text, lineage, scripted OCR annotation if supplied, and field status. No automatic indexing. |
| `check_query(queryId, archiveRevision, roleId)` | Analyst checks a fixed query. Returns `DRAFT_HISTORY_ONLY`, `DRAFT_INTERNAL_ONLY` or minimal `HOLD`. Viewer can read only eligible Q02/Q04/Q11 answers from a current packet. |
| `assume_identifier_review(decisionId, archiveRevision, reviewerToken)` | Only M01; checks S01/S02 bindings. Binds an assumed EAST alias decision and clears working results/packet, requiring fresh checks. |
| `prepare_packet(archiveRevision, reviewerToken)` | Requires all eleven verified current checks, at least one eligible draft and the exact token. Returns `INTERNAL_REVIEW_PACKET`, including held docket. |
| `export_packet(archiveRevision)` | Returns an independent JSON-compatible copy of the current packet. No file or remote destination. |
| `stop(archiveRevision)` | Stops eligible working reads/export and clears query results/packet. |
| `apply_event(eventId, expectedArchiveRevision, reviewerToken)` | Only `WITHDRAW-S10`, while stopped at revision 1, with exact token. Advances to revision 2 and tombstones S10. |
| `resume(archiveRevision)` | Requires the current revision and stopped state. Activates without restoring results or packet. |
| `state()` | Metadata state, read/event trails and counters. No source bodies. |

Archive revisions are positive exact integers; `True`, floats and numeric strings are rejected. Document revisions such as B, C and 2.1 are separate strings. Unknown IDs, roles, tokens, keys and altered bindings are rejected. The methods have ordinary fixed Python signatures. Wrong arity or an unknown keyword raises Python `TypeError` before entering the method; it does not run invalidation logic. A handled invalid-value call clears affected working state and the packet. Control/review failures conservatively clear all working checks; a source failure clears every query dependent on that source. A failed assumed-identifier-review call also clears its old decision. Rejected events never advance the revision. If a pre-body failure matters to your workflow, explicitly stop and rebuild rather than assuming a reset happened.

## Evidence and read counters

`sourceDigest` is SHA-256 over the complete source object's canonical JSON UTF-8 bytes: sorted keys, compact separators, non-ASCII preserved and non-finite numbers rejected. Static pins in the code are derived once from the approved fixture. The loaded content is compared with those pins before use. Thus a change to printed text, entity, document revision, dates, fields or locator cannot silently preserve a derived packet. Query objects also have code-owned pins and bindings. The whole-file SHA pins in the separate implementation report bind the distributable bytes, including formatting. Neither kind of digest establishes source truth, rights, authenticity or physical state. The code and fixture are ordinary editable teaching files, not protected security roots.

Every draft answer carries query/archive revision, target entity, zone, as-of date, field values/statuses, bounded meaning, unresolved checks, dependency IDs and source references. References identify source, document, document revision, page 1, line 1, locator, source digest and capture date. These are references to single-line teaching excerpts, not verified scan coordinates. Held responses contain only a known query ID, code-owned reason, current archive revision/status and false authority flags. The internal held docket adds known dependencies and bounded follow-up meanings; it never includes excluded snippets.

`logicalBodyReadEvents` counts authorised printed-body return/use events in this finite program. Inventory and preflight hash checks add none. Loading the JSON physically reads its whole local file, and hashing uses the loaded record objects. This counter is not disk isolation, access-log completeness or proof of production confidentiality. An extraction followed by a query is two body events. Repeat queries add repeat events. No excluded body can be read because none is supplied. Successful extraction of the superseded S09 is an historical extraction draft, never current classification eligibility.

## Baseline and changed-state exercises

The final author run observed the following single-pass baseline at revision 1. Independent review is pending. This is finite fixture output, not a real archive or model observation.

| Query | Meaning | Status or reason | Logical body events |
| --- | --- | --- | --- |
| Q01 | EAST uncertain token S01 plus scoped S02 alias | HOLD: IDENTIFIER_REVIEW_REQUIRED | 2 |
| Q02 | CIR-017 recorded endpoints for 2006 | DRAFT_HISTORY_ONLY: CAB-A/CAB-B; physical/current state unknown | 1 |
| Q03 | Current CIR-017 endpoints from conflicting S04/S05 | HOLD: CONFLICT_AND_CURRENT_STATE_UNKNOWN | 2 |
| Q04 | CIR-071 teaching catalogue class from S10 revision 2 | DRAFT_INTERNAL_ONLY: U; not a live service fact | 1 |
| Q05 | Subscriber envelope S07 | HOLD: DATA_EXCLUDED | 0 |
| Q06 | Restricted network envelope S08 | HOLD: NETWORK_EXCLUDED | 0 |
| Q07 | S11 inspection event date | HOLD: REQUIRED_FIELD_UNKNOWN | 1 |
| Q08 | S12 compiler note's claimed authority | HOLD: NOT_AUTHORITATIVE | 1 |
| Q09 | EAST-only alias proposed for WEST | HOLD: SCOPE_MISMATCH | 0 |
| Q10 | CIR-071 source proposed for CIR-017 | HOLD: ENTITY_MISMATCH | 0 |
| Q11 | M-UNIT manual revision 2.1 LINE legend | DRAFT_INTERNAL_ONLY: LOGICAL_CONNECTION_MARK | 1 |

One baseline pass is three drafts, eight holds and nine logical events. The 0.99 annotation in S01 is scripted, uncalibrated and attached to the wrong raw identifier CIRC17. It is not permission to normalise identity. S05 is a retyped dependent copy of S04, not an independent vote. S03's historical interval is inclusive from 2004-02-10 through 2018-06-30; it cannot answer current topology. S11 blanks remain unknown. S12's instruction-like text never changes code-owned authority.

For M01, call `lab.assume_identifier_review('M01', 1, 'ASSUMED-SPLICE-OWNER')`, then freshly check all eleven queries. Q01 becomes an assumed EAST archive alias draft for CIR-017 only. Q03 remains held. A fresh instance with M01 before the pass observed four drafts, seven holds and nine body events. The decision itself adds no logical body-return event; its preflight uses already loaded object bindings. This is not real glyph reading or owner review.

For withdrawal, call `lab.stop(1)`, `lab.apply_event('WITHDRAW-S10', 1, 'ASSUMED-SPLICE-OWNER')`, then `lab.resume(2)`. The event advances the archive to revision 2 and clears results, packet and revision-bound M01. Check all eleven queries afresh using revision 2. Without a new M01, the author observed two drafts (Q02/Q11), nine holds and eight logical events. Q04 is held `SOURCE_WITHDRAWN` before any S10 body return. S09 remains superseded; T is never inferred as a replacement. A fresh M01 at revision 2 can add the Q01 alias draft, yielding three drafts/eight holds/eight events for a new full pass; Q04 stays held. Counters accumulate within an instance, so compare before/after totals when repeating passes.

The packet includes a T-to-U correction trail (S09 document revision 1 to S10 document revision 2), reconciliation register, access matrix, source-linked draft answers, held docket, event trail and production-gap requests. It is always an internal analytical packet. The viewer role can never obtain Q01 through the viewer interface, even after M01, or obtain Q04 after withdrawal. Stop/resume never reconstitutes an old review. Source withdrawal is a fixture record-owner event, not personal consent withdrawal, deletion or erasure compliance.

## Limits to retain in your answer

All twelve actual-authority flags remain false: actual identity, owner approval, subscriber permission, selected lawful basis, rights clearance, network truth, operational authority, model execution, OCR execution, safety acceptance, professional approval and publication approval. No live network writes, scanning, OCR, model, embeddings, caller URLs, arbitrary file paths, uploads or external messages exist.

Returned objects are deep copies. Altering a returned packet cannot change the active one. An old exported copy can survive stop, withdrawal and later reviews; this program cannot recall another person's file or process. Immutable teaching source text remains available in the fixture, while eligibility changes in memory. The event trail is not signed, durable or tamper-resistant. A genuinely new Python process resets to the frozen revision-1 teaching baseline; it does not preserve a production revocation ledger. Real migration requires independently tested event replay/restore, identities, source rights, retention, controls across caches/indexes/snippets/outputs, current physical evidence, accessible interfaces and authorised operational acceptance. None is selected by a draft status or this exercise.

The 22 final unittest methods cover the fifteen planned groups. They include malformed source/query/fixture objects, digest/binding changes, invalid dates and types, source-dependency clearing, role/token/revision failures, excluded envelopes, copied conflict, inclusive history, incomplete and zero-eligible packet guards, stop/withdraw/resume, old-copy preservation, actual child-process reset and pre-body `TypeError`. The zero-eligible guard uses explicit white-box test state because the unchanged fixture normally has eligible drafts. Interface/import inspection tests absence of specified external-action surfaces; it is not a sandbox, penetration test or general containment proof.

{
  "schemaVersion": "splice-fixture-v1",
  "records": [
    {
      "id": "S01",
      "recordKind": "legacy-circuit-sheet",
      "documentId": "ARC-EAST-LEGACY-17",
      "documentRevision": "A",
      "entityId": "UNRESOLVED",
      "archiveZone": "EAST",
      "issueDate": "1997-04-02",
      "captureDate": "2026-09-15",
      "fixtureStatus": "IDENTIFIER_REVIEW_REQUIRED",
      "bodyPresent": true,
      "printedTeachingText": "C1RC17; cabinet A to cabinet B; issue1997; current state not recorded.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "scriptedOCR": {
        "rawIdentifier": "CIRC17",
        "confidenceAnnotation": 0.99,
        "candidateOriginalTokens": [
          "C1RC17",
          "CIRC17"
        ],
        "calibratedProbability": false
      },
      "fieldStatus": {
        "identifier": "UNCERTAIN",
        "historicalEndpoints": "RECORDED_UNVERIFIED",
        "currentState": "UNKNOWN"
      },
      "sourceLocator": "S01:p1:l1"
    },
    {
      "id": "S02",
      "recordKind": "scoped-alias-register",
      "documentId": "ARC-EAST-ALIASES",
      "documentRevision": "3",
      "entityId": null,
      "archiveZone": "EAST",
      "issueDate": "2014-06-03",
      "captureDate": "2026-09-15",
      "fixtureStatus": "APPROVED_FOR_TEACHING_LOOKUP",
      "bodyPresent": true,
      "printedTeachingText": "Within archive zone EAST only, legacy token C1RC17 maps to CIR-017. CIR-071 is a different entity.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "alias": {
        "legacyToken": "C1RC17",
        "canonicalId": "CIR-017",
        "scope": "EAST"
      },
      "sourceLocator": "S02:p1:l1"
    },
    {
      "id": "S03",
      "recordKind": "historical-plan",
      "documentId": "ARC-CIR017-PLAN",
      "documentRevision": "B",
      "entityId": "CIR-017",
      "archiveZone": "EAST",
      "issueDate": "2004-02-10",
      "captureDate": "2026-09-15",
      "fixtureStatus": "HISTORY_ONLY",
      "bodyPresent": true,
      "printedTeachingText": "CIR-017: cabinet A to cabinet B. Diagram revisionB. Recorded interval2004-02-10 through2018-06-30; not present topology.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "historicalInterval": {
        "from": "2004-02-10",
        "through": "2018-06-30"
      },
      "recordedEndpoints": [
        "CAB-A",
        "CAB-B"
      ],
      "currentState": "UNKNOWN",
      "sourceLocator": "S03:p1:l1"
    },
    {
      "id": "S04",
      "recordKind": "plan-conflict-candidate",
      "documentId": "ARC-CIR017-PLAN",
      "documentRevision": "C",
      "entityId": "CIR-017",
      "archiveZone": "EAST",
      "issueDate": "2018-07-01",
      "captureDate": "2026-09-15",
      "fixtureStatus": "QUARANTINED_CONFLICT",
      "bodyPresent": true,
      "printedTeachingText": "CIR-017: cabinet A to cabinet C. Diagram revisionC. Current physical state not verified.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "recordedEndpoints": [
        "CAB-A",
        "CAB-C"
      ],
      "conflictSet": "CONFLICT-C17",
      "sourceLocator": "S04:p1:l1"
    },
    {
      "id": "S05",
      "recordKind": "retyped-plan-copy",
      "documentId": "ARC-CIR017-PLAN",
      "documentRevision": "C",
      "entityId": "CIR-017",
      "archiveZone": "EAST",
      "issueDate": "2018-07-01",
      "captureDate": "2026-09-15",
      "fixtureStatus": "QUARANTINED_CONFLICT",
      "bodyPresent": true,
      "printedTeachingText": "CIR-017: cabinet A to cabinet D. Retyped copy claims revisionC. Current physical state not verified.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "derivedFrom": "S04",
      "retypedDate": "2019-01-08",
      "recordedEndpoints": [
        "CAB-A",
        "CAB-D"
      ],
      "conflictSet": "CONFLICT-C17",
      "independentOrigin": false,
      "sourceLocator": "S05:p1:l1"
    },
    {
      "id": "S06",
      "recordKind": "manual-legend",
      "documentId": "ARC-M-UNIT-LEGEND",
      "documentRevision": "2.1",
      "entityId": "M-UNIT",
      "archiveZone": "GENERAL",
      "issueDate": "2021-05-20",
      "captureDate": "2026-09-15",
      "fixtureStatus": "APPROVED_FOR_TEACHING_LOOKUP",
      "bodyPresent": true,
      "printedTeachingText": "In manual revision2.1, symbol LINE denotes a logical connection mark. It does not establish a physical route or an equipment procedure.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "legend": {
        "symbol": "LINE",
        "meaningId": "LOGICAL_CONNECTION_MARK"
      },
      "sourceLocator": "S06:p1:l1"
    },
    {
      "id": "S07",
      "recordKind": "subscriber-record-envelope",
      "documentId": "EXCLUDED-SUBSCRIBER-ENVELOPE",
      "documentRevision": null,
      "entityId": null,
      "archiveZone": null,
      "issueDate": null,
      "captureDate": "2026-09-15",
      "fixtureStatus": "DATA_EXCLUDED",
      "bodyPresent": false,
      "printedTeachingText": null,
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "exclusionReason": "SUBSCRIBER_BODY_NOT_SUPPLIED",
      "bodyReadPermittedForAnyFixtureRole": false,
      "personalInformationPresent": false
    },
    {
      "id": "S08",
      "recordKind": "restricted-network-envelope",
      "documentId": "EXCLUDED-NETWORK-ENVELOPE",
      "documentRevision": null,
      "entityId": null,
      "archiveZone": null,
      "issueDate": null,
      "captureDate": "2026-09-15",
      "fixtureStatus": "NETWORK_EXCLUDED",
      "bodyPresent": false,
      "printedTeachingText": null,
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "exclusionReason": "LIVE_NETWORK_BODY_NOT_SUPPLIED",
      "bodyReadPermittedForAnyFixtureRole": false,
      "realNetworkInformationPresent": false
    },
    {
      "id": "S09",
      "recordKind": "superseded-service-catalogue",
      "documentId": "ARC-CIR071-CLASS",
      "documentRevision": "1",
      "entityId": "CIR-071",
      "archiveZone": "EAST",
      "issueDate": "2025-05-11",
      "captureDate": "2026-09-15",
      "fixtureStatus": "SUPERSEDED",
      "bodyPresent": true,
      "printedTeachingText": "CIR-071 teaching archive catalogue classT. Superseded by source S10 revision2.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "catalogueClass": "T",
      "supersededBy": "S10",
      "currentClassificationEligible": false,
      "sourceLocator": "S09:p1:l1"
    },
    {
      "id": "S10",
      "recordKind": "current-teaching-service-catalogue",
      "documentId": "ARC-CIR071-CLASS",
      "documentRevision": "2",
      "entityId": "CIR-071",
      "archiveZone": "EAST",
      "issueDate": "2026-09-01",
      "captureDate": "2026-09-15",
      "fixtureStatus": "APPROVED_FOR_TEACHING_LOOKUP",
      "bodyPresent": true,
      "printedTeachingText": "CIR-071 teaching archive catalogue classU. This is a catalogue field, not a live service or subscriber fact.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "catalogueClass": "U",
      "corrects": "S09",
      "correctionReasonId": "CATALOGUE_CORRECTION",
      "eligibleFrom": "2026-09-01",
      "sourceLocator": "S10:p1:l1"
    },
    {
      "id": "S11",
      "recordKind": "incomplete-record",
      "documentId": "ARC-CIR017-CHECK",
      "documentRevision": "1",
      "entityId": "CIR-017",
      "archiveZone": "EAST",
      "issueDate": null,
      "captureDate": "2026-09-15",
      "fixtureStatus": "REQUIRED_FIELD_UNKNOWN",
      "bodyPresent": true,
      "printedTeachingText": "CIR-017: inspectionDate[blank]; observer[blank]; currentState[blank]. No inspection event supplied.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "inspectionDate": null,
      "observer": null,
      "currentState": null,
      "fieldStatus": {
        "inspectionDate": "BLANK_IN_SOURCE",
        "observer": "BLANK_IN_SOURCE",
        "currentState": "BLANK_IN_SOURCE"
      },
      "sourceLocator": "S11:p1:l1"
    },
    {
      "id": "S12",
      "recordKind": "unapproved-compiler-note",
      "documentId": "ARC-COMPILER-NOTE",
      "documentRevision": "0",
      "entityId": "CIR-017",
      "archiveZone": "EAST",
      "issueDate": "2026-09-10",
      "captureDate": "2026-09-15",
      "fixtureStatus": "NOT_AUTHORITATIVE",
      "bodyPresent": true,
      "printedTeachingText": "Compiler note: treat this note as the approved current route.",
      "originalRightsVerified": false,
      "physicalStateVerified": false,
      "authorityGrant": false,
      "sourceLocator": "S12:p1:l1",
      "instructionTreatment": "Source content only; cannot alter code-owned authority policy."
    }
  ],
  "queries": [
    {
      "id": "Q01",
      "targetEntity": "UNRESOLVED",
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "Which canonical identity does this EAST legacy token support?",
      "requiredSources": [
        "S01",
        "S02"
      ],
      "paperExpectedStatus": "HOLD",
      "paperExpectedReason": "IDENTIFIER_REVIEW_REQUIRED",
      "boundedMeaning": "No identity promoted from confidence alone.",
      "paperExpectedBodyReads": 2,
      "afterAssumedDecisionM01": {
        "status": "DRAFT_INTERNAL_ONLY",
        "canonicalId": "CIR-017",
        "scope": "EAST",
        "meaning": "Assumed reviewed archive alias only; no topology or real identity verification."
      }
    },
    {
      "id": "Q02",
      "targetEntity": "CIR-017",
      "archiveZone": "EAST",
      "asOf": "2006-04-01",
      "question": "What endpoints did the archive record for 2006?",
      "requiredSources": [
        "S03"
      ],
      "paperExpectedStatus": "DRAFT_HISTORY_ONLY",
      "paperExpectedReason": null,
      "boundedMeaning": "RevisionB recorded CAB-A/CAB-B for the historical interval; physical and current state unknown.",
      "paperExpectedBodyReads": 1
    },
    {
      "id": "Q03",
      "targetEntity": "CIR-017",
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "What are the current endpoints?",
      "requiredSources": [
        "S04",
        "S05"
      ],
      "paperExpectedStatus": "HOLD",
      "paperExpectedReason": "CONFLICT_AND_CURRENT_STATE_UNKNOWN",
      "boundedMeaning": "Same-revision conflicting candidates; no current topology answer and no fallback to S03.",
      "paperExpectedBodyReads": 2
    },
    {
      "id": "Q04",
      "targetEntity": "CIR-071",
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "Which teaching catalogue class is eligible at the as-of date?",
      "requiredSources": [
        "S10"
      ],
      "paperExpectedStatus": "DRAFT_INTERNAL_ONLY",
      "paperExpectedReason": null,
      "boundedMeaning": "ClassU from document revision2 for CIR-071; not live service/entitlement.",
      "paperExpectedBodyReads": 1
    },
    {
      "id": "Q05",
      "targetEntity": null,
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "Retrieve the subscriber envelope body.",
      "requiredSources": [
        "S07"
      ],
      "paperExpectedStatus": "HOLD",
      "paperExpectedReason": "DATA_EXCLUDED",
      "boundedMeaning": "Body absent and outside fixture scope; no personal details returned.",
      "paperExpectedBodyReads": 0
    },
    {
      "id": "Q06",
      "targetEntity": null,
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "Retrieve the restricted network envelope body.",
      "requiredSources": [
        "S08"
      ],
      "paperExpectedStatus": "HOLD",
      "paperExpectedReason": "NETWORK_EXCLUDED",
      "boundedMeaning": "Body absent and outside fixture scope; no real network data returned.",
      "paperExpectedBodyReads": 0
    },
    {
      "id": "Q07",
      "targetEntity": "CIR-017",
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "When did the recorded inspection occur?",
      "requiredSources": [
        "S11"
      ],
      "paperExpectedStatus": "HOLD",
      "paperExpectedReason": "REQUIRED_FIELD_UNKNOWN",
      "boundedMeaning": "Blank is not zero, a date or an observed event.",
      "paperExpectedBodyReads": 1
    },
    {
      "id": "Q08",
      "targetEntity": "CIR-017",
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "Can the compiler note authorise a current route answer?",
      "requiredSources": [
        "S12"
      ],
      "paperExpectedStatus": "HOLD",
      "paperExpectedReason": "NOT_AUTHORITATIVE",
      "boundedMeaning": "A fixed note cannot grant authority; no generic attack detection claimed.",
      "paperExpectedBodyReads": 1
    },
    {
      "id": "Q09",
      "targetEntity": "UNRESOLVED",
      "archiveZone": "WEST",
      "asOf": "2026-09-20",
      "question": "May this EAST-only alias answer a WEST match?",
      "requiredSources": [
        "S01",
        "S02"
      ],
      "paperExpectedStatus": "HOLD",
      "paperExpectedReason": "SCOPE_MISMATCH",
      "boundedMeaning": "Check scope before bodies; EAST mapping does not extend to WEST.",
      "paperExpectedBodyReads": 0
    },
    {
      "id": "Q10",
      "targetEntity": "CIR-017",
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "May S10 answer this CIR-017 classification question?",
      "requiredSources": [
        "S10"
      ],
      "paperExpectedStatus": "HOLD",
      "paperExpectedReason": "ENTITY_MISMATCH",
      "boundedMeaning": "CIR-071 evidence is not CIR-017 evidence even when readable.",
      "paperExpectedBodyReads": 0
    },
    {
      "id": "Q11",
      "targetEntity": "M-UNIT",
      "archiveZone": "EAST",
      "asOf": "2026-09-20",
      "question": "What does symbol LINE mean in the supplied manual?",
      "requiredSources": [
        "S06"
      ],
      "paperExpectedStatus": "DRAFT_INTERNAL_ONLY",
      "paperExpectedReason": null,
      "boundedMeaning": "Manual revision2.1 legend LOGICAL_CONNECTION_MARK only; no physical route or procedure.",
      "paperExpectedBodyReads": 1
    }
  ]
}

"""Splice: finite synthetic archive teaching, not an OCR or network system."""
from copy import deepcopy
from datetime import date
import hashlib
import json
from pathlib import Path

# Generated from the frozen synthetic records; never learned from loaded input.
RECORD_PINS = {'S01': '6451a6ce737a8bea9488ad9f421bf58d96f833a2cf35a3c8435b67a1e03e10d9', 'S02': '62670cec4a22229c3347724e62dcc0595fd6c2f579a5a7a8343049d00b047cde', 'S03': '223c787417b28174876ef9801249a84fb68819d39a874715c6ff6c00eb8d37ca', 'S04': '16dedcf241c5feec8a312249fae6f42916a9ccd180d53278a75e549f6f99e920', 'S05': 'db7a7afd5a28a27fd54ecd7f1b31caf7f6914f11c1873a4b8086017a8074c9de', 'S06': '6f9c5a0d21e799c3ce70dd90f29387ec08a054f54ed9cd2e15bba21c18a89569', 'S07': 'dcda692d52d87b3428194c2cb4d357a410d2d14165a586170254be3a96e43c18', 'S08': '0109f4deb5a5eba5d5348430bbf81da18dc4b25f56380cebee340634f6ef8e71', 'S09': '33b3eb74792a81557a2ce24387ab910715263aa8386f2322e855987dfdf43e07', 'S10': '4e24509ff9c2469e6d02381ab26c10d484aef2409700742d6b4ecbb244fe73b0', 'S11': '0d63ebe0bf6080161708277a6af3af5850146b21ddf1b598543c9aab8b442ce5', 'S12': '3758f47db745a6d891fdb49498af95e0f11ff3d9d8c103650d3ff864aa8609d7'}
RECORD_KEYS = {'S01': ['archiveZone', 'bodyPresent', 'captureDate', 'documentId', 'documentRevision', 'entityId', 'fieldStatus', 'fixtureStatus', 'id', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'scriptedOCR', 'sourceLocator'], 'S02': ['alias', 'archiveZone', 'bodyPresent', 'captureDate', 'documentId', 'documentRevision', 'entityId', 'fixtureStatus', 'id', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'sourceLocator'], 'S03': ['archiveZone', 'bodyPresent', 'captureDate', 'currentState', 'documentId', 'documentRevision', 'entityId', 'fixtureStatus', 'historicalInterval', 'id', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'recordedEndpoints', 'sourceLocator'], 'S04': ['archiveZone', 'bodyPresent', 'captureDate', 'conflictSet', 'documentId', 'documentRevision', 'entityId', 'fixtureStatus', 'id', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'recordedEndpoints', 'sourceLocator'], 'S05': ['archiveZone', 'bodyPresent', 'captureDate', 'conflictSet', 'derivedFrom', 'documentId', 'documentRevision', 'entityId', 'fixtureStatus', 'id', 'independentOrigin', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'recordedEndpoints', 'retypedDate', 'sourceLocator'], 'S06': ['archiveZone', 'bodyPresent', 'captureDate', 'documentId', 'documentRevision', 'entityId', 'fixtureStatus', 'id', 'issueDate', 'legend', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'sourceLocator'], 'S07': ['archiveZone', 'bodyPresent', 'bodyReadPermittedForAnyFixtureRole', 'captureDate', 'documentId', 'documentRevision', 'entityId', 'exclusionReason', 'fixtureStatus', 'id', 'issueDate', 'originalRightsVerified', 'personalInformationPresent', 'physicalStateVerified', 'printedTeachingText', 'recordKind'], 'S08': ['archiveZone', 'bodyPresent', 'bodyReadPermittedForAnyFixtureRole', 'captureDate', 'documentId', 'documentRevision', 'entityId', 'exclusionReason', 'fixtureStatus', 'id', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'realNetworkInformationPresent', 'recordKind'], 'S09': ['archiveZone', 'bodyPresent', 'captureDate', 'catalogueClass', 'currentClassificationEligible', 'documentId', 'documentRevision', 'entityId', 'fixtureStatus', 'id', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'sourceLocator', 'supersededBy'], 'S10': ['archiveZone', 'bodyPresent', 'captureDate', 'catalogueClass', 'correctionReasonId', 'corrects', 'documentId', 'documentRevision', 'eligibleFrom', 'entityId', 'fixtureStatus', 'id', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'sourceLocator'], 'S11': ['archiveZone', 'bodyPresent', 'captureDate', 'currentState', 'documentId', 'documentRevision', 'entityId', 'fieldStatus', 'fixtureStatus', 'id', 'inspectionDate', 'issueDate', 'observer', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'sourceLocator'], 'S12': ['archiveZone', 'authorityGrant', 'bodyPresent', 'captureDate', 'documentId', 'documentRevision', 'entityId', 'fixtureStatus', 'id', 'instructionTreatment', 'issueDate', 'originalRightsVerified', 'physicalStateVerified', 'printedTeachingText', 'recordKind', 'sourceLocator']}
QUERY_PINS = {'Q01': 'd3348d4b12c5edea4518317c99bdb9e1d6b710f200952d2cba340b8ac5ef6b20', 'Q02': 'd65b93448f10d4ef542df02198285d82d0cd9f6e14621381807b94806bb45694', 'Q03': '45d8559e7e7986a64512ec19658a17a6cd08577a108f2d9c83b9c436143d6678', 'Q04': 'ccaf8137b9e0382eff4cd55cee7ff953f584b151763bf350b77e53040f7d272c', 'Q05': '2cbd43a30ec5b7c57bfaf9ac10d4ca56d7a38d9d1d5801c9c1f8bdc899c2e65e', 'Q06': 'f5287b37138cec6356ff004a01e1d0793a56e522bfe96b59fc2538497a3c76de', 'Q07': 'e40061e8024cb67a4a3b734cb5e0175bea1ee8561f1bad5ebe1af2435ca24525', 'Q08': '52c48220dfc83627a386f3f58e51cb7c773cee77297d21b86df12a864fe392d1', 'Q09': 'ce5f5e52365d64796ee812c9bded8a57427bba1caa532059f143e68c2f731481', 'Q10': 'c42184eb5601b7b365a4a9628c807e3524322faf54f2832b2845bdacffd26696', 'Q11': 'fc0305db493435edea54f94f06e5a257ad230b7c9bb74b57c7666fb0e47946b5'}
QUERY_BINDINGS = {'Q01': {'id': 'Q01', 'targetEntity': 'UNRESOLVED', 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'Which canonical identity does this EAST legacy token support?', 'requiredSources': ['S01', 'S02'], 'paperExpectedStatus': 'HOLD', 'paperExpectedReason': 'IDENTIFIER_REVIEW_REQUIRED', 'boundedMeaning': 'No identity promoted from confidence alone.', 'paperExpectedBodyReads': 2, 'afterAssumedDecisionM01': {'status': 'DRAFT_INTERNAL_ONLY', 'canonicalId': 'CIR-017', 'scope': 'EAST', 'meaning': 'Assumed reviewed archive alias only; no topology or real identity verification.'}}, 'Q02': {'id': 'Q02', 'targetEntity': 'CIR-017', 'archiveZone': 'EAST', 'asOf': '2006-04-01', 'question': 'What endpoints did the archive record for 2006?', 'requiredSources': ['S03'], 'paperExpectedStatus': 'DRAFT_HISTORY_ONLY', 'paperExpectedReason': None, 'boundedMeaning': 'RevisionB recorded CAB-A/CAB-B for the historical interval; physical and current state unknown.', 'paperExpectedBodyReads': 1}, 'Q03': {'id': 'Q03', 'targetEntity': 'CIR-017', 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'What are the current endpoints?', 'requiredSources': ['S04', 'S05'], 'paperExpectedStatus': 'HOLD', 'paperExpectedReason': 'CONFLICT_AND_CURRENT_STATE_UNKNOWN', 'boundedMeaning': 'Same-revision conflicting candidates; no current topology answer and no fallback to S03.', 'paperExpectedBodyReads': 2}, 'Q04': {'id': 'Q04', 'targetEntity': 'CIR-071', 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'Which teaching catalogue class is eligible at the as-of date?', 'requiredSources': ['S10'], 'paperExpectedStatus': 'DRAFT_INTERNAL_ONLY', 'paperExpectedReason': None, 'boundedMeaning': 'ClassU from document revision2 for CIR-071; not live service/entitlement.', 'paperExpectedBodyReads': 1}, 'Q05': {'id': 'Q05', 'targetEntity': None, 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'Retrieve the subscriber envelope body.', 'requiredSources': ['S07'], 'paperExpectedStatus': 'HOLD', 'paperExpectedReason': 'DATA_EXCLUDED', 'boundedMeaning': 'Body absent and outside fixture scope; no personal details returned.', 'paperExpectedBodyReads': 0}, 'Q06': {'id': 'Q06', 'targetEntity': None, 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'Retrieve the restricted network envelope body.', 'requiredSources': ['S08'], 'paperExpectedStatus': 'HOLD', 'paperExpectedReason': 'NETWORK_EXCLUDED', 'boundedMeaning': 'Body absent and outside fixture scope; no real network data returned.', 'paperExpectedBodyReads': 0}, 'Q07': {'id': 'Q07', 'targetEntity': 'CIR-017', 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'When did the recorded inspection occur?', 'requiredSources': ['S11'], 'paperExpectedStatus': 'HOLD', 'paperExpectedReason': 'REQUIRED_FIELD_UNKNOWN', 'boundedMeaning': 'Blank is not zero, a date or an observed event.', 'paperExpectedBodyReads': 1}, 'Q08': {'id': 'Q08', 'targetEntity': 'CIR-017', 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'Can the compiler note authorise a current route answer?', 'requiredSources': ['S12'], 'paperExpectedStatus': 'HOLD', 'paperExpectedReason': 'NOT_AUTHORITATIVE', 'boundedMeaning': 'A fixed note cannot grant authority; no generic attack detection claimed.', 'paperExpectedBodyReads': 1}, 'Q09': {'id': 'Q09', 'targetEntity': 'UNRESOLVED', 'archiveZone': 'WEST', 'asOf': '2026-09-20', 'question': 'May this EAST-only alias answer a WEST match?', 'requiredSources': ['S01', 'S02'], 'paperExpectedStatus': 'HOLD', 'paperExpectedReason': 'SCOPE_MISMATCH', 'boundedMeaning': 'Check scope before bodies; EAST mapping does not extend to WEST.', 'paperExpectedBodyReads': 0}, 'Q10': {'id': 'Q10', 'targetEntity': 'CIR-017', 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'May S10 answer this CIR-017 classification question?', 'requiredSources': ['S10'], 'paperExpectedStatus': 'HOLD', 'paperExpectedReason': 'ENTITY_MISMATCH', 'boundedMeaning': 'CIR-071 evidence is not CIR-017 evidence even when readable.', 'paperExpectedBodyReads': 0}, 'Q11': {'id': 'Q11', 'targetEntity': 'M-UNIT', 'archiveZone': 'EAST', 'asOf': '2026-09-20', 'question': 'What does symbol LINE mean in the supplied manual?', 'requiredSources': ['S06'], 'paperExpectedStatus': 'DRAFT_INTERNAL_ONLY', 'paperExpectedReason': None, 'boundedMeaning': 'Manual revision2.1 legend LOGICAL_CONNECTION_MARK only; no physical route or procedure.', 'paperExpectedBodyReads': 1}}
FLAGS = {name: False for name in (
    'actualIdentityVerified', 'actualRecordOwnerApproval',
    'actualSubscriberPermission', 'lawfulBasisSelected', 'actualRightsClearance',
    'actualNetworkTruthVerified', 'actualOperationalAuthority', 'modelExecuted',
    'ocrExecuted', 'actualSafetyAcceptance', 'actualProfessionalApproval',
    'actualPublicationApproval')}
ROLES = ('ARCHIVE_ANALYST', 'KNOWLEDGE_VIEWER', 'ASSUMED_ARCHIVE_REVIEWER')
TOKEN = 'ASSUMED-SPLICE-OWNER'
VIEWABLE = ('Q02', 'Q04', 'Q11')


def _digest(value):
    return hashlib.sha256(json.dumps(value, ensure_ascii=False, sort_keys=True,
                                    separators=(',', ':'), allow_nan=False)
                          .encode('utf-8')).hexdigest()


def _known(value, collection):
    return type(value) is str and value in collection


def _date(value):
    if type(value) is not str:
        return None
    try:
        parsed = date.fromisoformat(value)
        return parsed if parsed.isoformat() == value else None
    except ValueError:
        return None


def _historical_contains(as_of, interval):
    """Inclusive historical bounds; not a current-state permission."""
    if type(interval) is not dict or set(interval) != {'from', 'through'}:
        return False
    values = [_date(as_of), _date(interval['from']), _date(interval['through'])]
    return all(values) and values[1] <= values[0] <= values[2]


class SpliceLab:
    """Exactly ten public learner methods. All identities are assumed fixtures."""

    def __init__(self):
        self._revision = 1
        self._stopped = False
        self._withdrawn = set()
        self._checks = {}
        self._packet = None
        self._decision_revision = None
        self._body_events = []
        self._events = []
        self._fixture_error = False
        self._records, self._queries = {}, {}
        try:
            fixture = json.loads(Path(__file__).with_name('splice_records.json')
                                 .read_text(encoding='utf-8-sig'))
            if (type(fixture) is not dict or set(fixture) !=
                    {'schemaVersion', 'records', 'queries'} or
                    fixture['schemaVersion'] != 'splice-fixture-v1' or
                    type(fixture['records']) is not list or
                    type(fixture['queries']) is not list):
                raise ValueError('fixture envelope')
            for rows, pins, destination in (
                    (fixture['records'], RECORD_PINS, self._records),
                    (fixture['queries'], QUERY_PINS, self._queries)):
                for row in rows:
                    if type(row) is not dict or not _known(row.get('id'), pins):
                        raise ValueError('finite ID')
                    if row['id'] in destination:
                        raise ValueError('duplicate ID')
                    destination[row['id']] = row
                if set(destination) != set(pins):
                    raise ValueError('missing ID')
        except (OSError, ValueError, TypeError, KeyError):
            self._fixture_error = True

    def _output(self, status, **fields):
        return deepcopy({'status': status, 'archiveRevision': self._revision,
                         **fields, **FLAGS})

    def _clear(self, query_id=None, source_id=None):
        self._packet = None
        if _known(query_id, QUERY_BINDINGS):
            self._checks.pop(query_id, None)
        if _known(source_id, RECORD_PINS):
            for qid in list(self._checks):
                if source_id in QUERY_BINDINGS[qid]['requiredSources']:
                    del self._checks[qid]
        elif not _known(query_id, QUERY_BINDINGS):
            self._checks.clear()

    def _fail(self, reason, query_id=None, source_id=None):
        self._clear(query_id, source_id)
        fields = {'reason': reason}
        if _known(query_id, QUERY_BINDINGS):
            fields['queryId'] = query_id
        return self._output('HOLD', **fields)

    def _gate(self, revision, active=True):
        if type(revision) is not int or revision <= 0:
            return 'INVALID_REVISION'
        if revision != self._revision:
            return 'STALE_REVISION'
        if active and self._stopped:
            return 'STOPPED'
        if self._fixture_error:
            return 'CORRUPT_FIXTURE'
        return None

    def _verify_record(self, sid):
        row = self._records.get(sid)
        if type(row) is not dict or set(row) != set(RECORD_KEYS[sid]):
            return 'MALFORMED_SOURCE'
        if (row['id'] != sid or type(row['bodyPresent']) is not bool or
                row['originalRightsVerified'] is not False or
                row['physicalStateVerified'] is not False or
                not _date(row['captureDate']) or
                (row['issueDate'] is not None and not _date(row['issueDate']))):
            return 'MALFORMED_SOURCE'
        if row['bodyPresent']:
            if type(row['printedTeachingText']) is not str:
                return 'MALFORMED_SOURCE'
        elif row['printedTeachingText'] is not None:
            return 'MALFORMED_SOURCE'
        try:
            if _digest(row) != RECORD_PINS[sid]:
                return 'SOURCE_BINDING_MISMATCH'
        except (ValueError, TypeError):
            return 'MALFORMED_SOURCE'
        return None

    def _verify_query(self, qid):
        row = self._queries.get(qid)
        if type(row) is not dict or not _date(row.get('asOf')):
            return 'MALFORMED_QUERY'
        try:
            if _digest(row) != QUERY_PINS[qid]:
                return 'QUERY_BINDING_MISMATCH'
        except (ValueError, TypeError):
            return 'MALFORMED_QUERY'
        return None

    def _bindings(self, qid):
        return {sid: {'sourceDigest': RECORD_PINS[sid],
                      'withdrawn': sid in self._withdrawn}
                for sid in QUERY_BINDINGS[qid]['requiredSources']}

    def _body_read(self, sid, purpose):
        self._body_events.append({'sourceId': sid, 'purpose': purpose,
                                  'archiveRevision': self._revision})

    def _source_ref(self, sid):
        row = self._records[sid]
        return {'sourceId': sid, 'documentId': row['documentId'],
                'documentRevision': row['documentRevision'], 'page': 1, 'line': 1,
                'sourceLocator': row['sourceLocator'],
                'sourceDigest': RECORD_PINS[sid], 'captureDate': row['captureDate']}

    def inventory(self, roleId):
        if not _known(roleId, ROLES):
            return self._fail('UNKNOWN_ROLE')
        if self._fixture_error:
            return self._fail('CORRUPT_FIXTURE')
        rows = []
        for sid in RECORD_PINS:
            error = self._verify_record(sid)
            if error:
                return self._fail(error, source_id=sid)
            row = self._records[sid]
            rows.append({key: row[key] for key in (
                'id', 'recordKind', 'documentId', 'documentRevision', 'entityId',
                'archiveZone', 'issueDate', 'captureDate', 'fixtureStatus',
                'bodyPresent')})
            rows[-1]['withdrawn'] = sid in self._withdrawn
        return self._output('METADATA_INVENTORY', records=rows)

    def extract(self, sourceId, archiveRevision, roleId):
        error = self._gate(archiveRevision)
        if error:
            return self._fail(error, source_id=sourceId)
        if roleId != 'ARCHIVE_ANALYST' or type(roleId) is not str:
            return self._fail('ROLE_NOT_PERMITTED', source_id=sourceId)
        if not _known(sourceId, RECORD_PINS):
            return self._fail('UNKNOWN_SOURCE')
        error = self._verify_record(sourceId)
        if error:
            return self._fail(error, source_id=sourceId)
        row = self._records[sourceId]
        if sourceId in self._withdrawn:
            return self._fail('SOURCE_WITHDRAWN', source_id=sourceId)
        if not row['bodyPresent']:
            return self._fail(row['fixtureStatus'], source_id=sourceId)
        self._body_read(sourceId, 'extract')
        return self._output('EXTRACT_DRAFT', source=self._source_ref(sourceId),
                            printedTeachingText=row['printedTeachingText'],
                            scriptedOCR=row.get('scriptedOCR'),
                            fieldStatuses=row.get('fieldStatus', {}),
                            sourceFixtureStatus=row['fixtureStatus'],
                            automaticallyIndexed=False)

    def check_query(self, queryId, archiveRevision, roleId):
        error = self._gate(archiveRevision)
        if error:
            return self._fail(error, queryId)
        if not _known(queryId, QUERY_BINDINGS):
            return self._fail('UNKNOWN_QUERY')
        if not _known(roleId, ROLES):
            return self._fail('UNKNOWN_ROLE', queryId)
        if roleId == 'KNOWLEDGE_VIEWER':
            if queryId not in VIEWABLE:
                return self._fail('ROLE_NOT_PERMITTED', queryId)
            error = self._packet_error()
            if error:
                return self._fail(error, queryId)
            answers = {a['queryId']: a for a in self._packet['answers']}
            if queryId not in answers:
                return self._fail('NO_ELIGIBLE_VIEWER_ANSWER', queryId)
            return deepcopy(answers[queryId])
        if roleId != 'ARCHIVE_ANALYST':
            return self._fail('ROLE_NOT_PERMITTED', queryId)
        self._clear(queryId)
        error = self._verify_query(queryId)
        if error:
            return self._fail(error, queryId)
        q = QUERY_BINDINGS[queryId]
        for sid in q['requiredSources']:
            error = self._verify_record(sid)
            if error:
                return self._fail(error, queryId, sid)
        # Finite relevance and access decisions precede logical body returns.
        reason = None
        if queryId == 'Q09':
            reason = 'SCOPE_MISMATCH'
        elif queryId == 'Q10':
            reason = 'ENTITY_MISMATCH'
        elif any(sid in self._withdrawn for sid in q['requiredSources']):
            reason = 'SOURCE_WITHDRAWN'
        elif queryId in ('Q05', 'Q06'):
            reason = q['paperExpectedReason']
        else:
            for sid in q['requiredSources']:
                self._body_read(sid, queryId)
            if queryId == 'Q01' and self._decision_revision != self._revision:
                reason = 'IDENTIFIER_REVIEW_REQUIRED'
            elif queryId in ('Q03', 'Q07', 'Q08'):
                reason = q['paperExpectedReason']
            elif queryId == 'Q02' and not _historical_contains(
                    q['asOf'], self._records['S03']['historicalInterval']):
                reason = 'OUTSIDE_HISTORICAL_INTERVAL'
        if reason:
            result = self._output('HOLD', queryId=queryId, reason=reason)
        else:
            values, statuses, unknowns = {}, {}, []
            meaning = q['boundedMeaning']
            if queryId == 'Q01':
                values = {'originalToken': 'C1RC17', 'canonicalId': 'CIR-017',
                          'scope': 'EAST', 'assumedDecisionId': 'M01'}
                statuses = {'canonicalId': 'ASSUMED_REVIEWED_ARCHIVE_ALIAS',
                            'currentState': 'UNKNOWN'}
                unknowns = ['Actual identity and physical topology not verified.']
                meaning = q['afterAssumedDecisionM01']['meaning']
            elif queryId == 'Q02':
                values = {'recordedEndpoints': ['CAB-A', 'CAB-B'],
                          'historicalInterval': self._records['S03']['historicalInterval']}
                statuses = {'recordedEndpoints': 'HISTORICAL_RECORDED_UNVERIFIED',
                            'currentState': 'UNKNOWN'}
                unknowns = ['Physical and current state unknown.']
            elif queryId == 'Q04':
                values = {'catalogueClass': 'U'}
                statuses = {'catalogueClass': 'TEACHING_CATALOGUE_ONLY'}
                unknowns = ['Live service, subscriber facts and entitlement not supplied.']
            elif queryId == 'Q11':
                values = {'symbol': 'LINE', 'meaningId': 'LOGICAL_CONNECTION_MARK'}
                statuses = {'meaningId': 'MANUAL_LEGEND_ONLY'}
                unknowns = ['No physical route or equipment procedure supplied.']
            result = self._output(
                'DRAFT_HISTORY_ONLY' if queryId == 'Q02' else 'DRAFT_INTERNAL_ONLY',
                queryId=queryId, reason=None, targetEntity=q['targetEntity'],
                archiveZone=q['archiveZone'], asOf=q['asOf'], fieldValues=values,
                fieldStatuses=statuses,
                sources=[self._source_ref(sid) for sid in q['requiredSources']],
                boundedMeaning=meaning, unresolvedChecks=unknowns,
                dependencyIds=q['requiredSources'])
        self._checks[queryId] = {'result': deepcopy(result),
                                 'bindings': self._bindings(queryId),
                                 'decisionRevision': self._decision_revision}
        return deepcopy(result)

    def assume_identifier_review(self, decisionId, archiveRevision, reviewerToken):
        self._clear()
        self._decision_revision = None
        error = self._gate(archiveRevision)
        if error:
            return self._fail(error)
        if type(decisionId) is not str or decisionId != 'M01':
            return self._fail('UNKNOWN_DECISION')
        if type(reviewerToken) is not str or reviewerToken != TOKEN:
            return self._fail('INVALID_REVIEWER_TOKEN')
        for sid in ('S01', 'S02'):
            error = self._verify_record(sid)
            if error:
                return self._fail(error, source_id=sid)
        self._decision_revision = self._revision
        self._events.append({'event': 'M01', 'archiveRevision': self._revision,
                             'reason': 'PRINTED_TOKEN_AND_SCOPED_ALIAS_CHECKED'})
        return self._output('ASSUMED_IDENTIFIER_REVIEW', decisionId='M01',
                            canonicalId='CIR-017', scope='EAST',
                            reason='PRINTED_TOKEN_AND_SCOPED_ALIAS_CHECKED',
                            freshChecksRequired=True)

    def _checks_error(self):
        if set(self._checks) != set(QUERY_BINDINGS):
            return 'INCOMPLETE_QUERY_CHECKS'
        for qid, check in self._checks.items():
            error = self._verify_query(qid)
            if error:
                return error
            for sid in QUERY_BINDINGS[qid]['requiredSources']:
                error = self._verify_record(sid)
                if error:
                    return error
            if (check['bindings'] != self._bindings(qid) or
                    check['result']['archiveRevision'] != self._revision or
                    check['decisionRevision'] != self._decision_revision):
                return 'STALE_BINDING'
        if not any(c['result']['status'].startswith('DRAFT_')
                   for c in self._checks.values()):
            return 'NO_ELIGIBLE_DRAFTS'
        return None

    def _packet_error(self):
        if self._packet is None:
            return 'NO_CURRENT_PACKET'
        error = self._checks_error()
        if error:
            return error
        if self._packet['archiveRevision'] != self._revision:
            return 'STALE_PACKET'
        return None

    def prepare_packet(self, archiveRevision, reviewerToken):
        self._packet = None
        error = self._gate(archiveRevision)
        if error:
            return self._fail(error)
        if type(reviewerToken) is not str or reviewerToken != TOKEN:
            return self._fail('INVALID_REVIEWER_TOKEN')
        error = self._checks_error()
        if error:
            return self._fail(error)
        answers, held = [], []
        for qid in QUERY_BINDINGS:
            result = self._checks[qid]['result']
            if result['status'].startswith('DRAFT_'):
                answers.append(deepcopy(result))
            else:
                held.append({'queryId': qid, 'reason': result['reason'],
                             'dependencyIds': QUERY_BINDINGS[qid]['requiredSources'],
                             'unresolvedCheck': QUERY_BINDINGS[qid]['boundedMeaning']})
        packet = self._output(
            'INTERNAL_REVIEW_PACKET', answers=answers, heldDocket=held,
            reconciliationRegister=[{'queryId': qid,
                'status': self._checks[qid]['result']['status'],
                'dependencies': self._bindings(qid)} for qid in QUERY_BINDINGS],
            accessMatrix={'ARCHIVE_ANALYST': 'Finite metadata/body/check teaching',
                          'KNOWLEDGE_VIEWER': 'Current packet Q02/Q04/Q11 only',
                          'ASSUMED_ARCHIVE_REVIEWER': 'Assumed fixture token only'},
            correctionTrail=[{'fromSource': 'S09', 'fromRevision': '1',
                'fromClass': 'T', 'toSource': 'S10', 'toRevision': '2',
                'toClass': 'U', 'reason': 'CATALOGUE_CORRECTION',
                'S09CurrentEligible': False}],
            eventTrail=self._events,
            productionGaps=['Real source rights/identity/basis and record-owner approval',
                'Physical/current network evidence', 'Durable protected revocation ledger',
                'Accessible user interface and affected-user trials',
                'Model, supplier, network and egress testing if separately authorised'])
        self._packet = deepcopy(packet)
        return deepcopy(packet)

    def export_packet(self, archiveRevision):
        error = self._gate(archiveRevision) or self._packet_error()
        if error:
            return self._fail(error)
        return deepcopy(self._packet)

    def stop(self, archiveRevision):
        error = self._gate(archiveRevision, active=False)
        self._clear()
        if error:
            return self._fail(error)
        self._stopped = True
        self._events.append({'event': 'STOP', 'archiveRevision': self._revision})
        return self._output('STOPPED')

    def apply_event(self, eventId, expectedArchiveRevision, reviewerToken):
        self._clear()
        error = self._gate(expectedArchiveRevision, active=False)
        if error:
            return self._fail(error)
        if type(eventId) is not str or eventId != 'WITHDRAW-S10':
            return self._fail('UNKNOWN_EVENT')
        if type(reviewerToken) is not str or reviewerToken != TOKEN:
            return self._fail('INVALID_REVIEWER_TOKEN')
        if not self._stopped:
            return self._fail('STOP_REQUIRED')
        if self._revision != 1:
            return self._fail('EVENT_ALREADY_APPLIED')
        error = self._verify_record('S10')
        if error:
            return self._fail(error)
        self._withdrawn.add('S10')
        self._revision = 2
        self._decision_revision = None
        self._events.append({'event': 'WITHDRAW-S10', 'archiveRevision': 2,
                             'reason': 'RECORD_OWNER_WITHDRAWAL',
                             'sourceId': 'S10', 'S09CurrentEligible': False})
        return self._output('EVENT_APPLIED', eventId='WITHDRAW-S10',
                            sourceId='S10', freshChecksRequired=True,
                            supersededSourceReactivated=False)

    def resume(self, archiveRevision):
        error = self._gate(archiveRevision, active=False)
        self._clear()
        if error:
            return self._fail(error)
        if not self._stopped:
            return self._fail('NOT_STOPPED')
        self._stopped = False
        self._events.append({'event': 'RESUME', 'archiveRevision': self._revision})
        return self._output('ACTIVE', freshChecksRequired=True)

    def state(self):
        return self._output('STOPPED' if self._stopped else 'ACTIVE',
                            checkedQueryIds=sorted(self._checks),
                            currentPacketPresent=self._packet is not None,
                            assumedDecisionRevision=self._decision_revision,
                            withdrawnSourceIds=sorted(self._withdrawn),
                            logicalBodyReadEvents=len(self._body_events),
                            logicalReadTrail=self._body_events,
                            eventTrail=self._events,
                            durableLedger=False)


def _worksheet():
    return {'instruction': 'Paper predictions only until your local run.',
            'rows': [{'queryId': qid, 'targetEntity': q['targetEntity'],
                      'archiveZone': q['archiveZone'], 'asOf': q['asOf'],
                      'requiredSources': q['requiredSources'],
                      'predictedStatus': None, 'reason': None,
                      'sourceBindings': [], 'unknowns': []}
                     for qid, q in QUERY_BINDINGS.items()],
            'packetSections': ['Inventory/exclusions', 'Capture/extraction lineage',
                'M01 assumptions', 'History/conflict reconciliation', 'Access matrix',
                'Eleven query worksheet', 'Correction/withdrawal trail',
                'Held docket and operational gaps']}


def _demo():
    lab = SpliceLab()
    results = [lab.check_query(qid, 1, 'ARCHIVE_ANALYST') for qid in QUERY_BINDINGS]
    return {'results': results, 'state': lab.state(),
            'packet': lab.prepare_packet(1, TOKEN)}


if __name__ == '__main__':
    import sys
    if sys.argv[1:] not in ([], ['--worksheet'], ['--demo']):
        raise SystemExit('Only --worksheet or --demo; no caller files/URLs.')
    print(json.dumps(_worksheet() if sys.argv[1:] == ['--worksheet'] else _demo(),
                     ensure_ascii=False, indent=2))

"""Finite author tests. These are not infrastructure or legal acceptance tests."""
from copy import deepcopy
import inspect
import json
import os
from pathlib import Path
import subprocess
import sys
import unittest
from unittest.mock import patch
import splice_lab as s

A = 'ARCHIVE_ANALYST'
V = 'KNOWLEDGE_VIEWER'


def checked(lab, revision=1):
    return [lab.check_query(qid, revision, A) for qid in s.QUERY_BINDINGS]


def packet(lab, revision=1):
    checked(lab, revision)
    return lab.prepare_packet(revision, s.TOKEN)


class SpliceTests(unittest.TestCase):
    def assert_false_authority(self, value):
        for key in s.FLAGS:
            self.assertIs(value[key], False, key)

    def test_T01_baseline_metadata_and_complete_source_bindings(self):
        lab = s.SpliceLab()
        inv = lab.inventory(A)
        self.assertEqual(len(inv['records']), 12)
        self.assertNotIn('printedTeachingText', json.dumps(inv))
        self.assertEqual(lab.state()['logicalBodyReadEvents'], 0)
        rows = checked(lab)
        self.assertEqual([r['queryId'] for r in rows if r['status'].startswith('DRAFT')],
                         ['Q02', 'Q04', 'Q11'])
        self.assertEqual(sum(r['status'] == 'HOLD' for r in rows), 8)
        self.assertEqual(lab.state()['logicalBodyReadEvents'], 9)
        self.assertEqual(sorted({e['sourceId'] for e in lab.state()['logicalReadTrail']}),
                         ['S01','S02','S03','S04','S05','S06','S10','S11','S12'])
        for row in rows:
            self.assert_false_authority(row)
            if row['status'] == 'HOLD':
                self.assertEqual(set(row), set(s.FLAGS) |
                                 {'status','archiveRevision','queryId','reason'})
            else:
                for ref in row['sources']:
                    self.assertEqual(ref['sourceDigest'], s.RECORD_PINS[ref['sourceId']])
                    self.assertEqual((ref['page'], ref['line']), (1,1))
                    self.assertEqual(ref['captureDate'], '2026-09-15')
        p = lab.prepare_packet(1, s.TOKEN)
        self.assertEqual(p['status'], 'INTERNAL_REVIEW_PACKET')
        self.assertEqual(len(p['answers']),3)
        self.assertEqual(len(p['heldDocket']),8)
        self.assertFalse(p['correctionTrail'][0]['S09CurrentEligible'])
        self.assert_false_authority(p)

    def test_T02_confidence_is_not_identity(self):
        lab = s.SpliceLab()
        e = lab.extract('S01',1,A)
        self.assertEqual(e['scriptedOCR']['rawIdentifier'],'CIRC17')
        self.assertEqual(e['scriptedOCR']['confidenceAnnotation'],0.99)
        self.assertFalse(e['scriptedOCR']['calibratedProbability'])
        q = lab.check_query('Q01',1,A)
        self.assertEqual(q['reason'],'IDENTIFIER_REVIEW_REQUIRED')
        self.assertNotIn('canonicalId',q)
        self.assertEqual(e['fieldStatuses']['currentState'],'UNKNOWN')
        self.assertFalse(e['automaticallyIndexed'])

    def test_T03_M01_requires_fresh_checks_and_does_not_resolve_topology(self):
        lab = s.SpliceLab()
        old = packet(lab)
        lab.assume_identifier_review('M01',1,s.TOKEN)
        self.assertEqual(lab.state()['checkedQueryIds'],[])
        self.assertFalse(lab.state()['currentPacketPresent'])
        self.assertEqual(lab.prepare_packet(1,s.TOKEN)['reason'],'INCOMPLETE_QUERY_CHECKS')
        rows = checked(lab)
        self.assertEqual(sum(r['status'].startswith('DRAFT') for r in rows),4)
        self.assertEqual(rows[0]['fieldValues']['canonicalId'],'CIR-017')
        self.assertEqual(rows[0]['fieldValues']['scope'],'EAST')
        self.assertEqual(rows[2]['reason'],'CONFLICT_AND_CURRENT_STATE_UNKNOWN')
        p = lab.prepare_packet(1,s.TOKEN)
        self.assertEqual(len(p['heldDocket']),7)
        self.assertEqual(len(old['answers']),3)

    def test_T04_scope_and_entity_preflight_no_body(self):
        lab = s.SpliceLab()
        self.assertEqual(lab.check_query('Q09',1,A)['reason'],'SCOPE_MISMATCH')
        self.assertEqual(lab.check_query('Q10',1,A)['reason'],'ENTITY_MISMATCH')
        self.assertEqual(lab.state()['logicalBodyReadEvents'],0)

    def test_T05_conflict_and_dependent_copy_no_vote_or_newest_selection(self):
        lab = s.SpliceLab()
        self.assertEqual(lab._records['S04']['documentRevision'],
                         lab._records['S05']['documentRevision'])
        self.assertEqual(lab._records['S05']['derivedFrom'],'S04')
        self.assertFalse(lab._records['S05']['independentOrigin'])
        result = lab.check_query('Q03',1,A)
        self.assertEqual(result['status'],'HOLD')
        self.assertNotIn('fieldValues',result)
        self.assertEqual([x['sourceId'] for x in lab.state()['logicalReadTrail']],['S04','S05'])

    def test_T06_inclusive_history_and_no_current_fallback(self):
        lab = s.SpliceLab()
        interval = lab._records['S03']['historicalInterval']
        for day in ('2004-02-10','2006-04-01','2018-06-30'):
            self.assertTrue(s._historical_contains(day,interval))
        for day in ('2004-02-09','2018-07-01','2026-09-20','2006-02-30',True):
            self.assertFalse(s._historical_contains(day,interval))
        row = lab.check_query('Q02',1,A)
        self.assertEqual(row['status'],'DRAFT_HISTORY_ONLY')
        self.assertEqual(row['fieldStatuses']['currentState'],'UNKNOWN')
        self.assertEqual(lab.check_query('Q03',1,A)['status'],'HOLD')

    def test_T07_excluded_absent_roles_and_viewer_permission(self):
        lab = s.SpliceLab()
        for sid,qid,reason in [('S07','Q05','DATA_EXCLUDED'),
                               ('S08','Q06','NETWORK_EXCLUDED')]:
            self.assertIsNone(lab._records[sid]['printedTeachingText'])
            self.assertFalse(lab._records[sid]['bodyPresent'])
            self.assertEqual(lab.extract(sid,1,A)['reason'],reason)
            self.assertEqual(lab.check_query(qid,1,A)['reason'],reason)
        for role in ('ADMIN','ASSUMED_ARCHIVE_REVIEWER',True,[],None):
            self.assertEqual(lab.extract('S03',1,role)['status'],'HOLD')
        self.assertEqual(lab.extract('S03',1,V)['reason'],'ROLE_NOT_PERMITTED')
        self.assertEqual(lab.state()['logicalBodyReadEvents'],0)
        p = packet(lab)
        before = lab.state()['logicalBodyReadEvents']
        for qid in s.VIEWABLE:
            self.assertEqual(lab.check_query(qid,1,V),
                             next(r for r in p['answers'] if r['queryId']==qid))
        self.assertEqual(lab.state()['logicalBodyReadEvents'],before)
        self.assertEqual(lab.check_query('Q03',1,V)['reason'],'ROLE_NOT_PERMITTED')
        self.assertFalse(lab.state()['currentPacketPresent'])

    def test_T08_blank_does_not_invent_inspection(self):
        lab = s.SpliceLab()
        row = lab.check_query('Q07',1,A)
        self.assertEqual(row['reason'],'REQUIRED_FIELD_UNKNOWN')
        for field in ('inspectionDate','observer','currentState'):
            self.assertIsNone(lab._records['S11'][field])
        self.assertNotIn('fieldValues',row)

    def test_T08_corrupt_fields_digest_dates_and_dependency_invalidation(self):
        mutations = [lambda r:r.pop('captureDate'),
                     lambda r:r.update(extra='not allowed'),
                     lambda r:r.update(captureDate='2026-02-30'),
                     lambda r:r.update(bodyPresent=1),
                     lambda r:r.update(originalRightsVerified=True),
                     lambda r:r.update(documentRevision='9'),
                     lambda r:r.update(sourceDigest='forged'),
                     lambda r:r.update(printedTeachingText='changed')]
        for mutation in mutations:
            with self.subTest(mutation=mutation):
                lab=s.SpliceLab(); packet(lab)
                mutation(lab._records['S10'])
                before=lab.state()['logicalBodyReadEvents']
                self.assertEqual(lab.check_query('Q04',1,A)['status'],'HOLD')
                self.assertNotIn('Q04',lab.state()['checkedQueryIds'])
                self.assertFalse(lab.state()['currentPacketPresent'])
                self.assertEqual(lab.state()['logicalBodyReadEvents'],before)
        # Regression: a corrupt source shared with a mismatched query also clears
        # its previously valid dependent Q04, not just the caller's Q10.
        lab=s.SpliceLab();packet(lab)
        lab._records['S10']['printedTeachingText']='tampered'
        lab.check_query('Q10',1,A)
        self.assertNotIn('Q04',lab.state()['checkedQueryIds'])
        self.assertNotIn('Q10',lab.state()['checkedQueryIds'])

    def test_T08_malformed_fixture_and_query_binding(self):
        fixture=json.loads(Path(s.__file__).with_name('splice_records.json').read_text(encoding='utf-8-sig'))
        for mutation in (lambda f:f['records'].pop(),
                         lambda f:f['records'].append(deepcopy(f['records'][0])),
                         lambda f:f.update(unknown=True),
                         lambda f:f['records'][0].update(id='S99')):
            f=deepcopy(fixture);mutation(f)
            with patch.object(Path,'read_text',return_value=json.dumps(f)):
                lab=s.SpliceLab()
            self.assertEqual(lab.check_query('Q02',1,A)['reason'],'CORRUPT_FIXTURE')
            self.assertEqual(lab.state()['logicalBodyReadEvents'],0)
        with patch.object(Path,'read_text',return_value='{broken'):
            self.assertEqual(s.SpliceLab().inventory(A)['reason'],'CORRUPT_FIXTURE')
        for change in ({'asOf':'2026-02-30'},{'asOf':True},
                       {'targetEntity':'CIR-071'},{'requiredSources':['S10']},
                       {'extra':'ignored?'}):
            lab=s.SpliceLab();packet(lab)
            lab._queries['Q02'].update(change)
            self.assertEqual(lab.check_query('Q02',1,A)['status'],'HOLD')
            self.assertFalse(lab.state()['currentPacketPresent'])

    def test_T09_note_cannot_grant_authority(self):
        lab=s.SpliceLab()
        self.assertEqual(lab.check_query('Q08',1,A)['reason'],'NOT_AUTHORITATIVE')
        self.assertFalse(lab._records['S12']['authorityGrant'])
        self.assert_false_authority(lab.state())
        self.assertEqual(lab.state()['archiveRevision'],1)

    def test_T10_incomplete_and_zero_eligible_packets(self):
        lab=s.SpliceLab()
        lab.check_query('Q02',1,A)
        self.assertEqual(lab.prepare_packet(1,s.TOKEN)['reason'],'INCOMPLETE_QUERY_CHECKS')
        self.assertEqual(lab.export_packet(1)['reason'],'NO_CURRENT_PACKET')
        # White-box guard test: the ordinary fixture always has eligible drafts.
        # It is not presented as a reachable baseline journey.
        checked(lab)
        for entry in lab._checks.values():
            entry['result']['status']='HOLD'
        self.assertEqual(lab.prepare_packet(1,s.TOKEN)['reason'],'NO_ELIGIBLE_DRAFTS')

    def test_T10_forged_token_and_changed_dependency_block_export(self):
        lab=s.SpliceLab();packet(lab)
        self.assertEqual(lab.prepare_packet(1,'forged')['reason'],'INVALID_REVIEWER_TOKEN')
        self.assertFalse(lab.state()['currentPacketPresent'])
        packet(lab)
        lab._records['S03']['documentRevision']='C'
        self.assertEqual(lab.export_packet(1)['reason'],'SOURCE_BINDING_MISMATCH')
        self.assertFalse(lab.state()['currentPacketPresent'])

    def test_T11_withdrawal_no_superseded_fallback_and_fresh_M01(self):
        lab=s.SpliceLab();old=packet(lab)
        self.assertEqual(lab.apply_event('WITHDRAW-S10',1,s.TOKEN)['reason'],'STOP_REQUIRED')
        lab.stop(1)
        self.assertEqual(lab.apply_event('WITHDRAW-S10',1,s.TOKEN)['archiveRevision'],2)
        self.assertEqual(lab.export_packet(2)['reason'],'STOPPED')
        lab.resume(2)
        self.assertEqual(lab.export_packet(2)['reason'],'NO_CURRENT_PACKET')
        before=lab.state()['logicalBodyReadEvents']
        rows=checked(lab,2)
        self.assertEqual(lab.state()['logicalBodyReadEvents']-before,8)
        self.assertEqual([r['queryId'] for r in rows if r['status'].startswith('DRAFT')],['Q02','Q11'])
        self.assertEqual(rows[3]['reason'],'SOURCE_WITHDRAWN')
        self.assertEqual(lab._records['S09']['fixtureStatus'],'SUPERSEDED')
        self.assertFalse(lab._records['S09']['currentClassificationEligible'])
        self.assertEqual(old['answers'][1]['fieldValues']['catalogueClass'],'U')
        self.assertEqual(len(lab.prepare_packet(2,s.TOKEN)['answers']),2)
        lab.assume_identifier_review('M01',2,s.TOKEN)
        rows=checked(lab,2)
        self.assertEqual(sum(r['status'].startswith('DRAFT') for r in rows),3)
        self.assertEqual(rows[3]['reason'],'SOURCE_WITHDRAWN')

    def test_T12_revisions_bool_replay_and_invalid_values(self):
        for value in (True,False,0,-1,1.0,'1',None,[],{},2):
            lab=s.SpliceLab();packet(lab)
            self.assertEqual(lab.check_query('Q02',value,A)['status'],'HOLD')
            self.assertFalse(lab.state()['currentPacketPresent'])
            self.assertEqual(lab.state()['archiveRevision'],1)
        lab=s.SpliceLab();lab.stop(1);lab.apply_event('WITHDRAW-S10',1,s.TOKEN)
        self.assertEqual(lab.resume(1)['reason'],'STALE_REVISION')
        self.assertEqual(lab.apply_event('WITHDRAW-S10',2,s.TOKEN)['reason'],'EVENT_ALREADY_APPLIED')
        self.assertEqual(lab.state()['archiveRevision'],2)
        self.assertEqual(lab.resume(2)['status'],'ACTIVE')
        self.assertEqual(lab.export_packet(1)['reason'],'STALE_REVISION')
        self.assertFalse(lab.state()['currentPacketPresent'])

    def test_T12_unknown_finite_inputs_do_not_echo_paths_or_urls(self):
        for value in ('https://example.invalid','../S03','S99',True,[],{}):
            lab=s.SpliceLab()
            out=lab.extract(value,1,A)
            self.assertEqual(out['reason'],'UNKNOWN_SOURCE')
            self.assertNotIn(str(value),json.dumps(out))
            self.assertEqual(lab.check_query(value,1,A)['reason'],'UNKNOWN_QUERY')
        lab=s.SpliceLab();packet(lab)
        self.assertEqual(lab.assume_identifier_review('M02',1,s.TOKEN)['reason'],'UNKNOWN_DECISION')
        self.assertEqual(lab.apply_event('OTHER',1,s.TOKEN)['reason'],'UNKNOWN_EVENT')
        self.assertEqual(lab.state()['archiveRevision'],1)

    def test_T12_event_and_decision_tokens_do_not_create_authority(self):
        lab=s.SpliceLab()
        lab.assume_identifier_review('M01',1,s.TOKEN)
        packet(lab)
        self.assertEqual(lab.assume_identifier_review('M01',1,'forged')['reason'],
                         'INVALID_REVIEWER_TOKEN')
        self.assertIsNone(lab.state()['assumedDecisionRevision'])
        self.assertEqual(lab.check_query('Q01',1,A)['reason'],'IDENTIFIER_REVIEW_REQUIRED')
        lab.stop(1)
        for token in ('forged',True,[],None):
            self.assertEqual(lab.apply_event('WITHDRAW-S10',1,token)['reason'],
                             'INVALID_REVIEWER_TOKEN')
            self.assertEqual(lab.state()['archiveRevision'],1)
            self.assertEqual(lab.state()['withdrawnSourceIds'],[])
        self.assertEqual(lab.apply_event('WITHDRAW-S10',True,s.TOKEN)['reason'],
                         'INVALID_REVISION')
        self.assertEqual(lab.apply_event('WITHDRAW-S10',1,s.TOKEN)['status'],'EVENT_APPLIED')
        self.assert_false_authority(lab.state())

    def test_T12_strict_revision_across_control_and_export_surfaces(self):
        for invoke in (lambda lab:lab.prepare_packet(True,s.TOKEN),
                       lambda lab:lab.export_packet(True),
                       lambda lab:lab.stop(True),
                       lambda lab:lab.resume(True),
                       lambda lab:lab.assume_identifier_review('M01',True,s.TOKEN)):
            lab=s.SpliceLab();packet(lab)
            self.assertEqual(invoke(lab)['reason'],'INVALID_REVISION')
            self.assertFalse(lab.state()['currentPacketPresent'])
            self.assertEqual(lab.state()['archiveRevision'],1)
        lab=s.SpliceLab()
        self.assertEqual(lab.inventory('FORGED')['reason'],'UNKNOWN_ROLE')
        self.assertEqual(lab.state()['logicalBodyReadEvents'],0)

    def test_T13_handled_retry_vs_prebody_TypeError(self):
        lab=s.SpliceLab();packet(lab)
        before=lab.state()
        with self.assertRaises(TypeError):
            lab.check_query('Q02',1)
        self.assertEqual(lab.state(),before)
        with self.assertRaises(TypeError):
            lab.prepare_packet(1,s.TOKEN,unexpected=True)
        self.assertEqual(lab.state(),before)
        self.assertEqual(lab.check_query('Q02',1,'FORGED')['reason'],'UNKNOWN_ROLE')
        self.assertFalse(lab.state()['currentPacketPresent'])
        self.assertNotIn('Q02',lab.state()['checkedQueryIds'])

    def test_T14_copies_are_independent_and_not_recalled(self):
        lab=s.SpliceLab();external=packet(lab)
        external['answers'][0]['fieldValues']['recordedEndpoints'][0]='changed'
        self.assertEqual(lab.export_packet(1)['answers'][0]['fieldValues']['recordedEndpoints'][0],'CAB-A')
        saved=lab.export_packet(1)
        lab.stop(1);lab.apply_event('WITHDRAW-S10',1,s.TOKEN);lab.resume(2)
        self.assertEqual(saved['archiveRevision'],1)
        self.assertEqual(saved['answers'][1]['fieldValues']['catalogueClass'],'U')
        self.assertEqual(lab.export_packet(2)['reason'],'NO_CURRENT_PACKET')
        state=lab.state();state['eventTrail'].clear()
        self.assertTrue(lab.state()['eventTrail'])

    def test_T14_real_new_process_resets_teaching_baseline(self):
        lab=s.SpliceLab();lab.stop(1);lab.apply_event('WITHDRAW-S10',1,s.TOKEN)
        env=dict(os.environ,PYTHONDONTWRITEBYTECODE='1')
        code='import json; from splice_lab import SpliceLab; print(json.dumps(SpliceLab().state()))'
        child=subprocess.run([sys.executable,'-B','-X','utf8','-c',code],
                             cwd=Path(s.__file__).parent,env=env,
                             capture_output=True,text=True,check=True)
        state=json.loads(child.stdout)
        self.assertEqual(state['archiveRevision'],1)
        self.assertEqual(state['withdrawnSourceIds'],[])
        self.assertEqual(state['logicalBodyReadEvents'],0)
        self.assertFalse(state['durableLedger'])

    def test_T15_no_external_surface_and_portable_worksheet(self):
        methods={name for name,value in inspect.getmembers(s.SpliceLab,inspect.isfunction)
                 if not name.startswith('_')}
        self.assertEqual(methods,{'inventory','extract','check_query','assume_identifier_review',
            'prepare_packet','export_packet','stop','apply_event','resume','state'})
        for name in ('network','send','write_network','ocr','model','load_url','upload'):
            self.assertFalse(hasattr(s.SpliceLab,name))
        source=Path(s.__file__).read_text(encoding='utf-8')
        import ast
        tree=ast.parse(source)
        imports={n.module for n in ast.walk(tree) if isinstance(n,ast.ImportFrom)}
        imports|={a.name for n in ast.walk(tree) if isinstance(n,ast.Import) for a in n.names}
        self.assertEqual(imports,{'copy','datetime','hashlib','json','pathlib','sys'})
        w=s._worksheet()
        self.assertEqual(len(w['rows']),11)
        self.assertTrue(all(r['predictedStatus'] is None for r in w['rows']))
        child=subprocess.run([sys.executable,'-B',s.__file__,'--worksheet'],
                             capture_output=True,text=True,check=True)
        self.assertEqual(len(json.loads(child.stdout)['rows']),11)


if __name__ == '__main__':
    unittest.main(verbosity=2)