PAGE_CURATION_AUDIT_2026-08-06.md

pipelines/PAGE_CURATION_AUDIT_2026-08-06.md

THE PAGE-CURATION AUDIT (2026-08-06) — every Flores board read against the curation law

What this is. The audit Josh chartered when he looked at the review pages and said most of what

is on them is crap. Thirty-five published board pages under docs/art_boards/flores_island/ were

read page-by-page by three fresh-context lanes against the curation law, with every canon id on

every page resolved (or refuted) in its owning registry. **All 35 pages fail the law. 77 of the 128

findings are page-unpublishable.** The defect is systemic and it is in the renderer, not in the

canon: the canon ids overwhelmingly resolve, and the pages publish the factory around them.

Machine worklist: docs/pipeline_review/page_curation_worklist.json

(35 rows, ranked slice-first), emitted by harness/emit_page_curation_worklist.py from these

returns verbatim.

---

1. The law being audited against

docs/spine/DECISIONS_PENDING_JOSH.md § JOSH MAKES IT UNIVERSAL + CONDEMNS THE PAGES

(2026-08-06). Josh, verbatim: *"not just creatures but companions, npcs, architecture, flora, fauna,

regions and environment and abilities and everything. and most of what you have on these pages are

absolute crap and completely messy or hallucinations. like wtf is that rock throw"*.

Two rulings came out of it. The second is the one this audit enforces:

• THE CALIBRATION IS UNIVERSAL. Every generated asset class — companions, NPCs, architecture,

flora, fauna, regions, environments, abilities, VFX — is GREYBOX until its plates pass Josh's

graded floor. Concept-first, Josh-graded floors are the law for every class.

• THE CURATION LAW (binding on every published surface). The director verified the named case:

"Rock Throw" is canonical (A_E_003, Earth T1, Ch 3 Manggarai, richly authored in

T0_Ability_Tree_Registry), so the defect is the PAGE, not the canon. The book/review

surfaces publish raw factory state — PENDING placeholders, superseded/rejected plates, REC-defect

diagnostics as body text. **RULED: published pages show CANON + the best current visual + an

HONEST TIER CHIP (concept/greybox/final), and NOTHING ELSE.** Factory diagnostics, supersession

ledgers, and rejected generations never render on a published page. WIP state lives in the repo,

not the book. Pages that cannot yet show an acceptable visual show the canon text plus

"no acceptable visual yet" honestly, rather than a rejected render.

Three standing laws bear on the fix and are cited where they bind: boards publish phone-first

(a board is DONE only with a phone-viewable publish); the honest register (nothing in the

generated-asset classes is shippable and the acceptable count is 0 — a chip that says otherwise is

the same inflation defect as the face judge); and §17.1 care is COLLECTIVE — rejected renders of

living-Manggarai personas and crowd types are the sharpest instance of what must not reach a viewer.

The audit's own honest register. This document records what the pages DO, verified by reading

the emitted HTML and resolving each canon id. It makes no claim that any Flores visual is

acceptable; the graded floor has passed nothing in this region.

---

2. Defect totals

Read the first row again. factory_leak is 35 of 35. Not one page in the region is curated;

every page is the factory console with a title on it. That is a renderer property, which is why the

rebuild plan leads with code and not with pages.

Coverage caveat, stated rather than papered over. The G3 lane's return truncated mid-finding on

BRD_0015; that page's asset-path and structure findings are UNRETURNED. BRD_0015 is therefore

recorded at three findings and is owed a re-audit. Every other page's findings are complete.

The three lanes covered 18 + 11 + 6 = 35 pages.

---

3. Per-group findings

3.1 G1 — regions, sites, architecture, mood (18 pages, 68 findings)

3.2 G2 — characters, NPCs, bosses (11 pages, 32 findings)

3.3 G3 — creatures, equipment, familiars, inscriptions, sites (6 pages returned, 28 findings)

---

4. The rebuild plan

Ranked by leverage. (a) lands first and alone, because it re-renders all 35 pages clean in one

change; per-page work that (a) cannot reach is the tail, not the head.

4.1 (a) THE SYSTEMIC FIX — make factory state impossible to render

The renderer is harness/boards/render_board.py::render_leaf (L979–1183). It has exactly one

surface today, and that surface is the factory. The fix is a published surface that is

structurally incapable of emitting the six defect classes, plus a gate that proves it.

A1 — split the surface. Add --surface {factory,published} in main() (L1186) and a surface

parameter on render_leaf. factory keeps today's behaviour for the internal sheet; published

is the law's page. Every diagnostic emitter below is gated on surface == "factory", so the

published branch cannot reach the code that prints them.

A2 — delete the diagnostics from the published branch. Each is a named line today:

• L1018–1021 the PROVISIONAL banner ("critic_verdicts is empty, marketing_eligible computes

false … Nothing here is picked and nothing here is promotable") and its markdown twin at

L1037–1039.

• L1098–1107 the <div class="recline"> REC-verdict block (REC · {verdict} — {reason}).
• L1108–1116 the <div class="regen"> supersession ledger ("Regenerated after vision review …

the superseded plates are kept on disk and kept on this page, marked").

• L1055–1057 the cite line (lane / care_tier / protected) and L1058–1059 care_source —

registry columns, not reader content.

• L1062–1065 the rule blocks (rekey_basis, released_by_ruling, dress_route,

lane_p_underlay, entity_care_register, care_conditions). canon_note is the only field of

the six that may survive, and only after harness/site/firewall.py::player_register().

• L1156–1178 the whole "Canon coverage — what this board does not carry" residue section.
• L1010–1017 the badge row: drop fidelity, condition, generation class, "private through

selection"; the published page carries one chip (A4) and nothing else.

A3 — the superseded gallery is deleted, not dimmed. L1137–1148 builds <figure> elements from

the superseded list computed at L1091. On the published surface that list is never iterated: a

plate whose generation_status == "regeneration_required" can never reach a <figure>. Second

tooth at the staging layer — see A6.

A4 — one evidence-derived tier chip per visual. The machinery already exists and is already

honest: harness/site/asset_gallery.py L68 `LADDER = ["ITERATION","GREYBOX","CONTENT-COMPLETE",

"POLISH","AAAAA-VERIFIED"], derive_tier()` (L400) which derives the rung **from evidence on disk,

never from an assertion**, and tier_pill() (L725). Factor those three into a new

harness/site/curation.py and have both the gallery and the board renderer import them, so there

is one tier oracle in the repo. The published board emits the chip beside every visual, mapped to

the law's viewer-facing words (concept / greybox / final). AAAAA-VERIFIED stays underivable, which

is the correct honest register: the acceptable count in this region is 0.

A5 — best_visual(), not a candidate grid. New in harness/site/curation.py: given a row's

plates and its REC row, return the single plate that is (i) not regeneration_required, (ii)

judged/picked, and (iii) present on disk — or None. The published page renders that one plate.

BRD_0033's four-up outlined-recommendation layout is a selection surface and does not survive.

A6 — kill file:/// at the source. L1125 and L1141 hardcode

src="file:///{art_root}/{asset_path}". That single expression is 369+ dead images across the

region and is why every board is unpublishable on a phone. The published branch must stage each

plate through harness/site/build_progress_site.py::Images.stage() (class at L672) — copy, downscale to the

phone-first width, apply image_policy() — and emit the returned site-relative /…jpg URL. Two

supporting changes:

• image_policy() (L663) already fails closed to withheld. Add a policy row that withholds

any source whose PLATES.csv row carries generation_status == regeneration_required, so a

rejected plate is unstageable at the copy layer and A3 has a second, independent tooth.

• Assert in render_leaf that on the published surface every emitted src starts with /. A

file: or drive-letter src raises rather than renders.

A7 — the honest no-visual state replaces the PENDING block. L1149–1152 today prints

<b>No image yet.</b> {bar_reason or "promised, not yet produced"} — that bar_reason string is

where LANE_R acquisition doctrine, care arithmetic, cultural_depiction_required predicates and

board.md line-citations reach the reader. The published branch emits the law's state instead:

the canon text, then a single line reading "No acceptable visual yet." bar_reason never

renders on a published page.

A8 — headings are canon, not slugs. L1047 emits <h2>ROW:{k}</h2>. Published headings come

from content.json's row title, falling back to a humanised slug. Pipe-packed canon_ref

strings, repo paths, file:line citations and registry column names are factory-surface only.

A9 — THE CURATION FIREWALL (the gate that keeps it fixed). harness/site/firewall.py already

has the right shape: compiled rules with a stated why, a CANARY positive control that must trip

every rule, an entity-decoded two-pass sweep_files() (L143 — a real bypass found by mutation

test), and an exit-code-bearing __main__ wired into harness/gates_config.json :: site_firewall.

Add a second rule-set in the same file, with its own canary:

• factory-diagnostic — critic_verdicts|marketing_eligible|PROVISIONAL|REGENERATE_ALL|REC · |recommended_candidate|regeneration_required|bar_reason|generation_status
• supersession — superseded|Regenerated after vision review|the set the reviewer looked at|kept on this page
• pending-placeholder — No image yet|GENERATION BARRED|LANE_R_ACQUISITION|promised, not yet produced|MUST-ACQUIRE
• factory-taxonomy — \bLANE_[A-Z]|lane_p_underlay|care_tier|cultural_depiction_required|hard_line_anchors|density_class|decay_stage|approval_state|mood_set
• repo-path — build/zones/|docs/spine/|registries/|harness/|\.csv\b|\.md:\d+|board\.md:\d+
• local-asset — file:///|[A-Za-z]:[\\/]
• raw-slug-heading — <h2>ROW:
• finding-id — \bF-\d+\b|boarded as finding
• missing-tier-chip — an inverse rule: every <figure> on a published page must carry

exactly one class="tier-chip". Its positive control is a fixture page with the chip stripped,

which must fail. (Standing law: a rule that cannot fail is not armed, and a zero that was never

controlled is not evidence.)

Wire the sweep into build_progress_site.py::deploy() (L2320) ahead of the publish, so a leaking

board cannot be deployed, and add the emitted docs/art_boards/**/board.html set to the swept

paths. Note that the existing reveal rules apply to these pages the moment they are published —

BRD_0006 currently prints an HL_0095 rejection reason as body text, which the held-object rule

already catches; the curation fix and the reveal firewall land the same page clean.

4.2 (b) The page template, per the law

One block per subject, in this order, and nothing else on the page:

• The subject's canon name — the display name, never a ROW: slug or a plate id.
• The canon text — what the subject IS, in reader register, passed through

firewall.player_register(). The canon id is resolvable in the repo but is not shouted on the

page; where it is printed it must resolve in its named owning registry (§4.3, C-rows).

• ONE visual — the best current judged plate, staged into the site tree, phone-first width.

Never a candidate grid, never a superseded plate, never a dimmed rejected render.

• ONE tier chip beside it — concept / greybox / final, derived from evidence by the shared

ladder. Given the honest register, essentially every Flores chip reads concept or greybox today,

and that is the point of the chip.

• Or, when there is no acceptable visual: the canon text plus "No acceptable visual yet."

and nothing more. No reason string, no lane, no acquisition doctrine, no bar_reason.

Page furniture allowed: the board title, the subject count, and a single dated stamp. Not allowed:

banners about critics, coverage-residue tables, promotability language, finding-ids, lane

taxonomy, file:line citations, registry column names, repo paths.

4.3 (c) The per-page worklist, ordered slice-first

Every flores_island board sits inside the Josh gate (Prologue→Ch 13), so the ordering is by what is

reached first — the region front door, then the protagonist, then Ch 2 subjects in encounter order,

then Ch 3 — with pages whose defect is only the renderer ahead of pages that additionally need a

canon repair, a generation, or an acquisition. Full rows, with every finding and its owner, are in

page_curation_worklist.json.

Sequencing rule. The four canon_mismatch repairs (BRD_0005, 0008, 0034, 0041) block their

pages' re-render — a citation that does not resolve is a hallucination on the page whatever the

renderer does. Everything else re-renders the moment §4.1 lands.

---

5. What this audit did not do

• It graded no visual. No plate in this region has been through Josh's graded floor, and none is

claimed acceptable here.

• It did not audit board pages outside docs/art_boards/flores_island/ (the D1-27 ability/VFX

boards are separately HALTED under the same sitting's exemplar-first ruling), nor the

progress-site pages, nor the asset gallery. The same firewall (§4.1 A9) is the instrument for

both when they are swept.

• It did not re-audit BRD_0015 after the truncated return; that page is owed a second read.

Generated by harness/site/structure_site.py — the URL path is the repo path. review root