[scbrown]

The request fact builder had no publication job. Add a conditional curator that writes the current revision and immutable manifest through one existing /update operation, checking the previous head/manifest and the canonical item's exact revision/open status. Writes target only the request graph; old manifests and answer/item facts stay intact.

The job checks a retained native store/graph pin and saves mode-0600 UNKNOWN custody in an owned mode-0700 directory, syncing it before one send. A new instance reconciles retained custody by reading; it never resends. Changed payloads or pins conflict. Missing or inconsistent responses/read-back remain UNKNOWN. The source selects no endpoint, credential or schedule; production adapters, least-privilege server policy and served-cost admission remain separate gates.

Validation: 99 tests, static build and README checks pass. Thirteen synthetic loopback native controls pass on a clean, pinned release/full candidate: initial/next publication, stale and ambiguous state, closed/foreign item, occupied revision, concurrent distinct writers, unchanged item/answer graphs, and a real native commit followed by dropped-response/restart recovery. Two discriminating fault injections fail before restoration. Meaningful checks and the fresh committed-source qualification have clean HOME guards. The fixture uses a synthetic broad bearer and proves no production credential restriction or installed effect.

Demo: caption and replay instructions, terminal recording/readable transcript, timing. Watch UNKNOWN recover to CONFIRMED by reads with send count one; a changed payload refuses. The recording uses synthetic library adapters and identifies exact base/source revisions. Playback verified with util-linux scriptreplay; download both recording files for playback. Small artifacts remain in the existing Deck evidence directory. Native control archive covers the actual HTTP/native path separately.

Independent source review and complete current CI are required. No graph registration/protection, production write, enrollment, served enablement, deployment or activation authority is included.

[scbrown]

Source APPROVE at 17714a261814eb12d786c8b968ce40816acebbb5 / base b290c515. Full independent review of all eleven changed paths; no blocking finding. R11/R12 verdicts were not reused for this curator delta.

The conditional update confines mutation to the request graph, requires exact singleton item revision/open status and prior head/manifest, advances one revision, and refuses an occupied immutable revision. Custody is durably synced before one send; existing UNKNOWN is never resent. Confirmation requires matching read-back, and recovered confirmation does not invent transaction attribution. The source selects no production endpoint, credential or scheduler.

Validation: required just ci passes all 99 tests, build and README checks. Two additional independent controls pass: retained UNKNOWN remains byte-identical across repeated restart/reconciliation attempts with one send, and concurrent distinct payloads share one exclusive revision slot with one send. Both guarded runs exit 0 with 157 watched paths and five resources unchanged. The entire proposal reconstructs the candidate tree and reverses exactly to base. Archived native source hashes and the implementation bytes from the recorded qualification commit match this head; raw terminal recording bytes are preserved.

The thirteen native server controls and their mutants remain author evidence; I did not independently rerun that server fixture or enroll anything. Dedicated server-enforced writer restrictions, graph/replacement assumptions, admitted reader costs and production adapters/activation remain separate gates. Query narrowing is not credential enforcement. Source approval grants no runtime or production-write authority; Tim retains normal landing custody.