v33.0.0 adopt checklist — persist v50.0.0

[emooreatx]

Checklist for the v50 adopt: ABI 5→6 floor >=50,<51; #694 Engine-level opener; #917; #701 BeyondDepthCap; #924 namespace re-pin after re-review; persist#931 apply_replicated_community on the replicated path; #916 device-add door decision.

[emooreatx]

persist#931, resolved for Family: no apply_replicated_family in v50. The door split exists only because the community gates that must not depend on the signer (#925/#927's infrastructure rules, #926's canonical gate) live on put_community; a family has no cohort_subkind, none of those gates apply, and put_family never had a by-signer leniency to remove — it stays exactly as v49 left it, with #910's occupied-id amendment path (supersede_proof against the receiver's prior roster) on the same door. So at the adopt: Community's replicated apply moves to apply_replicated_community; Family's stays on put_family. Persist lands the v50 notice against this issue.

[emooreatx]

Added (persist#928 / #925 review): CIRISEdge#703 — blob_swarm/revocation.rs:~506 re-derives already-stored withdraws at READ time through check_withdraws_admission (the WRITE gate, now 5-hop default), which would un-revoke a withdraws validly admitted at 6–16 hops. v50 records each row's admitting depth (V157; pre-V157 reads as 16) and exports check_withdraws_admission_as_admitted(dir, row) — switch the read-time re-derivation to it (capsule forwards withdraws_admission_depth). Witness: a 7-hop withdraws admitted pre-v50 still stops the bytes after the adopt.

[emooreatx]

DEK cascade — checked against the code, edge already rides persist's end to end; one v50 item resolved. Every content seal/open in edge goes through persist's cascade doors (group_content/persist_store.rs: put_blob_scoped, put_blob_chunk_scoped/seal_stream_scoped, read_blob_as); edge holds no content DEK, mints no key grants and has no hand-rolled new-device re-grant (grep for rekey_|retroactive|re-grant|device_add finds none). The only DEKs edge holds are the realtime A/V stream EpochDeks (MLS exporter, CC 5.1 stream keying) — a different axis, not at-rest content. #916 item: Engine::rekey_community_member_device_add is the CLAIMING node's door and the minter side fires inside persist's receive doors, so edge has nothing to wire: the device-claim event is the host's (CIRISServer's claim flow calls the engine directly from Rust). Ticked; noted on CIRISServer#630. #698's sealed descriptor follows the same rule — persist seals it under the blob's own DEK (#923); edge never sees the key.

[emooreatx]

Adopt risk found by #706's rc5 replay (PR #707): the CC rc5 reference matcher refuses capacity:relay_delivery:v1 — edge's PRODUCTION A/V delivery-score dimension (realtime_av_alm/delivered.rs:115, build_delivery_row). rc5's capacity family carries only the lens rows (reserved, owning_repo CIRISLensCore). Persist v49 admits it; if persist v50's #924 matcher enforces rc5 at admission, relay delivery scores stop landing on v50 nodes. Asked persist which it is and, if refused, whether edge moves to a registered leaf or a CC row is needed before the tag. Also 15 test-only literals refused (e.g. accord:halt:v1) — edge fixes those at the adopt. Plus: #707 lands the 962-vector replay #[ignore]d with the one-line hook to persist v50's match_family — un-ignore it in v33.0.0.

[emooreatx]

capacity:relay_delivery:v1 confirmed REFUSED by persist v50 (tested against the vendored rc5 bytes; no persist carve-out). The re-spelling must ship in v33.0.0 or v50 nodes drop relay delivery scores. Neither edge-owned row fits (delivery:{class} is substrate-self-report; delivery_receipt:{stream_id} is a membership-gated receipt, no subject-consent gate). Filed CIRISConstitution#129 asking for a registered home — preference: register capacity:relay_delivery:{version} as an edge-owned row (no-self-emit + subject analyze consent), zero wire change. v33.0.0 item: adopt whatever spelling CC rules (edge + LensCore in lockstep); 15 test-only literals re-spelled regardless.

[emooreatx]

Sequencing decided (maintainer): persist v50.0.0's vendored rc5 registry refuses any new row until persist re-vendors, so no interim open-vocab spelling. Order: CIRISConstitution#129 rules the relay-delivery home → persist cuts v50.x re-vendoring the registry with that row → edge v33.0.0 adopts v50.x (not v50.0.0) with the registered spelling, LensCore in lockstep. Persist asked to plan the re-vendor on #129's landing and to post the matcher's answer here.

[emooreatx]

Persist: the ruled spelling through the vendored matcher (CIRISConstitution#129 landed on rc6 at 651140a; persist re-vendors namespace_registry.json + namespace_match_vectors.json at exactly that commit — 149 families, 968 vectors, registry_sha256 c22dc087…, VENDORED_CC_VERSION 1.0-rc6). TESTED against those bytes with CC's reference matcher (the function persist ports, replayed on all 968 vectors in the release witness):

dimension	family	refusal
capacity:relay_delivery:v1	capacity:relay_delivery (edge-owned, reserved: no-self-emit, CC 3.4.5)	admitted
capacity:relay_delivery:v2	capacity:relay_delivery	admitted (open version)
capacity:relay_delivery:V1	—	namespace_dimension_case_malformed
capacity:relay_delivery	—	missing_version_segment
capacity:made_up:v1	—	namespace_family_unregistered (the stem stays fenced)

Sequencing (operator's bundling decision): the re-vendor ships in persist v51.0.0 — the release adopters take, with the rc6 security set (#937/#938/#939), the sealed descriptor (#922/#923) and CIRISVerify 18.0.0 — not a v50.x point release; v50.0.0 tags as the base. Edge v33.0.0 adopts v51.0.0 with capacity:relay_delivery:v1. The row is reserved no-self-emit: the attesting key must differ from the attested key, and analyze consent must cover the attesting consumer — persist's R2(b)/reserved-rule gates apply as to every reserved row.

[emooreatx]

persist v50.0.0 is tagged (v50.0.0 → ebc51de, PR CIRISPersist#921). MAJOR; verify stays v17.1.0 (CIRISVerify v18.0.0 — the hardware_custody:* spellings persist 50 refuses, lowercase CONSTITUTIONAL, zeroize — is re-pinned in persist v51.0.0, the release that adopters take). It carries the second-device four (#919, #916, #920, #917), the CC rc5 adopts pulled in by the operator (#924, #925, #926, #927, #928, #931, and the rc5 evidence rows of #935), the trust-root pre-flight gate (#809) and the release-gating fix (#756). Design: FSD/SECOND_DEVICE.md (§1–§4 second device, §8 rc5, §9 the trust root, §10 the dimension grammar).

What changes for edge (v33.0.0):

• #917: put_attestation_synced(record, peer) returns ReplicatedAttestationOutcome, the same enum as the unattributed door. A decoration-only re-delivery is Refused { already_present_identical }, which your attestation_outcome_to_apply already books as a duplicate. Your bridge.rs:7833-7862 match on Ok(AttestationOutcome) / Err(Conflict) won't compile: route it through attestation_outcome_to_apply. Both capsule wire digests moved for the appended ops/results of #917, #925/#931 and #928: op be22e2dc22c75b7c88cc236bfb5ea2c6613c8d3933b4efc554f9980b350731aa, result dccdb0994c22284eea288d333bb0160eaed3ed4dd1f0d19039368046bcf0d930; DIRECTORY_ABI_VERSION is 6 (#928: ReachabilityVerdict::BeyondDepthCap is a new variant of an EXISTING op's result — a payload-shape change, not growth). Two appended ops (ApplyReplicatedAttestation, ApplyReplicatedAttestationSynced) run the typed door on the far side; the old PutAttestationSynced op keeps its pre-v50 contract.
• #920: XChaChaKvStore::open_mls_state(path) is gone. Use Engine::open_mls_state(path) -> (XChaChaKvStore, MlsStateCustody { kind: Hardware | Software, descriptor }); log the kind. HardwareCustodyUnavailable now means §11.7 (hardware row, seed unreachable) or the compat arm (a v49 store's hardware key unreachable); a host with no hardware storage gets WrongPassphrase for a wrong-keyed store. A v32.1.0 store on a TPM host under a software row opens via the compat arm as Hardware with a legacy-v49-… descriptor.
• #916: on a device claim, each minter node re-wraps its own retained epochs to the new device when the owner-binding lands through any receive door (incl. the capsule far side), and the dirty-emit loop sends the sets. The host's door rekey_community_member_device_add is for the claiming node. Refusals DeviceRekeyRefused { rule }; device_rekey_unbound / _not_an_occurrence / _node_key_unknown are retryable. No kind, no hash move.
• #919: persist-internal (the sweep no longer widens a row naming a cohort target, including the blob pointer's owner slot). No wire change.

Mixed-fleet note for CIRISConstitution#114 / CIRISEdge#698: a v50.0.0 reader ADMITS a file:v1 row whose content pointer carries sealed_descriptor and no clear format — persist's media gate runs only on a top-level media member, which file rows do not carry, and nothing in persist reads the pointer's descriptor fields. The gate change that admits a seal on the media Source struct itself is CIRISPersist#922, the cut after v50; producers must not adopt the media struct on file rows before it.

CC rc5 adopts, also in v50.0.0 (pulled in by the operator): #924 (the dimension grammar is manifest data — 148 families at the released rc5 tag, one matcher, 962 replayed vectors, the version segment from _meta.case_rule, closed leaves, vocab values; a wire break on the domain-label version — details in the CHANGELOG), #925 (a node-bearing key never founds or votes in an infrastructure community; Clause A refused at mint and on every rewrite door; node-bearing via an occurrence needs the occurrence's own consent and is judged at the change's instant), #926 (the ciris-canonical row: born by the accord holders' 2-of-3, amended by the founders' quorum, served beside the bundle; fixture until the holders sign), #927 (infrastructure protocol must be quorum:M/N with M ≥ 2 when N ≥ 2), #928 (5-hop delegation default; 16 ceiling by explicit opt-in; beyond_depth_cap reported — CIRISEdge#701). Mixed fleet: a v49 node admits a 6–16-hop withdraws that a v50 node refuses at its replicated door — the bytes it withdraws stay live on the v50 node until the fleet upgrades; already-admitted withdraws keep their stored rule on both planes. A fused {node,user} key minted on a v49 peer is admitted by v50 as gated data (Clause B), never re-minted.

#924 adopter facts (computed from the vendored files): VENDORED_N_FAMILIES 116 → 148 at CIRISConstitution c60d0a6 (the RELEASED 1.0-rc5, tag v1.0-rc5; an earlier build had vendored PR #113's pre-release head 4b624513 and was re-vendored before the tag), VENDORED_REGISTRY_SHA256 = 07e0c72538f3dd42451cac0c5f2529eed37bea3e8996640de2749aabb960b7fb (CC's grammar-hash recipe, recomputed by a test), VENDORED_CC_COMMIT = c60d0a6a0dfd3a0f2f2c3970b4148bf5b8777b3f. VENDORED_MANIFEST_VERSION stays 0.3.0 (it versions the supersets walk, namespace_supersets.json, which did not move) and TRANSFORM_ALGEBRA_HASH is unchanged (b7bd7794…86b4b; no processor kind or transform op added, removed or re-typed), so edge's PERSIST_NAMESPACE_MANIFEST_VERSION pin does not move. Family diff v49 → released (scripts/manifest_diff.py): 33 added (six accord:* leaves, eight consent:* plus consent:community_trust, the two capacity companions capacity_assurance:reversible_excluded|reversible_pending:{domain}:{version}, nine media wildcards, three event:*, identity:canonical_binding:{canonical_hash}, topical_relation:{kind}, age_self_declared:band:{band}:{version}), 1 renamed (age_self_declared:{band}:{version} → age_self_declared:band:{band}:{version}), 27 existing families changed (variadic + closed leaves on accord:*, dma:*, system:*; consent:{kind} CLOSED to its ten leaves; capacity_assurance:{level}/{band} closed; the {lang_code} BCP 47 pattern rewritten (canonical casing — en-us refused, x-… private-use admitted); closed value lists on age_assurance and hardware_custody:{platform}; open value lists on 8; pattern/standard on bond_posted, the provenance locale family, transparency_log:cosigned, content_rating; multi on detection:correlated_action, provenance:skill_import; licensure no longer reserved; session → occurrence-self-report). New _meta grammar: reserved_stems, version_segment, external_standards, refusal_tokens, wildcard_rule, case_rule.match_semantics (full match — compile anchors every pattern ^(?:p)$). All 962 published vectors replay two ways; CC's reference-matcher changes between the pre-release and the release are ported (closed stems fence unmatched descendants; open vocabulary owes its version tail; v1beta / V1 / a duplicated tail refused). Refused by v50 from a named emitter: CIRISVerify 17.1.0's hardware_custody:{android|ios_secure_enclave|tpm} (no version tail; android/tpm outside the 13 tokens) — fixed in CIRISVerify v18.0.0 (#296), which persist re-pins in v51.0.0; do not store 17.1.0's entries on persist 50. Old-shape identity:canonical_binding:canonical:sha256:<hex> rows parse to nothing (fail-closed; no emitter found outside persist tests). Also newly refused: an unlisted consent:{kind} (consent:made_up:v1; CIRISAgent's consent:community_trust:v1 still admits on its own row), an unversioned open-vocabulary dimension, a companion capacity_assurance:reversible_excluded:a:b:v1 (closed {level}), a non-canonical locale. Edge's production A/V delivery score capacity:relay_delivery:v1 (CIRISEdge#706) is REFUSED at admission on v50 — rc5 fully claims the capacity: stem with the six lens-owned rows, so every unnamed descendant is fenced; re-spell it under an open or registered stem (e.g. relay_delivery:av:v1, admitted as open vocabulary) in the same Edge release that re-pins persist 50, or v50 nodes drop those rows from the upgrade onward.

#926 surfaces (the ciris-canonical trust root): SignedCommunity gains pub cosignatures and lineage (struct-literal constructions break; both are outside signing_envelope()); RootKind::Community is a new serde variant (trust_root_valid resolves a trust-root-grade community through its accord family; an exhaustive match breaks). GET /v1/trust-root/bundle (/v1/steward-key alias, server feature) serves the signed row + lineage + co-signer key records + withdrawal evidence; pin_trust_from_bundle_response verifies the bundle quorum against the consumer's OWN roster before admitting anything, and admits the carried withdrawals/key records through the ordinary doors. resolve_community returns the record's founders, only while Rooted; standing is StoredStanding::{Rooted, Stalled, NotRooted} re-derived on read (cached with an expiry at the next time-dependent boundary). A production node resolves ciris-canonical to nothing until the holders sign the real row (a holder session outside persist); only the fixture resolves. FederationDirectory gains lookup_signed_community and trust_root_standing_cache (both defaulted).

Community doors (#931, in v50): put_community is STRICT by default on every door (the #925/#927 infrastructure gates and #926's canonical gate run regardless of signer). Replication uses the new apply_replicated_community(record) (identical re-put settles; a legacy non-conformant record is admitted as data with the fold's gates applying; occupied-id amendments through the #910 proof checks) — a capsule op appended (digests re-pinned) and pyo3 apply_replicated_community_json. Edge's bridge: the replicated community apply moves to it; locally authored rows keep put_community. Migrations: V157 = withdraws_admission_depth on the withdraws row (pre-migration rows default 16, new rows stamped with the effective cap; the bytes-plane re-derives at the ROW's depth), V158 = federation_communities.cosignatures + lineage (#926). Also: a fused {node,user} key can no longer be minted through add_peer_record; an infrastructure record's quorum:M/N must have N equal to its founder count.

Read-time re-derivation of withdraws (#928 review): persist exports check_withdraws_admission_as_admitted(dir, row), which re-derives at the row's RECORDED admitting depth (V157; pre-V157 rows read as 16); the write-form check_withdraws_admission now walks the 5-hop default and must not be used to re-judge stored rows (it would un-retire blobs). Server drive.rs:1094 → CIRISServer#690; Edge blob_swarm/revocation.rs:506 → CIRISEdge#703. The capsule forwards withdraws_admission_depth (appended op). Founder self-leave: a founder may leave a conformant infrastructure room on their own signature (v49's consent floor); N is the founder count as admitted, and if the remaining founders can no longer reach M the room is frozen until its conferring authority re-founds it. On a trust-root row (ciris-canonical) founder seats move ONLY through the record: a founder's own plane revocation is a RESIGNATION dated strictly after the stored head's instant; from that instant they count as nothing (a later version may still record them; it is Stalled until the founders' quorum amends them out or re-seats them). A conformant room never degrades through the replicated door (a weakening supersede is refused there too).

[emooreatx]

Target moved to persist v51.0.0 (maintainer sequence, persist 2026-09-28): edge does NOT adopt v50.0.0 (ebc51de5). v51.0.0 is a superset: everything in the v50 notice above, plus the registry re-vendored at CIRISConstitution 651140a (capacity:relay_delivery:v1 admits — CC #129 ruled for the existing spelling; matcher answers above), the rc6 trust-root set (#937/#938/#939: lineage-head cosigns via capsule op PutLineageHeadCosign, charter-armed attach freshness, liveness margin), the sealed-descriptor doors (#922/#923 → CIRISEdge#698's producer and #638 ride v33.0.0 too), and CIRISVerify 18.0.0 (lockstep). ENVELOPE_VOCABULARY_SHA256 moves again; capsule digests grow; ABI stays 6. Edge pre-stages the v50-superset items on a branch against v50.0.0 now and re-pins to v51.0.0 at its tag.

[emooreatx]

Pre-stage done — draft PR #710 (branch adopt-persist-50-prestage, against persist v50.0.0, all gates green, not merged). All eight v50-superset items land there: pins (only DIRECTORY_ABI_VERSION 5→6 moved; policy/grammar/manifest/algebra hashes unchanged; verify stays 17.1.0), #701 BeyondDepthCap (named refusal beyond_depth_cap — a new wire token in a signed row, so v33 is MAJOR), #703 recorded-depth re-derivation (e2e fails on the old call), #917 typed synced door, #931 apply_replicated_community, #694 open_mls_state → (ScopeStateProvider, MlsStateCustody) (opens ON DISK as Software on a TPM-less host — host API break), #924 manifest unchanged + the 962-vector replay wired to match_family and un-ignored (962/962), #916 nothing to wire. Rescan found 7 test-only dimension literals to re-spell (done), not 15. Remaining at v51.0.0: re-pin persist v51 + verify 18.0.0 (lockstep), ENVELOPE_VOCABULARY_SHA256, re-vendor CC at 651140a + assert capacity:relay_delivery:v1 admits, rc6 PutLineageHeadCosign (#937–939), #922/#923 → #698 producer + #638, version bump/TSV/note, RUSTFLAGS=-D warnings before tag.

[emooreatx]

v51.0.0 will differ from the branch edge adopted (789be5b3) — persist folds both asks and the PR #943 Codex fixes into the tag. At the re-pin (#710), edge must: (1) pass the referencing row's caller_aad to Engine::open_descriptor_for_blob(sha, viewer, sealed, caller_aad) (now Option<&[u8]>; missing/different AAD on a row-sealed blob → crypto-class Backend error, never NotGranted) and flip D8 to assert the transplant is refused at the door; (2) handle SealStreamScopedResult.chunk_key_grant_emissions if edge seals streams below the Engine door (the Engine door emits them itself) — D9 becomes TESTED on persist's side; (3) re-check trust-root consumers: a stalled root is now served with live=false (CC 3.2 T7) where v50 returned no resolution — confirm rooted_with reads valid/liveness as intended; cosign renewals are rows; #941 refuses A→B→A ownership (re-run edge's #941 witness). Re-diff hashes at the tag; verify the tag derefs to the tree reviewed.

[emooreatx]

Server ask for the v51 re-pin (#698 consumer side). CIRISServer is pre-staging against #710 (68bba8b). On a sealed row, FileRow.filename/media_type are None (correct), and the only public way to the name is FileRow::open_described, which opens the BYTES first. The drive needs the descriptor on paths that never read the bytes:

• GET /v1/drive lists every file (25 in the selffiles corpus, up to 24 MiB each). Opening each file's bytes to show its name is a full decrypt per listing, and a file whose bytes are not_fetched would list with no name, although its descriptor rides in the pointer and would open.
• The notes discriminator (text/plain AND no filename) runs over every self-room row.
• Replace and move carry the old name and type onto the new row.

Ask: FileRow::describe(&self, store, viewer_key_id) -> Result<Descriptor, UnopenedReason>, which opens ONLY sealed_descriptor, under the row's caller_aad. That is what v51's open_descriptor_for_blob(sha, viewer, sealed, caller_aad) makes safe: a transplanted pointer is refused at the door, so opening the bytes is no longer needed as the guard. It should return Descriptor::Clear for a clear row, and NotGranted / NotFetched-style reasons as open does (though a sealed descriptor should not need the bytes to be here).

Until then the server routes every read of a name or type through one helper, drive::describe, whose body calls open_described. At the re-pin that becomes a one-line swap. SealedDescription stays edge's; the server will not parse the descriptor JSON itself.

🤖 Generated with Claude Code

[emooreatx]

Second server ask for the v51 re-pin: a rename door (#698 makes it required).

The drive's rename writes a new file:v1 row over the SAME bytes. It keeps the old row's author and instant so the bytes open under their AAD, and puts the new name in the envelope. It had to build that row itself because files::publish takes bytes, not a pointer. On #710, the old pointer carries a sealed_descriptor with the OLD name, so the renamed row has a clear filename beside a sealed descriptor. FileRow::try_from_row refuses that as TwoDescriptions (D4), and the renamed file disappears from the room (drive_crud::rename_keeps_the_blob_and_the_bytes_open, the write-gate test's rename step).

The server cannot fix this without copying edge's private descriptor format (Description::to_jcs) into Engine::seal_descriptor_for_blob, and at v51 that seal may also bind the row. So:

Ask: files::rename(dir, store, signers, room, old: &FileRow, new_name: Option<&str>, replaces: &str) -> Result<Published, FileError>. It re-seals {name, format, codec} over the same blob under the new row's binding, keeps the pointer's sha and the bytes' AAD, and writes the supersedes-shaped row edge already defines. A move (another room) re-uploads today and needs nothing new.

Until it lands, the adoption branch leaves rename red (3 test assertions). I'm not shipping a copied descriptor format.

🤖 Generated with Claude Code

[emooreatx]

persist v51.0.0 is tagged (v51.0.0 → d7f3a40, PR CIRISPersist#943). MAJOR — the release adopters take (nobody re-pinned 50). It carries the rc6 trust-root security set (#937 attach freshness, #938 witnessed lineage, #939 liveness margin), the sealed descriptor (#922/#923, CIRISConstitution#114), CIRISVerify 18.0.0, the postgres projection fix (#933), the widening purpose-marker fix (#929), the owner-of-node withdraw (#941), and the registry re-vendored at CIRISConstitution 651140a (rc6, 149 families, 968 vectors) carrying Edge's capacity:relay_delivery row (CIRISConstitution#129). Design: FSD/TRUST_ROOT_RC6.md, FSD/MEDIA_SOURCE.md §9. Everything below is TESTED on memory, sqlite and postgres unless marked.

What changes for edge (v33.0.0):

• Pins: the six verify crates → v18.0.0 (your hardware_custody:{platform}:v1 and lowercase accord:invoke:constitutional:… spellings admit under the vendored registry — replayed in persist's own witness). ENVELOPE_VOCABULARY_SHA256 a6a84cc9… → c9558c98bf871e97c2e73c428894e2dc642fcffec4de92da06ab5a9fa69ddca2 (four typed members: attach_window_secs, witness_cadence_secs, witness_quorum, attached_head_digest). Both capsule digests moved as GROWTH (op 9050c899…bcd034, result bf09a010…9262; PutLineageHeadCosign op + LineageCosignOutcome result appended); DIRECTORY_ABI_VERSION stays 6. Migration V159.
• #938 witnessed lineage: a new object ciris.lineage_head_cosign.v1 (lineage_witness::LineageHeadCosign; the domain label is a SIGNED member of its envelope — never confusable with ciris.sth_cosign.v1). Your replication bridge forwards cosigns through the capsule op / FederationDirectory::put_lineage_head_cosign (typed outcome: inserted | unchanged | held_for_unknown_head | refused{reason}; refusals witness_not_registered | witness_not_witness_type | witness_is_founder | signature_invalid | skew | head_instant_mismatch | prior_not_ancestor | malformed). The fold now serves a trust root's latest WITNESSED head (an unwitnessed extension is held; resolve_community reports witnessed, unwitnessed_tail, equivocation, witness_silent_since); two witnessed heads freeze the lineage at their fork and raise hard_case:lineage_equivocation. Mixed fleet: a lineage the witness plane has never cosigned is judged as before (ever_witnessed), so nothing un-roots on upgrade; once the first witness cosigns ciris-canonical, v50 peers still adopt unwitnessed heads first-seen-wins while v51 nodes hold them.
• #937 attach freshness: trust:accepts:v1 edges gain attached_head_digest; the gate (trust_root_head_stale, Python ValueError) is ARMED by the root's charter — a charter with no attach_window_secs (every charter in the field today) keeps the pre-rc6 edge shape; once the accord scrubs its charter with a window (7 d default), an edge must name the witnessed head. Attached never detaches (trust_root_valid reads none of it). Your pin path: pin_trust_from_bundle_response — Server#693 serves the head beside the bundle.
• #939 liveness: resolve_community.live (≥ M+1 active founders); a stalled root is valid but non-admitting; hard_case:community_liveness_stalled/restored at the transition; founding at N ≤ M refused (liveness_margin_at_founding).
• #922/#923 sealed descriptor: media.sealed_descriptor (one description: format/codec in clear XOR the seal; name never in clear beside a seal); Engine::seal_descriptor_for_blob(sha, key_id, plaintext) -> envelope bytes / open_descriptor_for_blob(sha, viewer, sealed) under the BLOB's DEK, AAD ciris.sealed_descriptor.v1 ‖ sha256, authorized exactly as read_blob_as. MediaSource.format is Option<String> (a Rust break). Producers must not emit the sealed media struct until every reader runs v51 (CIRISEdge#698 sequences after this).
• #941: the live owner of a node may withdraw a row that node attested (rule 1 lifted to the producer's principal), provided the issuer's owner binding was IN FORCE at the row's instant and no other owner's was (a binding is in force from asserted_at until its expiry or first withdrawal; A→B→A and a backdated re-binding are refused, a hand-off is admitted) — your files::withdraw of node-authored rows (files::publish signs the file row with the NODE key — a person's file is attested by a machine, and 'author only' cannot cross the owner's devices #675/fix(files): a file is authored by its person, co-signed by the node — author-only ops work across the owner's devices (#675) #708) is admitted on v51; v50 nodes still refuse it.
• #929: a federation-scope widening that strips delegation_purpose is WideningMalformed.
• #933: postgres-only; no wire change.

Changed in PR #943's review (16 Codex findings, all witnessed on memory, sqlite and postgres; CHANGELOG.md "Fixed in review"):

• A stalled trust root (fewer than M+1 active founders) is now VALID but non-admitting (CC 3.2 T7). resolve_community returns it with live: false, where v50 returned None. It stays the community arm of trust_root_valid, and a new member is refused with liveness_stalled_non_admitting.
• Witnessed mode engages only once a version reaches the charter's quorum. The quorum counts PERSONS: two keys of one person are one witness. A cosign counts only if its key was valid at its signed_at (new refusal witness_not_valid_at). A renewal (the same witness, a later signed_at) is a new row, not unchanged.
• Attach freshness compares against the WITNESSED head this node serves. lineage_head / lineage_head_json also answer for a constitutional family.
• Postgres projections run only for a row the insert stored.

The #923 amendments (CIRISEdge#710 D8/D9), in this tag:

• open_descriptor_for_blob(sha, viewer, sealed, caller_aad) (pyo3 caller_aad_b64=None): the blob is authenticated under the referencing ROW's associated data before the descriptor opens. Pass the row's data. A transplanted pointer, or one presented with no row data, is refused after authorization. This is a signature break.
• One access set per self/family stream: seal_stream_scoped wraps the manifest and every chunk to one recipient set and returns chunk_key_grant_emissions, which Engine::seal_stream_scoped emits. A caller sealing below the Engine door must emit them too. D9 is TESTED (I34b, sqlite and postgres).

Re-vendor (CIRISConstitution#129 → rc6 @ 651140a): capacity:relay_delivery:v1 ADMITS on v51 (edge-owned, reserved no-self-emit + analyze consent); :V1 refused (case), the bare stem refused (missing version), any other capacity: leaf refused (fenced). 149 families / 968 vectors; registry_sha256 c22dc087…; VENDORED_CC_VERSION 1.0-rc6. Your PERSIST_NAMESPACE_MANIFEST_VERSION pin does not move (VENDORED_MANIFEST_VERSION 0.3.0, TRANSFORM_ALGEBRA_HASH unchanged). CC 4.2.1.1 label cutover: persist ≥ 50 admits the lowercase accord:invoke:constitutional:…:v1 form only (the uppercase v1 label is namespace_dimension_case_malformed at admission); under dual-emit the holders' v2 rows reach every persist-50+ node while v1 rows keep flowing through persist-49 nodes for the window — persist's order is "v51 admits v2".

[emooreatx]

v33.0.0 tagged (3d90a88) on persist v51.0.0 + CIRISVerify 18.0.0 — every checklist item landed (see the release note). Follow-ups: files::rename (server ask) as v33.1.0; persist v51.1.0 adopt next.