docs(adr): define TEPP topic-lineage consumption boundary (TRSL-TM + CHRONOS/TDT)

AGENTS.md

@@ -34,7 +34,7 @@ reimplementing them:
   tree assembly (`reconstruct.py`'s `_walk`/`thread_messages` calls).
 - [RankWeave](https://github.com/ContextualWisdomLab/RankWeave) for
   multi-channel score fusion (`weighted_convex_fuse` in
-  `reconstruct.py`) and the buyer-facing Rankings port
+  `reconstruct.py`) and the reader-facing Rankings port
   (`rankweave_client.py`) -- never invent a fused score or a theta.
 - [TEPP](https://github.com/ContextualWisdomLab/TEPP)'s published wire
   contract for calibrated measurement (`tepp_client.py`) -- never
@@ -127,7 +127,7 @@ contextual-orchestrator owns model discovery and selection.
   retaining the original asset and provenance. Recognize image DOM/visual
   regions before OCR, descriptions, Keyman extraction, or embeddings. Store
   region-level evidence; never show an internal LLM instruction such as
-  `This post is an image` to a buyer.
+  `This post is an image` to a reader.
 
 ## Source parsing and semantic units
 
@@ -146,10 +146,10 @@ contextual-orchestrator owns model discovery and selection.
 - Remove presentation-only visual line alignment inside a paragraph (for
   example continuation lines manually aligned after `-`, `*`, `1.`, or `.`)
   from derived semantic text, while retaining the source body and meaningful
-  list/heading nesting. A buyer-facing post view must render semantic
+  list/heading nesting. A reader-facing post view must render semantic
   paragraphs, not the authoring application's spacing workaround.
 - Image descriptions, OCR text, and region evidence are analysis artifacts,
-  not buyer-facing prompt instructions. Buyer UI shows the source content and
+  not reader-facing prompt instructions. The workspace UI shows the source content and
   useful captions/evidence only, with provenance where appropriate.
 
 ## Pluggable channels: never fake a missing signal

ARCHITECTURE.md

@@ -64,7 +64,7 @@ flowchart LR
 | `chunking.py` | Splits a document into meaning-identifiable units (paragraph, sentence, DOM, conversation-turn) plus embedded-image extraction, in document order |
 | `embedding_client.py` | Pluggable text-embedding channel (`Null` default, `OpenAiCompatible` real impl) + `chunked_max_similarity` |
 | `adjudication_client.py` | Pluggable LLM-judgment channel (`Null` default, `ContextualOrchestrator` real impl) |
-| `image_content.py` | Pluggable vision channel: OCR + object recognition/tagging for embedded images (`Null` default, `OpenAiCompatibleVisionClient` real impl). The product popup (`frontend/src/PostBody.tsx`) renders each `data:image` payload in document order so the buyer sees the picture, not the base64 string; GET does not call the vision client. |
+| `image_content.py` | Pluggable vision channel: OCR + object recognition/tagging for embedded images (`Null` default, `OpenAiCompatibleVisionClient` real impl). The product popup (`frontend/src/PostBody.tsx`) renders each `data:image` payload in document order so the reader sees the picture, not the base64 string; GET does not call the vision client. |
 | `tepp_client.py` | TEPP's published `AnalysisRunRequest` wire contract, pluggable transport |
 | `rankweave_client.py` | Fail-closed RankWeave ranking port (`weighted_reciprocal_rank_fuse` in-process; never invent a fused score or a theta) |
 | `reconstruct.py` | The pipeline: group → candidate window → score → fuse → thread |
@@ -326,7 +326,7 @@ Keymen are affiliated with (`lineageweave/affiliate_tree.py`, loaded by
 set of those leaves, not the whole company directory -- a sibling the
 post never mentions is omitted. People on the tree are buttons that
 reuse `GET /api/keymen/{person_id}/related` so the popup Keyman walk
-starts from the affiliation the buyer clicked. A resolved organization
+starts from the affiliation the reader clicked. A resolved organization
 is the same walk via `GET /api/corporate-entities/{id}/related`. An affiliation that did not resolve to
 a `corporate_entity` row stays as its own root (`resolved=false`); that
 is the same never-guess-a-parent rule
@@ -467,15 +467,15 @@ truly have no dated open tickets.
 
 ## Phase 6-M2: authorized analysis-run evidence (read projection)
 
-Issue #79's first buyer-visible Milestone 2 slice is a source-redacting
+Issue #79's first reader-visible Milestone 2 slice is a source-redacting
 read of the #89 registry. `GET /api/analysis-runs` and
 `GET /api/analysis-runs/{id}` require `post_read` and apply the scope
 in SQL: the requester always sees their own run; a corporate-entity or
 process-unit scope is visible only to affiliated accounts; a
 thread-group scope is visible only when the account can already see a
 post in that group; `all_visible` is requester-only. Hidden runs 404. Detail also lists ABAC-visible post titles in the
 run's scope whose `created_at` is at or before `knowledge_cutoff`
-(ADR 0016) so a buyer can open a post the run was allowed to know
+(ADR 0016) so a reader can open a post the run was allowed to know
 without seeing later live rows or hidden bodies. Detail also returns
 revision and configuration digest prefixes.
 `POST /api/analysis-runs` records a Pending lineage run on a new
@@ -925,7 +925,7 @@ code. Wired into both `keyman_ingestion.py`'s affiliation loop and
 ## Standards-complete W3C PROV-O provenance layer
 
 ADR 0011 separates standards-complete provenance from the compact
-buyer-facing navigation graph. `lineageweave/prov_o.py` validates
+reader-facing navigation graph. `lineageweave/prov_o.py` validates
 and materializes all 50 normative PROV-O properties, including
 literal-valued times/values and qualified Influence resources.
 `migrations/0017_prov_o_standard_relations.sql` stores definitions,

CHANGELOG.d/2.12.6-frontend-build-gate.md

@@ -0,0 +1,3 @@
+## Fixed
+
+- Keep the unauthenticated login surface free of authenticated admin controls and remove unused OIDC imports so TypeScript production builds pass.

CHANGELOG.d/2.12.6-provider-error-boundary.md

@@ -0,0 +1,4 @@
+## Fixed
+
+- Keep contextual-orchestrator, OIDC, RankWeave, TEPP, and durable-ingestion diagnostics behind stable product error boundaries while retaining the original exception for server-side chaining.
+- Keep browser 5xx and transport failures behind the same stable client error boundary.

CHANGELOG.d/2.12.6-remove-self-modifying-repair-workflows.md

@@ -0,0 +1,5 @@
+## Fixed
+
+- Removed completed repair-only GitHub Actions that could write to feature
+  branches. Product fixes now require ordinary reviewed commits and the normal
+  protected Checks path.

CHANGELOG.d/2.12.7-lineage-dag-evidence.md

@@ -0,0 +1,8 @@
+### Changed
+
+- Made the buyer Event Lineage DAG explicitly directional with parent-to-child arrowheads whose paths stop outside node circles.
+- Preserved authored graph width behind a keyboard-focusable horizontal scroll region instead of shrinking deep lineages.
+- Added visible event dates, a redundant visual/text legend, and an accessible exact-value evidence table for lineage relations, dates, and fused scores.
+- Added five-locale buyer copy stating that reconstructed continuation edges do not prove causality or authoritative fact.
+- Replaced the internal "seed posts" empty-state language with an actionable five-locale instruction to add eligible source records and rebuild Event Lineage.
+- Added synthetic Storybook states for branching, selected-root, isolated-root, and empty lineage surfaces.

CHANGELOG.d/global-ask-history-compose-replay.md

@@ -0,0 +1,4 @@
+### Fixed
+
+- Replay the Global Ask conversation-history migration in the Compose database
+  initializer so existing volumes create the tables required by Ask history.

CHANGELOG.md

@@ -6,11 +6,83 @@ All notable changes to this project are documented here. Format follows
 
 ## [Unreleased]
 
+### Added
+
+- Playwright e2e harness (`frontend/playwright.config.ts`, `npm run
+  test:e2e`) with the ADR 0132 fail-closed spec
+  (`frontend/e2e/topic-lineage-fail-closed.spec.ts`): a seeded Failed
+  topic-lineage run must show its caption, connect-a-transport next
+  action, and detail-only failure code, and must render no
+  evidence/inference/prediction mark without a TEPP envelope. Skips
+  itself, with the ADR 0001/0042 reason named, on deployments holding
+  real source data.
+
+- Registered the `analysis_run_topic_lineage` analysis-run kind (migrations
+  0131/0132, ADR 0132), the LineageWeave-side consumption boundary for
+  TEPP's Temporal Relational Shared-Latent Topic Measurement (TRSL-TM,
+  TEPP ADR 0012) and CHRONOS/TDT event-intelligence status (TEPP ADR 0016).
+  It mirrors the existing TEPP measurement path exactly: submits through
+  `tepp_client`, fails closed (`tepp_not_available` /
+  `tepp_result_not_persisted`) until TEPP publishes a completed envelope,
+  and never computes a topic identity or event prediction locally.
+  `make seed` now also writes a Demo Corp topic-lineage run alongside the
+  existing lineage/TEPP/period-report rows.
+
+- `EvidenceStatusMark`, a reusable evidence/inference/prediction status
+  badge (ADR 0132 decision 5, TEPP ADR 0016) distinguishing status by label
+  text and glyph shape, not color alone. Ships ahead of the Event Lineage
+  DAG topic-thread wiring it is designed for, so review and Storybook
+  coverage (`Analysis/EvidenceStatusMark`) are available now; it is
+  presentational only and never infers a status itself.
+
+- Persisted Global Ask conversation history (ADR 0126, superseding the
+  non-persistence consequence in ADR 0090): migration
+  `0105_global_ask_conversation_history.sql` and
+  `backend/app/global_ask_history.py` store each account's questions,
+  answers, next actions, retrieved source posts, cited posts, and
+  reader-safe evidence facts, and re-apply current post visibility on
+  read so a revoked post drops from history while the stored answer
+  stays. Ask history now survives navigation and a new browser session
+  instead of living only in the client.
+
+### Changed
+
+- Renamed "Buyer" terminology to reader/workspace naming across the frontend
+  shell, backend evidence helpers, and living docs (ADR 0119). LineageWeave
+  has no explicit buyer role, so `BuyerNav`/`BuyerDestination` became
+  `WorkspaceNav`/`WorkspaceDestination`, `.buyer-gnb*` CSS became
+  `.workspace-gnb*`, and prose referring to the reading user now says
+  "reader" instead of "buyer". Historical ADRs and changelog entries keep
+  their original wording as a point-in-time record.
+
 ### Fixed
 
+- The post-detail dialog focus trap now excludes descendants of `aria-hidden`
+  content as well as collapsed `details`, keeping keyboard focus inside the
+  visible modal controls.
+
 - `make smoke` and `make seed` now run through the locked project `uv`
   environment, so local OIDC and synthetic-data workflows resolve the same
   pinned dependencies as CI.
+- The workspace Event Lineage global Search action now retries focus after the
+  board finishes loading, so navigation from Customer master, Calendar, or
+  Ask Agent lands the cursor in the search box. The handled request is consumed,
+  so later board navigation does not steal focus, and Search closes an open
+  mobile drawer like every other destination change.
+- Mobile Event Lineage evidence cards now read their translated column labels
+  from the rendered cells instead of hardcoded English CSS, and the two drawer
+  close controls have distinct accessible names.
+- Event Lineage SVG edges now retain their instance-specific direction markers,
+  so parent-to-child arrows remain visible when multiple lineage groups render.
+- All OpenAI-compatible chat-completion consumers now validate the shared
+  response envelope before parsing it, preventing malformed provider bodies
+  from escaping as raw `KeyError` or response-shape details.
+- Customer Master integration fixtures no longer reference the Global Ask
+  history migration for their own setup; they apply only the shipped
+  scope-facet migration directly, since Global Ask's persisted history
+  (see Added, ADR 0126) is unrelated to Customer Master scope fixtures.
+- The static SQL review contract now counts the Customer Master evidence query
+  that uses closed schema fragments and bound entity ids.
 
 ## [2.12.6] - 2026-08-20
 

CLAUDE.md

@@ -70,3 +70,22 @@ cited source. After that next action, the popup lands the first cited
 evidence. Changing the week first still
 focuses the report period field. Mean θ stays on the period-report
 panel.
+
+## Analysis-run topic lineage (ADR 0132)
+
+`make seed` also writes a Demo Corp topic-lineage run on the same shared
+snapshot, alongside the lineage, TEPP, and period-report rows. The
+topic-lineage kind (`analysis_run_topic_lineage`, migration 0131) submits
+through the same `tepp_client` boundary as TEPP (ADR 0022), requesting
+TEPP's Temporal Relational Shared-Latent Topic Measurement (TRSL-TM) and
+CHRONOS/TDT event-intelligence status instead of calibrated psychometric
+measurement. A missing transport or an unused accepted envelope is Failed
+(`tepp_not_available` / `tepp_result_not_persisted`), the same as TEPP. Do
+not invent a topic identity, a CHRONOS event prediction, or a local topic
+model of any kind. `POST /api/analysis-runs` still 422s this kind — Create
+does not invent a Pending topic-lineage row; connect a TEPP transport from
+a Failed topic-lineage row and re-run through
+`POST /api/analysis-runs/{id}/start`, exactly like TEPP. A Succeeded
+envelope persists into `analysis_run_topic_lineage_result` (migration 0132)
+as an opaque, versioned JSON envelope until TEPP's topic-identity/CHRONOS
+schema stabilizes into dedicated columns.

add_translations.py

@@ -39,7 +39,7 @@
 for eng, trans in translations.items():
     content = content.replace(f'    Refresh: "새로 고침",', f'    Refresh: "새로 고침",\n    "{eng}": "{trans["ko"]}",')
     content = content.replace(f'    Refresh: "조회",', f'    Refresh: "조회",\n    "{eng}": "{trans["ko"]}",')
-    
+
     content = content.replace(f'    Refresh: "刷新",', f'    Refresh: "刷新",\n    "{eng}": "{trans["zh"]}",')
     content = content.replace(f'    Refresh: "更新",', f'    Refresh: "更新",\n    "{eng}": "{trans["ja"]}",')
     content = content.replace(f'    Refresh: "Làm mới",', f'    Refresh: "Làm mới",\n    "{eng}": "{trans["vi"]}",')

backend/app/analysis_run_ingestion.py

@@ -34,11 +34,13 @@
 _LINEAGE_RUN_KIND = "analysis_run_lineage"
 _TEPP_RUN_KIND = "analysis_run_tepp"
 _REPORT_RUN_KIND = "analysis_run_report"
+_TOPIC_LINEAGE_RUN_KIND = "analysis_run_topic_lineage"
 _CORPORATE_SCOPE = "analysis_scope_corporate_entity"
 _CAPTURE_CONTRACT_VERSION = "analysis-run-capture-v1"
 _KIND_SCHEMA_VERSION = {
     "analysis_run_lineage": "lineage-run-v1",
     "analysis_run_tepp": "tepp-run-v1",
+    "analysis_run_topic_lineage": "topic-lineage-run-v1",
 }
 
 _RUN_LIST_SQL = f"""
@@ -249,7 +251,7 @@ async def fetch_outbox_deliveries(
     """Labeled claim/delivery events for one already-visible run.
 
     Missing outbox tables mean migration 0023 is not applied. Stream
-    entry ids stay off the payload -- they are not buyer evidence.
+    entry ids stay off the payload -- they are not reader-facing evidence.
     """
     try:
         rows = await conn.fetch(
@@ -285,7 +287,7 @@ async def _serialize_runs(
     conn: asyncpg.Connection,
     rows: list[asyncpg.Record],
 ) -> list[dict[str, Any]]:
-    """Project registry rows into the authorized buyer-facing payload."""
+    """Project registry rows into the authorized reader-facing payload."""
     if not rows:
         return []
     count_rows = await _counts_by_run(conn, [str(row["analysis_run_id"]) for row in rows])
@@ -346,7 +348,7 @@ async def fetch_visible_analysis_runs(
     """Runs the account requested or whose scope they may already walk.
 
     Once real source-import evidence is visible, the synthetic `make seed`
-    Demo Corp runs stop appearing here -- a buyer must not mistake that
+    Demo Corp runs stop appearing here -- a reader must not mistake that
     fabricated narrative for real evidence (ADR 0001 / ADR 0042).
     """
     # Safe SQL: this immutable module query contains only closed schema SQL; request values remain bound below.
@@ -611,18 +613,25 @@ def __init__(self, status_code: int, detail: str) -> None:
 
 
 def _require_lineage_create_kind(run_kind_code: str) -> None:
-    """Reject TEPP and report writes so this path cannot fake those products.
+    """Reject TEPP, topic-lineage, and report writes so this path cannot fake those products.
 
-    TEPP stays a ``tepp_client`` wire path. Period reports stay on the
-    Reports panel rebuild. A Pending TEPP row that never called the
-    transport is a fabricated measurement request.
+    TEPP and topic-lineage stay ``tepp_client`` wire paths (ADR 0022 /
+    ADR 0132). Period reports stay on the Reports panel rebuild. A Pending
+    TEPP or topic-lineage row that never called the transport is a
+    fabricated measurement request.
     """
     if run_kind_code == _TEPP_RUN_KIND:
         raise AnalysisRunCreateError(
             422,
             "Connect a TEPP transport from a Failed TEPP row; this endpoint "
             "does not invent a measurement.",
         )
+    if run_kind_code == _TOPIC_LINEAGE_RUN_KIND:
+        raise AnalysisRunCreateError(
+            422,
+            "Connect a TEPP transport from a Failed topic-lineage row; this "
+            "endpoint does not invent a topic model.",
+        )
     if run_kind_code == _REPORT_RUN_KIND:
         raise AnalysisRunCreateError(
             422,