fix(person): bind admitted memory rows and clarify publication outcomes (A4/A3)

[bitmaster162]

Exact stack and publication scope

A4 → A3, stacked on Draft PR #213. Not a PR directly against protected master. Owner approval covers publication of this exact two-commit chain and one Draft PR only. Merge, deployment and runtime activation are not authorized.

• Base branch: agent/person-export-actor-deny-local-r1 (fix(export): deny unsupported actor kinds (WO-01, stacked on #212) #213).
• Verified base HEAD: b11af1a69957e77accc0a6d74dedb7c4dab8ee28.
• Head branch: agent/person-a3-publication-result-local-r1.
• HEAD: 34d02e44104146beba7b174a88d58270606891fd.
• TREE: 41f31d9ce16693b47c392c31d1f4b845cc6b0f2e.
• Two exact commits: A4 fe04df409f86bc773d7210dbfaefa620afc3a231 (tree 8b52fb2e3986e2c159cbcf38e0e56497e0369b4a) → A3 34d02e44104146beba7b174a88d58270606891fd.
• Cumulative scope against fix(export): deny unsupported actor kinds (WO-01, stacked on #212) #213: 6 files, +652 / -3. No additional commits were generated for publication.

Both commit objects and their parent/tree identities were read back from GitHub after creating the new branch. The push used an empty expected-ref lease: creation only, never replacement of an existing remote branch. #211, #212, #213 and master are outside the write scope.

A4 — enforce the saved admission-to-memory-row binding

Reproduced predecessor behavior

A synthetic admission was persisted for mem:3. A distinct CURRENT row mem:4 with identical text, namespace and acceptable metadata could be selected by the intent. The real R21H path then produced ALLOW and sent mem:4 to a recording model client. Different text, different namespace, superseded metadata and missing-row controls were already denied.

This was a source-identity guarantee violation, not proof of cross-tenant disclosure or a live-model exploit.

Correction

• PersonTwinAdmissionStore.read_current_memory_binding_bytes() reads one verified persisted CURRENT snapshot. It receives no request/intent row id and does not manufacture admission from caller pins.
• Existing Person R21H compares exact canonical binding bytes with the intended row, namespace, candidate/source identities, and CURRENT pointer/candidate commitments, after R4 validation and before the selected Memory row is read.
• Missing, malformed, unavailable or mismatching binding is DENY; there is no legacy fallback. The same _read path is used for preparation and final prompt revalidation.
• Integration-contract change: an admission-store used by Person R21H must now provide this saved-binding read method. A plain R4-only store remains valid for R4 but is insufficient for the protected R21H path. Test fixtures bind their seeded row once, before creating intent/provider inputs.
• No new database/schema/authority issuer, no replacement Twin runtime, and no change to R3/R4 or the public R21H receipt schema.

A3 — distinguish an attempted publication from an acknowledged COMMIT

Reproduced predecessor behavior

An injected denial immediately before promotion COMMIT returned HOLD with an allocated publication_id, although no publication row existed. Candidate staging could already be committed. A failed post-COMMIT readback, conversely, could legitimately leave a persisted publication while returning HOLD.

Correction

Only _result changes in the A3 runtime delta (one line replaced by two):

• New attempt_publication_id retains the allocated attempt id, including uncertain outcomes, for later reconciliation.
• publication_id is emitted only when promotion COMMIT was acknowledged as CONFIRMED; otherwise it is null.
• A confirmed COMMIT followed by failed readback remains HOLD with its publication id retained. Unknown COMMIT retains only the attempt id. No automatic retry or invented rollback is introduced.
• Existing staging/promotion state fields, effect ceilings, transactions, guards, rollback handling, stored receipts, SQL schema and A4 binding behavior are unchanged.

Consumer-contract change: strict consumers of the outer admit() result must account for the additional field. A non-null publication_id is not fresh CURRENT, consent, READ authority, or production signoff.

Exact file scope

• continuityos/person_twin_admission_store.py: saved-binding read port and publication-result clarification.
• continuityos/person_twin_r21h_evidence.py: mandatory binding verification in the existing adapter.
• tests/test_person_twin_admission_store.py: A4 and A3 regressions; old test bodies retained.
• tests/test_person_twin_r21h_evidence.py: seeded binding support in the existing synthetic fixture; prior test bodies retained.
• docs/PERSON_R21H_MEMORY_BINDING_A4_R1.md: A4 contract, checks and limitations.
• docs/PERSON_ADMISSION_PUBLICATION_RESULT_A3_R1.md: attempted/confirmed publication contract and outcome matrix.

Local evidence — not new GitHub CI

Exact final local revision, Windows / Python 3.11.9, synthetic temporary SQLite databases and recording model clients only:

Evidence	Observed result
Eleven-file regression	423 passed, 2 skipped, 0 failed
New A4 targeted cases	31 passed (included in extended regression, not additive)
New A3 targeted cases	19 passed (included in extended regression, not additive)
Original unchanged A3/A4/backup-revoke-restore acceptance bodies	12 passed, 0 failed
Source CLI cos demo person-continuity --json	COS_DEMO_PERSON_CONTINUITY_PASS
Deterministic A4 scope audit	21 checks passed
Deterministic A3 scope audit	17 checks passed; 36 pure-result combinations checked

The two skips concern real filesystem symlink creation unavailable to that Windows process. They are not PASS. Backup → revoke → restore still denies READ before model generation with a current external revocation ledger; a deliberately stale ledger remains a trusted-input limitation, not a newly solved native witness problem. No cross-machine or authenticated-principal qualification is claimed.

Historical failed attempts are preserved: the first A4 candidate unnecessarily added a receipt field incompatible with the exact demo validator; the field was removed rather than relaxing validation. A separate A3 audit runner initially omitted SCHEMA; the runner was corrected outside product source and passed on the same runtime bytes. Original red reproductions remain separate from later green runs.

Publication preflight rechecked the clean branch, exact chain/scope, 728/728 tracked files against git archive, all 19 members of the sealed A3 manifest, and the bundle. A3 manifest SHA-256: a9260da827138bd08f467d7fed7b1b8d657d5344fbf4ff3137be6fd3f073e2fa. Two-commit bundle SHA-256: 00307649e2e255394a7957c5b72e6601243871000f436fa00a054bdb1bdd0b0d; prerequisite is the exact #213 HEAD. Unsigned commit hashes are not owner-identity attestations.

Qualification / next gate

LOCAL PASS WITH CONDITIONS. Fresh official Ubuntu/Windows CI, installed-wheel checks and independent review of these exact corrective diffs must be assessed separately. Prior Opus findings motivated the reproductions; Opus has not yet approved the finished A4/A3 patch. Deterministic author audits are not external independent review.

Keep Draft. No manual CI rerun, PR #211/#212/#213 edits, issue closure, merge, deployment, installation/runtime switch, Scheduler/TPM/service change, real personal-data ingestion, live-model call or trading is included. Reconcile exact stack SHA/tree, CI source provenance and independent review before any separately approved merge.

C0 HOLD; T11/T12 UNEXECUTED; NOT_PRODUCTION_ADMITTED; execution_authority=NONE; can_execute=false; can_trade=false; capital_permission=DENY.