Pre-push review: character-extraction (T-2229)

diff --git a/Asterism/Asterism/CharacterExtraction/CharacterExtractionCoordinator.swift b/Asterism/Asterism/CharacterExtraction/CharacterExtractionCoordinator.swiftnew file mode 100644index 0000000..97438f3--- /dev/null+++ b/Asterism/Asterism/CharacterExtraction/CharacterExtractionCoordinator.swift@@ -0,0 +1,482 @@+import AsterismCore+import AsterismIntelligence+import Foundation++/// Owns everything an extraction pass needs that is not the attempt itself: the+/// ledger, the in-flight `Task`, the library reads, the coverage write, and the+/// outcome the reader is shown after a manual pass.+///+/// `@MainActor` because the work page reads `held(for:)` and the manual-pass+/// outcome synchronously; the attempt runs in a `CharacterExtractor` actor, so+/// no model work touches this actor.+///+/// The shape is `RuleSuggestionCoordinator`'s deliberately — the two features+/// share the lane, the environment gates and the log split, and a second shape+/// for the same job would be a second set of bugs.+@MainActor @Observable+final class CharacterExtractionCoordinator {++    /// What a manual pass ended with (Req 1.11). Every ending the reader can see+    /// is one of these three: nothing else — a refusal, a timeout, an empty+    /// answer and a work that vanished all read as "no proposals available",+    /// because Req 1.8 forbids any of the causes reaching them.+    nonisolated enum ManualPassOutcome: Equatable, Sendable {+        case running+        case proposals(Int)+        case noProposals+    }++    /// Req 1.11: the manual trigger is not offered while the model is away.+    /// Re-read on every activation, because `.modelNotReady` is transient.+    private(set) var isModelAvailable: Bool++    /// The manual outcome per work, so the work page can show it and dismiss it+    /// without asking the coordinator to remember which page is open.+    private(set) var manualOutcomes: [UUID: ManualPassOutcome] = [:]++    private let library: any LibraryProviding+    private let model: any CharacterExtractionModelClient+    private let extractor: CharacterExtractor+    private let environment: any SuggestionEnvironment+    /// The app-wide model lane (Req 1.3, Q62). The ledger arbitrates this+    /// feature's own passes against each other; the lane arbitrates against rule+    /// suggestion's model work.+    private let lane: ModelLane++    private var ledger = CharacterExtractionLedger()+    /// The attempt is the coordinator's, never the caller's: a view that goes+    /// away must not cancel work the ledger has already recorded.+    private var attemptTask: Task<SourceOutcome, Never>?+    private var sweepTask: Task<Void, Never>?++    init(+        library: any LibraryProviding,+        model: any CharacterExtractionModelClient,+        environment: any SuggestionEnvironment = SystemSuggestionEnvironment(),+        lane: ModelLane = .shared,+        timeout: Duration = CharacterExtractionBounds.attemptTimeout+    ) {+        self.library = library+        self.model = model+        self.extractor = CharacterExtractor(model: model, timeout: timeout)+        self.environment = environment+        self.lane = lane+        self.isModelAvailable = model.availability().isAvailable+    }++    // MARK: - Reads++    /// The rows the review sheet shows for one work (Req 2.1).+    func held(for work: UUID) -> [ExtractionProposal] { ledger.held(for: work) }++    /// Whether the work's page shows the proposals indicator (Req 2.1).+    func hasProposals(for work: UUID) -> Bool { !ledger.held(for: work).isEmpty }++    var worksWithProposals: Set<UUID> { ledger.worksWithProposals }++    /// Req 1.11: hidden, not disabled — an action that can never do anything is+    /// not an action.+    var canRunManualPass: Bool { isModelAvailable }++    func manualOutcome(for work: UUID) -> ManualPassOutcome? { manualOutcomes[work] }++    func clearManualOutcome(for work: UUID) { manualOutcomes[work] = nil }++    /// What the run has spent on the sweep (Req 1.2). A manual pass charges+    /// nothing (Q101).+    var budgetSpent: Duration { ledger.budgetSpent }++    // MARK: - Decisions++    /// Drops the row a committed decision decided. One row per name key per work+    /// (Q83/Q100), so the key identifies it.+    func discard(nameKey: String, for work: UUID) {+        ledger.discard(nameKey: nameKey, for: work)+    }++    /// Q66/Q110: applies a `.reRouted` refusal's payload to the row it was+    /// about, so the refreshed sheet re-presents it against the character it+    /// really resolves onto rather than re-reading the row that just refused.+    func retarget(nameKey: String, for work: UUID, to characterID: UUID?) {+        ledger.retarget(nameKey: nameKey, for: work, to: characterID)+    }++    // MARK: - The activation sweep (Req 1.1, 1.2)++    /// One sweep per activation, bounded by `worksExamined` at the read and+    /// `worksPerActivation` at the model. Never awaited inline by the caller —+    /// the app's activation must not wait on model work (Req 1.2).+    ///+    /// Activations queue rather than collide, for the reason rule suggestion's+    /// do: `resignActive()` stops a sweep but cannot end it, so an app that comes+    /// straight back finds the previous coroutine still in its loop.+    func activationSweep() async {+        let previous = sweepTask+        let task = Task { [weak self] in+            await previous?.value+            await self?.runSweep()+        }+        sweepTask = task+        await task.value+        if sweepTask == task { sweepTask = nil }+    }++    private func runSweep() async {+        guard let generation = ledger.beginSweep() else { return }+        defer { ledger.endSweep(generation: generation) }++        let availability = model.availability()+        isModelAvailable = availability.isAvailable+        if case .unavailable(let reason) = availability {+            CharacterExtractionLog.note("sweep skipped — model unavailable: \(reason)")+            return+        }+        // Asked before the read, not after: with the budget spent every source+        // would be refused anyway, and the read is a whole-library fetch to be+        // told so.+        guard !ledger.budgetExhausted else {+            CharacterExtractionLog.note(+                "sweep skipped — run budget spent (\(CharacterExtractionLog.milliseconds(ledger.budgetSpent)) ms)")+            return+        }++        let candidates: [CharacterExtractionCandidate]+        do {+            candidates = try await library.characterExtractionCandidates(+                limit: CharacterExtractionBounds.worksExamined, workIDs: nil)+        } catch {+            // A library that is not ready yet skips this activation in silence+            // (Req 1.8); the next one tries again.+            CharacterExtractionLog.failure(+                "sweep skipped — candidate read failed: \(CharacterExtractionLog.describe(error))")+            return+        }++        // The read is already newest-activity-first and already excludes torn+        // works (Q53). What is left to bound is the model work.+        //+        // Q106: attempt memory joins coverage in the filter, exactly as rule+        // suggestion filters `!ledger.isAttempted` before its own prefix. A work+        // whose uncovered sources were *all* attempted this run — held undecided,+        // failed, or refused — is not going to produce anything this activation,+        // and on coverage alone it kept occupying one of the two slots on every+        // activation for the rest of the run, so the sweep never reached the work+        // behind it.+        let eligible = candidates+            .filter { candidate in+                candidate.uncoveredSources.contains { source in+                    !ledger.isAttempted(+                        ExtractionSourceKey(work: candidate.workID, source: source.ref))+                }+            }+            .prefix(CharacterExtractionBounds.worksPerActivation)+        CharacterExtractionLog.note(+            "sweep: \(eligible.count) of \(candidates.count) works have unattempted uncovered sources")++        for candidate in eligible {+            // A pre-emption or a resign-active ends *this* sweep; the next+            // activation restarts it.+            guard ledger.isSweeping(generation: generation) else { return }+            await process(candidate, pass: .automatic, sweep: generation)+        }+    }++    /// Req 2.8's invalidation hook, called after every library refresh — the+    /// same place rule suggestion's `reconcile()` is called from. The comparison+    /// is the ledger's; this only performs the read.+    func reconcile() async {+        let tracked = ledger.trackedWorks+        guard !tracked.isEmpty else { return }+        let rows: [CharacterExtractionCandidate]+        do {+            rows = try await library.characterExtractionCandidates(+                limit: tracked.count, workIDs: tracked)+        } catch {+            CharacterExtractionLog.failure(+                "reconcile skipped — candidate read failed: \(CharacterExtractionLog.describe(error))")+            return+        }+        var states: [UUID: WorkExtractionState] = [:]+        for row in rows {+            states[row.workID] = WorkExtractionState(+                revisions: row.revisionsBySource,+                characterIDs: Set(row.characters.map(\.id)))+        }++        let invalidated = ledger.reconcile(against: states)+        if !invalidated.isEmpty {+            CharacterExtractionLog.note("reconcile invalidated \(invalidated.count) work(s)")+            // A voided attempt's answer is discarded whatever it says; cancelling+            // only stops it sooner.+            attemptTask?.cancel()+        }+    }++    /// Req 1.2: the sweep stops with the foreground, and its attempt with it. A+    /// manual pass is the reader's and continues.+    func resignActive() {+        if ledger.resignActive() != nil { attemptTask?.cancel() }+    }++    /// Held proposals are re-derivable — their revisions are not covered — so+    /// they are the first thing to go under memory pressure (Q61).+    func memoryWarning() {+        if ledger.memoryWarning() != nil { attemptTask?.cancel() }+    }++    // MARK: - The manual pass (Req 1.11)++    /// The reader's pass over one work: every source regardless of coverage and+    /// suppression, starting even with the sweep budget spent, ending with a+    /// visible outcome.+    func runManualPass(workID: UUID) async {+        guard isModelAvailable else {+            CharacterExtractionLog.note("\(workID): manual pass refused — model unavailable")+            manualOutcomes[workID] = .noProposals+            return+        }+        manualOutcomes[workID] = .running++        let candidate: CharacterExtractionCandidate?+        do {+            candidate = try await library+                .characterExtractionCandidates(limit: 1, workIDs: [workID]).first+        } catch {+            CharacterExtractionLog.failure(+                "\(workID): manual pass — candidate read failed: \(CharacterExtractionLog.describe(error))")+            manualOutcomes[workID] = .noProposals+            return+        }+        guard let candidate else {+            // Gone, or torn — the read excludes torn works (Q53). Both read to+            // the reader as no proposals available.+            CharacterExtractionLog.note("\(workID): manual pass — the library returned no row")+            manualOutcomes[workID] = .noProposals+            return+        }++        await process(candidate, pass: .manual)++        let held = ledger.held(for: workID)+        manualOutcomes[workID] = held.isEmpty ? .noProposals : .proposals(held.count)+    }++    // MARK: - One work++    /// Every source of one work, in one pass, with the coverage its+    /// produced-none sources earned written once at the end (Q65).+    ///+    /// `sweep` is the generation of the sweep this pass belongs to, and nil for+    /// the reader's own pass, which no stop signal ends (Req 1.11).+    private func process(+        _ candidate: CharacterExtractionCandidate, pass: ExtractionPassKind,+        sweep generation: Int? = nil+    ) async {+        let context = CharacterExtractionContext(candidate)+        let revisions = candidate.revisionsBySource+        let sources = candidate.extractionSources(includingCovered: pass == .manual)+        var covered: [CharacterCompletedSource] = []++        for source in sources {+            // Q110: the stop signal is checked **per source**, not per work. A+            // work with several sources was otherwise a window of one attempt+            // timeout per remaining source in which `resignActive()` had stopped+            // the sweep and the sweep kept starting fresh requests anyway — and+            // after a manual pass pre-empted one source, the sweep retook the+            // slot on the next and the two cancelled each other in turn.+            //+            // Breaking rather than returning, so the sources already settled as+            // produced-none still earn their coverage below: they were processed,+            // and re-deriving them next activation would spend the budget to+            // produce the same nothing.+            if let generation, !ledger.isSweeping(generation: generation) {+                CharacterExtractionLog.note(+                    "\(candidate.workID): sweep stopped — remaining sources left for the next one")+                break+            }+            let outcome = await attempt(+                source, context: context, revisions: revisions, pass: pass)+            if outcome == .producedNone {+                covered.append(+                    CharacterCompletedSource(ref: source.source, fingerprint: source.fingerprint))+            }+        }++        guard !covered.isEmpty else { return }+        do {+            let written = try await library.advanceCharacterCoverage(+                workID: candidate.workID, sources: covered)+            CharacterExtractionLog.note(+                "\(candidate.workID): produced-none covered \(written) of \(covered.count) source(s)")+        } catch {+            // Coverage is bookkeeping: losing the advance costs the next sweep a+            // re-derivation the filter will empty again, never reader data.+            CharacterExtractionLog.failure(+                "\(candidate.workID): coverage advance failed — \(CharacterExtractionLog.describe(error))")+        }+    }++    /// How one source's attempt ended, in the only terms the caller acts on.+    private nonisolated enum SourceOutcome: Sendable, Equatable {+        /// Grounded and filtered to nothing: covers at pass time (Q65).+        case producedNone+        /// Rows the reader will decide on; the decision covers the source.+        case produced+        /// Failed, timed out, was refused, or never started. Left uncovered.+        case unsettled+    }++    private func attempt(+        _ source: ExtractionSource,+        context: CharacterExtractionContext,+        revisions: [SourceRef: String],+        pass: ExtractionPassKind+    ) async -> SourceOutcome {+        let key = ExtractionSourceKey(work: source.workID, source: source.source)+        let label = "\(source.workID)/\(CharacterExtractionLog.describe(source.source))"++        while true {+            switch ledger.start(+                key, fingerprint: source.fingerprint, pass: pass,+                environment: currentEnvironment+            ) {+            case .refuse(let reason):+                CharacterExtractionLog.note("\(label): \(pass.rawValue) refused — \(reason)")+                return .unsettled+            case .preempt(let preempted):+                // The two-step protocol: the ledger will not swap the in-flight+                // record itself, so the running attempt is cancelled and awaited+                // — it settles itself on the way out — and only then asked again.+                CharacterExtractionLog.note(+                    "\(label): manual pass pre-empts the attempt for "+                        + CharacterExtractionLog.describe(preempted.source))+                await cancelInFlight()+            case .start:+                CharacterExtractionLog.note("\(label): attempt start (\(pass.rawValue))")+                let task = beginAttempt(+                    key: key, label: label, source: source, context: context,+                    revisions: revisions, pass: pass)+                attemptTask = task+                let outcome = await task.value+                if attemptTask == task { attemptTask = nil }+                return outcome+            }+        }+    }++    private func beginAttempt(+        key: ExtractionSourceKey,+        label: String,+        source: ExtractionSource,+        context: CharacterExtractionContext,+        revisions: [SourceRef: String],+        pass: ExtractionPassKind+    ) -> Task<SourceOutcome, Never> {+        // Built here rather than inside the `Task` below: a `[weak self]` inside+        // the task body would re-capture the binding `guard let self` produced,+        // and a reference to *that* from a nested concurrently-executing closure+        // is an error under the Swift 6 language mode. Out here `self` is the+        // real one, and the capture is the ordinary kind.+        let yieldToInteractiveWork: @Sendable () -> Void = { [weak self] in+            // Bound to a `let` before the nested task: a weak capture is a *var*+            // in its closure's context, and referencing one from concurrently-+            // executing code is an error under the Swift 6 language mode.+            guard let coordinator = self else { return }+            Task { @MainActor in coordinator.attemptTask?.cancel() }+        }+        return Task { [weak self] in+            guard let self else { return .unsettled }+            let laneClass: ModelLaneClass = pass == .manual ? .interactive : .background+            let token: LaneToken+            do {+                // Acquired per request, and released between sources: a rule+                // editor waiting on the lane behind a manual pass waits for at+                // most one in-flight source (design, lane section).+                token = try await self.lane.acquire(laneClass, onPreempt: yieldToInteractiveWork)+            } catch {+                // **A lane wait is not a settlement**: no budget charge and no+                // attempt memory, so the source stays retriable this run.+                CharacterExtractionLog.note("\(label): lane claim withdrawn before the request")+                self.settle(key, .cancelled, modelPhase: .zero, label: label)+                return .unsettled+            }+            defer { token.release() }++            let started = self.environment.now+            do {+                let outcome = try await self.extractor.attempt(source)+                let proposals = CharacterExtractionAssembler.assemble(+                    outcome.candidates, revisions: revisions, context: context, pass: pass)+                self.settle(+                    key, .proposals(proposals), modelPhase: outcome.modelPhase, label: label)+                return proposals.isEmpty ? .producedNone : .produced+            } catch is CancellationError {+                self.settle(+                    key, .cancelled, modelPhase: self.elapsed(since: started), label: label)+                return .unsettled+            } catch let timeout as AttemptTimeout {+                self.settle(key, .timedOut, modelPhase: timeout.modelPhase, label: label)+                return .unsettled+            } catch {+                // Req 1.5's oversized source and Req 1.8's refusals and decode+                // failures differ only here, in the line that says which it was.+                if self.model.isContextWindowOverflow(error) {+                    CharacterExtractionLog.note(+                        "\(label): source too long for one request — skipped, left uncovered")+                } else {+                    CharacterExtractionLog.failure(+                        "\(label): request failed — \(self.model.describe(error))")+                }+                self.settle(key, .failed, modelPhase: self.elapsed(since: started), label: label)+                return .unsettled+            }+        }+    }++    private func settle(+        _ key: ExtractionSourceKey, _ settlement: ExtractionSettlement,+        modelPhase: Duration, label: String+    ) {+        CharacterExtractionLog.note(+            "\(label): settled \(Self.describe(settlement)) after "+                + "\(CharacterExtractionLog.milliseconds(modelPhase)) ms")+        ledger.settle(key, settlement, modelPhase: modelPhase)+    }++    /// The next attempt may not start until this one has stopped (Req 1.3).+    private func cancelInFlight() async {+        guard let task = attemptTask else { return }+        task.cancel()+        _ = await task.value+        if attemptTask == task { attemptTask = nil }+    }++    private func elapsed(since start: ContinuousClock.Instant) -> Duration {+        start.duration(to: environment.now)+    }++    private var currentEnvironment: ModelWorkEnvironment { environment.modelWorkEnvironment }++    private static func describe(_ settlement: ExtractionSettlement) -> String {+        switch settlement {+        case .proposals(let proposals):+            proposals.isEmpty ? "no proposals" : "\(proposals.count) proposal(s)"+        case .failed: "failed"+        case .timedOut: "timed out"+        case .cancelled: "cancelled"+        }+    }++    #if DEBUG+    /// Spends the run's whole sweep budget, so a test can drive the one rule+    /// that separates the two passes: exhaustion stops automatic work and leaves+    /// the reader's pass alone (Req 1.11, Q101). Charging the ledger by hand is+    /// the only way there — the alternative is a 120-second test.+    func exhaustBudgetForTesting() {+        let key = ExtractionSourceKey(work: UUID(), source: .genericNotes)+        _ = ledger.start(+            key, fingerprint: "", pass: .automatic, environment: ModelWorkEnvironment())+        ledger.settle(key, .cancelled, modelPhase: CharacterExtractionBounds.runTimeBudget)+    }+    #endif+}

diff --git a/Asterism/Asterism/CharacterExtraction/CharacterExtractionLog.swift b/Asterism/Asterism/CharacterExtraction/CharacterExtractionLog.swiftnew file mode 100644index 0000000..d056755--- /dev/null+++ b/Asterism/Asterism/CharacterExtraction/CharacterExtractionLog.swift@@ -0,0 +1,62 @@+import AsterismCore+import Foundation+import OSLog++/// The character-extraction pipeline's diagnostic log (Req 1.9).+///+/// Everything this pipeline declines to do is invisible to the reader by+/// design — a source skipped for being too long, an attempt refused by the+/// model's guardrails, a work passed over for being torn, and a sweep that ran+/// out of budget all look exactly like "no proposals" (Req 1.8, 4.3). These+/// lines are the only place the reason survives.+///+/// Follow one run in Console.app with+/// `subsystem:me.nore.ig.Asterism category:CharacterExtraction`, or after the+/// fact with+/// `log show --predicate 'subsystem == "me.nore.ig.Asterism" AND category == "CharacterExtraction"' --last 10m`.+///+/// The body is `PipelineLog`'s, shared with rule suggestion — the privacy split+/// Q23 asks for is the same split, and two copies of it are two chances for one+/// of them to start logging reader content in a release build. What lives here+/// is the category, the name a call site reads, and the one thing only this+/// pipeline has to describe: a source.+///+/// `nonisolated` for the same reason `RuleSuggestionLog` is: the extractor runs+/// on its own actor, off the main one, and every static under this target's+/// default isolation would otherwise be main-actor bound.+nonisolated enum CharacterExtractionLog {+    static let pipeline = PipelineLog(category: "CharacterExtraction")++    static var logger: Logger { pipeline.logger }++    /// `reason` — work id, source kind, counts, durations, refusal causes — is+    /// always readable. `content` — note text, evidence spans, proposed names+    /// and statements — is readable only in a debug build (Req 1.9, Q23).+    static func note(+        _ reason: @autoclosure () -> String,+        content: @autoclosure () -> String? = nil,+        level: OSLogType = .default+    ) {+        pipeline.note(reason(), content: content(), level: level)+    }++    static func failure(+        _ reason: @autoclosure () -> String, content: @autoclosure () -> String? = nil+    ) {+        pipeline.failure(reason(), content: content())+    }++    static func describe(_ error: any Error) -> String { PipelineLog.describe(error) }++    static func milliseconds(_ duration: Duration) -> Int64 {+        PipelineLog.milliseconds(duration)+    }++    /// A source in a log line: never its text, only which source it is.+    static func describe(_ source: SourceRef) -> String {+        switch source {+        case .genericNotes: "generic notes"+        case .entry(let id): "entry \(id)"+        }+    }+}

diff --git a/Asterism/Asterism/CharacterExtraction/CharacterExtractor.swift b/Asterism/Asterism/CharacterExtraction/CharacterExtractor.swiftnew file mode 100644index 0000000..92252f2--- /dev/null+++ b/Asterism/Asterism/CharacterExtraction/CharacterExtractor.swift@@ -0,0 +1,62 @@+import AsterismCore+import AsterismIntelligence+import Foundation++/// One extraction attempt for one source: the model request, its bound, and the+/// grounding that follows it.+///+/// An actor, and deliberately not the main one — the model call must never run+/// on the actor the work page reads from (Req 1.2's "shall not delay app+/// activation" is the same rule stated from the reader's side). It owns no state+/// beyond its two dependencies; the ledger, the budget, the lane token and the+/// in-flight `Task` all live in the coordinator.+actor CharacterExtractor {+    private let model: any CharacterExtractionModelClient+    /// Injected so the timeout path is testable in milliseconds rather than in+    /// the 30 seconds `CharacterExtractionBounds` sets.+    private let timeout: Duration++    /// Main-actor isolated for the same reason `RuleSuggester`'s is, and at the+    /// same cost: under this target's `SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor`+    /// an actor's synchronous initializer cannot be made `nonisolated`. Only+    /// construction is pinned — the attempt itself is on this actor.+    init(+        model: any CharacterExtractionModelClient,+        timeout: Duration = CharacterExtractionBounds.attemptTimeout+    ) {+        self.model = model+        self.timeout = timeout+    }++    /// The grounded candidates one source produced, and what the attempt spent.+    ///+    /// Throws `AttemptTimeout` when the request outlived its bound and+    /// `CancellationError` when the app pre-empted it. Everything else the model+    /// can do wrong — a refusal, a decode failure, a source too long for one+    /// request — is thrown as it arrived and settled by the coordinator, because+    /// the three differ only in the log line (Req 1.8).+    func attempt(+        _ source: ExtractionSource+    ) async throws -> (candidates: [GroundedCandidate], modelPhase: Duration) {+        // Locals: `addTask`'s closure is not isolated to this actor, so reading+        // the stored properties inside it would need an `await` that the+        // closure's own suspension points make unnecessary.+        let model = self.model+        let timeout = self.timeout+        let started = ContinuousClock.now++        // The race itself is `withAttemptTimeout` — the same body `RuleSuggester`+        // bounds its pipeline with, so a timeout means the same thing on both.+        let result = try await withAttemptTimeout(timeout, startedAt: started) {+            try await model.extract(source)+        }++        let grounded = CharacterGrounding.ground(result, from: source)+        for drop in grounded.drops {+            CharacterExtractionLog.note(+                "\(CharacterExtractionLog.describe(source.source)): dropped a candidate — \(drop.reason.rawValue)",+                content: "name=\"\(drop.name)\"")+        }+        return (grounded.candidates, started.duration(to: .now))+    }+}

diff --git a/Asterism/Asterism/CharacterExtraction/CharacterReviewModel.swift b/Asterism/Asterism/CharacterExtraction/CharacterReviewModel.swiftnew file mode 100644index 0000000..3209cfd--- /dev/null+++ b/Asterism/Asterism/CharacterExtraction/CharacterReviewModel.swift@@ -0,0 +1,327 @@+import AsterismCore+import AsterismIntelligence+import Foundation+// For `OSLogType.info` on the one line below that asks for a level other than+// the default; the log body itself is `CharacterExtractionLog`'s.+import OSLog++// The review list (Reqs 2.1, 2.2, 2.5, 2.7, 2.8).+//+// Modelled on `PostTeachingWorkURLModel`'s queue: a list of independent+// decisions, each committed on its own, each failure keeping its own row and+// never touching the others.+//+// The one thing it does *not* share with that queue is refreshing. The sheet+// **snapshots its proposals at open** (Req 2.7): a sweep that settles while the+// reader is deciding must not move the list under them, so later results appear+// on the next open. The single in-place refresh is the commit-refusal+// disclosure, which is the case where what the reader is looking at is known to+// be wrong.++/// One proposed alias on a row, and whether the reader has struck it (Q92).+struct CharacterReviewAlias: Identifiable, Equatable, Sendable {+    let name: String+    var isStruck: Bool++    var id: String { name }+}++/// One proposed fact on a row, and whether it is still ticked (Req 2.2).+struct CharacterReviewFact: Identifiable, Equatable, Sendable {+    let id: String+    let statement: String+    let quote: String+    let source: SourceRef+    var isTicked: Bool+    let fact: CharacterFact+}++/// One row of the review list: a new candidate, or a bundle of additional+/// content for a character the work already has.+struct CharacterReviewRow: Identifiable, Equatable, Sendable {+    /// The proposal's name key. One row per key per work (Q83/Q100), so the key+    /// identifies the row for every decision that follows.+    let id: String+    let name: String+    let isBundle: Bool+    /// The character a bundle enriches, for the existing facts it is shown+    /// beside (Q38).+    let targetID: UUID?+    var aliases: [CharacterReviewAlias]+    var proposedFacts: [CharacterReviewFact]+    /// The target character's facts as they stand, so the reader can see what+    /// the bundle adds to (Req 2.1). Empty for a candidate.+    let existingFacts: [WorkCharacterFactRow]+    /// The held proposal this row was built from, so the decision request is+    /// assembled from the pipeline's own seam rather than re-derived here.+    let proposal: ExtractionProposal++    var struckAliases: Set<String> { Set(aliases.filter(\.isStruck).map(\.name)) }++    var untickedFacts: Set<CharacterFactIdentity> {+        Set(proposedFacts.filter { !$0.isTicked }.map(\.fact.identity))+    }+}++@MainActor @Observable+final class CharacterReviewModel: Identifiable {+    /// Presented with `sheet(item:)`, so the sheet comes and goes with the model+    /// rather than with a separate flag that can disagree with it.+    nonisolated var id: ObjectIdentifier { ObjectIdentifier(self) }++    /// The rows still undecided. Decided rows leave immediately; a refused+    /// acceptance keeps its row, because there is still a decision owed.+    private(set) var rows: [CharacterReviewRow] = []+    /// What the last refusal was, in the reader's words. Nil when nothing has+    /// been refused (Req 2.7's disclosure).+    private(set) var disclosure: String?+    /// Whether the disclosure has somewhere for the reader to go — only a torn+    /// refusal does (Req 2.8), and it routes where every torn record is+    /// resolved.+    private(set) var routesToCheckLibrary = false++    var isEmpty: Bool { rows.isEmpty }++    private let workID: UUID+    private var characters: [WorkCharacterPresentation]+    /// Q88's display order needs the notes' capture order, and a *proposed* fact+    /// has no `WorkCharacterPresentation` to have been ordered inside. Without+    /// it a merged row's facts came out in entry-UUID order — the pipeline's+    /// canonical order (Q75) — and contradicted the work page showing the same+    /// facts once they were kept.+    private var captureOrder: [UUID: Int]+    private let library: any LibraryProviding+    /// Told which row was decided, so the coordinator can drop it from what it+    /// holds.+    private let onDecision: @MainActor (String) -> Void+    /// Q66: where a `.reRouted` refusal's payload goes. The coordinator+    /// re-points the held row at the character the commit resolved onto, and+    /// only then is `refresh` worth re-reading.+    private let onReRoute: @MainActor (String, UUID?) -> Void+    /// The coordinator's held rows, for the one refresh Req 2.7 allows —+    /// **after** it has reconciled them (Q110). Async because that reconcile is+    /// a library read: the stale disclosure claims the list below is up to date,+    /// and the invalidation pass is the only thing that can make it so.+    private let refresh: @MainActor () async -> [ExtractionProposal]+    private var isSubmitting = false++    init(+        workID: UUID,+        proposals: [ExtractionProposal],+        characters: [WorkCharacterPresentation],+        captureOrder: [UUID: Int] = [:],+        library: any LibraryProviding,+        onDecision: @escaping @MainActor (String) -> Void,+        onReRoute: @escaping @MainActor (String, UUID?) -> Void,+        refresh: @escaping @MainActor () async -> [ExtractionProposal]+    ) {+        self.workID = workID+        self.characters = characters+        self.captureOrder = captureOrder+        self.library = library+        self.onDecision = onDecision+        self.onReRoute = onReRoute+        self.refresh = refresh+        // Snapshot at open (Req 2.7).+        self.rows = proposals.map {+            Self.row(from: $0, characters: characters, captureOrder: captureOrder)+        }+    }++    // MARK: - Reader input++    func setTicked(_ isTicked: Bool, factID: String, in rowID: String) {+        guard let rowIndex = rows.firstIndex(where: { $0.id == rowID }),+              let factIndex = rows[rowIndex].proposedFacts.firstIndex(where: { $0.id == factID })+        else { return }+        rows[rowIndex].proposedFacts[factIndex].isTicked = isTicked+    }++    /// Q92: an alias is struck *before* deciding, and a struck one is neither+    /// installed by an accept nor suppressed by a skip.+    func setStruck(_ isStruck: Bool, alias: String, in rowID: String) {+        guard let rowIndex = rows.firstIndex(where: { $0.id == rowID }),+              let aliasIndex = rows[rowIndex].aliases.firstIndex(where: { $0.name == alias })+        else { return }+        rows[rowIndex].aliases[aliasIndex].isStruck = isStruck+    }++    /// Dismissing leaves undecided rows exactly where they are (Req 2.6): the+    /// coordinator still holds them, and the next open re-presents them.+    func dismiss() {+        disclosure = nil+        routesToCheckLibrary = false+    }++    // MARK: - Decisions (Req 2.2)++    func accept(_ rowID: String) async { await decide(rowID, action: .accept) }++    func skip(_ rowID: String) async { await decide(rowID, action: .skip) }++    private func decide(_ rowID: String, action: CharacterDecisionAction) async {+        guard !isSubmitting, let row = rows.first(where: { $0.id == rowID }) else { return }+        isSubmitting = true+        defer { isSubmitting = false }+        disclosure = nil+        routesToCheckLibrary = false++        let request = row.proposal.decisionRequest(+            workID: workID, action: action,+            struckAliases: row.struckAliases, untickedFacts: row.untickedFacts)++        let outcome: CharacterDecisionOutcome+        do {+            outcome = try await library.commitCharacterDecision(request)+        } catch {+            disclosure = "That could not be saved. Try again."+            CharacterExtractionLog.failure(+                "character decision failed — \(CharacterExtractionLog.describe(error))")+            return+        }++        switch outcome {+        case .committed:+            rows.removeAll { $0.id == rowID }+            onDecision(rowID)+        case .refused(let refusal):+            await handle(refusal, rowID: rowID, action: action)+        }+    }++    /// Req 2.7/2.8's disclosures, and the one in-place refresh the sheet does.+    private func handle(+        _ refusal: CharacterDecisionRefusal, rowID: String, action: CharacterDecisionAction+    ) async {+        switch refusal {+        case .staleSource:+            disclosure = "That note changed while this was waiting, so nothing was saved. "+                + "The list below is up to date."+            // Req 2.7/Q110: the refresh is what *makes* that sentence true. It+            // drives the coordinator's reconcile, which is the only thing that+            // drops the stale row; re-reading unreconciled held rows re-presented+            // the same row and earned the same refusal on the next Keep.+            await refreshRows()+        case .reRouted(let target):+            disclosure = "This turned out to belong to a character you already have, "+                + "so nothing was saved. It is shown against them now."+            // Q66: the refusal carries where the row actually resolves, and+            // applying it before the re-read is what makes the re-presentation+            // real. Without it the reader looped Keep → refuse → Keep.+            onReRoute(rowID, target)+            await refreshRows()+        case .torn(let characterID):+            disclosure = characterID == nil+                ? "This work exists in differing copies, so nothing can be added to it yet. "+                    + "Open Check Library to choose which copy to keep."+                : "That character exists in differing copies, so nothing can be added to them "+                    + "yet. Open Check Library to choose which copy to keep."+            routesToCheckLibrary = true+        case .workGone:+            disclosure = nil+            rows = []+            onDecision(rowID)+        }+        CharacterExtractionLog.note(+            "character \(action.rawValue) refused — \(String(describing: refusal))",+            level: .info)+    }++    /// The refreshed list, re-presented from what the coordinator now holds — so+    /// a candidate that has become a bundle is shown as one and the reader is+    /// not looped through the same refusal.+    ///+    /// **Both** halves are re-read (Q110). The coordinator reconciles before it+    /// answers, and the work's characters come back with the rows: the character+    /// a re-route resolved onto may have been created seconds ago by a sibling+    /// accept in this very sheet, and a bundle drawn against the open-time+    /// snapshot would be shown under the model's spelling with no existing facts+    /// beside it.+    private func refreshRows() async {+        let held = await refresh()+        if let detail = try? await library.workDetail(id: workID) {+            characters = detail.characters+            captureOrder = detail.captureOrder+        } else {+            // A failed read leaves the previous snapshot standing: an empty+            // character list would redraw every bundle as if its target held+            // nothing, which is a worse answer than a slightly old one.+            CharacterExtractionLog.failure(+                "character review refresh could not re-read the work's characters")+        }+        // Both kept per row, not per value: one row per name key per work+        // (Q83/Q100), and two rows proposing the same alias string — or the same+        // fact — are two decisions. Keyed globally, one row's strike travelled to+        // the other's on every refresh.+        //+        // Built with a uniquing rule rather than `uniqueKeysWithValues`: the+        // ledger's grain makes a repeated key impossible, and a view model is+        // not the place to make that guess fatal.+        let ticks = Dictionary(+            rows.map { row in+                (row.id, Dictionary(+                    row.proposedFacts.map { ($0.id, $0.isTicked) },+                    uniquingKeysWith: { first, _ in first }))+            },+            uniquingKeysWith: { first, _ in first })+        let strikes = Dictionary(+            rows.map { ($0.id, $0.struckAliases) }, uniquingKeysWith: { first, _ in first })+        rows = held.map { proposal in+            var row = Self.row(+                from: proposal, characters: characters, captureOrder: captureOrder)+            for index in row.proposedFacts.indices {+                // The reader's ticks survive the refresh: they decided those,+                // and the refusal was about the store, not about them.+                row.proposedFacts[index].isTicked =+                    ticks[row.id]?[row.proposedFacts[index].id] ?? true+            }+            for index in row.aliases.indices {+                row.aliases[index].isStruck =+                    strikes[row.id]?.contains(row.aliases[index].name) == true+            }+            return row+        }+    }++    // MARK: - Row construction++    private static func row(+        from proposal: ExtractionProposal, characters: [WorkCharacterPresentation],+        captureOrder: [UUID: Int]+    ) -> CharacterReviewRow {+        let targetID: UUID? = if case .existing(let id) = proposal.target { id } else { nil }+        let target = targetID.flatMap { id in characters.first { $0.id == id } }+        return CharacterReviewRow(+            id: proposal.nameKey,+            // A bundle is shown under the character's own name, not the model's+            // spelling of it: the reader knows them by what they called them.+            name: target?.name ?? proposal.name,+            isBundle: proposal.isBundle,+            targetID: targetID,+            aliases: proposal.proposedAliases.map {+                CharacterReviewAlias(name: $0, isStruck: false)+            },+            // Q88/AC 2.1's display order, applied here rather than upstream: the+            // pipeline's own order is Q75's canonical one (entries by UUID),+            // which is right for merging and encoding and wrong on screen. The+            // reader reads a character's facts as history, and the work page+            // shows exactly this order once they are kept.+            proposedFacts: proposal.facts+                .map { fact in+                    let stored = fact.storedFact+                    return CharacterReviewFact(+                        id: stored.displayRowID,+                        statement: fact.statement, quote: fact.quote, source: fact.source,+                        isTicked: true, fact: stored)+                }+                .sorted { left, right in+                    let leftTier = left.source.displayTier(captureOrder: captureOrder)+                    let rightTier = right.source.displayTier(captureOrder: captureOrder)+                    if leftTier != rightTier { return leftTier < rightTier }+                    if left.quote != right.quote { return left.quote < right.quote }+                    return left.statement < right.statement+                },+            existingFacts: target?.facts ?? [],+            proposal: proposal)+    }+}

diff --git a/Asterism/Asterism/ContentView.swift b/Asterism/Asterism/ContentView.swiftindex 69c95cc..d47fd6d 100644--- a/Asterism/Asterism/ContentView.swift+++ b/Asterism/Asterism/ContentView.swift@@ -206,11 +206,17 @@ struct ContentView: View {         // foreground. On-open and on-request work is the reader's and continues.         .onReceive(NotificationCenter.default.publisher(for: UIApplication.willResignActiveNotification)) { _ in             model.suggestions?.resignActive()+            // `character-extraction` Req 1.2, the same rule: the sweep stops with+            // the foreground. A manual pass is the reader's and continues.+            model.characterExtraction?.resignActive()         }         // Req 5.6: held suggestions are cheap to recompute and are the first         // thing to go under memory pressure.         .onReceive(NotificationCenter.default.publisher(for: UIApplication.didReceiveMemoryWarningNotification)) { _ in             model.suggestions?.memoryWarning()+            // Held proposals cost a sweep to re-derive and nothing to lose:+            // their revisions are not covered until a decision commits (Q61).+            model.characterExtraction?.memoryWarning()         }     } @@ -302,7 +308,13 @@ struct ContentView: View {                                 // the destination is declared *here* rather                                 // than beside the work's own below.                                 onSelectEntry: { selectedWorkChapterEntryID = $0 },-                                exportModel: model.markdownExportModel(forWork: workID))+                                exportModel: model.markdownExportModel(forWork: workID),+                                // `character-extraction`: the indicator, the+                                // review sheet and the manual pass. Only this+                                // route gets it — the Merge sheet's embedded+                                // copy of this screen is a preview of a work,+                                // not a place to decide about it.+                                extraction: model.characterExtraction)                                 .navigationDestination(item: $selectedWorkChapterEntryID) {                                     entryID in                                     entryDetail(for: entryID)

diff --git a/Asterism/Asterism/PipelineLog.swift b/Asterism/Asterism/PipelineLog.swiftnew file mode 100644index 0000000..09b36fe--- /dev/null+++ b/Asterism/Asterism/PipelineLog.swift@@ -0,0 +1,78 @@+import AsterismIntelligence+import Foundation+import OSLog++/// The diagnostic-log body both on-device model pipelines use.+///+/// Rule suggestion and character extraction each have the same problem: every+/// failure settles silently, so a hostname that produces no suggestion and a+/// source that produced no characters are indistinguishable from work that was+/// never attempted. The log lines are the only place the reason survives, and+/// both pipelines draw the same privacy split — the *reason* (hostname, work id,+/// step, counts, durations, refusal causes) is always readable, the *content*+/// (capture titles, URLs, note text, evidence spans, proposed names) only in a+/// debug build.+///+/// The two façades below it stay, because a call site should name the pipeline+/// it belongs to and each carries its own Console category.+///+/// `nonisolated` because both pipelines run their model work off the main actor,+/// and every member under this target's default isolation would otherwise be+/// main-actor bound.+nonisolated struct PipelineLog {+    let logger: Logger++    init(category: String) {+        logger = Logger(subsystem: "me.nore.ig.Asterism", category: category)+    }++    /// The `#if` has to wrap the whole call rather than a constant: `privacy:`+    /// accepts nothing but a literal member of `OSLogPrivacy` — not a variable,+    /// and not a static of our own ("argument must be a static method or+    /// property of 'OSLogPrivacy'").+    ///+    /// Both arguments are autoclosures and neither is evaluated until the level+    /// is known to be enabled. Every call site interpolates — a proposal's+    /// fields, an error stringified, a duration — and `Logger`'s own laziness+    /// cannot help with that, because the interpolation happens at the call+    /// site, before the message is ever handed over.+    func note(+        _ reason: @autoclosure () -> String,+        content: @autoclosure () -> String? = nil,+        level: OSLogType = .default+    ) {+        guard logger.isEnabled(type: level) else { return }+        // Bound to locals first: `OSLogMessage`'s interpolation is an *escaping*+        // autoclosure, and a non-escaping parameter cannot be captured by one.+        let reason = reason()+        guard let content = content() else {+            logger.log(level: level, "\(reason, privacy: .public)")+            return+        }+        #if DEBUG+        logger.log(level: level, "\(reason, privacy: .public) | \(content, privacy: .public)")+        #else+        logger.log(level: level, "\(reason, privacy: .public) | \(content, privacy: .private)")+        #endif+    }++    /// A step that failed with an error rather than an answer.+    func failure(+        _ reason: @autoclosure () -> String, content: @autoclosure () -> String? = nil+    ) {+        note(reason(), content: content(), level: .error)+    }++    /// The one spelling of a failure these logs use, shared with the package so+    /// a model client's default `describe(_:)` reads the same.+    static func describe(_ error: any Error) -> String {+        SuggestionFailure.describe(error)+    }++    /// Durations read better in the log as a plain millisecond count than as+    /// `Duration`'s "0.123 seconds".+    static func milliseconds(_ duration: Duration) -> Int64 {+        let components = duration.components+        return components.seconds * 1000 + components.attoseconds / 1_000_000_000_000_000+    }+}

diff --git a/Asterism/Asterism/RuleSuggestion/RuleSuggester.swift b/Asterism/Asterism/RuleSuggestion/RuleSuggester.swiftindex 5d97be8..2108af6 100644--- a/Asterism/Asterism/RuleSuggestion/RuleSuggester.swift+++ b/Asterism/Asterism/RuleSuggestion/RuleSuggester.swift@@ -93,32 +93,12 @@ actor RuleSuggester: RuleSuggesting {          // Steps 3–6 under the timeout, measured from the model request.         let started = ContinuousClock.now-        let outcome = try await withThrowingTaskGroup(of: PipelineOutcome.self) { group in-            group.addTask {-                .settled(try await self.run(corpus: corpus, basis: basis, hostname: hostname))-            }-            group.addTask {-                try await Task.sleep(for: self.timeout)-                return .timedOut-            }-            guard let first = try await group.next() else { throw CancellationError() }-            // Whichever lost is cancelled here and awaited on scope exit, so a-            // timeout is thrown only once the work has actually stopped.-            group.cancelAll()-            return first-        }--        switch outcome {-        case .settled(let suggestion):-            return (suggestion, started.duration(to: .now))-        case .timedOut:-            throw AttemptTimeout(modelPhase: started.duration(to: .now))+        // The race itself is `withAttemptTimeout` — the same body+        // `CharacterExtractor` bounds its request with.+        let suggestion = try await withAttemptTimeout(self.timeout, startedAt: started) {+            try await self.run(corpus: corpus, basis: basis, hostname: hostname)         }-    }--    private nonisolated enum PipelineOutcome: Sendable {-        case settled(RuleSuggestion?)-        case timedOut+        return (suggestion, started.duration(to: .now))     }      // MARK: - Steps 3–6

diff --git a/Asterism/Asterism/RuleSuggestion/RuleSuggestionCoordinator.swift b/Asterism/Asterism/RuleSuggestion/RuleSuggestionCoordinator.swiftindex 6802407..18c3d06 100644--- a/Asterism/Asterism/RuleSuggestion/RuleSuggestionCoordinator.swift+++ b/Asterism/Asterism/RuleSuggestion/RuleSuggestionCoordinator.swift@@ -31,6 +31,19 @@ struct SystemSuggestionEnvironment: SuggestionEnvironment {     var now: ContinuousClock.Instant { .now } } +extension SuggestionEnvironment {+    /// The three gates as a ledger reads them — one spelling, because both+    /// coordinators ask the same question of the same protocol and a+    /// disagreement between them would be a sweep gated differently from the+    /// other for no stated reason.+    var modelWorkEnvironment: ModelWorkEnvironment {+        ModelWorkEnvironment(+            isActive: isActive,+            isLowPowerMode: isLowPowerModeEnabled,+            thermalState: thermalState)+    }+}+ /// Owns everything a suggestion needs that is not the attempt itself: the /// ledger, the in-flight `Task`, the callers waiting on it, and the library /// read that produces a hostname's fingerprint.@@ -49,6 +62,10 @@ final class RuleSuggestionCoordinator {     private let model: any RuleSuggestionModelClient     private let suggester: any RuleSuggesting     private let environment: any SuggestionEnvironment+    /// The app-wide model lane (character-extraction Req 1.3, Q62). Rule+    /// suggestion's own ledger still arbitrates its three origins against each+    /// other; the lane arbitrates against the *other* feature's model work.+    private let lane: ModelLane      private var ledger = RuleSuggestionLedger()     /// The attempt is the coordinator's, never the caller's: cancelling whoever@@ -68,12 +85,14 @@ final class RuleSuggestionCoordinator {         library: any LibraryProviding,         model: any RuleSuggestionModelClient,         suggester: any RuleSuggesting,-        environment: any SuggestionEnvironment = SystemSuggestionEnvironment()+        environment: any SuggestionEnvironment = SystemSuggestionEnvironment(),+        lane: ModelLane = .shared     ) {         self.library = library         self.model = model         self.suggester = suggester         self.environment = environment+        self.lane = lane         self.isModelAvailable = model.availability().isAvailable     } @@ -296,7 +315,7 @@ final class RuleSuggestionCoordinator {                 await cancelInFlight()             case .start:                 RuleSuggestionLog.note("\(hostname): attempt start (\(origin.rawValue))")-                beginAttempt(hostname: hostname)+                beginAttempt(hostname: hostname, origin: origin)                 return await awaitAttempt()             }         }@@ -304,10 +323,31 @@ final class RuleSuggestionCoordinator {      // MARK: - The attempt Task -    private func beginAttempt(hostname: String) {-        attemptStartedAt = environment.now+    private func beginAttempt(hostname: String, origin: Origin) {+        // Deliberately not set until the lane is held: **a lane wait is not a+        // settlement**, so a claim cancelled while queued must charge nothing+        // (character-extraction Q68). `elapsedSinceStart()` reads zero until+        // `markAttemptStart()` runs.+        attemptStartedAt = nil         attemptTask = Task { [weak self] in             guard let self else { return }+            let token: LaneToken+            do {+                token = try await self.lane.acquire(ModelLaneClass(origin)) { [weak self] in+                    // The other feature's interactive work is asking this+                    // background attempt to yield: cancel and settle on the way+                    // out, which is the same two-step protocol this coordinator+                    // runs for its own pre-emptions.+                    Task { @MainActor in self?.attemptTask?.cancel() }+                }+            } catch {+                RuleSuggestionLog.note("\(hostname): lane claim withdrawn before the model call")+                self.settle(hostname: hostname, settlement: .cancelled, modelPhase: .zero)+                return+            }+            defer { token.release() }++            self.markAttemptStart()             do {                 let result = try await self.suggester.attempt(hostname: hostname)                 self.settle(@@ -326,6 +366,12 @@ final class RuleSuggestionCoordinator {         }     } +    /// The model phase starts when the lane is held, not when the attempt was+    /// asked for.+    private func markAttemptStart() {+        attemptStartedAt = environment.now+    }+     /// Only ever reached from the attempt's own `Task`, which is the only thing     /// that can end an attempt — so clearing the handles here cannot strand a     /// newer one: a new attempt starts only after this one has terminated.@@ -364,12 +410,7 @@ final class RuleSuggestionCoordinator {         return attemptStartedAt.duration(to: environment.now)     } -    private var currentEnvironment: RuleSuggestionEnvironment {-        RuleSuggestionEnvironment(-            isActive: environment.isActive,-            isLowPowerMode: environment.isLowPowerModeEnabled,-            thermalState: environment.thermalState)-    }+    private var currentEnvironment: ModelWorkEnvironment { environment.modelWorkEnvironment }      // MARK: - Candidate rows 

diff --git a/Asterism/Asterism/RuleSuggestion/RuleSuggestionLog.swift b/Asterism/Asterism/RuleSuggestion/RuleSuggestionLog.swiftindex b9577e8..07c398b 100644--- a/Asterism/Asterism/RuleSuggestion/RuleSuggestionLog.swift+++ b/Asterism/Asterism/RuleSuggestion/RuleSuggestionLog.swift@@ -1,4 +1,3 @@-import AsterismIntelligence import Foundation import OSLog @@ -14,66 +13,40 @@ import OSLog /// with /// `log show --predicate 'subsystem == "me.nore.ig.Asterism" AND category == "RuleSuggestion"' --last 10m`. ///+/// The body — the privacy split, the autoclosure laziness, the `describe` and+/// `milliseconds` spellings — is `PipelineLog`'s, shared with character+/// extraction. What lives here is the category and the name a call site reads.+/// /// `nonisolated` because the suggester runs on its own actor, off the main one /// (Req 5.1), and every static under this target's default isolation would /// otherwise be main-actor bound. nonisolated enum RuleSuggestionLog {-    static let logger = Logger(subsystem: "me.nore.ig.Asterism", category: "RuleSuggestion")+    static let pipeline = PipelineLog(category: "RuleSuggestion")++    static var logger: Logger { pipeline.logger }      /// `reason` — hostname, step, origin, error type, count, duration — is     /// always readable. `content` — capture titles, URLs, the text the model     /// copied out of them — is readable only in a debug build; a release build     /// leaves it to the logging system to redact.-    ///-    /// The `#if` has to wrap the whole call rather than a constant: `privacy:`-    /// accepts nothing but a literal member of `OSLogPrivacy` — not a variable,-    /// and not a static of our own ("argument must be a static method or-    /// property of 'OSLogPrivacy'").-    ///-    /// Both arguments are autoclosures and neither is evaluated until the level-    /// is known to be enabled. Every call site here interpolates — a proposal's-    /// four fields, a capture title looked back up in the basis, an error-    /// stringified — and `Logger`'s own laziness cannot help with that, because-    /// the interpolation happens at the call site, before the message is ever-    /// handed over.     static func note(         _ reason: @autoclosure () -> String,         content: @autoclosure () -> String? = nil,         level: OSLogType = .default     ) {-        guard logger.isEnabled(type: level) else { return }-        // Both are bound to locals first: `OSLogMessage`'s interpolation is an-        // *escaping* autoclosure, and a non-escaping parameter cannot be-        // captured by one.-        let reason = reason()-        guard let content = content() else {-            logger.log(level: level, "\(reason, privacy: .public)")-            return-        }-        #if DEBUG-        logger.log(level: level, "\(reason, privacy: .public) | \(content, privacy: .public)")-        #else-        logger.log(level: level, "\(reason, privacy: .public) | \(content, privacy: .private)")-        #endif+        pipeline.note(reason(), content: content(), level: level)     }      /// A step that failed with an error rather than an answer.     static func failure(         _ reason: @autoclosure () -> String, content: @autoclosure () -> String? = nil     ) {-        note(reason(), content: content(), level: .error)+        pipeline.failure(reason(), content: content())     } -    /// The one spelling of a failure this pipeline's logs use, shared with the-    /// package so a model client's default `describe(_:)` reads the same.-    static func describe(_ error: any Error) -> String {-        SuggestionFailure.describe(error)-    }+    static func describe(_ error: any Error) -> String { PipelineLog.describe(error) } -    /// Durations read better in the log as a plain millisecond count than as-    /// `Duration`'s "0.123 seconds".     static func milliseconds(_ duration: Duration) -> Int64 {-        let components = duration.components-        return components.seconds * 1000 + components.attoseconds / 1_000_000_000_000_000+        PipelineLog.milliseconds(duration)     } }

diff --git a/Asterism/Asterism/UITestLaunchSupport.swift b/Asterism/Asterism/UITestLaunchSupport.swiftindex f859624..1ce2a67 100644--- a/Asterism/Asterism/UITestLaunchSupport.swift+++ b/Asterism/Asterism/UITestLaunchSupport.swift@@ -40,6 +40,11 @@ enum UITestFixtureKind: Equatable {     /// reachable from a launch — nothing in the app can preserve a capture, only     /// the share extension can.     case pendingCaptures+    /// One work with notes that name people, so the extraction journey has+    /// something to ground against (`character-extraction`). The scripted client+    /// supplies the model's answer; the grounding, the assembly and every+    /// decision are the real ones.+    case characters     /// A wholly legal library whose captures span 31 calendar months     /// (`seedSpanningMonthsFixture`). The Stats page's All-time graph draws one     /// band per month and can outgrow its viewport; no other fixture here spans@@ -83,6 +88,8 @@ enum UITestLaunchSupport {     /// needs no second table. Matched after the exact `seeded-scale-m4`.     static let seededScaleM4ToleratedPrefix = "seeded-scale-m4-"     static let seededComposedScenario = "seeded-composed"+    /// The one work the character-extraction journey runs over.+    static let seededCharactersScenario = "seeded-characters"     /// The 31-month library the Stats All-time graph needs to be drawn at more     /// than one band.     static let seededSpanningMonthsScenario = "seeded-spanning-months"@@ -129,6 +136,59 @@ enum UITestLaunchSupport {     }     #endif +    /// `character-extraction`: which scripted extraction client this launch runs+    /// with. Absent means the on-device model, which is what production always+    /// uses — and what no UI test may use (design, Testing Strategy: the UI+    /// suites are stub-driven, so nothing there depends on the host having a+    /// model or on the model repeating itself, Req 1.7).+    static let extractionKey = "ASTERISM_UI_TEST_EXTRACTION"++    #if DEBUG || ASTERISM_PERFORMANCE_TESTING+    /// The characters the canned client proposes. They ground against the+    /// `seeded-characters` fixture's generic notes, so what the reader sees is+    /// the real grounding and assembly over a scripted model answer rather than+    /// a hand-built proposal list.+    ///+    /// Inside the guard with its only consumer: a release build has no scripted+    /// client to hand it to, and a fixture compiled into the shipping binary is+    /// dead weight that reads as production data.+    static let cannedExtractionResult = ExtractionResult(characters: [+        ExtractedCharacter(+            name: "Ada/Nightjar",+            facts: [+                ExtractedFact(+                    statement: "Ada keeps the lighthouse.",+                    quote: "Ada keeps the lighthouse"),+                ExtractedFact(+                    statement: "Ada is called Nightjar by the crew.",+                    quote: "the crew call her Nightjar"),+            ]),+        ExtractedCharacter(+            name: "Brede",+            facts: [+                ExtractedFact(+                    statement: "Brede rows the tender.",+                    quote: "Brede rows the tender")+            ]),+    ])++    static func characterExtractionClient(+        environmentProvider: any ProcessEnvironmentProviding = SystemProcessEnvironment()+    ) -> (any CharacterExtractionModelClient)? {+        switch environmentProvider.environment[extractionKey] {+        case "canned":+            return StubCharacterExtractionModelClient(result: cannedExtractionResult)+        case "empty":+            return StubCharacterExtractionModelClient(result: ExtractionResult(characters: []))+        case "unavailable":+            return StubCharacterExtractionModelClient(+                availability: .unavailable(reason: "UI test"))+        default:+            return nil+        }+    }+    #endif+     static func request(         environmentProvider: any ProcessEnvironmentProviding = SystemProcessEnvironment(),         temporaryDirectory: URL = FileManager.default.temporaryDirectory@@ -147,6 +207,8 @@ enum UITestLaunchSupport {             fixture = .scaleM4         case seededComposedScenario:             fixture = .composed+        case seededCharactersScenario:+            fixture = .characters         case seededSpanningMonthsScenario:             fixture = .spanningMonths         case seededPendingCapturesScenario:

diff --git a/Asterism/Asterism/ViewModels/AppLibraryModel.swift b/Asterism/Asterism/ViewModels/AppLibraryModel.swiftindex 3da6b15..73d82e4 100644--- a/Asterism/Asterism/ViewModels/AppLibraryModel.swift+++ b/Asterism/Asterism/ViewModels/AppLibraryModel.swift@@ -124,8 +124,8 @@ public final class AppLibraryModel {     /// The resolved configuration after successful bootstrap.     private var resolvedConfiguration: LibraryConfiguration?     private var repository: (any LibraryProviding)?-    /// Retains the concrete repository for backup export (conforms to BackupV5SnapshotProviding).-    private var backupRepository: (any BackupV5SnapshotProviding)?+    /// Retains the concrete repository for backup export (conforms to BackupV6SnapshotProviding).+    private var backupRepository: (any BackupV6SnapshotProviding)?     /// A pre-bootstrap failure used to fail closed on invalid debug launch input.     private let startupFailureMessage: String?     /// Seeds only a fresh, explicit temporary configuration used by UI tests.@@ -137,6 +137,11 @@ public final class AppLibraryModel {     /// in the test seams that publish a repository without one.     private(set) var suggestions: RuleSuggestionCoordinator? +    /// `character-extraction`: the run's held extraction proposals and the+    /// passes that produce them. Nil until the library is ready, for the same+    /// reason `suggestions` is.+    private(set) var characterExtraction: CharacterExtractionCoordinator?+     /// Production initializer: resolves the configuration from the App Group     /// identifier its bundle declares. Fails closed (→ unavailable) when App     /// Group resolution fails.@@ -301,6 +306,7 @@ public final class AppLibraryModel {             // repository that just opened. Nothing is attempted until an             // activation sweeps or an editor opens.             self.suggestions = Self.makeSuggestionCoordinator(library: repo)+            self.characterExtraction = Self.makeCharacterExtractionCoordinator(library: repo)             interruptedImport = await repo.interruptedImport()             // Before `refreshAll()`, so a capture this pass commits is in the             // first snapshots rather than waiting for the next activation, and@@ -318,6 +324,15 @@ public final class AppLibraryModel {             startSyncObservation(                 configuration: configuration, mirroring: await repo.mirroring)             scheduleLaunchReconcile()+            // `character-extraction` Req 1.1: a cold launch *is* the app becoming+            // active, but `didBecomeActive` fires while this is still opening —+            // `handleActivation()` sees a library that is not ready yet and+            // returns. Without this the first launch of a run sweeps nothing and+            // the reader waits for a second foregrounding. Never awaited, and a+            // later activation queues behind it rather than racing it.+            if let characterExtraction {+                Task { await characterExtraction.activationSweep() }+            }             Self.logger.debug("Library bootstrap completed")         } catch {             state = .unavailable(message: String(describing: error))@@ -374,6 +389,14 @@ public final class AppLibraryModel {         setAsideCaptureRows = []         drainReport = nil         drainReportNotice = nil+        // The run's model coordinators go with the repository they were built+        // over. `ContentView`'s resign-active and memory-warning handlers reach+        // them through this model whether or not a library is open, and a+        // coordinator left standing would drive candidate reads and coverage+        // writes against a store that has been shut down. Cleared before the+        // guard below, so a teardown with nothing open still forgets them.+        suggestions = nil+        characterExtraction = nil         guard let repository else { return }         await repository.shutdown()         self.repository = nil@@ -395,6 +418,12 @@ public final class AppLibraryModel {         if let suggestions {             Task { await suggestions.activationSweep() }         }+        // `character-extraction` Req 1.2, the same rule and the same reason. The+        // two sweeps queue against each other in the shared `ModelLane` rather+        // than here, so neither has to know the other exists.+        if let characterExtraction {+            Task { await characterExtraction.activationSweep() }+        }     }      /// The model client the run's suggestions are computed with. A UI test may@@ -411,6 +440,20 @@ public final class AppLibraryModel {             suggester: RuleSuggester(library: library, model: client))     } +    /// The model client the run's extraction passes are computed with. A UI test+    /// may substitute a scripted one; production always asks the on-device+    /// model. The lane is deliberately not a parameter: `ModelLane.shared` is+    /// the whole guarantee that one request runs at a time app-wide (Req 1.3).+    private static func makeCharacterExtractionCoordinator(+        library: any LibraryProviding+    ) -> CharacterExtractionCoordinator {+        var client: any CharacterExtractionModelClient = FoundationCharacterExtractionModelClient()+        #if DEBUG || ASTERISM_PERFORMANCE_TESTING+        if let scripted = UITestLaunchSupport.characterExtractionClient() { client = scripted }+        #endif+        return CharacterExtractionCoordinator(library: library, model: client)+    }+     // MARK: - Preserved captures (pending-capture-queue)      /// Builds the queue over the certified library, restores a report the reader@@ -603,6 +646,9 @@ public final class AppLibraryModel {         // `rule-suggestion` Req 5.5's single invalidation hook: every library         // mutation the app performs funnels through here (Q43).         await suggestions?.reconcile()+        // `character-extraction` Req 2.8's, and the same hook: a deleted work, a+        // deleted character and an edited note all arrive here.+        await characterExtraction?.reconcile()         dropSettledConflicts()     } @@ -1333,7 +1379,7 @@ public final class AppLibraryModel {         guard let repo = backupRepository, let config = resolvedConfiguration else { return nil }         let stagingDir = config.rootDirectory             .appending(path: "Library/Caches/BackupExports")-        let exporter = BackupV5Exporter(+        let exporter = BackupV6Exporter(             repository: repo,             stagingDirectory: stagingDir         )@@ -1446,6 +1492,43 @@ public final class AppLibraryModel {         }     } +    /// `character-extraction`: one work whose notes name people, so the+    /// extraction journey has something real to ground against.+    ///+    /// The text is chosen to make the scripted answer+    /// (`UITestLaunchSupport.cannedExtractionResult`) ground: every quote+    /// appears verbatim, and both halves of the slash-compound name appear, so+    /// the split produces a proposed alias the reader can strike (Decision 5,+    /// Q92). Nothing about the *proposals* is seeded — grounding, assembly,+    /// matching and every decision are the shipping ones.+    private func seedCharactersFixture(in repo: LibraryRepository) async throws {+        let entry = try await repo.capture(CaptureDraft(+            captureTitle: "Chapter 1 - The Lamp Room",+            captureTitleSource: .host,+            rawURLString: "https://characters.test/lamp/1",+            note: "Brede rows the tender out at dusk."))++        let work = try await repo.createWork(+            NewWorkDraft(displayTitle: "The Lamp Room", hostname: "characters.test"))+        let assignment = try await repo.entry(id: entry.id)+        _ = try await repo.moveEntry(+            entry.id,+            basis: EntryAssignmentBasis(entry: assignment),+            to: .existing(work.id))++        let reloaded = try await repo.work(id: work.id)+        _ = try await repo.updateWork(+            id: work.id,+            basis: WorkEditBasis(work: reloaded),+            draft: WorkMetadataDraft(+                displayTitle: reloaded.displayTitle,+                typeAssignment: reloaded.typeDisplay.assignment,+                genreTags: reloaded.genreTags,+                genericNotes: "Ada keeps the lighthouse, and the crew call her Nightjar. "+                    + "Brede rows the tender out at dusk."))+        Self.logger.debug("Seeded the character-extraction UI test fixture")+    }+     /// Preserves two captures in the disposable root's spool, exactly as the     /// share extension would have: one the drain commits, and one it can never     /// commit and therefore sets aside (Req 6.4).@@ -1534,6 +1617,11 @@ public final class AppLibraryModel {             #endif         } +        if fixture == .characters {+            try await seedCharactersFixture(in: repository)+            return+        }+         if fixture == .composed {             // Production opens through the app-role opener, so the composed             // fixture seeds through the ordinary bootstrap, which creates and

diff --git a/Asterism/Asterism/ViewModels/DuplicateResolutionModel.swift b/Asterism/Asterism/ViewModels/DuplicateResolutionModel.swiftindex 066cba5..f902347 100644--- a/Asterism/Asterism/ViewModels/DuplicateResolutionModel.swift+++ b/Asterism/Asterism/ViewModels/DuplicateResolutionModel.swift@@ -75,6 +75,15 @@ public final class DuplicateResolutionModel {         return []     } +    /// `character-extraction` Req 6.5: a torn character discloses and resolves+    /// through this sheet, exactly as a torn Work or Entry does — chosen-only,+    /// with no union (the `.work` arm's write shape, not the `.entry` arm's+    /// note-append).+    public var characterVariants: [CharacterVariantChoice] {+        if case .character(_, let variants, _, _) = contract { return variants }+        return []+    }+     public var differingFields: [DuplicateResolutionField] { contract?.differingFields ?? [] }      public var canConfirm: Bool {

diff --git a/Asterism/Asterism/ViewModels/EntryDetailModel.swift b/Asterism/Asterism/ViewModels/EntryDetailModel.swiftindex 223372d..b67baa0 100644--- a/Asterism/Asterism/ViewModels/EntryDetailModel.swift+++ b/Asterism/Asterism/ViewModels/EntryDetailModel.swift@@ -124,6 +124,18 @@ public final class EntryDetailModel {      public var supportsTitleRecovery: Bool { capabilities.supportsSegmentTeaching } +    /// `character-extraction` Req 5.4: the characters holding a fact that cites+    /// this entry, in name order. Read off the teaching detail rather than+    /// fetched separately — it was populated in the same locked context as+    /// everything else on this screen, and a second read would describe a+    /// different moment.+    ///+    /// Empty is the ordinary case, and what makes the section absent rather than+    /// empty.+    public var citingCharacters: [EntryCitingCharacter] {+        teachingDetail?.citingCharacters ?? []+    }+     // MARK: - What the title card says (Q51)      /// The heading: the parsed chapter, falling back to the presentation title

diff --git a/Asterism/Asterism/ViewModels/MaintenanceViewModels.swift b/Asterism/Asterism/ViewModels/MaintenanceViewModels.swiftindex b647197..7b81dab 100644--- a/Asterism/Asterism/ViewModels/MaintenanceViewModels.swift+++ b/Asterism/Asterism/ViewModels/MaintenanceViewModels.swift@@ -277,8 +277,19 @@ public final class LibraryDiagnosticsModel {     /// Req 9.3's rows for a duplicate set: what it is, how many records, and     /// the route named rather than "no merge exists".     private static func row(_ item: DuplicateReviewItem) -> Row {-        let noun = item.recordType == .work ? "work" : "entry"-        let plural = item.recordType == .work ? "works" : "entries"+        // Three record types now, not two (`character-extraction` Req 6.5): the+        // work-else-entry ternary this replaces called a torn character an+        // entry, which sends the reader looking for a note that does not exist.+        let noun: String+        let plural: String+        switch item.recordType {+        case .work: (noun, plural) = ("work", "works")+        case .character: (noun, plural) = ("character", "characters")+        // The rule types never reach a review item — they collapse silently —+        // but the switch has to be total, and "entry" is what the ternary this+        // replaces already said about them.+        case .entry, .titleRule, .urlRule: (noun, plural) = ("entry", "entries")+        }         let problem: String         switch item.route {         case .sheet where item.isTorn:

diff --git a/Asterism/Asterism/ViewModels/SettingsBackupModel.swift b/Asterism/Asterism/ViewModels/SettingsBackupModel.swiftindex 78f7e78..86ac442 100644--- a/Asterism/Asterism/ViewModels/SettingsBackupModel.swift+++ b/Asterism/Asterism/ViewModels/SettingsBackupModel.swift@@ -5,19 +5,20 @@ import OSLog // MARK: - Backup Exporting Protocol  /// Test seam abstracting the exporter's operations needed by the Settings-/// surface. Conforms `BackupV5Exporter` to this protocol via extension below.+/// surface. Conforms `BackupV6Exporter` to this protocol via extension below. ///-/// Settings exports 5/6 (`configurable-work-types` Req 7.6): the archive has to-/// carry the configured type list, which the 4/4 format has no place for. The-/// 4/4 exporter is still declared — it is the format the app still *imports* —-/// but nothing in the app writes one any more.+/// Settings exports 6/7 (`character-extraction` Req 6.1): the archive has to+/// carry characters, their suppressions and their coverage, which the 5/6+/// format has no place for. The older exporters are still declared — those are+/// formats the app still *imports* — but nothing in the app writes one any+/// more. public protocol BackupExporting: Sendable {-    func export(metadata: BackupV5Metadata) async throws -> BackupExportResult+    func export(metadata: BackupV6Metadata) async throws -> BackupExportResult     func cleanup(_ result: BackupExportResult)     func scavengeStaleFiles() } -extension BackupV5Exporter: BackupExporting {}+extension BackupV6Exporter: BackupExporting {}  // MARK: - Settings Backup View Model @@ -78,7 +79,7 @@ public final class SettingsBackupModel {         currentResult = nil          do {-            let metadata = BackupV5Metadata(+            let metadata = BackupV6Metadata(                 appBuild: Self.currentAppBuild(),                 exportedAt: Date()             )@@ -91,7 +92,7 @@ public final class SettingsBackupModel {             state = .failed             // Privacy-safe: log only the error category, never user content             errorMessage = Self.privacySafeMessage(for: error)-            if let exportError = error as? BackupV5ExportError,+            if let exportError = error as? BackupV6ExportError,                case .tornGroups = exportError {                 routesToCheckLibrary = true             }@@ -136,7 +137,7 @@ public final class SettingsBackupModel {             "Backup export failed due to an encoding error. Please try again."         case is BackupValidationError:             "Backup validation failed. The export was not saved. Please try again."-        case let error as BackupV5ExportError:+        case let error as BackupV6ExportError:             exportMessage(for: error)         default:             "Backup export failed. Please try again."@@ -155,7 +156,12 @@ public final class SettingsBackupModel {     /// reader to retry while something settled; no such state can block an     /// export, because a torn group is divergent by definition and a divergent     /// set never resolves without the reader.-    private static func exportMessage(for error: BackupV5ExportError) -> String {+    ///+    /// The `tornGroups` arm now also covers a torn **character** group+    /// (`character-extraction` Req 6.5, Q105). It needs no new sentence: the+    /// payload carries a count and a route, not a record kind, and Check Library+    /// is where every torn group is resolved.+    private static func exportMessage(for error: BackupV6ExportError) -> String {         switch error {         case .tornGroups(let payload):             tornGroupsMessage(payload)

diff --git a/Asterism/Asterism/ViewModels/WorkDetailModel.swift b/Asterism/Asterism/ViewModels/WorkDetailModel.swiftindex d58405a..800b49a 100644--- a/Asterism/Asterism/ViewModels/WorkDetailModel.swift+++ b/Asterism/Asterism/ViewModels/WorkDetailModel.swift@@ -30,6 +30,45 @@ public final class WorkDetailModel {     /// Req 5.4, newest-first with cleaned display titles.     public var chapterRows: [WorkChapterRow] { presentation?.chapterRows ?? [] } +    // MARK: - Characters (`character-extraction` Reqs 3.2, 3.7, 5.1–5.3)++    /// The work's characters as the repository ordered them, with their facts in+    /// Q88's display order. Empty is the ordinary case, and what makes the+    /// section absent rather than empty (Req 5.1).+    public var characters: [WorkCharacterPresentation] { presentation?.characters ?? [] }++    /// Q88's capture order, for the surfaces that order facts the repository has+    /// not already ordered — the review sheet's proposed rows.+    public var captureOrder: [UUID: Int] { presentation?.captureOrder ?? [:] }++    /// The reader's intended state for each character, keyed by id.+    ///+    /// Captured at `load()` — **before** any `save()` reloads the screen (the+    /// task list's own note): a draft taken after the reload would be taken from+    /// the values the reload published, so an edit made before the metadata save+    /// would vanish without a trace.+    public private(set) var characterDrafts: [UUID: CharacterDraft] = [:]+    /// What each draft is compared against, and the basis the commit re-verifies+    /// (Q73).+    private var characterBases: [UUID: CharacterEditBasis] = [:]+    /// The order the reader performed things in (Q97). A combine followed by an+    /// edit of the target must reach the repository in that order.+    private var stagedCharacterOperations: [StagedCharacterOperation] = []+    /// Whether the last refused character step has somewhere for the reader to+    /// go — only a torn refusal does (Req 6.5).+    public private(set) var characterRefusalRoutesToCheckLibrary = false++    /// A staged operation, before the drafts it describes are read at commit.+    ///+    /// Creates and combines are recorded; updates and deletes are derived from+    /// the drafts at commit, because an edit made three times is still one+    /// update and recording each keystroke would send three.+    private enum StagedCharacterOperation: Equatable {+        case create(id: UUID)+        case delete(id: UUID)+        case combine(source: UUID, target: UUID)+    }+     /// Req 2.8, mirrored from Entry detail: a torn Work's authored fields are     /// read-only until its resolution. The repository refuses the write either     /// way (`updateWork` returns `.conflict(.torn)`), so this is not the@@ -107,6 +146,7 @@ public final class WorkDetailModel {             typeOptions = await pickerOptions(carrying: snapshot.typeDisplay)             draftTags = snapshot.genreTags             draftNotes = snapshot.genericNotes+            adoptCharacterDrafts(detail.characters)             state = .ready             await loadWorkURL()         } catch {@@ -299,6 +339,10 @@ public final class WorkDetailModel {     /// a draft like any other, so a cancel puts back what the last projection     /// gave the field.     public func cancelEditing() {+        // The mode goes first: the X *is* the reader's discard, and+        // `adoptCharacterDrafts` refuses to replace the drafts of a session that+        // is still open.+        isEditing = false         restoreDraftsFromSnapshot()         draftWorkURL = baselineWorkURL         errorMessage = nil@@ -306,7 +350,6 @@ public final class WorkDetailModel {         // explanation of why this Work has no suggestion is not a refusal, and         // stays.         refreshWorkURLStatusFromCandidate()-        isEditing = false     }      /// The editor's confirmation: saves where a draft differs, then leaves.@@ -326,15 +369,29 @@ public final class WorkDetailModel {             guard await commitWorkURLDraft() else { return }             committedURL = true         }-        if hasUnsavedChanges {-            await save()+        // Derived once. It JSON-encodes every character's facts to decide what+        // differs, and the state it reads cannot move between here and the+        // commit: `adoptCharacterDrafts` refuses to touch a staged session, and+        // the metadata save below skips its reload when a character step+        // follows.+        let characterOperations = stagedCharacterEdits()+        let hasCharacterChanges = !characterOperations.isEmpty+        let hadMetadataChanges = hasUnsavedChanges++        if hadMetadataChanges {+            // One reload, not two: the character step is the last write, so when+            // one follows, its reload is the one that publishes everything.+            await save(reloading: !hasCharacterChanges)             guard errorMessage == nil else { return }-        } else if committedURL {-            // The URL commit re-projects the field but not the presentation, and-            // view mode's link glyph reads the presentation.-            await load()         }+        guard await commitCharacterStep(characterOperations) else { return }++        // Dropped before the reload, so the re-adopt below is allowed to replace+        // the drafts with what the store now holds.         isEditing = false+        if hasCharacterChanges || (committedURL && !hadMetadataChanges) {+            await load()+        }     }      private func restoreDraftsFromSnapshot() {@@ -343,10 +400,234 @@ public final class WorkDetailModel {         draftAssignment = work.typeDisplay.assignment         draftTags = work.genreTags         draftNotes = work.genericNotes+        adoptCharacterDrafts(presentation?.characters ?? [])+    }++    // MARK: - The character edit session (Reqs 3.2, 3.7, 5.3)++    /// Whether the reader has a character edit session in progress — staged+    /// creates, deletes or combines (Q97), or a draft that no longer matches the+    /// basis it was taken from.+    ///+    /// **This is where the "do not clobber the drafts" invariant lives.** It+    /// used to live at the one call site that could trip it, as a+    /// capture-save-restore around the metadata save; stated here it holds for+    /// every reload, including ones added later.+    private var hasStagedCharacterSession: Bool {+        guard isEditing else { return false }+        if !stagedCharacterOperations.isEmpty { return true }+        return characterDrafts.contains { id, draft in+            guard let basis = characterBases[id] else { return false }+            return Self.differs(draft, from: basis)+        }+    }++    private func adoptCharacterDrafts(_ characters: [WorkCharacterPresentation]) {+        // A reload in the middle of an open session would replace the reader's+        // drafts with the stored values and drop the staged operations — the+        // edits this session exists to commit, gone without a trace. The reader+        // discards through the X, which leaves edit mode first.+        guard !hasStagedCharacterSession else { return }+        characterDrafts = Dictionary(+            uniqueKeysWithValues: characters.map { character in+                (character.id,+                 CharacterDraft(+                    name: character.name, note: character.note, aliases: character.aliases,+                    facts: character.facts.map(\.fact)))+            })+        characterBases = Dictionary(+            uniqueKeysWithValues: characters.map { ($0.id, $0.editBasis) })+        stagedCharacterOperations = []+        characterRefusalRoutesToCheckLibrary = false+    }++    public func characterDraft(for id: UUID) -> CharacterDraft? { characterDrafts[id] }++    /// The characters this session created, in the order the reader added them.+    ///+    /// Derived from the staged operations rather than from the draft dictionary:+    /// a dictionary has no order, and the screen sorting its keys by+    /// `uuidString` dropped each new row into a random place among the others.+    public var createdCharacterIDs: [UUID] {+        stagedCharacterOperations.compactMap { staged in+            guard case .create(let id) = staged, characterDrafts[id] != nil else { return nil }+            return id+        }+    }++    /// The seam the review sheet commits its decisions through — this screen's+    /// own, so the sheet and the page cannot end up on two repositories.+    /// Decisions commit independently of edit mode (Q37), which is why the sheet+    /// holds the library rather than routing through this model.+    public var libraryForReview: any LibraryProviding { library }++    /// Req 5.3's read-only gate, per character: a torn character is read-only+    /// until its resolution, and so is every character while the *work* is torn.+    public func canEditCharacter(id: UUID) -> Bool {+        guard !isReadOnly else { return false }+        return characters.first { $0.id == id }?.isTorn == false+    }++    /// Who this character may be combined into (Req 3.7): every other editable+    /// character of the work. A torn character refuses on either side, so it is+    /// offered on neither.+    public func combineTargets(for id: UUID) -> [WorkCharacterPresentation] {+        guard canEditCharacter(id: id) else { return [] }+        return characters.filter { $0.id != id && canEditCharacter(id: $0.id) }+    }++    public func updateCharacterDraft(id: UUID, _ edit: (inout CharacterDraft) -> Void) {+        guard var draft = characterDrafts[id] else { return }+        edit(&draft)+        characterDrafts[id] = draft+    }++    /// Deleting a fact is expressed by its absence from the draft (Q50): the+    /// commit suppresses the triple of every fact the basis had and the draft+    /// does not.+    public func deleteFact(_ identity: CharacterFactIdentity, from id: UUID) {+        updateCharacterDraft(id: id) { draft in+            draft.facts.removeAll { $0.identity == identity }+        }+    }++    @discardableResult+    public func addCharacter(named name: String) -> UUID {+        // A local id for the session only. The row's real UUID is minted by the+        // repository at commit, along with its retained key (Q46).+        let id = UUID()+        characterDrafts[id] = CharacterDraft(name: name)+        stagedCharacterOperations.append(.create(id: id))+        return id+    }++    public func deleteCharacter(id: UUID) {+        characterDrafts[id] = nil+        if let index = stagedCharacterOperations.firstIndex(of: .create(id: id)) {+            // Created and deleted in one session: neither ever existed, and+            // sending both would ask the repository to suppress a key it just+            // minted.+            stagedCharacterOperations.remove(at: index)+            return+        }+        stagedCharacterOperations.append(.delete(id: id))+    }++    /// Q97: staged in the edit session and discardable by its X until commit.+    /// The source leaves the page as soon as it is staged, so the reader sees+    /// what they asked for before it lands.+    public func combineCharacter(source: UUID, into target: UUID) {+        guard canEditCharacter(id: source), canEditCharacter(id: target) else { return }+        characterDrafts[source] = nil+        stagedCharacterOperations.append(.combine(source: source, target: target))+    }++    /// The session's operations, in the order the reader performed them.+    ///+    /// Updates and deletes of characters that already existed are derived here+    /// rather than recorded as they happen: an edit made three times is one+    /// update, and the draft is the intended state either way. Creates and+    /// combines carry their own position, because their order against each+    /// other is what Q97 is about.+    private func stagedCharacterEdits() -> [CharacterEditOperation] {+        var operations: [CharacterEditOperation] = []+        var handled: Set<UUID> = []+        for staged in stagedCharacterOperations {+            switch staged {+            case .create(let id):+                guard let draft = characterDrafts[id] else { continue }+                operations.append(.create(draft))+                handled.insert(id)+            case .delete(let id):+                guard let basis = characterBases[id] else { continue }+                operations.append(.delete(basis: basis))+                handled.insert(id)+            case .combine(let source, let target):+                guard let sourceBasis = characterBases[source],+                      let targetBasis = characterBases[target]+                else { continue }+                operations.append(.combine(source: sourceBasis, target: targetBasis))+                handled.insert(source)+            }+        }+        for (id, draft) in characterDrafts.sorted(by: { $0.key.uuidString < $1.key.uuidString }) {+            guard !handled.contains(id), let basis = characterBases[id] else { continue }+            guard Self.differs(draft, from: basis) else { continue }+            operations.append(.update(basis: basis, draft: draft))+        }+        return operations+    }++    /// A draft differs from its basis when the basis it *would* produce differs.+    /// Comparing through `CharacterEditBasis` rather than field by field is what+    /// makes a re-ordered fact list not a change: the basis canonicalises the+    /// facts and sorts the aliases (Q75), and the repository compares the same+    /// way.+    private static func differs(_ draft: CharacterDraft, from basis: CharacterEditBasis) -> Bool {+        CharacterEditBasis(+            characterID: basis.characterID, name: draft.name, note: draft.note,+            aliases: draft.aliases, facts: draft.facts) != basis+    }++    /// The one repository call the session's character changes go through.+    /// Returns false where the step refused, which keeps the editor open.+    private func commitCharacterStep(_ operations: [CharacterEditOperation]) async -> Bool {+        guard !operations.isEmpty else { return true }+        characterRefusalRoutesToCheckLibrary = false+        do {+            let outcome = try await library.commitCharacterEdits(+                workID: workID, operations: operations)+            switch outcome {+            case .committed:+                stagedCharacterOperations = []+                return true+            case .refused(let refusal):+                errorMessage = Self.characterRefusalMessage(refusal)+                if case .torn = refusal { characterRefusalRoutesToCheckLibrary = true }+                if case .workTorn = refusal { characterRefusalRoutesToCheckLibrary = true }+                state = .error(message: errorMessage ?? "")+                return false+            }+        } catch {+            errorMessage = error.localizedDescription+            state = .error(message: error.localizedDescription)+            Self.logger.error(+                "Character edit step failed: \(String(describing: error), privacy: .public)")+            return false+        }+    }++    /// Q73: the whole step refuses, and the message names the character so the+    /// reader knows which of their edits is the one in question.+    private static func characterRefusalMessage(_ refusal: CharacterEditRefusal) -> String {+        switch refusal {+        case .basisMismatch(_, let name):+            "\(name) changed elsewhere while you were editing, so nothing was saved. "+                + "Leave and come back to see the current version."+        case .torn(_, let name):+            "\(name) exists in differing copies, so nothing was saved. "+                + "Open Check Library to choose which copy to keep."+        case .workTorn:+            // Q104: a tear can sync in while the editor sits open, so the commit+            // re-checks the work. Without this arm the reader would be told+            // nothing about a refusal they can act on.+            "This work now exists in differing copies, so nothing was saved. "+                + "Open Check Library to choose which copy to keep."+        case .characterGone:+            "That character was deleted elsewhere, so nothing was saved."+        case .workGone:+            "This work was deleted elsewhere, so nothing was saved."+        }     }      /// Commits metadata edit. Suppresses duplicate submissions.-    public func save() async {+    public func save() async { await save(reloading: true) }++    /// - Parameter reloading: whether a successful write re-reads the screen.+    ///   False only inside `commitEditing()`, where a character step follows and+    ///   its own reload is the one that publishes both halves — two full+    ///   `workDetail` reads for one confirmation is one too many.+    private func save(reloading: Bool) async {         guard !isSubmitting else { return }         isSubmitting = true         state = .submitting@@ -375,11 +656,18 @@ public final class WorkDetailModel {                 return             }             await onMutation()-            await load()+            if reloading {+                await load()+            } else {+                state = .ready+            }         } catch {             errorMessage = error.localizedDescription-            // No optimistic mutation: restore from prior snapshot.-            restoreDraftsFromSnapshot()+            // The drafts stay, exactly as on the `.conflict` path above: nothing+            // was written, the editor is still open, and the draft is the only+            // copy of itself until it lands. Restoring from the snapshot here+            // re-adopted the stored characters and so silently threw away the+            // session's staged character operations as well as the typed fields.             state = .error(message: error.localizedDescription)             Self.logger.error("Work update failed: \(String(describing: error), privacy: .public)")         }

diff --git a/Asterism/Asterism/Views/CharacterReviewView.swift b/Asterism/Asterism/Views/CharacterReviewView.swiftnew file mode 100644index 0000000..d1264c4--- /dev/null+++ b/Asterism/Asterism/Views/CharacterReviewView.swift@@ -0,0 +1,174 @@+import AsterismCore+import ConstellationKit+import SwiftUI++/// The review list (Reqs 2.1, 2.2, 2.5, 2.7).+///+/// One section per candidate or bundle, each with its own Keep and Skip. The+/// list is a snapshot taken when the sheet opened, so nothing moves under the+/// reader while they decide.+struct CharacterReviewView: View {+    @Bindable var model: CharacterReviewModel+    let onDone: () -> Void+    /// Where a torn refusal sends the reader (Req 2.8).+    let onCheckLibrary: () -> Void++    var body: some View {+        NavigationStack {+            Group {+                if model.isEmpty {+                    completeContent+                } else {+                    reviewContent+                }+            }+            .navigationTitle("Suggested characters")+            .toolbar {+                // Every row commits on its own, so this button commits nothing —+                // it leaves the list, and undecided rows stay for a later visit+                // (Req 2.6). That is a close, and it renders as the platform's X.+                ToolbarItem(placement: .cancellationAction) {+                    Button(role: .close) {+                        model.dismiss()+                        onDone()+                    }+                    .frame(+                        minWidth: AsterismLayout.minHitTarget,+                        minHeight: AsterismLayout.minHitTarget)+                    .accessibilityIdentifier("character-review-done")+                    .accessibilityLabel("Done")+                }+            }+        }+    }++    private var reviewContent: some View {+        Form {+            Section {+                Label(+                    "Suggested from your notes — review before keeping",+                    systemImage: "sparkles")+                    .font(.footnote)+                    .foregroundStyle(AsterismColors.amberText)+                    .accessibilityElement(children: .combine)+                    .accessibilityIdentifier("character-review-banner")+            }++            if let disclosure = model.disclosure {+                Section {+                    Text(disclosure)+                        .font(.footnote)+                        .foregroundStyle(AsterismColors.amberText)+                        .accessibilityIdentifier("character-review-disclosure")+                    if model.routesToCheckLibrary {+                        Button("Open Check Library", action: onCheckLibrary)+                            .frame(minHeight: AsterismLayout.minHitTarget)+                            .accessibilityIdentifier("character-review-check-library")+                    }+                }+            }++            ForEach(model.rows) { row in+                Section(header: ConstellationSectionHeader(row.name, accent: .cyan)) {+                    rowContent(row)+                }+            }+        }+    }++    @ViewBuilder+    private func rowContent(_ row: CharacterReviewRow) -> some View {+        if row.isBundle {+            Text("Adds to a character you already have.")+                .font(.caption)+                .foregroundStyle(.secondary)+                .accessibilityIdentifier("character-review-bundle-note")+        }++        ForEach(row.aliases) { alias in+            // Q92: shown and strikeable before accepting, never installed+            // silently. "A/B" in these notes is as often a pairing as a second+            // name for one person, and a wrong alias would mis-route for ever.+            Toggle(isOn: aliasBinding(row: row, alias: alias)) {+                Text("Also known as \(alias.name)")+                    .strikethrough(alias.isStruck)+                    .foregroundStyle(alias.isStruck ? AnyShapeStyle(.secondary)+                                                    : AnyShapeStyle(.primary))+            }+            .frame(minHeight: AsterismLayout.minHitTarget)+            .accessibilityIdentifier("character-review-alias-\(alias.name)")+        }++        ForEach(row.proposedFacts) { fact in+            Toggle(isOn: factBinding(row: row, fact: fact)) {+                VStack(alignment: .leading, spacing: 4) {+                    Text(fact.statement)+                    Text("“\(fact.quote)”")+                        .font(.caption)+                        .foregroundStyle(.secondary)+                }+            }+            .frame(minHeight: AsterismLayout.minHitTarget)+            .accessibilityIdentifier("character-review-fact-\(fact.id)")+        }++        if row.proposedFacts.isEmpty, row.aliases.isEmpty {+            Text("A name, with nothing said about them yet.")+                .font(.caption)+                .foregroundStyle(.secondary)+                .accessibilityIdentifier("character-review-name-only")+        }++        // Req 2.1: a bundle is shown *beside* what the character already holds,+        // so the reader can see what is being added to rather than guessing.+        if !row.existingFacts.isEmpty {+            DisclosureGroup("Already kept (\(row.existingFacts.count))") {+                ForEach(row.existingFacts) { fact in+                    Text(fact.statement)+                        .font(.caption)+                        .foregroundStyle(.secondary)+                }+            }+            .accessibilityIdentifier("character-review-existing-\(row.id)")+        }++        HStack(spacing: 12) {+            Button("Keep") {+                Task { await model.accept(row.id) }+            }+            .buttonStyle(.constellationPrimary)+            .accessibilityIdentifier("character-review-keep-\(row.id)")++            Button("Skip") {+                Task { await model.skip(row.id) }+            }+            .buttonStyle(.constellationSecondary)+            .accessibilityIdentifier("character-review-skip-\(row.id)")+        }+        .frame(maxWidth: .infinity)+    }++    private var completeContent: some View {+        ContentUnavailableView(+            "Nothing left to review",+            systemImage: "checkmark.circle",+            description: Text("You have decided every suggestion for this work."))+            .accessibilityIdentifier("character-review-complete")+    }++    private func aliasBinding(+        row: CharacterReviewRow, alias: CharacterReviewAlias+    ) -> Binding<Bool> {+        Binding(+            get: { !alias.isStruck },+            set: { model.setStruck(!$0, alias: alias.name, in: row.id) })+    }++    private func factBinding(+        row: CharacterReviewRow, fact: CharacterReviewFact+    ) -> Binding<Bool> {+        Binding(+            get: { fact.isTicked },+            set: { model.setTicked($0, factID: fact.id, in: row.id) })+    }+}

diff --git a/Asterism/Asterism/Views/DuplicateResolutionView.swift b/Asterism/Asterism/Views/DuplicateResolutionView.swiftindex fa8e5c0..002edfa 100644--- a/Asterism/Asterism/Views/DuplicateResolutionView.swift+++ b/Asterism/Asterism/Views/DuplicateResolutionView.swift@@ -89,6 +89,9 @@ struct DuplicateResolutionView: View {                 ForEach(model.workVariants) { variant in                     variantRow(id: variant.id) { workVariantContent(variant) }                 }+                ForEach(model.characterVariants) { variant in+                    variantRow(id: variant.id) { characterVariantContent(variant) }+                }             } header: {                 // Decision 1 and Q46: duplicate review is an                 // actionable-attention surface, and this header is the sheet's@@ -165,6 +168,41 @@ struct DuplicateResolutionView: View {         .accessibilityAddTraits(model.selectedVariantID == id ? [.isSelected] : [])     } +    /// `character-extraction` Req 6.5. The three things that tell one copy of a+    /// character from another: what they are called, what the reader wrote about+    /// them, and how much of it there is. The facts themselves are not listed —+    /// a divergent character can hold dozens, and the choice is between copies,+    /// not between facts.+    @ViewBuilder+    private func characterVariantContent(_ variant: CharacterVariantChoice) -> some View {+        VStack(alignment: .leading, spacing: 4) {+            Text(variant.name.isEmpty ? "(no name)" : variant.name)+                .font(.body)+                .accessibilityIdentifier("duplicate-variant-character-name")+            if !variant.note.isEmpty {+                Text(variant.note)+                    .font(.caption)+                    .foregroundStyle(.secondary)+                    .accessibilityIdentifier("duplicate-variant-character-note")+            }+            HStack(spacing: 8) {+                Text(Pluralisation.count(variant.factCount, "fact", "facts"))+                    .font(.caption)+                    .foregroundStyle(.secondary)+                    .accessibilityIdentifier("duplicate-variant-character-facts")+                if !variant.aliases.isEmpty {+                    Text("also \(variant.aliases.joined(separator: ", "))")+                        .font(.caption)+                        .foregroundStyle(AsterismColors.cyan)+                        .accessibilityIdentifier("duplicate-variant-character-aliases")+                }+            }+            Text(variant.firstCapturedAt, style: .date)+                .font(.caption2)+                .foregroundStyle(.tertiary)+        }+    }+     @ViewBuilder     private func entryVariantContent(_ variant: EntryVariantChoice) -> some View {         VStack(alignment: .leading, spacing: 4) {

diff --git a/Asterism/Asterism/Views/EntryDetailView.swift b/Asterism/Asterism/Views/EntryDetailView.swiftindex 122c49d..ef4242f 100644--- a/Asterism/Asterism/Views/EntryDetailView.swift+++ b/Asterism/Asterism/Views/EntryDetailView.swift@@ -143,6 +143,8 @@ struct EntryDetailView: View {                 .accessibilityIdentifier("entry-detail-delete-button")             } +            citingCharactersSection+             // Q49: last, and collapsed. The capture's site and the             // title-recovery actions — neither is something a reader needs             // while writing a note.@@ -316,6 +318,35 @@ struct EntryDetailView: View {         }     } +    /// `character-extraction` Req 5.4: who this note is about, where any+    /// character says so. Absent rather than empty — most notes name nobody the+    /// reader has kept, and an empty section on every entry would be noise on+    /// the screen where they write.+    ///+    /// A count rather than a list of statements: a character can cite one entry+    /// several times, and saying "3 facts" is more honest than the name three+    /// times. The facts themselves live on the work page, which is where they+    /// are edited.+    @ViewBuilder+    private var citingCharactersSection: some View {+        if !model.citingCharacters.isEmpty {+            Section {+                ForEach(model.citingCharacters) { character in+                    LabeledContent(character.name) {+                        Text(Pluralisation.count(character.factCount, "fact", "facts"))+                            .font(.caption)+                            .foregroundStyle(.secondary)+                    }+                    .accessibilityIdentifier("entry-detail-citing-character")+                    .accessibilityLabel(+                        "\(character.name), \(Pluralisation.count(character.factCount, "fact", "facts")) citing this note")+                }+            } header: {+                ConstellationSectionHeader("Characters", accent: .violet)+            }+        }+    }+     /// Q49's bottom disclosure: where the capture came from and what can be done     /// about a title that came out wrong — one collapsed group at the end of the     /// screen instead of two sections above the note.

diff --git a/Asterism/Asterism/Views/RecentView.swift b/Asterism/Asterism/Views/RecentView.swiftindex a776aa5..b89a3d1 100644--- a/Asterism/Asterism/Views/RecentView.swift+++ b/Asterism/Asterism/Views/RecentView.swift@@ -698,6 +698,14 @@ struct RecentDuplicatePlan: Equatable {     }      private static func text(for item: DuplicateReviewItem) -> String {+        // `character-extraction` Req 6.5: a torn character reaches this filter+        // like any other non-Entry set, and the work-shaped sentences below+        // would call it a work. It is resolved in the same sheet, so only the+        // noun changes.+        if item.recordType == .character {+            return "A character arrived more than once and the copies differ. "+                + "Choose which one to keep."+        }         switch item.route {         case .merge:             return "\(Pluralisation.count(item.memberIDs.count, "work is", "works are")) "

diff --git a/Asterism/Asterism/Views/WorkDetailView.swift b/Asterism/Asterism/Views/WorkDetailView.swiftindex 8be350d..5ffd72e 100644--- a/Asterism/Asterism/Views/WorkDetailView.swift+++ b/Asterism/Asterism/Views/WorkDetailView.swift@@ -42,19 +42,30 @@ struct WorkDetailView: View {     /// route, and a sheet is its own glass layer (§4) — so the host says which     /// it is rather than the screen assuming.     let showsSky: Bool+    /// `character-extraction`: the run's extraction state, or nil where the host+    /// has none — the Merge route's embedded copy of this screen, and every+    /// preview. Nil hides the indicator and the manual trigger entirely.+    let extraction: CharacterExtractionCoordinator?+    /// The review sheet, `@State`-owned so its snapshot survives a re-render+    /// (Req 2.7).+    @State private var reviewModel: CharacterReviewModel?+    /// Which character the combine picker is open for.+    @State private var combineSource: UUID?      init(         model: WorkDetailModel,         onResolveDuplicate: (() -> Void)? = nil,         onSelectEntry: ((UUID) -> Void)? = nil,         exportModel: MarkdownExportModel? = nil,-        showsSky: Bool = true+        showsSky: Bool = true,+        extraction: CharacterExtractionCoordinator? = nil     ) {         _model = State(initialValue: model)         _exportModel = State(initialValue: exportModel)         self.onResolveDuplicate = onResolveDuplicate         self.onSelectEntry = onSelectEntry         self.showsSky = showsSky+        self.extraction = extraction     }      var body: some View {@@ -89,6 +100,23 @@ struct WorkDetailView: View {         .onChange(of: model.isDeleted) { _, deleted in             if deleted { dismiss() }         }+        // Req 2.1's review list. Presented from the indicator, and it snapshots+        // its proposals at open (Req 2.7) — so a sweep settling behind it+        // changes nothing under the reader.+        .sheet(item: $reviewModel) { review in+            CharacterReviewView(+                model: review,+                onDone: {+                    reviewModel = nil+                    // A decision writes characters and coverage, so the page has+                    // to re-read to show what was kept.+                    Task { await model.load() }+                },+                onCheckLibrary: {+                    reviewModel = nil+                    onResolveDuplicate?()+                })+        }     }      // MARK: - The §6 layout@@ -97,10 +125,13 @@ struct WorkDetailView: View {     private func workContent(_ work: WorkSnapshot) -> some View {         List {             if model.isReadOnly { duplicateReviewSection }+            tornCharactersSection+            proposalsIndicatorSection              if model.isEditing {                 editHeaderSection                 editNotesSection+                editCharactersSection                 workURLSection                 urlIdentitySection                 manageSection@@ -109,6 +140,7 @@ struct WorkDetailView: View {                 pulseSection                 openLastNotedSection                 viewNotesSection(work)+                charactersSection                 chapterSection             } @@ -630,6 +662,386 @@ struct WorkDetailView: View {         }     } +    // MARK: - Characters (`character-extraction` Reqs 2.1, 5.1–5.3, 1.11)++    /// Req 6.5: torn characters are disclosed the way torn works are — in the+    /// same top slot, wearing the same amber border, routing to the same sheet.+    /// A torn character is otherwise only visible as a label deep in the+    /// characters section, which is not a disclosure the reader will meet.+    @ViewBuilder+    private var tornCharactersSection: some View {+        let torn = model.characters.filter(\.isTorn)+        if !torn.isEmpty {+            Section {+                VStack(alignment: .leading, spacing: 8) {+                    Text(torn.count == 1+                        ? "\(torn[0].name) arrived more than once and the copies differ."+                        : "\(torn.count) characters arrived more than once and their copies differ.")+                        .font(.callout)+                        .foregroundStyle(AsterismColors.primaryText)+                        .accessibilityIdentifier("work-detail-torn-characters-notice")+                    Text("Editing them is off until you choose which copy to keep — nothing has been lost.")+                        .font(.caption)+                        .foregroundStyle(AsterismColors.secondaryText)+                    if let onResolveDuplicate {+                        Button("Resolve copies") { onResolveDuplicate() }+                            .buttonStyle(.constellationSecondary)+                            .accessibilityIdentifier("work-detail-resolve-character-button")+                    }+                }+                .frame(maxWidth: .infinity, alignment: .leading)+                .padding(12)+                .constellationCard(borderColor: AsterismColors.attentionBorder)+                .constellationListRow()+            }+        }+    }++    /// Req 2.1's indicator, in the top slot the torn-work card already owns and+    /// wearing the same amber border: held proposals are the other thing on this+    /// screen that is waiting for a decision.+    ///+    /// Absent when nothing is held — a work with no characters and no proposals+    /// shows nothing character-related at all (Req 5.1, Q107's one exception+    /// being the manual-pass trigger).+    ///+    /// Absent in edit mode too (Q109), which is the gating `offersManualPass`+    /// already had: the sheet's completion reload rebuilds the character drafts,+    /// and that would silently destroy the staged session Q97 promises is+    /// discardable only by the reader's own X.+    @ViewBuilder+    private var proposalsIndicatorSection: some View {+        if let extraction, let work = model.work, !model.isEditing,+           extraction.hasProposals(for: work.id) {+            Section {+                VStack(alignment: .leading, spacing: 8) {+                    Label(+                        "\(Pluralisation.count(extraction.held(for: work.id).count, "character suggestion", "character suggestions")) from your notes",+                        systemImage: "sparkles")+                        .font(.callout)+                        .foregroundStyle(AsterismColors.primaryText)+                        // On the label, not on the card: a container's+                        // identifier is inherited by every descendant and would+                        // mask the button below it+                        // (`docs/agent-notes/testing.md`).+                        .accessibilityIdentifier("work-detail-character-proposals")+                    Text("Nothing is kept until you say so.")+                        .font(.caption)+                        .foregroundStyle(AsterismColors.secondaryText)+                    Button("Review suggestions") { openReview(workID: work.id) }+                        .buttonStyle(.constellationSecondary)+                        .accessibilityIdentifier("work-detail-review-characters-button")+                }+                .frame(maxWidth: .infinity, alignment: .leading)+                .padding(12)+                .constellationCard(borderColor: AsterismColors.attentionBorder)+                .constellationListRow()+            }+        }+    }++    /// Req 5.1/5.2's view-mode section, in the `chapterSection` idiom: absent+    /// when the work has no characters, and its facts already in Q88's display+    /// order — the repository's, not this view's.+    @ViewBuilder+    private var charactersSection: some View {+        if !model.characters.isEmpty || offersManualPass {+            Section {+                ForEach(model.characters) { character in+                    characterRow(character)+                }+                manualPassRow+            } header: {+                ConstellationSectionHeader("Characters", accent: .violet)+            }+        }+    }++    @ViewBuilder+    private func characterRow(_ character: WorkCharacterPresentation) -> some View {+        VStack(alignment: .leading, spacing: 6) {+            HStack(spacing: 8) {+                Text(character.name)+                    .font(AsterismTypography.serifHeading)+                    // On the name, not on the row: the row holds the fact rows+                    // and their citation buttons, and a container identifier+                    // masks every one of them.+                    .accessibilityIdentifier("work-detail-character")+                if character.isTorn {+                    // Req 6.5: disclosed where the reader meets it, and resolved+                    // where every torn record is.+                    Label("Differing copies", systemImage: "exclamationmark.circle")+                        .font(.caption)+                        .foregroundStyle(AsterismColors.amberText)+                        .accessibilityIdentifier("work-detail-character-torn")+                }+            }+            if !character.aliases.isEmpty {+                Text("Also \(character.aliases.joined(separator: ", "))")+                    .font(.caption)+                    .foregroundStyle(AsterismColors.cyan)+            }+            if !character.note.isEmpty {+                Text(character.note)+                    .font(.footnote)+                    .foregroundStyle(AsterismColors.secondaryText)+            }+            ForEach(character.facts) { fact in+                characterFactRow(fact)+            }+        }+        .frame(maxWidth: .infinity, alignment: .leading)+        .constellationListRow()+    }++    /// Req 5.2: each citation opens the note it came from, where that note still+    /// exists. A dangling citation displays without navigation and is not an+    /// error (Req 3.5) — the statement and the quote are still the reader's.+    @ViewBuilder+    private func characterFactRow(_ fact: WorkCharacterFactRow) -> some View {+        VStack(alignment: .leading, spacing: 2) {+            Text(fact.statement)+                .font(.footnote)+            if let entryID = fact.citedEntryID, let onSelectEntry {+                Button(fact.citationTitle ?? "Open the note") { onSelectEntry(entryID) }+                    .font(.caption)+                    .buttonStyle(.plain)+                    .foregroundStyle(AsterismColors.cyan)+                    .accessibilityIdentifier("work-detail-character-citation")+            } else if fact.isDangling {+                Text("From a note that is no longer here")+                    .font(.caption2)+                    .foregroundStyle(.tertiary)+                    .accessibilityIdentifier("work-detail-character-citation-dangling")+            } else {+                Text("From this work's notes")+                    .font(.caption2)+                    .foregroundStyle(.tertiary)+            }+        }+        .accessibilityIdentifier("work-detail-character-fact")+    }++    /// Req 1.11's trigger and its outcome, in the `suggestRow` shape. Hidden —+    /// not disabled — while the model is away: an action that can never do+    /// anything is not an action.+    private var offersManualPass: Bool {+        guard let extraction, model.work != nil, !model.isEditing else { return false }+        return extraction.canRunManualPass+    }++    @ViewBuilder+    private var manualPassRow: some View {+        if offersManualPass, let extraction, let work = model.work {+            // One source of truth for "a pass is running": the coordinator sets+            // `.running` before it does anything and replaces it on the way out,+            // so a second `@State` flag beside it could only ever disagree.+            let outcome = extraction.manualOutcome(for: work.id)+            VStack(alignment: .leading, spacing: 8) {+                Button {+                    Task { await runManualPass(workID: work.id) }+                } label: {+                    Label("Look for characters", systemImage: "sparkles")+                        .frame(maxWidth: .infinity, minHeight: AsterismLayout.minHitTarget)+                }+                .buttonStyle(.constellationSecondary)+                .disabled(outcome == .running)+                .accessibilityIdentifier("work-detail-extract-characters")+                .overlay(alignment: .trailing) {+                    if outcome == .running {+                        ProgressView()+                            .controlSize(.small)+                            .padding(.trailing, 18)+                            .accessibilityIdentifier("work-detail-extract-busy")+                            .accessibilityLabel("Looking for characters")+                    }+                }++                // Req 1.11: a pass always ends with something visible. "No+                // proposals available" covers empty, failed and refused alike —+                // the causes are diagnostics only (Req 1.8).+                switch outcome {+                case .proposals(let count):+                    Label(+                        "\(Pluralisation.count(count, "suggestion", "suggestions")) ready",+                        systemImage: "sparkles")+                        .font(.caption)+                        .foregroundStyle(AsterismColors.amberText)+                        .accessibilityIdentifier("work-detail-extract-ready")+                case .noProposals:+                    Label("No suggestions available", systemImage: "exclamationmark.circle")+                        .font(.caption)+                        .foregroundStyle(AsterismColors.amberText)+                        .accessibilityIdentifier("work-detail-extract-none")+                case .running, .none:+                    EmptyView()+                }+            }+            .frame(maxWidth: .infinity, alignment: .leading)+            .constellationListRow()+            // Deliberately unidentified: an identifier here would be inherited+            // by the trigger and the outcome label, and both are addressed by+            // name (`docs/agent-notes/testing.md`).+        }+    }++    /// Req 5.3: creating, editing, deleting and combining live in the existing+    /// edit mode and follow its commit/discard semantics — including the torn+    /// read-only gate, which is per character as well as per work.+    @ViewBuilder+    private var editCharactersSection: some View {+        Section {+            ForEach(model.characters) { character in+                if let draft = model.characterDraft(for: character.id) {+                    editCharacterRow(character, id: character.id, draft: draft)+                }+            }+            ForEach(newCharacterIDs, id: \.self) { id in+                if let draft = model.characterDraft(for: id) {+                    editCharacterRow(nil, id: id, draft: draft)+                }+            }+            Button("Add a character") { _ = model.addCharacter(named: "") }+                .disabled(model.isReadOnly)+                .frame(minHeight: AsterismLayout.minHitTarget)+                .accessibilityIdentifier("work-detail-add-character")+        } header: {+            ConstellationSectionHeader("Characters", accent: .violet)+        }+    }++    /// The characters this session created, in the order the reader added them.+    ///+    /// The model's order, not a sort of the draft dictionary's keys: a UUID is+    /// random, so sorting by `uuidString` dropped each new row into an arbitrary+    /// place in the list and re-ordered the ones already there.+    private var newCharacterIDs: [UUID] { model.createdCharacterIDs }++    /// `characterID` is a parameter rather than something derived here: the id is+    /// what every binding, delete and combine on this row addresses, and the old+    /// `character?.id ?? id ?? UUID()` would have silently minted a fresh UUID —+    /// a row whose every control wrote to a draft that does not exist.+    @ViewBuilder+    private func editCharacterRow(+        _ character: WorkCharacterPresentation?, id characterID: UUID, draft: CharacterDraft+    ) -> some View {+        let editable = character.map { model.canEditCharacter(id: $0.id) } ?? !model.isReadOnly+        VStack(alignment: .leading, spacing: 8) {+            TextField("Name", text: characterBinding(characterID, \.name))+                .disabled(!editable)+                .accessibilityIdentifier("work-detail-character-name-field")+            TextField("Note", text: characterBinding(characterID, \.note), axis: .vertical)+                .disabled(!editable)+                .accessibilityIdentifier("work-detail-character-note-field")++            ForEach(draft.facts, id: \.identity) { fact in+                HStack(alignment: .top, spacing: 8) {+                    Text(fact.statement)+                        .font(.footnote)+                    Spacer(minLength: 0)+                    Button("Delete", role: .destructive) {+                        model.deleteFact(fact.identity, from: characterID)+                    }+                    .font(.caption)+                    .disabled(!editable)+                    .accessibilityIdentifier("work-detail-character-fact-delete")+                }+            }++            if character?.isTorn == true {+                Text("This character exists in differing copies — editing is off until you choose which one to keep.")+                    .font(.caption)+                    .foregroundStyle(AsterismColors.amberText)+                    .accessibilityIdentifier("work-detail-character-torn-notice")+            }++            HStack(spacing: 12) {+                if let character, !model.combineTargets(for: character.id).isEmpty {+                    Button("Combine into…") { combineSource = character.id }+                        .font(.caption)+                        .accessibilityIdentifier("work-detail-character-combine")+                }+                Button("Delete character", role: .destructive) {+                    model.deleteCharacter(id: characterID)+                }+                .font(.caption)+                .disabled(!editable)+                .accessibilityIdentifier("work-detail-character-delete")+            }+        }+        .constellationListRow()+        .accessibilityIdentifier("work-detail-character-editor")+        .confirmationDialog(+            "Combine into", isPresented: combinePresented(for: characterID),+            titleVisibility: .visible+        ) {+            if let character {+                ForEach(model.combineTargets(for: character.id)) { target in+                    Button(target.name) {+                        model.combineCharacter(source: character.id, into: target.id)+                        combineSource = nil+                    }+                }+            }+            Button("Cancel", role: .cancel) { combineSource = nil }+        } message: {+            Text("Their facts and names move across. Nothing is written until you tap the checkmark.")+        }+    }++    private func combinePresented(for id: UUID) -> Binding<Bool> {+        Binding(+            get: { combineSource == id },+            set: { if !$0 { combineSource = nil } })+    }++    private func characterBinding(+        _ id: UUID, _ keyPath: WritableKeyPath<CharacterDraft, String>+    ) -> Binding<String> {+        Binding(+            get: { model.characterDraft(for: id)?[keyPath: keyPath] ?? "" },+            set: { value in model.updateCharacterDraft(id: id) { $0[keyPath: keyPath] = value } })+    }++    private func openReview(workID: UUID) {+        guard let extraction else { return }+        // Q109/Req 1.11: opening the sheet is one of the two moments a stale+        // manual-pass outcome stops being about anything the reader is looking+        // at. Clearing it here is what keeps "3 suggestions ready" from standing+        // under the trigger for the rest of the app run.+        extraction.clearManualOutcome(for: workID)+        reviewModel = CharacterReviewModel(+            workID: workID,+            proposals: extraction.held(for: workID),+            characters: model.characters,+            captureOrder: model.captureOrder,+            library: model.libraryForReview,+            onDecision: { nameKey in extraction.discard(nameKey: nameKey, for: workID) },+            // Q66: a `.reRouted` refusal names the character the row really+            // resolves onto, and the coordinator is where the held row lives.+            onReRoute: { nameKey, target in+                extraction.retarget(nameKey: nameKey, for: workID, to: target)+            },+            // Q110: reconcile before answering. The refusal disclosure promises+            // the list below is up to date, and this is the pass that makes it+            // so — nothing else on this screen reaches the coordinator's+            // invalidation.+            refresh: {+                await extraction.reconcile()+                return extraction.held(for: workID)+            })+    }++    private func runManualPass(workID: UUID) async {+        guard let extraction else { return }+        // The previous pass's label goes before this one starts, so a stale+        // "no suggestions available" never sits under a running pass. The+        // coordinator sets `.running` immediately and finishes with the real+        // outcome, which is what drives both the spinner and the label.+        extraction.clearManualOutcome(for: workID)+        await extraction.runManualPass(workID: workID)+    }+     // MARK: - Torn Work notice      /// Req 2.8 and Req 9.2 on this screen, mirroring Entry detail: say plainly

diff --git a/Asterism/AsterismTests/AppLibraryModelTests.swift b/Asterism/AsterismTests/AppLibraryModelTests.swiftindex 67af506..9cea7b0 100644--- a/Asterism/AsterismTests/AppLibraryModelTests.swift+++ b/Asterism/AsterismTests/AppLibraryModelTests.swift@@ -42,6 +42,39 @@ struct AppLibraryModelTests {         try? FileManager.default.removeItem(at: root)     } +    /// The two model coordinators are built over the repository that just+    /// opened, and `ContentView` reaches them through this model on every+    /// resign-active and memory warning — whether or not a library is open. A+    /// teardown that leaves them standing hands those handlers a coordinator+    /// whose library reads and coverage writes go to a store that has been shut+    /// down.+    @Test("Tearing the repository down forgets the run's model coordinators")+    @MainActor func teardownForgetsTheCoordinators() async throws {+        let root = FileManager.default.temporaryDirectory+            .appending(path: "asterism-teardown-coordinators-\(UUID())")+        let config = LibraryConfiguration(rootDirectory: root)+        defer { try? FileManager.default.removeItem(at: root) }+        let model = AppLibraryModel(configuration: config)++        await model.bootstrap()+        #expect(model.state == .ready)+        #expect(model.characterExtraction != nil)+        #expect(model.suggestions != nil)++        // A second open that cannot succeed: the store's directory is now a+        // file. `bootstrap()` tears down first, so what survives the failure is+        // exactly what the teardown forgot to clear.+        let storeDirectory = config.storeURL.deletingLastPathComponent()+        try? FileManager.default.removeItem(at: storeDirectory)+        FileManager.default.createFile(atPath: storeDirectory.path, contents: Data())++        await model.retry()++        #expect(model.state != .ready, "the second open failed, as the fixture arranged")+        #expect(model.characterExtraction == nil)+        #expect(model.suggestions == nil)+    }+     // MARK: - Req 4.4: an import that stopped partway is reported      @Test("A sidecar left by an interrupted import is read at bootstrap and named to the reader")

diff --git a/Asterism/AsterismTests/CharacterExtractionCoordinatorTests.swift b/Asterism/AsterismTests/CharacterExtractionCoordinatorTests.swiftnew file mode 100644index 0000000..66f23d8--- /dev/null+++ b/Asterism/AsterismTests/CharacterExtractionCoordinatorTests.swift@@ -0,0 +1,696 @@+import AsterismCore+import AsterismIntelligence+import Foundation+import Testing+@testable import Asterism++/// Tests for `CharacterExtractionCoordinator`: the sweep's bounds and gates, the+/// produced-none coverage write, and the manual pass.+///+/// The ledger's own transitions are covered host-side in+/// `CharacterExtractionLedgerTests`, and grounding and assembly in their own+/// suites. What is pinned here is what the coordinator does *around* them — the+/// library reads, the `Task`, the lane, the coverage write, and the outcome the+/// reader is shown.+///+/// Every case drives the **stub** model client. No live model call happens in+/// this suite, so nothing here depends on the host having a model.+@Suite("CharacterExtractionCoordinator")+@MainActor+struct CharacterExtractionCoordinatorTests {++    // MARK: - Doubles++    @MainActor+    final class StubEnvironment: SuggestionEnvironment {+        var isActive = true+        var isLowPowerModeEnabled = false+        var thermalState: ProcessInfo.ThermalState = .nominal+        var elapsed: Duration = .zero+        private let base = ContinuousClock.now+        var now: ContinuousClock.Instant { base.advanced(by: elapsed) }+    }++    /// A client whose availability can change between activations, which is the+    /// point of re-reading it. The package's stub is a value type, so the copy+    /// the coordinator holds could never change.+    final class MutableAvailabilityClient: CharacterExtractionModelClient, @unchecked Sendable {+        nonisolated(unsafe) var availabilityResult: ModelAvailability+        nonisolated(unsafe) var inner: StubCharacterExtractionModelClient+        /// Run **and awaited** at the end of every `extract`, so a test can move+        /// the coordinator's state at a known point mid-pass — between one+        /// source of a work and the next — rather than hoping a detached task+        /// lands in the right gap.+        nonisolated(unsafe) var onExtract: (@Sendable (ExtractionSource) async -> Void)?++        init(_ availability: ModelAvailability,+             inner: StubCharacterExtractionModelClient = StubCharacterExtractionModelClient()) {+            self.availabilityResult = availability+            self.inner = inner+        }++        func availability() -> ModelAvailability { availabilityResult }++        func extract(_ source: ExtractionSource) async throws -> ExtractionResult {+            let result = try await inner.extract(source)+            await onExtract?(source)+            return result+        }++        func isContextWindowOverflow(_ error: any Error) -> Bool {+            inner.isContextWindowOverflow(error)+        }+    }++    // MARK: - Fixtures++    /// One work, one generic-notes source, nothing covered and nothing known.+    private nonisolated static func candidate(+        workID: UUID = UUID(),+        title: String = "A Work",+        recency: TimeInterval = 0,+        notes: String = "Ada carried the lantern.",+        covered: Bool = false,+        characters: [CharacterMatchTarget] = [],+        acceptedFacts: Set<CharacterFactIdentity> = [],+        suppressions: CharacterSuppressionIndex = .empty+    ) -> CharacterExtractionCandidate {+        let fingerprint = CharacterCoverageFingerprint.of(notes)+        return CharacterExtractionCandidate(+            workID: workID,+            displayTitle: title,+            recency: Date(timeIntervalSince1970: recency),+            sources: [+                CharacterExtractionSource(+                    ref: .genericNotes, text: notes, fingerprint: fingerprint,+                    coveredFingerprint: covered ? fingerprint : nil)+            ],+            characters: characters,+            acceptedFactIdentities: acceptedFacts,+            suppressions: suppressions)+    }++    /// One work with **two** uncovered sources, so a stop taken between them is+    /// observable at all: the per-work guard cannot see it.+    private nonisolated static func twoSourceCandidate(+        workID: UUID, entryID: UUID, recency: TimeInterval = 0+    ) -> CharacterExtractionCandidate {+        let notes = "Ada carried the lantern."+        let chapter = "Brede followed."+        return CharacterExtractionCandidate(+            workID: workID,+            displayTitle: "A Work",+            recency: Date(timeIntervalSince1970: recency),+            sources: [+                CharacterExtractionSource(+                    ref: .genericNotes, text: notes,+                    fingerprint: CharacterCoverageFingerprint.of(notes),+                    coveredFingerprint: nil),+                CharacterExtractionSource(+                    ref: .entry(entryID), text: chapter,+                    fingerprint: CharacterCoverageFingerprint.of(chapter),+                    coveredFingerprint: nil),+            ],+            characters: [],+            acceptedFactIdentities: [],+            suppressions: .empty)+    }++    private nonisolated static func result(+        _ name: String = "Ada", statement: String = "Ada carried a lantern.",+        quote: String = "Ada carried the lantern"+    ) -> ExtractionResult {+        ExtractionResult(characters: [+            ExtractedCharacter(+                name: name, facts: [ExtractedFact(statement: statement, quote: quote)])+        ])+    }++    private func makeSUT(+        candidates: [CharacterExtractionCandidate] = [],+        availability: ModelAvailability = .available,+        stub: StubCharacterExtractionModelClient = StubCharacterExtractionModelClient(+            result: CharacterExtractionCoordinatorTests.result())+    ) -> (CharacterExtractionCoordinator, MockLibraryProvider, MutableAvailabilityClient,+          StubEnvironment) {+        let mock = MockLibraryProvider()+        mock.characterExtractionCandidatesResult = .success(candidates)+        let client = MutableAvailabilityClient(availability, inner: stub)+        let environment = StubEnvironment()+        // A lane of its own: `ModelLane.shared` is app-wide by design, and a+        // suite sharing one slot across cases would couple them.+        let coordinator = CharacterExtractionCoordinator(+            library: mock, model: client, environment: environment, lane: ModelLane())+        return (coordinator, mock, client, environment)+    }++    // MARK: - The activation sweep (Req 1.1, 1.2)++    @Test("The sweep processes at most the bounded number of works, newest activity first")+    func sweepRespectsWorksPerActivationAndOrder() async {+        let newest = UUID(), middle = UUID(), oldest = UUID()+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, _, _) = makeSUT(+            candidates: [+                Self.candidate(workID: oldest, recency: 10),+                Self.candidate(workID: newest, recency: 90),+                Self.candidate(workID: middle, recency: 50),+            ],+            stub: stub)++        await coordinator.activationSweep()++        #expect(CharacterExtractionBounds.worksPerActivation == 2)+        let workIDs = recorder.recordedSources.map(\.workID)+        #expect(workIDs == [newest, middle])+        #expect(coordinator.held(for: oldest).isEmpty)+    }++    /// Q106: coverage alone was not enough. A refusal covers nothing, so a work+    /// whose every source had already been attempted this run stayed "eligible"+    /// and kept one of the two slots on every activation for the rest of the run+    /// — the work behind it was never reached.+    @Test("A work whose uncovered sources were all attempted stops taking a sweep slot")+    func attemptedWorksReleaseTheirSlot() async {+        let workA = UUID(), workB = UUID(), workC = UUID()+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(+            error: StubCharacterExtractionModelClientError.refused, recorder: recorder)+        let (coordinator, _, _, _) = makeSUT(+            candidates: [+                Self.candidate(workID: workA, recency: 90),+                Self.candidate(workID: workB, recency: 50),+                Self.candidate(workID: workC, recency: 10),+            ],+            stub: stub)++        await coordinator.activationSweep()+        #expect(recorder.recordedSources.map(\.workID) == [workA, workB])++        await coordinator.activationSweep()++        #expect(recorder.recordedSources.map(\.workID) == [workA, workB, workC])+    }++    @Test("The sweep asks the library for no more works than it may examine")+    func sweepBoundsTheCandidateRead() async {+        let (coordinator, mock, _, _) = makeSUT(candidates: [Self.candidate()])++        await coordinator.activationSweep()++        #expect(mock.lastCharacterExtractionLimit == CharacterExtractionBounds.worksExamined)+        // nil is the whole-library read; a set is `reconcile`'s tracked pass.+        #expect(mock.lastCharacterExtractionWorkIDs == .some(nil))+    }++    @Test("A request carries the work's title and one source's text, and nothing else")+    func requestCarriesOnlyTheSource() async {+        let workID = UUID()+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, _, _) = makeSUT(+            candidates: [+                Self.candidate(+                    workID: workID, title: "Lanterns", notes: "Ada carried the lantern.")+            ],+            stub: stub)++        await coordinator.activationSweep()++        #expect(recorder.callCount == 1)+        let request = recorder.recordedSources.first+        #expect(request?.workTitle == "Lanterns")+        #expect(request?.text == "Ada carried the lantern.")+        #expect(request?.source == .genericNotes)+    }++    @Test("A covered source is not re-processed")+    func sweepSkipsCoveredSources() async {+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, _, _) = makeSUT(+            candidates: [Self.candidate(covered: true)], stub: stub)++        await coordinator.activationSweep()++        #expect(recorder.callCount == 0)+    }++    @Test("Held proposals are the assembled rows the reader will decide on")+    func sweepHoldsAssembledProposals() async {+        let workID = UUID()+        let (coordinator, _, _, _) = makeSUT(candidates: [Self.candidate(workID: workID)])++        await coordinator.activationSweep()++        let held = coordinator.held(for: workID)+        #expect(held.count == 1)+        #expect(held.first?.name == "Ada")+        #expect(held.first?.facts.count == 1)+        #expect(coordinator.hasProposals(for: workID))+    }++    // MARK: - The gates (Req 1.2)++    @Test("Low Power Mode stops the sweep before any model call")+    func sweepGatedByLowPowerMode() async {+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, _, environment) = makeSUT(+            candidates: [Self.candidate()], stub: stub)+        environment.isLowPowerModeEnabled = true++        await coordinator.activationSweep()++        #expect(recorder.callCount == 0)+    }++    @Test("A serious thermal state stops the sweep; a fair one does not")+    func sweepGatedByThermalState() async {+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, _, environment) = makeSUT(+            candidates: [Self.candidate()], stub: stub)+        environment.thermalState = .serious++        await coordinator.activationSweep()+        #expect(recorder.callCount == 0)++        environment.thermalState = .fair+        await coordinator.activationSweep()+        #expect(recorder.callCount == 1)+    }++    @Test("An inactive app runs no sweep")+    func sweepGatedByActiveState() async {+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, _, environment) = makeSUT(+            candidates: [Self.candidate()], stub: stub)+        environment.isActive = false++        await coordinator.activationSweep()++        #expect(recorder.callCount == 0)+    }++    @Test("An unavailable model sweeps nothing and reports itself away")+    func sweepSkippedWhileModelUnavailable() async {+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, mock, client, _) = makeSUT(+            candidates: [Self.candidate()],+            availability: .unavailable(reason: "test"),+            stub: stub)++        await coordinator.activationSweep()++        #expect(!coordinator.isModelAvailable)+        #expect(recorder.callCount == 0)+        // Req 1.2's read bound is not even paid for.+        #expect(mock.characterExtractionCandidatesCallCount == 0)++        // Availability is transient, so it is re-read every activation.+        client.availabilityResult = .available+        await coordinator.activationSweep()+        #expect(coordinator.isModelAvailable)+        #expect(recorder.callCount == 1)+    }++    // MARK: - Produced-none coverage (Req 4.3, Q65)++    @Test("A source the pass produced nothing for is covered at pass time")+    func producedNoneCoversAtPassTime() async {+        let workID = UUID()+        let notes = "Nothing here names anyone."+        let stub = StubCharacterExtractionModelClient(result: ExtractionResult(characters: []))+        let (coordinator, mock, _, _) = makeSUT(+            candidates: [Self.candidate(workID: workID, notes: notes)], stub: stub)++        await coordinator.activationSweep()++        #expect(coordinator.held(for: workID).isEmpty)+        #expect(mock.advancedCoverage.count == 1)+        let advance = mock.advancedCoverage.first+        #expect(advance?.workID == workID)+        #expect(advance?.sources.map(\.ref) == [.genericNotes])+        #expect(advance?.sources.first?.fingerprint == CharacterCoverageFingerprint.of(notes))+    }++    @Test("A source with shown proposals is left for the decision to cover")+    func shownProposalsAreNotCoveredAtPassTime() async {+        let (coordinator, mock, _, _) = makeSUT(candidates: [Self.candidate()])++        await coordinator.activationSweep()++        #expect(mock.advancedCoverage.isEmpty)+    }++    @Test("A source whose whole output is filtered away still covers")+    func filteredEmptyStillCovers() async {+        let workID = UUID()+        // The only fact the model offers is one the reader already accepted, so+        // the row empties and there is nothing left to decide (Req 1.7).+        let accepted = CharacterFactIdentity(+            nameKey: "ada", source: .genericNotes, quote: "Ada carried the lantern")+        let (coordinator, mock, _, _) = makeSUT(+            candidates: [+                Self.candidate(+                    workID: workID,+                    characters: [+                        CharacterMatchTarget(+                            id: UUID(), currentNameKey: "ada", retainedKey: "ada",+                            aliasKeys: [], isTorn: false)+                    ],+                    acceptedFacts: [accepted])+            ])++        await coordinator.activationSweep()++        #expect(coordinator.held(for: workID).isEmpty)+        #expect(mock.advancedCoverage.count == 1)+    }++    // MARK: - Failure (Req 1.8)++    @Test("A failed source is skipped, left uncovered, and not retried this run")+    func failedSourceIsSkippedAndRemembered() async {+        let workID = UUID()+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(+            error: StubCharacterExtractionModelClientError.refused, recorder: recorder)+        let (coordinator, mock, _, _) = makeSUT(+            candidates: [Self.candidate(workID: workID)], stub: stub)++        await coordinator.activationSweep()+        #expect(coordinator.held(for: workID).isEmpty)+        #expect(mock.advancedCoverage.isEmpty)+        #expect(recorder.callCount == 1)++        // Req 1.8: not retried within the same app run.+        await coordinator.activationSweep()+        #expect(recorder.callCount == 1)+    }++    @Test("An oversized source is skipped rather than truncated")+    func oversizedSourceIsSkipped() async {+        let workID = UUID()+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(+            error: StubCharacterExtractionModelClientError.contextWindowOverflow,+            recorder: recorder)+        let (coordinator, mock, _, _) = makeSUT(+            candidates: [Self.candidate(workID: workID)], stub: stub)++        await coordinator.activationSweep()++        #expect(recorder.callCount == 1)+        #expect(coordinator.held(for: workID).isEmpty)+        // Uncovered: never truncated and marked covered (Req 1.5).+        #expect(mock.advancedCoverage.isEmpty)+    }++    @Test("A failed candidate read skips the activation in silence")+    func failedCandidateReadSkipsSweep() async {+        let (coordinator, mock, _, _) = makeSUT()+        mock.characterExtractionCandidatesResult = .failure(MockLibraryProvider.MockError.notConfigured)++        await coordinator.activationSweep()++        #expect(coordinator.worksWithProposals.isEmpty)+    }++    // MARK: - Invalidation (Req 2.8)++    @Test("Reconcile drops held proposals whose work is gone")+    func reconcileDropsDeletedWork() async {+        let workID = UUID()+        let (coordinator, mock, _, _) = makeSUT(candidates: [Self.candidate(workID: workID)])+        await coordinator.activationSweep()+        #expect(coordinator.hasProposals(for: workID))++        mock.characterExtractionCandidatesResult = .success([])+        await coordinator.reconcile()++        #expect(!coordinator.hasProposals(for: workID))+    }++    @Test("Reconcile drops a proposal whose cited note has been edited")+    func reconcileDropsChangedRevision() async {+        let workID = UUID()+        let (coordinator, mock, _, _) = makeSUT(candidates: [Self.candidate(workID: workID)])+        await coordinator.activationSweep()+        #expect(coordinator.hasProposals(for: workID))++        mock.characterExtractionCandidatesResult = .success([+            Self.candidate(workID: workID, notes: "Ada carried the lantern, and a rope.")+        ])+        await coordinator.reconcile()++        #expect(!coordinator.hasProposals(for: workID))+    }++    @Test("Reconcile asks only about the works something is held or attempted for")+    func reconcileReadsOnlyTrackedWorks() async {+        let workID = UUID()+        let (coordinator, mock, _, _) = makeSUT(candidates: [Self.candidate(workID: workID)])+        await coordinator.activationSweep()++        await coordinator.reconcile()++        #expect(mock.lastCharacterExtractionWorkIDs == .some(Set([workID])))+    }++    @Test("Reconcile with nothing tracked reads nothing")+    func reconcileNoOpWhenNothingTracked() async {+        let (coordinator, mock, _, _) = makeSUT()++        await coordinator.reconcile()++        #expect(mock.characterExtractionCandidatesCallCount == 0)+    }++    // MARK: - Lifecycle++    @Test("A memory warning drops what is held")+    func memoryWarningDropsHeld() async {+        let workID = UUID()+        let (coordinator, _, _, _) = makeSUT(candidates: [Self.candidate(workID: workID)])+        await coordinator.activationSweep()+        #expect(coordinator.hasProposals(for: workID))++        coordinator.memoryWarning()++        #expect(!coordinator.hasProposals(for: workID))+    }++    /// Q110: the stop signal is checked **per source**, not per work.+    ///+    /// The old shape of this test called `resignActive()` *before* the sweep and+    /// asserted both works were processed — which asserts only that a stop taken+    /// while no sweep is running stops nothing. What matters is the stop taken+    /// while a work is half-processed: `environment.isActive` is still `.active`+    /// at `willResignActive`, so nothing else stopped the work's next source+    /// starting a fresh attempt on the way to the background.+    @Test("Resigning active mid-work stops the sweep before the work's next source")+    func resignActiveStopsBetweenSources() async {+        let workID = UUID(), entryID = UUID()+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, client, _) = makeSUT(+            candidates: [Self.twoSourceCandidate(workID: workID, entryID: entryID)], stub: stub)+        client.onExtract = { [weak coordinator] _ in+            await MainActor.run { coordinator?.resignActive() }+        }++        await coordinator.activationSweep()++        #expect(recorder.callCount == 1, "the second source must not be attempted")+        #expect(recorder.recordedSources.first?.source == .genericNotes)++        // The stop ends *that* sweep and nothing else: the source it spared is+        // still uncovered, and the next activation reaches it.+        client.onExtract = nil+        await coordinator.activationSweep()+        #expect(+            recorder.recordedSources.contains { $0.source == .entry(entryID) },+            "the next activation picks up the source the stop spared")+    }++    // MARK: - The manual pass (Req 1.11)++    @Test("A manual pass processes a covered source the sweep would leave alone")+    func manualPassIgnoresCoverage() async {+        let workID = UUID()+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, _, _) = makeSUT(+            candidates: [Self.candidate(workID: workID, covered: true)], stub: stub)++        await coordinator.runManualPass(workID: workID)++        #expect(recorder.callCount == 1)+        #expect(coordinator.held(for: workID).count == 1)+        #expect(coordinator.manualOutcome(for: workID) == .proposals(1))+    }++    @Test("A manual pass gets past a name-key suppression")+    func manualPassIgnoresSuppression() async {+        let workID = UUID()+        let (coordinator, _, _, _) = makeSUT(+            candidates: [+                Self.candidate(+                    workID: workID,+                    suppressions: CharacterSuppressionIndex(+                        candidateKeys: ["ada"], factIdentities: []))+            ])++        await coordinator.runManualPass(workID: workID)++        #expect(coordinator.held(for: workID).count == 1)+    }++    @Test("A manual pass still refuses to re-propose an accepted fact")+    func manualPassDedupsAcceptedFacts() async {+        let workID = UUID()+        let accepted = CharacterFactIdentity(+            nameKey: "ada", source: .genericNotes, quote: "Ada carried the lantern")+        let (coordinator, _, _, _) = makeSUT(+            candidates: [+                Self.candidate(+                    workID: workID,+                    characters: [+                        CharacterMatchTarget(+                            id: UUID(), currentNameKey: "ada", retainedKey: "ada",+                            aliasKeys: [], isTorn: false)+                    ],+                    acceptedFacts: [accepted])+            ])++        await coordinator.runManualPass(workID: workID)++        #expect(coordinator.held(for: workID).isEmpty)+        #expect(coordinator.manualOutcome(for: workID) == .noProposals)+    }++    @Test("A manual pass covers what it produced nothing for, and never regresses coverage")+    func manualPassAdvancesCoverage() async {+        let workID = UUID()+        let stub = StubCharacterExtractionModelClient(result: ExtractionResult(characters: []))+        let (coordinator, mock, _, _) = makeSUT(+            candidates: [Self.candidate(workID: workID, covered: true)], stub: stub)++        await coordinator.runManualPass(workID: workID)++        // The write is the repository's, and it only ever moves a fingerprint to+        // the text the source currently holds — so "never regresses" is a+        // property of what is sent, not of what the coordinator decides.+        #expect(mock.advancedCoverage.count == 1)+        #expect(mock.advancedCoverage.first?.workID == workID)+        #expect(coordinator.manualOutcome(for: workID) == .noProposals)+    }++    @Test("A manual pass runs with the sweep budget spent")+    func manualPassIsExemptFromTheBudget() async {+        let workID = UUID()+        let recorder = StubCharacterExtractionModelClient.Recorder()+        let stub = StubCharacterExtractionModelClient(result: Self.result(), recorder: recorder)+        let (coordinator, _, _, _) = makeSUT(+            candidates: [Self.candidate(workID: workID)], stub: stub)+        coordinator.exhaustBudgetForTesting()++        await coordinator.activationSweep()+        #expect(recorder.callCount == 0)++        await coordinator.runManualPass(workID: workID)+        #expect(recorder.callCount == 1)+    }++    @Test("A manual pass charges the sweep budget nothing", .timeLimit(.minutes(1)))+    func manualPassChargesNoBudget() async {+        let workID = UUID()+        let (coordinator, _, _, _) = makeSUT(candidates: [Self.candidate(workID: workID)])++        await coordinator.runManualPass(workID: workID)++        #expect(coordinator.budgetSpent == .zero)+    }++    @Test("A failed manual pass ends with the same visible outcome as an empty one")+    func manualPassFailureReadsAsNoProposals() async {+        let workID = UUID()+        let stub = StubCharacterExtractionModelClient(+            error: StubCharacterExtractionModelClientError.refused)+        let (coordinator, _, _, _) = makeSUT(+            candidates: [Self.candidate(workID: workID)], stub: stub)++        await coordinator.runManualPass(workID: workID)++        #expect(coordinator.manualOutcome(for: workID) == .noProposals)+        #expect(coordinator.held(for: workID).isEmpty)+    }++    @Test("A manual pass on a work the library no longer offers ends with no proposals")+    func manualPassOnMissingWorkReadsAsNoProposals() async {+        let (coordinator, _, _, _) = makeSUT(candidates: [])++        let workID = UUID()+        await coordinator.runManualPass(workID: workID)++        #expect(coordinator.manualOutcome(for: workID) == .noProposals)+    }++    @Test("The manual trigger is not offered while the model is away")+    func manualTriggerHiddenWhileUnavailable() async {+        let (coordinator, _, client, _) = makeSUT(availability: .unavailable(reason: "test"))++        #expect(!coordinator.canRunManualPass)++        client.availabilityResult = .available+        await coordinator.activationSweep()+        #expect(coordinator.canRunManualPass)+    }++    @Test("Dismissing a manual outcome clears it")+    func manualOutcomeIsDismissible() async {+        let workID = UUID()+        let (coordinator, _, _, _) = makeSUT(candidates: [Self.candidate(workID: workID)])++        await coordinator.runManualPass(workID: workID)+        #expect(coordinator.manualOutcome(for: workID) != nil)++        coordinator.clearManualOutcome(for: workID)+        #expect(coordinator.manualOutcome(for: workID) == nil)+    }++    // MARK: - Decisions++    @Test("Discarding a decided row leaves its siblings held")+    func discardRemovesOneRow() async {+        let workID = UUID()+        let stub = StubCharacterExtractionModelClient(+            result: ExtractionResult(characters: [+                ExtractedCharacter(+                    name: "Ada",+                    facts: [ExtractedFact(statement: "Ada carried a lantern.",+                                          quote: "Ada carried the lantern")]),+                ExtractedCharacter(+                    name: "Brede",+                    facts: [ExtractedFact(statement: "Brede followed.", quote: "Brede followed")]),+            ]))+        let (coordinator, _, _, _) = makeSUT(+            candidates: [+                Self.candidate(+                    workID: workID, notes: "Ada carried the lantern. Brede followed.")+            ],+            stub: stub)++        await coordinator.activationSweep()+        #expect(coordinator.held(for: workID).count == 2)++        coordinator.discard(nameKey: "ada", for: workID)++        #expect(coordinator.held(for: workID).map(\.nameKey) == ["brede"])+    }+}

diff --git a/Asterism/AsterismTests/CharacterReviewModelTests.swift b/Asterism/AsterismTests/CharacterReviewModelTests.swiftnew file mode 100644index 0000000..a6cfc55--- /dev/null+++ b/Asterism/AsterismTests/CharacterReviewModelTests.swift@@ -0,0 +1,559 @@+import AsterismCore+import AsterismIntelligence+import Foundation+import Testing+@testable import Asterism++/// Tests for `CharacterReviewModel`: the sheet that turns held proposals into+/// decisions (Reqs 2.1, 2.2, 2.5, 2.7).+///+/// The commit itself is the repository's and is covered against a real store in+/// `CharacterExtractionRepositoryTests`. What is pinned here is what the sheet+/// *sends* — the displayed keys, the struck aliases, the unticked facts — and+/// what it does with what comes back.+@Suite("CharacterReviewModel")+@MainActor+struct CharacterReviewModelTests {++    // MARK: - Fixtures++    private nonisolated static func fact(+        _ statement: String, quote: String, key: String = "ada",+        source: SourceRef = .genericNotes+    ) -> GroundedFact {+        GroundedFact(nameKey: key, statement: statement, quote: quote, source: source)+    }++    private nonisolated static func candidate(+        name: String = "Ada", key: String = "ada", aliases: [String] = [],+        facts: [GroundedFact]? = nil,+        target: ExtractionProposal.Target = .newCharacter,+        revisions: [SourceRef: String] = [.genericNotes: "fp-1"]+    ) -> ExtractionProposal {+        ExtractionProposal(+            name: name, nameKey: key, proposedAliases: aliases, target: target,+            facts: facts ?? [fact("Ada keeps the light.", quote: "Ada keeps the light", key: key)],+            citedRevisions: revisions)+    }++    private nonisolated static func character(+        id: UUID, name: String = "Ada", facts: [CharacterFact] = []+    ) -> WorkCharacterPresentation {+        WorkCharacterPresentation(+            id: id, name: name, note: "", aliases: [],+            nameKey: CharacterNameKey.normalize(name),+            facts: facts.map {+                WorkCharacterFactRow(+                    id: $0.quote, statement: $0.statement, quote: $0.quote, source: $0.source,+                    citedEntryID: nil, citationTitle: nil, isDangling: false, fact: $0)+            },+            isTorn: false, rowCount: 1,+            editBasis: CharacterEditBasis(+                characterID: id, name: name, note: "", aliases: [], facts: facts))+    }++    private func makeSUT(+        workID: UUID = UUID(),+        proposals: [ExtractionProposal] = [CharacterReviewModelTests.candidate()],+        characters: [WorkCharacterPresentation] = []+    ) -> (CharacterReviewModel, MockLibraryProvider) {+        let mock = MockLibraryProvider()+        let model = CharacterReviewModel(+            workID: workID, proposals: proposals, characters: characters, library: mock,+            onDecision: { _ in }, onReRoute: { _, _ in }, refresh: { [] })+        return (model, mock)+    }++    // MARK: - Fixtures for the refusal cases that cross the real seam++    @MainActor+    final class StubEnvironment: SuggestionEnvironment {+        var isActive = true+        var isLowPowerModeEnabled = false+        var thermalState: ProcessInfo.ThermalState = .nominal+        var now: ContinuousClock.Instant { ContinuousClock.now }+    }++    /// The library row an activation sweep reads, naming Ada in the generic+    /// notes. `characters` are the work's existing characters, which is what+    /// decides whether the assembled proposal is a candidate or a bundle.+    private nonisolated static func extractionCandidate(+        workID: UUID,+        notes: String = "Ada keeps the light.",+        characters: [CharacterMatchTarget] = []+    ) -> CharacterExtractionCandidate {+        CharacterExtractionCandidate(+            workID: workID,+            displayTitle: "The Lamp Room",+            recency: Date(timeIntervalSince1970: 0),+            sources: [+                CharacterExtractionSource(+                    ref: .genericNotes, text: notes,+                    fingerprint: CharacterCoverageFingerprint.of(notes),+                    coveredFingerprint: nil)+            ],+            characters: characters,+            acceptedFactIdentities: [],+            suppressions: .empty)+    }++    private nonisolated static func workPresentation(+        workID: UUID, characters: [WorkCharacterPresentation]+    ) -> WorkDetailPresentation {+        let base = TestFixtures.makeWorkDetail(work: TestFixtures.makeWork(id: workID))+        return WorkDetailPresentation(+            work: base.work, pulse: base.pulse,+            lastNotedURLString: base.lastNotedURLString, chapterRows: base.chapterRows,+            characters: characters)+    }++    /// A coordinator holding what a real sweep assembled over `library`.+    ///+    /// The refusal cases below drive the coordinator's own held state rather+    /// than a proposal list the test hands back from `refresh`: what is being+    /// pinned is that the *coordinator* changes, and a fixture returning a+    /// pre-retargeted row proves only that the row builder works.+    private func sweptCoordinator(+        library: MockLibraryProvider+    ) async -> CharacterExtractionCoordinator {+        let coordinator = CharacterExtractionCoordinator(+            library: library,+            model: StubCharacterExtractionModelClient(+                result: ExtractionResult(characters: [+                    ExtractedCharacter(+                        name: "Ada",+                        facts: [+                            ExtractedFact(+                                statement: "Ada keeps the light.", quote: "Ada keeps the light")+                        ])+                ])),+            environment: StubEnvironment(),+            lane: ModelLane())+        await coordinator.activationSweep()+        return coordinator+    }++    // MARK: - Presentation (Req 2.1)++    @Test("The sheet opens on the proposals it was given")+    func opensOnItsProposals() {+        let (model, _) = makeSUT(+            proposals: [Self.candidate(name: "Ada", key: "ada"),+                        Self.candidate(name: "Brede", key: "brede")])++        #expect(model.rows.map(\.name) == ["Ada", "Brede"])+        #expect(!model.isEmpty)+    }++    @Test("A bundle row shows the target character's existing facts beside the proposals")+    func bundleShowsExistingFacts() {+        let characterID = UUID()+        let existing = CharacterFact(+            statement: "Ada arrived by sea.", quote: "arrived by sea", nameKey: "ada",+            source: .genericNotes)+        let (model, _) = makeSUT(+            proposals: [Self.candidate(target: .existing(characterID))],+            characters: [Self.character(id: characterID, facts: [existing])])++        let row = model.rows.first+        #expect(row?.isBundle == true)+        #expect(row?.existingFacts.map(\.statement) == ["Ada arrived by sea."])+        #expect(row?.proposedFacts.map(\.statement) == ["Ada keeps the light."])+    }++    @Test("A candidate row shows no existing facts")+    func candidateShowsNoExistingFacts() {+        let (model, _) = makeSUT()++        #expect(model.rows.first?.isBundle == false)+        #expect(model.rows.first?.existingFacts.isEmpty == true)+    }++    @Test("A row with proposed aliases shows them")+    func aliasesAreShown() {+        let (model, _) = makeSUT(+            proposals: [Self.candidate(name: "Ada", aliases: ["Nightjar"])])++        #expect(model.rows.first?.aliases.map(\.name) == ["Nightjar"])+        #expect(model.rows.first?.aliases.first?.isStruck == false)+    }++    // MARK: - Snapshot at open (Req 2.7)++    @Test("A later sweep's proposals do not change the open sheet")+    func snapshotAtOpen() {+        let workID = UUID()+        let mock = MockLibraryProvider()+        nonisolated(unsafe) var latest = [Self.candidate(name: "Ada", key: "ada")]+        let model = CharacterReviewModel(+            workID: workID, proposals: latest, characters: [], library: mock,+            onDecision: { _ in }, onReRoute: { _, _ in }, refresh: { latest })++        latest.append(Self.candidate(name: "Brede", key: "brede"))++        #expect(model.rows.map(\.name) == ["Ada"])+    }++    // MARK: - Display order (AC 2.1, Q88)++    /// A row aggregating two sources (Q83/Q100) arrives in the pipeline's+    /// **canonical** order (Q75), which puts entry citations in UUID order. That+    /// is right for merging, dedup and encoding and wrong on screen: the reader+    /// reads a character's facts as history, and the work page shows exactly+    /// this order once the facts are kept.+    @Test("A merged row's facts are displayed in the notes' capture order")+    func mergedRowOrdersFactsByCaptureOrder() {+        // Deliberately opposed: the note captured *second* holds the UUID that+        // sorts *first*, so a display keyed on the citation's UUID would put it+        // above the note that came before it.+        let capturedSecond = UUID(uuidString: "0E000000-0000-4000-8000-000000000001")!+        let capturedFirst = UUID(uuidString: "0E000000-0000-4000-8000-000000000002")!+        let proposal = Self.candidate(+            facts: [+                // As the ledger's merge left them (`isOrderedBefore`).+                Self.fact("Ada arrives.", quote: "Ada arrives", source: .entry(capturedSecond)),+                Self.fact("Ada leaves.", quote: "Ada leaves", source: .entry(capturedFirst)),+                Self.fact("Ada keeps the light.", quote: "Ada keeps the light"),+            ],+            revisions: [+                .genericNotes: "fp-0",+                .entry(capturedSecond): "fp-2",+                .entry(capturedFirst): "fp-1",+            ])+        let model = CharacterReviewModel(+            workID: UUID(), proposals: [proposal], characters: [],+            captureOrder: [capturedFirst: 0, capturedSecond: 1],+            library: MockLibraryProvider(),+            onDecision: { _ in }, onReRoute: { _, _ in }, refresh: { [] })++        #expect(+            model.rows.first?.proposedFacts.map(\.source)+                == [.genericNotes, .entry(capturedFirst), .entry(capturedSecond)],+            """+            Q88: generic notes first, then live citations in capture order — \+            not the entry-UUID order the canonical encoding uses+            """)+    }++    // MARK: - Ticks and strikes (Req 2.2, Q92)++    @Test("Unticking a fact keeps it displayed and sends it as unticked")+    func untickingSendsTheFactSeparately() async {+        let (model, mock) = makeSUT()+        guard let row = model.rows.first, let fact = row.proposedFacts.first else {+            Issue.record("Expected a proposed fact")+            return+        }++        model.setTicked(false, factID: fact.id, in: row.id)+        #expect(model.rows.first?.proposedFacts.first?.isTicked == false)++        await model.accept(row.id)++        let request = mock.committedCharacterDecisions.first+        #expect(request?.facts.isEmpty == true)+        #expect(request?.untickedFacts.count == 1)+    }++    @Test("A struck alias is not among the keys the decision displays")+    func strikingAnAliasRemovesItsKey() async {+        let (model, mock) = makeSUT(+            proposals: [Self.candidate(name: "Ada", aliases: ["Nightjar", "Lampkeeper"])])+        guard let row = model.rows.first else {+            Issue.record("Expected a row")+            return+        }++        model.setStruck(true, alias: "Nightjar", in: row.id)+        await model.accept(row.id)++        let request = mock.committedCharacterDecisions.first+        #expect(request?.proposedAliases == ["Lampkeeper"])+        #expect(request?.displayedKeys == ["ada", "lampkeeper"])+    }++    @Test("Skipping suppresses exactly the keys the row displayed at skip time")+    func skipSuppressesTheDisplayedKeys() async {+        let (model, mock) = makeSUT(+            proposals: [Self.candidate(name: "Ada", aliases: ["Nightjar"])])+        guard let row = model.rows.first else {+            Issue.record("Expected a row")+            return+        }++        model.setStruck(true, alias: "Nightjar", in: row.id)+        await model.skip(row.id)++        let request = mock.committedCharacterDecisions.first+        #expect(request?.action == .skip)+        // The struck alias's key is not among them (Q92).+        #expect(request?.displayedKeys == ["ada"])+    }++    @Test("A decision carries the sources it completes")+    func decisionCarriesCompletedSources() async {+        let entryID = UUID()+        let (model, mock) = makeSUT(+            proposals: [+                Self.candidate(+                    facts: [+                        Self.fact("Ada keeps the light.", quote: "Ada keeps the light"),+                        Self.fact("Ada rows out.", quote: "Ada rows out", source: .entry(entryID)),+                    ],+                    revisions: [.genericNotes: "fp-1", .entry(entryID): "fp-2"])+            ])+        guard let row = model.rows.first else {+            Issue.record("Expected a row")+            return+        }++        await model.accept(row.id)++        let sources = mock.committedCharacterDecisions.first?.completedSources ?? []+        #expect(sources.count == 2)+        #expect(Set(sources.map(\.ref)) == Set([.genericNotes, .entry(entryID)]))+    }++    // MARK: - Committing (Req 2.2, 2.5)++    @Test("A committed decision leaves the sheet and tells the coordinator which row it was")+    func commitReportsTheDecidedRow() async {+        nonisolated(unsafe) var decided: [String] = []+        let mock = MockLibraryProvider()+        let model = CharacterReviewModel(+            workID: UUID(),+            proposals: [Self.candidate(name: "Ada", key: "ada"),+                        Self.candidate(name: "Brede", key: "brede")],+            characters: [], library: mock,+            onDecision: { decided.append($0) }, onReRoute: { _, _ in }, refresh: { [] })++        await model.accept("ada")++        #expect(decided == ["ada"])+        #expect(model.rows.map(\.name) == ["Brede"])+    }++    @Test("Deciding the last row empties the sheet")+    func lastDecisionEmptiesTheSheet() async {+        let (model, _) = makeSUT()++        await model.accept("ada")++        #expect(model.isEmpty)+    }++    @Test("Undecided rows survive dismissal")+    func undecidedRowsSurviveDismissal() async {+        let (model, _) = makeSUT(+            proposals: [Self.candidate(name: "Ada", key: "ada"),+                        Self.candidate(name: "Brede", key: "brede")])++        await model.accept("ada")+        model.dismiss()++        // Nothing was discarded on the way out: the coordinator still holds+        // Brede, and the next open re-presents it (Req 2.6).+        #expect(model.rows.map(\.name) == ["Brede"])+    }++    // MARK: - Refusals (Req 2.7, 2.8)++    /// Req 2.7/Q110: "The list below is up to date" is a promise the refresh has+    /// to keep. Nothing else on the work page reaches the coordinator's+    /// invalidation, so without the reconcile the stale row was re-presented+    /// byte-identical and refused again on the next Keep.+    @Test("A stale refusal reconciles the coordinator, and the stale row goes")+    func staleRefusalInvalidatesTheRow() async {+        let workID = UUID()+        let mock = MockLibraryProvider()+        mock.characterExtractionCandidatesResult = .success([+            Self.extractionCandidate(workID: workID)+        ])+        let coordinator = await sweptCoordinator(library: mock)+        #expect(coordinator.hasProposals(for: workID), "the sweep held a real proposal")++        let model = CharacterReviewModel(+            workID: workID, proposals: coordinator.held(for: workID), characters: [],+            library: mock,+            onDecision: { coordinator.discard(nameKey: $0, for: workID) },+            onReRoute: { key, target in+                coordinator.retarget(nameKey: key, for: workID, to: target)+            },+            refresh: {+                await coordinator.reconcile()+                return coordinator.held(for: workID)+            })++        // The note the proposal cites has been edited since it was assembled.+        mock.characterExtractionCandidatesResult = .success([+            Self.extractionCandidate(workID: workID, notes: "Ada keeps the light, and the door.")+        ])+        mock.workDetailResult = .success(Self.workPresentation(workID: workID, characters: []))+        mock.commitCharacterDecisionResult = .success(.refused(.staleSource(.genericNotes)))++        await model.accept("ada")++        #expect(model.disclosure?.contains("changed") == true)+        #expect(model.isEmpty, "the stale row is gone from the sheet")+        #expect(!coordinator.hasProposals(for: workID), "and from what the coordinator holds")+    }++    /// Q66/Q110: the refusal carries the character the row really resolves onto,+    /// and applying it to the **coordinator's** held row is the whole fix. A+    /// refresh that re-read the unchanged row looped the reader Keep → refuse →+    /// Keep for ever.+    @Test("A re-routed refusal retargets the held row and re-presents it as a bundle")+    func reRoutedRefusalRetargetsTheHeldRow() async {+        let workID = UUID(), characterID = UUID()+        let mock = MockLibraryProvider()+        // The work already has a character under a different key, so the sweep's+        // proposal is assembled as a *candidate* — which is the state the+        // re-route has to move.+        mock.characterExtractionCandidatesResult = .success([+            Self.extractionCandidate(+                workID: workID,+                characters: [+                    CharacterMatchTarget(+                        id: characterID, currentNameKey: "ada vance", retainedKey: "ada vance",+                        aliasKeys: [], isTorn: false)+                ])+        ])+        let coordinator = await sweptCoordinator(library: mock)+        #expect(coordinator.held(for: workID).first?.target == .newCharacter)++        let existing = CharacterFact(+            statement: "Ada arrived by sea.", quote: "arrived by sea", nameKey: "ada vance",+            source: .genericNotes)+        // The sheet's own snapshot has no characters in it: the resolving one may+        // have been created seconds ago by a sibling accept in this very sheet.+        let model = CharacterReviewModel(+            workID: workID, proposals: coordinator.held(for: workID), characters: [],+            library: mock,+            onDecision: { coordinator.discard(nameKey: $0, for: workID) },+            onReRoute: { key, target in+                coordinator.retarget(nameKey: key, for: workID, to: target)+            },+            refresh: {+                await coordinator.reconcile()+                return coordinator.held(for: workID)+            })+        mock.workDetailResult = .success(+            Self.workPresentation(+                workID: workID,+                characters: [+                    Self.character(id: characterID, name: "Ada Vance", facts: [existing])+                ]))+        mock.commitCharacterDecisionResult = .success(.refused(.reRouted(to: characterID)))++        await model.accept("ada")++        #expect(model.disclosure != nil)+        #expect(+            coordinator.held(for: workID).first?.target == .existing(characterID),+            "the retarget is what changed; the refresh only re-read it")+        let row = model.rows.first+        #expect(model.rows.count == 1)+        #expect(row?.isBundle == true)+        // Drawn against the *re-read* characters, not the open-time snapshot.+        #expect(row?.name == "Ada Vance")+        #expect(row?.existingFacts.map(\.statement) == ["Ada arrived by sea."])+    }++    @Test("A torn refusal discloses and routes the reader to Check Library")+    func tornRefusalRoutes() async {+        let mock = MockLibraryProvider()+        mock.commitCharacterDecisionResult = .success(.refused(.torn(characterID: UUID())))+        let model = CharacterReviewModel(+            workID: UUID(), proposals: [Self.candidate()], characters: [], library: mock,+            onDecision: { _ in }, onReRoute: { _, _ in }, refresh: { [Self.candidate()] })++        await model.accept("ada")++        #expect(model.disclosure != nil)+        #expect(model.routesToCheckLibrary)+        // Acceptance was refused, so the row is still there to decide.+        #expect(model.rows.count == 1)+    }++    @Test("A torn work still takes a skip")+    func tornWorkStillTakesASkip() async {+        let mock = MockLibraryProvider()+        mock.commitCharacterDecisionResult = .success(.committed(characterID: nil))+        let model = CharacterReviewModel(+            workID: UUID(), proposals: [Self.candidate()], characters: [], library: mock,+            onDecision: { _ in }, onReRoute: { _, _ in }, refresh: { [] })++        await model.skip("ada")++        #expect(model.isEmpty)+        #expect(mock.committedCharacterDecisions.first?.action == .skip)+    }++    @Test("A vanished work closes the sheet")+    func workGoneClosesTheSheet() async {+        let mock = MockLibraryProvider()+        mock.commitCharacterDecisionResult = .success(.refused(.workGone))+        let model = CharacterReviewModel(+            workID: UUID(), proposals: [Self.candidate()], characters: [], library: mock,+            onDecision: { _ in }, onReRoute: { _, _ in }, refresh: { [] })++        await model.accept("ada")++        #expect(model.isEmpty)+    }++    @Test("A thrown commit keeps the row and says so")+    func thrownCommitKeepsTheRow() async {+        let mock = MockLibraryProvider()+        mock.commitCharacterDecisionResult = .failure(MockLibraryProvider.MockError.notConfigured)+        let model = CharacterReviewModel(+            workID: UUID(), proposals: [Self.candidate()], characters: [], library: mock,+            onDecision: { _ in }, onReRoute: { _, _ in }, refresh: { [Self.candidate()] })++        await model.accept("ada")++        #expect(model.disclosure != nil)+        #expect(model.rows.count == 1)+    }++    /// Q92's strikes belong to the row that drew them. Matched by alias *name*+    /// across the whole list, one row's strike travelled to every other row+    /// proposing the same string on the first refresh — and a suppressed alias+    /// mis-routes for ever, which is the reason strikes exist.+    @Test("A strike does not travel to another row proposing the same alias")+    func strikesAreScopedToTheirRow() async {+        // The boundary here is the sheet's own refresh bookkeeping, so the+        // refreshed list is deliberately identical to the opened one: what must+        // not survive the round trip is Brede's borrowed strike.+        let held = [+            Self.candidate(name: "Ada", key: "ada", aliases: ["Nightjar"]),+            Self.candidate(name: "Brede", key: "brede", aliases: ["Nightjar"]),+        ]+        let workID = UUID()+        let mock = MockLibraryProvider()+        mock.commitCharacterDecisionResult = .success(.refused(.staleSource(.genericNotes)))+        mock.workDetailResult = .success(Self.workPresentation(workID: workID, characters: []))+        let model = CharacterReviewModel(+            workID: workID, proposals: held, characters: [], library: mock,+            onDecision: { _ in }, onReRoute: { _, _ in }, refresh: { held })++        model.setStruck(true, alias: "Nightjar", in: "ada")+        await model.accept("ada")++        #expect(model.rows.first { $0.id == "ada" }?.aliases.first?.isStruck == true)+        #expect(+            model.rows.first { $0.id == "brede" }?.aliases.first?.isStruck == false,+            "Brede's alias is Brede's decision")+    }++    @Test("A second decision while one is in flight is suppressed")+    func duplicateSubmissionSuppressed() async {+        let (model, mock) = makeSUT()++        async let first: Void = model.accept("ada")+        await model.accept("ada")+        await first++        #expect(mock.committedCharacterDecisions.count == 1)+    }+}

diff --git a/Asterism/AsterismTests/ComposedTeachingViewModelTests.swift b/Asterism/AsterismTests/ComposedTeachingViewModelTests.swiftindex fce2b4a..4ffa5b9 100644--- a/Asterism/AsterismTests/ComposedTeachingViewModelTests.swift+++ b/Asterism/AsterismTests/ComposedTeachingViewModelTests.swift@@ -1074,7 +1074,8 @@ struct ComposedTeachingViewModelTests {             library: mock,             model: StubRuleSuggestionModelClient(availability: availability),             suggester: suggester,-            environment: RuleSuggestionCoordinatorTests.StubEnvironment())+            environment: RuleSuggestionCoordinatorTests.StubEnvironment(),+            lane: ModelLane())         if let held {             suggester.suggestions[Self.hostname] = held             _ = await coordinator.suggestion(for: Self.hostname, origin: .background)

diff --git a/Asterism/AsterismTests/Helpers/MockLibraryProvider.swift b/Asterism/AsterismTests/Helpers/MockLibraryProvider.swiftindex a9d6530..a9044f7 100644--- a/Asterism/AsterismTests/Helpers/MockLibraryProvider.swift+++ b/Asterism/AsterismTests/Helpers/MockLibraryProvider.swift@@ -212,6 +212,103 @@ final class MockLibraryProvider: LibraryProviding, @unchecked Sendable {         return rows.filter { hostnames.contains($0.hostname) }     } +    // MARK: - Character extraction++    /// Recorded under `recorderLock` for the same reason the rule-suggestion+    /// read is: the sweep, `reconcile()` and a manual pass can all be inside+    /// these at once.+    var characterExtractionCandidatesResult:+        Result<[CharacterExtractionCandidate], Error> = .success([])+    var advanceCharacterCoverageResult: Result<Int, Error> = .success(1)+    var commitCharacterDecisionResult: Result<CharacterDecisionOutcome, Error> =+        .success(.committed(characterID: nil))+    var commitCharacterEditsResult: Result<CharacterEditOutcome, Error> =+        .success(.committed(characterIDs: []))++    var characterExtractionCandidatesCallCount: Int {+        recorderLock.withLock { storedCharacterExtractionCallCount }+    }+    var lastCharacterExtractionLimit: Int? {+        recorderLock.withLock { storedLastCharacterExtractionLimit }+    }+    /// Doubly optional so a test can tell "asked for every work" from "was never+    /// called".+    var lastCharacterExtractionWorkIDs: Set<UUID>?? {+        recorderLock.withLock { storedLastCharacterExtractionWorkIDs }+    }+    /// Every coverage advance, in order, so the produced-none rule is an+    /// assertion about what was written rather than about what was not.+    var advancedCoverage: [(workID: UUID, sources: [CharacterCompletedSource])] {+        recorderLock.withLock { storedAdvancedCoverage }+    }+    var committedCharacterDecisions: [CharacterDecisionRequest] {+        recorderLock.withLock { storedCharacterDecisions }+    }+    var committedCharacterEdits: [(workID: UUID, operations: [CharacterEditOperation])] {+        recorderLock.withLock { storedCharacterEdits }+    }++    private var storedCharacterExtractionCallCount = 0+    private var storedLastCharacterExtractionLimit: Int?+    private var storedLastCharacterExtractionWorkIDs: Set<UUID>??+    private var storedAdvancedCoverage: [(workID: UUID, sources: [CharacterCompletedSource])] = []+    private var storedCharacterDecisions: [CharacterDecisionRequest] = []+    private var storedCharacterEdits: [(workID: UUID, operations: [CharacterEditOperation])] = []++    func characterExtractionCandidates(+        limit: Int, workIDs: Set<UUID>?+    ) async throws -> [CharacterExtractionCandidate] {+        recorderLock.withLock {+            storedCharacterExtractionCallCount += 1+            storedLastCharacterExtractionLimit = limit+            storedLastCharacterExtractionWorkIDs = workIDs+            callLog.append("characterExtractionCandidates")+        }+        let rows = try characterExtractionCandidatesResult.get()+        let selected = workIDs.map { ids in rows.filter { ids.contains($0.workID) } } ?? rows+        // The repository orders newest activity first and then caps; the double+        // does the same, so a test asserting the sweep's order is asserting the+        // sweep's order and not the fixture's.+        return Array(+            selected.sorted {+                $0.recency == $1.recency+                    ? $0.workID.uuidString < $1.workID.uuidString+                    : $0.recency > $1.recency+            }+            .prefix(limit))+    }++    @discardableResult+    func advanceCharacterCoverage(+        workID: UUID, sources: [CharacterCompletedSource]+    ) async throws -> Int {+        recorderLock.withLock {+            storedAdvancedCoverage.append((workID: workID, sources: sources))+            callLog.append("advanceCharacterCoverage")+        }+        return try advanceCharacterCoverageResult.get()+    }++    func commitCharacterDecision(+        _ request: CharacterDecisionRequest+    ) async throws -> CharacterDecisionOutcome {+        recorderLock.withLock {+            storedCharacterDecisions.append(request)+            callLog.append("commitCharacterDecision")+        }+        return try commitCharacterDecisionResult.get()+    }++    func commitCharacterEdits(+        workID: UUID, operations: [CharacterEditOperation]+    ) async throws -> CharacterEditOutcome {+        recorderLock.withLock {+            storedCharacterEdits.append((workID: workID, operations: operations))+            callLog.append("commitCharacterEdits")+        }+        return try commitCharacterEditsResult.get()+    }+     // MARK: - Work types      var workTypesCallCount = 0

diff --git a/Asterism/AsterismTests/IntegrationSafetyNetTests.swift b/Asterism/AsterismTests/IntegrationSafetyNetTests.swiftindex 1f388af..fa47a7f 100644--- a/Asterism/AsterismTests/IntegrationSafetyNetTests.swift+++ b/Asterism/AsterismTests/IntegrationSafetyNetTests.swift@@ -232,9 +232,11 @@ struct IntegrationSafetyNetTests {                     Issue.record("Expected Backup export for \(environment) \(capabilities.gate.rawValue)")                     continue                 }-                // Settings writes 5/6 now (`configurable-work-types` Req 7.6);-                // the gate the file declares is still the running one.-                let document = try BackupV5Codec.decode(Data(contentsOf: backupURL))+                // Settings writes 6/7 now (`character-extraction` Req 6.1): the+                // archive has to carry characters, suppressions and coverage, so+                // the round-trip is reachable from the surface the reader uses.+                // The gate the file declares is still the running one.+                let document = try BackupV6Codec.decode(Data(contentsOf: backupURL))                 #expect(document.capabilityGate == AsterismCapabilities.current.gate.rawValue)                 backup.handleShareCancellation()             }

diff --git a/Asterism/AsterismTests/RuleSuggestionCoordinatorTests.swift b/Asterism/AsterismTests/RuleSuggestionCoordinatorTests.swiftindex 59827cc..ee6f395 100644--- a/Asterism/AsterismTests/RuleSuggestionCoordinatorTests.swift+++ b/Asterism/AsterismTests/RuleSuggestionCoordinatorTests.swift@@ -157,8 +157,11 @@ struct RuleSuggestionCoordinatorTests {         let suggester = StubSuggester()         let environment = StubEnvironment()         let client = MutableAvailabilityClient(availability)+        // A lane of its own: `ModelLane.shared` is app-wide by design, and a+        // suite sharing one slot across cases would couple them.         let coordinator = RuleSuggestionCoordinator(-            library: mock, model: client, suggester: suggester, environment: environment)+            library: mock, model: client, suggester: suggester, environment: environment,+            lane: ModelLane())         return (coordinator, mock, suggester, environment, client)     } 

diff --git a/Asterism/AsterismTests/SettingsBackupModelTests.swift b/Asterism/AsterismTests/SettingsBackupModelTests.swiftindex a46f52f..4af35d7 100644--- a/Asterism/AsterismTests/SettingsBackupModelTests.swift+++ b/Asterism/AsterismTests/SettingsBackupModelTests.swift@@ -213,7 +213,7 @@ struct SettingsBackupModelTests {     @MainActor func tornGroupsMessageStatesTheCount() async {         let mock = MockBackupExporting()         mock.exportResult = .failure(-            BackupV5ExportError.tornGroups(+            BackupV6ExportError.tornGroups(                 TornGroupsPayload(count: 3, blockingWorkSet: nil)))          let model = SettingsBackupModel(exporter: mock)@@ -234,7 +234,7 @@ struct SettingsBackupModelTests {     @MainActor func tornGroupsMessageReadsSingular() async {         let mock = MockBackupExporting()         mock.exportResult = .failure(-            BackupV5ExportError.tornGroups(+            BackupV6ExportError.tornGroups(                 TornGroupsPayload(count: 1, blockingWorkSet: nil)))          let model = SettingsBackupModel(exporter: mock)@@ -252,7 +252,7 @@ struct SettingsBackupModelTests {     @MainActor func tornGroupsMessagePointsAtTheBlockingWorkSet() async {         let mock = MockBackupExporting()         mock.exportResult = .failure(-            BackupV5ExportError.tornGroups(+            BackupV6ExportError.tornGroups(                 TornGroupsPayload(                     count: 1,                     blockingWorkSet: DuplicateSetKey(@@ -288,7 +288,7 @@ struct SettingsBackupModelTests {          let mock = MockBackupExporting()         mock.exportResult = .failure(-            BackupV5ExportError.tornGroups(+            BackupV6ExportError.tornGroups(                 TornGroupsPayload(count: 1, blockingWorkSet: nil)))         let model = SettingsBackupModel(exporter: mock)         await model.startExport()@@ -302,6 +302,83 @@ struct SettingsBackupModelTests {         #expect(!model.routesToCheckLibrary)     } +    // MARK: - Archive generation 6/7 (character-extraction Req 6.1)++    /// The Settings surface is the only place the app *writes* an archive, so a+    /// repository that reaches 6/7 while this seam still asks for 5/6 leaves the+    /// round-trip Req 6.1 promises unreachable. The metadata type is the tell:+    /// the exporter this model holds is the one whose payload carries+    /// characters, suppressions and coverage.+    @Test("The export surface asks the 6/7 exporter for the archive")+    @MainActor func exportsArchiveGenerationSixSeven() async {+        let tempDir = FileManager.default.temporaryDirectory.appending(path: UUID().uuidString)+        try? FileManager.default.createDirectory(at: tempDir, withIntermediateDirectories: true)+        defer { try? FileManager.default.removeItem(at: tempDir) }+        let fakeURL = tempDir.appending(path: "Asterism-backup-67.json")+        try? Data("{}".utf8).write(to: fakeURL)++        let mock = MockBackupExporting()+        mock.exportResult = .success(BackupExportResult(fileURL: fakeURL))++        let model = SettingsBackupModel(exporter: mock)+        await model.startExport()++        let metadata: BackupV6Metadata? = mock.lastMetadata+        #expect(metadata != nil)+        #expect(metadata?.appBuild.isEmpty == false)+    }++    /// Req 6.5, through Q105: a torn **character** group refuses the export the+    /// same way a torn Work or Entry does, and the reader is sent to the same+    /// place. The payload carries a count, not a record kind, so what this pins+    /// is that the 6/7 refusal reaches a message arm at all — an unhandled case+    /// would fall through to the generic "please try again", which is the dead+    /// end Decision 20 already removed once.+    @Test("A 6/7 torn refusal routes the reader to Check Library")+    @MainActor func sixSevenTornRefusalRoutes() async {+        let mock = MockBackupExporting()+        mock.exportResult = .failure(+            BackupV6ExportError.tornGroups(+                TornGroupsPayload(count: 2, blockingWorkSet: nil)))++        let model = SettingsBackupModel(exporter: mock)+        await model.startExport()++        let message = model.errorMessage ?? ""+        #expect(message.contains("2 records"))+        #expect(message.contains("Check Library"))+        #expect(!message.contains("Please try again"))+        #expect(model.routesToCheckLibrary)+    }++    /// Every case of the 6/7 refusal has a message of its own. A case that fell+    /// through to the default arm would be indistinguishable from an error the+    /// app has never heard of.+    @Test("Every 6/7 export refusal has its own message", arguments: [+        BackupV6ExportError.referencesStillArriving(detail: "rule 1"),+        BackupV6ExportError.unrepresentableValue(+            record: "Character", field: "factsData", value: "…"),+        BackupV6ExportError.snapshotFailed(reason: "read"),+        BackupV6ExportError.encodingFailed(reason: "encode"),+        BackupV6ExportError.stagingFailed(reason: "stage"),+    ])+    @MainActor func everySixSevenRefusalHasAMessage(error: BackupV6ExportError) async {+        let mock = MockBackupExporting()+        mock.exportResult = .failure(error)++        let model = SettingsBackupModel(exporter: mock)+        await model.startExport()++        let message = model.errorMessage ?? ""+        #expect(!message.isEmpty)+        // Privacy holds by construction: the reason strings above never reach+        // the reader.+        #expect(!message.contains("rule 1"))+        #expect(!message.contains("factsData"))+        // Only a torn refusal has somewhere to go.+        #expect(!model.routesToCheckLibrary)+    }+     // MARK: - Scavenging on Init      @Test("Scavenges stale files on initialization")@@ -320,12 +397,12 @@ final class MockBackupExporting: BackupExporting, @unchecked Sendable {     var cleanupCallCount = 0     var scavengeCallCount = 0     var lastCleanupURL: URL?-    var lastMetadata: BackupV5Metadata?+    var lastMetadata: BackupV6Metadata?      var exportResult: Result<BackupExportResult, Error> = .failure(MockBackupError.notConfigured)     var exportDelay: Duration? -    func export(metadata: BackupV5Metadata) async throws -> BackupExportResult {+    func export(metadata: BackupV6Metadata) async throws -> BackupExportResult {         exportCallCount += 1         lastMetadata = metadata         if let delay = exportDelay {

diff --git a/Asterism/AsterismTests/WorkDetailCharacterTests.swift b/Asterism/AsterismTests/WorkDetailCharacterTests.swiftnew file mode 100644index 0000000..287593e--- /dev/null+++ b/Asterism/AsterismTests/WorkDetailCharacterTests.swift@@ -0,0 +1,661 @@+import AsterismCore+import AsterismIntelligence+import Foundation+import SwiftData+import Testing+@testable import Asterism++/// The work page's character half (Reqs 3.2, 3.7, 5.1–5.4, 6.5), the entry+/// detail's citing-characters section, and the duplicate-resolution sheet's+/// character arm.+///+/// The repository calls these drive are covered against a real store in+/// `CharacterEditingTests`. What is pinned here is the edit session: what is+/// staged, when it is captured, what a discard throws away, and what the one+/// commit call is given.+@Suite("Work page characters")+@MainActor+struct WorkDetailCharacterTests {++    // MARK: - Fixtures++    private nonisolated static func fact(+        _ statement: String, quote: String, source: SourceRef = .genericNotes+    ) -> CharacterFact {+        CharacterFact(statement: statement, quote: quote, nameKey: "ada", source: source)+    }++    private nonisolated static func character(+        id: UUID = UUID(), name: String = "Ada", note: String = "",+        aliases: [String] = [], facts: [CharacterFact] = [], isTorn: Bool = false+    ) -> WorkCharacterPresentation {+        WorkCharacterPresentation(+            id: id, name: name, note: note, aliases: aliases,+            nameKey: CharacterNameKey.normalize(name),+            facts: facts.map {+                WorkCharacterFactRow(+                    id: $0.quote, statement: $0.statement, quote: $0.quote, source: $0.source,+                    citedEntryID: nil, citationTitle: nil, isDangling: false, fact: $0)+            },+            isTorn: isTorn, rowCount: isTorn ? 2 : 1,+            editBasis: CharacterEditBasis(+                characterID: id, name: name, note: note, aliases: aliases, facts: facts))+    }++    private nonisolated static func presentation(+        workID: UUID, characters: [WorkCharacterPresentation]+    ) -> WorkDetailPresentation {+        let base = TestFixtures.makeWorkDetail(work: TestFixtures.makeWork(id: workID))+        return WorkDetailPresentation(+            work: base.work,+            pulse: base.pulse,+            lastNotedURLString: base.lastNotedURLString,+            chapterRows: base.chapterRows,+            characters: characters)+    }++    private func makeSUT(+        workID: UUID = UUID(),+        characters: [WorkCharacterPresentation] = []+    ) -> (WorkDetailModel, MockLibraryProvider) {+        let mock = MockLibraryProvider()+        mock.workDetailResult = .success(Self.presentation(workID: workID, characters: characters))+        let model = WorkDetailModel(workID: workID, library: mock, onMutation: {})+        return (model, mock)+    }++    // MARK: - Display (Reqs 5.1, 5.2)++    @Test("A work with no characters shows nothing character-related")+    func noCharactersShowsNothing() async {+        let (model, _) = makeSUT()++        await model.load()++        #expect(model.characters.isEmpty)+    }++    @Test("The page shows the work's characters as the repository ordered them")+    func showsCharactersInRepositoryOrder() async {+        let (model, _) = makeSUT(+            characters: [Self.character(name: "Ada"), Self.character(name: "Brede")])++        await model.load()++        #expect(model.characters.map(\.name) == ["Ada", "Brede"])+    }++    // MARK: - Drafts (Req 3.2, Q97)++    @Test("Character drafts are captured at load, before any save reloads the screen")+    func draftsCapturedAtLoad() async {+        let id = UUID()+        let (model, _) = makeSUT(characters: [Self.character(id: id, name: "Ada", note: "Keeper")])++        await model.load()++        let draft = model.characterDraft(for: id)+        #expect(draft?.name == "Ada")+        #expect(draft?.note == "Keeper")+    }++    @Test("Editing a draft stages an update against the basis the editor opened on")+    func editingStagesAnUpdate() async {+        let id = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: id, name: "Ada")])+        await model.load()+        model.beginEditing()++        model.updateCharacterDraft(id: id) { $0.name = "Ada Vance" }+        await model.commitEditing()++        let step = mock.committedCharacterEdits.first+        #expect(step?.operations.count == 1)+        guard case .update(let basis, let draft)? = step?.operations.first else {+            Issue.record("Expected an update operation")+            return+        }+        #expect(basis.name == "Ada")+        #expect(draft.name == "Ada Vance")+    }++    @Test("An untouched character stages nothing")+    func untouchedCharacterStagesNothing() async {+        let id = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: id)])+        await model.load()+        model.beginEditing()++        await model.commitEditing()++        #expect(mock.committedCharacterEdits.isEmpty)+    }++    @Test("Creating a character stages a create")+    func creatingStagesACreate() async {+        let (model, mock) = makeSUT()+        await model.load()+        model.beginEditing()++        model.addCharacter(named: "Brede")+        await model.commitEditing()++        guard case .create(let draft)? = mock.committedCharacterEdits.first?.operations.first else {+            Issue.record("Expected a create operation")+            return+        }+        #expect(draft.name == "Brede")+    }++    @Test("Deleting a character stages a delete and removes it from the drafts")+    func deletingStagesADelete() async {+        let id = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: id)])+        await model.load()+        model.beginEditing()++        model.deleteCharacter(id: id)+        #expect(model.characterDrafts.isEmpty)++        await model.commitEditing()++        guard case .delete(let basis)? = mock.committedCharacterEdits.first?.operations.first else {+            Issue.record("Expected a delete operation")+            return+        }+        #expect(basis.characterID == id)+    }++    @Test("Deleting a fact from a draft is a deletion the commit carries")+    func deletingAFactStagesIt() async {+        let id = UUID()+        let kept = Self.fact("Ada keeps the light.", quote: "keeps the light")+        let dropped = Self.fact("Ada rows out.", quote: "rows out")+        let (model, mock) = makeSUT(+            characters: [Self.character(id: id, facts: [kept, dropped])])+        await model.load()+        model.beginEditing()++        model.deleteFact(dropped.identity, from: id)+        await model.commitEditing()++        guard case .update(_, let draft)? = mock.committedCharacterEdits.first?.operations.first+        else {+            Issue.record("Expected an update operation")+            return+        }+        #expect(draft.facts.map(\.quote) == ["keeps the light"])+    }++    // MARK: - Combine (Req 3.7, Q97)++    @Test("Combining is staged, in the order performed, and discardable until commit")+    func combineIsStagedAndDiscardable() async {+        let source = UUID(), target = UUID()+        let (model, mock) = makeSUT(+            characters: [+                Self.character(id: source, name: "Ada"),+                Self.character(id: target, name: "Ada Vance"),+            ])+        await model.load()+        model.beginEditing()++        model.combineCharacter(source: source, into: target)+        // The source is gone from the page as soon as it is staged, so the+        // reader sees what they asked for before it lands.+        #expect(model.characterDrafts[source] == nil)++        model.cancelEditing()++        #expect(mock.committedCharacterEdits.isEmpty)+        #expect(model.characterDrafts[source] != nil)+    }++    @Test("A combine followed by an edit of the target commits in that order")+    func stagedOperationsKeepTheirOrder() async {+        let source = UUID(), target = UUID()+        let (model, mock) = makeSUT(+            characters: [+                Self.character(id: source, name: "Ada"),+                Self.character(id: target, name: "Ada Vance"),+            ])+        await model.load()+        model.beginEditing()++        model.combineCharacter(source: source, into: target)+        model.updateCharacterDraft(id: target) { $0.note = "One person after all." }+        await model.commitEditing()++        let operations = mock.committedCharacterEdits.first?.operations ?? []+        #expect(operations.count == 2)+        guard case .combine = operations.first else {+            Issue.record("Expected the combine first")+            return+        }+        guard case .update = operations.last else {+            Issue.record("Expected the update last")+            return+        }+    }++    @Test("A torn character cannot be combined or edited")+    func tornCharacterIsReadOnly() async {+        let torn = UUID(), other = UUID()+        let (model, _) = makeSUT(+            characters: [+                Self.character(id: torn, name: "Ada", isTorn: true),+                Self.character(id: other, name: "Brede"),+            ])+        await model.load()+        model.beginEditing()++        #expect(!model.canEditCharacter(id: torn))+        #expect(model.canEditCharacter(id: other))+        #expect(model.combineTargets(for: other).map(\.id) == [])+    }++    // MARK: - Commit (Req 5.3, Q104)++    @Test("A refused character step keeps the editor open and names the character")+    func refusedStepKeepsTheEditorOpen() async {+        let id = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: id, name: "Ada")])+        mock.commitCharacterEditsResult = .success(+            .refused(.basisMismatch(characterID: id, name: "Ada")))+        await model.load()+        model.beginEditing()++        model.updateCharacterDraft(id: id) { $0.name = "Ada Vance" }+        await model.commitEditing()++        #expect(model.isEditing)+        #expect(model.errorMessage?.contains("Ada") == true)+    }++    /// Q104: a tear can sync in while the editor sits open, so `commitCharacterEdits`+    /// re-verifies the *work's* tornness inside the transaction. The UI has to+    /// render that refusal — before this it was a case the sheet could reach and+    /// not describe.+    @Test("A work torn under the open editor refuses the whole step and says so")+    func workTornRefusalIsRendered() async {+        let id = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: id)])+        mock.commitCharacterEditsResult = .success(.refused(.workTorn))+        await model.load()+        model.beginEditing()++        model.updateCharacterDraft(id: id) { $0.note = "Keeper" }+        await model.commitEditing()++        #expect(model.isEditing)+        #expect(model.errorMessage?.contains("copies") == true)+    }++    @Test("A torn character refusal routes the reader to the resolution surface")+    func tornCharacterRefusalRoutes() async {+        let id = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: id, name: "Ada")])+        mock.commitCharacterEditsResult = .success(+            .refused(.torn(characterID: id, name: "Ada")))+        await model.load()+        model.beginEditing()++        model.updateCharacterDraft(id: id) { $0.name = "Ada Vance" }+        await model.commitEditing()++        #expect(model.isEditing)+        #expect(model.characterRefusalRoutesToCheckLibrary)+    }++    @Test("A committed character step leaves the editor and reloads")+    func committedStepLeavesTheEditor() async {+        let id = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: id)])+        await model.load()+        model.beginEditing()++        model.updateCharacterDraft(id: id) { $0.note = "Keeper" }+        await model.commitEditing()++        #expect(!model.isEditing)+        #expect(mock.committedCharacterEdits.count == 1)+    }++    @Test("The character step runs even when no metadata changed")+    func characterStepRunsWithoutMetadataChanges() async {+        let id = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: id)])+        await model.load()+        model.beginEditing()++        model.updateCharacterDraft(id: id) { $0.note = "Keeper" }+        await model.commitEditing()++        #expect(mock.committedCharacterEdits.count == 1)+        #expect(mock.updateWorkCallCount == 0)+    }++    /// The `.conflict` path already preserved the drafts, on the grounds that a+    /// draft is the only copy of itself until it lands. The `throw` path+    /// restored from the snapshot instead, which re-adopted the stored+    /// characters and so discarded the whole staged session — silently, while+    /// the editor stayed open on what looked like the reader's own work.+    @Test("A thrown metadata save keeps the staged character session")+    func thrownSaveKeepsTheStagedSession() async {+        let existing = UUID()+        let (model, mock) = makeSUT(characters: [Self.character(id: existing, name: "Ada")])+        await model.load()+        model.beginEditing()++        model.updateCharacterDraft(id: existing) { $0.note = "Keeper" }+        let created = model.addCharacter(named: "Brede")+        model.draftTitle = "A corrected title"+        mock.updateWorkResult = .failure(MockLibraryProvider.MockError.notConfigured)++        await model.commitEditing()++        #expect(model.errorMessage != nil)+        #expect(model.isEditing, "a failed save keeps the editor open")+        #expect(model.draftTitle == "A corrected title")+        #expect(model.characterDraft(for: existing)?.note == "Keeper")+        #expect(model.createdCharacterIDs == [created])+        #expect(mock.committedCharacterEdits.isEmpty, "nothing was written")+    }++    /// The screen used to sort the draft dictionary's keys by `uuidString`,+    /// which is a random order: each new row landed in an arbitrary place among+    /// the ones already added, and adding one re-ordered the rest.+    @Test("Created characters keep the order the reader added them in")+    func createdCharactersKeepInsertionOrder() async {+        let (model, _) = makeSUT()+        await model.load()+        model.beginEditing()++        let first = model.addCharacter(named: "Ada")+        let second = model.addCharacter(named: "Brede")+        let third = model.addCharacter(named: "Cass")++        #expect(model.createdCharacterIDs == [first, second, third])++        model.deleteCharacter(id: second)+        #expect(model.createdCharacterIDs == [first, third])+    }+}++// MARK: - Entry detail (Req 5.4)++@Suite("Entry detail citing characters")+@MainActor+struct EntryDetailCitingCharactersTests {++    private nonisolated static func detail(+        entryID: UUID, citing: [EntryCitingCharacter]+    ) -> EntryTeachingDetail {+        EntryTeachingDetail(+            entry: TestFixtures.makeEntry(id: entryID),+            siteMode: .untaught,+            activePatternSummary: nil,+            historicalPatternSummaries: [],+            chapterSettlement: .unsettled(reason: "no pattern"),+            assignmentSettlement: .unsettled(reason: "no pattern"),+            availableActions: [],+            unresolvedCandidateTitle: nil,+            citingCharacters: citing)+    }++    @Test("An entry no character cites shows no section")+    func noCitationsShowsNothing() async {+        let mock = MockLibraryProvider()+        let entryID = UUID()+        mock.entryTeachingDetailResult = .success(Self.detail(entryID: entryID, citing: []))+        let model = EntryDetailModel(entryID: entryID, library: mock, onMutation: {})++        await model.load()++        #expect(model.citingCharacters.isEmpty)+    }++    @Test("An entry a character cites names them and how many facts")+    func citationsAreNamed() async {+        let mock = MockLibraryProvider()+        let entryID = UUID()+        mock.entryTeachingDetailResult = .success(+            Self.detail(+                entryID: entryID,+                citing: [EntryCitingCharacter(id: UUID(), name: "Ada", factCount: 2)]))+        let model = EntryDetailModel(entryID: entryID, library: mock, onMutation: {})++        await model.load()++        #expect(model.citingCharacters.map(\.name) == ["Ada"])+        #expect(model.citingCharacters.first?.factCount == 2)+    }+}++// MARK: - The duplicate-resolution character arm (Req 6.5, Q102)++@Suite("Duplicate resolution character arm")+@MainActor+struct DuplicateResolutionCharacterArmTests {++    private nonisolated static func contract(+        setKey: DuplicateSetKey, variants: [CharacterVariantChoice]+    ) -> DuplicateResolutionContract {+        .character(+            setKey: setKey, variants: variants, differingFields: [.note],+            preselected: variants[0].id)+    }++    @Test("A character set's variants reach the sheet")+    func characterVariantsAreExposed() async {+        let id = UUID()+        let setKey = DuplicateSetKey(recordType: .character, memberIDs: [id])+        let variants = [+            CharacterVariantChoice(+                id: VariantID(rawValue: "a"), name: "Ada", note: "Keeper", aliases: [],+                factCount: 3, firstCapturedAt: Date(timeIntervalSince1970: 0)),+            CharacterVariantChoice(+                id: VariantID(rawValue: "b"), name: "Ada", note: "Lightkeeper",+                aliases: ["Nightjar"], factCount: 2,+                firstCapturedAt: Date(timeIntervalSince1970: 10)),+        ]+        let mock = MockLibraryProvider()+        mock.projectDuplicateResolutionResult = .success(+            Self.contract(setKey: setKey, variants: variants))+        let model = DuplicateResolutionModel(setKey: setKey, library: mock, onMutation: {})++        await model.load()++        #expect(model.characterVariants.map(\.note) == ["Keeper", "Lightkeeper"])+        #expect(model.entryVariants.isEmpty)+        #expect(model.workVariants.isEmpty)+        #expect(model.selectedVariantID == VariantID(rawValue: "a"))+    }++    private nonisolated static func tornCharacterItem() -> DuplicateReviewItem {+        let id = UUID()+        return DuplicateReviewItem(+            key: DuplicateSetKey(recordType: .character, memberIDs: [id]),+            route: .sheet,+            memberIDs: [id],+            variantCount: 2,+            isTorn: true)+    }++    /// `MaintenanceViewModels`' work-else-entry ternary called every non-work+    /// set an entry. A torn character listed as "one entry" sends the reader+    /// looking for a note that does not exist.+    @Test("A character set is labelled as a character, not as an entry")+    func characterSetIsLabelledCorrectly() async {+        let mock = MockLibraryProvider()+        mock.duplicateWorkload = (+            DuplicateWorkload(reviewItems: [Self.tornCharacterItem()], deferredItems: []))+        let model = LibraryDiagnosticsModel(library: mock, onReteach: { _ in })++        await model.load()++        let text = model.rows.map(\.problem).joined(separator: " ")+        #expect(text.contains("character"))+        #expect(!text.contains("entry"))+    }++    /// `RecentView`'s recordType filter kept only `.entry` items as rows and+    /// swept the rest into "elsewhere" — which is right for a character, but+    /// only because the arm names it. Without one the line reads as a bare+    /// count.+    @Test("A character set is not mis-bucketed into Recent's entry filter")+    func characterSetIsNotAnEntryItem() {+        let plan = RecentDuplicatePlan(+            workload: DuplicateWorkload(reviewItems: [Self.tornCharacterItem()], deferredItems: []),+            conflictCount: 0)++        #expect(plan.entryItems.isEmpty)+        #expect(plan.elsewhere.count == 1)+        #expect(plan.elsewhere.first?.text.contains("character") == true)+    }+}++// MARK: - The edit step against a real store (Q97, Q108)++/// The combine-then-edit journey through the **real** seam: the shipping+/// `WorkDetailModel` deriving its operations from a real edit session, and the+/// shipping `LibraryRepository` committing them against a real store.+///+/// A double on either side hides the bug this suite exists for. The repository+/// suite's own order test hand-builds the trailing update's basis from the+/// *post-combine* state, which no editor can produce: the model sends the+/// **load-time** basis, so every derived update after a combine mismatched and+/// the whole step refused as "changed elsewhere" — naming a concurrent editor+/// who did not exist. Q108 answers it: within one step a character's basis is+/// verified on first touch only.+@Suite("The character edit step through the work page", .serialized)+@MainActor+struct WorkDetailCharacterCommitTests {++    private struct Fixture {+        let directory: URL+        /// Retained for the test's lifetime: a `ModelContext` does not keep its+        /// container alive, and a temporary one deallocates under the test.+        let container: ModelContainer+        let repository: LibraryRepository++        init() throws {+            directory = FileManager.default.temporaryDirectory+                .appending(+                    path: "AsterismWorkDetailCharacters-\(UUID())", directoryHint: .isDirectory)+            try FileManager.default.createDirectory(+                at: directory, withIntermediateDirectories: true)+            let configuration = LibraryConfiguration(rootDirectory: directory)+            try FileManager.default.createDirectory(+                at: configuration.storeURL.deletingLastPathComponent(),+                withIntermediateDirectories: true)+            container = try LibraryRepository.openContainer(at: configuration.storeURL)+            repository = LibraryRepository.makeRepository(+                configuration, container, .m4, FixedCommitClock(), ModelContextSaveStrategy())+        }++        func cleanup() { try? FileManager.default.removeItem(at: directory) }+    }++    private nonisolated static func fact(+        _ statement: String, _ quote: String, key: String+    ) -> CharacterFact {+        CharacterFact(statement: statement, quote: quote, nameKey: key, source: .genericNotes)+    }++    /// One work with two characters, each carrying a fact of its own.+    private static func seed(+        _ fixture: Fixture+    ) async throws -> (workID: UUID, keeper: UUID, rower: UUID) {+        let work = try await fixture.repository.createWork(+            NewWorkDraft(displayTitle: "The Lamp Room", hostname: "characters.test"))+        let outcome = try await fixture.repository.commitCharacterEdits(+            workID: work.id,+            operations: [+                .create(CharacterDraft(+                    name: "Ada", note: "the keeper", aliases: [],+                    facts: [Self.fact("Ada keeps the light.", "Ada keeps the light", key: "ada")])),+                .create(CharacterDraft(+                    name: "Vance", note: "the rower", aliases: [],+                    facts: [Self.fact("Vance rows out.", "Vance rows out", key: "vance")])),+            ])+        guard case .committed(let ids) = outcome, ids.count == 2 else {+            throw CommitFixtureError.seedRefused(String(describing: outcome))+        }+        return (work.id, ids[0], ids[1])+    }++    @Test("A combine and an edit of the combined character commit together, in order")+    func combineThenEditCommits() async throws {+        let fixture = try Fixture()+        defer { fixture.cleanup() }+        let (workID, keeper, rower) = try await Self.seed(fixture)++        let model = WorkDetailModel(workID: workID, library: fixture.repository, onMutation: {})+        await model.load()+        #expect(model.characters.count == 2)+        model.beginEditing()++        model.combineCharacter(source: rower, into: keeper)+        model.updateCharacterDraft(id: keeper) {+            $0.name = "Adelaide"+            $0.note = "One person after all."+        }+        await model.commitEditing()++        #expect(model.errorMessage == nil, "Q108: the step's own writes are not a stale basis")+        #expect(!model.isEditing)++        let after = model.characters+        #expect(after.count == 1)+        #expect(after.first?.name == "Adelaide", "the edit landed on top of the combine")+        #expect(after.first?.note == "One person after all.")+        // The combine's own writes survive the update the editor derives from a+        // load-time draft: the absorbed name still routes, and the moved fact is+        // still here rather than deleted as an omission.+        #expect(after.first?.aliases.contains("Vance") == true)+        #expect(+            Set(after.first?.facts.map(\.statement) ?? [])+                == ["Ada keeps the light.", "Vance rows out."])+        withExtendedLifetime(fixture) {}+    }++    @Test("A character changed elsewhere still refuses the whole step on first touch")+    func externalChangeStillRefusesTheStep() async throws {+        let fixture = try Fixture()+        defer { fixture.cleanup() }+        let (workID, keeper, _) = try await Self.seed(fixture)++        let model = WorkDetailModel(workID: workID, library: fixture.repository, onMutation: {})+        await model.load()+        let basis = try #require(model.characters.first { $0.id == keeper }?.editBasis)+        model.beginEditing()+        model.updateCharacterDraft(id: keeper) { $0.note = "Mine." }++        // Another device writes to the same character while the editor sits open.+        _ = try await fixture.repository.commitCharacterEdits(+            workID: workID,+            operations: [.update(+                basis: basis,+                draft: CharacterDraft(+                    name: "Ada", note: "Theirs.", aliases: [],+                    facts: [+                        Self.fact("Ada keeps the light.", "Ada keeps the light", key: "ada")+                    ]))])++        await model.commitEditing()++        #expect(model.isEditing, "a refused step keeps the editor open")+        #expect(model.errorMessage?.contains("changed elsewhere") == true)+        withExtendedLifetime(fixture) {}+    }+}++private enum CommitFixtureError: Error {+    case seedRefused(String)+}++private final class FixedCommitClock: RepositoryClock, @unchecked Sendable {+    private let value = Date(timeIntervalSince1970: 1_800_000_000)+    func now() -> Date { MillisecondInstant.quantize(value) }+}

diff --git a/Asterism/AsterismTests/WorkDetailModelTests.swift b/Asterism/AsterismTests/WorkDetailModelTests.swiftindex d54ac7d..76f59ac 100644--- a/Asterism/AsterismTests/WorkDetailModelTests.swift+++ b/Asterism/AsterismTests/WorkDetailModelTests.swift@@ -65,8 +65,13 @@ struct WorkDetailModelTests {         #expect(tracker.mutationCount == 1)     } -    @Test("Save failure restores drafts from prior snapshot")-    @MainActor func saveFailureRestores() async {+    /// The `.conflict` path already kept the drafts, on the grounds that a draft+    /// is the only copy of itself until it lands and the editor is still open on+    /// it. A throw is the same situation — nothing was written — so it now keeps+    /// them too. Restoring here also re-adopted the stored characters, which+    /// silently discarded the session's whole staged character step.+    @Test("A failed save keeps the drafts, exactly as a refused one does")+    @MainActor func saveFailureKeepsDrafts() async {         let work = TestFixtures.makeWork(             displayTitle: "Prior Title",             typeDisplay: WorkTypeDirectory.empty.display(of: .legacy("novel")),@@ -83,11 +88,11 @@ struct WorkDetailModelTests {         model.draftTags = ["new-tag"]         model.draftNotes = "changed notes"         await model.save()-        // Restored from snapshot-        #expect(model.draftTitle == "Prior Title")-        #expect(model.draftAssignment == .legacy("novel"))-        #expect(model.draftTags == ["drama"])-        #expect(model.draftNotes == "prior notes")+        // Kept, not restored: nothing was written, and the editor still has them.+        #expect(model.draftTitle == "Changed")+        #expect(model.draftAssignment == .legacy("toon"))+        #expect(model.draftTags == ["new-tag"])+        #expect(model.draftNotes == "changed notes")         #expect(model.errorMessage != nil)     } 

diff --git a/Asterism/AsterismUITests/CharacterExtractionUITests.swift b/Asterism/AsterismUITests/CharacterExtractionUITests.swiftnew file mode 100644index 0000000..0d19e8f--- /dev/null+++ b/Asterism/AsterismUITests/CharacterExtractionUITests.swift@@ -0,0 +1,327 @@+import XCTest++/// The extraction journey end to end (`character-extraction` Reqs 2.1, 2.2,+/// 5.1, 5.4), from the activation sweep's indicator to a kept character's facts+/// on the work page and its citation on the entry it came from.+///+/// **Stub-driven, always.** `ASTERISM_UI_TEST_EXTRACTION=canned` substitutes a+/// scripted model client, so nothing here depends on the host having a model or+/// on the model repeating itself — which is what Req 1.7 says reader-visible+/// behaviour may never depend on. Everything downstream of the scripted answer+/// is the shipping code: grounding, the slash split, assembly, matching, and+/// every decision the reader makes.+///+/// The fixture (`seeded-characters`) is one work, "The Lamp Room", whose generic+/// notes and single chapter note name Ada — called Nightjar by the crew — and+/// Brede.+final class CharacterExtractionUITests: XCTestCase {+    let app = XCUIApplication()++    override func setUp() {+        continueAfterFailure = false+        XCUIDevice.shared.orientation = .portrait+        terminateAndWaitForExit(app)+        app.launchEnvironment["ASTERISM_UI_TEST_SCENARIO"] = "seeded-characters"+        app.launchEnvironment["ASTERISM_UI_TEST_RUN_ID"] = UUID().uuidString+        app.launchEnvironment["ASTERISM_UI_TEST_EXTRACTION"] = "canned"+        app.launch()+    }++    override func tearDown() {+        terminateAndWaitForExit(app)+    }++    // MARK: - Navigation++    private func openWorkDetail() {+        waitFor(app.collectionViews["recent-list"], "The library opens", timeout: 60)+        waitFor(app.tabBars.buttons["Works"], "The Works tab is reachable").tap()+        waitFor(app.collectionViews["works-list"], "Works lists the seeded library")+        waitFor(+            app.elements(withIdentifierPrefix: "work-row-").firstMatch,+            "The seeded work is listed").tap()+        waitFor(app.anyElement("work-detail-pulse"), "Work detail presents the rating pulse")+    }++    private func openReview() {+        // The sweep runs on activation and is never awaited by it, so the+        // indicator arrives after the screen does.+        waitFor(+            app.anyElement("work-detail-character-proposals"),+            "The sweep's proposals raise the indicator", timeout: 60)+        waitFor(+            app.buttons["work-detail-review-characters-button"],+            "The indicator offers the review list").tap()+        waitFor(app.anyElement("character-review-banner"), "The review list opens")+    }++    private func closeReview() {+        waitFor(app.buttons["character-review-done"], "The review list closes").tap()+        waitUntilGone(+            app.anyElement("character-review-banner"), "The review list is dismissed", timeout: 15)+    }++    /// The proposed-fact toggle whose statement contains `text`.+    ///+    /// Deliberately not addressed by its identifier alone: a fact's id is its+    /// `(source, quote, statement)` identity triple joined by a unit separator+    /// (Q29), which is not a string a journey can type. The identifier prefix+    /// plus the statement the reader can actually see is.+    private func factToggle(containing text: String) -> XCUIElement {+        let facts = app.descendants(matching: .any)+            .matching(NSPredicate(format: "identifier BEGINSWITH %@", "character-review-fact-"))+        let statement = NSPredicate(format: "label CONTAINS[c] %@", text)+        let byOwnLabel = facts.matching(statement).firstMatch+        // SwiftUI publishes a `Toggle` with a composed label either as one+        // combined label or as a switch over its own text elements, and which+        // one it picks depends on the row. Both are tried rather than guessed.+        return byOwnLabel.exists ? byOwnLabel : facts.containing(statement).firstMatch+    }++    /// Flips a `Toggle` row, and asserts that it flipped.+    ///+    /// **Not `element.tap()`.** That taps the centre of the row, which in a+    /// SwiftUI `Form` lands on the label and does nothing at all — the value+    /// comes back unchanged and the journey carries on asserting over a tick it+    /// never removed. The control sits at the trailing edge, so that is where+    /// the tap goes, and the wait on the value is what makes the gesture a fact+    /// rather than a hope.+    private func flip(+        _ toggle: XCUIElement, _ message: String,+        file: StaticString = #filePath, line: UInt = #line+    ) {+        let before = (toggle.value as? String) ?? "1"+        toggle.coordinate(withNormalizedOffset: CGVector(dx: 0.92, dy: 0.5)).tap()+        let flipped = expectation(+            for: NSPredicate(format: "value != %@", before), evaluatedWith: toggle)+        XCTAssertEqual(+            XCTWaiter().wait(for: [flipped], timeout: 10), .completed, message,+            file: file, line: line)+    }++    // MARK: - Req 2.1: the indicator and the list++    func testTheSweepRaisesAnIndicatorAndTheListPresentsBothProposals() {+        openWorkDetail()+        openReview()++        waitFor(app.anyElement("character-review-keep-ada"), "Ada is proposed")+        waitFor(app.anyElement("character-review-keep-brede"), "Brede is proposed")+        // Decision 5: the compound name split, with the second half offered as a+        // strikeable alias rather than installed silently (Q92).+        waitFor(app.anyElement("character-review-alias-Nightjar"), "The split alias is shown")+    }++    // MARK: - Req 2.2: keeping, with a fact unticked and an alias struck++    func testKeepingACharacterWritesOnlyWhatWasTicked() {+        openWorkDetail()+        openReview()++        // Strike the proposed alias: a pairing the reader does not accept must+        // not become a match key (Q92).+        flip(+            waitFor(app.anyElement("character-review-alias-Nightjar"), "The alias is offered"),+            "The alias is struck")++        // Untick one of Ada's two proposed facts. "Only what was ticked" is the+        // whole claim of this journey, and it says nothing at all unless+        // something is left unticked.+        flip(+            waitFor(factToggle(containing: "lighthouse"), "Ada's lighthouse fact is offered"),+            "The lighthouse fact is unticked")++        waitFor(app.anyElement("character-review-keep-ada"), "Ada can be kept").tap()+        waitUntilGone(+            app.anyElement("character-review-keep-ada"), "The decided row leaves the list",+            timeout: 15)+        // The other proposal is untouched by that decision.+        waitFor(app.anyElement("character-review-keep-brede"), "Brede is still undecided")++        closeReview()++        // Req 5.1/5.2: what was kept shows on the page, with its facts.+        waitFor(+            app.anyElement("work-detail-character"), "The kept character appears on the page",+            timeout: 30)+        scrollUntilPresent(+            app.staticTexts["Ada is called Nightjar by the crew."], in: app,+            "The ticked fact was written")+        XCTAssertFalse(+            app.staticTexts["Ada keeps the lighthouse."].exists,+            "The unticked fact was not written")+        // Q92: the struck alias was not installed either.+        XCTAssertFalse(+            app.staticTexts["Also Nightjar"].exists,+            "The struck alias did not become a match key")+    }++    // MARK: - Req 5.3, Q109: the review sheet is unreachable in edit mode++    /// The sheet's completion reload rebuilds the page's character drafts, so a+    /// review opened over a staged edit session would silently destroy it. The+    /// indicator is therefore hidden while the editor is open — the gating the+    /// manual-pass trigger already had.+    func testTheProposalsIndicatorIsAbsentInEditMode() {+        openWorkDetail()+        waitFor(+            app.anyElement("work-detail-character-proposals"),+            "The sweep's proposals raise the indicator", timeout: 60)++        waitFor(app.buttons["work-detail-edit-button"], "The page offers its editor").tap()+        waitFor(app.anyElement("work-detail-title-field"), "The editor is open")++        waitUntilGone(+            app.anyElement("work-detail-character-proposals"),+            "The indicator is not offered in edit mode", timeout: 15)++        // And it is back the moment the session is left: the proposals were+        // never decided, so they are still owed a decision (Req 2.6).+        waitFor(app.buttons["work-detail-edit-cancel-button"], "The editor offers its X").tap()+        waitFor(+            app.anyElement("work-detail-character-proposals"),+            "The indicator returns in view mode", timeout: 20)+    }++    // MARK: - Req 2.2: skipping++    func testSkippingLeavesTheOtherProposalAndWritesNoCharacter() {+        openWorkDetail()+        openReview()++        waitFor(app.anyElement("character-review-skip-brede"), "Brede can be skipped").tap()+        waitUntilGone(+            app.anyElement("character-review-skip-brede"), "The skipped row leaves the list",+            timeout: 15)+        waitFor(app.anyElement("character-review-keep-ada"), "Ada is still undecided")++        closeReview()++        // A skip writes only system records, so nothing appears on the page.+        XCTAssertFalse(+            app.anyElement("work-detail-character").waitForExistence(timeout: 5),+            "Skipping writes no character")+    }++    // MARK: - Req 2.6: undecided proposals survive dismissal++    func testUndecidedProposalsSurviveDismissal() {+        openWorkDetail()+        openReview()+        closeReview()++        waitFor(+            app.anyElement("work-detail-character-proposals"),+            "The indicator still stands for the undecided proposals", timeout: 30)+    }++    // MARK: - Req 5.4: the entry the fact cites says so++    func testAKeptCharacterIsNamedOnTheEntryItCites() {+        openWorkDetail()+        openReview()+        waitFor(app.anyElement("character-review-keep-brede"), "Brede can be kept").tap()+        closeReview()++        waitFor(+            app.anyElement("work-detail-character"), "The kept character appears on the page",+            timeout: 30)++        // The characters section sits above Chapter Notes, so on this screen the+        // chapter row is now below the fold. `waitForExistence` does not scroll.+        let chapterRow = app.anyElement("work-detail-entry")+        for _ in 0..<6 where !chapterRow.exists {+            app.swipeUp()+        }+        waitFor(chapterRow, "The work's chapter note is listed").tap()++        // Entry detail's section sits between the actions and the capture+        // details, so it needs a scroll on a short screen.+        if !app.anyElement("entry-detail-citing-character").waitForExistence(timeout: 5) {+            scrollEntryDetail(in: app)+        }+        waitFor(+            app.anyElement("entry-detail-citing-character"),+            "The entry names the character citing it", timeout: 20)+    }++    // MARK: - Req 1.11: the manual pass and its outcomes++    func testTheManualPassReportsSuggestionsReady() {+        openWorkDetail()+        // Decide everything the sweep produced, so the manual pass is the only+        // thing that could put a proposal back.+        openReview()+        waitFor(app.anyElement("character-review-skip-ada"), "Ada can be skipped").tap()+        waitFor(app.anyElement("character-review-skip-brede"), "Brede can be skipped").tap()+        closeReview()++        waitFor(app.buttons["work-detail-extract-characters"], "The manual trigger is offered").tap()+        // Req 1.11: a manual pass gets past the suppression the skips wrote, so+        // it ends with proposals rather than with nothing.+        waitFor(+            app.anyElement("work-detail-extract-ready"),+            "The manual pass reports what it found", timeout: 60)+    }+}++/// The same journey with the two other scripted clients, which are the only way+/// to reach Req 1.11's other two states.+final class CharacterExtractionOutcomeUITests: XCTestCase {+    let app = XCUIApplication()++    override func setUp() {+        continueAfterFailure = false+        XCUIDevice.shared.orientation = .portrait+        terminateAndWaitForExit(app)+        app.launchEnvironment["ASTERISM_UI_TEST_SCENARIO"] = "seeded-characters"+        app.launchEnvironment["ASTERISM_UI_TEST_RUN_ID"] = UUID().uuidString+    }++    override func tearDown() {+        terminateAndWaitForExit(app)+    }++    private func openWorkDetail() {+        waitFor(app.collectionViews["recent-list"], "The library opens", timeout: 60)+        waitFor(app.tabBars.buttons["Works"], "The Works tab is reachable").tap()+        waitFor(app.collectionViews["works-list"], "Works lists the seeded library")+        waitFor(+            app.elements(withIdentifierPrefix: "work-row-").firstMatch,+            "The seeded work is listed").tap()+        waitFor(app.anyElement("work-detail-pulse"), "Work detail presents the rating pulse")+    }++    /// Req 1.11: a pass that found nothing still ends with something the reader+    /// can see — the same sentence a failure and a refusal produce, because+    /// Req 1.8 forbids the cause reaching them.+    func testAPassThatFoundNothingSaysSo() {+        app.launchEnvironment["ASTERISM_UI_TEST_EXTRACTION"] = "empty"+        app.launch()+        openWorkDetail()++        XCTAssertFalse(+            app.anyElement("work-detail-character-proposals").waitForExistence(timeout: 10),+            "An empty sweep raises no indicator (Req 4.3)")++        waitFor(app.buttons["work-detail-extract-characters"], "The manual trigger is offered").tap()+        waitFor(+            app.anyElement("work-detail-extract-none"),+            "The pass reports that nothing was found", timeout: 60)+    }++    /// Req 1.11: hidden, not disabled. An action that can never do anything is+    /// not an action.+    func testTheManualTriggerIsAbsentWhileTheModelIsAway() {+        app.launchEnvironment["ASTERISM_UI_TEST_EXTRACTION"] = "unavailable"+        app.launch()+        openWorkDetail()++        XCTAssertFalse(+            app.buttons["work-detail-extract-characters"].waitForExistence(timeout: 10),+            "The trigger is not offered while the model is unavailable")+        XCTAssertFalse(+            app.anyElement("work-detail-character-proposals").exists,+            "An unavailable model sweeps nothing")+    }+}

diff --git a/CHANGELOG.md b/CHANGELOG.mdindex 5334801..0a81f6d 100644--- a/CHANGELOG.md+++ b/CHANGELOG.md@@ -8,6 +8,54 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).  ### Added +- **Characters extracted from your notes, reviewed by you (character-extraction,+  T-2229, app integration).** The feature is now wired end to end. On devices+  with Apple Intelligence, a background sweep (bounded: two works per+  activation, never in Low Power Mode or under thermal pressure, stopping+  per-source the moment the app deactivates) reads a work's notes one source+  per request and proposes characters — every fact a verbatim quote citing the+  note it came from. Nothing is written until you decide: a work page with+  proposals shows an indicator (hidden while you are editing) opening a review+  sheet with per-candidate accept/skip, per-fact ticks, and per-alias strikes;+  skipping suppresses exactly the keys you saw. Accepted characters appear in+  a Characters section on the work page — fully editable, combinable (combine+  then tidy the merged name in the same session works), and deletable — with+  citing characters shown on each entry's detail. A manual "Find characters"+  pass on the work page runs regardless of sweep budgets. Characters sync,+  join the torn/duplicate machinery with their own resolution flow, and+  round-trip through the backup archive: Settings now exports generation 6/7,+  and older archives import unchanged. A post-integration review hardened the+  sweep's scheduling (attempt-aware slot use, per-source stop), the refusal+  refresh paths (re-routed candidates genuinely re-present as bundles), and+  the edit-step basis contract (Q106–Q110). End-to-end stub-driven UI tests+  cover the whole flow; no live model runs in any UI or app test (the package+  suite keeps its one guarded live-call check per model client).++- **Character extraction foundations — store and intelligence (character-extraction,+  T-2229, not yet user-visible).** The groundwork for on-device character+  extraction: schema V7 adds the `Character` and `CharacterSuppression`+  entities plus per-source coverage fingerprints (V6 frozen, plan+  [V5, V6, V7], marker generation "7"); characters join the full torn/duplicate+  machinery with UUID-only sets (silent merge structurally unreachable) and+  collapse repointing; the repository gains the extraction-candidates read,+  decision commits (accept/skip/untick/bundle with suppression LWW), the+  character edit step (create/edit/delete/combine), work merge/delete+  integration, and entry-detail citations; archive generation 6/7 round-trips+  characters, suppressions and coverage, still importing 4/4 and 5/6, with+  pre-feature archives importing cleanly with zero characters. On the+  intelligence side: `ModelLane`, an app-wide single-slot arbiter the+  rule-suggestion pipeline now also uses (interactive asks a background holder+  to yield, never seizes), the guided-generation extraction client (greedy,+  named story characters only), grounding that keeps only verbatim-quoted+  facts, slash-compound splitting into name plus proposed aliases, canonical+  name keys (repeat-until-stable article stripping, Q99), and the extraction+  ledger (held proposals merged per name key per work, budgets that a manual+  pass never charges). A post-integration design review tightened all of this:+  one name-key recipe across modules, shared value types, and a torn re-check+  inside the edit-commit transaction. No UI yet — the review sheet, work-page+  cast, and sweep wiring are the next phase, and nothing runs or is shown+  until they land.+ - **Suggested rules in the composed teaching editor (rule-suggestion,   T-2156).** On devices where Apple Intelligence is available, the app proposes   a title rule and a URL rule for an untaught hostname from its captures, using@@ -30,6 +78,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).  ### Upgrading +- **Character extraction moves the library on to schema V7** (V6 was frozen as+  an intermediate step in the same chain). The step is lightweight — new+  entities and fields only, no data rewrite — and runs in the same single+  first open as any earlier pending steps. A backup archive exported after+  this update is generation 6/7, which older builds cannot read; archives+  from before the update import unchanged. - **Your library migrates to schema V5 the first time you open the app after   this update.** A library still on an older schema traverses every intervening   step in that same single open. The migration is crash-safe and needs no action

diff --git a/CLAUDE.md b/CLAUDE.mdindex 5e657b4..4287a6b 100644--- a/CLAUDE.md+++ b/CLAUDE.md@@ -40,7 +40,7 @@ overwrites state. A restore is irreversible; a container download is not. Use the `Makefile` for everything. Do not hand-roll `xcodebuild` or `swift test` invocations where a target exists. -- `make test-core` — AsterismCore package tests (host, fast, safe). Since `rule-suggestion` the package has a second product, `AsterismIntelligence` (linked by the app and `AsterismTests` only — never the share extension), and its tests include **one live Apple Intelligence call** that degrades to a `withKnownIssue` when the host has no model available. On a host that does have the model, a transient `GenerationError` (rate limited, assets unavailable) is also a known issue — only a response that will not decode into `RuleProposal` fails the target, so the pre-commit bar stays deterministic either way.+- `make test-core` — AsterismCore package tests (host, fast, safe). Since `rule-suggestion` the package has a second product, `AsterismIntelligence` (linked by the app and `AsterismTests` only — never the share extension), and its tests include **two live Apple Intelligence calls** — one per pipeline, decoding into `RuleProposal` and (since `character-extraction`) into `ExtractionResult` — both of which degrade to a `withKnownIssue` when the host has no model available. On a host that does have the model, a transient `GenerationError` (rate limited, assets unavailable) is also a known issue — only a response that will not decode into the expected structure fails the target, so the pre-commit bar stays deterministic either way. - `make test-quick` — unit-test bundle only (simulator) - `make test` / `make test-ui` — full suites (simulator) - `make test-performance-m4` — M4 Core budgets, host only, no device, safe to run. **~20 minutes** (1,213 s measured 2026-08-09, including a 165 s release build): 62% of it is the worst-case single-hostname consolidation in `M4ScalePerformanceTests` (5 samples, each paying its own ~40 s divert before a ~40 s measurement) and the Req 10.1 settling pass (10 samples, each re-seeding 1,350 duplicate rows plus an untimed observation pass). The V4→V5 migration measurement is **gone** — `retire-migration-chain` deleted the pass it timed along with the suite. **The target exits 0**, with four accepted breaches reported as `withKnownIssue` known issues rather than failures (Req 10.1's settling pass, Req 5.5's three diagnosis re-derivations); `RUNS=3` therefore completes all three runs. See `specs/retire-migration-chain/verification-run.md` for the numbers and `docs/agent-notes/testing.md` for recording a band.@@ -79,13 +79,16 @@ shipped app. Unit tests must use `Development` — `Personal` has no testability and the `Asterism Personal` scheme deliberately excludes the unit-test bundle for that reason. -### Rule-suggestion diagnostics+### On-device model diagnostics  The suggestion pipeline logs every attempt, refusal, drop point and settle (with the model phase in ms) under `subsystem:me.nore.ig.Asterism-category:RuleSuggestion`. Reader content (titles, URLs, proposal text) is-readable in `Development` builds only; reasons and numbers are always readable.-Filter on that in Console.app with the phone selected.+category:RuleSuggestion`. Character extraction logs the same shape under+`category:CharacterExtraction` — both go through one body (`PipelineLog`), so+the split is identical: reader content (titles, URLs, note text, evidence spans,+proposed names) is readable in `Development` builds only; reasons and numbers+are always readable. Filter on either category in Console.app with the phone+selected.  ## Performance measurement 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swiftindex 6f83c11..3b72a0d 100644--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swift@@ -15,8 +15,8 @@ import SwiftData /// to open: `addPersistentStore` fails with `NSCocoaErrorDomain` 134504, /// "Cannot use staged migration with an unknown model version" (measured for the /// V4 snapshot this file is modelled on, Q20 of `retire-migration-chain`). The-/// live classes therefore moved to `AsterismSchemaV6`, and this declaration-/// exists only to give `AsterismV6MigrationPlan` a `from` version.+/// live classes therefore moved on, and this declaration exists only to give+/// `AsterismV7MigrationPlan` the `from` version of its first stage. /// /// The classes are nested here so they can carry the same SwiftData entity names /// ("Entry", "Site", …) as the live V6 classes without a top-level collision:

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV6.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV6.swiftindex f8d3afe..e0f2f8d 100644--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV6.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV6.swift@@ -1,19 +1,37 @@ import Foundation import SwiftData -/// The runtime schema. Its body is `Models.swift`, which opens-/// `extension AsterismSchemaV6`.+/// The frozen `configurable-work-types` schema — the shape every installed+/// library was written by before `character-extraction`, and the `from` version+/// of the V6 → V7 lightweight stage. ///-/// V6 is V5 plus the two additions `configurable-work-types` needs: the-/// `WorkTypeEntity` table holding the configured list, and `Work.workTypeID`,-/// the plain UUID column a Work cites its type by (Decision 8 — no relationship,-/// so no CloudKit inverse and no fan-out). `Work.typeRaw` stays exactly where it-/// was: it is the compatibility surface pre-feature builds read and write-/// (Decision 4), not a column this feature repurposes.+/// V6 is V5 plus the `WorkTypeEntity` table and `Work.workTypeID`. It does+/// **not** carry `Character`, `CharacterSuppression`, or the two extraction+/// fingerprint columns; those are V7's additions. ///-/// Both additions are additive and CloudKit-legal by construction: every-/// property is defaulted or optional, nothing is unique, and `WorkTypeEntity`-/// declares no relationships at all.+/// V6 is frozen for the same reason V5 is: *any* edit to its body makes a+/// V6-recorded store refuse to open with `NSCocoaErrorDomain` 134504, "Cannot+/// use staged migration with an unknown model version". The live classes+/// therefore moved to `AsterismSchemaV7`, and this declaration exists only to+/// give `AsterismV7MigrationPlan` a `from` version — and to let+/// `V6RecordedStoreFixture` seed a genuinely 6.0.0-recorded store in-process.+///+/// The classes are nested so they can carry the same SwiftData entity names+/// ("Entry", "Site", …) as the live V7 classes without a top-level collision:+/// the only top-level references are typealiases, and two *top-level* `@Model`s+/// sharing an entity name crash `ModelContext`+/// (`docs/agent-notes/schema-migration.md`). Nothing reads a V6-shaped object at+/// runtime, so these carry stored columns only — no accessors, no business+/// logic.+///+/// # These snapshots are frozen *by reference*, not only by file+///+/// The nesting freezes the class bodies; it does **not** freeze the value types+/// they store. `SegmentRangeSpec`, `SegmentPositionSpec`, `URLIdentityRule` and+/// `JunkSuffixRule` are live top-level types in `ValueObjects.swift`, shared+/// with the live classes. Editing any of them changes the stored shape of this+/// frozen schema silently — and that is exactly what makes a recorded store+/// refuse to open (134504). public enum AsterismSchemaV6: VersionedSchema {     public static let versionIdentifier = Schema.Version(6, 0, 0) @@ -23,29 +41,145 @@ public enum AsterismSchemaV6: VersionedSchema {     } } -/// The migration plan: `[V5, V6]`, one lightweight stage.-///-/// It was `AsterismV5MigrationPlan` — one schema, no stages — after-/// `retire-migration-chain` collapsed the V3 → V4 → V5 chain. The V5 → V6 step-/// adds a column and a table and changes nothing that exists, so it is exactly-/// what `.lightweight` is for: `ModelContainer.init` runs the conversion, and no-/// data pass accompanies it (`docs/agent-notes/schema-migration.md`'s six-step-/// table).-///-/// `AsterismSchemaV5` survives as a frozen snapshot rather than being deleted-/// with the live classes: a staged migration needs its `from` version to be a-/// declared schema whose stored shape matches what installed stores actually-/// hold.-///-/// The stage is **not** `.custom`: a custom stage never fires between-/// structurally identical models, and it would also run inside the share-/// extension, which must never migrate.-public enum AsterismV6MigrationPlan: SchemaMigrationPlan {-    public static var schemas: [any VersionedSchema.Type] {-        [AsterismSchemaV5.self, AsterismSchemaV6.self]+extension AsterismSchemaV6 {+    @Model+    public final class Entry {+        public var id: UUID = UUID()+        public var captureTitle: String = ""+        public var captureTitleSourceRaw: String = CaptureTitleSource.manual.rawValue+        public var rawURLString: String = ""+        public var canonicalURLString: String?+        public var hostname: String = ""+        public var site: Site?+        public var entryIdentityKey: String = ""+        public var identityKeyVersion: Int = 1+        public var conservativeIdentityKey: String = ""+        public var identityBasisRaw: String = EntryIdentityBasis.conservative.rawValue+        public var identityURLRuleID: UUID?+        public var identityURLRuleVersion: Int?+        public var identityNameTitleRuleID: UUID?+        public var identityNameTitleRuleVersion: Int?+        public var urlWorkIdentity: String?+        public var urlWorkRuleID: UUID?+        public var urlWorkRuleVersion: Int?+        public var chapterSequence: String?+        public var chapterSequenceRuleID: UUID?+        public var chapterSequenceRuleVersion: Int?+        public var chapterTitle: String?+        public var chapterTitleProvenanceRaw: String = FieldProvenanceKind.none.rawValue+        public var chapterPatternID: UUID?+        public var chapterPatternVersion: Int?+        public var note: String = ""+        public var ratingRaw: String?+        public var firstCapturedAt: Date = Date(timeIntervalSince1970: 0)+        public var lastSharedAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var work: Work?+        public var workAssignmentProvenanceRaw: String = FieldProvenanceKind.none.rawValue+        public var workPatternID: UUID?+        public var workPatternVersion: Int?+        public var workURLRuleID: UUID?+        public var workURLRuleVersion: Int?+        public var workURLAssignmentKindRaw: String?+        public var intentionallyUnattached: Bool = false++        public init() {}+    }++    @Model+    public final class Work {+        public var id: UUID = UUID()+        public var displayTitle: String = ""+        public var lastParsedTitle: String?+        public var siteHostname: String = ""+        public var site: Site?+        public var urlIdentity: String?+        public var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue+        public var urlIdentityRuleID: UUID?+        public var urlIdentityRuleVersion: Int?+        public var workURLString: String?+        public var genericNotes: String = ""+        public var typeRaw: String = WorkType.other.rawValue+        public var workTypeID: UUID?+        public var genreTags: [String] = []+        public var titleProvenanceRaw: String = TitleProvenance.manual.rawValue+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)+        @Relationship(deleteRule: .nullify, inverse: \Entry.work)+        public var entries: [Entry]?++        public init() {}     } -    public static var stages: [MigrationStage] {-        [.lightweight(fromVersion: AsterismSchemaV5.self, toVersion: AsterismSchemaV6.self)]+    @Model+    public final class Site {+        public var hostname: String = ""+        public var displayName: String = ""+        public var modeRaw: String = SiteMode.untaught.rawValue+        @Relationship(deleteRule: .cascade, inverse: \TitlePattern.site)+        public var patterns: [TitlePattern]?+        @Relationship(deleteRule: .cascade, inverse: \URLRulePattern.site)+        public var urlRules: [URLRulePattern]?+        /// Inverse of `Entry.site`, present only because CloudKit requires every+        /// relationship to have one. Internal for the same reason the live class+        /// keeps it internal (Q17): traversing it faults every Entry for a+        /// hostname.+        @Relationship(deleteRule: .nullify, inverse: \Entry.site)+        var entries: [Entry]?+        /// Inverse of `Work.site`. Same reasoning as `entries`.+        @Relationship(deleteRule: .nullify, inverse: \Work.site)+        var works: [Work]?+        public var urlIdentityRule: URLIdentityRule?+        public var junkSuffixRule: JunkSuffixRule?++        public init() {}+    }++    @Model+    public final class TitlePattern {+        public var id: UUID = UUID()+        public var version: Int = 1+        public var isActive: Bool = false+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var formRaw: String = PatternForm.segment.rawValue+        public var segmentWorkAnchor: SegmentRangeSpec?+        public var segmentIgnoredAnchors: [SegmentPositionSpec]?+        public var phrasePrefix: String?+        public var phraseSeparator: String?+        public var phraseSuffix: String?+        public var fieldOrderRaw: String?+        public var trimPrefix: String?+        public var trimSuffix: String?+        public var chapterless: Bool = false+        public var site: Site?++        public init() {}+    }++    @Model+    public final class URLRulePattern {+        public var id: UUID = UUID()+        public var version: Int = 1+        public var isCurrent: Bool = false+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var originRaw: String = URLRuleOrigin.readerTaught.rawValue+        public var definitionData: Data = Data()+        public var site: Site?++        public init() {}+    }++    @Model+    public final class WorkTypeEntity {+        public var id: UUID = UUID()+        public var name: String = ""+        public var nameModifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var stateRaw: String = WorkTypeState.active.rawValue+        public var stateModifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var canonicalID: UUID?+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)++        public init() {}     } }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV7.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV7.swiftnew file mode 100644index 0000000..1a1c4a1--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV7.swift@@ -0,0 +1,51 @@+import Foundation+import SwiftData++/// The runtime schema. Its body is `Models.swift`, which opens+/// `extension AsterismSchemaV7`.+///+/// V7 is V6 plus what `character-extraction` needs: the `Character` table+/// (Decision 1 — reader-authored data), the `CharacterSuppression` table+/// (Q60/Q72 — a system record, never torn), and the two derived coverage+/// fingerprints `Entry.characterExtractionFingerprint` and+/// `Work.genericNotesExtractionFingerprint` (Q59).+///+/// Every addition is CloudKit-legal by construction: every property is defaulted+/// or optional, nothing is unique, and both new relationships (`Character.work`,+/// `CharacterSuppression.work`) are `.nullify` with an inverse on `Work`+/// (Q58).+public enum AsterismSchemaV7: VersionedSchema {+    public static let versionIdentifier = Schema.Version(7, 0, 0)++    public static var models: [any PersistentModel.Type] {+        [Entry.self, Work.self, Site.self, TitlePattern.self, URLRulePattern.self,+         WorkTypeEntity.self, Character.self, CharacterSuppression.self]+    }+}++/// The migration plan: `[V5, V6, V7]`, two lightweight stages.+///+/// **The V5 stage stays** (Q80). Retiring it would carry+/// `retire-migration-chain` Decision 6's population precondition — every device+/// verified past the migration — for no gain here, and dropping it would make+/// every V5-seeded fixture unopenable, because declaring a plan makes a store+/// older than the plan's oldest schema fail closed rather than convert+/// implicitly (`docs/agent-notes/schema-migration.md`).+///+/// Both stages are `.lightweight`: V6 → V7 adds two tables and two columns and+/// changes nothing that exists, so `ModelContainer.init` runs the whole+/// conversion and no data pass accompanies it. Neither is `.custom`: a custom+/// stage never fires between structurally identical models, and it would also+/// run inside the share extension, which must never migrate.+public enum AsterismV7MigrationPlan: SchemaMigrationPlan {+    public static var schemas: [any VersionedSchema.Type] {+        [AsterismSchemaV5.self, AsterismSchemaV6.self, AsterismSchemaV7.self]+    }++    public static var stages: [MigrationStage] {+        [+            .lightweight(fromVersion: AsterismSchemaV5.self, toVersion: AsterismSchemaV6.self),+            .lightweight(fromVersion: AsterismSchemaV6.self, toVersion: AsterismSchemaV7.self),+        ]+    }+}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupGroupProjection.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupGroupProjection.swiftindex 5a5422a..b8d62bb 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupGroupProjection.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupGroupProjection.swift@@ -61,12 +61,22 @@ enum BackupGroupProjection {         let types: WorkTypeDirectory         let entries: [EntryGroup]         let works: [WorkGroup]+        /// Every character in the store, as logical records — enumerated whole+        /// rather than works→children, so a sync orphan exports with a nil work+        /// reference instead of silently vanishing from the backup (Q78).+        ///+        /// In UUID order, and **read by the 6/7 payload**: 4/4 and 5/6 have+        /// nowhere to write characters but the torn-group refusal applies to+        /// every format, so the grouping happens once here and the one format+        /// that can carry them takes it from here rather than repeating it.+        let characters: [CharacterGroup]     }      /// - Throws: `BackupV4ExportError.tornGroups` when the store holds a torn     ///   group — the biconditional of Req 8.1, since nothing else here refuses.     static func project(-        entries: [Entry], works: [Work], types: WorkTypeDirectory+        entries: [Entry], works: [Work], characters: [CharacterRecord] = [],+        types: WorkTypeDirectory     ) throws -> Projection {         // The Definitions' assignment normalisation (Q106): an Entry group whose         // rows point at two members of one Work set is *not* torn, and the one@@ -78,13 +88,20 @@ enum BackupGroupProjection {         let entryGroups = LibraryRepository.entryGroups(             entries, canonicalWorkIDs: canonicalWorkIDs)         let workGroups = LibraryRepository.workGroups(works, types: types)+        let characterGroups = LibraryRepository.characterGroups(characters)          let tornEntries = entryGroups.values.filter(\.isTorn)         let tornWorks = workGroups.values.filter(\.isTorn)-        guard tornEntries.isEmpty, tornWorks.isEmpty else {+        // Req 6.5: a torn character group is the same thing an archive cannot+        // hold — one record with two authored values — so it refuses the export+        // exactly as a torn Entry or Work does. Without this arm the refusal has+        // no site at all and a torn character would export one variant silently.+        let tornCharacters = characterGroups.values.filter(\.isTorn)+        guard tornEntries.isEmpty, tornWorks.isEmpty, tornCharacters.isEmpty else {             throw BackupV4ExportError.tornGroups(                 tornGroupsPayload(                     tornEntries: tornEntries, tornWorks: tornWorks,+                    tornCharacters: tornCharacters,                     entries: entries, workSets: workSets))         } @@ -92,7 +109,8 @@ enum BackupGroupProjection {             canonicalWorkIDs: canonicalWorkIDs,             types: types,             entries: entryGroups.values.sorted { $0.id.uuidString < $1.id.uuidString },-            works: workGroups.values.sorted { $0.id.uuidString < $1.id.uuidString })+            works: workGroups.values.sorted { $0.id.uuidString < $1.id.uuidString },+            characters: characterGroups.values.sorted { $0.id.uuidString < $1.id.uuidString })     }      /// Req 8.4's second arm. The blocking Work set is named only when every torn@@ -102,11 +120,15 @@ enum BackupGroupProjection {     private static func tornGroupsPayload(         tornEntries: [EntryGroup],         tornWorks: [WorkGroup],+        tornCharacters: [CharacterGroup],         entries: [Entry],         workSets: [WorkDuplicateSet]     ) -> TornGroupsPayload {-        let count = tornEntries.count + tornWorks.count-        guard tornWorks.isEmpty else {+        let count = tornEntries.count + tornWorks.count + tornCharacters.count+        // A torn character waits behind nothing — its set has one member and no+        // assignment (Q76) — so naming a blocking Work set would send the reader+        // to a decision that unblocks only part of the refusal.+        guard tornWorks.isEmpty, tornCharacters.isEmpty else {             return TornGroupsPayload(count: count, blockingWorkSet: nil)         }         let entrySets = DuplicateScan.entrySets(of: entries, workSets: workSets)

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupImportCharacters.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupImportCharacters.swiftnew file mode 100644index 0000000..c374317--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupImportCharacters.swift@@ -0,0 +1,149 @@+import Foundation+import SwiftData++// The character half of a 6/7 import (Req 6.1).+//+// **Additive, UUID-keyed, and never a deletion** — the upsert's posture, applied+// to the three arrays this generation adds:+//+// * a character matches by application UUID and is value-guarded by+//   `modifiedAt`, so an older archive cannot regress a newer edit, and a *torn*+//   group is skipped whole exactly as a torn Work or Entry is (applying an+//   archive over it would overwrite a variant the reader owes a decision on);+// * a suppression matches by row UUID and is value-guarded by `actionAt`, which+//   is the same comparable Q82's read-through uses — so an archived suppression+//   can never undo a newer clear (Req 6.6);+// * a coverage pair carries no timestamp and needs none: it is imported exactly+//   where its fingerprint still describes the source's current text, and dropped+//   otherwise (Q81).+//+// Every insert is match-guarded and every write is value-guarded, which is where+// idempotence comes from: importing the same archive twice writes nothing the+// second time.++extension LibraryRepository {++    /// Merges an archive's characters, suppressions and coverage into the live+    /// library. Does not save — the caller's chunk save covers it.+    ///+    /// - Parameters:+    ///   - workTargets: the Work row each application UUID's group points at,+    ///     as the Work step already computed it. A character whose work is not+    ///     in the map lands unattached, which is the tolerated in-flight state+    ///     Req 6.7 names rather than a reason to drop the record.+    internal static func mergeImportedCharacters(+        _ payload: BackupV6Payload,+        workTargets: [UUID: Work],+        workRows: [UUID: [Work]],+        entryRows: [UUID: [Entry]],+        context: ModelContext+    ) throws {+        var characterRows = Dictionary(+            grouping: try context.fetch(FetchDescriptor<CharacterRecord>()), by: \.id)+        for record in payload.characters {+            let target = record.workID.flatMap { workTargets[$0] }+            if let rows = characterRows[record.id], !rows.isEmpty {+                guard let group = characterGroup(id: record.id, rows: rows), !group.isTorn,+                    record.modifiedAt >= group.modifiedAt+                else { continue }+                // Every row of the group takes the write, or the archive lands+                // on one row and tears the group it was applying to (Req 2.7's+                // rule, and Q85's).+                for row in group.rows {+                    apply(record, to: row)+                    if let target { row.work = target }+                }+            } else {+                let character = CharacterRecord(+                    id: record.id, name: record.name, nameKey: record.nameKey,+                    aliases: record.aliases, note: record.note, facts: record.facts,+                    timestamp: record.createdAt)+                character.modifiedAt = record.modifiedAt+                context.insert(character)+                character.work = target+                characterRows[record.id] = [character]+            }+        }++        var suppressionRows = Dictionary(+            grouping: try context.fetch(FetchDescriptor<CharacterSuppression>()), by: \.id)+        for record in payload.suppressions {+            let target = record.workID.flatMap { workTargets[$0] }+            if let rows = suppressionRows[record.id], !rows.isEmpty {+                for row in rows where record.actionAt >= row.actionAt {+                    apply(record, to: row)+                    if let target { row.work = target }+                }+            } else {+                let row = CharacterSuppression(+                    id: record.id, kind: record.kind, nameKey: record.nameKey,+                    source: record.source, evidence: record.evidence, status: record.status,+                    actionAt: record.actionAt)+                // The raw columns verbatim, so a value written by a later+                // build's wider set survives the round trip rather than being+                // coerced to this build's default.+                row.kindRaw = record.kindRaw+                row.statusRaw = record.statusRaw+                context.insert(row)+                row.work = target+                suppressionRows[record.id] = [row]+            }+        }++        applyImportedCoverage(+            payload.coverage, workRows: workRows, entryRows: entryRows)+    }++    /// Q81's self-validation, over every row of the addressed group.+    private static func applyImportedCoverage(+        _ records: [BackupV6Coverage],+        workRows: [UUID: [Work]],+        entryRows: [UUID: [Entry]]+    ) {+        for record in records {+            switch record.sourceKind {+            case .genericNotes:+                for row in workRows[record.recordID] ?? []+                where CharacterCoverageFingerprint.of(row.genericNotes) == record.fingerprint {+                    row.genericNotesExtractionFingerprint = record.fingerprint+                }+            case .entry:+                for row in entryRows[record.recordID] ?? []+                where CharacterCoverageFingerprint.of(row.note) == record.fingerprint {+                    row.characterExtractionFingerprint = record.fingerprint+                }+            case nil:+                // A discriminator no build writes. The codec refuses one before+                // the plan exists; a hand-built plan reaching here is ignored+                // rather than guessed at.+                continue+            }+        }+    }++    /// The mutable half of an archived character, shared by the insert and the+    /// update so the two cannot drift apart.+    ///+    /// `nameKey` travels rather than being re-derived: it is retained through+    /// renames (Q19/Q46), and recomputing it from `name` would silently re-key+    /// every character an archive restored.+    internal static func apply(_ record: BackupV6Character, to character: CharacterRecord) {+        character.name = record.name+        character.nameKey = record.nameKey+        character.aliases = record.aliases+        character.note = record.note+        character.facts = record.facts+        character.createdAt = record.createdAt+        character.modifiedAt = record.modifiedAt+    }++    internal static func apply(_ record: BackupV6Suppression, to row: CharacterSuppression) {+        row.kindRaw = record.kindRaw+        row.nameKey = record.nameKey+        row.sourceKindRaw = record.sourceKindRaw+        row.sourceEntryID = record.sourceEntryID+        row.evidence = record.evidence+        row.statusRaw = record.statusRaw+        row.actionAt = record.actionAt+    }+}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupImportWorkTypes.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupImportWorkTypes.swiftindex 7de5ce7..9ed314d 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupImportWorkTypes.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupImportWorkTypes.swift@@ -21,13 +21,18 @@ extension LibraryRepository {     /// something changed.     ///     /// - Parameters:+    ///   - workTypes: the archive's type list, and `works` the records citing+    ///     it. Taken as the two arrays rather than a payload because every+    ///     generation that carries a type list carries the *same* two record+    ///     types (Q63) — a per-generation overload would be one body twice.     ///   - exportedAt: the archive's own timestamp, worn by rows minted from a     ///     work's `typeName` — there is no list record to take one from (Q33).     ///   - importedAt: the quantized import-time clock, worn *only* by the     ///     restore of an entry this library already held. That one write is the     ///     reader acting now, and it has to assert over a removal older than it.     internal static func mergeImportedWorkTypes(-        _ payload: BackupV5Payload,+        workTypes: [BackupV5WorkTypeRecord],+        works: [BackupV5Work],         exportedAt: Date,         importedAt: Date,         context: ModelContext,@@ -57,7 +62,7 @@ extension LibraryRepository {             wrote = true         } -        for entry in archivedTypeIdentities(payload.workTypes) {+        for entry in archivedTypeIdentities(workTypes) {             // Req 7.8: a name that is empty or carries control characters never             // becomes a visible type. A `merged` entry is not a visible type —             // it is a redirection — so it is admitted whatever it is called,@@ -114,7 +119,7 @@ extension LibraryRepository {         // Citations arrive pre-validated: `unresolvedTypeCitations` checks the         // name before its per-id dedup so an invalid snapshot cannot shadow a         // valid one.-        for citation in unresolvedTypeCitations(payload.works, in: local) {+        for citation in unresolvedTypeCitations(works, in: local) {             let name = WorkTypeName.trimmed(citation.name)             // Re-asked per citation rather than once: a mint two citations ago is             // what the next same-named one has to alias to, or one archive would

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupImporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupImporter.swiftindex f74e954..a88cb04 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupImporter.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupImporter.swift@@ -5,21 +5,24 @@ import OSLog  /// The records an accepted archive carries, and which format wrote them. ///-/// Two cases rather than one up-converted shape, because the two formats mean-/// genuinely different things by an untyped work and the difference is not-/// expressible in one record. A 4/4 archive says "untyped as a pre-feature build-/// can say it", which must not untype a configured or unrecognised assignment-/// (Q35); a 5/6 archive says exactly what it means. Everything *else* the two+/// One case per generation rather than one up-converted shape, because the+/// generations mean genuinely different things by an untyped work and the+/// difference is not expressible in one record. A 4/4 archive says "untyped as a+/// pre-feature build can say it", which must not untype a configured or+/// unrecognised assignment (Q35); a 5/6 archive says exactly what it means, and+/// a 6/7 archive says it while also carrying characters. Everything *else* they /// carry is literally the same record types (Decision 12), which is why the four-/// shared arrays read straight off either case.+/// shared arrays read straight off any case. public enum BackupImportPayload: Sendable, Equatable {     case v4Archive(BackupV4Payload)     case v5Archive(BackupV5Payload)+    case v6Archive(BackupV6Payload)      public var entries: [BackupV4Entry] {         switch self {         case .v4Archive(let payload): payload.entries         case .v5Archive(let payload): payload.entries+        case .v6Archive(let payload): payload.entries         }     } @@ -27,6 +30,7 @@ public enum BackupImportPayload: Sendable, Equatable {         switch self {         case .v4Archive(let payload): payload.sites         case .v5Archive(let payload): payload.sites+        case .v6Archive(let payload): payload.sites         }     } @@ -34,6 +38,7 @@ public enum BackupImportPayload: Sendable, Equatable {         switch self {         case .v4Archive(let payload): payload.titlePatterns         case .v5Archive(let payload): payload.titlePatterns+        case .v6Archive(let payload): payload.titlePatterns         }     } @@ -41,16 +46,29 @@ public enum BackupImportPayload: Sendable, Equatable {         switch self {         case .v4Archive(let payload): payload.urlRules         case .v5Archive(let payload): payload.urlRules+        case .v6Archive(let payload): payload.urlRules         }     }      /// How many Work records the archive holds. A count rather than the records-    /// themselves: the two formats' Work records are different types, and every+    /// themselves: the formats' Work records are different types, and every     /// caller outside the commit loop only ever wanted the number.     public var workCount: Int {         switch self {         case .v4Archive(let payload): payload.works.count         case .v5Archive(let payload): payload.works.count+        case .v6Archive(let payload): payload.works.count+        }+    }++    /// The type list and the works that cite it, for the generations that carry+    /// one. 4/4 carries neither, and its untyped record means something the+    /// merge must not act on (Q35), so it answers with nothing.+    internal var workTypeRecords: (types: [BackupV5WorkTypeRecord], works: [BackupV5Work]) {+        switch self {+        case .v4Archive: ([], [])+        case .v5Archive(let payload): (payload.workTypes, payload.works)+        case .v6Archive(let payload): (payload.workTypes, payload.works)         }     } }@@ -59,10 +77,11 @@ public enum BackupImportPayload: Sendable, Equatable { /// process lease. Represents a complete validated prospective graph ready to be /// materialized atomically. ///-/// Two source versions are accepted: native `4/4`, and the `5/6` this feature-/// mints (Req 7.6). The `2/2` and `3/3` import paths were retired once every-/// archive worth importing had been re-exported at 4/4; recovering a pre-M3.5-/// archive now means checking out a build that still carries those codecs.+/// Three source versions are accepted: native `4/4`, `5/6`, and the `6/7` this+/// feature mints (Req 6.1). The `2/2` and `3/3` import paths were retired once+/// every archive worth importing had been re-exported at 4/4; recovering a+/// pre-M3.5 archive now means checking out a build that still carries those+/// codecs. public struct BackupImportPlan: Sendable, Equatable {     public let metadata: BackupImportMetadata     public let payload: BackupImportPayload@@ -159,18 +178,18 @@ public enum BackupImportError: Error, Equatable, Sendable, CustomStringConvertib /// claims the pair. Builds an immutable `BackupImportPlan` outside the repository /// actor and without a process lease. Never mutates the selected file. ///-/// Import supports exact native `4/4` and `5/6`. Mixed pairs and malformed or-/// future headers reject before repository mutation — which is the same door a-/// *pre-feature* build meets `(5, 6)` at, and why a 5/6 archive cannot half-apply-/// on one (Req 7.6).+/// Import supports exact native `4/4`, `5/6` and `6/7`. Mixed pairs and malformed+/// or future headers reject before repository mutation — which is the same door a+/// *pre-feature* build meets `(6, 7)` at, and why a 6/7 archive cannot half-apply+/// on one (`character-extraction` Req 6.1). public enum BackupImporter {     private static let logger = Logger(subsystem: "me.nore.ig.Asterism", category: "BackupImporter")      // MARK: - Plan Dispatch (Req 5.1, 5.2, Decision 2)      /// Builds a validated prospective import plan from raw backup data. Native-    /// `4/4` and `5/6` are the accepted source versions; everything else is-    /// unsupported. Runs entirely outside the repository actor and holds no+    /// `4/4`, `5/6` and `6/7` are the accepted source versions; everything else+    /// is unsupported. Runs entirely outside the repository actor and holds no     /// process lease.     public static func plan(from data: Data) throws -> BackupImportPlan {         logger.debug("Building import plan from \(data.count) bytes")@@ -183,6 +202,8 @@ public enum BackupImporter {             return try planFromV4Archive(data)         case (5, 6):             return try planFromV5Archive(data)+        case (6, 7):+            return try planFromV6Archive(data)         case (2, 2), (3, 3):             // Recognised, and deliberately no longer readable. Say so plainly:             // these archives were restorable until the older import paths were@@ -191,7 +212,7 @@ public enum BackupImporter {                 reason: """                     this backup is in the older \(formatVersion)/\(schemaVersion) \                     format, which this version of Asterism can no longer restore. \-                    Only backups exported by a recent version (4/4 or 5/6) can be \+                    Only backups exported by a recent version (4/4, 5/6 or 6/7) can \                     imported.                     """             )@@ -199,7 +220,7 @@ public enum BackupImporter {             throw BackupImportError.unsupportedFormat(                 reason:                     "format \(formatVersion)/schema \(schemaVersion) is not supported; "-                    + "expected 4/4 or 5/6"+                    + "expected 4/4, 5/6 or 6/7"             )         }     }@@ -248,6 +269,28 @@ public enum BackupImporter {             metadata: metadata, payload: .v5Archive(document.payload), counts: counts)     } +    private static func planFromV6Archive(_ data: Data) throws -> BackupImportPlan {+        logger.debug("Decoding native Backup V6")+        let document: BackupV6Document+        do {+            document = try BackupV6Codec.decode(data)+        } catch {+            throw BackupImportError.decodingFailed(reason: String(describing: error))+        }+        let counts = try validateV6(document.payload)+        let metadata = BackupImportMetadata(+            formatVersion: document.backupFormatVersion,+            schemaVersion: document.databaseSchemaVersion,+            appBuild: document.appBuild,+            exportedAt: document.exportedAt,+            capabilityGate: document.capabilityGate,+            entryCount: document.entryCount,+            workCount: document.workCount+        )+        return BackupImportPlan(+            metadata: metadata, payload: .v6Archive(document.payload), counts: counts)+    }+     /// Materializes and V4-validates a prospective import graph entirely in     /// memory, so a malformed composed tuple fails before any store or readiness     /// marker can be touched.@@ -274,6 +317,19 @@ public enum BackupImporter {         }     } +    /// The same gate over a 6/7 graph. The characters, suppressions and coverage+    /// ride into the in-memory store with the rest, so a payload whose records+    /// contradict the schema fails here rather than at the commit.+    private static func validateV6(_ payload: BackupV6Payload) throws -> LibraryRecordCounts {+        do {+            return try LibraryRepository.validateImportPlanPayloadV6(payload)+        } catch {+            throw BackupImportError.validationFailed(+                reason: "prospective V6 graph failed validation: \(error)"+            )+        }+    }+     // MARK: - Version Detection      /// Reads the format and schema versions from the JSON envelope without

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupJSONCodecSupport.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupJSONCodecSupport.swiftindex 2dc2288..e1a7f6e 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupJSONCodecSupport.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupJSONCodecSupport.swift@@ -1,4 +1,3 @@-import CryptoKit import Foundation  // Extracted from the retired `LegacyBackupV2Codec` when the 2/2 and 3/3 import@@ -22,8 +21,7 @@ internal enum BackupCanonicalJSON {      /// Deterministic bytes: sorted keys so a re-encode reproduces the checksum,     /// unescaped slashes so a URL reads as itself in the file.-    static let outputFormatting: JSONEncoder.OutputFormatting =-        [.sortedKeys, .withoutEscapingSlashes]+    static let outputFormatting: JSONEncoder.OutputFormatting = .canonical      /// The encoder both codecs write with — envelope, payload, and the checksum     /// re-encode alike.@@ -49,9 +47,7 @@ internal enum BackupCanonicalJSON {     }      /// The payload checksum's digest, lowercase hex.-    static func sha256Hex(_ data: Data) -> String {-        SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined()-    }+    static func sha256Hex(_ data: Data) -> String { Hexadecimal.sha256(data) }      static func encodeDate(_ date: Date, encoder: Encoder) throws {         var container = encoder.singleValueContainer()

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV4Exporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV4Exporter.swiftindex b4fab94..09e8409 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV4Exporter.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV4Exporter.swift@@ -173,8 +173,15 @@ extension LibraryRepository: BackupV4SnapshotProviding {         // shape the archive cannot hold is a torn group. The projection is what         // replaced `requireUniqueIdentities`, which refused over every repeated         // UUID including the ones that agree.+        // Characters are enumerated whole, never works→children (Q78): a+        // character whose work has not arrived is a tolerated in-flight state+        // (Req 6.7), and a child-of-work walk would drop it out of the backup+        // silently. 4/4 and 5/6 have nowhere to write them, but the torn-group+        // refusal applies to every format — an archive of a torn character is+        // one record with two authored values whichever generation writes it.+        let characters = try context.fetch(FetchDescriptor<CharacterRecord>())         let groups = try BackupGroupProjection.project(-            entries: entries, works: works,+            entries: entries, works: works, characters: characters,             types: workTypeDirectory(context: context))         // Req 4.5, Q14: a URL rule whose stored definition will not decode         // cannot be archived — the record mapper needs a typed value for every

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV5Exporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV5Exporter.swiftindex a4eff6a..d0768f5 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV5Exporter.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV5Exporter.swift@@ -91,6 +91,20 @@ extension LibraryRepository: BackupV5SnapshotProviding {     /// `projectCommonArchiveRecords`, which is what keeps a 5/6 and a 4/4 backup     /// of one library describing one library.     internal static func projectV5Payload(context: ModelContext) throws -> BackupV5Payload {+        try projectV5Payload(from: context).payload+    }++    /// The same, keeping the common projection.+    ///+    /// 6/7 is 5/6 plus three character arrays, and every input it needs — the+    /// character groups, the work groups, the entry groups — is already in+    /// `common`. Re-deriving them (a second whole-table fetch of characters, and+    /// a third of works and entries for the coverage pairs) made one export walk+    /// the library twice and gave the two walks two chances to describe two+    /// moments.+    internal static func projectV5Payload(+        from context: ModelContext+    ) throws -> (payload: BackupV5Payload, common: ArchiveCommonProjection) {         let common: ArchiveCommonProjection         do {             // No type refusal (Req 7.1): a raw value outside the closed set is@@ -135,7 +149,7 @@ extension LibraryRepository: BackupV5SnapshotProviding {         } catch let error as BackupV4ExportError {             throw BackupV5ExportError(error)         }-        return payload+        return (payload, common)     }      /// The 5/6 Work record. Identical to the 4/4 mapper but for the type

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Codec.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Codec.swiftnew file mode 100644index 0000000..0596045--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Codec.swift@@ -0,0 +1,257 @@+import Foundation++/// The strict 6/7 archive codec: canonical JSON, a SHA-256 checksum over the+/// payload bytes, entry/work counts, root-strict envelope validation, typed+/// nested decode, and a reference validator over the shared record checks plus+/// this generation's own rules.+///+/// Cloned from `BackupV5Codec` rather than grown out of it — a shipped archive+/// format is never redefined in place. What the generations share is the+/// *record-level* checking body (`BackupArchiveReferenceChecks`), the envelope+/// shape (`BackupArchiveShapeValidator`) and the canonical JSON settings; what is+/// restated here is everything that names a version.+///+/// The capability gate is pinned to the literal `"m4"`, for the reason 4/4 and+/// 5/6 pin it: the payload is frozen the moment it ships, and a later+/// `AsterismCapabilities.current` must not change what a 6/7 backup declares.+public enum BackupV6Codec {+    /// Pinned literally. 6/7 ships at the m4 gate; a future gate flip cannot+    /// retroactively change what these files say.+    static let gate = "m4"++    // MARK: - Encode++    public static func encode(+        payload: BackupV6Payload,+        metadata: BackupV6Metadata+    ) throws -> Data {+        let encoder = BackupCanonicalJSON.encoder()++        let payloadData = try encoder.encode(payload)+        let checksum = BackupCanonicalJSON.sha256Hex(payloadData)++        let document = BackupV6Document(+            appBuild: metadata.appBuild,+            exportedAt: metadata.exportedAt,+            capabilityGate: Self.gate,+            entryCount: payload.entries.count,+            workCount: payload.works.count,+            checksum: checksum,+            payload: payload+        )++        return try encoder.encode(document)+    }++    // MARK: - Decode++    /// Decodes and validates a 6/7 document. Validates: envelope format/schema,+    /// capability gate, duplicate keys, strict root shape, entry/work counts,+    /// payload checksum, and all references and tuples.+    ///+    /// The version pair is exact. `(6, 6)` and `(5, 7)` are rejected here, not+    /// only at the importer's dispatch: a mismatched pair is a file this codec+    /// cannot claim to understand whichever door it arrived through.+    public static func decode(_ data: Data) throws -> BackupV6Document {+        do {+            try DuplicateJSONKeyValidator.validate(data)+            try BackupV6ShapeValidator.validate(data)++            let document = try BackupCanonicalJSON.decoder()+                .decode(BackupV6Document.self, from: data)++            guard document.backupFormatVersion == BackupV6Document.formatVersion else {+                throw BackupV6CodecError.invalidFormatVersion(document.backupFormatVersion)+            }+            guard document.databaseSchemaVersion == BackupV6Document.schemaVersion else {+                throw BackupV6CodecError.invalidSchemaVersion(document.databaseSchemaVersion)+            }+            guard document.capabilityGate == Self.gate else {+                throw BackupV6CodecError.unsupportedGate(document.capabilityGate)+            }++            guard document.entryCount == document.payload.entries.count else {+                throw BackupV6CodecError.countMismatch(+                    field: "entryCount",+                    expected: document.entryCount,+                    actual: document.payload.entries.count+                )+            }+            guard document.workCount == document.payload.works.count else {+                throw BackupV6CodecError.countMismatch(+                    field: "workCount",+                    expected: document.workCount,+                    actual: document.payload.works.count+                )+            }++            // Verify checksum: re-encode payload with the same settings.+            let payloadData = try BackupCanonicalJSON.encoder().encode(document.payload)+            let computedChecksum = BackupCanonicalJSON.sha256Hex(payloadData)+            guard document.checksum == computedChecksum else {+                throw BackupV6CodecError.checksumMismatch(+                    expected: document.checksum,+                    actual: computedChecksum+                )+            }++            try BackupV6ReferenceValidator.validate(payload: document.payload)++            return document+        } catch let error as BackupV6CodecError { throw error }+        catch let error as BackupCodecError { throw error }+        catch {+            throw BackupV6CodecError.decodingFailed(reason: String(describing: error))+        }+    }+}++// MARK: - V6 Codec Error++public enum BackupV6CodecError: Error, Equatable, Sendable, CustomStringConvertible {+    case encodingFailed(reason: String)+    case decodingFailed(reason: String)+    case invalidFormatVersion(Int)+    case invalidSchemaVersion(Int)+    case unsupportedGate(String)+    case countMismatch(field: String, expected: Int, actual: Int)+    case checksumMismatch(expected: String, actual: String)+    case unresolvedReference(type: String, id: String, reference: String)+    case invalidStateTuple(type: String, id: String, reason: String)++    /// The shared record-level checks' finding, named as a 6/7 refusal.+    internal init(_ issue: BackupArchiveReferenceIssue) {+        switch issue {+        case .unresolvedReference(let type, let id, let reference):+            self = .unresolvedReference(type: type, id: id, reference: reference)+        case .invalidStateTuple(let type, let id, let reason):+            self = .invalidStateTuple(type: type, id: id, reason: reason)+        }+    }++    public var description: String {+        switch self {+        case .encodingFailed(let reason): "Backup V6 encoding failed: \(reason)"+        case .decodingFailed(let reason): "Backup V6 decoding failed: \(reason)"+        case .invalidFormatVersion(let v): "Backup V6 unsupported format version: \(v)"+        case .invalidSchemaVersion(let v): "Backup V6 unsupported schema version: \(v)"+        case .unsupportedGate(let g): "Backup V6 unsupported capability gate: \(g)"+        case .countMismatch(let field, let expected, let actual):+            "Backup V6 \(field) mismatch: header says \(expected), payload has \(actual)"+        case .checksumMismatch(let expected, let actual):+            "Backup V6 checksum mismatch: expected \(expected), computed \(actual)"+        case .unresolvedReference(let type, let id, let reference):+            "Backup V6 \(type) \(id) has unresolved reference: \(reference)"+        case .invalidStateTuple(let type, let id, let reason):+            "Backup V6 invalid \(type) tuple \(id): \(reason)"+        }+    }+}++// MARK: - V6 Metadata++public struct BackupV6Metadata: Sendable {+    public let appBuild: String+    public let exportedAt: Date++    public init(appBuild: String, exportedAt: Date) {+        self.appBuild = appBuild+        self.exportedAt = exportedAt+    }+}++// MARK: - V6 Shape Validator++/// Root-strict envelope validation, over the shape every generation shares.+internal enum BackupV6ShapeValidator {+    static func validate(_ data: Data) throws {+        try BackupArchiveShapeValidator.validate(data)+    }+}++// MARK: - V6 Reference Validator++/// The shared record checks, 5/6's type-list rules, and the three things only+/// 6/7 carries.+///+/// **What it deliberately does not check.** A fact's `sourceEntryID` and a fact+/// suppression's are exempt (Decision 2): a citation whose entry the reader+/// deleted — or whose entry has not synced — is a tolerated state, not+/// corruption, and refusing here would fail a whole backup over routine+/// curation. A coverage record's `recordID` is exempt too, because an imported+/// pair validates itself against the source's current text (Q81), so a pair+/// naming a record the archive does not carry is inert.+///+/// What it does refuse is a payload contradicting itself: two records for one+/// character, suppression or covered revision, a coverage record whose source+/// kind no build writes, and a character or suppression naming a Work the file+/// does not hold. The work reference is **optional, checked when present** —+/// the `validateEntry` `workID` pattern — so an orphan passes (Q78).+internal enum BackupV6ReferenceValidator {+    static func validate(payload: BackupV6Payload) throws {+        do {+            try BackupArchiveReferenceChecks.validate(+                entries: payload.entries,+                works: payload.works.map(\.referenceRecord),+                sites: payload.sites,+                titlePatterns: payload.titlePatterns,+                urlRules: payload.urlRules,+                formatLabel: "V6")+        } catch let issue as BackupArchiveReferenceIssue {+            throw BackupV6CodecError(issue)+        }++        let typeIDs = Set(payload.workTypes.map(\.id))+        guard typeIDs.count == payload.workTypes.count else {+            throw BackupV6CodecError.invalidStateTuple(+                type: "Payload", id: "V6", reason: "duplicate work type ID")+        }+        for work in payload.works where work.workTypeID != nil && work.legacyType != nil {+            throw BackupV6CodecError.invalidStateTuple(+                type: "Work", id: work.id.uuidString,+                reason: "a work carries a configured type or a legacy value, never both")+        }++        let workIDs = Set(payload.works.map(\.id))++        var characterIDs: Set<UUID> = []+        for character in payload.characters {+            guard characterIDs.insert(character.id).inserted else {+                throw BackupV6CodecError.invalidStateTuple(+                    type: "Payload", id: "V6", reason: "duplicate Character ID")+            }+            if let workID = character.workID, !workIDs.contains(workID) {+                throw BackupV6CodecError.unresolvedReference(+                    type: "Character", id: character.id.uuidString, reference: "Work \(workID)")+            }+        }++        var suppressionIDs: Set<UUID> = []+        for suppression in payload.suppressions {+            guard suppressionIDs.insert(suppression.id).inserted else {+                throw BackupV6CodecError.invalidStateTuple(+                    type: "Payload", id: "V6", reason: "duplicate CharacterSuppression ID")+            }+            if let workID = suppression.workID, !workIDs.contains(workID) {+                throw BackupV6CodecError.unresolvedReference(+                    type: "CharacterSuppression", id: suppression.id.uuidString,+                    reference: "Work \(workID)")+            }+        }++        var coveredRevisions: Set<String> = []+        for record in payload.coverage {+            guard record.sourceKind != nil else {+                throw BackupV6CodecError.invalidStateTuple(+                    type: "Coverage", id: record.recordID.uuidString,+                    reason: "unrecognised source kind '\(record.sourceKindRaw)'")+            }+            let key = "\(record.sourceKindRaw)\u{1F}\(record.recordID.uuidString.lowercased())"+            guard coveredRevisions.insert(key).inserted else {+                throw BackupV6CodecError.invalidStateTuple(+                    type: "Coverage", id: record.recordID.uuidString,+                    reason: "two fingerprints for one source revision")+            }+        }+    }+}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Exporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Exporter.swiftnew file mode 100644index 0000000..0146307--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Exporter.swift@@ -0,0 +1,279 @@+import Foundation+import SwiftData++// MARK: - V6 Snapshot Providing++/// Provides one coherent 6/7 payload under a shared lock. Isolated from+/// persistence so export can be unit-tested with injected snapshots.+public protocol BackupV6SnapshotProviding: Sendable {+    func backupV6Snapshot() async throws -> BackupV6Payload+}++// MARK: - V6 Export Errors++/// The 6/7 export's refusals — the same four states 5/6 names, restated under+/// this generation's name so a reader is told which export declined.+///+/// `tornGroups` gains a member it did not have: a **character** group whose rows+/// disagree about something the reader wrote refuses the export exactly as a+/// torn Entry or Work does+/// ([6.5](../../../../specs/character-extraction/requirements.md#6.5)). What+/// does *not* refuse is a fact whose citation dangles — Decision 2 makes that a+/// tolerated state, so+/// [6.2](../../../../specs/character-extraction/requirements.md#6.2) holds.+public enum BackupV6ExportError: Error, Equatable, Sendable, CustomStringConvertible {+    /// The store holds a **torn** identity group: one application UUID over rows+    /// that disagree about something the reader wrote.+    case tornGroups(TornGroupsPayload)+    /// A record holds a stored value the wire format cannot represent.+    case unrepresentableValue(record: String, field: String, value: String)+    /// A record cites a rule no row in the library holds. Transient by nature.+    case referencesStillArriving(detail: String)++    case snapshotFailed(reason: String)+    case encodingFailed(reason: String)+    case stagingFailed(reason: String)++    /// The shared projection's refusal, named as a 6/7 refusal. The projection+    /// is one body for every generation, so its findings arrive spelled 4/4.+    internal init(_ error: BackupV4ExportError) {+        switch error {+        case .tornGroups(let payload): self = .tornGroups(payload)+        case .unrepresentableValue(let record, let field, let value):+            self = .unrepresentableValue(record: record, field: field, value: value)+        case .referencesStillArriving(let detail): self = .referencesStillArriving(detail: detail)+        case .snapshotFailed(let reason): self = .snapshotFailed(reason: reason)+        case .encodingFailed(let reason): self = .encodingFailed(reason: reason)+        case .stagingFailed(let reason): self = .stagingFailed(reason: reason)+        }+    }++    internal init(_ error: BackupV5ExportError) {+        switch error {+        case .tornGroups(let payload): self = .tornGroups(payload)+        case .unrepresentableValue(let record, let field, let value):+            self = .unrepresentableValue(record: record, field: field, value: value)+        case .referencesStillArriving(let detail): self = .referencesStillArriving(detail: detail)+        case .snapshotFailed(let reason): self = .snapshotFailed(reason: reason)+        case .encodingFailed(let reason): self = .encodingFailed(reason: reason)+        case .stagingFailed(let reason): self = .stagingFailed(reason: reason)+        }+    }++    public var description: String {+        switch self {+        case .tornGroups(let payload):+            payload.count == 1+                ? "Backup export refused: 1 record exists in differing copies, and a "+                    + "backup cannot hold both"+                : "Backup export refused: \(payload.count) records exist in differing "+                    + "copies, and a backup cannot hold them all"+        case .unrepresentableValue(let record, let field, let value):+            "Backup export refused: \(record) holds \(field) '\(value)', which this "+                + "backup format cannot represent — it was probably written by a newer "+                + "version of Asterism"+        case .referencesStillArriving(let detail):+            "Backup export refused: records are still arriving from iCloud (\(detail)). "+                + "Try again once syncing has settled"+        case .snapshotFailed(let reason): "Backup V6 snapshot failed: \(reason)"+        case .encodingFailed(let reason): "Backup V6 encoding failed: \(reason)"+        case .stagingFailed(let reason): "Backup V6 staging failed: \(reason)"+        }+    }+}++// MARK: - LibraryRepository V6 Snapshot++extension LibraryRepository: BackupV6SnapshotProviding {+    /// Provides a coherent 6/7 backup payload under a shared lock.+    public func backupV6Snapshot() async throws -> BackupV6Payload {+        let outcome: Result<BackupV6Payload, BackupV6ExportError> =+            try await withLockedBackupContext { context in+                do { return .success(try Self.projectV6Payload(context: context)) }+                catch let error as BackupV6ExportError { return .failure(error) }+                catch let error as BackupV5ExportError { return .failure(BackupV6ExportError(error)) }+                catch let error as BackupV4ExportError { return .failure(BackupV6ExportError(error)) }+            }+        return try outcome.get()+    }++    /// The whole 6/7 snapshot, from a context.+    ///+    /// The six frozen arrays are 5/6's projection verbatim — the same body, so a+    /// 5/6 and a 6/7 backup of one library describe one library — and what is+    /// added here are the three character arrays, all three read from the same+    /// context under the same lock.+    internal static func projectV6Payload(context: ModelContext) throws -> BackupV6Payload {+        let frozen: BackupV5Payload+        let common: ArchiveCommonProjection+        do { (frozen, common) = try projectV5Payload(from: context) }+        catch let error as BackupV5ExportError { throw BackupV6ExportError(error) }+        catch let error as BackupV4ExportError { throw BackupV6ExportError(error) }++        // **One projection pass.** The shared projection already enumerated every+        // character whole (Q78 — never works→children, so a sync orphan exports+        // with a nil work reference instead of vanishing), already refused a torn+        // group, and already sorted by UUID. Re-fetching and re-grouping them+        // here was a second answer to a question with one answer, and the field+        // it duplicated was carried on every 4/4 and 5/6 export for nothing.+        let characters = common.groups.characters.map(mapV6CharacterRecord)++        let suppressions = try context.fetch(FetchDescriptor<CharacterSuppression>())+            .map(mapV6SuppressionRecord)+            .sorted { $0.id.uuidString < $1.id.uuidString }++        return BackupV6Payload(+            entries: frozen.entries,+            works: frozen.works,+            sites: frozen.sites,+            titlePatterns: frozen.titlePatterns,+            urlRules: frozen.urlRules,+            workTypes: frozen.workTypes,+            characters: characters,+            suppressions: suppressions,+            coverage: projectV6Coverage(common.groups))+    }++    /// The group's presented content, plus the immutable evidence its carrier+    /// holds. One record per identity, like every other archive record: rows+    /// sharing a UUID are one character everywhere else in the app.+    private static func mapV6CharacterRecord(_ group: CharacterGroup) -> BackupV6Character {+        let content = group.presentedContent+        return BackupV6Character(+            id: group.id,+            workID: group.carrier.work?.id,+            name: content.name,+            nameKey: group.carrier.nameKey,+            aliases: content.aliases,+            note: content.note,+            facts: content.facts,+            createdAt: group.createdAt,+            modifiedAt: group.modifiedAt)+    }++    /// Suppression rows travel one-for-one, duplicates included (Q82): the store+    /// reads them through by `actionAt` rather than folding them, so folding+    /// here would be a second convergence rule that only archives obey.+    private static func mapV6SuppressionRecord(+        _ row: CharacterSuppression+    ) -> BackupV6Suppression {+        BackupV6Suppression(+            id: row.id, workID: row.work?.id, kindRaw: row.kindRaw, nameKey: row.nameKey,+            sourceKindRaw: row.sourceKindRaw, sourceEntryID: row.sourceEntryID,+            evidence: row.evidence, statusRaw: row.statusRaw, actionAt: row.actionAt)+    }++    /// The covered revisions, keyed by the record whose text they describe.+    ///+    /// Written verbatim, including a fingerprint that no longer matches the+    /// text: the archive is a snapshot of what the store holds, and the import+    /// is where a stale pair is dropped (Q81). Read from the carrier row, which+    /// is the row the group presents.+    ///+    /// Takes the shared projection rather than a context: the work and entry+    /// groups it needs are exactly the ones the export has already built, under+    /// the same assignment normalisation (Q106). Re-deriving them was a third+    /// walk of the two largest tables and a third chance to fold them+    /// differently.+    private static func projectV6Coverage(+        _ groups: BackupGroupProjection.Projection+    ) -> [BackupV6Coverage] {+        var records: [BackupV6Coverage] = []+        for group in groups.works {+            guard let fingerprint = group.carrier.genericNotesExtractionFingerprint else {+                continue+            }+            records.append(.genericNotes(work: group.id, fingerprint: fingerprint))+        }++        for group in groups.entries {+            guard let fingerprint = group.carrier.characterExtractionFingerprint else { continue }+            records.append(.entry(group.id, fingerprint: fingerprint))+        }++        return records.sorted {+            ($0.sourceKindRaw, $0.recordID.uuidString) < ($1.sourceKindRaw, $1.recordID.uuidString)+        }+    }+}++// MARK: - V6 Exporter++/// Orchestrates coherent 6/7 snapshot → validated encoding → staging.+///+/// It decode-validates its own bytes before sharing, so a produced file is+/// always a valid strict 6/7 document — the 4/4 exporter's contract, kept.+public final class BackupV6Exporter: Sendable {+    private let repository: any BackupV6SnapshotProviding+    private let stagingDirectory: URL++    public init(+        repository: any BackupV6SnapshotProviding,+        stagingDirectory: URL+    ) {+        self.repository = repository+        self.stagingDirectory = stagingDirectory+    }++    public func export(metadata: BackupV6Metadata) async throws -> BackupExportResult {+        let payload: BackupV6Payload+        do {+            payload = try await repository.backupV6Snapshot()+        } catch let error as BackupV6ExportError {+            throw error+        } catch let error as BackupV5ExportError {+            throw BackupV6ExportError(error)+        } catch let error as BackupV4ExportError {+            throw BackupV6ExportError(error)+        } catch {+            throw BackupV6ExportError.snapshotFailed(reason: String(describing: error))+        }++        let encoded: Data+        do {+            encoded = try BackupV6Codec.encode(payload: payload, metadata: metadata)+        } catch {+            throw BackupV6ExportError.encodingFailed(reason: String(describing: error))+        }++        do {+            let decoded = try BackupV6Codec.decode(encoded)+            guard decoded.payload == payload else {+                throw BackupV6ExportError.encodingFailed(reason: "decode-validation payload mismatch")+            }+        } catch let error as BackupV6ExportError {+            throw error+        } catch {+            throw BackupV6ExportError.encodingFailed(reason: "decode-validation failed: \(error)")+        }++        do {+            try FileManager.default.createDirectory(+                at: stagingDirectory, withIntermediateDirectories: true)+            let fileURL = stagingDirectory.appending(+                path: ExportStaging.backupFilename(+                    version: "v6", exportedAt: metadata.exportedAt))+            do {+                try ExportStaging.write(encoded, to: fileURL)+            } catch {+                throw BackupV6ExportError.stagingFailed(reason: String(describing: error))+            }+            return BackupExportResult(fileURL: fileURL)+        } catch let error as BackupV6ExportError {+            throw error+        } catch {+            throw BackupV6ExportError.stagingFailed(+                reason: "preparing staging directory failed: \(error)")+        }+    }++    public func cleanup(_ result: BackupExportResult) {+        try? FileManager.default.removeItem(at: result.fileURL)+    }++    /// Removes abandoned backup files older than 24 hours from the staging area,+    /// which still covers the 4/4 and 5/6 files a previous build staged.+    public func scavengeStaleFiles() {+        ExportStaging.scavengeBackups(in: stagingDirectory)+    }+}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Types.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Types.swiftnew file mode 100644index 0000000..eac06fb--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Types.swift@@ -0,0 +1,263 @@+import Foundation++// MARK: - Backup V6 Document++/// The 6/7 backup envelope: format version 6 over schema version 7+/// (`character-extraction` Req 6.1, Q63).+///+/// A new document type rather than an edit to the 5/6 one, for the reason 5/6+/// was added beside 4/4: a shipped archive format is never redefined in place.+/// Pre-feature builds meet the `(6, 7)` pair in their importer's default arm and+/// refuse it before touching the library — an accepted consequence, stated in+/// [6.1](../../../../specs/character-extraction/requirements.md#6.1).+///+/// The envelope keys are 4/4's, unchanged. Everything this generation adds is+/// inside `payload`.+public struct BackupV6Document: Codable, Equatable, Sendable {+    public static let formatVersion = 6+    public static let schemaVersion = 7++    public let backupFormatVersion: Int+    public let databaseSchemaVersion: Int+    public let appBuild: String+    public let exportedAt: Date+    public let capabilityGate: String+    public let entryCount: Int+    public let workCount: Int+    public let checksum: String+    public let payload: BackupV6Payload++    public init(+        appBuild: String,+        exportedAt: Date,+        capabilityGate: String,+        entryCount: Int,+        workCount: Int,+        checksum: String,+        payload: BackupV6Payload+    ) {+        backupFormatVersion = Self.formatVersion+        databaseSchemaVersion = Self.schemaVersion+        self.appBuild = appBuild+        self.exportedAt = exportedAt+        self.capabilityGate = capabilityGate+        self.entryCount = entryCount+        self.workCount = workCount+        self.checksum = checksum+        self.payload = payload+    }+}++// MARK: - V6 Payload++/// 5/6's six arrays plus the three this generation adds.+///+/// **Nothing is re-frozen** (Q63). The Entry, Work, Site, TitlePattern, URLRule+/// and work-type records are the 5/6 records *themselves*: schema V7 adds two+/// derived coverage columns and two new entities, and a derived column is not a+/// reason to restate six wire shapes and give them somewhere to drift apart.+/// The coverage array rides beside the frozen records instead, keyed by the+/// UUID of the Entry or Work whose text it describes.+public struct BackupV6Payload: Codable, Equatable, Sendable {+    public let entries: [BackupV4Entry]+    public let works: [BackupV5Work]+    public let sites: [BackupV4Site]+    public let titlePatterns: [BackupV4TitlePattern]+    public let urlRules: [BackupV4URLRule]+    public let workTypes: [BackupV5WorkTypeRecord]+    /// **Every** character in the library, enumerated whole rather than+    /// works→children (Q78): a character that synced ahead of its work exports+    /// with a nil work reference instead of vanishing from the backup.+    public let characters: [BackupV6Character]+    /// Every suppression row, likewise — including rows sync duplicated, which+    /// the store reads through rather than folding (Q82).+    public let suppressions: [BackupV6Suppression]+    /// Which source revisions an extraction pass has covered.+    public let coverage: [BackupV6Coverage]++    public init(+        entries: [BackupV4Entry],+        works: [BackupV5Work],+        sites: [BackupV4Site],+        titlePatterns: [BackupV4TitlePattern],+        urlRules: [BackupV4URLRule],+        workTypes: [BackupV5WorkTypeRecord],+        characters: [BackupV6Character],+        suppressions: [BackupV6Suppression],+        coverage: [BackupV6Coverage]+    ) {+        self.entries = entries+        self.works = works+        self.sites = sites+        self.titlePatterns = titlePatterns+        self.urlRules = urlRules+        self.workTypes = workTypes+        self.characters = characters+        self.suppressions = suppressions+        self.coverage = coverage+    }++    /// The same six arrays a 5/6 archive of this library would hold. What the+    /// import path reads when it is doing the work both generations share.+    public var frozenRecords: BackupV5Payload {+        BackupV5Payload(+            entries: entries, works: works, sites: sites, titlePatterns: titlePatterns,+            urlRules: urlRules, workTypes: workTypes)+    }+}++// MARK: - V6 Records++/// One character, as the archive holds it (Req 6.1).+///+/// `facts` carries `CharacterFact` itself rather than a wire clone of it, the+/// way the 4/4 records carry `TitleProvenance` and `WorkURLIdentityState`: the+/// fact *is* a value type with a stable Codable shape, and a second spelling of+/// it would be two definitions of one thing with no way to notice them drifting.+///+/// `workID` is optional and the validator checks it only when present — a+/// character whose work has not arrived is a tolerated in-flight state+/// ([6.7](../../../../specs/character-extraction/requirements.md#6.7), Q78), a+/// reference to a work the archive does not carry is a file contradicting+/// itself.+public struct BackupV6Character: Codable, Equatable, Sendable {+    public let id: UUID+    public let workID: UUID?+    public let name: String+    /// The retained key, minted at accept or creation and never re-derived from+    /// a rename (Q19/Q46) — so it travels rather than being recomputed on the+    /// way in.+    public let nameKey: String+    public let aliases: [String]+    public let note: String+    public let facts: [CharacterFact]+    public let createdAt: Date+    public let modifiedAt: Date++    public init(+        id: UUID,+        workID: UUID?,+        name: String,+        nameKey: String,+        aliases: [String],+        note: String,+        facts: [CharacterFact],+        createdAt: Date,+        modifiedAt: Date+    ) {+        self.id = id+        self.workID = workID+        self.name = name+        self.nameKey = nameKey+        self.aliases = aliases+        self.note = note+        self.facts = facts+        self.createdAt = createdAt+        self.modifiedAt = modifiedAt+    }+}++/// One suppression row (Req 2.4's durability clause).+///+/// The enum columns travel **raw**, for the reason `BackupV5WorkTypeRecord`'s+/// `stateRaw` does: an archive written by a later build's wider set decodes here+/// rather than refusing, and the store's own `?? .candidate` coercion answers+/// for a value this build cannot name.+public struct BackupV6Suppression: Codable, Equatable, Sendable {+    public let id: UUID+    public let workID: UUID?+    public let kindRaw: String+    public let nameKey: String+    /// Present on fact rows only. Explicit rather than inferred from a nil+    /// `sourceEntryID`, so a malformed row is distinguishable from a+    /// generic-notes citation (Q72).+    public let sourceKindRaw: String?+    public let sourceEntryID: UUID?+    public let evidence: String?+    public let statusRaw: String+    /// When the reader acted — the comparable the import value-guards with, and+    /// the one Q82's convergence reads.+    public let actionAt: Date++    public init(+        id: UUID,+        workID: UUID?,+        kindRaw: String,+        nameKey: String,+        sourceKindRaw: String?,+        sourceEntryID: UUID?,+        evidence: String?,+        statusRaw: String,+        actionAt: Date+    ) {+        self.id = id+        self.workID = workID+        self.kindRaw = kindRaw+        self.nameKey = nameKey+        self.sourceKindRaw = sourceKindRaw+        self.sourceEntryID = sourceEntryID+        self.evidence = evidence+        self.statusRaw = statusRaw+        self.actionAt = actionAt+    }++    public var kind: CharacterSuppressionKind {+        CharacterSuppressionKind(rawValue: kindRaw) ?? .candidate+    }++    public var status: CharacterSuppressionStatus {+        CharacterSuppressionStatus(rawValue: statusRaw) ?? .active+    }++    public var source: SourceRef? {+        SourceRef(kindRaw: sourceKindRaw, entryID: sourceEntryID)+    }+}++/// One covered source revision: the fingerprint of the text a pass processed,+/// beside the UUID of the record holding it (Q63).+///+/// **Self-validating on the way in** (Q81). Coverage carries no timestamp to+/// value-guard with and needs none: a pair is imported exactly where the+/// archived fingerprint still describes the source's current text, and dropped+/// otherwise. That is also why the wire validator does not check `recordID`+/// against the archive's records — a pair naming a record the archive does not+/// carry is inert rather than corrupt.+public struct BackupV6Coverage: Codable, Equatable, Sendable {+    /// `"entry"` or `"genericNotes"` — the discriminator `SourceRef` writes.+    public let sourceKindRaw: String+    /// The Entry's UUID for an entry revision; the Work's for a generic-notes+    /// one.+    public let recordID: UUID+    /// SHA-256 of the covered text — the `VariantID` recipe (Q30).+    public let fingerprint: String++    public init(sourceKindRaw: String, recordID: UUID, fingerprint: String) {+        self.sourceKindRaw = sourceKindRaw+        self.recordID = recordID+        self.fingerprint = fingerprint+    }++    public static func entry(_ id: UUID, fingerprint: String) -> BackupV6Coverage {+        BackupV6Coverage(+            sourceKindRaw: SourceRef.entry(id).kindRaw, recordID: id, fingerprint: fingerprint)+    }++    public static func genericNotes(work id: UUID, fingerprint: String) -> BackupV6Coverage {+        BackupV6Coverage(+            sourceKindRaw: SourceRef.genericNotes.kindRaw, recordID: id, fingerprint: fingerprint)+    }++    /// The kind, or nil for a discriminator no build writes.+    public var sourceKind: CharacterCoverageSourceKind? {+        CharacterCoverageSourceKind(rawValue: sourceKindRaw)+    }+}++/// Which of the two coverage columns a record names. Spelled as its own enum+/// rather than reusing `SourceRef`, because `SourceRef.genericNotes` carries no+/// identifier and the coverage record needs one for both shapes.+public enum CharacterCoverageSourceKind: String, Sendable, Equatable, CaseIterable {+    case entry+    case genericNotes+}