Task 3, re-scoped per the plan's honest-FAIL branch: the CPU verdict FAILED
(the ladder ran to its documented stop), so the c3 class is NOT retired —
the record instead carries the executed-and-measured ALT truth.
- budget-gates.mjs: the verdict law documents the Phase-8 outcome (ALT
EXECUTED, optimality green, CPU verdict FAIL 152.788/185.692 ms quoted
with date; L=32 probe measured worse) — the stale 'next-milestone item'
wording is gone; ROUTE_CPU_DRIFT_GUARD_MS re-anchored 200 → 400 (the
post-ALT documented band outgrew the old guard; ≈2x the worst shipped-
config run 185.692 ms); the guard stays a regression trip-wire, the 8 ms
budget stays and its FAIL still prints every run
- budget-audit.test.mjs: CPU3 pins the new law (evidence must name the
EXECUTED-in-Phase-8 verdict and must NEVER say 'next-milestone');
19/19 vectors ok (the count holds — no vector dropped)
- docs/BUDGETS.md: route-cpu row carries the Phase-8 measured numbers +
date; the c3 section is the honest post-ALT record (what changed, the
quoted gate lines, the one-directional-Lipschitz wall, the open
escalation) — staged as selective hunks; the tree's pre-existing
doc-sync edits in other sections remain uncommitted, untouched
grep law: zero 'next-milestone' hits in budget-gates.mjs + BUDGETS.md;
ROUTE_CPU_DRIFT_GUARD_MS still exported and used.
- the Bot API parameter is 'scope' (verified against
core.telegram.org/bots/api/methods/setmycommands); the script's
'bot_command_scope' was an unknown field Telegram silently ignores,
so every call hit the default scope and the two clear calls wiped the
default set entirely — the ok:true lines proved nothing about scope
- registration re-run: default (agnostic/en/ms) + all_private_chats
(agnostic/ms) read back help, privacy, cari via getMyCommands with
the correct 'scope' param; group scopes verified cleared
- docs/KNOWN-LIMITATIONS.md: the 'Telegram-side defect' attribution
corrected to the actual script bug; residual client menu-caching
caveat + type-the-command workaround kept
- bot/README.md command row updated to the real scope set
- source-side runtime-hosts gate gains DOC_POINTER_STATIC_TEXT_HOSTS (the
MapLibre-attribution precedent): the published repo origin may appear
ONLY as a bare URL literal in bot copy (D-08/D-09), never fetched
- class is NARROW and pinned by SA6: a fetch( target naming the same
host is still a violation
- Rule 1 (found by SA6's RED): the fetch( handler's declaration
heuristic misclassified any quoted absolute URL as a TS declaration —
quoted strings are targets; they now reach the host check
- docs/PRIVACY-AUDIT.md: adjudication documented + dated re-run addendum
- deferred-items.md #1 closed: npm run privacy-audit exits 0 again
(PRIVACY AUDIT CLEAN — 5 gate(s) passed, 0 violations; suite 13/13)
- the full ceilings table (Cloudflare Workers limits / KV limits / pricing, sourced)
- current measurements: A* p95 83.989 ms vs 8 ms ladder budget (the accepted c3 class,
negative headroom printed), BA9 79,815/204,800 gz, app bundle 479,178/500,000 gz,
KV write classes (cron = 0, source-proven), golden corpora exit 0
- the per-request-class subrequest inventory (source-derived, not a live Workers Logs metric)
- the DISCOVERED finding: KV list rate 1,440/day (60 s cron x 1 list/tick) OVER the
1,000/day ceiling — documented with options, decision deferred to the 07-06 launch gate
- the c3 cross-metro escalation restated; honest Statement; unsigned signature block
- docs/KNOWN-LIMITATIONS.md — new, for drivers AND forks: OSM data gaps,
the c3 cross-metro CPU degradation (2-8 ms short / p95 38-93 ms cross-metro,
measure-route-cpu.mjs LADDER HISTORY as evidence, ALT as the committed lever,
Workers Paid rejected on the $0 mandate), the /cari menu defect + the
type-the-command workaround, the beta-quality statement, the roadmap
pointers (WASM-router / ALT / engine B — none in this release), the
privacy paragraph, and the fork-facing audit commands
- strings.ts helpMenu (en+ms): ONE pointer line each, not /-prefixed so the
CS5 menu parse ignores it; URL is the repo's actual remote deep link
(http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md),
identical in both locales — single-copy law (D-05)
- suite 126/126, CS5 green
- Findings table carries the ACTUAL printed evidence from the audited run
(commit 9c55e9a): 5 static gates PASS, 0 violations; live legs recorded
honestly as NOT RUN with the launch-gate re-run protocol
- Storage inventory: the four TTL-only KV families; Log vocabulary: the
category-only surfaces; Runtime network: the printed host inventory
(allowlist + documented static-text class) and D-02's zero-telemetry posture
- human signature block left blank for the launch gate (D-09)
- upload-road-graph.mjs: wrangler-shelled maintainer tool (pre-flight 1-80MB,
round-trip verify hint); bucket araharah-graphs NOT created — R2 is not yet
enabled on the account (wrangler code 10042) — dashboard one-time activation
is the phase's user_setup item
- measure-route-cpu.mjs: 25-pair gate (corpus + seeded quadrant spread),
hrtime around routeAstar, warm-up excluded, unreachable probes reported
SEPARATELY from the routed p95, exits 1 over the 8ms budget
- Rule 1 (measured): the class set lacked *_link ramps — the graph FRAGMENTED
(7.7% of nodes in severed motorway islands; corpus pairs 'unreachable').
5 link classes added -> 311325 nodes / 677068 edges / 14.7 MB, all landmarks
in one component; enforced floor corrected 1KB -> 1MB (D-01)
- ladder (a) drop tertiary+residential: p95 17.8ms but 12/25 pairs unreachable
— REJECTED on correctness (D-03), reverted, ladder history recorded
- ladder (b) bidirectional A* (BH, Ikeda potentials, reverse-CSR WeakMap):
provably optimal (A1 625-pair sweep green), alternation balanced by heap
size (raw-top comparison starves the backward side 19501:3), reduction
signs in the standard feasible form. Measured: p95 ~38-93ms — NO GATE PASS.
The potential split halves each side's steering, cancelling the halved radius
- GATE FAIL is the honest verdict: ladder (c) — Workers Paid vs layout-v2 ALT
(still $0) vs free-plan-with-degradation — requires maintainer sign-off;
docs/ROAD-GRAPH.md carries the decision table and the fork contract
- cari.ts: /cari + /search twin, 128-char pre-search cap (T-04-21), honest
no-match refusal (D-13), single sendVenue card with inline OPEN + alternates
- deep-link carrier corrected per RESEARCH Pitfall 1: web_app button URL
carries ?dest=<plain slug id> — WebAppInfo has only a url field; no crypto
- origin from configured MINI_APP_URL only (never user input); blank origin
omits the OPEN button instead of guessing (T-04-30)
- strings.ts: searchUsage/searchNoMatch/searchQueryTooLong/searchOpenButton/
osmAttribution in en+ms; helpMenu gains the /cari line in both locales
- category-only logging law (D-15): four literal rejection categories, query
never logged; success path logs nothing
- config: MINI_APP_URL in Env + wrangler vars (public, not secret) +
.dev.vars.example + docs/CONFIGURATION.md row and sections
- bot deps gain @araharah/search (workspace link)
- docs/SEARCH-QUALITY.md: the bake-off close record — corpus v1 (75 cases) x
gazetteer v1 (30 entries), measured 2026-10-23T17:02Z via npm run search:corpus
- top-1 66/68 (97.1%), top-3 68/68 (100.0%) >= 90% threshold
- negatives refused 7/7, refusal margin 0.643 < 0.72 admission line
- per-category table (landmark/abbreviation/glued/typo/alias all 100%)
- escalation lever: None — met on first run; no abbreviations.ts row, no
alias, no corpus edit; the fixed ladder was never climbed
- coordinate verification: 10 seed entries spot-checked against Nominatim
(identifying UA, 1 req/s): 8/10 within 0.01°; bukit-bintang outlier is an
area-vs-point discrepancy (no change); pavilion-kl was a real ~2 km error
- both top-1 misses documented as expected disjoint-tier behaviour
- kl-gazetteer.json: pavilion-kl coordinate corrected (3.1478,101.695) ->
(3.149,101.7132) — Rule 1 data bug found by the prescribed Nominatim
verification; post-fix delta 0.0002°; corpus is coordinate-blind, all suites green
araharah-executor