Story-2490 · functions lane

The registrar now reads the Extraction Record

The read path

document registration event
        ↓
firm + matter scoped document lookup
        ↓
current extraction version under RLS
        ↓
Model view renderer + persisted render cache
        ↓
≤ 32 KiB: whole view
> 32 KiB: 24 KiB head + explicit elision + 8 KiB tail
        ↓
Blake invocation

What stayed invariant

The registrar keeps the existing byte-window contract. Small documents arrive whole. Large documents preserve complete JSONL records from the identifying front matter and the prayer, verification, or signature tail. A typed elision record states the omitted byte count, so the bounded result remains valid fenced Model-view data.

Firm and matter authorization still happens before rendering. A renderer or cache failure stamps registration_failed before the queue message retries, so no document is left indefinitely in a non-terminal state.

Atomic cutover proof

The registrar contains no S3 document.md read, no derived-key construction, and no fallback. A DB-backed integration test proves a worker-style GUC-only session renders and caches the current Model view while a second firm cannot read it.