Story-2512 · T5d

Family carving without silent evidence loss

A 2,000-page upload can contain dozens of independent legal documents. Treating it as one document hides those boundaries; guessing the boundaries can be worse, because pages may be attached to the wrong instrument. This engine keeps model judgment between two deterministic code gates so every proposed cut is checked and receipted before a child exists.

The code → model → code sandwich

every extracted page
       │ exhaustive scan: no head/tail shortcut
       ▼
index candidates + 250-page core / 8-page halo skim windows
       │ model proposes titles and anchor-level boundaries (T5i prompt)
       ▼
deterministic reconciliation
  ├─ title agrees with the indexed entry?
  ├─ claimed page agrees with the page map?
  ├─ anchor exists and boundaries remain monotonic?
  └─ conflicts captured in an evidence receipt?
       ▼
virtual child manifests → capped waves → Identity + Deep Read jobs

The corrected failure: landing on the index's claimed page is no longer enough to verify a cut. If the nearby marker title does not match the indexed title, the boundary remains review-only and the receipt says why.

Children are views over source evidence

Carving records the parent document, start/end page, and start/end anchor. It does not duplicate extracted pages. Identity and Deep Read resolve the child through that immutable parent range, so citations still point to the original evidence and a revoked relationship never deletes source facts.

Large families keep their waves

60 verified children, wave cap 20

wave 1: children 01–20  → durable outbox → dispatched
wave 2: children 21–40  → durable, awaiting counsel release
wave 3: children 41–60  → durable, awaiting counsel release

Counsel releases one later wave at a time. The relay only sees released rows,
so a scheduler restart can neither lose nor flatten the remaining 40.

The strict twin ladder

full-page exact alignment + no veto  → auto-confirmed twin
similarity only                      → counsel candidate
date / party / amount / polarity     → hard veto; never auto
partial or short-document match      → hard veto; never auto

candidate → confirm API → confirmed → revoke API → revoked
             audit event               audit event

Confirmation changes which document may act as the projection authority; revocation reverses that projection. Both transitions are matter-scoped, row-locked, and audited. The underlying documents and findings remain intact.

Proof carried by the change

ER-09   index found beyond the opening pages
ER-34   deterministic boundary reconciliation and receipts
ER-39   anchor-level child manifests
ER-40   250-core / 8-halo skim windows
ER-41   capped waves remain explicit
ER-42   strict exact / similarity / veto ladder
ER-43   audited confirm and revoke lifecycle

Hard-zero fixture: every false-twin conflict asserts auto_confirm == false.

One-sentence recall

The engine may use a model to propose structure, but code owns every cut, every receipt, every wave, and every irreversible-looking decision—so a plausible guess can never silently rewrite legal evidence.