Rescores both matrices for A5, A6 and A7 and closes GAP-14.
Corrections to previously-recorded claims:
- The two claims flagged as "still false" are now true, with named bounds. The
kill switch does keep a stream dead (revocation batch), and monitoring does
never trust client progress (this batch) — with the one deliberate exception
that a paused session holding an open, ping-checked realtime/WebSocket
connection is exempt from reaping. That is an observed connection, not a
reported position, and it preserves the issue #243 fix.
- GAP-14 listed four `Begin` call sites. There are five;
`api/handlers/ebook_reader.go` was missing.
- Category A #7 is rescored honestly: A6 fixes cross-replica *monitoring*, so
the excess is trimmed within ~120s. Synchronous admission is still
per-process, so those starts are admitted and then trimmed rather than
refused at the door. Recorded under "does not cover" rather than scored as a
clean pass.
- Follow-up 0g's deferred cross-replica mirror race is closed: the Redis
revocation mirror now merges server-side.
- 0f (A7) does not close E28 — there is still no server-wide connection cap,
only a per-user transfer cap.
Adds an accepted-limitations section for the things a reader would otherwise be
surprised by: paused sessions aging from the last served byte, the bounded
never-served grace, `last_served_at` being omitted for never-served integrated
sessions, the advisory enforcer lease, the plain-SET fallback for the merge, and
that the Lua tests skip without SILO_TEST_REDIS_ADDR — which matters because
this repository runs no `go test` job in CI at all.
Records the Batch 6 re-stream decisions now that they are settled, including the
privacy posture: detection ships on by default and alert-only, retaining
per-viewer IP history on every deployment, with auto-kill behind an
operator setting that defaults to off.
Extends the AI-use disclosure with round 5, including the two review claims
rejected on verification and the defect each model found in the other's work.
Part of #305