docs: Path Registry rows DP6/DP8/MT5 flip to contracted+pinned — the deferred-embedding and atomic-update train landed with cited tests

docs/path-registry.md

@@ -40,9 +40,9 @@ and what's missing, stated) · 🔴 owed (named, never silent).
 | DP3 | Filtered/sorted list: column top-K when the field is columnized (INDEX-SERVED, zero canonical reads on the sorted page — value pairs come from ONE batched metadata-record pass); no-column fallback is BOUNDED-ANNOUNCED (one batch pass, announces once per field past 500 rows); unknown field → TYPED REFUSAL naming both candidate spellings. | ✅ `tests/unit/utils/metadataIndex-sort-callshape` (zero per-row reads, batch-only — latency-blind) + `metadataIndex-nested-orderby` (dotted keys serve-or-refuse) + `tests/integration/orderby-sort-bug` |
 | DP4 | Aggregation/stats: ALWAYS answers. Write-time incremental; behind-stamp reconciles incrementally; genuine rebuilds go through the native parallel door or the paged JS walk; nothing ever latches off; before-image-less deletes flag a LOUD rescan, never a silent skip. | ✅ `tests/integration/aggregation-lifecycle-catchup` + `tests/unit/aggregation/aggregation-provider-rebuild` |
 | DP5 | Graph traversal: `related()` paged via adjacency; whole-graph analytics carry declared cost. | 🟡 paged reads pinned; analytics cost-class declaration owed (rides VENUE-GRAPH-TRUST audit tool) |
-| DP6 | Single write: ack at the canonical commit; visibility committed at ack (the atomic vector update kills the remove→add dark window); maintenance NEVER holds the ack (background flush cadence — THE ACK LAW pin: a hung flush cannot block a write). | 🟡 ack law pinned (`tests/unit/brainy/persistence-policy`); atomic-update pin lands with the flicker fix in this train |
+| DP6 | Single write: ack at the canonical commit; visibility committed at ack (the atomic vector update kills the remove→add dark window); maintenance NEVER holds the ack (background flush cadence — THE ACK LAW pins: a hung flush cannot block a write, a hung EMBEDDER cannot block a write). | ✅ `tests/unit/brainy/persistence-policy` + `tests/unit/hnsw/update-item-atomic` + `tests/integration/deferred-embedding` |
 | DP7 | Bulk ingest: sustained rate holds flat — per-write maintenance taxes must not grow with brain size (A4 removed caller-flush convoys; deferred embedding removes the per-write embed tax where opted). | 🟡 the decay-curve row is a pair speed-table RED GATE; brainy-alone sustained-rate run rides the same corpora |
-| DP8 | Read under write pressure: no flicker window — a row that exists is never invisible to recall, even transiently (same-vector re-index is a no-op; changed-vector swaps in place, node never leaves the index). | 🟡 lands in this train (atomic `updateItem` + `ReplaceInVectorIndexOperation`); symmetry suite + sentinels are the B4 program |
+| DP8 | Read under write pressure: no flicker window — a row that exists is never invisible to recall, even transiently (same-vector re-index is a no-op; changed-vector swaps in place, node never leaves the index; deferred updates serve the OLD vector until the atomic swap — stale-beats-absent). | ✅ brainy leg pinned (`tests/unit/hnsw/update-item-atomic` 9/9 + `deferred-embedding` stale-beats-absent); the symmetry property suite + runtime sentinels remain the B4 program |
 | — | **The lazy-open gate honors EVERY provider's not-ready report** (a not-ready metadata provider can no longer latch the silent-empty state under `disableAutoRebuild`). | ✅ `tests/unit/brainy/lazy-notready-honor` |
 
 ## MT — Maintenance (never in the door path)
@@ -53,7 +53,7 @@ and what's missing, stated) · 🔴 owed (named, never silent).
 | MT2 | Compaction: never on flush (durability-only law, 8.9.0); close-time pass time-budgeted + resumable; explicit `compactHistory({timeBudgetMs})`. | ✅ 8.9.0 suites |
 | MT3 | Index upkeep (mapper folds, delta promotion): native-side machinery; brainy's JS legs are small and synchronous-cheap. | 🟡 declared; yield audit rides the pair |
 | MT4 | Heal/rebuild walks (`repairIndex`, backfill walks): paged; failure latches with cooldown; NOT yet yield-to-foreground installments. | 🔴 owed — the priority-isolation clause (couples to LC4; same choreography) |
-| MT5 | Deferred embedding worker: ack at durability, durable pending markers, crash-recovered at open, single-flight batches. | 🔴 lands as A3 in this train (design frozen on the incident thread) |
+| MT5 | Deferred embedding worker: ack at durability, durable pending markers (written BEFORE the commit — orphan-safe), crash-recovered at open via a bounded prefix listing, single-flight, 60s hang guard, `awaitPendingEmbeds()` barrier + `pendingEmbeds` gauge. VFS write paths adopt it end-to-end. | ✅ `tests/integration/deferred-embedding` 5/5 |
 | MT6 | Retention/archival walks: retention `'all'` does nothing by design; bounded-retention reclaim is close-time/explicit only. | 🟡 8.9.0 behavior pinned; archival profile is the co-frozen D1+D3 unit |
 
 ## FM — Failure modes
@@ -75,11 +75,11 @@ and what's missing, stated) · 🔴 owed (named, never silent).
 
 ## Status summary
 
-Contracted + pinned this train: **DP3, DP4, MT1, LC5(aggregation), the
-lazy-open not-ready gate, LC1/LC3/LC9, FM4, FL5** — each with the cited
-test. Landing in this train: **DP6/DP8 (atomic vector update), MT5 (A3
-deferred embedding)**. Owed, in production-risk order, all coupled to the
-priority-isolation program the lifecycle sev opened: **LC4 (doors-open
-migration), MT4 (yielding heals), LC7 (downgrade contract), LC6 (SIGTERM
-budget), FL2–FL4, FM1/FM2 depot cases.** Rows move from owed to contracted
-only with a cited test — none lands by prose.
+Contracted + pinned this train: **DP3, DP4, DP6, DP8(brainy leg), MT1,
+MT5, LC5(aggregation), the lazy-open not-ready gate, LC1/LC3/LC9, FM4,
+FL5** — each with the cited test. Owed, in production-risk order, all
+coupled to the priority-isolation program the lifecycle sev opened: **LC4
+(doors-open migration), MT4 (yielding heals), LC7 (downgrade contract),
+LC6 (SIGTERM budget), FL2–FL4, FM1/FM2 depot cases, B4 symmetry suite +
+sentinels.** Rows move from owed to contracted only with a cited test —
+none lands by prose.