Onta — Context Trial

Engineering release notes, August 10, 2026

Everything that changed on your trial link since it was first shared on August 7, 2026. Current build: page 054919a, engine f93992c. This is not the same build with patches — the state machinery and several engine paths were rebuilt, and the page was rebuilt on top of them. References are commit ids (page = the trial link’s repo, engine = the answering engine’s repo) or the decision date.

What was rebuilt underneath

What changed / what was broken	The actual fix (mechanism)	Reference
Decision state: four layers collapsed into one ledger. Your Keep / Leave-out / Edit decisions lived in four separate state layers — page overlay state, saved-edit rows, consumed proposals, derived stamps — that could disagree, and most early breakage traced to exactly that.	One append-only decision ledger table with head-of-chain indexes. A single writer module is bound at the seven outer decision verbs (save, apply, withhold, reverse-applied, confirm, reset, reverse-reset) and writes in the same transaction as each primitive; ledger-vs-store disagreement refuses the write by name and rolls back. Every reader — queue standing, counters, answer attribution, unit composition, the answer composer itself — was flipped onto the ledger in nine sequenced landings. Pre-ledger history was reconstructed by a disclosed-lossy backfill: anything unreconstructable is reported as a count, never a fabricated row. The transitional dual-write is retired; a structural test pins “one writer”.	engine 7991b3c, 668850f, 5819c9e, 992be0a, 202c0c6
One ontology store, one run path. The engine composed answers from two sources — a hand-authored declaration file loaded at boot plus the ratified ontology store — and ran two composition legs against them, so two surfaces could disagree about which reading a figure used.	The declaration file is removed from the runtime path; answers compose from the ratified ontology store alone. The second composition leg and the source selector are gone from every surface: the selector is out of the DOM on both result renderers, and run-start source is keyed server-side by role — the client cannot ask for the retired leg. One run path remains: the 19-question run against your standing ontology.	ruling 2026-08-07; page 00a49da
Answer paths under refusals. Withholding a definition could silently vanish it: the engine composed without the refused reading and said nothing — 13 measured wrong answers came from exactly this.	A withhold now stamps the refusal in force on the declaration set (`removed_by_refusal`), and refusal-honoring is threaded through every composer entry point. On each affected question the engine runs a counterfactual compose with the full set: if removing the unit materially changes the figure, the answer declines and names the removed unit; if the figure truthfully survives without it, it serves with the withhold named on the answer. The comparison covers the conditions applied, not just value and count — a figure that coincidentally matches while the read narrowed still declines.	engine 12db050, dce4c28, 746de1d, 3f3f746
Persistent run state. Run state lived in the page, so a reload or a connection blip lost a run in flight and the page reported it dead while the service was still working.	Run state is persisted service-side: a durable run-marker file written by the ask service plus process-liveness in the status endpoint. The page display is a pure function of that status read and re-attaches to a running run on load. Lost contact is a retrying state, never terminal; only a confirmed dead service concludes the run, reporting the service’s own error sentence.	page 9915631, 06ddb49, e7d0b9e
Runs are pinned by snapshot, not by luck. Mid-run ontology changes could leak into the running run; a sync barrier held apply and run apart as a workaround.	Run start mints an ontology state snapshot and the run holds it by address in a snapshot register table; every ask in the run resolves against that pinned snapshot, so a change you make mid-run applies to the next run, never half of this one. The sync barrier is retired structurally. Run start also reads the data substrate’s vintage, so the run record states exactly what the asks read.	engine 02ca327, ee93cce; page 2ac2def
Clicking is saving. Decisions wrote a pending edit that a separate consume step applied later — a “saved but not applied” state that leaked into counters and answers.	The consume machinery became click-time application: one shared consume body, click = saved = applied, and the applied decision comes back on the click’s own wire response. Discard/restore are ledger verbs, not page state. Re-answering fires automatically for only the questions the decision touches.	engine 2943fd7; page 5bb0939
Reset All is one blank event. Reset was a partial overlay walk-back with its own undo and a banner, and its semantics drifted per surface.	Reset All is a single estate-level blank event through the one ledger writer: every standing decision head (Keep / Withhold / Edit) is superseded, all rows reopen, authored wording walks back to its declared root, consumed withholds lift estate-wide. Your ratified declarations and identity resolutions are untouched. Undo-of-reset is deleted — route unmounted, no reverse path in any mode; the response is the count alone (“N reset”). Migration 094.	engine 92d56c7; page 629b991
Headline count crossed record families. After Reset All + Re-Run the headline still said 14 answered / 5 abstained while the rows showed 18 / 1: the renderer counted the hand-declared record family while the Ontology-tab re-run writes the automatic record family.	The headline renderer flipped to count the record family the re-run actually writes. When that record is absent, the headline states the service’s own reason verbatim instead of a stale number.	page 4a8c76a
No control eats a click during a write. Clicking a live-looking control while a decision write was recording silently dropped the click — one aborted run traced to exactly this race.	Busy-guards on all 7 tab surfaces refuse with a stated reason while a write is recording (Re-Run disables with its reason, re-enables when the write settles). Refusal is loud, never silent.	page dd34aa5, cf89f82
Review outcomes are stored facts. Opening a queue item invoked a model inline — page reads paid inference latency and could fail on a parse error.	Inference is off the click and page-read path entirely: a guard refuses any model invocation inside a page read. A background settler computes each outcome at decision time and stores it with its reference and failure class (migration 082); page loads read the stored outcomes. Clicks respond immediately.	page 769d9b1; engine 6ff08d6
The answer record has a contract. Five consumers each guessed at the answer record’s field meanings; a field rename could break the page silently.	The answer-record family is schema-versioned (contract v1.0.0). The producer refuses to write a malformed record; the server validates every record against the vendored schema before serving it; CI runs the real producer against the schema so the two repos cannot drift apart.	page f33db95, dfbaac4, d135da8; charter 2026-08-08
One codebase, role-gated. Your link and ours could have diverged into separately edited copies.	Your link is minted from our pinned internal build as a built artifact and role-gated server-side in the access-rails config — run controls, internal panels, and internal tabs are unmounted for the customer role, never forked. A vocabulary gate sits on the publish path. Usage/allowance caps are removed from the link permanently — no cap can refuse a question.	page b5cfdcb; rulings 2026-08-07, 2026-08-10

On the page

What changed / what was broken	The actual fix (mechanism)	Reference
Two tabs: Results and Ontology. Ontology is the control surface; Results is reporting.	The run trigger lives on Ontology’s Re-Run alone; Results’ run controls are detached (built, never appended). The same run-status line renders on both tabs from the same status read.	page f8b7115, 8ab711b
Ontology tab rebuilt as a grouped tree.	Sections group subgroups, counts roll up; rows carry decision pills with a checkmark and inline row Undo; primary verbs on the row, secondary verbs behind a three-dot menu. The feed serves each row’s decided / withheld / bound state from the store, and display names come from your declared vocabulary.	page c4f01ec, c4e6986
Rows grouped by what they do: ontology influencing the current question set, standing ontology (your policies, stated), declared ontology.	Grouping keys off each unit’s recorded influence on the question set, read from the store — not off a hand-maintained list.	page c4e6986
Decisions are dropdown choices, never free text.	Free-text edit is removed from the ratification workflow; each dropdown option is a pre-computed choice showing the count it produces and which answers move before you click.	ruling 2026-08-05; page c4f01ec
Plain-language rows in your own field names.	Internal machine tokens were purged from the customer page and FAQ at source, and a gate on the publish path blocks their return.	page 3a63d50
Decision counters (Confirmed, Withheld) always match the rows.	The counters derive from the decision ledger through one state mapping (keep → confirmed, edit → edited, withhold → withheld-in-force); no separate count exists to drift. This cured a frozen-counter class where a raw status overrode a standing decision.	engine 559d25e
Answers that name a set of records include those records as a table.	List-shaped answers compose their matched records into a copy-pasteable table beside the prose; a decline over a ranking is composed from the same measure table it describes, so prose and table cannot disagree.	ruling 2026-08-07; engine e022f18
Reset All: always visible, two clicks, “N reset”.	The show/hide offer machinery was deleted — the button always renders; a no-op reset answers exactly “0 reset”. Native confirm, no banner.	page f1bf621, 68f4fae, 978abed
Undo on every decided row, including withheld rows.	Undo on a withheld row reaches the engine’s single lift-refusal primitive (one primitive, two doors), so the refusal actually lifts; undo of a first Keep returns the question to the queue instead of doing nothing.	engine 2d24838, a728893; page 0877414
Undo always reflects the current state.	Undo blocks baked into stored responses pointed at write-time state, so a consumed save answered “Nothing to take back”. All 4 such sites now route through the click-time undo door, which re-reads fresh state and applies the right reversal.	page 33f76cf
The data picker offers one option: your live SparkDB pull with the declared ontology applied.	The internal sandbox cache variant does not ship on the customer link; the picker is composed per role server-side.	page b5cfdcb
Built-in reference vocabularies, column-scoped.	Standard codings (ISO country forms via the CLDR reference import, name-form spelling unions) ship as reference data and bind on arrival — gated on a passing probe and no collision — reserving your clicks for mappings only your business can decide. Word meaning is scoped to its column, so the same word in two fields is never treated as one conflict.	engine 2424326, f3e5f0f, 2dc3efe
Re-answering shows its progress and its result per answer.	“Re-answering N…” with each affected answer marked changed or unchanged; the count comes from the decision’s own touched-question set.	page 5bb0939
Your first view leads with items waiting on your action.	Row ordering keys on open decision state from the ledger; our editing history sits behind the per-row detail.	page c4e6986

Fixed since the first send

What changed / what was broken	The actual fix (mechanism)	Reference
35 rows showed no category chip.	The row name and its chip shared one ellipsizing cell; long names pushed the chip out. The name now truncates in its own span and the chip holds a fixed slot.	page 12aabdc
Ungrouped row labels truncated.	The name gets the whole cell and wraps whole; the chip flows after it.	page 26a94ce
The state chip could contradict the stored decision.	The chip now reads the store’s refusal-in-force stamp directly on both faces, never the assertion layer’s raw status. A per-unit test proves chip == store field in both directions.	page fb31c89
The run status bar (and its seconds counter) vanished mid-run.	One unreadable poll used to conclude the run. Up to 4 consecutive blank polls (~6 s, the service’s measured restart window) now hold the display and keep polling; only the 5th concludes. Both tab renderers ride the same writer.	page 8fbe1f8
A withheld definition’s answers described it as “not yet ratified” / “undeclared”.	Decline prose derives from the decision record: a refused unit is named as refused, with the refusal as the answer’s stated reason.	engine f93992c, cadd8f0
Empty Results after a failed questions load.	An unread answers record now retries on your next click instead of caching the failure.	page 1bf8dbd
A tab left open served a stale page after a new publish.	The page polls the served build stamp (every 60 s and on focus) and reloads itself when idle; the footer states the version gap meanwhile.	page 2f041ae
Whole window could hang on an idle connection.	The page server is threaded with a 30 s request-read timeout — one idle browser preconnect no longer wedges every other request.	page 4c33bb4
Figure queries were slow from day one.	The snapshot builder never ran statistics analysis on the store it wrote, so every figure query full-scanned a 379k-row table. Statistics now land with every refresh, before reconciliation; a failed analysis kills the build loudly.	page f26ce69
Snapshot refresh could report success against a dead source.	Refresh reconciles append-only tables by union and refuses an empty source outright — zero active rows means a mispointed connection, never a valid “0 == 0” snapshot.	page 7747d2f
The records exhibit could go stale silently.	The exhibit gained its regeneration path and a stamp stating the data’s own vintage.	page a62a316
A raw internal record identifier appeared in answer text.	Internal tokens are stripped at composition source, with the publish-path gate as the backstop.	page 3a63d50

Removed

What was removed	Why / mechanism	Reference
Ask, Identity, and Auto-ontology tabs.	Offline pending review; removed from the customer build (the role gate assembles the tab set), not hidden by CSS.	page f8b7115
The “Keep saved / Re-run now” bar and manual per-change re-run.	Click-time application made the bar meaningless — there is no saved-but-not-applied state left for it to manage.	page 5bb0939, f1bf621
Undo of a reset.	Reset is a blank event; its reverse route is deleted and unmounted. Every individual row decision remains re-decidable.	engine 92d56c7
Right/wrong wording.	Answers are answered or abstained, nothing else; the record fields carry the same two words.	ruling 2026-08-05

Build references: page 054919a (records regenerated 2026-08-10), engine f93992c. All commit ids are short hashes in the respective repositories.

	Change	Ref
Added	Resources tab — one row per person, expand to the full extraction table with source citations.	page 63f1b1d
Fixed	Tab repointed onto durable serving after its dev rig went down.	page 21b8480
Changed	Renamed “Resumes” to “Resources” across every on-screen label.	page 0bf41a8