the second scroll: the mesorah snapshot, pinned and read (bishe'arecha step 6)

Devarim 17:18 — the king writes his copy from before the priests, not from
memory. scripts/build_mesorah.py takes one open-licence version per work
per language from the Sefaria export (bucket sefaria-export, catalogue of
2026-10-02; Public Domain / CC0 / CC-BY / CC-BY-SA only, checked in every
file; no CC-BY-NC — the Bavli is Wikisource's) and lays it down beside
L1: mesorah/works/<slug>/{he,en}.json, index.json, integrity.sha256,
build_report.json. 128 works (Rashi, Onkelos, Ramban, Ibn Ezra, Sforno
on the Torah; all of Mishnah; 37 Bavli tractates; Bereshit and Shemot
Rabbah, Sifrei, Tanchuma), 256 files, 44.9 MiB, tree hash 7d5b3a6c…
computed as L1's (sorted relative path, then bytes; the two post-hash
files excluded). What is out, and why (licence), is in Terumah §E5.

Read, never fetched: korban_processor/mesorah.py finds citations as
written (Rashi on Devarim 6:5, Berakhot 2a, Mishnah Berakhot 1:1,
Bereshit Rabbah 1:1, Sifrei Devarim 32, Tanchuma Bereshit 1 …), resolves
each against the snapshot (complex works through their unnamed node,
Tanchuma by parashah), lists them as examination.mesorah_references, and
makes every passage found a given source for that examination — so a
claim about Rashi anchors in Rashi or does not. The Vav Pipeline couples
coupled(reference(R), mesorah(Work, [Address])) or not_in_mesorah; the
engine accepts mesorah/2 as a terminal and not_in_mesorah is Form 4.
VavPipeline.Mesorah pins the hash, re-reads the tree at startup and every
ten minutes, and /kodesh/health carries mesorah_hash. Mounted read-only at
/mnt/mesorah in the vav-pipeline and korban-processor images. L3
bedikot.mesorah (migration 20261013000002).

Also: the 1-in-12 Day6 serving failure of 2026-10-04 reproduced with seed
446116 — HaltMonitorTest left the system halted; it now resolves on exit
and the Day6 setup is defensive. Construction §3.11, Terumah §E5, Tamid
§1.1, bishearecha §IV, KOHEN, AGENTS. Doorpost 0638d4eb…. Elixir 604/0
(seeds 835592 and 446116), korban 294/1 skipped, Prolog bedikah 44/44,
L3 10/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

specs/bishearecha.md

@@ -129,7 +129,13 @@ text and can be checked as a verse is. **Not a live network call during a
 verdict**: the verdict must be the same tomorrow; a text fetched at
 verdict time is memory of another kind.
 
-**Status.** Not built. L1 is the pattern; the second scroll is the work.
+**Status.** Built (2026-10-13): `mesorah/` — 128 works, 44.9 MiB, from
+the Sefaria export, open-licence versions only, pinned by one hash like
+L1 and mounted read-only in the images (Construction §3.11, Terumah
+§E5). A citation resolves to text or to nothing; the passage is a given
+source for the claims made about it. Not a live call. What is not in it
+is listed in Terumah §E5 — Sifra, three of the Rabbah, Ramban on
+Shemot — for want of an open licence, not of a text.
 
 ## V. Two witnesses — Devarim 19:15
 
@@ -330,7 +336,7 @@ In the order the text argues it, and by dependency:
 5. **The hakhel cycle and record** (VIII). *Done 2026-10-13.*
 6. **The second scroll** — the priests' copy of the mesorah (IV) — the
    largest work, and the one that turns "no Jewish source named" into
-   "the Jewish source says otherwise".
+   "the Jewish source says otherwise". *Done 2026-10-13.*
 
 ## What this document is not
 

specs/shorashim_tamid.md

@@ -257,7 +257,8 @@ Response (200):
     "vital_content": "...", "propositions": [...], "references": [...],
     "roots": [...], "discarded": [...], "sources": [...], "claims": [...],
     "self_validation": [...], "self_promotion": [...], "excluded_adversarial": [...],
-    "frames": [{"form","sentence","matched"}, ...]
+    "frames": [{"form","sentence","matched"}, ...],
+    "mesorah_references": [{"as_written","ref","work","address","found","languages"}, ...]
   },
   "coupling_trace": ["coupled(claim(1), source(report_q3))",
                      "coupled(claim(2), not_in_sources)",
@@ -294,7 +295,8 @@ SHA-256 and length — never the output itself — the sources by id,
 SHA-256 and length — never their text — vital content, propositions,
 references, claims with their anchors, authority claims, actions, the
 sentences read for checks 4–6, the forms found for check 7, trace, violations, verdict,
-and at the gate `rebukes` — the ref of the examination this one answers.
+and at the gate `rebukes` — the ref of the examination this one answers;
+`mesorah` — the citations made, each found or not.
 ```
 
 **Every rule cites its verse** (`bishearecha.md` §X; Devarim 4:2).
@@ -363,6 +365,20 @@ Errors: as /courtyard/bedikah, with "side 'a': …" / "side 'b': …" in the
 message; a missing side is 422.
 ```
 
+**The second scroll** (`bishearecha.md` §IV; Construction §3.11). A
+citation the output makes to the mesorah — Rashi, Onkelos, Ramban, Ibn
+Ezra, Sforno on the Torah; the Mishnah; the Bavli; Bereshit and Shemot
+Rabbah, Sifrei, Tanchuma — is looked up in the snapshot baked into the
+images, never fetched. `examination.mesorah_references` lists each with
+`found`; the trace couples it to `mesorah(<work>, [<address>])` or
+`not_in_mesorah` (Form 4: a source that does not exist); the passage the
+snapshot has is a given source for that examination, so what the output
+says about it anchors in it or does not (the grounding check, as for any
+source). The snapshot is pinned (`VavPipeline.Mesorah`), hashed at
+startup and every ten minutes, and readiness carries `mesorah_hash`.
+Sefaria's export is the source; only open-licence versions are taken
+(Terumah §E5).
+
 **Hakhel — the scroll read again** (`bishearecha.md` §VIII; Devarim
 31:9–13, 26). The specimen corpus is read on a cycle — every seventh day,
 from the builder's machine where it lives — against the readings at the

specs/shorashim_terumah.md

@@ -149,6 +149,22 @@ Source: Westminster Leningrad Codex (WLC) 4.20, as carried by the Open Scripture
 | 613 mitzvot in Prolog logical format | ❌ | Core encoding task. ~4-6 weeks. |
 | Relationships between mitzvot | ❌ | Dependencies, conflicts, groupings. ~2-3 weeks. |
 
+### E5. The Second Scroll — the mesorah snapshot (bishe'arecha §IV)
+
+Source: the Sefaria export (public storage bucket `sefaria-export`, catalogue `books.json` generated 2026-10-02), one chosen version per work per language, taken by `scripts/build_mesorah.py` from `scripts/mesorah_sources.json`. Only open versions: Public Domain, CC0, CC-BY, CC-BY-SA — the licence in each file is checked against the sources file and the build refuses otherwise. No CC-BY-NC text is taken (the Steinsaltz/Davidson Talmud is therefore not here; the Bavli is Wikisource's, CC-BY-SA). Sefaria and each version's source are credited in `mesorah/index.json`.
+
+| Material | Status | Notes |
+|---|---|---|
+| Rashi, Onkelos, Ramban, Ibn Ezra, Sforno on the five books | ✅ | Hebrew (public domain editions) and English (Silbermann 1929–34 public domain; Sefaria Community CC0) |
+| Mishnah, all 63 tractates | ✅ | Hebrew Torat Emet (PD); English where open |
+| Talmud Bavli, 37 tractates | ✅ | Hebrew: Wikisource (CC-BY-SA). English only where an open one exists (Cohen's Berakhot, PD) |
+| Midrash halakha: Sifra, Sifrei Bamidbar, Sifrei Devarim | ✅ | Sifra's Hebrew is a 1545 print marked "unknown" licence by Sefaria — EXCLUDED; Sifrei included |
+| Midrash aggadah: Bereshit / Shemot / Vayikra / Bamidbar / Devarim Rabbah, Tanchuma | ⚠️ | Vayikra, Bamidbar, Devarim Rabbah Hebrew are "unknown" licence — EXCLUDED; Bereshit and Shemot Rabbah and Tanchuma included |
+| Ramban on Shemot | ❌ | Hebrew "unknown" licence — excluded |
+| Mekhilta | ❌ | Not in the export catalogue under that title |
+
+Extent: 128 works, 256 files, 44.9 MiB, tree hash `7d5b3a6c…` (`mesorah/integrity.sha256`). Seven works have named nodes (Ramban on four books, Ibn Ezra and Sforno on Bereishit, Tanchuma); the reader addresses their unnamed node, and Tanchuma by parashah.
+
 ### E4. Talmudic Training Data (Kushya Generator)
 
 | Item | Status | Notes |

specs/shorashim_vayakhel.md

@@ -504,6 +504,22 @@ Errors: `{"status": "error", "code": PARSE_ERROR | INVALID_REQUEST | UNKNOWN_ACT
 
 ---
 
+### 3.11 The Second Scroll — the mesorah snapshot, read (bishe'arecha §IV)
+
+| Property | Value |
+|----------|-------|
+| **Source** | Sefaria export, bucket `sefaria-export` (catalogue generated 2026-10-02); one version per work per language, chosen in `scripts/mesorah_sources.json` by licence (Public Domain, CC0, CC-BY, CC-BY-SA only), then size. Terumah §E5 lists what is in and what is out, and why |
+| **Builder** | `scripts/build_mesorah.py`. Deterministic: the same sources file and the same export bytes give the same tree and the same hash. The licence in every file must equal the sources file's or the build stops. The export bytes are cached at `~/shorashim-source-data/sefaria-export-cache` |
+| **Extent** | 128 works, 256 files, 44.9 MiB. Hash `7d5b3a6caa61322239d2daf97f8bff1cc6c9aeb81ff58efad033a8e8a3aa90b5` |
+| **Format** | `mesorah/index.json` (slug → title, heTitle, categories, schema, per-language versionTitle / versionSource / license / sha256 / bytes / export URL); `mesorah/works/<slug>/{he,en}.json` — the exported version with its `text` as Sefaria's jagged array, tags and all, keys sorted; `integrity.sha256`; `build_report.json` |
+| **Slugs** | `rashi_on_devarim`, `onkelos_bereishit`, `ramban_on_bereishit`, `mishnah_berakhot`, `bavli_berakhot`, `bereshit_rabbah`, `sifrei_devarim`, `midrash_tanchuma`, … (Torah books by their Hebrew names) |
+| **Integrity** | SHA-256 over every file under `mesorah/` except `integrity.sha256` and `build_report.json` — relative path, then bytes, sorted, as L1. Pinned in `VavPipeline.Mesorah`; hashed at startup and every ten minutes; `/kodesh/health` row `mesorah_hash`; readiness fails on mismatch |
+| **Mount** | `/mnt/mesorah` in the vav-pipeline and korban-processor images, root-owned, no write bit (`MESORAH_MOUNT_POINT`) |
+
+**What the processor does with it** (`korban_processor/mesorah.py`): the output's citations are found as written — `Rashi on Devarim 6:5`, `Rashi to Deut. 6:5`, `Onkelos Bereishit 1:1`, `Ramban on Shemot 20:2`, `Mishnah Berakhot 1:1`, `Berakhot 2a` / `Bavli Shabbat 31a` / `b. Berakhot 2a`, `Bereshit Rabbah 1:1`, `Sifrei Devarim 32`, `Tanchuma Bereshit 1` — and each is resolved against the snapshot (a Bavli daf `2a` is index 3, `2b` index 4). The examination lists them as `mesorah_references: [{as_written, ref, work, address, found, languages}]`. Every citation the snapshot has becomes a **given source** for that examination (`mesorah:<ref>`), so a claim about the passage anchors in the passage — six consecutive words, or 60 % of its content words — or does not. **What the pipeline does with it**: `coupled(reference(<ref>), mesorah(<work>, [<address>]))` for a citation the snapshot has, `coupled(reference(<ref>), not_in_mesorah)` for one it lacks; the engine accepts `mesorah/2` as a terminal beside `verse/3` and `source/1` (`is_given_grounded_coupling/1`), and `not_in_mesorah` is Form 4 — grounded in a source that does not exist. Recorded in `bedikot.mesorah`.
+
+**Verification procedure:** check out nothing — run `scripts/build_mesorah.py scripts/mesorah_sources.json`; the hash it prints must equal the one committed and pinned. A different hash means a different scroll: the export served different bytes for a pinned version (the cache keeps the bytes that were hashed), or the sources file moved.
+
 ### 3.10 The Gate — Vav Pipeline between a caller and a model (bishe'arecha §I, §III, §VII)
 
 **Protocol:** HTTPS outbound from the Vav Pipeline (OTP `inets`/`ssl`,