serve: the minchah is answered, emptiness is not tov, the oral tradition is written (kohen Day 6)

TORAH ANCHORS:

Vayikra 2:1 — וְנֶפֶשׁ כִּי תַקְרִיב קָרְבַּן מִנְחָה. "When a SOUL brings a
grain offering." Rashi: only of the minchah does Torah say nefesh,
because the poor person who gives from their little has given their
soul. PRD §3.5 makes the pe'ah question the minchah. On Day 6 the
first minchah brought to this system — "What is bereishit?" — came
back as HTTP 200 and the words "Processing complete", with sources: []
and roots_consulted: []. The soul's offering was accepted and nothing
was given back.

Vayikra 19:9-10 — לֶעָנִי וְלַגֵּר תַּעֲזֹב אֹתָם. The corner is LEFT for the
stranger. A corner that has been harvested and is still called pe'ah
is the lie this commit removes: when the system cannot answer, it now
says so, and it leaves the verse itself — text, in Hebrew — in the
error body. The ger walks away with something real or with an honest
"not yet"; never with a 200 that says nothing.

Devarim 17:9 — וְדָרַשְׁתָּ וְהִגִּידוּ לְךָ אֵת דְּבַר הַמִּשְׁפָּט. Already the
anchor of l3/store.ex: "the inquiry requires that what is found is
RECORDED." Store existed. Nothing called it.

=====================================================================
WHAT THE KOHEN FOUND (BUILDER_HANDOFF_day6.md, 2026-09-07)
=====================================================================

Five defects, found by running the cycle on a live pod, invisible to
437 green unit tests because every test ran the L1 fallback (no Port
in the test VM) and none ran the cycle to L3:

  1. Real Hebrew input crashed havdalah — KeyError :position.
     The engine's roots_activated[] (vayakhel §3.1) has no position;
     only vayomer_fallback ever set one.
  2. English input was graded :tov with nothing in it.
     separate_by_boundaries([]) → [[]] → kriah named "group_0" with
     no :shoresh → all_roots_grounded?'s `_ -> true` counted it
     grounded → "Processing complete".
  3. The pipeline never wrote L3. record_interpretation/1,
     record_minority/1, record_teiku/1: zero callers. Day 7's
     SELECT count(*) FROM interpretations could not exceed 0.
  4. Errors were not chatat. No Plug.ErrorHandler; a raise returned
     an EMPTY 500. Also: process_peah had no clause for
     {:rejected, _} — a lo_tov result was itself a CaseClauseError.
  5. Health was blind to serving. esh_tamid = ShabbatTimer.resting?;
     it read "pass" while /peah/ask was 500-ing. manna_present passed
     on {:ok, :no_provision}.

Plus, confirmed in motion: MannaLedger never consumed from; a
completed cycle left cycle_date: nil.

=====================================================================
WHAT CHANGED
=====================================================================

bereishit_cycle.ex
  - normalize_root/3: ONE root shape for both sources. Engine roots
    (string keys, no position) and L1 roots (atom keys) come out as
    %{shoresh, shoresh_letters, gematria, binyan, domain, positions,
    position, source, engine}. `positions` is looked up in
    context.verse.words — the ShemaContext gives the WHERE; the
    engine gives the WHAT. That is what havdalah's own @doc always
    said, and vayakhel §3.1 is unchanged: the engine was conforming.
  - separate_by_boundaries([], _) → [] (was [[]]). Roots the verse
    does not place form their own trailing group instead of crashing
    or vanishing.
  - kriah never names an empty group and always carries :shoresh.
  - erev_voker composes the answer (roots, gematria, te'amim groups,
    ki tov — the system's own reasoning, not prose from a model) and
    sources (the context verse: book/chapter/verse/ref/text, tamid
    §1.1's shape), then RECORDS: Interpretation for {:ok}, TeikuRecord
    for {:unresolved}, NOTHING for {:rejected} (BUILD_KORBAN.md:123:
    rejected, not processed into empty propositions). l3_attrs/2 is
    pure and tested without PostgreSQL. coupling_trace is the
    L1-anchored shape the write gate accepts, and only for roots that
    occur in the verse. A record that fails — validation OR a raise
    from a database that is down — is logged, sounds chatzotzrot
    :assembly_leaders, and does not turn a served answer into a 500.
  - case_ref minted once in tohu; Talmudic routing and the L3 record
    use the same one.
  - probe: true (tamid) runs the whole cycle and skips the write.

specification.ex
  - all_roots_grounded?/1: `_ -> true` is gone. No :shoresh → not
    grounded. shoresh: nil stays :teiku (the existing test).
  - evaluate/2: halt check FIRST (yehareg v'al ya'avor — shape never
    masks a cardinal sin), then a result with no :shoresh is lo_tov
    with a reason that names it.

manna.ex / vav_pipeline.ex
  - Manna.gather_for_cycle/0: load (idempotent per date) + consume
    one compute unit, called from VavPipeline.process/1. The ledger
    is now consumed from.
  - Manna.release_at_day_boundary/0: surplus is released when the
    DATE rolls, not per request. enforce_cycle_boundary zeroes the
    ledger and clears its date; called after every request it would
    have re-gathered a full day's provision on the next one —
    infinite manna. Shemot 16:19: until MORNING.
  - The late-manna trap: load_provision pins cycle_date=today with a
    ZERO allocation when the file is absent, then :already_loaded for
    the rest of the day — a provision written after the first request
    would never be gathered. gather_for_cycle re-gathers when the
    ledger holds nothing for today.
  - VavPipeline.tamid_probe/0: builds a real context, honours the
    cloud, runs the real cycle on Bereishit 1:1 in Hebrew, consumes
    no manna, writes no L3.

bigdei_kodesh/router.ex
  - use Plug.ErrorHandler; handle_errors/2 sends tamid §1.2's
    code/type/message/guidance, logs, signals :assembly_leaders, then
    re-raises so the crash is still supervised. 400 → KIYOR_MALFORMED_
    REQUEST; else CHATAT_UNEXPECTED. No stack in the body.
  - {:rejected, reason} handled on pe'ah AND courtyard: 422
    TEIKU_NO_ROOTS for the empty-results case, with guidance naming
    Architecture Step 22 and guidance.scope_verse carrying the verse
    in Hebrew; 422 LO_TOV otherwise.
  - {:waiting, :provision_exhausted} → MANNA_DEPLETED (was falling
    through to CLOUD_MOVING).
  - esh_tamid runs VavPipeline.tamid_probe/0 — "shabbat" on Shabbat,
    "pass" only when roots came back. manna_present fails on
    :no_provision. l3_writable added (Repo up AND SELECT 1 answers;
    "absent" without a Repo, counted as a failure). /kodesh/status
    exposes manna_provision (allocated / consumed / remaining).
  - roots_consulted as letter-hyphenated Hebrew ("ב-ר-א").

test/day6_serving_test.exs — 25 tests
  A process registered under the REAL name VavPipeline.ShoreshEnginePort
  answers the way the pod's engine answered (string keys, no position;
  nothing for non-Hebrew), so the engine-shaped path runs end to end
  through the router with no binary. Each describe names the defect it
  holds shut. One @tag :l3 test asserts count(interpretations) rises
  by one after a live cycle.

KOHEN.md — Day 6 gains the Hebrew request, the expected 422 for
English, and the health shape; Day 7 sends FIVE Hebrew + FIVE English
and expects the L3 count to rise by the Hebrew ones, with the reason.

=====================================================================
VERIFIED — the kohen's exact procedure, locally, against the REAL
Haskell binary over the Port, with L3 deliberately unreachable
=====================================================================

  POST /peah/ask {"question":"בראשית ברא אלהים"}
    200. answer: "Roots activated in Bereishit 1:1: ב-ר-א (gematria
    203, Qal, word 2). Te'amim divide them into 1 group(s): ב-ר-א.
    Ki tov: ..." sources[0]: Bereishit 1:1 with Hebrew text.
    roots_consulted: ["ב-ר-א"]. Cycle: 31ms.
  POST /peah/ask {"question":"What is bereishit?"}
    422 TEIKU_NO_ROOTS / unresolvable, guidance.scope_verse =
    Bereishit 1:1 in Hebrew, no answer key. Cycle: 3ms, :rejected.
  POST /peah/ask '{this is not json'
    400 KIYOR_MALFORMED_REQUEST with guidance — 406 bytes, not 0.
  GET /kodesh/health
    esh_tamid "pass" (from a real cycle, 7ms, no L3 attempt),
    l3_writable "fail" (DB unreachable by design), overall degraded.
  GET /kodesh/status
    manna_provision: consumed 2 after two cycles; the probe took none.
  Log: L3_WRITE_FAILED + chatzotzrot for each served Hebrew cycle;
    "activated no roots" for English; CHATAT_UNEXPECTED for the bad
    body. The 2–5s per request was ENTIRELY DBConnection queuing
    against the dead database — the cycles themselves were 1–31ms.

  mix test — 437 tests, 0 failures, 36 excluded (:l3)
  Doorpost.verify_identity() :ok — no @spec_files entry touched
  l1/integrity.sha256 unchanged: 99bbd07a…4ea377

NOT FIXED, RAISED:
  - The engine's parse_tree is null on the pod because Server.hs reads
    "l1/torah/..." relative to cwd. Nothing consumes parse_tree yet
    (havdalah uses context.teamim_marks), so nothing is lost today.
  - cloud.ex Shabbat is the UTC stub; zmanim absent (kohen Day 5).
  - The L3 write is on the request's critical path by choice: the
    offering is not complete until the altar portion is recorded. With
    L3 down that costs the queue timeout per request AND is visible in
    l3_writable. If that trade should go the other way, it is one
    Task.start, and a spec question first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

KOHEN.md

@@ -350,18 +350,59 @@ curl http://<host>/kodesh/status | jq '.halt_status'
 curl http://<host>/kodesh/status | jq '.refuge_components'
 # Expect: 0
 
-# Pe'ah responds (the public ring)
+# Pe'ah responds (the public ring) — Hebrew: the cycle has roots to reason over
+curl -X POST http://<host>/peah/ask \
+  -H 'Content-Type: application/json' \
+  -d '{"question":"בראשית ברא אלהים"}'
+# Expect: 200. `answer` is the system's own reasoning over L1 (roots,
+# gematria, te'amim groups, ki tov) — NEVER the words "Processing
+# complete". `sources[0]` is Bereishit 1:1 with its Hebrew `text`.
+# `processing.roots_consulted` includes "ב-ר-א".
+
+# Pe'ah responds — English: the system says what it cannot yet do
 curl -X POST http://<host>/peah/ask \
   -H 'Content-Type: application/json' \
   -d '{"question":"What is bereishit?"}'
-# Expect: a 200 response with `answer`, `sources`, `processing` fields
+# Expect: 422, error.code "TEIKU_NO_ROOTS", type "unresolvable", with
+# guidance.correction naming Architecture Step 22 and
+# guidance.scope_verse carrying Bereishit 1:1 in Hebrew — the corner of
+# the field, offered regardless. NOT a 200 with `sources: []`. Until the
+# Korban Processor's external-model path (Step 22) is built, a question
+# with no Hebrew root is answered honestly, not hollowly (tamid §4.1:
+# "It does not fabricate results from partial capacity").
+
+# Health now pushes a real input through the cycle (tamid §2.1 check 7)
+curl http://<host>/kodesh/health | jq '.checks'
+# Expect: esh_tamid "pass" (or "shabbat"), l3_writable "pass",
+# manna_present "pass" only when today's provision is actually present.
 ```
 
+**Day 6 fail modes, in order of likelihood:**
+- Hebrew request returns 500 with an empty body → the chatat handler is
+  missing; every error must carry `code/type/message/guidance`. Builder.
+- Hebrew request returns 200 with `answer: "Processing complete"` →
+  the cycle graded emptiness tov. Builder.
+- English returns 200 → same defect. Builder.
+- `esh_tamid` "fail" while pe'ah answers → the probe could not build a
+  ShemaContext; check L1 mount and the vav-pipeline log.
+
 ### Day 7 — *Yom HaShevi'i* — Full integration under load
 
 ```bash
-# Submit 10 questions through pe'ah
-for i in $(seq 1 10); do
+# Submit 10 questions through pe'ah — FIVE in Hebrew (these are the
+# ones that reach L3), FIVE in English (these prove the chatat path).
+# "Test query $i" is English: it carries no Hebrew root, so until
+# Architecture Step 22 it is answered with 422 TEIKU_NO_ROOTS and does
+# NOT write L3 — by design (BUILD_KORBAN.md:123). The L3 count below is
+# expected to rise by the number of Hebrew questions, not by ten.
+for q in "בראשית ברא אלהים" "את השמים ואת הארץ" "ויאמר אלהים יהי אור" "ויהי ערב ויהי בקר" "ברא אלהים"; do
+  curl -s -X POST http://<host>/peah/ask \
+    -H 'Content-Type: application/json' \
+    -d "{\"question\":\"$q\"}"
+  echo
+  sleep 2
+done
+for i in $(seq 1 5); do
   curl -s -X POST http://<host>/peah/ask \
     -H 'Content-Type: application/json' \
     -d "{\"question\":\"Test query $i\"}"
@@ -378,9 +419,18 @@ curl -X POST http://<host>/chatzer/sanhedrin \
 # Status after load
 curl http://<host>/kodesh/status | jq .
 
-# Verify L3 wrote interpretations
+# Verify L3 wrote interpretations — expect >= 5 (one per Hebrew
+# question; a Hebrew question that resolves to teiku lands in
+# teiku_registry instead, so check both)
 docker run --rm postgres:17 psql "$DATABASE_URL" \
-  -c "SELECT count(*) FROM interpretations;"
+  -c "SELECT count(*) FROM interpretations;" \
+  -c "SELECT count(*) FROM teiku_registry;"
+
+# Manna was consumed, and NOT re-gathered per request
+curl http://<host>/kodesh/status | jq '.manna_provision'
+# Expect: cycle_date = today, consumed.compute_units >= 5 (Hebrew
+# cycles consume; rejected English ones consumed too — every cycle
+# eats), allocated unchanged from today.json.
 ```
 
 **24-hour observation period.** System runs but does not yet serve outside users. Watch logs: