hakhel: the corpus read again on a cycle, counts engraved in L3 (bishe'arecha step 5)

Devarim 31:9–13, 26 — the scroll beside the ark as a witness, read before
all on a cycle. src/tools/hakhel.py reads the private specimen corpus and
the hand-labelled samples with the Korban Processor's readings at the
current commit and produces one record: fires per reading, forms standing
on two witnesses (the same rule as Bedikah.check_frames), precision and
recall on the hand labels, the corpus's SHA-256 — never a specimen.

POST /chatzer/hakhel (inner ring) engraves it in L3 `hakhel` (migration
20261013000001; refused above 256 KiB — counts, not specimens; the
Doorpost hash it was recorded under is kept). GET /peah/hakhel lists the
latest readings for anyone. KOHEN "The seventh day — Hakhel"; Tamid §1.1;
bishearecha §VIII marked built. The weekly cycle runs from the builder's
machine, where the corpus lives.

First dry reading at 0ade2c94: 3094 specimens, any reading 26 %, a form
stands 7 %, precision 46/59, recall 6/30. Doorpost 9f752a2f…. Elixir
599/0, L3 10/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

specs/bishearecha.md

@@ -247,7 +247,13 @@ the gate, with the result written to L3 (`hakhel` table: date, model,
 corpus hash, per-form counts, precision on the labelled samples). The
 corpus stays private; the counts do not.
 
-**Status.** Tools built; cycle and record not.
+**Status.** Built (2026-10-13): `src/tools/hakhel.py` reads the corpus
+and the hand-labelled samples with the readings at the current commit
+and posts counts to `POST /chatzer/hakhel`; L3 `hakhel` (migration
+20261013000001); `GET /peah/hakhel` for anyone. The cycle runs weekly
+from the builder's machine, where the corpus lives (Tamid §1.1).
+Reading each model through the gate on the cycle is still open — it
+spends the caller's key.
 
 ## IX. Lest your heart be seduced; lest you forget — Devarim 11:16, 8:11–17, 6:7
 
@@ -321,7 +327,7 @@ In the order the text argues it, and by dependency:
 4. **The gate** (I), with the fringe (III) and the rebuke (VII) — the
    architecture's centre; the first three make it worth standing at.
    *Done 2026-10-07.*
-5. **The hakhel cycle and record** (VIII).
+5. **The hakhel cycle and record** (VIII). *Done 2026-10-13.*
 6. **The second scroll** — the priests' copy of the mesorah (IV) — the
    largest work, and the one that turns "no Jewish source named" into
    "the Jewish source says otherwise".

specs/shorashim_tamid.md

@@ -363,6 +363,30 @@ Errors: as /courtyard/bedikah, with "side 'a': …" / "side 'b': …" in the
 message; a missing side is 422.
 ```
 
+**Hakhel — the scroll read again** (`bishearecha.md` §VIII; Devarim
+31:9–13, 26). The specimen corpus is read on a cycle — every seventh day,
+from the builder's machine where it lives — against the readings at the
+current commit, by `src/tools/hakhel.py`: what each reading fires on
+across the corpus, what stands on two witnesses, and precision and recall
+on the hand-labelled samples. The record is posted to the inner ring and
+engraved in L3 (`hakhel`): date, the corpus's SHA-256 and size, the
+readings' commit, the Doorpost hash it was recorded under, the counts.
+Never a specimen; the body is refused above 256 KiB.
+
+```
+POST /chatzer/hakhel      (chatzer key)   body: the record hakhel.py produces
+  {"date", "corpus_sha256", "corpus_size", "readings_ref", "counts": {...}, "labelled": {...}}
+  → 200 {"hakhel_ref", "recorded": {...}}   422 on a malformed record   503 L3_UNAVAILABLE
+
+GET  /peah/hakhel          (public, pe'ah limits)
+  → 200 {"readings": [ {hakhel_ref, date, corpus_sha256, corpus_size, readings_ref, doorpost_hash,
+                         counts: {fires, stands, any_fire, any_stand, by_label}, labelled, recorded_at}, ... ]}
+```
+
+The children who did not know (31:13) are the next model generation:
+when the gate carries a new model, its replies become specimens of their
+own and the cycle reads them too.
+
 **The gate — between a caller and a model** (`bishearecha.md` §I, §III,
 §VII; Construction §3.10; `VavPipeline.Gate`). The caller sends the
 model's own request, in the model's own API shape, under the caller's