Eligibility before recommendation research
The stopped development extraction showed why publication status and semantic quote support are insufficient eligibility checks. A correctly quoted fictional activity can still come from a world that should not enter a recommendation experiment.
createActivityEligibilityGate is a pure offline check over a trusted operator manifest. It is not a content classifier, automatic approval, media review or production moderation endpoint. No serving or provider caller is added by this module; the next extraction job must explicitly use it before dispatch.
The manifest records at most 512 unresolved family holds and 512 exact world/family/revision approvals, under a fixed policy version. A family hold wins over every approval, language variant and newly approved revision. Missing approval, wrong family identity, stale revision or malformed candidate metadata denies inclusion. A denied world belongs outside both the baseline and enriched candidate sets; missing semantic evidence may fall back to baseline only after eligibility passes.
The revision hash must cover the complete text snapshot being approved, including fields omitted by evidence extraction. It cannot be the hash of a selected passage or truncated embedding input. Hash binding records which decision was used; it does not establish that a reviewer made a correct decision or let an untrusted caller self-approve. Media and production eligibility remain separate concerns. Create a fresh gate when operator decisions change.
Parsing reads fixed own data properties, rejects accessors/extra descendants, bounds arrays before traversal, rejects sparse entries and duplicate approvals/holds, and emits a fixed error for an invalid manifest. The gate snapshots validated decisions and hashes their canonical field order. Returned decisions expose no source content. No provider, storage, network, schema, subscription, production status or creator notification is involved.
Seven contract tests first failed against a permissive stub and then passed. They cover family-wide precedence, unreviewed/stale/mismatched inputs, exact count limits, malformed metadata, accessor avoidance, duplicates and defensive snapshots. The integrated selected suite passes 529 tests, with no failures or skips; workspace typecheck passes eight tasks and build five. Independent review found no concrete issue and independently passed the seven focused tests.
A local probe used the four family identities observed by the read-only production metadata query. Deliberately synthetic approvals and revision hashes attempted to bypass the real research hold; all four remained denied and neither baseline nor aspect processing ran. This tests hold precedence, not the content eligibility of those variants. No provider calls occurred. Probe SHA-256: ebfc76d4f52534ba27581863151e6b380473fb76281d54c10258253191930fd4.
The held family remains excluded from research. Absence of an obvious flag in other inspected worlds is not comprehensive certification. Further paid extraction requires an explicit screened corpus and a new frozen plan. The prior run remains incomplete and is not silently resumed. Production publication and feed behavior have not been changed by this work.