Reviewed snapshot preparation

prepareActivityResearchSnapshot now connects the offline eligibility decision to the actual baseline and evidence preparation APIs. A caller supplies a trusted serialized public-world snapshot and an operator review manifest. The function hashes the entire exact UTF-8 JSON, derives world/family identity from it and checks eligibility before building any baseline, source page or evidence packet. Denied snapshots return metadata only. Approved snapshots retain the canonical baseline, all pages and original omission diagnostics.

Review identity covers unknown metadata, disabled prose, key order and whitespace. Reserializing or changing any of these invalidates the review; a selected-passage or truncated embedding hash cannot substitute for the complete snapshot. This is an exact snapshot agreement, not a semantic-content hash or safety classifier.

The engineering limits are 8 MiB of UTF-8, 64 container levels checked before JSON parsing, and 100,000 values across the parsed tree. The entrypoint requires an object schema and valid metadata shapes and sanitizes malformed-input and extraction errors. It does not query data, call a provider, review media, grant an approval or alter production serving.

Eleven meaningful contract tests passed after a failing test-first phase. The broader selected suite passes 564 tests, with no failures or skips; workspace typecheck passes eight tasks and build five. Independent review found no actionable defect and independently passed the eleven focused tests.

The complete Discovery workflow and OSS export workflow also passed on source commit 734c11c96a1ccb8135ec0f99081411dfc3b54542. The Discovery warehouse job passed separately within that workflow. These CI results do not replace the still-missing production ClickPipe mappings or actual canonical replication/erasure receipts.

A newly frozen preflight used the same twelve immutable development snapshots, the existing held family and zero approvals. All twelve were denied before baseline/evidence work: one family hold and eleven unreviewed snapshots. No credentials or providers were used. This verifies the job boundary; it is not a content assessment of the eleven unreviewed worlds. The stopped extraction remains stopped, and its historical results were neither retried nor relabeled.

Preflight plan SHA-256: 4e584e551dae2868df03dc7193b089a6ca1692ea5aaee0df55b45f39f98d73f3. Result SHA-256: b3bbedb5c25ff2cd810e8a4b5683edb6783ff41ad0038ffce741fedfd5825b33.

Further paid work needs explicit eligibility decisions for its exact text snapshots and a new frozen execution plan. A screening judgment may be mistaken; it must retain reviewer provenance and uncertainty. No production publication decision or recommendation uplift follows from these structural checks.