Feature-preservation matrix

FP-2 review artifact, inspected at cd12d688a19f73f34995c9af6b86e72f5f6d7886 on fix/fp1-metacognition-preservation. It is an outcome inventory, not a declaration that the 11.0 migration preserves every feature. The companion machine-readable inventory is the row-level source of truth; it records the legacy trigger, observable, live owner, required wiring, exact source file, named meaningful public test (or MISSING), risk, next action, and owning FP ticket for every row.

Run the checked-in verifier from a source checkout so imports resolve to the reviewed tree:

PYTHONPATH=src python \
  scripts/validate_feature_preservation_inventory.py

It derives the 38 flat names from RETIRED_SETTINGS, cross-checks the selected partial rows against live cutover tables, requires all evidence fields, and derives the seven continuation contexts from RECONCILED_ROWS. Its high-risk check only detects a missing cited source anchor; the source audit, rather than a marker search, assigns the behavior class. It deliberately does not turn a passing inventory check into behavioral parity.

Reading a classification

Classification	Meaning
equivalent-proven	A supported public observable has meaningful evidence.
replacement-unverified	A live capability/port exists, but automatic composition or old/new outcome parity is not proved.
behavior-changed	The replacement has a verified, intentional, or structural semantic difference.
removed-without-equivalent	No supported owner currently expresses the old behavior.
legacy-inert	The legacy input had no reachable behavior to preserve.
admitted-but-inactive	An admitted cutover control does not configure a reachable admitted-route consumer. This says nothing about whether legacy behavior was inert.
unresolved	The evidence is insufficient.

Admission, rejection, imports, and a similarly named field are not evidence of parity. A missing proof stays visible as MISSING, with a bounded next action.

The , approved suffix reports a row-specific APPROVE CHANGE or APPROVE REMOVAL decision in the FP-5 contract. FP-5 separately validates its owner and transition evidence; the suffix does not establish parity, migration closure, fallback unreachability, or retirement.

Flat retired/replaced settings (38)

The source column below is a readable routing label. The linked JSON carries the exact repository-relative source and test paths, along with the full legacy trigger and observable, without making this table unreasonably wide.

Control	Classification	Live owner and required wiring	Source; evidence	Risk → action (owner)
extraction_template_path	behavior-changed, approved	ExtractionDirectiveSource(template_path=..., scope_path=scope.path) beside LegacyGraphOperationsAdapter(MemoryExtractionService(...)) for bundled templates	public Agent and AgentHost directive journeys; validated legacy-to-native persistence and fallback journeys	approved change: adapter handles documented operations; unsupported operations and retractions use extraction-model fallback, not full legacy parity (CORE-1)
phase_12_action_type_from_tool_calls	behavior-changed, approved	explicit LearningPolicy(promotion_use_tool_calls_fallback=True) → deep_phases → persisted draft	memory/policy.py; test_fp_class_b_native_observables.py::test_the_tool_call_fallback_decides_whether_a_draft_exists_at_all; test_fp_class_b_native_observables.py::test_native_and_legacy_config_defaults_do_not_select_the_same_fallback	tool-derived call deploy_staging draft proven; stock native false versus FrameworkConfig true, with route-dependent legacy effective default; owner approved explicit opt-in (FP-3); approved change recorded in CORE-1 comment 5596490f (not universal parity)
phase_12_llm_max_drafts_per_run	equivalent-proven	LearningPolicy → extractor	memory/policy.py; test_deep_roster.py verifies one persisted draft from three model candidates	composed LLM draft cap is independent of the regex cap (FP-3)
phase_12_llm_max_episodes_per_run	equivalent-proven	LearningPolicy.as_kwargs() → extractor	memory/policy.py; test_deep_roster.py verifies two model-visible episodes	composed episode cap bounds the extractor input (FP-3)
phase_12_llm_model	behavior-changed, approved	explicit deep_phases(procedural_extractor=...); policy name is telemetry only	test_the_configured_procedural_model_reaches_telemetry_not_selection	approved change: caller-composed extractor selects its own model; the legacy name does not select it (CORE-1)
phase_12_promote_assistant_content	equivalent-proven	LearningPolicy → promotion	memory/policy.py; test_deep_roster.py measures persisted assistant turns with the switch off and on	only the enabled branch promotes those turns (FP-3)
phase_12_use_llm_extractor	equivalent-proven	policy plus extractor collaborator	memory/policy.py; test_deep_roster.py measures both composed selector branches	false keeps regex promotion and makes no model call (FP-3)
promotion_max_drafts_per_run	equivalent-proven	LearningPolicy → promotion	memory/policy.py; test_deep_roster.py verifies one persisted draft from two eligible patterns	regex output cap is independent of the LLM cap (FP-3)
promotion_min_pattern_count	equivalent-proven	LearningPolicy → promotion	memory/policy.py; test_deep_roster.py verifies the N-1/N persisted-record boundary	below threshold produces no draft (FP-3)
promotion_recency_days	equivalent-proven	LearningPolicy → promotion	memory/policy.py; test_deep_roster.py verifies old and fresh persisted records at the lookback boundary	old records cannot satisfy the minimum (FP-3)
synthetic_link_min_co_count	equivalent-proven	LearningPolicy → synthetic phase	memory/policy.py; test_composed_synthetic_floor_reaches_persisted_edge_creation	marker-bearing episodics create the persisted boundary edge (FP-3)
nightly_nap_cron	legacy-inert	Operator scheduler metadata; engine never parsed cron	src/symfonic/agent/config.py; MISSING operator-scheduler contract	stale retirement prose implied an engine loop → keep operator compatibility separate (FP-4)
nightly_nap_enabled	legacy-inert	Operator scheduler metadata; engine never started a loop	src/symfonic/agent/config.py; MISSING operator-scheduler contract	stale retirement prose described automatic scheduling → keep operator compatibility separate (FP-4)
quick_nap_interval	behavior-changed, approved	positive ConsolidationSchedule + coordinator + memory capability; omit coordinator to disable	test_fp_class_b_native_observables.py: positive, nonpositive, omission, per-scope tests	approved change: N-positive cadence is per scope; 0/negative refuse instead of disabling (CORE-1)
metacognition_confidence_threshold	behavior-changed, approved	default SelectiveMetacognitionPolicy	governance/stages/metacognition_policy.py; test_subject_confidence_precedes_reporter_and_an_invalid_subject_stays_loud	approved change: subject/reporter confidence supplements hard evidence; no legacy activation-log score (CORE-1)
metacognition_gate	behavior-changed, approved	governance(trigger_policy=...)	governance/stages/metacognition.py; test_public_custom_policy_is_the_explicit_opt_out_seam	approved change: migrate callable to native trigger contract (CORE-1)
metacognition_selective_gate	behavior-changed, approved	governance capability default policy	governance/stages/metacognition_policy.py; test_public_selective_policy_preserves_the_three_regression_probes	approved change: composed reflector uses selective policy; old flag rejected (CORE-1)
metacognition_sensitive_tags	behavior-changed, approved	native recall tag projection plus caller state evidence	memory/recall_evidence.py; test_public_agent_distinguishes_native_recalled_tags_from_draft_terms; test_core21_sensitive_tags_differential.py compares native stream review with compatibility refusal	approved change: retrieved tag classification triggers review without copying private text into governance state or public stage reasons; the retired compatibility field refuses before dispatch (CORE-1, CORE-21)
metacognition_trivial_ack_patterns	behavior-changed, approved	explicit trivial_ack_patterns policy	governance/stages/metacognition_policy.py; test_public_custom_ack_patterns_replace_the_default_set	approved change: supplied patterns replace defaults; hard signals still review (CORE-1)
activation_log_mode	behavior-changed, approved	native HMS default footer; no never/complex policy	prompting/hms.py; test_native_compiler_preserves_the_default_footer_but_has_no_mode_switch	approved change: retain default; do not reimplement modes (FP-4)
prompt_block_self_edit	legacy-inert	None	cutover/retired_settings.py; test_retired_configuration.py	stale docs → remove guidance (FP-4)
dev_sqlite_checkpoint_path	behavior-changed, approved	human_interaction(...) plus AgentHost(continuation_factory=human_continuation(...)) with adopter-owned durable checkpoint/consumption ports	platform/human_continuation.py; test_public_host_continues_a_durable_pause_in_a_fresh_process; test_legacy_sqlite_path_refuses_before_dispatch	CORE-1 APPROVE CHANGE: no import of legacy LangGraph SQLite files, paused runs, transcripts, or working deque data; new-port recovery, scope binding, payload isolation, and single use are measured, not legacy-file parity; pin published 9.12 for legacy files (FP-4)
scorer_on_hot_path	behavior-changed, approved	Explicit public RetrievalCoordinator	memory/factory.py; test_public_agent_same_scenario_uses_scorer_or_pre_ranked_order	the legacy boolean is unsupported; compose native scoring or a source-owned pre-ranked order (FP-3); approved change recorded in CORE-1 comment 5596490f (not universal parity)
state_class	behavior-changed, approved	typed per-turn Agent.run(state=...) mapping read by a composed capability	agent/facade_turn.py; test_custom_state_is_per_turn_and_legacy_schema_refuses_before_dispatch	no state-class conversion or automatic continuation persistence → keep durable app state deployment-owned (FP-4); approved change recorded in CORE-1 comment 5596490f (not universal parity)
experimental_tool_decorator	legacy-inert	Always-public @symfonic_tool	cutover/retired_settings.py; test_retired_configuration.py	stale config → remove docs (FP-4)
ask_user_pause_ttl_seconds	behavior-changed, approved	human_interaction(ttl=TTLPolicy(...)) plus AgentHost continuation	human/values.py; test_public_host_continues_a_durable_pause_in_a_fresh_process	below/equal/expired fresh-process recovery is measured; above maximum rejects rather than clamps; owner approved explicit TTL refusal (FP-3); approved change recorded in CORE-1 comment 5596490f (not universal parity)
ask_user_tool_descriptions	equivalent-proven	human_interaction(ask_user_description=...) → InteractionToolSpec.description	human/factory.py; test_public_agent_binds_a_custom_or_localized_ask_user_description	custom and Spanish localized text reach the model binding; composition selects one deployment locale (FP-4)
procedural_force_first_action_tool	equivalent-proven	ToolsCapability(stages=(ForcedChoiceStage(),)) plus per-round palette release	tools/stages/forced.py; test_palette_force_release.py	native composition is explicit rather than a legacy boolean → compose the stage with the procedural resolver (#189)
credential_patterns	behavior-changed, approved	CredentialHygieneStage	governance(patterns=...); test_custom_credential_pattern_scrubs_its_configured_key_only; test_core21_credential_patterns_differential.py compares the two public doors with a shared tool request and disabled-pattern control	approved change: native explicit replacement scrubs the selected key while compatibility use refuses before model or tool dispatch; matching tool results are redacted whole (CORE-1, CORE-21)
fabrication_refuse_min_confidence	behavior-changed, approved	FabricationStage grades → public egress verdict	governance(min_confidence=..., refuse_min_confidence=...); test_public_fabrication_floor_withholds_the_draft_at_both_doors and test_intent_only_finding_uses_the_actionable_floor_without_detector_refusal	public run/stream allow detector findings below 0.6, withhold at 0.6 via STEER, and refuse detector findings at 0.8 inclusive; action intent without tool calls can STEER at 0.6 but cannot itself trigger REFUSE; owner approved the changed two-floor policy in CORE-1 comment 5596490f (not full legacy parity or metacognition parity)
hms_budget_mode	behavior-changed, approved	PromptBudget	cutover/prompt_assembly_policy.py; test_hms_budget_mode_native_observable.py	owner approved the safer native default; opt-in regional warn/strict remains available (CORE-1)
hms_system_prompt_token_budget	behavior-changed, approved	RegionalPromptPolicy.hms_system_prompt_token_budget	prompting/regional.py; test_hms_region_is_pinned_against_the_total_prompt_budget	approved change: explicit regional HMS limit is separate from the total prompt budget; legacy config stays refused (CORE-1)
on_hms_budget_exceeded	equivalent-proven	RegionalPromptPolicy.on_hms_budget_exceeded	prompting/regional.py; test_hms_overflow_reports_only_counts_and_strict_stops_before_provider	observer carries only counts and fires before strict failure (FP-4)
jit_manifest_token_budget	behavior-changed, approved	RegionalPromptPolicy.jit_manifest_token_budget	prompting/regional.py; test_public_agent_sends_bounded_domain_and_independent_manifest_bytes; test_core138_jit_body_differential.py::test_full_jit_hms_body_differential	CORE-138 owner approved the native JIT placement: the template keeps a manifest marker and a separate L1 tool line follows TOOL DISCIPLINE. Caller-authorized manifest remains independently bounded; legacy keyword filtering and automatic selection are not restored. This does not sign the domain_description_max_chars row.
manifest_cache_position	behavior-changed, approved	Public L1/L2 regions plus #221's explicit native manifest opt-in	cutover/prompt_assembly_policy.py; Anthropic region capture proves marker placement only	owner approved native marker placement without reproducing legacy manifest selection (CORE-1)
memory_extract_cadence	behavior-changed, approved	ExtractionDirectiveSource(cadence=..., scope_path=scope.path)	public Agent session-cadence journey	approved change: isolated by full scope and session; anonymous cadence >1 omits directive; not extraction scheduling (CORE-1)
messages_cache_policy	behavior-changed, approved	explicit NativeCacheComposition history opt-in; no automatic default or rolling ladder	cutover/prompt_assembly_policy.py; test_history_opt_in_changes_only_the_second_request_shape	owner approved caller-directed Anthropic history caching; stock remains unmarked and cost/latency are unmeasured (CORE-1)
system_prefix_cache_ttl	equivalent-proven	Stable PromptContribution cache directive plus provider serializer	prompting/assembly.py; test_public_two_turn_cache_reaches_anthropic_wire_with_ttl_marker	Anthropic wire capture proves the 1h system marker; history is a separate, uncached contract (FP-4)

FP-1 metacognition update and enforcement boundary

FP-1 changed the reviewed target from the old scalar-only stage. SelectiveMetacognitionPolicy is the default, ConfidenceOnlyMetacognitionPolicy is an explicit opt-out, and tests/platform/test_metacognition_preservation.py covers public run and drained-stream triggers for claims, mutating tools, action/ambiguous intent, fabrication findings, caller-supplied tags, native recalled MemoryRecord.metadata["tags"], trivial acknowledgments, custom policy, and invalid confidence signals. The tag route carries classifications only and its public trace is redacted. This establishes critic-invocation coverage for the native public memory composition; it is not a blanket equivalence claim.

The exact owned evidence nodes are tests/platform/test_metacognition_preservation.py::test_subject_confidence_precedes_reporter_and_an_invalid_subject_stays_loud, tests/platform/test_metacognition_preservation.py::test_public_custom_policy_is_the_explicit_opt_out_seam, tests/platform/test_metacognition_preservation.py::test_public_selective_policy_preserves_the_three_regression_probes, tests/platform/test_metacognition_preservation.py::test_public_agent_distinguishes_native_recalled_tags_from_draft_terms, tests/platform/test_metacognition_preservation.py::test_public_custom_ack_patterns_replace_the_default_set, tests/platform/test_governance_amends.py::test_custom_credential_pattern_scrubs_its_configured_key_only, tests/capabilities/governance/test_egress_stages.py::TestFabrication::test_refusal_floor_includes_its_exact_boundary, tests/platform/test_governance_refusal_precedence.py::test_a_repair_does_not_swallow_a_refusal, and tests/platform/test_metacognition_preservation.py::test_public_tool_evidence_distinguishes_mutating_and_read_only.

This proves critic invocation coverage, not every historical amendment shape. platform/governance_verdict.py now turns a STEER or ANNOTATE with no amendment content into a typed GovernanceRefused before an egress draft reaches run, stream consumers, or event sinks. A reflector outage retains the pipeline's existing fail-open policy. The public journey proves this refusal contract; it does not claim that a prompt cache is a history cache or that every legacy verdict was textually revised.

PARTIALLY MIGRATED controls (23 unique)

The following controls are distinct from the flat 38. They are source-enumerated from the cutover contract. “Admitted but inactive” never means the legacy control was inert.

Control	Classification	Live owner/wiring	Source; evidence	Risk → action (owner)
self_reflection	equivalent-proven	memory_capabilities(..., reflection=MemoryReflectionService(...)) finalizer	memory/reflection_phase.py; test_reflection_in_the_turn.py	explicit collaborator replaces implicit response-provider selection → follow migration composition (#189)
reflection_prompt	equivalent-proven	MemoryReflectionService(prompt_template=...)	memory/reflection.py; test_reflection_in_the_turn.py	missing {conversation} is refused before a model call → use the composed prompt template (#189)
domain.core_preferences	behavior-changed, approved	explicit core_preference_migration(...) → native prompt guardrails/review-trigger terms; explicit per-app core_preference_governance(...) reviewer at egress	platform/core_preferences.py; platform/core_preference_policy.py; TestMetacognitionEndToEnd::test_sensitive_tag_forces_reflection_and_refuse_replaces_response; test_legacy_critic_receives_the_preference_statement; test_public_core_preference_adapter_preserves_values_and_reaches_native_composition; test_a_migrated_core_preference_changes_no_executable_decision; test_core_preferences_causal_differential.py; test_core_preference_policy.py; test_generated_app_composes_preference_reviewer_at_public_egress	legacy critic receives preference prose; native reflector does not automatically consume it, and the migrated preference alone does not change a governed decision; an explicit caller-supplied async reviewer does, and fails closed; owner approved the explicit per-app reviewer/policy instead of an automatic legacy critic in CORE-139 comment 49c841c8 (not safety parity, adoption frequency, or per-preference effectiveness)
read_only_tools	behavior-changed, approved	governance(read_only_tools=...); the admitted compatibility field is inactive when metacognition is off	governance/stages/metacognition_policy.py; test_public_tool_evidence_distinguishes_mutating_and_read_only; test_core21_read_only_tools_differential.py replays one tool exchange at both doors	approved change: explicit native names suppress only the tool-action signal; unclassified actions and substantive claims still review (CORE-1, CORE-21)
skill_auto_approve	behavior-changed, approved	Native Agent writes drafts; MemoryAdminService requires explicit human approval before activation	ProceduralLayer; test_extraction_in_the_turn.py and test_procedural_chain.py cover drafts, explicit approval, prompt consumption, and tool enforcement	CORE-1 owner approved no implicit auto-approval; SymfonicAgent remains a live legacy reader (CORE-28)
domain	behavior-changed, approved	hms_source_for_domain(...) projects description	prompting/regional.py; test_public_agent_sends_bounded_domain_and_independent_manifest_bytes	approved change: only description projects to HMS; tools and governance remain capability-owned (CORE-1)
domain_description_max_chars	behavior-changed, approved	RegionalPromptPolicy.domain_description_max_chars	test_jit_domain_restores_legacy_directive_bytes; test_core1_full_hms_domain_cap_restore.py; test_core140_domain_cap_transition.py (public run/stream cap and empty fallback; construction-time notice on each of two Agents with no repeat across turns; first-read notice on each of two direct compositions from one source)	CORE-1 comment 50509c6e approves native RegionalPromptPolicy wording and once-per-composition notice lifetime; the legacy FrameworkConfig notice remains once per SymfonicAgent. Direct composition tests distinguish the notice guard from an Agent-bound guard. Agent rejects a second prompting stage, so same-Agent multi-composition remains UNKNOWN through the public API; no general deployment reachability, whole-template parity, or engine-retirement claim.
hydration_min_relevance	behavior-changed	RetrievalPolicy.min_relevance	memory/factory.py; test_issue188_public_retrieval_contracts.py; test_core134_hydration_relevance_differential.py; test_core1_relevance_root_audit.py	Actual constructed RetrievalEngine produces composite scores; admitted kernel run/stream preserves below/equal/above admission. The pinned legacy default per-layer body admits unscored keyword matches; public legacy scorer-on-hot-path use is refused before provider. Native explicit composite floor preserves its own boundary and unscored admission. Synthetic mechanism evidence does not calibrate apps; row stays unsigned pending representative per-app corpus, accepted rollout bounds and owner approval (FP-3). Owner ruled CORE-432 (declared split, permanent): no scale wins, per-source scales stand, no tuned number moves.
episodic_telemetry_sink	equivalent-proven	memory_capabilities(..., episodic_telemetry_sink=sink) → native memory.lifecycle	memory/telemetry.py; test_issue191_episodic_telemetry_contracts.py	receipt contains scope/run ids and committed ids only; sink failure never rolls back publication (FP-4)
working_memory_recent_turns	behavior-changed, approved	memory_capabilities(conversation=..., recent_turns=...) → WorkingWindow.read	test_public_agent_recent_turns_changes_model_prompt_and_zero_disables_window; tests/retirement/test_core29_working_window_evidence.py::test_direct_agent_zero_disables_window_but_still_retrieves; tests/retirement/test_core29_working_window_evidence.py::test_facade_zero_disables_window_and_retrieves_without_fallback; test_core135_working_window_differential.py (test_same_corpus_public_window_differential, test_hms_off_preserves_native_window_as_approved_change, test_typed_facade_cells_and_native_unknown); test_core135_window_prompt_and_scaffold.py (scaffold window tests)	public factory accepts zero, skips conversation reads and retains ranked recall; the N-utterance recency prefix matches legacy in the seeded run/stream corpus for N=0,1,2 and native keeps it with HMS prompting off where legacy sends a bare query; scaffold N exchanges are 2N saved messages (a different unit); typed cells cover the compatibility facade, native stream_typed is UNKNOWN (Agent has no public stream_typed); owner approved in CORE-135 comment be4ee003 (not whole-prompt parity, byte parity, or engine retirement)
working_layer_exclude_speakers	behavior-changed, approved	Public working window and tagged recovered records	test_public_agent_filters_tagged_recalled_speaker (run/stream); test_saturated_recall_exclusion_does_not_restore_legacy_selection (run/stream/stream_typed)	CORE-133 owner approved native filter-before-top_k: in the measured 12-record episodic top_k=2 profile, one user hit reaches the native prompt versus zero on legacy; neither prompt includes tagged assistant hits. Unfiltered and singleton legacy controls confirm recall is live. No universal ranking parity or retirement is claimed.
stm_summary_mode	equivalent-proven	WorkingMemorySummaryService JIT-only contribution	memory/summary_stage.py; test_stm_summary_in_the_turn.py	explicit evicted-turn source replaces a legacy-owned working layer → compose the migration example (FP-4)
scope_blend_mode	behavior-changed, approved	Public RetrievalCoordinator + ScopeBlend	memory/factory.py; test_public_agent_same_scenario_uses_scorer_or_pre_ranked_order; test_public_agent_scope_blend_off_and_blend_choose_different_order	OFF, BLEND and BACKFILL produce distinct public Agent ranking; pre-ranked sources preserve their order; owner approved change (FP-3); approved change recorded in CORE-1 comment 5596490f (not universal parity)
enabled_layers	behavior-changed, approved	explicit RetrievalPolicy.enabled_layers in memory_capabilities(retrieval=...); an explicitly injected orchestrator keeps its own selector	test_enabled_layers_same_turn_legacy_kernel_and_native_agent; test_public_agent_enabled_layers_reaches_source_and_model_prompt; test_core26_injected_orchestrator.py (test_injected_orchestrator_selects_layers_on_kernel_route, test_injected_orchestrator_matching_or_unset_selector_is_quiet)	The same enabled/disabled markers reach the expected source layers and prompt on direct Agent and the admitted SymfonicAgent Kernel path across run/stream/stream_typed; native stream covers the latter two's plain-text dispatch, not a separate typed-output contract. A supplied orchestrator's selector is retained and an explicitly set disagreeing FrameworkConfig.enabled_layers only logs a diagnostic; legacy implicit precedence is not transferred to native composition; owner approved in CORE-26 comment 6db8a76e (not universal retrieval parity, byte parity, or engine retirement).
enable_entity_linker	equivalent-proven	Policy plus extractor collaborator	memory/policy.py; test_entity_linking_requires_the_opt_in_and_enforces_thresholds_and_cap	the disabled policy declines; enabled composition requires an extractor (FP-3)
phase1_spreading_weight	behavior-changed, approved	LearningPolicy → quick_phases(policy=...)	memory/phases/quick.py; test_public_quick_nap_persists_phase1_spreading_weight_effect	native nap is a replacement; the public quick nap persists the selected weighting (FP-3); approved change recorded in CORE-1 comment 5596490f (not universal parity)
entity_linker_extractor	behavior-changed, approved	explicit deep_phases(entity_extractor=...) collaborator	test_the_extractor_that_runs_is_the_one_composed_not_the_one_named	approved change: injected extractor runs; legacy regex/llm kind no longer selects it (CORE-1)
entity_linker_min_mention_count	equivalent-proven	LearningPolicy → entity phase	memory/policy.py; test_entity_linking_requires_the_opt_in_and_enforces_thresholds_and_cap	N-1 produces no MENTIONS edge; N does (FP-3)
entity_linker_max_episodics_per_run	equivalent-proven	LearningPolicy → entity phase	memory/policy.py; test_entity_linking_requires_the_opt_in_and_enforces_thresholds_and_cap	persisted extractor inputs stop at the cap (FP-3)
entity_linker_confidence_threshold	equivalent-proven	LearningPolicy → entity phase	memory/policy.py; test_entity_linking_requires_the_opt_in_and_enforces_thresholds_and_cap	equality accepts; below threshold is rejected (FP-3)
episodic_summarization_max_entries	equivalent-proven	LearningPolicy → quick phase	memory/policy.py; test_composed_episodic_summary_starts_above_the_cap_and_consumes_exact_batch	summary starts only above the cap (FP-3)
episodic_summarization_batch_size	equivalent-proven	LearningPolicy → quick phase	memory/policy.py; test_composed_episodic_summary_starts_above_the_cap_and_consumes_exact_batch	exactly the configured batch is consumed (FP-3)
enable_semantic_merge	equivalent-proven	explicit quick_phases(enable_semantic_merge=True, chat_model=...)	memory/phases/quick.py; test_semantic_merge_is_explicitly_disabled_or_enabled_on_quick_nap	disabled nap preserves duplicates; enabled judge merges them (FP-3)

Continuation boundary and exclusions

Seven continuation contexts are audited separately and are not seven additional controls: enabled_layers, domain, hydration_min_relevance, working_memory_recent_turns, domain_description_max_chars, working_layer_exclude_speakers, and scope_blend_mode. continuation_admission.RECONCILED_ROWS, tests/retirement/test_continuation_reconciliation.py, and tests/agent/cutover/test_continuation_cutover.py establish cutover context only. They do not establish durable process-restart recovery.

The inventory excludes nested agent.ask_user_pause_ttl_seconds (the same TTLPolicy behavior change), per-call is_admin (refused by governance authority), and all other nested/per-call options. This is an explicit scope boundary, not a claim that no other configuration needs review.

Derived totals and release implication

The validator prints totals directly from the checked-in rows. The current evidence leaves a large set of high-risk replacement-unverified, removed-without-equivalent, and behavior-changed controls. That blocks a blanket no-feature-loss claim. FP-3 owns the discriminating public journeys; FP-4 owns supported composition, explicit refusals, and deliberate product decisions. FP-1 owns the metacognition policy implementation and its remaining custom-pattern and verdict-enforcement evidence.