Voice Lab — the room

Replanned 2026-09-27 around the revised spec. Source: .claude/plans/voice-lab-room.md

Status: Phases A–C complete (2026-08-27). Replanned 2026-09-27 around the revised spec; Phase G (prerequisite fixes) is next. Awaiting approval. Written 2026-08-27 · replanned 2026-09-27. Canonical design: Docs/mockups/voice-lab-spec.md (revised 2026-09-27) and the nine-screen prototype Docs/mockups/Voice-Lab.html. Review of the spec and every revision: Docs/reviews/2026-09-27-voice-lab-spec-review.html. Supersedes: this plan's own Phases D–F (a single LLM prose analysis over uploaded samples), and the 2026-04-10 mockup at .claude/handoffs/atticus/mockups/voice-lab-60F26437/mockup.html.

Section numbers such as §6.4 refer to the spec.

What changed on 2026-09-27

The spec replaces the design Phases D–F were built for. Five LLM-authored prose dimensions with a preserve / neutral / challenge stance give way to three things:

• Two voices. Actual is measured from writing; aspirational is measured from choices.
• Ten bipolar axes, split into a stable core and a register that shifts by Mode.
• A per-gap lifecycle, running hunch → mirror → fork → thread.

Most measurement is deterministic. The model writes margin notes, judges whether a hedge is justified, and drafts Say it first suggestions. It never places a mark.

Scope decisions

Why the gates stay untouched

RegisterBaseline → VoiceCeiling ships today and actively regenerates drafts that score above the writer's register. Two reasons not to feed Voice Lab material into it:

1. The scorer's own calibration finding is that chat and prose do not compare — which is why RegisterScorer.Weights.sentenceComplexity is zero. A polished uploaded chapter sits far above a Discovery chat answer on lexical rarity too.
2. Mixing samples in would silently raise the baseline and change which drafts get regenerated, with no visible cause. A regression in shipped synthesis behavior that only manifests as "the drafts feel different."

Phases A–C and their implementation notes (complete, 2026-08-27)

Phase A: Sample model + true multi-sample store (no LLM, no UI)

The current model holds one sample and actively deletes the others.

• Remove the destructive pruning in WorkspaceStore.writeVoiceSample. It currently runs for stale in profile.samples where stale.id != existing.id { modelContext.delete(stale) }. That was correct for a single-sample UI; in a multi-sample world it eats the writer's library on every edit. This is the single most dangerous line in the existing code for this plan.
• Add title: String and workTypeRaw: String to VoiceSample, plus a VoiceWorkType enum (shortStory, essay, personalEssay, novelExcerpt, flashFiction, poem, other) with a computed wrapper over the raw string — the house convention for enum-backed columns, so new cases absorb via lightweight migration.
• Backfill existing rows: title from sourceFilename minus extension, else "Untitled sample"; workType = .other. Extend backfillLegacyVoiceSample() or add a sibling; idempotent, safe on every launch, following backfillLegacyDraftVersions as the pattern.
• New store methods: addVoiceSample(text:sourceFilename:title:workType:), removeVoiceSample(id:), renameVoiceSample(id:title:), setWorkType(id:_:). addVoiceSample appends; the existing updateVoiceSample is retained and re-documented as the onboarding single-sample replace path only.
• Per-sample cap stays at voiceSampleCharacterLimit (20,000). Add a total cap — a sample count ceiling (suggest 12) so the analysis prompt has a bounded worst case. Refuse politely at the ceiling; never silently drop.
• Tests: append does not delete siblings, remove leaves others intact, backfill is idempotent and derives titles correctly, count ceiling refuses with a message, cascade delete still clears samples with the profile.

Deliverable: a sample library that can hold many samples without losing any.

Phase B: The room (renders what exists; no analysis yet)

• New Atticus/Views/VoiceLab/VoiceLabView.swift, replacing VoiceLabStubSurface in ContentView's .voiceLab branch. Delete the stub rather than leaving both (see the duplicate-file rule in the global guidelines).
• Two-column layout per mockup: profile column + 320pt samples panel with a hairline divider. Translate the mockup's raw hex to AtticusTheme tokens — the mockup's #F3F0EA / #FCFAF5 / #365750 / #C97C44 / #1D2828 map to canvas / surface / primary / secondary / ink. Do not reintroduce raw hex.
• Header: Voice Lab + Built from N samples across M months of your work. Singular/plural correct; the "across M months" clause is omitted when all samples fall in one month rather than printing "across 1 months".
• Samples panel: title · work type · date, × remove. Removal is a real destructive action on writer material — confirm before deleting, and state that the profile will recalculate.
• Upload zone: drag-and-drop (dropDestination), browse (existing .fileImporter), and paste. Reuses WritingSampleImporter and VoiceSampleInputCard where it fits; the drop path must run the same extraction and the same error surfacing as the picker path.
• Empty state (no samples): the existing "Atticus writes back to your voice" affordance, not an empty grid.
• Dimensions section renders in an unanalyzed state until Phase D — the five names present, no prose, a single "Build my profile" action. This keeps Phase B shippable and honest rather than showing placeholder analysis.
• Accessibility: the dimension rows are disclosure controls, not divs — keyboard-reachable, correct expanded/collapsed state, VoiceOver labels on remove and stance controls.
• Tests: layout state machine (no samples / samples but unanalyzed / analyzed), drop-path extraction, removal confirmation.

Deliverable: the Voice Lab room, managing a real sample library.

Phase C: Analysis contract + quote verification (pure, no LLM)

Built and fully tested before anything calls a model — the sequencing that synthesis-quality-gates.md used for RegisterScorer.

• VoiceDimension enum with exactly five fixed cases: sentenceRhythm, wordChoices, tonalRange, sceneBuilding, structuralPatterns. Fixed, not LLM-chosen — this is what lets the writer's stance survive a re-analysis. The model fills in prose and evidence for known dimensions; it never invents the taxonomy.
• MentorStance enum: preserve / neutral / challenge, defaulting to neutral.
• VoiceAnalysis — a Codable/Sendable value type with schemaVersion: overall summary: String plus per-dimension description: String and evidence: [Evidence] (quote text + source sample ID + source title). Persisted as a JSON blob on VoiceProfile.analysisJSON, mirroring the voiceFingerprintJSON convention so the 5-dimension shape can iterate without schema migrations.
• VoiceProfile.dimensionStancesJSON — a separate blob holding [VoiceDimension: MentorStance]. Separate on purpose: a profile rebuild overwrites the analysis, and the writer's stances must not go with it. Losing a writer's deliberate "Preserve my long sentences" because they added a sample would be a bug they would not forgive.
• VoiceAnalysisParser — tolerant tag parser in the house style (<summary>, <dimension name="…">, <description>, <evidence sample="…">), modeled on DiffSummaryParser: degrade to nil or to a partial analysis rather than throwing, and tolerate a missing wrapper.
• QuoteVerifier — the load-bearing guard. Every evidence quote must be a verbatim substring of the sample it is attributed to, after normalizing whitespace, smart quotes, dashes, and ellipses. Non-matching quotes are dropped, not displayed. A dimension that ends with zero verified quotes renders its prose alone.

Rationale: this is the writer's own prose. A quote that is subtly paraphrased — the failure mode LLMs are most prone to — is immediately visible to the one person who wrote it, and it destroys trust in the whole profile. Reuse or mirror the existing substring-anchoring logic in EditorHighlightResolver / the critique quotedSubstring degradation pattern rather than writing a third one.

• Tests: round-trip codable, schema-version tolerance, parser tolerance (missing tags, extra prose, wrong dimension names ignored), stance blob survives an analysis overwrite, and quote verification rejects a paraphrased quote, accepts a smart-quote/whitespace variant, and drops a quote attributed to the wrong sample.

Deliverable: a verified analysis contract that cannot display prose the writer did not write.

Implementation notes — Phases A–C (2026-08-27)

Where the build departed from the plan above, and why.

• Built C before B. The room's dimension rows need VoiceDimension to render, so the pure contract landed first. No scope change.
• Header omits the time span entirely, rather than omitting it only for single-month libraries as the checkbox reads. VoiceSample.addedAt records when a sample was added to Atticus, not when it was written — a chapter drafted in 2019 and uploaded today would make "across 14 months of your work" false. Restoring the mockup's phrasing needs a writtenAt field on VoiceSample; until then the header reports only what we know. Guarded by testHeaderSubtitleDoesNotClaimATimeSpanWeCannotKnow.
• No "Build my profile" button yet. The plan called for one in the unanalyzed state, but Phase D owns the analysis; a button that did nothing would be worse than the copy now in its place. Phase D adds it.
• VoiceStanceCopy landed early (planned for Phase E). VoiceLabDimensionRow needs the consequence sentence to render the stance control, so all 15 strings are written and tested now. The file also carries directive(dimension:stance:) — the prompt-side instruction Phase E consumes — deliberately beside the writer-facing copy so the promise and the instruction cannot drift apart.
• The stance control is built but not offered. VoiceLabDimensionRow renders it only when handed an onStanceChange; the room passes nil until Phase E wires the directive, so the writer is never shown a setting that changes nothing. WorkspaceStore.setVoiceStance and the persistence are complete and tested — only the wiring is withheld.
• Row actions use a ⋯ menu alongside the mockup's ×. The mockup shows only removal, but renaming and retyping have to be reachable by keyboard, which a context menu alone is not.

Suite: 730 tests, 0 failures (was 671 before this work).

Phase G: Prerequisite fixes in shipped code (no Voice Lab UI)

These are bugs against the spec's generation policy (§7.4), and they exist today. They land first because every later phase measures drafts, and a draft measured before this phase includes Atticus's own sentences.

• Authorship ledger. Add AuthorshipLedger: a per-project set of normalized sentences Atticus wrote. It is stored as a JSON blob on Project (LOW risk: a new nullable column). Every generation path records its output: DraftGenerator, applyRevision, applyReviewChanges, and, later, thread Say it first. A sentence counts as Atticus's while its normalized text matches exactly. Once the writer edits it, it is theirs. Sentence-level text matching survives paragraph splits, merges, and reordering, which ParagraphOrigin's paragraph granularity cannot.
• Close the fingerprint leak. VoiceFingerprintBuilder's sources exclude ledger sentences. Today, applied revisions pass through commitBuffer (CompositionViewModel.swift:1270-1283) and come back as .writerOriginal. Leave ParagraphOrigin as it is. The ledger is the authority for voice measurement, and a note at commitBuffer says so.
• Student rewrite gate. canRequestRevision (:1949) and canRequestWholeDraftRevision (:2589) return false when project.writingType.isStudentWork, and the Discussion prompt for student work asks a question in place of offering a <revision>. Behavior change: students lose passage rewrites they can reach today, which spec §7.4 requires. Flag it in release notes.
• Undoable revision apply. applyRevision and applyReviewChanges go through the text view's undo manager (shouldChangeText / replaceCharacters / didChangeText), not setAttributedString, so ⌘Z reverts an applied revision. Threads depend on this (§6.4).
• Abbreviation-aware sentence splitter. SentenceSplitter, built on NLTokenizer(.sentence) with post-rules ported from the prototype: no split after an abbreviation or initial, ellipses handled, closing quotes and brackets attached. It also reports an in-progress trailing sentence. RegisterScorer.sentences(in:) stays as it is, so the VoiceCeiling numbers don't shift.
• Tests: the ledger excludes generated sentences and releases edited ones, the fingerprint ignores ledger sentences, student projects can't request revisions, ⌘Z reverts an applied revision, and the splitter handles the prototype's cases ("Dr. Ng arrived.", "J. R. R. Tolkien", "Wait…", a closing quote after a period).

Deliverable: Atticus can tell its sentences from the writer's, and students get no rewrites.

Phase H: Axes, evidence, and the portrait engine (pure, no UI, no LLM)

• VoiceAxis: ten fixed cases, each carrying its poles, its group (core / register), and its detection kind (detected / modelJudgment), following spec §8.1. Fixed for the same reason VoiceDimension was: writer decisions key off it and must survive recomputation.
• Detectors, one per detected axis. Each is pure, takes the writer-authored sentences of a text, and returns a raw metric plus the sentences that drove it:
  • Hedged/Committed: an epistemic-hedge lexicon, kept separate from a scope-qualifier list that is never counted as hedging (§6.4).
  • Clipped/Rolling: mean and spread of sentence length.
  • Formal/Conversational: contraction rate plus a small register lexicon.
  • Absent/Present: first-person pronoun rate.
  • Compressed/Unfolded: clauses per sentence and sentences per paragraph.
  • Plain/Ornate: RegisterScorer lexical rarity, reused as it is.
  • Concrete/Abstract: a concreteness word-norms list. Blocker to resolve: confirm the licence of the candidate list (Brysbaert et al. 2014 concreteness ratings) before bundling it. If it can't ship, this axis becomes model-judgment and pencil-only.
• Calibration bands. Map each raw metric to a 0–100 position with fixed constants, commented as provisional. Phase N calibrates them against real writing. Material below a content-word floor produces no position, in the same way VoiceFingerprintBuilder.minimumContentWords works.
• VoiceEvidence @Model rows cascading from VoiceProfile (LOW risk: new table). Each row holds:
  • kind (write / reach) and source (pair, ownSentence, paragraph, page, upload, draft, admired);
  • axis, Mode?, and the position or lean;
  • weight, date, and a source ID (draft ID plus version);
  • up to three sentence snapshots. Rows, not a blob, because drafts add evidence continuously, and rewriting one growing blob on every step-back is the wrong shape.
• VoiceDecisions: a separate JSON blob on VoiceProfile, following the same separate-blob rule as stances. It holds:
  • verdict overrides, keyed by axis × mode;
  • Leave decisions, keyed by axis × mode;
  • corrections;
  • won'ts;
  • the gap lifecycle state (§6 table), with at most one active gap.
• PortraitBuilder: a pure function from evidence plus decisions to the portrait. It computes:
  • the write dot per axis, per mode for register axes, with recency weighting on write evidence only;
  • the reach ring per axis, mode-free;
  • ink or pencil for each of the three mark kinds (§5.2);
  • gaps, with verdicts from the default table (§5.3) plus overrides;
  • an "as of" date. Unheard modes stay nil and are never interpolated.
• HunchSelector (§6.1): verdict Work, a mode heard, a detected axis, the largest gap. It returns nil when no gap qualifies.
• Mode tagging for samples. Add a nullable VoiceSample.modeRaw column (LOW). Backfill it once from workType: short story, novel excerpt, and flash fiction map to narrative; essay to analytical; personal essay to reflective; poem to artistic; other to nil, meaning not sure. workTypeRaw stays in the schema, unread.
• Tests:
  • each detector on hand-written fixtures at both poles;
  • scope qualifiers are not hedges;
  • ledger sentences are excluded;
  • each of the three ink rules separately, including "a pair and a page agree" producing no ink;
  • unheard modes stay nil;
  • Door III alone never inks and never produces a hunch;
  • recency decays write evidence but not reach evidence or decisions;
  • hunch selection, including the nil case;
  • the backfill is idempotent.

Deliverable: give it evidence and it returns a correct portrait and hunch, with no screen yet.

Phase I: Retire the five-dimension analysis (if approved)

• Delete VoiceDimension.swift, VoiceStanceCopy.swift, VoiceAnalysis.swift, VoiceAnalysisParser.swift, VoiceLabDimensionRow.swift, the stance store methods, and their tests. Before deleting, move anything QuoteVerifier imports from VoiceAnalysis (such as Evidence) into QuoteVerifier.
• Doc-comment analysisJSON and dimensionStancesJSON as retired and unread. No column drop (see the retirement decision above).
• Search for every reference and update each one. Remaining imports must be zero. Report the files touched.

Deliverable: one model of voice in the codebase.

Phase J: The room and the sitting (UI)

• Entry (prototype screen 1). Three doors, plus the portrait preview column. VoiceLabView is restructured around them. The samples panel becomes Door II's tray.
• Pairs (screen 2):
  • ten pairs from the revised table (§4.1) plus the adaptive reserve;
  • Neither, Pass, Write it your way with the gist, and Previous;
  • fixed per-pole margin notes;
  • alternating pole sides;
  • reach evidence written per pick. Content task: write seven reserve pairs, one per detected axis. Claude drafts them to the pair rules; Sarah approves them before they ship.
• A paragraph (screen 3). An editable copy beside the fixed source. On Keep it, measure the writer's version, with the directional limit from §4.2 applied, and request one set of edit notes from the model. Each note that quotes the writer passes QuoteVerifier; a note that fails is dropped.
• Short pages (screen 4). A ruled single page with live SentenceSplitter dots, accessible count text, and the ceiling copy. Overruns are stored at zero weight. Alternates appear where they exist. Axis-neutral sparks (Principle 7) need rewriting: the analytical note and the "polite" spark. One model note on Keep this page.
• Refusals (screen 5). Seven rows. Checked rows become won'ts.
• Leave whenever. The sitting's progress persists in VoiceDecisions, and returning resumes at the first unfinished exercise. Nothing is thrown away.
• Door II. Uploads are tagged by mode, with not sure as an option, and measured on add or remove as write evidence. Debouncing and the no-LLM rule make the cost zero.
• Door III. A pasted admired paragraph is measured as reach evidence in pencil. It is stored in Atticus only.
• populatedAt is set on the first evidence from any door, so the rail badge keeps its contract.
• Tests: sitting state and resume, adaptive-pair trigger, the refusals → won'ts mapping, ceiling copy states, and a failed note degrading to no note (never a paraphrase).

Deliverable: a writer can sit, bring pages, or bring an admired paragraph, and all three feed the portrait.

Phase K: The portrait and the hunch (UI)

• Portrait (screen 6):
  • core and register sections;
  • mode tabs with "not yet" labels;
  • dots and rings;
  • ink or pencil rules;
  • verdict bars (solid / thin / dotted, never color alone);
  • a range bar in "All";
  • the "Heard so far" line;
  • text equivalents on each row (§5.1).
• Verdict cells are editable from the portrait, and the writer's choice is always ink.
• Hunch ending (screen 7), the no-gap ending, Don't listen for this, and the portrait's That isn't me, which opens the §6.3 correction branches.
• Remove evidence / reset portrait (Principle 5). Both are behind a confirmation, since they destroy writer material.
• Tests: the presentation state for each mode tab, hunch and no-gap copy selection, and that reset clears evidence and decisions but leaves samples intact.

Deliverable: the sitting ends honestly, on a hunch or on "nothing yet."

Phase L: Listening, the mirror, and the fork

• Step-back event. CompositionViewModel posts draftSteppedBack(draftID, version) from sendToCritique(), Save, and Start new version. There is one path, and it never runs on view appearance.
• Draft learning. On step-back, measure the writer-authored sentences (ledger excluded) and write draft evidence tagged with the project's Mode. Skip projects marked "not in my voice" or answered "occasion's voice" (Phase M). Show "Learned from Thursday's draft" on the portrait.
• "Not in my voice" is a flag on Draft (LOW: a new column) that withdraws that draft's evidence.
• Listening. When the gap state is Listening and the draft's mode matches the hunch, evaluate the axis. Confirmation or disconfirmation updates the gap state (§6.2).
• Justified-hedge judgment. One model call per step-back, only while a gap is listening or threaded, over candidate hedged sentences. Each is classified justified or reflexive with a short reason ("the studies really do disagree"). Quotes pass the verifier. This feeds both the mirror's exclusions and the thread's "left alone" notes.
• Mirror (screen 8):
  • the median qualifying sentence, excluding justified hedges and quoted material;
  • the writer's own sentence on the left when one exists;
  • "One you chose. One you wrote." otherwise;
  • dotted hedges, See the others (n), and the side panel. It is shown as a sheet after the step-back completes. If dismissed, it waits behind a badge on the draft in the rail.
• Disconfirmation copy. The hunch is withdrawn and the portrait updates.
• Fork. All branches from §6.3, including "This draft isn't in my voice." The resulting state is written to VoiceDecisions.
• Tests: step-back fires once per action, the ledger is excluded from draft evidence, a mode mismatch doesn't trigger the mirror, median selection with exclusions, disconfirmation, every fork branch's resulting state, and occasion's-voice and not-in-my-voice drafts contributing nothing.

Deliverable: a hunch is confirmed or withdrawn on real writing, and the writer decides what it means.

Gate: the first Phase N item (Sarah's writer validation) runs here. Phase M starts only after it passes.

Phase M: Threads, Review, Discovery, and generation

• Editor capability (spec §8.7). Multiple simultaneous dotted-underline marks with superscript numbers, anchored by quote to a paragraph through EditorHighlightResolver. This is the riskiest UI work in the plan; see "Custom editor revert context." It is built as temporary attributes on the existing NSTextView, not a new editor.
• Thread section pinned above the margin tabs:
  • a header with Pause;
  • the first two instances per draft, then a count, with Show them anyway;
  • marks only on paragraphs the writer has moved past;
  • Keep mine / Say it first (adult), applied through the undoable path and recorded in the ledger;
  • the question form for student work;
  • justified-hedge notes, and "That's the voice you chose" when a paragraph shows the chosen voice. Kept sentences are stored and never re-marked.
• ***Say it first* generation.** One model call per mark. The prompt removes epistemic hedges only and keeps scope qualifiers. A deterministic check rejects any suggestion that drops a scope-list word.
• Review anchor. CritiqueService.Request gains voiceConstraints, rendered as a prompt block holding the active thread, Leave decisions for the project's mode, and won'ts. A post-parse filter drops any finding whose suggested text adds an epistemic hedge while a Hedged → Committed thread is active, or reintroduces a won't pattern. Both the Critique room and inline Composition critique pass it.
• Discovery question. "Your voice, or the occasion's?" is asked once per piece through the reflective-offer flow (MentorContextStore), and it sets or reads Modifier.voiceLoaded / .formallyConventionalized. An occasion's-voice answer pauses the thread for that piece and keeps the piece out of the portrait.
• Generation directive. Add a VoiceDirectiveBuilder built from the portrait's write marks for the project's mode, plus won'ts. It never uses reach marks (§7.4.3). It replaces project.seedText as writerProfile in DraftGenerator and the revision paths, in a cache_control: ephemeral block. It emits nothing when the portrait is empty. VoiceCeiling still runs.
• Drift detection (§7.2). A writer-authored paragraph whose detected axes fall outside the writer's band for this mode, on two or more axes, earns one margin note at step-back. This is new code: VoiceDrift remains disabled, and its header comment points here.
• Tests:
  • the thread marks two and then counts;
  • kept sentences are never re-marked;
  • pause stops marks;
  • Say it first lands in the ledger, can be undone, and never counts as progress;
  • a scope-dropping suggestion is rejected;
  • students get questions only;
  • the Critique filter drops a contradicting finding;
  • the directive uses write marks only and is empty with no portrait;
  • an occasion's-voice answer pauses the thread.

Deliverable: the writer's decisions reach every surface that comments on or writes their prose.

Phase N: Validation and documentation

• Writer validation, owner: Sarah. Do a real sitting, then two real drafts in one mode, and answer:
  • Is the portrait recognisable?
  • Does the hunch land?
  • Is the mirror's example fair?
  • Do the thread's suggestions keep your meaning? Unlike the 2026-08-27 plan, this is scheduled at the end of Phase L, not after everything is wired. If the mirror feels like surveillance, Phase M is built on sand.
• Calibrate the Phase H bands and the default verdict table against that writing and at least two other writers' samples.
• Test the bus premise and the reserve pairs with at least one other writer (spec §9).
• VoiceOver and keyboard pass over the sitting, the portrait, the mirror, and the thread.
• Blueprints:
  • domain-models.md: VoiceEvidence, VoiceDecisions, the ledger, VoiceSample.modeRaw, and the retired columns;
  • services.md: detectors, PortraitBuilder, and the step-back event;
  • ui-views.md and shared-views.md. Also correct the stale claim at RegisterScorer.swift:30 that "Phase D calibration confirmed" the weights.
• Resolve the // TODO(lens-shift) marker at ConceptViewModel.swift:1500, which replan.md gates on Voice Lab landing.

Migrations (per the migration safety protocol)

No HIGH-risk migration is planned.

Model calls and cost

Portrait computation, uploads, and draft learning make no model calls. This replaces the old plan's unbounded "rebuild on every sample change" analysis.

Open questions

• Concreteness norms licence (Phase H). If the list can't ship, Concrete/Abstract becomes pencil-only.
• Non-English writing. The detectors, lexicons, and RegisterScorer corpus are English. Non-English samples should produce "not heard" instead of wrong marks. Detect the language with NLLanguageRecognizer and skip the sample.
• Multiple devices. Evidence rows sync with the store. A sitting started on one Mac and resumed on another depends on the existing sync, and this plan adds nothing to it.
• Reserve-pair quality. Seven new pairs must meet rules the original ten broke four times. Testing them with another writer is in Phase N, and it matters.

References

• Docs/mockups/voice-lab-spec.md, Docs/mockups/Voice-Lab.html: the design
• Docs/reviews/2026-09-27-voice-lab-spec-review.html: spec review and code facts
• Atticus/Rooms/Composition/CompositionViewModel.swift: commitBuffer (:1270), applyRevision (:2394), sendToCritique (:1817), revision gates (:1949, :2589)
• Atticus/Rooms/Composition/CompositionEditorView.swift: single highlight (:317), non-undoable model push (:146)
• Atticus/Rooms/Critique/CritiqueService.swift: Request (:15), userMessage (:156)
• Atticus/Workspace/MentorContextStore.swift: reflective-offer flow (:155)
• Atticus/Synthesis/VoiceFingerprintBuilder.swift, VoiceDrift.swift, RegisterScorer.swift
• Atticus/Services/QuoteVerifier.swift: kept

Final review

Pros

• Deterministic where it counts. Every mark, every ink decision, and hunch selection are pure, testable functions. The model writes prose around the measurements and never makes them. That is a direct answer to the old plan's biggest risk: an LLM profile reading as horoscope copy.
• Prerequisites first. The provenance leak and the student rewrite gap are real bugs today. Fixing them first means no phase ever measures Atticus's own sentences as the writer's.
• The ledger is simple. Matching exact sentence text survives every edit shape, and releasing a sentence the moment the writer changes it matches the spec's "own means typed by the writer."
• Bounded cost. Model calls happen only on explicit writer actions, and each is capped.
• Validation moves earlier. Sarah's check happens before the thread and Critique wiring, not after.
• No destructive migration.

Cons and where the plan may be inadequate

• Calibration is guesswork until Phase N. The bands that turn "0.8 hedges per sentence" into a dot position are invented constants. A miscalibrated band makes the portrait wrong in a confident-looking way. Ink rules reduce the damage without removing it.
• Lexicon detectors are crude. A hedge lexicon misses irony, and contraction rate misreads dialogue in fiction. Narrative drafts with heavy dialogue will skew Formal/Conversational. Excluding quoted dialogue from measurement helps, but it is not in the phases above.
• The editor work is the schedule risk. Multiple dotted marks and undoable replacement in an NSTextView that already had one custom-editor attempt reverted.
• Phase M is large. Threads, the Review anchor, the Discovery question, the generation directive, and drift are five features. They can ship separately, and the phase may need splitting at approval.
• Most of the plan hangs on the mirror. If Phase N finds the mirror unfair, the thread has nothing to stand on.
• Retirement deletes tested work. It is defensible, and it still costs about 900 lines built a month ago.

Adjustments worth considering

1. Exclude quoted dialogue from measurement in Phase H. This is cheap and removes the worst fiction skew. I'd add it at approval.
2. Split Phase M into M1 (threads + Review anchor) and M2 (Discovery question, generation directive, drift). M1 completes the loop the sitting promises. M2 extends it.
3. Ship Phases G–K as a first release. The sitting and portrait stand on their own, and Phase G fixes bugs regardless.

Confidence: 74 / 100

I'm confident in the sequencing, the ledger, deterministic measurement, the retirement call, and keeping migrations additive. The doubt sits in three empirical places: whether lexicon detectors plus provisional bands produce a portrait the writer recognises; whether the mirror's median-instance rule reads as fair; and how much the editor work costs. Phase N answers the first two, and it is placed early enough that a bad answer stops the plan before Phase M.