Thais crazy me and yourself w like linked that couple days. What i found has been that the data id perfect when you have made enough transformations that it almost becomes so deterministic it more of a compiled rust program. ALWAYS look to the 'negative adjacent possible -- if something is fixed it pops a neighbor into motion. IF something is in motion treat it like a cone. Take random forest and and treat the most scattered of point and make a circumference and fix the group into a point -> order is chaos in the land of random things. Strong work — receipt discipline pointed at the one surface most specs leave ungoverned: the training step itself. The reframe ("a corpus is a claim about what the world did and why it's admissible," not "data") is the right spine, and §8 being load-bearing rather than an afterthought tells me you know where the danger actually lives.
Two places I'd push it, from a stack I've been building on parallel lines — sovereignty-first runtime, everything content-addressed and forward-chained:

1. Extraction and execution are still two objects here, and that's where §8 leaks.
   Your corpus is a projection of receipts (157/158) through the extraction contract. Training is a separate attested event. So the quiet interference vector isn't touching canon — it's the extraction contract silently reweighting what gets projected. "Downstream projection only" still shapes the next generation through the deploy gate, canon untouched. You govern extraction-surface changes (109/118 + verification receipt), but nothing binds the reweighting to the non-interference attestation. Both can finalize without either asking whether the projection biased the learned substrate.
   The patch is another receipt. The dissolve is: stop projecting. If the model trains on execution traces and you catch the trace at the token/execution boundary — content-addressed, byte-identical to what ran — then the receipt and the trainable artifact are the same object. No extraction step to reweight, because there's no extraction. The trace isn't a description of what happened; it is what happened. That collapses your worst failure mode instead of papering it with more provenance.
2. Your trust root is mutable and central, which reopens the door you're closing.
   Every artifact binds trust_anchor_set_id + digest. Fail-closed guards against poison/leak/reality-rewrite — but it assumes the anchor set is sound and that whoever holds it can't revoke or reset to rewrite admissibility after the fact. That's the exact third-party-reset surface the whole posture exists to eliminate, just relocated one layer up. If admissibility can be retroactively rewritten by mutating the anchor set, "FINALIZED" isn't final.
   Forward-chain it instead: derive each receipt from its predecessor off a root key, anchor the chain externally (witness layer / external commit), and admissibility becomes verifiable without trusting — or asking — a central authority that can change its mind. Same guarantee, no revocable root.
   Neither breaks 167. It's the same instinct one turn further: don't govern the copy — make the original and the trainable thing one content-addressed object — and don't root trust in something that can be reset under you.
   Would read whatever's next in the sequence.