truf-server/openspec/changes/retire-zero-alive-keywords/tasks.md

1. Canonical Rejection Policy

• 1.1 Add strict machine-checkable rejected-query evidence validation with active/rejected disjointness and sentinel protection.
• 1.2 Record the approved 38 source/query pairs and evidence in canonical configuration while removing them from active rotations.
• 1.3 Make reviewed stale-row planning select only exact registered rejected pairs when a rejection registry is present.

2. Verification

• 2.1 Add focused unit tests for evidence validation, exact source-specific retention, malformed evidence, overlap, and sentinel rejection.
• 2.2 Extend PostgreSQL policy-hold tests for multi-source exact rejected selection, fences, idempotency, history preservation, and reactivation.
• 2.3 Run focused configuration, migration, queue, integration, and strict OpenSpec validation.

3. Reviewed Queue Transition

• 3.1 Stop maintenance PostgreSQL before editing authority-covered configuration, restart it afterward, and rerun the aggregate evidence cutoff.
• 3.2 Generate and review bounded privacy-safe cold manifests for every affected source/platform scope.
• 3.3 Apply the exact manifests with sources stopped and verify counts, append-only policy events, unclaimability, and unchanged history.

4. Deployment

• 4.1 Cleanly stop maintenance PostgreSQL and start the canonical runtime with the reduced rotations.
• 4.2 Verify authenticated database/pipeline/source health, rejected-pair absence, retained query loading, and normal queue movement.