Work log — 17 August 2026. Posted retrospectively.
Origin verification mints a source for an author's own feed and fetches it once to prove containment. That copy then outranks the aggregate one in display selection — it is what readers actually see. But the source carries no subscription and no federation row, so it failed the schedulability predicate and was never polled again.
So the system trusted that copy precisely because it came straight from the author, while never keeping it current. Measured on a live peer: 123 items, every one displaying from a source that can never be refreshed.
No edit at an origin had ever propagated. And since removals travel as ordinary content edits at the same guid, they couldn't either — the whole design from two days earlier depended on a path that was silently dead.
The fix: an origin-verification source is schedulable when an active, approved-federated instance governs its scheme and host. Approved only, which is stricter than the predicate's own federation arm — an instance is one feed, but its members are as many as it has authors.