[PROPOSAL] PENDING-119 + PENDING-120: (e) is built, its wiring is not placed

119 — REVIEWED-101 condition 6 sends (e)'s consumer to ~/dotfiles/scripts/ on
cross-repo reasoning, while the same ruling's If-AUTHORIZED line says (e) needs no
cross-repo enumeration. The tension only became live because (e) was built as a
delegation to the gate that already enforced §1.1; a fresh sha-comparing script
would have made condition 6 straightforwardly right. Carries the finding that no
fleet suite validates live binding.

120 — the trigger's pathspec is corpus/ only, so engine/ and tests/ changes run no
suite. Demonstrated by the commit that built (e), which is also the first real
non-probe commit since the trigger landed: the hook ran and no declared check fired.

Both filed rather than fixed, on the steward's direction. PENDING-117 gains a
pointer-only AMENDMENT 2 so the thread is navigable from the ruled item.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A35wiD55yRHj5U1ECZAX4t

PENDING.md

@@ -1632,6 +1632,20 @@ This is harmless today only because voice ⟺ source: measured, **max distinct v
 
 ---
 
+### AMENDMENT 2 — 2026-08-08, after REVIEWED-101 was placed and (e) was built
+
+*A pointer only. Nothing above is altered: the ruling stands as placed, and this records where the thread continued so a reader arriving here is not left at a dead end.*
+
+**(e)'s engine half is BUILT and standing** — studium-engine `eecc8bb`, `engine/ingest_gate.py --check-only`, suite 24 → 41 checks, fleet 221/221. It **delegates** to the gate that already enforced §1.1 rather than reimplementing it, which is what raised the placement question below.
+
+**(e)'s WIRING is unplaced and is now PENDING-119.** Condition 6 sends the consumer to `~/dotfiles/scripts/` on cross-repo reasoning; this ruling's own If-AUTHORIZED line says (e) *"needs no cross-repo enumeration."* Filed rather than resolved, on the steward's direction.
+
+**One finding here belongs to the record even if 119 is rejected:** **no fleet suite validates live binding** — all six gate invocations in `tests/test_ingest_gate.py` are synthetic `tmp` corpora, and `test_navigate.py:95` checks that a span *carries* `source_sha256`, not that it matches. The fleet's green was never evidence the corpus was bound. That is larger than this item described and is the gap (e) actually closes.
+
+**A separate gap surfaced by building this: PENDING-120** — the `.precommit-triggers` pathspec is `corpus/` only, so `engine/` and `tests/` changes run no suite. Demonstrated by `eecc8bb` itself.
+
+---
+
 ## PENDING-118 — The deferred-decision checker is structurally blind to every archived deferral
 
 **Date:** 2026-08-08
@@ -1662,3 +1676,61 @@ This is harmless today only because voice ⟺ source: measured, **max distinct v
 **Awaiting:** Steward authorization.
 
 ---
+
+## PENDING-119 — REVIEWED-101 condition 6 placed (e)'s consumer in dotfiles, on reasoning the same ruling says (e) does not engage
+
+**Date:** 2026-08-08
+**Tag:** [PROPOSAL]
+**Related:** REVIEWED-101 conditions 4 + 6 · PENDING-117 §D/§E · REVIEWED-100 (the repo-blind global hook) · studium-engine `eecc8bb` (the engine-side half, built and green).
+
+**Summary.** (e)'s engine half is built, tested both directions, and standing; its **wiring** is deliberately unplaced, because condition 6's stated reasoning is about a cross-repo invariant and the same ruling says (e) is not one.
+
+**The tension, both texts quoted rather than paraphrased.** Condition 6: *"Placement: ~/dotfiles/scripts/. A cross-repo invariant is owned by neither repo; putting it in either makes that repo the authority over a relationship it is only one half of."* The If-AUTHORIZED line, four lines later: *"The spec amendment gates (a), not (e): (e) reads the engine's own manifest and sidecars and needs no cross-repo enumeration."* Both were placed in one ruling. Read flat, condition 6 covers the whole item; read against the second sentence, its reasoning reaches (a) and (c) — which genuinely span two repos — and not (e), which does not.
+
+**New evidence, unavailable when the ruling was written.** `engine/ingest_gate.py` **already enforces §1.1 on both surfaces (e) names** — manifest `sha256` at L128–131, sidecar `source_sha256` at L150–153. So (e) was built as a **delegation, not a reimplementation** (`eecc8bb`), and its consumer is now a single command rather than an algorithm. A dotfiles wrapper around one command is therefore either a no-op hop, or it plants engine knowledge (`engine/ingest_gate.py`, `--check-only`) in exactly the global layer REVIEWED-100 worked to keep repo-blind. Had (e) been written as a fresh sha-comparing script, condition 6 would have been straightforwardly right — the placement question only became live *because* the duplication was avoided.
+
+**A second measured finding, filed here because it is why the delegation matters.** **No fleet suite validates live binding.** Censused all seven: only `tests/test_ingest_gate.py` invokes the gate, and all six invocations build a synthetic corpus under `tmp`; `tests/test_navigate.py:95` asserts a span *carries* `source_sha256`, which is **presence, not correctness**. The fleet's green has never been evidence that the corpus is bound — it is evidence that the gate works on fixtures. This is the gap (e) closes, and it is larger than PENDING-117 described.
+
+**Options.**
+- **(i) One line in the engine's `.precommit-triggers`:** `. | python3 engine/ingest_gate.py --check-only`. Zero new files; the global hook stays repo-blind; the repo declares its own check — the declared-data-plus-thin-consumer pattern condition 6 itself cites approvingly. Reads condition 6 as scoped to (a) and (c).
+- **(ii) `~/dotfiles/scripts/check-source-binding.sh`,** invoked from `.precommit-triggers`. Honours condition 6's letter; pays for it in repo-blindness, and the script's body is one `exec`.
+- **(iii) Defer (e)'s wiring until (a) is built,** then give both one shared consumer. ⚠ That consumer would have to name the surface list **before** the spec amendment defines it — hardcoding the enumeration in a consumer, which is precisely what condition 1 forbids.
+
+**Recommendation: (i)**, on the ruling's own distinction rather than on convenience. The steward has instead directed that it be filed, which is why this exists rather than a commit.
+
+**⚠ What this does not establish.** Nothing here argues (a) or (c) should leave `~/dotfiles/scripts/` — condition 6's reasoning holds for them exactly as written, and (a) is the cross-repo invariant it was written about. This asks only whether **(e)**, which the ruling itself sets apart, falls inside its scope. It also does not establish that (i) is safe to run unconditionally on every commit at scale: measured today at **0.218 s over 14 sources**, which is a burst-sized corpus, not a lifetime one.
+
+**Files affected:** `~/_Dev/studium-engine/.precommit-triggers` (one line) **or** a new `~/dotfiles/scripts/check-source-binding.sh`. The built engine mode is unaffected either way.
+
+**Awaiting:** Steward authorization.
+
+---
+
+## PENDING-120 — The fleet trigger covers `corpus/` but not the engine code the fleet exists to test
+
+**Date:** 2026-08-08
+**Tag:** [HARDENING]
+**Related:** REVIEWED-100 / PENDING-116 · `~/_Dev/studium-engine/.precommit-triggers` · studium-engine `eecc8bb` (the demonstrating instance).
+
+**Summary.** `.precommit-triggers` declares `corpus/ | scripts/run-fleet.sh`. A commit touching `engine/` or `tests/` runs **no suite**, so the fleet is not run on a large class of changes able to redden it.
+
+**Demonstrated, not reasoned.** Commit `eecc8bb` changed `engine/ingest_gate.py` and `tests/test_ingest_gate.py` — the gate and its own test floor — and the hook printed only *"Running pre-commit checks…"*, with **no** *"Staged change touches […] — running declared check"* line. That is the **first real, non-probe commit since the trigger landed**, and it ran nothing. (It also answers this session's inherited literal question in the negative for this class: the gate has still never fired outside its own acceptance probes.)
+
+**Rationale.** PENDING-116's whole argument was that *naming* a risk is not *mechanizing* a check on it. The mechanism then landed against the **instance** that had occurred — a sidecar re-split breaking a hardcoded node id, which lives under `corpus/` — rather than against its **class**: *a staged change that can turn the fleet red*. `engine/` is the code the fleet exists to test; `tests/` is the fleet itself. Both are at least as capable of reddening it as `corpus/` is, and neither is watched. ⚠ **Scope honesty:** REVIEWED-100 authorized the *mechanism* (option (b), repo-declared trigger); it did **not** rule the pathspec, which was my implementation choice. So this is arguably in-scope repair rather than an amendment — it is filed rather than fixed because the steward directed it be filed separately.
+
+**Options.**
+- **(a) Widen to the code the fleet tests:** `corpus/ engine/ tests/ scripts/run-fleet.sh | scripts/run-fleet.sh`. Cost: ~2 s on engine and test commits.
+- **(b) Widen to everything** (`.`). Simplest to state, but it runs the fleet on documentation-only commits and so destroys the *"a docs-only commit ran nothing"* half of REVIEWED-100's acceptance — the half that proves the trigger discriminates.
+- **(c) Leave it; rely on discipline.** Refuted by PENDING-116's own evidence, and now by `eecc8bb`.
+
+**Recommendation: (a).** It restores the pathspec to the class the mechanism was authorized for, and it preserves both halves of the existing acceptance test.
+
+**Check that it worked — both directions required.** A staged `engine/` change that reddens a suite must refuse the commit; a docs-only commit must still run nothing. Neither may be a synthetic probe if a real one is available — an induced-red in `engine/` is available cheaply and is the honest fixture.
+
+**⚠ What this does not establish.** `--no-verify` still steps over it: tripwire, not boundary. And widening the pathspec does **not** make the suites better at seeing binding drift — PENDING-119 records that none of them check it at all, so a widened trigger would run seven green suites over a corpus whose bindings nothing verified.
+
+**Files affected:** `~/_Dev/studium-engine/.precommit-triggers` (one line).
+
+**Awaiting:** Steward authorization.
+
+---

claude/memory/session-ledger-2026-08-08.md

@@ -5,7 +5,7 @@ metadata:
   node_type: memory
   type: feedback
   originSessionId: 7d08dad4-626a-484c-870b-8f1a9674db7a
-  modified: 2026-08-08T11:54:21.195Z
+  modified: 2026-08-08T13:30:54.198Z
 ---
 
 # Session Ledger — 2026-08-08
@@ -93,6 +93,37 @@ metadata:
   from the start, which is what caught the probe's own anchor bug) · **0 duplicating
   something already banked**.
 
+### ⎯ SESSION 3 (context cleared ~15:25; same day, same ledger) ⎯
+
+- **T~15:3x — the day's pattern produced instances SIX and SEVEN inside the wake itself,
+  both at the error-vs-empty seam.**
+  (6) Answering the literal question, I ran `git log c86b825..HEAD -- corpus/` *inside
+  studium-engine*. `c86b825` is a **dotfiles** commit: the range died `fatal: Needed a
+  single revision`, and I read the empty stdout as "no commit touched the trigger path."
+  The conclusion happened to be true; the instrument was invalid. Caught **only** because
+  remedy (a) — state the check's vocabulary alongside its result — forced me to name the
+  range. Re-ran from `088a171` (the in-repo commit): result stands, now on a valid range.
+  (7) `ls <contamination-problem.md> && echo present` returned exit 2, no output. I was one
+  step from logging "the doc `~/CLAUDE.md` cites is absent" as a drift finding the checker
+  had missed. `find` located it at **exactly** the cited path.
+  **Unifying mechanism, sharper than yesterday's:** a *failed* command's empty output read
+  as a substantive *empty result*. Absence-of-output is not absence-of-thing. Five errors
+  yesterday reduced the output before looking at it; these two never had an output to
+  reduce and I treated the void as data. Instance (7) is the more dangerous kind — it would
+  have produced a **false positive against the governance record**, not a false negative.
+
+- **T~15:3x — literal question answered from the record, not introspection.** The
+  `.precommit-triggers` gate has **not** fired on any real commit: since `088a171`,
+  studium-engine has one commit (`4ec0ba2`, docs) and **zero** touching the declared
+  pathspec `corpus/ | scripts/run-fleet.sh`. This is silence-from-no-opportunity, not
+  silence-from-a-broken-path — the distinction the *silent net is uninformative* entry
+  requires be made before either reading is taken. The `--no-verify` half remains untested.
+
+- **T~15:3x — substrate-checked the resumption point rather than inheriting it.** Item (e)
+  verified **unbuilt**: `~/dotfiles/scripts/` does not exist; no `sha256`/`source_sha` match
+  anywhere under `~/dotfiles/scripts/` or `~/dotfiles/git/hooks/`. Global hook present and
+  active (`core.hooksPath = ~/dotfiles/git/hooks`, pre-commit 5.2k, 8 Aug 13:45).
+
 ## What held
 
 - The inherited prospective-control question (1 of 12) is carried forward as a live counter,