[FIX] L1 pin root-caused and cleared; S-series closed; instrument census

mindfabric-00 had been event-loop-pinned for 6+ days (100% CPU, /health silent).
Profile + CDP inspector named two hot paths, both from runTemporalPipeline:

  checkForCycle -> getCausalEdgesFromSqlite   99.8% of samples
  tryExtendChains -> getChainsContainingSeq   now dominant (json_each scan)

Cause of the first: ANALYZE had never been run, so SQLite preferred a boolean
index (idx_caused_tombstoned, matching ~all 836k edges) over idx_caused_from.
ANALYZE across 15 module DBs flipped the plan; 6.4x on a microbenchmark and
99.8% -> 6.0% in the live profile. /health went from silent to 200 in 0.13s.

B1.1's fan-out cap is IMPLEMENTED AND WORKING (today: max in-degree exactly 20,
zero violations; pre-23-June: max 629, avg 67.6). The defect is data, not code —
836k edges / 813k chains minted under ungoverned fan-out before the fix landed.
Repair run: derived stores wiped, logchain preserved, replay in flight.

S-series closed (jurist had already ruled all of Q1-Q5 on 2026-05-18):
  S6/S7/S9 implemented (Symmetria §3 flags, `suspend` outcome, wrap-up §8 tenses)
  S2 rebuilt as [FIX] — wake-digest unwrapped-session detector, discrimination-
    gated on real sessions (11 wrapped / 2 unwrapped)
  S4/S5 withdrawn with MemPalace (steward ruling)
Dormant legacy dispositioned: PENDING-4/5/11/12, CD-03, ICP-19 duplicate.
Open authorization items 22 -> 10.

Census 01: which instruments have no real negative instance. Finding — the
governance drift-check has 3 of 5 families inert against the current CLAUDE.md,
and 71 of 75 verification-ladder entries are cited nowhere outside the ladder.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WuMjg3ipEVa3n8CoSzoyvc

scripts/wake-digest.py

@@ -132,6 +132,82 @@ def sec_pause():
     return newest, span
 
 
+def wrap_records():
+    """Wrap records only — session-ledger-*.md is a Symmetria artifact, not a wrap."""
+    return [os.path.join(MEM, f) for f in os.listdir(MEM)
+            if f.startswith("session-") and not f.startswith("session-ledger-")]
+
+
+def transcript_span(path):
+    """
+    A session's true span, from the timestamps INSIDE the transcript — never mtime.
+    mtime says when the file was last touched; it cannot say when the session ran.
+    Returns (first_epoch, last_epoch), or (None, None) if unreadable.
+    """
+    first = last = None
+    try:
+        with open(path, errors="ignore") as f:
+            for line in f:
+                m = re.search(r'"timestamp"\s*:\s*"([0-9T:\-]{19})', line)
+                if m:
+                    if first is None:
+                        first = m.group(1)
+                    last = m.group(1)
+    except OSError:
+        return None, None
+
+    def epoch(s):
+        try:
+            return time.mktime(time.strptime(s, "%Y-%m-%dT%H:%M:%S"))
+        except (ValueError, OverflowError):
+            return None
+    return epoch(first), epoch(last)
+
+
+def wrap_inside(span, wrap_mtimes, lead=300, lag=900):
+    """Did a wrap record get written inside this session's span?"""
+    a, b = span
+    if a is None or b is None:
+        return None                      # unreadable — not the same as 'no wrap'
+    return any(a - lead <= m <= b + lag for m in wrap_mtimes)
+
+
+def sec_unwrapped():
+    """
+    PENDING-S2's obligation, rebuilt on our own substrate.
+
+    A session that ends without /wrap-up writes no memory file, so `Last wrap`
+    — computed from mtime — silently reports the session BEFORE it, and the
+    thread below is inherited from the wrong session. The original proposal
+    detected this via a MemPalace Stop hook; that hook is retired, but the
+    failure it named is live. The transcripts are the only witness that a
+    session ran at all.
+    """
+    proj = os.path.dirname(os.path.join(HOME, ".claude", "projects",
+                                        "-Users-davidglidden", "memory"))
+    try:
+        tx = [os.path.join(proj, f) for f in os.listdir(proj) if f.endswith(".jsonl")]
+    except OSError:
+        return None
+    now = time.time()
+    # The current session's transcript is being appended right now; the previous
+    # session's is the newest one that has gone quiet.
+    prior = [p for p in tx if now - os.path.getmtime(p) > 60]
+    if not prior:
+        return None
+    last = max(prior, key=os.path.getmtime)
+    verdict = wrap_inside(transcript_span(last),
+                          [os.path.getmtime(w) for w in wrap_records()])
+    if verdict is None or verdict:
+        return None
+    ended = time.strftime("%b %d %H:%M", time.localtime(os.path.getmtime(last)))
+    return (f"⚠ PREVIOUS SESSION DID NOT WRAP (ended ~{ended}). The thread and "
+            f"question below are inherited from an OLDER session — treat them as "
+            f"possibly stale, and expect no record of what that session did.\n"
+            f"  Not established: whether that session did work worth keeping. The "
+            f"transcript is on disk and can be read if the gap matters.")
+
+
 def ruled_pendings(reviewed_text):
     """
     The set of PENDING ids that rulings actually DISPOSE OF.
@@ -539,6 +615,28 @@ def selftest():
         not is_homed(os.path.join(MAPS_DIR, "README.md"), MAPS_DIR))
     chk("is_homed FALSE for a symlink pointing OUTSIDE maps/",
         not is_homed(os.path.join(HOME, ".claude"), MAPS_DIR))
+    print("\nunwrapped-session detector  [PENDING-S2's obligation, our substrate]:")
+    chk("wrap_inside TRUE when a wrap falls inside the span",
+        wrap_inside((1000.0, 2000.0), [1500.0]))
+    chk("wrap_inside TRUE for a wrap just after the last write  [wraps land near the end]",
+        wrap_inside((1000.0, 2000.0), [2400.0]))
+    chk("wrap_inside FALSE when every wrap is outside  [negative control]",
+        not wrap_inside((1000.0, 2000.0), [500.0, 5000.0]))
+    chk("wrap_inside returns None on an unreadable span  [must NOT read as 'no wrap']",
+        wrap_inside((None, None), [1500.0]) is None)
+    # Discrimination on REAL sessions: the detector must return BOTH verdicts over
+    # the actual transcript history. One verdict everywhere = it discriminates nothing.
+    _proj = os.path.dirname(MEM)
+    _tx = sorted((os.path.join(_proj, f) for f in os.listdir(_proj)
+                  if f.endswith(".jsonl")), key=os.path.getmtime)[-14:-1]
+    _wm = [os.path.getmtime(w) for w in wrap_records()]
+    _v = [wrap_inside(transcript_span(p), _wm) for p in _tx]
+    chk(f"real sessions read as WRAPPED  [{sum(1 for x in _v if x is True)} of {len(_v)}]",
+        any(x is True for x in _v))
+    chk(f"real sessions read as UNWRAPPED  [{sum(1 for x in _v if x is False)} of {len(_v)}]"
+        "  — the negative instance; without one the detector is unproven",
+        any(x is False for x in _v))
+
     print("\nlive substrate:")
     chk("PENDING.md readable", read(PENDING) is not None)
     chk("REVIEWED.md readable", read(REVIEWED) is not None)
@@ -557,6 +655,9 @@ def main():
 
     o = ["=== WAKE DIGEST (computed now — not a stored snapshot) ==="]
     o.append(f"Last wrap: {span} ago  ({newest})" if span else "Last wrap: UNKNOWN")
+    unwrapped = sec_unwrapped()
+    if unwrapped:
+        o.append(unwrapped)
     if th:
         o.append(f"\nPULLING THREAD — {th}")
     if q: