diff --git a/scripts/governance-drift-check.py b/scripts/governance-drift-check.py index 5447545..e830b62 100755 --- a/scripts/governance-drift-check.py +++ b/scripts/governance-drift-check.py @@ -232,7 +232,26 @@ PENDING_ARCHIVE_MD = HOME / "dotfiles" / "PENDING-archive.md" MARKERS = ("AMENDMENT", "ADDENDUM") RE_MARKER_TOKEN = re.compile(r"\b(?:AMENDMENT|ADDENDUM)\b") RE_HEAD_LINE = re.compile(r"^#{2,3}\s+(.*)$", re.M) -RE_ID = re.compile(r"^((?:PENDING|REVIEWED|COMPLETED)\S*)\s*[—–-]\s*(.*)$") +# ⚠ WIDENED 2026-09-06. The old pattern was +# ^((?:PENDING|REVIEWED|COMPLETED)\S*)\s*[—–-]\s*(.*)$ +# and on `## REVIEWED-131 (PENDING-172) — …` the greedy \S* BACKTRACKED until the hyphen +# INSIDE `REVIEWED-131` served as the separator, yielding ident `REVIEWED` — not +# `REVIEWED-131`. No un-amended `REVIEWED-131` original was then found, so the register +# check reported that REVIEWED-131's amendment had REPLACED the record it amends. It had +# not. A false alarm standing in the register is the disarmed-tripwire hazard PENDING-139 +# measured: red-on-absent trains the reader to discount red. +# +# THE SAME PARENTHETICAL HEADER SHAPE THAT BROKE `ruled_pendings` IN wake-digest.py ON +# 2026-09-05, in a second instrument, found the next day. Both failures ran toward hiding +# a record that exists. Fixed as one act with that widening, per the jurist. +# +# The id is now an explicit token and the trailing parenthetical is consumed rather than +# collided with. Enumerated over all 549 headers in the three registers before landing +# (REVIEWED-132 condition 3 — enumerate, do not count): exactly THREE classifications +# change, all of them parenthetical rulings recovering their true ident — +# REVIEWED-131, -132, -133. Nothing else in the record moves. +RE_ID = re.compile( + r"^((?:PENDING|REVIEWED|COMPLETED)(?:-\S+)?)(?:\s*\([^)]*\))?\s*[—–-]\s*(.*)$") RE_INBODY = re.compile(r"^\*\*(?:AMENDMENT|ADDENDUM)\b.*$", re.M) RE_AMENDS = re.compile(r"\*\*Amends:\*\*\s*((?:PENDING|REVIEWED|COMPLETED)-\S+?)[\s,.(]") @@ -342,6 +361,27 @@ control("a lower-case 'amendment' in a TITLE stays an ORIGINAL [must-not-flag: control("an UPPER-CASE marker mid-title is still excluded from originals [must-detect]", "compound" in register_scan( {"t": "## PENDING-164 — BUILD RECORD + AMENDMENT 1 result\n"})[2]) +# --- RE_ID parenthetical widening, 2026-09-06. Paired: the form is read, AND the forms +# that must not move are held. The mangled-ident case is stated as its own control +# because "ident is wrong" and "header is unseen" fail identically downstream. +control("a PARENTHETICAL ruling header yields its FULL ident [must-detect: the " + "REVIEWED-131 false positive]", + RE_ID.match("REVIEWED-131 (PENDING-172) — A version upgrade").group(1) + == "REVIEWED-131") +control("that header does NOT yield the bare family name [negative control — the exact " + "old failure, which looked like a clean parse]", + RE_ID.match("REVIEWED-131 (PENDING-172) — x").group(1) != "REVIEWED") +control("the ordinary em-dash form is unchanged [regression]", + RE_ID.match("REVIEWED-121 — PENDING-134 — The whose-proposition test").group(1) + == "REVIEWED-121") +control("a NON-NUMERIC family header still parses [regression: `## PENDING — ICP-19`]", + RE_ID.match("PENDING — ICP-19 Remit Expansion").group(1) == "PENDING") +control("an id+marker header still classifies as id+marker [regression]", + _classify("REVIEWED-135 — AMENDMENT 1 — §8's dependency")[:2] + == ("id+marker", "REVIEWED-135")) +control("a parenthetical header carrying a MARKER is still caught [must-detect: the " + "widening must not smuggle an amendment into originals]", + _classify("REVIEWED-131 (PENDING-172) — AMENDMENT 1: x")[0] == "id+marker") control("PENDING-side registers are actually read", "PENDING.md" in _TEXTS) control("every form present in the record is covered by a control", not reg_uncovered) control("register file is reachable", REVIEWED_MD.exists())