session 2026-09-09 night: skill-harvest proposal C + B's second instance

C: a detector for controls carrying no fail-arm. Earned twice tonight — the
co_names form cited in REVIEWED-137 §3 is inadequate (passes a why-string leak,
which is the leak that actually existed), and mutation caught a re-planted
needle the green selftest could not.

B fired again: eight instances in one day, and the daybook format now lives in
three places rather than the two §7.5 predicted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BsN7nKHjKBsn5bfNRRCNmo

claude/memory/skill-harvest-register.md

@@ -668,3 +668,44 @@ differently, each time it runs.
 **B — why the cue, not the executor.** Followed literally four times today; the structure stayed empty until §7.5. Not a recall failure — the instruction and the artifact disagree, and the instruction is the thing that fires.
 
 **NOT filed, and why.** *"Leak-gate any working copy before committing, when the original is under a deletion order"* is a real discipline earned today (it stopped a verbatim corpus copy entering git permanently). It belongs on the **verification ladder**, which is **FROZEN under REVIEWED-123** — no additions from any source, whatever its authorization, until the trial is graded. It therefore **queues in PENDING-141's owed-entries list** and is not added. Recorded explicitly because a discipline this load-bearing is exactly the kind someone adds believing the freeze cannot have meant *this* one.
+
+## Proposed 2026-09-09 night — from the verdicts sitting
+
+| # | Proposal | Kind | Firing moment (declared) | Status |
+|---|---|---|---|---|
+| C | **A detector for controls that carry no fail-arm.** The Tarbuckle family already uses a clean convention — `X` asserts, `Xn`/`Xnn` proves the predicate can fail. A checker can enumerate every `ck("...")` in the governed scripts and report those with no paired arm. | patch (script) | **MECHANICAL** — runs in `governance-drift-check.py` or pre-commit; fires without anyone remembering. | PROPOSED |
+
+**C — earned tonight, twice, and the second one is the argument.** The jurist required that the
+control proposed in REVIEWED-137 §3 be *shown to fail* before the design was trusted. Run as a probe:
+**the form I had proposed — the `co_names` idiom copied from `tarbuckle-body.py:256` — is
+INADEQUATE.** It catches a parameter obviously named `line` and passes a parameter named `why`
+carrying the reason string, **which is the leak that actually existed** (`echoes_soul()` returns a
+literal run from the suppressed line). A control I had cited as precedent, in a signed judgment,
+would have certified the very defect it was meant to prevent.
+
+Then the same discipline caught a second thing the selftest could not: the repaired seam control
+passed 17/17 while its own explanatory comment had re-planted the needle in the file being searched.
+**Mutation caught it; the green suite did not.**
+
+⚠ **Why a detector and not a discipline.** Both catches came from a hand-run mutation that I nearly
+did not run, on a question nobody would have asked if the jurist had not demanded it. The routing
+table sends exactly this profile — cheap check, silent failure, depends on the executor *noticing* —
+to a mechanism. **A "remember to mutation-test your controls" ladder entry would retrieve at ~10%.**
+
+⚠ **Bound, stated rather than discovered:** a fail-arm detector checks that an arm *exists*, not that
+it is *sound*. `A8n the predicate can fail` and my removed third `A10` arm both existed; one was
+sound and one did not implement its label. **This finds absence, never vacuity** — the harder half is
+untouched, and PENDING-179 AMENDMENT 2's two vacuity classes remain the open question.
+
+**SECOND INSTANCE OF B, recorded rather than re-filed.** B (reconcile `daybook-cue.py` with the
+skeleton) was proposed this morning from four instances. It fired again tonight: the cue prompted
+narrative `##` headings four more times, and `/wrap-up` §7.5 had to reconcile the evening's work back
+into the five canonical sections at wrap — from a session-long context, which is the reconstruction
+the log exists to prevent. **Eight instances in one day.** ⚠ And the format now lives in **three**
+places, not two — the skeleton, §7.5's list, and the cue's message. §7.5 predicted the drift for two.
+
+**NOT filed, and why.** *"The unit of your check must match the unit of your claim"* is the session's
+pulling thread and fired three times in my own verification tonight. It has **no declarable firing
+moment** — it applies whenever a predicate is written, which is a noticing condition, and the routing
+table is explicit that such a proposal is documentation and must say so on its face. **It belongs in
+the session record and the KG drift-pattern, where it now is, and not here as though it will fire.**