Session 2026-08-24: grounding gates ruled, daybook rule changed, two censuses run

PENDING-95: Amendment 2 (jurist ruling — (a) rejected, (d) discharged, (b)/(c)
deferred) plus the (b)/(c) census that discharges the deferral's condition.
60 guarded / 32 marked (record said 59/31); date 75%, sections 97%, quoting 47%.
Date broadly present => the jurist's cheaper third form is the live option.

PENDING-156 opened (kind (c): mechanisms off the path the work takes) and its
option (b) census run the same session. PENDING-109 prior confirmed by direct
read. PENDING-89: two docket entries, one same-direction miss and one
cross-direction catch, filed the same day and at the same speed.

Mechanisms: daybook-cue.py rewritten on steward ruling — the daily note must be
appended to until end of day, so the trigger is staleness, not note size, and the
matcher now includes Bash (it had never fired once). daybook-ensure.py and
/wrap-up 7.5 gain a standing Corrections slot per REVIEWED-126.
governance-mcp.py gains two read-only keys so the jurist can read the artifacts
it rules on; the doctrine that read-surface changes should arrive as rulings is
adopted, and the next key is proposed rather than added.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JQKeKY9T9d95KpvHwwok8T

PENDING.md

@@ -760,6 +760,68 @@ Measured against the register itself before acting. Four corrections; the item's
 **Files affected:** none yet; a measurement, not a change. Output would be a dated record beside the doctrine package.
 **Awaiting:** Steward direction on (a)/(b)/(c), and on whether the executor is the right party to run a measurement of its own oversight at all — the jurist is no more independent here, so this may be steward-only work.
 
+### Docket entry 2026-08-24 (second, later) — a CROSS-DIRECTION catch, on the same day
+*Filed with the same alacrity as the same-direction entry above, which is the point: an executor
+that records evidence against the doctrine promptly and evidence for it slowly is running the bias
+the docket exists to detect.*
+
+**The jurist caught a false claim the executor made about the executor's own code**, by reading the
+artifact rather than the record. PENDING-95 Amendment 1 asserted the new pre-commit gate "reuses the
+CURRENT attestation rule." It does not: it tests the resulting artifact where the PreToolUse hook
+tests the file as it was, making it a **strict superset**. The executor had written both surfaces,
+described them in a governance record, and not noticed they had diverged.
+
+**Why this one counts where a self-catch does not.** The catch required (i) a different party,
+(ii) reading two artifacts the executor authored, and (iii) disbelieving the executor's own summary
+of them. The executor then **verified it empirically before accepting it** — exit 0 at one surface,
+exit 1 at the other, same edit — so the finding is confirmed by the party it corrects rather than
+taken on authority.
+
+**Also cross-direction, same ruling:** the jurist found that the `(read YYYY-MM-DD)` field and the
+QUOTES requirement are parsed by nothing on either surface — a defect present since 2026-07-17 that
+the executor had looked at repeatedly, including while editing one of the two files that day.
+
+⚠ **What it does NOT establish.** One catch does not answer Q3, and the jurist's access here was
+**newly granted by the executor hours earlier** — so this is evidence about what the pair can do
+*when the jurist can read the substrate*, not about the pair as it has historically operated. The
+honest reading of the day is: **two same-direction misses in the parties' model of each other, and
+one genuine cross-direction catch that required a read surface which did not exist that morning.**
+That is an argument for widening the read surface before it is an argument about independence.
+
+### Docket entry 2026-08-24 — a SAME-DIRECTION miss, and its class is the parties' model of each other
+*Filed unprompted per Constraint 6: "Evidence against is to be recorded when observed, not only when
+sought." Raw instances left checkable; evidence, not a verdict.*
+
+**Same-direction miss (the doctrine's predicted failure), n=2 within one week, mirror-imaged.**
+
+| party | claim asserted from recall | substrate |
+|---|---|---|
+| **executor**, 2026-08-23 (recorded in PENDING-155) | *"Claude.app has no filesystem access"* | false — mediated read access since 2026-08-08 |
+| **jurist**, 2026-08-24 (in its PENDING-155 ruling, self-reported) | the governance tools are unavailable — asserted **twice in one session** | false — deferred behind `tool_search`, never called |
+
+**The class is sharper than "asserted from recall."** Both are negative claims about **the other
+party's capabilities**, made without a positive control, by parties who each hold the doctrine that
+forbids it — the jurist naming its own as *"the same error… from the party whose Q2 doctrine that
+is."* Neither party checks what the other can actually do. **This is the pair failing in the same
+direction on the same class, which is confirmation of the weak separation REVIEWED-86 declares.**
+
+⚠ **It has an operational cost, incurred today.** The executor offered to build a jurist package
+that was largely unnecessary, because it mis-modelled the jurist's reach; the jurist left its own
+tools uncalled for a session, because it mis-modelled its own. **The parties' mutual
+capability-model is a shared blind spot with a measurable price in wasted work and unused reach.**
+
+**Who caught each, which is the part that bears on the doctrine.**
+- The executor's instance: caught by the **steward**, by asking *"unless there is enough there that
+  his governance tools can read without a package"* — a one-line prompt that redirected the work.
+- The jurist's instance: caught by the **jurist itself**, unprompted, on re-reading.
+
+⚠ **A self-catch is not a cross-catch and must not be counted as one.** The pair did not check each
+other here; one party checked itself and the steward checked the other. **This is consistent with
+the weakened form the doctrine names as its own failure case** — *"only the steward supplies genuine
+independence; jurist review is a second reading, valuable and not a check"* — and it is the second
+same-direction instance on this docket. It does not settle Q3; it moves the evidence the same way
+2026-08-06 did, and no instance yet recorded moves it the other way.
+
 ### Docket entry 2026-08-06 — first day the correlation question has data in BOTH directions
 *Filed per the jurist's instruction on PENDING-102. Raw classifications left checkable; this is evidence, not a verdict.*
 
@@ -935,6 +997,166 @@ the Obsidian vault pass and again 2026-08-20 against the trial-09 package — th
 workstreams, neither of which the hook was scoped to and both of which it was meant to cover in
 spirit. The instance is disclosed by the party that bypassed it.
 
+### AMENDMENT 1 — 2026-08-24 — third instance; the REACHABILITY half is fixed, the STRICTNESS half is still owed
+
+**Steward-authorized in-session** — *"yes, we need this fixed now."* Implemented and committed
+before this entry was written; this entry records what was done, not what is proposed.
+
+**Third instance, same shape.** `verify-before-compose` did not fire on any file written in this
+session either — the runbook edit, two memory trackers, the session ledger — because every write
+went through Bash. Found today only by censusing the configured hooks after the steward observed
+the session "felt intuitive"; **the executor reported it as a new discovery and only then read this
+item, which had carried it since 2026-08-20.** Reporting before reading is the same ordering error
+that produced a duplicate-tracker proposal earlier the same afternoon.
+
+**A second, independent victim of the identical defect.** `daybook-cue.py` (built 2026-08-24 11:19)
+was wired `PostToolUse | Write|Edit` — **the same matcher, copied from the hook whose blindness was
+already on this record.** It has never fired; `~/.claude/state/` does not exist. A known defect
+propagated into a new mechanism because it was recorded as an instance rather than as a class.
+
+**What was fixed.** `chamber-library/.githooks/pre-commit` (`4ccba76`) now gates staged
+constitutional artifacts — same scope predicate as the PreToolUse hook — on a `GROUNDED-IN:`
+attestation. **The commit is the tool-agnostic boundary**: however a file was edited, it passes
+through here. Controls run before committing: constitutional+ungrounded **BLOCKS** (exit 1),
+constitutional+grounded **PASSES** (exit 0), non-constitutional+ungrounded **PASSES** (exit 0).
+
+**What was deliberately NOT fixed, and why.**
+1. **The strictness question is untouched.** The new gate reuses the CURRENT rule (marker anywhere
+   in staged content), so it **inherits this item's original decay defect** by design. Options
+   (a)–(d) above remain UNRULED and choosing one at the commit boundary would have pre-empted the
+   steward. ⚠ **When that ruling lands it must be applied to BOTH surfaces** — the PreToolUse hook
+   and the pre-commit gate — or they will diverge. Declared in the hook body, not only here.
+2. **`--no-verify` bypasses it.** Speed-bump, not guarantee — the same claim the original makes.
+3. **The PreToolUse hook is unchanged.** It still covers the Write/Edit route; no reason to remove.
+4. **`daybook-cue.py` is NOT fixed.** Two gaps, and only one is this item's class: (i) reachability,
+   shared with this item; (ii) its condition is `note_size < SKELETON_CEILING` (1200 bytes), so a
+   session appending nothing to an already-filled note is invisible to it — today's note is 15,688
+   bytes and the cue would have stayed silent **even if reachable**. (ii) is a design choice, not a
+   defect, and is not the executor's to redecide.
+
+**Still open on this item:** the (a)–(d) ruling, and the coverage question of which *other* guards
+are wired to tool-matchers the work routes around. `census-02-have-they-ever-fired` (2026-08-04)
+censused seven instruments; **three mechanisms built since have never been censused.**
+
+**Read surface widened so the ruling can have the right subject.** `governance-mcp.py` serves the
+jurist a fixed enum of files. It already carried PENDING-95 itself (via `read_item`), the whole
+register, and chamber-library's git log — so most of this ruling was reachable unaided. It did **not**
+carry the two artifacts the ruling GOVERNS. Ruling from the record alone would have made the subject
+the executor's *description* of the hooks rather than the hooks — the exact defect recorded inside
+REVIEWED-125 (*"the ruling's subject was the pasted text, not the filed artifact"*). Added two
+read-only keys, `grounding-hook-pretool` and `grounding-hook-commit`, under the **PENDING-86 option
+(a) precedent** already sitting three lines above them in the same dict. Enum design unchanged, no
+path argument, no write path; the AST no-write invariant and its positive control still pass.
+⚠ **Requires a steward restart of the desktop app** — the key map is built at import, the same
+friction that held PENDING-134. ⚠ **Done on the steward's in-session instruction rather than a
+separate authorization; read-only and reversible by deleting two dict entries** if that reads as
+overreach.
+
+**Awaiting:** steward ruling on (a)–(d), now applying to two surfaces rather than one.
+
+### AMENDMENT 2 — 2026-08-24 — RULED. (a) rejected, (d) discharged, (b)/(c) deferred on a census
+
+**Jurist ruling placed by the steward** (REVIEWED, id unasserted pending PENDING-110's
+`REVIEWED-N`/`PENDING-N` collision). Ruled from a **verbatim read of both hook artifacts**, which the
+two read-only keys added earlier the same session made possible; the ruling records that findings
+1–3 exist only because of that widening.
+
+**⚠ A CLAIM IN AMENDMENT 1 WAS FALSE AND THE JURIST CAUGHT IT BY READING THE CODE.** Amendment 1
+said the pre-commit gate "reuses the CURRENT attestation rule." It does not. The PreToolUse hook
+tests the payload **plus the file as it was on disk**; the pre-commit gate tests `git show ":$file"`,
+the **resulting** artifact. **The two surfaces had already diverged, and the new one is strictly
+stricter.** Verified empirically before accepting the finding: an edit stripping the only marker
+from a marked file **exits 0 at the PreToolUse hook and 1 at the commit gate**. The standing
+instruction is therefore amended and is asymmetric — *the pre-commit semantics are the FLOOR, do not
+equalise downward*; the PreToolUse hook owes the payload-vs-disk correction regardless of (b)/(c).
+
+**(a) REJECTED** — not revisited without new steward input. **(d) AUTHORIZED unconditional, and
+DISCHARGED 2026-08-24** across the surfaces that were owed it (`8eea85f` + the PreToolUse header):
+per-file decay stated, the divergence stated, and — the finding neither party had before the read —
+**the `(read YYYY-MM-DD)` field and the "Grounding section that QUOTES them" requirement are
+ADVISORY TEXT PARSED BY NOTHING.** Both surfaces test the bare substring `GROUNDED-IN:`. Marker
+presence has never been evidence that any reading occurred.
+
+**⚠ On (d) obligation 2, the ruling's premise was already stale, and this item is why.** The ruling
+directs correcting chamber-library `CLAUDE.md`'s *"is **DENIED** unless the artifact carries"* clause
+and notes honestly that the jurist cannot verify its state (outside its read enum). **Checked: that
+clause was already corrected on 2026-08-06 under PENDING-106, jurist-authorized FIX**, and now
+records all three consequences explicitly, including the once-per-file decay and the unenforced
+QUOTES requirement. **What was stale is THIS ITEM's quotation of it** — PENDING-95 is dated
+2026-08-04 and was never updated after the 08-06 correction, so the jurist read a two-day-old quote
+as current. Nothing to fix in the constitution; the defect was in the register quoting a document
+instead of pointing at it.
+
+**(b)/(c) DEFERRED**, on a stated and cheap condition: a read-only census of the 31 marked guarded
+files recording, per file, whether the marker carries (i) a parseable date, (ii) named §sections,
+(iii) a Grounding section that actually quotes — **distribution, not summary.** Ruling between (b)
+and (c) now would authorize a mechanism against an unknown input format and would likely invalidate
+markers retroactively. The jurist offers a **third form, explicitly outside the four and offered as
+a scope expansion for the steward to accept or refuse**: require the marker's date to be no older
+than the last substantive change to the artifact it grounds — (c)'s firing semantics with no format
+migration. And: draft the new marker against three real files before authorizing the rule that
+invalidates the other 28.
+
+**Read-surface doctrine, accepted.** The two keys were added on in-session instruction. The jurist
+records this as exemplary in disclosure and load-bearing in effect, and holds the doctrine point
+anyway: **the jurist's read surface is the one instrument the jurist cannot audit, so changes to it
+should arrive as recorded rulings, not in-session authorization.** ⚠ **Adopted as binding on the
+executor from now.** Accordingly, the obvious next key — chamber-library `CLAUDE.md`, whose clause
+(d) obligation 2 concerns and whose state the jurist could not verify — is **NOT being added
+unilaterally; it is proposed and awaits a ruling.**
+
+### THE (b)/(c) CENSUS — RUN 2026-08-24, the condition is discharged
+
+*Read-only, no new instrument, as ruled. Definitions declared before counting: **(i)** `(read
+YYYY-MM-DD)` in the marker line · **(ii)** a `§` in the marker line · **(iii)** a heading matching
+/grounding/i with at least one blockquote line in the 40 lines after it. Per-file table preserved in
+the session record so the classification is checkable, not just the totals.*
+
+**⚠ First result: the item's own numbers were stale.** **60 guarded / 32 marked / 28 unmarked**, not
+59/31. Verified by walking the tree against the five basename patterns, not relayed. The drift is
+one file each way and changes nothing, but the item has been quoting 59/31 since 2026-08-04.
+
+| | count | share |
+|---|---|---|
+| marker carries a parseable **date** | **24 / 32** | **75%** |
+| marker names **§sections** | 31 / 32 | 97% |
+| a **Grounding section that actually quotes** | **15 / 32** | **47%** |
+
+**Distribution (the jurist asked for this, not a summary):**
+
+| date | §sec | quotes | files |
+|---|---|---|---|
+| ✓ | ✓ | ✗ | **16** |
+| ✓ | ✓ | ✓ | 8 |
+| ✗ | ✓ | ✓ | 6 |
+| ✗ | ✗ | ✓ | 1 |
+| ✗ | ✓ | ✗ | 1 |
+
+**This decides the ruling's own fork.** The jurist wrote: *"if the date field is broadly absent, (c)
+is the only live option… if broadly present, a third form becomes available."* **It is broadly
+present — 75%.** So the third form is live: *require the marker's date to be no older than the last
+substantive change to the artifact it grounds.* No format migration for 24 files; 8 need a date
+added. **(c)'s firing semantics at roughly a third of (c)'s cost.**
+
+**⚠ The largest single class is the one that matters: 16 files carry date AND §sections AND NO
+quoting Grounding section.** Marker complete, substantive half absent — the protocol's own evidence
+that the attestation has been doing ceremonial work. This is PENDING-109's prior, now with a number.
+
+⚠ **A caveat that cuts against reading 47% as a failure rate.** All ten
+`chamber-library-specification*.md` files score `DS-`, and that may be **correct by category**: the
+spec is what one grounds *in*, not a grounded draft, so it has no occasion for a Grounding section.
+Excluding them, quoting runs **15/22 = 68%**. I have not established which reading is right — it
+turns on whether the marker on a spec file means "this version was grounded" or "this file grounds
+elsewhere," and that is a question for the party who placed them. **Both figures are reported
+because choosing one silently would be the finer-instrument error the ruling warns about.**
+
+**Not done, and named:** the ruling's *"draft the new marker against three real files before
+authorizing the rule that invalidates the other 28"* — deliberately left, since it is an authoring
+act under the third form, and the third form is a scope expansion the steward has not yet accepted.
+
+**Awaiting:** steward direction on the (b)/(c) census, and on the third form as a scope expansion.
+
+
 ## PENDING-96 — The engine's `SILENCE — ✓ warranted` certifies the index and claims the answer
 **Date:** 2026-08-04
 **Tag:** [HARDENING]
@@ -1363,6 +1585,21 @@ Method: every `*JURIST-PACKAGE*.md` / `*FOR-JURIST*.md` under `~/dotfiles/claude
 
 ---
 
+### Contribution 2026-08-24 — the prior is now CONFIRMED BY DIRECT READ, not inferred
+
+Filed by the jurist while it had the substrate. This item's prior — that the *"QUOTES the ratified
+sections"* clause has **no mechanism behind it** — is confirmed on **both** grounding surfaces:
+each tests the bare substring `GROUNDED-IN:` (`case "$haystack" in *GROUNDED-IN:*` and
+`grep -q 'GROUNDED-IN:'`). Neither parses the date field nor validates marker shape. Previously
+inferred; now read. ⚠ **Scope: two of two artifacts within the jurist's read enum; a parser outside
+that surface cannot be ruled out.**
+
+⚠ **And a routing decision recorded so it is not silently reversed:** the residual coverage question
+(guards wired to tool-matchers the work routes around) was expected to land here and **does not**.
+This item is bounded to **kind (a)** — an honest mechanism under an over-claiming doc. `daybook-cue.py`
+is a different kind: nothing over-claims; the mechanism is simply off the path. Folding it in would
+silently widen a scope this item says is not to be widened silently. Opened as PENDING-156.
+
 ## PENDING-110 — `REVIEWED-N` and `PENDING-N` are independent sequences that now collide, and a bare number no longer identifies an item
 
 **Date:** 2026-08-06
@@ -4608,3 +4845,57 @@ If the visible work today came from **positional difference between two same-for
 **Files affected:** new `~/dotfiles/scripts/daybook-mcp.py`; `/wrap-up` §7.5 (fold step); awaiting steward hand: `claude_desktop_config.json` merge + app restart.
 **Recommendation:** Build it, with a selftest carrying the same paired positive/negative controls as its sibling, and hold installation until the daily log has run long enough to show it survives — a jurist inbox for a practice that lapsed would be the fourth abandoned attempt rather than the first durable one.
 **Awaiting:** Steward authorization.
+
+---
+
+## PENDING-156 — Kind (c): mechanisms that are off the path the work takes
+**Date:** 2026-08-24
+**Tag:** [HARDENING]
+**Summary:** A third failure kind, distinct from PENDING-109's: not a doc over-claiming an honest mechanism, but an honest mechanism wired to a trigger the work routes around. Two instances found today out of seven configured hooks; three mechanisms built since the last census have never been censused at all.
+**Rationale:** Opened on jurist direction in the PENDING-95 ruling, which declined to absorb it: *"109 is bounded to kind (a)... `daybook-cue.py` is kind (c): nothing over-claims; the mechanism is off the path. Open it as its own [HARDENING] item."* PENDING-95 has already carried two defects under one id and one ruling slot and does not take a third — a lesson that item paid for.
+
+**The class, stated so it is testable:** a mechanism whose *stated* scope is correct, whose selftests pass, and whose trigger condition is never met in practice because the work reaches the guarded action by a route the trigger does not observe. It differs from kind (a) in that **no document is wrong** — the failure is invisible to any audit that reads docs against code, which is what makes it worth its own item. A green suite and an honest doc are both consistent with zero firings.
+
+**Instances so far (2 of 7 configured hooks, both found 2026-08-24 by censusing the hook config, not by any selftest):**
+1. `verify-before-compose` — `PreToolUse | Write|Edit`; work routes through Bash. Recorded 2026-08-19, 08-20, 08-24. Remediated at the commit boundary, not at the matcher.
+2. `daybook-cue.py` — `PostToolUse | Write|Edit`, **inheriting the identical matcher by copy** from the hook whose blindness was already on the record. Never fired; `~/.claude/state/` did not exist. Fixed 2026-08-24 (matcher widened to `Bash|Write|Edit`; condition changed from note-size to staleness on steward ruling).
+
+**⚠ The propagation is the finding, not the instances.** Defect 2 exists because defect 1 was filed as an *instance* rather than as a *class*, and the new mechanism copied the broken pattern from the recorded one. Filing this item is the remedy for that specific mode.
+
+**Never censused:** `census-02-have-they-ever-fired` (2026-08-04) covered seven instruments. Three have been built since and are outside it — `thread-query.py`, `daybook-cue.py`, `daybook-ensure.py` — under the standing discipline *re-run a prior verification at the scope of your extension*, which was not run.
+
+**Options:** (a) re-run census-02's method over the current mechanism set, extended with an "is its trigger on the path the work takes?" axis; (b) axis-only pass over the 7 configured hooks, cheapest, ignores non-hook mechanisms; (c) require every new mechanism to record a first-firing observation before it counts as built — a standing rule rather than a census.
+**Recommendation:** (b) now, because it is one read of one config file and closes the known-unknown; then (c) as the durable form, since (a) will simply be owed again the next time something is built. ⚠ (c) generalises today's repeated lesson — **only the live run catches it; a green selftest over a self-authored fixture certifies its author's blind spot** — which fired three times on 2026-08-23/24 on three different tools.
+**Files affected:** none yet; a census plus, under (c), a line in the build discipline.
+
+### Option (b) RUN — 2026-08-24, same session the item was opened
+
+*Steward-directed. Read-only, one pass over `settings.json` + every `dotfiles/scripts/*.py`, then a
+caller search. Distribution, not summary.*
+
+| verdict | mechanisms |
+|---|---|
+| **fires mechanically** | `wake-digest.py` (SessionStart) · `governance-drift-check.py` (**executed by wake-digest**, not prose) · `daybook-ensure.py` (SessionStart) · `daybook-cue.py` (PostToolUse, fixed today) · `cm-hook.mjs` |
+| **fires only if the executor follows a prose step** | `thread-query.py` — the one genuinely at risk, and it already carries a trial for exactly this |
+| **nothing invokes automatically** | `vault-links.py` · `verify-quotes.py` · `l1-replay-sampler.py` — **manual instruments; not a defect**, and census-02 already records that hand-run tools have the rich firing records |
+| **wired but OFF the path** | `verify-before-compose.sh` — the only remaining kind-(c) instance |
+
+**⚠ THE METHOD FINDING IS WORTH MORE THAN THE TABLE.** A first pass classified by the **proxy**
+*"is it named in a SKILL.md?"* and produced a tidy 3/3/3 split. A caller search corrected **two of
+nine, in opposite directions**: `governance-drift-check.py` looked prose-wired and is in fact
+hook-fired (wake-digest executes it, and today's SessionStart output proves it ran);
+`vault-links.py` looked code-referenced and is **cited in a docstring comment, never called**. A
+proxy does not err in one direction that can be corrected for — it errs both ways at once. Recorded
+because the tidy first answer is the one that would have been filed.
+
+**Result for the item's scope:** kind (c) has **one live instance**, not a class in the wild —
+`verify-before-compose`, already remediated at the commit boundary and still owed the matcher fix.
+The propagation risk the item names is real but its blast radius today is one. **The bigger residual
+is the prose-wired tier**: a mechanism whose trigger is a sentence in a skill fires only when read
+and obeyed, which is the described-not-invoked class that had the link canary hand-typed twice.
+`thread-query.py` is the only one there, and it is under trial.
+
+**Recommendation now narrows to (c)** — the standing rule *a mechanism does not count as built until
+a first firing is observed on the live path* — since (b) is now run and (a) would re-derive it.
+
+**Awaiting:** Steward authorization.