governance: PENDING-137 recommendation corrected; PENDING-138 and -139 filed

PENDING-137 (b) SUPERSEDED IN PLACE, same day, by the executor who filed it —
the original text kept visible. It proposed dating the cell-constant amendment
2026-08-07, when the narrowing took force. An amendment is constituted by its
DISCLOSURE, and a disclosure cannot be retroactively dated to a day it did not
occur; under REVIEWED-121 point 2's strong form that act was impermissible in
kind, so dating an amendment to it asserts a properly-made amendment existed
then. Corrected: dated to its ruling, recording in_force 2026-08-07 and 7 days
undisclosed. The executed YAML was already more honest than the proposal that
implemented it.

PENDING-138 — the jurist's read-path/regeneration question, both halves
answered by census. (b) CLOSED: no script writes v2-stratum-tags.yaml.
(a) OPEN: nothing reads any declared field and no recall reporter exists, so
point 7's binding is aspirational. Tripwire deferred to a NAMED dependency —
build it when engine/v2_harness.py is created — so it is a record, not a task.

PENDING-139 — two blind spots in governance-drift-check.py, and the second was
found by filing an item about the first. (A) RE_HEAD cannot see a ###-level
amendment: 2 present, 1 seen, clean line printed. (B) RE_BUILT matches "NOT
BUILT", reading a negation as an assertion.

⚠ PENDING-138's wording was deliberately NOT changed to dodge (B). Rewording
would conceal a real defect and leave the check's clean line maintained by
authors accommodating it. The false alarm stands until ruled.

The common cause is the technique, not the regexes: a STATUS inferred from
NARRATIVE text never constrained to carry one. Whether to give status its own
declared field is the real question and is the steward's.

PENDING.md

@@ -3027,7 +3027,15 @@ The reason is that (a) and (b) both answer *"which population did this field mea
 - **(b) Ratify it as its own amendment, separately dated 2026-08-07.** §6.2 then carries **two** dated amendments, in the order they actually occurred.
 - **(c) Overrule it and restore the literal reading.** fr and de go 100% stratum B; A:B ≈ 1:1 becomes unsatisfiable in those cells and the stratification carries no information there.
 
-**RECOMMENDATION: (b).** It took force on its own date under its own reasoning, and folding it into PENDING-134's disclosure would date it wrongly and bind two independent acts together. Option (i) of H3 — *a pre-registration carrying dated amendments* — is already the ruled resulting state, and it is plural in REVIEWED-121 point 9's own wording (*"dated amendments"*), which (b) satisfies exactly and (a) does not.
+**RECOMMENDATION: (b), AS CORRECTED BELOW — the recommendation as first filed was unsound and is superseded in place rather than quietly reworded.**
+
+> **⚠ SUPERSEDED 2026-08-14, same day, by the executor who filed it.** The original read: *"(b). It took force on its own date under its own reasoning, and folding it into PENDING-134's disclosure would date it wrongly and bind two independent acts together."* That reasoning is right about not folding and **wrong about the date**, and the error is inconsistent with REVIEWED-121 point 2 as placed.
+>
+> **An amendment is CONSTITUTED BY ITS DISCLOSURE.** A disclosure cannot be retroactively dated to a day on which it did not occur. Under point 2's strong form the 2026-08-07 act was impermissible *in kind* — it entered by reading rather than by disclosed amendment — so dating an amendment to it would assert that a properly-made amendment existed on 2026-08-07. It did not. What existed was a narrowing in force and undisclosed.
+>
+> **The coherent form separates the two dates**, which a single `date:` key cannot carry: the amendment is dated to its **ruling**, and **records** that the narrowing took force 2026-08-07 undisclosed. ⚠ Noted because it is its own small finding: the executed YAML already did this correctly by structure while this recommendation did not — the substrate was more honest than the proposal that implemented it. Both rows now carry `date_in_force` and `date_disclosed` explicitly (`corpus/v2-stratum-tags.yaml`, [FIX] 2026-08-14), and for this row they diverge by seven days, which is the finding rather than an untidiness.
+
+**(b) as corrected:** ratify the narrowing as its own amendment, **dated to its ruling**, recording `in_force: 2026-08-07` and `undisclosed_days_in_force: 7`. This keeps the two acts separate — which was (b)'s sound half — without asserting a disclosure that never happened. H3's ruled resulting state, *"a pre-registration carrying dated **amendments**"* (REVIEWED-121 point 9, plural), is satisfied by this and not by (a).
 
 **(c) is listed because the option set must not hide the literal reading, but it is not seriously available:** it defeats the stated purpose of stratification, and REVIEWED-121 point 2 records that nothing suggests the reading itself is wrong.
 
@@ -3038,3 +3046,60 @@ The reason is that (a) and (b) both answer *"which population did this field mea
 **Awaiting:** Jurist ruling per REVIEWED-121 point 2, then steward authorization.
 
 ---
+## PENDING-138 — The REVIEWED-121 declared fields: (b) survives regeneration — ESTABLISHED; (a) is read by nothing — OPEN
+**Date:** 2026-08-14
+**Tag:** [HARDENING]
+
+**Summary:** REVIEWED-121 point 7 binds the declared disclosure fields to *"whatever reports recall"*. Censused 2026-08-14: the regeneration hazard does not apply, and the read path does not exist — so the binding is unenforced, for a different reason than the one suspected.
+
+**Raised by the jurist**, who could not reach the substrate from its seat and named both halves as assumed-rather-than-checked. Both are answered here.
+
+**(a) READ PATH — OPEN, and the binding is aspirational.** **Nothing reads any of the declared fields.** `scripts/gold_intersection.py` reads `spans[].span` and `spans[].stratum` and nothing else. No recall reporter exists anywhere in the repo: `engine/v2_harness.py` is a §14.3 *contract*, not code. So the fields are unconsumed, and nothing will require the recall reporter to read them on the day it is built. **A declared field with no consumer, and no mechanism to acquire one, is a note wearing a field's clothes by absence rather than by overwrite.**
+
+**(b) REGENERATION — ESTABLISHED CLEAN, by census rather than by the file's own claim.** **No script writes `corpus/v2-stratum-tags.yaml`.** Every reference in the repo was enumerated: `gold_intersection.py` READS it (`_ranges_from_stratum_tags`, registered in a readers list); `scripts/bind_mauss_spans.py` names it only inside a comment string it emits into a *different* file. The `mauss-fixture-spans` precedent — where a retraction recorded only in generated output is erased by the next regeneration, silently, with no diff to read, so the note had to be carried into the generator — **therefore does not apply here.** The file's own header claim to be hand-authored is now verified rather than trusted. No generator-side carry is required.
+
+⚠ **(b) is established for TODAY's repo and is not a standing guarantee.** The day someone writes a generator for this file, the `mauss-fixture-spans` carry becomes required and nothing will announce it. That is the same prospective-consumer shape as (a), which is why they belong in one item.
+
+**PROPOSED REMEDY for (a), NOT BUILT:** a tripwire that is inert today and fails the moment a recall-reporting path exists which does not read the disclosure — the same shape as `test_false_positives_are_pinned` and `test_conjunction_is_monotonic`, guarding a *property* rather than a value. It cannot be written against the harness while the harness is absent, but it can be written against that absence now: assert that **if** `engine/v2_harness.py` exists, it reads `defeater_has_ever_been_exercisable`. Silent until the harness lands; red the day it lands without the read.
+
+**⚠ NAMED DEPENDENCY, so this does not become another open thread:** build the tripwire **when `engine/v2_harness.py` is created**, not before. Until then this item is a record, not a task.
+
+**Files affected:** `tests/` (one new check) when the dependency fires. No corpus or engine change now.
+
+**Awaiting:** Steward authorization for the tripwire, deferred to the named dependency. (b) needs nothing further.
+
+---
+
+## PENDING-139 — Two blind spots in `governance-drift-check.py`, found the same hour, one by filing an item about the other
+**Date:** 2026-08-14
+**Tag:** [HARDENING]
+
+**Summary:** Two independent marker defects in the same instrument. **(A)** the register-integrity check cannot see a `###`-level amendment heading, so it reports a clean line over half the amendments present; **(B)** `RE_BUILT = re.compile(r"\bBUILT\b")` matches the string *"NOT BUILT"*, so the built-vs-ruled check reads a **negation as an assertion** and raises a false alarm against an item that says it built nothing.
+
+⚠ **(B) WAS FOUND BY FILING (A).** PENDING-138 contains the honest phrase *"PROPOSED REMEDY for (a), NOT BUILT"*; the checker immediately reported *"PENDING-138 is marked BUILT and no REVIEWED entry names it."* An item filed about the instrument's blind spot tripped a different blind spot in the same instrument. Recorded because the coincidence is evidence about marker-matching as a technique, not about these two regexes.
+
+⚠ **THE WORDING IN PENDING-138 WAS DELIBERATELY NOT CHANGED.** Rewording to dodge the false positive would have (i) concealed a real defect and (ii) left the check's clean line maintained by authors accommodating it rather than by it working — the disarmed-tripwire class. **The alarm stands until this item is ruled**, explained by this entry rather than silenced. If it is left standing long it becomes noise, and *red-on-absent trains readers to discount red* — which is the reason to rule this rather than live with it.
+
+**(A) MEASURED 2026-08-14.** `RE_HEAD = ^##\s+REVIEWED-(\d+)\s*[—-]\s*(.*)$`.
+
+**MEASURED 2026-08-14.** Amendment-like headings present: **2** — `### REVIEWED-83 — AMENDMENT 1 (2026-08-01)` and `## REVIEWED-87 — AMENDMENT 2026-08-07`. Seen by the check: **1** — REVIEWED-87 only. `^##\s+` requires whitespace after two hashes, so a third hash fails the match and the entry is invisible to the amendment machinery entirely — neither counted, nor protected, nor reported as unparsed.
+
+**⚠ WHY THIS IS THE SAME DEFECT THE INSTRUMENT EXISTS TO CATCH.** The check was earned 2026-08-07 when REVIEWED-87's original was overwritten by its own amendment and nothing detected it. It now emits a **clean line over a silently halved population** — which is the PENDING-136 denominator class, in the instrument built to protect the register against exactly that kind of loss. **Fifth occurrence in this arc.** Surfaced while conforming a REVIEWED-121 addendum heading: both the jurist's proposed `## REVIEWED-121 · ADDENDUM 1` (the `·` fails `[—-]`) and the `###` house form used at REVIEWED-83 are invisible; only `## REVIEWED-121 — AMENDMENT 1` registers.
+
+**⚠ NO LOSS HAS OCCURRED, and the item says so plainly.** REVIEWED-83's amendment is correctly placed and joined; the check simply cannot see it. The exposure is **prospective**: if that entry were ever replaced by its own amendment, the check would stay green. This is not urgent and is filed rather than fixed for that reason.
+
+**OPTIONS.** (a) Widen `RE_HEAD` to `^#{2,4}\s+REVIEWED-…`, accept `ADDENDUM` alongside `AMENDMENT`, and negation-guard `RE_BUILT`. (b) All of (a) **plus** emit a count of amendment-like headings the parser could not classify, so a future unmatched form announces itself instead of vanishing. (c) Leave both, and standardize heading form and phrasing by convention only.
+
+**RECOMMENDATION: (b).** (a) fixes today's three known forms and leaves the *next* unanticipated one silently invisible, which is precisely how (A) arrived and how (B) survived. (c) puts the guarantee in a convention nothing enforces — the disarmed-tripwire class, and it would also mean authors phrasing around `\bBUILT\b` forever. **(b) is the only option under which the check's own blind spot is reportable by the check**, which is honest degradation applied to the instrument itself.
+
+⚠ **THE COMMON CAUSE IS THE TECHNIQUE, NOT THE TWO REGEXES.** Both defects are *substring-matching over prose used as a status signal*: `###` isn't `##`, and `NOT BUILT` contains `BUILT`. Widening the patterns treats the instances. The class is that a **status** is being inferred from **narrative text** that was never constrained to carry one, and it will keep producing defects of this shape in either direction — false clean lines and false alarms — for as long as the status has no declared field of its own. Whether that is worth fixing properly (a declared status key per item, matched exactly) or whether marker-matching is good enough for a detection-only instrument is the real question, and it is the steward's.
+
+⚠ **Whichever lands, positive controls are required in both directions**: a fixture amendment under a `###` heading the check must DETECT, and a fixture item saying `NOT BUILT` the check must NOT flag. The existing control (`register check DETECTS an amendment that replaced its record`) passed throughout and could not see (A), because it only ever exercised the `##` form — **a control that exercises one form of the thing it guards proves nothing about the others**, which is the control-set-drawn-from-one-source finding of 2026-08-13, recurring in the governance instrument.
+
+**⚠ SCOPE — this touches a governance instrument, so nothing is changed without authorization.** Detection-only was already exercised: the gap was measured, not corrected.
+
+**Files affected:** `~/dotfiles/scripts/governance-drift-check.py` — `RE_HEAD`, `RE_BUILT`, the register and built-vs-ruled checks, and their controls.
+
+**Awaiting:** Steward authorization. ⚠ Until then the built-vs-ruled check reports **one false alarm** against PENDING-138, left standing deliberately (see above) rather than worded around.
+
+---