diff --git a/PENDING.md b/PENDING.md index 8683b20..b317460 100644 --- a/PENDING.md +++ b/PENDING.md @@ -5061,4 +5061,33 @@ Jurist review (2026-09-17) found the design sound on all five points Fable flagg **Files affected:** None yet. A new, isolated working directory for the build; no existing repo is touched. -**Awaiting:** Steward ruling — AUTHORIZED / DEFERRED / REJECTED — on proceeding to build. Full jurist review: this conversation, 2026-09-17. \ No newline at end of file +**Awaiting:** Steward ruling — AUTHORIZED / DEFERRED / REJECTED — on proceeding to build. Full jurist review: this conversation, 2026-09-17. + +## PENDING-139 — AMENDMENT 1: a third blind spot, and it is a unit mismatch rather than a marker defect + +**Date:** 2026-09-20 +**Tag:** [HARDENING] + +**Summary:** `governance-drift-check.py`'s register-integrity check cannot detect an in-place rewrite of a **placed ruling's disposition fields**, because such a rewrite produces no amendment-shaped block and the check's unit is the block. This is distinct in kind from the two defects the parent item records: (A) and (B) are *marker* defects — a `###` heading the pattern fails to match, a negated token read as an assertion — repairable by fixing a regex. This one is not repairable by fixing a regex, because the thing to be detected never enters the population the regex runs over. + +**Observed 2026-09-20, not predicted.** The steward rewrote REVIEWED-140's `Decision:`, `Ruled by:` and `Authorized by:` fields in place, completing a ruling that had been begun 2026-09-17 and interrupted mid-write. The check ran immediately afterwards and reported `register integrity: 43 attributable amendment block(s) checked, all resolve`. **The silence is correct on the merits** — completing an interrupted entry is legitimate, no amendment was involved, and nothing was lost — **but the instrument could not have reported otherwise on any input of this shape**, including a rewrite that was not legitimate. A net that cannot fire on a class has not been shown to protect against it; per the ladder, its silence is uninformative rather than reassuring. + +**Why the parent item does not cover it.** PENDING-139's prospective exposure is *an amendment replacing the record it amends* — the REVIEWED-87 shape the check was earned from on 2026-08-07. Both parties to that shape are amendment-shaped blocks, so both are inside the check's unit and the failure is that the regex misses one of them. The exposure named here has **no amendment at either end**: a placed entry is edited, the edit leaves no block, and the register retains no trace that any field ever read differently. Same instrument, same file, different failure mode; filed here rather than as a new item so the instrument's exposures stay in one place and the remedy can be ruled once. + +**Class.** Unit mismatch — the instrument's unit is the amendment block, the question's unit is the entry. Fifth-plus instance of this class in the record since 2026-09-08 (`register_scan`'s header-vs-block, the `12/63` preamble-recorded-vs-delivered near-miss, the `31/28` predicate incommensurability, the `[:72]`/`[:100]` truncations). **It is the class that reading does not catch** — each instance was found by running something, never by looking harder. + +**What today's events also establish, bearing on the remedy.** Register commits are **not atomic per entry**, measured over the last twelve commits touching `REVIEWED.md`: five added two entries in one commit, one added none (an in-place edit), and several bundled the register with two to nine unrelated files. So git history is a *real* but *coarse* witness — it preserves that something changed and can show the prior bytes, but a single commit may carry several entries and unrelated files, so `git log -- REVIEWED.md` does not isolate a given ruling's edit history without further work. This is the same fact the jurist flagged at REVIEWED-140 row 4 as beyond its reach, measured here by the party that has the substrate. + +**Options.** +1. **Content-hash each placed entry** and check the hashes against a stored manifest — detects any field rewrite, at the cost of a manifest that must itself be maintained and that becomes a second place the truth lives. +2. **Derive the check from git** — compare each entry's current text against its text at the commit that placed it, and report entries whose disposition fields differ. No new stored state; bounded by the coarseness measured above. +3. **Require that a placed ruling's disposition fields are never edited in place** — corrections arrive as amendments — and let the existing block machinery cover it. Cheapest to state, but it is a convention with no detector, which is the disarmed-tripwire class the parent item already names. +4. **Accept and record.** The exposure is prospective, as it was for (A); no loss has occurred. + +**Recommendation:** Option 2, and not before PENDING-146 settles. Option 3 would add amendments to a register whose amendment-attribution convention is exactly what PENDING-146 has open — 59 blocks already cannot be attributed, and 37 of those would be actively mis-filed by an id-keyed repair. **Prescribing more amendments before the convention is ruled writes more of the population the convention question exists to bound.** Option 1 duplicates state the substrate already holds. Option 2 reads the substrate directly and adds nothing to maintain. + +⚠ **This amendment's own filing is a check on the finding it reports.** It is filed as `## PENDING-139 — AMENDMENT 1:` — the id+marker form established 2026-09-14 — and the instrument was run before and after with the counts predicted in advance. A bare `### AMENDMENT` heading here would have joined the 59 it discusses. + +**Files affected:** `scripts/governance-drift-check.py` (register-integrity check); no change made under this amendment. + +**Awaiting:** Steward annotation, with PENDING-139's two original defects — one ruling for the instrument, not three.