session 2026-08-08: PENDING-116 (fleet-on-corpus-change) filed; /wrap-up Instruments field (FIX lane)

PENDING.md

@@ -1535,3 +1535,36 @@ This is harmless today only because voice ⟺ source: measured, **max distinct v
 **Awaiting:** Steward authorization. Blocks REVIEWED-97 remediation step 3.
 
 ---
+
+## PENDING-116 — A corpus edit can invalidate engine fixtures silently: the fleet is not run on the change that breaks it
+
+**Date:** 2026-08-08
+**Tag:** [PROPOSAL]
+**Related:** REVIEWED-97 · PENDING-115 · skill-harvest register #192. **PROPOSAL, not FIX** — it changes what a gate accepts (a hook that can refuse a commit), which the amendment discipline puts above the FIX lane regardless of how small the diff is.
+
+**Summary.** `118f411` split the Mauss sidecar's `body` section into `body-01…13`. That invalidated `test_navigate.py`'s hardcoded node id, and **the fleet sat 202/203 red for a full day** — through two separate rounds of correction to that very commit — surfacing only because the steward asked an unrelated question about instrument reliability. Nothing runs the suites on the change that breaks them.
+
+**Why a discipline will not fix this.** The knowledge was never missing. The repo's own `CLAUDE.md` names the chamber↔engine binding surface as *"a cross-repo re-anchor trap — keep it named"*, and it is named. It still did not fire, because firing depended on someone remembering at the moment of commit. Per the REVIEWED-95 routing gate this belongs in the **top row — mechanical, and should always fire** — not in a rule anyone must recall.
+
+**Design, derived from reading the hook rather than assuming it.** `core.hooksPath` is `~/dotfiles/git/hooks` — so the hook is **tracked and travels** (better than a `.git/hooks/` script, which would exist on one machine and vanish on a fresh clone), but it is **global to every repo**. The fleet command therefore cannot live in the hook.
+
+**Options.**
+- **(a) Bake the studium-engine paths and suite into the global hook.** REJECTED — couples a hook shared by every repo to one repo's layout; the next repo that needs this copies rather than declares.
+- **(b) Repo-declared trigger.** The global hook stays generic and looks for a repo-local declaration naming *trigger paths* + *command* (e.g. `corpus/**` → `python3 tests/test_*.py`). If the staged diff intersects the trigger paths, run the command and refuse on red. **This is the generative-from-spec pattern the chamber already uses** (`graduation-spec.yaml`): conventions live in declared data, tools are thin consumers.
+- **(c) Per-repo hooks directory.** Requires unsetting the global `core.hooksPath` per repo, losing the existing global checks. Rejected.
+- **(d) Do nothing; rely on the named discipline.** Refuted by the evidence above — the discipline existed and was written down.
+
+**Recommendation: (b).**
+
+**Costs and limits, stated rather than discovered later.**
+- **Every triggering commit gets slower.** The seven engine suites run in seconds, not minutes, but the trigger paths must be scoped tightly (`corpus/`, `corpus/sidecars/`) so ordinary docs commits do not pay it.
+- **`--no-verify` bypasses it.** This is a tripwire, not an enforcement boundary, and should be described as one. A gate that can be stepped over is still worth having when the failure mode is *forgetting*, not *evading*.
+- **⚠ It does not close the cross-repo half, which is the larger hole.** The Mauss *sidecar* lives in `studium-engine/corpus/sidecars/`, so this hook would have caught `118f411`. But the *canonical text* lives in `chamber-library`, and a chamber-side edit that re-anchors or re-cleans a source can invalidate engine fixtures with **no engine-side commit at all** — no hook fires, on either side. Scoping this proposal to the same-repo case is deliberate; the cross-repo case needs the manifest `source_sha256` binding checked on a schedule, and is **named here as a known-open follow-on**, not silently absorbed.
+
+**Check that it worked.** Stage a change to a sidecar's section ids that is known to break a fixture; the commit must be refused. Then stage a docs-only change; it must not run the suites. **Both halves required** — a gate that always fires and a gate that never fires are indistinguishable from a gate that works, if only one direction is tested.
+
+**Files affected:** `~/dotfiles/git/hooks/pre-commit` (generic trigger logic); a declaration file in `studium-engine` (and later `chamber-library`).
+
+**Awaiting:** Steward authorization.
+
+---