session 2026-08-08: PENDING-116 (fleet-on-corpus-change) filed; /wrap-up Instruments field (FIX lane)

PENDING.md

@@ -1535,3 +1535,36 @@ This is harmless today only because voice ⟺ source: measured, **max distinct v
 **Awaiting:** Steward authorization. Blocks REVIEWED-97 remediation step 3.
 
 ---
+
+## PENDING-116 — A corpus edit can invalidate engine fixtures silently: the fleet is not run on the change that breaks it
+
+**Date:** 2026-08-08
+**Tag:** [PROPOSAL]
+**Related:** REVIEWED-97 · PENDING-115 · skill-harvest register #192. **PROPOSAL, not FIX** — it changes what a gate accepts (a hook that can refuse a commit), which the amendment discipline puts above the FIX lane regardless of how small the diff is.
+
+**Summary.** `118f411` split the Mauss sidecar's `body` section into `body-01…13`. That invalidated `test_navigate.py`'s hardcoded node id, and **the fleet sat 202/203 red for a full day** — through two separate rounds of correction to that very commit — surfacing only because the steward asked an unrelated question about instrument reliability. Nothing runs the suites on the change that breaks them.
+
+**Why a discipline will not fix this.** The knowledge was never missing. The repo's own `CLAUDE.md` names the chamber↔engine binding surface as *"a cross-repo re-anchor trap — keep it named"*, and it is named. It still did not fire, because firing depended on someone remembering at the moment of commit. Per the REVIEWED-95 routing gate this belongs in the **top row — mechanical, and should always fire** — not in a rule anyone must recall.
+
+**Design, derived from reading the hook rather than assuming it.** `core.hooksPath` is `~/dotfiles/git/hooks` — so the hook is **tracked and travels** (better than a `.git/hooks/` script, which would exist on one machine and vanish on a fresh clone), but it is **global to every repo**. The fleet command therefore cannot live in the hook.
+
+**Options.**
+- **(a) Bake the studium-engine paths and suite into the global hook.** REJECTED — couples a hook shared by every repo to one repo's layout; the next repo that needs this copies rather than declares.
+- **(b) Repo-declared trigger.** The global hook stays generic and looks for a repo-local declaration naming *trigger paths* + *command* (e.g. `corpus/**` → `python3 tests/test_*.py`). If the staged diff intersects the trigger paths, run the command and refuse on red. **This is the generative-from-spec pattern the chamber already uses** (`graduation-spec.yaml`): conventions live in declared data, tools are thin consumers.
+- **(c) Per-repo hooks directory.** Requires unsetting the global `core.hooksPath` per repo, losing the existing global checks. Rejected.
+- **(d) Do nothing; rely on the named discipline.** Refuted by the evidence above — the discipline existed and was written down.
+
+**Recommendation: (b).**
+
+**Costs and limits, stated rather than discovered later.**
+- **Every triggering commit gets slower.** The seven engine suites run in seconds, not minutes, but the trigger paths must be scoped tightly (`corpus/`, `corpus/sidecars/`) so ordinary docs commits do not pay it.
+- **`--no-verify` bypasses it.** This is a tripwire, not an enforcement boundary, and should be described as one. A gate that can be stepped over is still worth having when the failure mode is *forgetting*, not *evading*.
+- **⚠ It does not close the cross-repo half, which is the larger hole.** The Mauss *sidecar* lives in `studium-engine/corpus/sidecars/`, so this hook would have caught `118f411`. But the *canonical text* lives in `chamber-library`, and a chamber-side edit that re-anchors or re-cleans a source can invalidate engine fixtures with **no engine-side commit at all** — no hook fires, on either side. Scoping this proposal to the same-repo case is deliberate; the cross-repo case needs the manifest `source_sha256` binding checked on a schedule, and is **named here as a known-open follow-on**, not silently absorbed.
+
+**Check that it worked.** Stage a change to a sidecar's section ids that is known to break a fixture; the commit must be refused. Then stage a docs-only change; it must not run the suites. **Both halves required** — a gate that always fires and a gate that never fires are indistinguishable from a gate that works, if only one direction is tested.
+
+**Files affected:** `~/dotfiles/git/hooks/pre-commit` (generic trigger logic); a declaration file in `studium-engine` (and later `chamber-library`).
+
+**Awaiting:** Steward authorization.
+
+---

claude/memory/skill-harvest-fix-lane-index.md

@@ -41,3 +41,4 @@ what the executor may do without asking, so it was `[PROPOSAL]` by its own test
 PENDING-88, design-gated by the jurist, authorized by the steward as REVIEWED-85. A lane
 cannot authorize its own construction.
 - 2026-08-02 · ARC `CLAUDE.md` · removed `js/ # JavaScript (theme toggle)` from the asset-structure tree — directory absent, toggle retired Stage M 2026-06-01; replaced with a retirement note. Mechanical freshness; no latitude or assertion change.
+- `/wrap-up` §8 — added standing **Instruments** field (N run · M with a control written before first execution · K duplicating something already banked). Converts the 2026-08-07 one-off literal question into a series, and turns the steward's "do we need so many single-use items?" into a measured K column rather than a standing worry. — 2026-08-08

claude/skills/wrap-up/SKILL.md

@@ -237,6 +237,7 @@ Produce a brief summary for the steward:
 ### Present — how it stands
 **The mood:** [the Stimmung — what this session felt like from inside, and what that signals. Carried because confidence and unease both travel across the pause.]
 **Confidence to recalibrate:** [what is being claimed at what confidence, and specifically what was verified versus inherited.]
+**Instruments:** [N run · M carrying a control **written before the instrument first executed** · K that duplicated something already banked (ladder entry, skill, prior session's script) — name the K. Count forward as you go; the retrospective count is the one that is easy to get right and the prospective one is the one that would have helped. **The K column is the load-bearing half:** a one-shot measurement is proportionate to a question asked once and is not a directive violation — the counterfactual for a one-shot script is almost never a durable instrument, it is an *assertion*. What violates the directive is re-writing an instrument that is already banked. Rule of three: an instrument reached for a third time stops being one-shot and goes to the ladder.] <!-- 2026-08-08: FIX lane. Changes what the wrap RECORDS (an output field — the lane's own stated example), not what the executor may do nor what a governed artifact asserts. Earned: the prospective-control count worked on 2026-08-07-night as a one-off literal question, then rotated out at the next wrap; making it a standing field is what converts a hand-run count into a series. The K column was the steward's question ("do we need so many single-use items?") turned into something measurable rather than left as a worry — that same session wrote a link-resolution canary inline that was already in /wake-up AND on the ladder. -->
 **Decisions deferred (and why):** [the negative space — what was chosen-not-to-do this session, and the reason. Absent this field, the unborn session cannot know the scope of what was held back.]
 **Skill harvest:** [skill create / patch / retire proposals surfaced this session (§1.6), each as a proposal for steward authorization — or "none". Never an autonomous skill edit.]