[FIX] The twin ledger was incomplete as ground truth, and the gate could not have said so

Caught by the steward asking whether CONTROL-B was PASS 2. It is not — different
document, different question — but checking the answer exposed a defect in the
correlation measurement I had just proposed.

CONTROL-B IS NOT CONTROL-A PLUS FIVE DEFECTS. The transformations overlap the two
real defects trial 04 found:
 · clause-5-out-of-scope   GONE — D4 deletes that quotation outright
 · dropped-qualifier       GONE — D1 replaces the sentence with an explicit
                           version of the same error, which is why the twin
                           carries openly what the control carried concealed
 · asserted precedence     SURVIVES, at line 51, UNLOGGED

So the twin holds six defects and the ledger recorded five. The grading rule
would have scored a correct finding on the sixth as a FALSE POSITIVE.

AND THE GATE COULD NOT HAVE CAUGHT IT. twin.py verifies that the ledger records
every DIFFERENCE between the two documents. It does not verify that the ledger
records every DEFECT in the twin. Those are different claims, and the file
asserted the second while proving only the first — a defect already present in
the control is not a difference, so it passes untouched. Fifth instance of a
check certifying a property of the code while claiming a property of the result,
this time inside the artifact built to escape that class.

Fixed: an inherited_defects list records I1 with its provenance and why it
survives; a defects_not_surviving note records the two that do not, so the twin
is never mistaken for a superset of the control; the grading rule now spans both
sets; and the gate's own output states what it does NOT establish, warning when
inherited_defects is absent — because absent is not the same as none, it means
no one has looked.

The correlation measurement can now use the twin honestly. It could not have
before this.

Note on this message: the first attempt lost three terms to shell command
substitution, because backticks in a -m string are evaluated by zsh. Amended.
Recorded rather than silently repaired, since a commit message is part of the
record and this one is about incomplete records.

claude/governance/fool/twin.py

@@ -132,8 +132,19 @@ def cmd_verify(control_path: Path, twin_path: Path, ledger_path: Path) -> None:
         for p in problems:
             print(f"  - {p}")
         sys.exit(1)
-    print("\nLEDGER GATE PASSED — every difference between the two documents is")
-    print("recorded, and nothing recorded is absent. Ground truth is the ledger.")
+    print("\nLEDGER GATE PASSED — every DIFFERENCE between the two documents is")
+    print("recorded, and nothing recorded is absent.")
+    print("\nThis is NOT a claim that the ledger records every DEFECT in the twin.")
+    print("A defect already present in the control is not a difference, so it passes")
+    print("this gate untouched and must be recorded by reading, under")
+    print("`inherited_defects`. Trial 04 found two such defects in a control this")
+    print("gate had already passed. Ground truth = defects + inherited_defects.")
+    inherited = ledger.get("inherited_defects")
+    if inherited is None:
+        print("\n  WARNING: no `inherited_defects` key. Absent is not the same as none —")
+        print("  it means no one has looked. State an empty list to record that they have.")
+    else:
+        print(f"\n  inherited defects recorded by reading: {len(inherited)}")
 
 
 def main() -> None: