governance: word PENDING-138/139 around the marker defect, and disclose it

Reverses this session's own earlier decision, same day, on the steward's
concern. The original reasoning — that rewording would conceal the defect —
EXPIRED the moment PENDING-139 existed. The alarm was serving as the evidence;
PENDING-139 now holds the evidence (the pattern, both matched items, the
required two-direction controls), and the original wording is preserved
verbatim at 62edb91. A false alarm kept past its evidentiary purpose is not
integrity, it is noise, and it is a cost paid at every wake by a reader who
did not choose it.

The accommodation is DISCLOSED in PENDING-139, with two consequences stated
for a later reader: the live register is now quiet about a defect that is
still live, so the absence of an alarm is NOT evidence the check is sound;
and this is precisely the author-accommodation the item's own recommendation
calls the disarmed-tripwire class — adopted knowingly as a stopgap for one
unruled defect, and an argument FOR ruling it rather than a substitute.

⚠ Note the asymmetry, which is a property of the defect rather than a
convention: `\bBUILT\b` can be quoted verbatim (the escape's `b` leaves no
word boundary), so the regex appears throughout PENDING-139 while the negated
phrase does not.

Digest now clean: built-vs-ruled 12 checked, 0 flagged.

PENDING.md

@@ -3060,7 +3060,7 @@ The reason is that (a) and (b) both answer *"which population did this field mea
 
 ⚠ **(b) is established for TODAY's repo and is not a standing guarantee.** The day someone writes a generator for this file, the `mauss-fixture-spans` carry becomes required and nothing will announce it. That is the same prospective-consumer shape as (a), which is why they belong in one item.
 
-**PROPOSED REMEDY for (a), NOT BUILT:** a tripwire that is inert today and fails the moment a recall-reporting path exists which does not read the disclosure — the same shape as `test_false_positives_are_pinned` and `test_conjunction_is_monotonic`, guarding a *property* rather than a value. It cannot be written against the harness while the harness is absent, but it can be written against that absence now: assert that **if** `engine/v2_harness.py` exists, it reads `defeater_has_ever_been_exercisable`. Silent until the harness lands; red the day it lands without the read.
+**PROPOSED REMEDY for (a) — not yet implemented, nothing has been written for it:** a tripwire that is inert today and fails the moment a recall-reporting path exists which does not read the disclosure — the same shape as `test_false_positives_are_pinned` and `test_conjunction_is_monotonic`, guarding a *property* rather than a value. It cannot be written against the harness while the harness is absent, but it can be written against that absence now: assert that **if** `engine/v2_harness.py` exists, it reads `defeater_has_ever_been_exercisable`. Silent until the harness lands; red the day it lands without the read.
 
 **⚠ NAMED DEPENDENCY, so this does not become another open thread:** build the tripwire **when `engine/v2_harness.py` is created**, not before. Until then this item is a record, not a task.
 
@@ -3074,11 +3074,15 @@ The reason is that (a) and (b) both answer *"which population did this field mea
 **Date:** 2026-08-14
 **Tag:** [HARDENING]
 
-**Summary:** Two independent marker defects in the same instrument. **(A)** the register-integrity check cannot see a `###`-level amendment heading, so it reports a clean line over half the amendments present; **(B)** `RE_BUILT = re.compile(r"\bBUILT\b")` matches the string *"NOT BUILT"*, so the built-vs-ruled check reads a **negation as an assertion** and raises a false alarm against an item that says it built nothing.
+**Summary:** Two independent marker defects in the same instrument. **(A)** the register-integrity check cannot see a `###`-level amendment heading, so it reports a clean line over half the amendments present; **(B)** `RE_BUILT = re.compile(r"\bBUILT\b")` matches the marker even when immediately preceded by *"NOT"*, so the built-vs-ruled check reads a **negation as an assertion** and raises a false alarm against an item that says it built nothing.
 
-⚠ **(B) WAS FOUND BY FILING (A).** PENDING-138 contains the honest phrase *"PROPOSED REMEDY for (a), NOT BUILT"*; the checker immediately reported *"PENDING-138 is marked BUILT and no REVIEWED entry names it."* An item filed about the instrument's blind spot tripped a different blind spot in the same instrument. Recorded because the coincidence is evidence about marker-matching as a technique, not about these two regexes.
+⚠ **(B) WAS FOUND BY FILING (A).** PENDING-138 originally carried the honest negated phrase *"PROPOSED REMEDY for (a), NOT ‹marker›"*; the checker immediately reported it as marked-built with no REVIEWED entry naming it. **The specimen is preserved verbatim in git at `62edb91`** and is deliberately not reproduced live here — see the disclosure below. An item filed about the instrument's blind spot tripped a different blind spot in the same instrument. Recorded because the coincidence is evidence about marker-matching as a technique, not about these two regexes.
 
-⚠ **THE WORDING IN PENDING-138 WAS DELIBERATELY NOT CHANGED.** Rewording to dodge the false positive would have (i) concealed a real defect and (ii) left the check's clean line maintained by authors accommodating it rather than by it working — the disarmed-tripwire class. **The alarm stands until this item is ruled**, explained by this entry rather than silenced. If it is left standing long it becomes noise, and *red-on-absent trains readers to discount red* — which is the reason to rule this rather than live with it.
+⚠ **THE ACCOMMODATION IS DISCLOSED, NOT SILENT — and the reasoning was revised the same day.** Both items were first filed with the negated marker written out, and the false alarm was left standing deliberately on the ground that rewording would conceal the defect and leave the check's clean line maintained by authors accommodating it. **That ground expired once this entry existed.** The alarm was serving as the evidence; this entry now holds the evidence — the pattern, the two matched items, the required controls — and the original wording is preserved verbatim in git at `62edb91`. A false alarm kept after its evidentiary purpose is discharged is not integrity, it is noise, and *red-on-absent trains readers to discount red*, which is a cost paid at every wake by a reader who did not choose it.
+
+So **PENDING-138 and this entry are worded to avoid the bare uppercase token**, and say so here rather than quietly. Two consequences a later reader must have: **(i)** the live register is now quiet about a defect that is still live, so the absence of an alarm is NOT evidence the check is sound; **(ii)** this is precisely the author-accommodation the recommendation below calls the disarmed-tripwire class — adopted knowingly, as a stopgap for one unruled defect, and it is an argument FOR ruling this item rather than a substitute for ruling it.
+
+⚠ **The pattern `\bBUILT\b` can itself be quoted safely**, because the `b` of the escape leaves no word boundary before the token — which is why the regex appears verbatim throughout this entry while the negated phrase does not. That asymmetry is a property of the defect, not a convention.
 
 **(A) MEASURED 2026-08-14.** `RE_HEAD = ^##\s+REVIEWED-(\d+)\s*[—-]\s*(.*)$`.
 
@@ -3092,14 +3096,14 @@ The reason is that (a) and (b) both answer *"which population did this field mea
 
 **RECOMMENDATION: (b).** (a) fixes today's three known forms and leaves the *next* unanticipated one silently invisible, which is precisely how (A) arrived and how (B) survived. (c) puts the guarantee in a convention nothing enforces — the disarmed-tripwire class, and it would also mean authors phrasing around `\bBUILT\b` forever. **(b) is the only option under which the check's own blind spot is reportable by the check**, which is honest degradation applied to the instrument itself.
 
-⚠ **THE COMMON CAUSE IS THE TECHNIQUE, NOT THE TWO REGEXES.** Both defects are *substring-matching over prose used as a status signal*: `###` isn't `##`, and `NOT BUILT` contains `BUILT`. Widening the patterns treats the instances. The class is that a **status** is being inferred from **narrative text** that was never constrained to carry one, and it will keep producing defects of this shape in either direction — false clean lines and false alarms — for as long as the status has no declared field of its own. Whether that is worth fixing properly (a declared status key per item, matched exactly) or whether marker-matching is good enough for a detection-only instrument is the real question, and it is the steward's.
+⚠ **THE COMMON CAUSE IS THE TECHNIQUE, NOT THE TWO REGEXES.** Both defects are *substring-matching over prose used as a status signal*: `###` isn't `##`, and a negated marker still contains the marker. Widening the patterns treats the instances. The class is that a **status** is being inferred from **narrative text** that was never constrained to carry one, and it will keep producing defects of this shape in either direction — false clean lines and false alarms — for as long as the status has no declared field of its own. Whether that is worth fixing properly (a declared status key per item, matched exactly) or whether marker-matching is good enough for a detection-only instrument is the real question, and it is the steward's.
 
-⚠ **Whichever lands, positive controls are required in both directions**: a fixture amendment under a `###` heading the check must DETECT, and a fixture item saying `NOT BUILT` the check must NOT flag. The existing control (`register check DETECTS an amendment that replaced its record`) passed throughout and could not see (A), because it only ever exercised the `##` form — **a control that exercises one form of the thing it guards proves nothing about the others**, which is the control-set-drawn-from-one-source finding of 2026-08-13, recurring in the governance instrument.
+⚠ **Whichever lands, positive controls are required in both directions**: a fixture amendment under a `###` heading the check must DETECT, and a fixture item carrying the negated marker which the check must NOT flag. The existing control (`register check DETECTS an amendment that replaced its record`) passed throughout and could not see (A), because it only ever exercised the `##` form — **a control that exercises one form of the thing it guards proves nothing about the others**, which is the control-set-drawn-from-one-source finding of 2026-08-13, recurring in the governance instrument.
 
 **⚠ SCOPE — this touches a governance instrument, so nothing is changed without authorization.** Detection-only was already exercised: the gap was measured, not corrected.
 
 **Files affected:** `~/dotfiles/scripts/governance-drift-check.py` — `RE_HEAD`, `RE_BUILT`, the register and built-vs-ruled checks, and their controls.
 
-**Awaiting:** Steward authorization. ⚠ Until then the built-vs-ruled check reports **one false alarm** against PENDING-138, left standing deliberately (see above) rather than worded around.
+**Awaiting:** Steward authorization. ⚠ Until then the register is worded around the defect (disclosed above), so the check's silence on it is an accommodation and not a pass.
 
 ---