diff --git a/PENDING.md b/PENDING.md
index a9f2597..fe1a53e 100644
--- a/PENDING.md
+++ b/PENDING.md
@@ -1953,6 +1953,22 @@ The `0 of 17` → `0 of 14` figure the jurist saw is a **secondary** paragraph o
 
 ---
 
+### AMENDMENT 3 — 2026-08-08, BUILT (merged with PENDING-126, `8ff5a9f`)
+
+**Merged with 126 because they are one subject** — 122 is *three suites crash instead of reporting*, 126 hole 2 is *`test_navigate` crashes instead of naming*: same shape, overlapping files, and **hole 2 was a prerequisite** (while suites raise, `cannot-assess` cannot be told from red).
+
+**Built.** `tests/_fleet.py` gives suites **exit 3** — could not assess at all. `run-fleet.sh` renders `[----]` with **reason and remedy** and withdraws the word *green*. The generalization is of **`test_retrieve.py`'s existing shape**, not a second one.
+
+⚠ **TWO STRENGTHS OF WEAKENING, deliberately not one.** A suite-level `cannot-assess` withdraws *green*; a per-check skip is **counted but does not**. Treating both alike made *"NOT A CLEAN PASS"* **permanent**, because one long-standing skip is vacuous-by-corpus-state — and that is the jurist's own **Q1 warning** (a check that always says the same thing stops being read) arriving in the fix rather than the defect. Caught by running it.
+
+**Exit stays 0 for both.** An unreachable subject is an environment condition; refusing the commit would be the **red-on-absent** failure REVIEWED-104 names. The **claim** is weakened, not the commit.
+
+**122's actual ask is in:** `test_ingest_gate` now compares **DECLARED sha to LIVE bytes** over the manifest. Because it reaches outside the repo (**chamber-library AND animal-davidglidden-eu**), unreachable sources report as **named skips per source**, never folded into the pass.
+
+**Acceptance both directions.** Clean → 7 suites green. Fresh clone without `index.db` → **3 CANNOT ASSESS** with reason + remedy, **no traceback**, exit 0.
+
+---
+
 ## PENDING-123 — The pre-commit hook cannot distinguish "nothing to check" from "I am disarmed"
 
 **Date:** 2026-08-08
@@ -2141,7 +2157,17 @@ Three cases, all discriminated: a rule ran → existing output already says so,
 
 **Files affected:** `~/_Dev/studium-engine/tests/test_reading_index.py`, `~/_Dev/studium-engine/tests/test_navigate.py`.
 
-**Awaiting:** Steward authorization (D-1 lane).
+**Awaiting:** ~~Steward authorization (D-1 lane).~~ → **BUILT 2026-08-08, `8ff5a9f`** (merged with PENDING-122).
+
+---
+
+### AMENDMENT 1 — 2026-08-08, built; hole 2 was a CLASS, not an instance
+
+**Hole 1 closed.** `close_ranges`' `section_end` bound is now guarded, both branches. Discriminating negative run: **bound removed → 2 named failures citing the exact values (499, 400); restored → 47/47.** The removal was already proven invisible, which is what made it a real negative rather than a synthetic one. ⚠ The fixtures themselves are **synthetic of necessity** — the live corpus never exercises the branch, which is precisely why the gap survived.
+
+**Hole 2 was three sites, not one.** I filed it as *"a suite that crashes instead of failing"*; `test_navigate.py` carried **three** bare `next(...)` calls over generators. Fixed as a class with one guarded helper. **Induced citability break: was a single `StopIteration` traceback → now SEVEN named failures**, each saying what broke and why the dependent checks did not run. The exit code was always right; the legibility is what changed.
+
+**⚠ Option (c) — the census — is NOT done and remains open.** Two holes found without looking is not a base rate. The bounded sweep (7 suites; are other rules asserted-in-prose and unguarded? do other suites crash rather than name?) is still owed, and finding three more `next()` calls in the first suite I opened is weak evidence the class is wider than two.
 
 ---