[HARDENING] PENDING-165 AMENDMENT 1: (d) was blind to the damaging occurrence; (c) is not a binary

Jurist correction, accepted. Option (d) as filed reported files that are neither
tracked nor pre-commit. The 066a47a occurrence WAS tracked, for four weeks, so
the check would have been silent throughout the only occurrence that did damage.
It sees deposit and not capture, and capture is the laundering — the item own
thesis. Corrected to an allowlist: git/hooks contains exactly README.md and
pre-commit, anything else is a finding tracked or not, and anything MISSING is
also a finding per REVIEWED-105 section 2.

This is the executor own standard — ask which failure class a green check can see
— applied to the executor filing by the other party. Recorded as an instance of
Constraint 6 rather than quietly repaired.

Option (c) decoupled: the 552 LFS objects are local, so a cold archive preserves
the backup byte-for-byte and git-lfs is needed only at restore. Precondition
measured, which was the executor figure to supply: 399 of 399 tracked files
resolve from local objects, 0 remote-only. COMPLETE, the reframe holds. Keeping
the backup and removing the vector are not exclusive.

Do NOT run git lfs migrate export on the backup: it rewrites commits and destroys
the exact-preservation property that is the snapshot only reason to exist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NvZAKSf9aqratbqHbU9LK5

PENDING.md

@@ -6040,3 +6040,42 @@ The jurist asked: does the directory carry a *governed* hook under any of those
 
 **Files affected:** `~/dotfiles/git/hooks/` (shims removed, twice, not otherwise modified); `Brewfile:40` (not modified).
 **Awaiting:** Steward authorization.
+
+### PENDING-165 — AMENDMENT 1: option (d) was blind to the only occurrence that did damage; option (c) is not the binary the item drew
+**Date:** 2026-08-26
+**Raised by:** the jurist. **JOINS the item; replaces nothing.** Both corrections accepted; the (c) precondition measured by the executor, whose figure it was.
+
+**(1) ⚠ OPTION (d) AS FILED IS HOLED, in the shape of the incident it was written for. ACCEPTED.**
+
+As filed, (d) reports *"any file in `git/hooks/` that is neither tracked nor `pre-commit`."* The `066a47a` occurrence was a **tracked** file: `git add` captured the shims and they sat tracked for four weeks. `not tracked` was false for that entire period, so **the check would have been silent throughout the only occurrence that actually did damage.** It sees deposit and not capture — **and capture is the laundering, which is this item's own thesis.**
+
+⚠ **This is the executor's own standard, applied to the executor's filing by the other party:** *ask which failure class each green check can actually see.* It was not asked here. The doctrine in Constraint 6 is that biases which fail to coincide catch what one party is not positioned to see; this is an instance, and it is recorded as one rather than quietly repaired.
+
+**(d), CORRECTED — declare the contents, do not test tracked-ness:**
+
+> `git/hooks/` contains exactly `README.md` and `pre-commit`.
+> **Anything else present is a finding, tracked or untracked.**
+> **Anything declared and missing is also a finding** — REVIEWED-105 §2 measured that an absent hook file produces zero output rather than an ambiguous silence, so absence must be asserted, not inferred.
+
+An allowlist sees the deposit *and* the four-week tracked state. A tracked/untracked test sees only the first. The allowlist also needs no knowledge of git-lfs, so it does not go stale if the vector changes.
+
+**(2) OPTION (c) IS NOT THE BINARY THE ITEM DREW, and the precondition is now measured. ACCEPTED.**
+
+The item presented (c) as *keep the backup* **or** *remove the vector*. The jurist's decoupling: the 552 objects are **local**, so a cold archive of the whole directory — `.git` and `.git/lfs/objects` included — preserves it byte-for-byte and needs no git-lfs to *hold*. git-lfs is required only at **restore**, which is a deliberate act and a `brew install` away.
+
+**The precondition the jurist named and could not measure, measured:**
+
+| | |
+|---|---|
+| LFS-tracked files at HEAD | **399** |
+| resolving from local objects | **399** |
+| remote-only (would break the archive) | **0** |
+| object files on disk | 552 (975 MB) — more than 399 because history carries prior versions |
+
+**COMPLETE. The reframe holds.** (c)'s cost is therefore *one archive operation now, one reinstall if ever restored* — not *strand a 975 MB safety copy*. The steward can keep the backup **and** remove the vector; the item was wrong to present them as exclusive.
+
+⚠ **DO NOT run `git lfs migrate export` on the backup.** It is the obvious-looking move and it rewrites commits, destroying the exact-preservation property that is the entire reason the snapshot exists. Recorded here because the next reader will think of it.
+
+**Recommendation, revised: corrected-(d) first, then (b) once (d) is live, and (c) available on the archive route whenever the steward wants the vector gone.** (c) is no longer gated on retiring the backup.
+
+**Awaiting:** Steward authorization. Nothing here is built; this corrects a specification before it is implemented, which is the cheapest point at which this correction could have landed.