[FIX] PENDING-164 (c)+(d): prior-art search, one implementation, two surfaces

Steward-authorized in session. prior-art.py searches commit messages across every
owned repo with NO count window and reports the register's mention count beside
it; the executor runs it as a CLI (d) and governance-mcp.py exposes it as
prior_art (c). One implementation on purpose — a value computed twice on two
sides of a boundary is how the parties end up with different answers.

Verified on the case that motivated the item: 'LFS' returns 20 commits including
0677e8a and 95760ff, both past repo_activity's 100-commit floor, one of them in
dotfiles which is not in REPOS. The positive control forced the enumeration to be
COMPUTED from remote ownership rather than copied from REPOS, or 95760ff would
have been unreachable and the control would have failed.

Had this existed this morning, one command before filing PENDING-163 would have
returned 0677e8a and 400c054.

⚠ Its first run returned zero and the control caught it: sh() discarded stdout on
non-zero exit, and find over $HOME exits 1 from 154 unreadable Library dirs while
printing all 37 repos. Third false-zero of the day, first one caught before being
believed — the difference is that the jurist pre-specified what it must return.

AMENDMENT 1's census: mechanical half runs (661 candidates, narrowed to 270),
interpretive half does not. Identifying WHICH mechanism a commit decided about is
interpretation, not extraction. Limit declared rather than a column manufactured.
The backlog is NOT censused and no number here is one.

Extending the read-only guarantee to delegates found a pre-existing hole: bare
.replace flagged str.replace() (why it had never been extended), and wake-digest,
a delegate since before today, was never covered. Its only real mutation is
emit_brief(), its hook role, unreachable from any tool. Now a declared exemption
per delegate, so a new mutating function fails until named.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NvZAKSf9aqratbqHbU9LK5

PENDING.md

@@ -6079,3 +6079,34 @@ The item presented (c) as *keep the backup* **or** *remove the vector*. The juri
 **Recommendation, revised: corrected-(d) first, then (b) once (d) is live, and (c) available on the archive route whenever the steward wants the vector gone.** (c) is no longer gated on retiring the backup.
 
 **Awaiting:** Steward authorization. Nothing here is built; this corrects a specification before it is implemented, which is the cheapest point at which this correction could have landed.
+
+### PENDING-164 — BUILD RECORD + AMENDMENT 1 result: (c) and (d) built; the census's second half is not mechanical
+**Date:** 2026-08-26
+**Authorization:** steward, in session — *"Pending 164 c + d authorized with the amendment."*
+
+**(c) and (d) are built, as ONE implementation with two surfaces.** `scripts/prior-art.py` searches commit messages across every owned repo with **no count window**, and reports the register's mention count beside it. The executor runs it as a CLI (**(d)**, the pre-proposal check); `governance-mcp.py` exposes it as `prior_art` (**(c)**, the jurist's reach). One implementation deliberately — a value computed twice on two sides of a boundary is how the two parties end up with different answers.
+
+**The finding it looks for is the ASYMMETRY**, not the hits: commits mention it, the register does not. That is a decision taken in a repo and never routed into the record.
+
+**Verified against the case that motivated the item.** Run on `LFS` it returns **20 commits including `0677e8a` and `95760ff`** — both beyond `repo_activity`'s 100-commit floor, one of them in `dotfiles`, which is not in `REPOS` at all. ⚠ **The positive control forced the enumeration**: had owned repos been copied from `REPOS`, `95760ff` would have been unreachable and the control would have failed. Repos are now **computed from remote ownership**, not hand-listed.
+
+⚠ **Had this existed this morning, one command before filing PENDING-163 would have returned `0677e8a` and `400c054`. The entire afternoon's detour was one command away.**
+
+**⚠ The instrument's first run returned zero, and the control caught it.** `sh()` discarded stdout on a non-zero exit; `find` over `$HOME` exits 1 because 154 directories under `Library` are unreadable — **while printing all 37 repos to stdout.** Every search returned nothing. Without the control that is a clean, confident *"no prior art"* for every term ever queried. **This is the third false-zero of the day and the first one a control caught before it was believed** — the difference from the census's zsh zero is entirely that the jurist pre-specified what the instrument must return.
+
+**AMENDMENT 1's census: the mechanical half runs; the interpretive half does not, and that IS the result.**
+
+| verb set | candidates |
+|---|---|
+| first, incl. "remove"/"replace with"/"no longer" | **661** |
+| narrowed to strong retirement/adoption forms | **270** (243 outside `dotfiles`) |
+
+Neither number is a census result — both are haystacks. The specification has two halves: grep the verbs, **then check each hit against the register**. The first is mechanical. The second requires reading each commit to identify *which mechanism it decided about*, and that is interpretation, not extraction. **The same shape as PENDING-151 step 1, where propositions could not be extracted mechanically either — and, as there, the honest move is to declare the limit rather than manufacture the column.**
+
+**⇒ The backlog is NOT censused, and no number here should be read as one.** What exists is a candidate list of 270, unclassified. Classifying it is a reading task of a few hours, and it is proposed as such rather than smuggled in as a result. **The forward-looking halves — (c) and (d) — are complete and need nothing further.**
+
+**Files:** `scripts/prior-art.py` (new), `scripts/governance-mcp.py` (+`prior_art`, +9 controls).
+
+⚠ **The read-only guarantee was extended, and doing so found a pre-existing hole.** `governance-mcp.py` proves read-only-ness by AST **over itself**; adding a delegate put code outside that proof. Extending it to delegates surfaced (a) a **false-positive class** — bare `.replace` flagged `str.replace()`, which is why the guarantee had never been extended past one file — and (b) that `wake-digest.py`, a delegate **since before today**, was never covered. Its only real mutation is `emit_brief()`, its SessionStart-hook role, unreachable from any tool. Now handled by **declared exemption per delegate**, so a new mutating function fails until someone names it and says why — the same shape as PENDING-165's allowlist, and for the same reason.
+
+**Awaiting:** nothing on (c)/(d). The 270-candidate classification pass is unscheduled and unclaimed.