From bcc02ada3d78974507c9f80638d86b1797ca421c Mon Sep 17 00:00:00 2001 From: David F Glidden Date: Fri, 7 Aug 2026 17:21:07 +0200 Subject: [PATCH] [FIX] register integrity: an amendment must never replace the record it amends MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit REVIEWED-87's original entry (PENDING-99, the fidelity_equivalence@3 design-gate ruling of 2026-08-05) was replaced this afternoon by the PENDING-111 amendment block placed at the same heading. The amendment's own "**Amends:** REVIEWED-87" line then pointed at a record no longer in the file, and the register could no longer answer what was ruled under 87 — the register's whole job. Recoverable, and recovered: the entry was intact in git HEAD and the underlying jurist ruling is separately filed at studium-engine/docs/quoted-tier-acceptance-JURIST-RULING-2026-08-05.md. But the register entry uniquely held Q2's reframing (the route to PENDING-100), Q3 REJECTED and its strengthened basis, Q5 CONCUR D-1, and the finding that "the decisive sentence was one the executor had read and not surfaced, which a verbatim-containment check passes every time." CAUSE, and it is the executor's. The handoff draft was headed "## REVIEWED-87 — AMENDMENT 2026-08-07" and described as "the block to place", with no instruction that it join rather than replace. That reads as a replacement heading, and the steward's reading of it was reasonable. The copy-paste-clean discipline exists so a placement cannot be ambiguous, and this draft was ambiguous. NOTHING DETECTED IT. It surfaced because a diff was read by hand and the tell was a deletion count on what should have been a pure append. This is `removing-a-claim-is-not-removing-the-reliance` at the governance layer: the amendment's dependency on the original survived the original's removal and became invisible. Check 7 added to governance-drift-check.py, which already runs at every wake: every `## REVIEWED-N — AMENDMENT` requires an un-amended `## REVIEWED-N` entry, and every `**Amends:** REVIEWED-N` must resolve. Reported separately from the CLAUDE.md findings so that report's own claim stays true. Controls per the standing epistemic standard, and the third is the lesson of the day — a check that has never fired on a known-bad input is unestablished, so the instrument is run against a synthetic reproduction of the actual failure. Red-witnessed on a copy of the live file with the deletion replayed: fires both findings. 11/11 controls pass. Detection only. REVIEWED.md is [ESCALATE], the steward's hand (Constitutional Constraint #1); the restoration above was placed by the steward, not by the executor. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NEWjLBP4quXbDPDL2byEzZ --- REVIEWED.md | 55 +++++++++++++++++++++ scripts/governance-drift-check.py | 80 +++++++++++++++++++++++++++++++ 2 files changed, 135 insertions(+) diff --git a/REVIEWED.md b/REVIEWED.md index c2f30c2..d34537c 100644 --- a/REVIEWED.md +++ b/REVIEWED.md @@ -918,6 +918,61 @@ brief. No work is blocked meanwhile; `wake-digest.py --brief` remains the fallba **Notes:** Q1 AUTHORIZED, [^n] / _emphasis_ only — but NOT on the package's own reading that this aligns the engine with an already-ratified chamber principle. §II.3 states the marker's exact syntax remains OPEN, so no such ratification exists to align with; recording it that way would overstate the constitution. Authorized instead on (i) the engine's own fidelity_equivalence@2 governing test, independent of the chamber question, and (ii) functional analogy to §II.3's stated reason for excluding its own anchor marker — that a legitimate re-extraction adding recovered anchors would falsely fail a word-multiset comparison, which is the identical shape PENDING-99 measured. Q2 ANSWERED as a reframing rather than a yes/no: §II.3's marker doctrine governs citation-scheme anchors (Stephanus, Bekker), not footnotes; the real open question is whether a footnote's inline REFERENCE MARKER — as distinct from its display number (§V, carrier artifact) and its text (§V, Tier-3, inviolable) — is excluded from word-identity comparison, which neither clause addresses. Routed to the chamber-side PROPOSAL that closes §II.3's marker-syntax item, so both open edges close together. Does not block Q1. Q3 REJECTED as filed, disposition unchanged and basis strengthened: chamber §V Tier 3's "preserved and flagged... never corrected in the canonical text" makes a dropped trailing period a silent correction, not only an engine-side F5 shape. Q4 outside the gate. Q5 CONCUR, D-1. First ruling made with governance_read reaching chamber-spec (PENDING-86 (a), same day) — the jurist records that the ruling changed materially once the primary text was reachable, and that the decisive sentence was one the executor had read and not surfaced, which a verbatim-containment check passes every time. **If AUTHORIZED:** Build fidelity_equivalence@3 = @2 + markup-delimiter exclusion, test-first and witnessed red, with @1/@2 preserved frozen and verdicts naming their relation (superset-only, so no re-verification obligation). Pre-registered effect on the Mauss gold: 3/17 to 6/17 at corrected anchors. Carry Q2 to the chamber side as a named open item. Tag commits REVIEWED-87. +## REVIEWED-87 — AMENDMENT 2026-08-07 (PENDING-111) + +**Amends:** REVIEWED-87 (`fidelity_equivalence@3`, ratified 2026-08-05). +**Authority:** PENDING-111 jurist design-gate ruling, Q1 AUTHORIZE / Q2 +correction-in-place, conditions (a) and (b). +**Version:** `fidelity_equivalence@3` — unchanged. Corrected in place, not bumped. +`@1`/`@2` frozen and untouched; **`@4` remains reserved for the Greek/Latin census.** + +**The defect.** REVIEWED-87 authorized excluding the markdown emphasis +*delimiter* — the word used twice, with "not to markup as a class" added to keep +the scope narrow. The mechanism shipped as `re.compile(r"[_*]")`: a bare +character class with no notion of pairing, adjacency, or escaping. It therefore +stripped the asterisk out of a **backslash-escaped literal** — `COMPOST\*` +became `COMPOST\` — implementing something broader than the ruling authorized. +The ruling's text was unambiguous; the regex failed to implement it. Under this +system's constitution/mechanism split that is a mechanism defect against +standing doctrine, not new doctrine — hence correction in place. + +**What it erased.** In *A Pattern Language* the escaped asterisks are Alexander's +own confidence rating: two = a solution he holds to be a true invariant, one = +progress toward one, none = far from one ("Using this book", L141/L143 of the +manifested file). Census by reading index, 2026-08-07: **83 / 114 / 56 across all +253 patterns.** + +**The fix.** The emphasis exclusion now applies to **unescaped delimiters only**. +An escaped `\*` / `\_` is content and normalizes to its literal character — +backslash dropped, character kept. Implemented as a single left-to-right scan +(`engine/fidelity.py::_fold_emphasis`), not a lookbehind plus unescape pass, +because the two-pass form mis-reads an escaped backslash before a real delimiter. + +**Bounded window:** 2026-08-05 (REVIEWED-87 ratified, `@3` governing) → +2026-08-07 (this correction landing). + +**Scope — sources containing escaped emphasis characters.** Censused 2026-08-07 +across all 13 manifested sources (Q3, which follows and does not gate): +**3 sources, not 1** — `alexander-pattern-language` (293 occurrences), +`musil-the-man-without-qualities` (16), `arendt-eichmann` (1). The ruling's +scope line said "currently known to be Alexander only"; that was the state of +knowledge at ruling time and the census supersedes it. + +**Verdicts affected: none measured, in either direction.** The correction is +monotonic by construction (the exclusion set strictly narrows), and measurement +found no verdict that moved: the phase-2 Mauss gold holds at 6/17 accepted +before and after, and on the three realistic Alexander comparisons +(engine-constructed citation; human transcription including the rating; human +transcription omitting it) old and new agree in every case. **No verdict issued +in the window is known to have overclaimed** — see the amendment note below, +which corrects the premise on which that phrase was required. + +**Remedy shipped with the required falsifier** (`tests/test_fidelity_v3.py`, +33 checks): `COMPOST\*`, `COMPOST\*\*` and `COMPOST` compare distinct; +`*property*` still folds; and — per the jurist's addition — an escaped literal +nested inside a genuine delimiter pair separates correctly +(`*text with \* inside*` → `text with * inside`). + ## REVIEWED-88 — PENDING-101 — Cross-repo research brief: structural implications of INC-2026-07-28-01 **Date:** 2026-08-06 **Provenance:** Reconstructed by the executor 2026-08-06 from the session record — the INC-2026-07-28-01 package carries no filed ruling document (PENDING-108). Read against the jurist's own account and CONFIRMED 2026-08-06; the jurist additionally endorsed the design-transfer reading recorded below as a fair correction to the brief as it was written. NOT RECOVERED: the jurist's stated reasons for striking findings (1) and (3). Only the fact of the striking survives. If those reasons are ever needed as precedent they must be re-elicited, not inferred from this entry. diff --git a/scripts/governance-drift-check.py b/scripts/governance-drift-check.py index 9c0c74c..97cd3c1 100755 --- a/scripts/governance-drift-check.py +++ b/scripts/governance-drift-check.py @@ -191,6 +191,70 @@ control("doctrine-id citing surface is reachable", (not skills_dir.is_dir()) or scanned > 0) +# ------------------------------------------ 7. register integrity (REVIEWED) +# EARNED 2026-08-07, from a real loss. An amendment block was placed OVER the +# record it amends: the original `## REVIEWED-87 — PENDING-99 — …` entry was +# replaced by `## REVIEWED-87 — AMENDMENT 2026-08-07`, leaving the amendment's +# own `**Amends:** REVIEWED-87` line pointing at a record no longer in the file. +# The content was recoverable from git and the underlying jurist ruling was +# filed separately, so nothing was lost — but NOTHING DETECTED IT. It surfaced +# because a diff was read by hand, and the tell was a deletion count on what +# should have been a pure append. +# +# The class: a register whose entries can silently replace one another cannot be +# trusted to answer "what was ruled under N", which is the register's whole job. +# This is `removing-a-claim-is-not-removing-the-reliance` at the governance +# layer — the amendment's dependency on the original survived the original's +# removal, and became invisible. +# +# Detection only, like every check here: REVIEWED.md is [ESCALATE], the +# steward's hand (Constitutional Constraint #1). +REVIEWED_MD = HOME / "dotfiles" / "REVIEWED.md" + +RE_HEAD = re.compile(r"^##\s+REVIEWED-(\d+)\s*[—-]\s*(.*)$", re.M) +RE_AMENDS = re.compile(r"\*\*Amends:\*\*\s*REVIEWED-(\d+)") + + +def register_findings(text: str, label: str) -> list[str]: + """Every amendment must sit ALONGSIDE the record it amends, never replace it.""" + out: list[str] = [] + heads = RE_HEAD.findall(text) + originals = {n for n, rest in heads + if not rest.strip().upper().startswith("AMENDMENT")} + for n, rest in heads: + if rest.strip().upper().startswith("AMENDMENT") and n not in originals: + out.append(f"{label}: '## REVIEWED-{n} — AMENDMENT' exists with no " + f"un-amended REVIEWED-{n} entry — the amendment replaced " + f"the record it amends") + for n in sorted(set(RE_AMENDS.findall(text))): + if n not in originals: + out.append(f"{label}: a block declares '**Amends:** REVIEWED-{n}' but " + f"no REVIEWED-{n} entry exists in the file") + return out + + +reg_findings: list[str] = [] +if REVIEWED_MD.exists(): + reg_findings = register_findings(REVIEWED_MD.read_text(errors="replace"), + "REVIEWED.md") + +# Controls. The third is the one that matters and is the lesson of the day: +# a check that has never fired on a known-bad input is unestablished, so the +# instrument is run against a synthetic reproduction of the actual failure. +_GOOD = ("## REVIEWED-87 — PENDING-99 — original\n**Date:** 2026-08-05\n\n" + "## REVIEGH\n\n## REVIEWED-87 — AMENDMENT 2026-08-07\n" + "**Amends:** REVIEWED-87 (x).\n") +_BAD = ("## REVIEWED-87 — AMENDMENT 2026-08-07\n" + "**Amends:** REVIEWED-87 (x).\n") +control("register parser finds REVIEWED headings", len(RE_HEAD.findall(_GOOD)) == 2) +control("register check passes a correctly JOINED amendment", + not register_findings(_GOOD, "t")) +control("register check DETECTS an amendment that replaced its record " + "[reproduces the 2026-08-07 loss]", + len(register_findings(_BAD, "t")) == 2) +control("register file is reachable", REVIEWED_MD.exists()) + + # ------------------------------------------------------------- report failed_controls = [lbl for lbl, ok in controls if not ok] if failed_controls: @@ -210,4 +274,20 @@ else: print("\n Correction requires [ESCALATE] (Constitutional Constraint #1). " "This report is detection only.") +# Register integrity is reported SEPARATELY. Folding it into the count above +# would make that line's own claim false — it says "claim(s) in ~/CLAUDE.md", +# and these are findings about a different file. +if reg_findings: + print(f"\n⚑ register integrity: {len(reg_findings)} broken amendment link(s) " + f"in ~/REVIEWED.md") + for f in reg_findings: + print(f" {f}") + print("\n An amendment must sit alongside the record it amends, never replace it.") + print(" Correction requires [ESCALATE] — REVIEWED.md is the steward's hand.") +elif REVIEWED_MD.exists(): + n_am = sum(1 for _, r in RE_HEAD.findall(REVIEWED_MD.read_text(errors="replace")) + if r.strip().upper().startswith("AMENDMENT")) + print(f"✓ register integrity: every amendment link resolves " + f"({n_am} amendment(s) checked)") + sys.exit(0)