[FIX] register integrity: an amendment must never replace the record it amends

REVIEWED-87's original entry (PENDING-99, the fidelity_equivalence@3
design-gate ruling of 2026-08-05) was replaced this afternoon by the
PENDING-111 amendment block placed at the same heading. The amendment's own
"**Amends:** REVIEWED-87" line then pointed at a record no longer in the
file, and the register could no longer answer what was ruled under 87 — the
register's whole job.

Recoverable, and recovered: the entry was intact in git HEAD and the
underlying jurist ruling is separately filed at
studium-engine/docs/quoted-tier-acceptance-JURIST-RULING-2026-08-05.md. But
the register entry uniquely held Q2's reframing (the route to PENDING-100),
Q3 REJECTED and its strengthened basis, Q5 CONCUR D-1, and the finding that
"the decisive sentence was one the executor had read and not surfaced, which
a verbatim-containment check passes every time."

CAUSE, and it is the executor's. The handoff draft was headed
"## REVIEWED-87 — AMENDMENT 2026-08-07" and described as "the block to
place", with no instruction that it join rather than replace. That reads as a
replacement heading, and the steward's reading of it was reasonable. The
copy-paste-clean discipline exists so a placement cannot be ambiguous, and
this draft was ambiguous.

NOTHING DETECTED IT. It surfaced because a diff was read by hand and the tell
was a deletion count on what should have been a pure append. This is
`removing-a-claim-is-not-removing-the-reliance` at the governance layer: the
amendment's dependency on the original survived the original's removal and
became invisible.

Check 7 added to governance-drift-check.py, which already runs at every wake:
every `## REVIEWED-N — AMENDMENT` requires an un-amended `## REVIEWED-N`
entry, and every `**Amends:** REVIEWED-N` must resolve. Reported separately
from the CLAUDE.md findings so that report's own claim stays true.

Controls per the standing epistemic standard, and the third is the lesson of
the day — a check that has never fired on a known-bad input is unestablished,
so the instrument is run against a synthetic reproduction of the actual
failure. Red-witnessed on a copy of the live file with the deletion replayed:
fires both findings. 11/11 controls pass.

Detection only. REVIEWED.md is [ESCALATE], the steward's hand
(Constitutional Constraint #1); the restoration above was placed by the
steward, not by the executor.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NEWjLBP4quXbDPDL2byEzZ

scripts/governance-drift-check.py

@@ -191,6 +191,70 @@ control("doctrine-id citing surface is reachable",
         (not skills_dir.is_dir()) or scanned > 0)
 
 
+# ------------------------------------------ 7. register integrity (REVIEWED)
+# EARNED 2026-08-07, from a real loss. An amendment block was placed OVER the
+# record it amends: the original `## REVIEWED-87 — PENDING-99 — …` entry was
+# replaced by `## REVIEWED-87 — AMENDMENT 2026-08-07`, leaving the amendment's
+# own `**Amends:** REVIEWED-87` line pointing at a record no longer in the file.
+# The content was recoverable from git and the underlying jurist ruling was
+# filed separately, so nothing was lost — but NOTHING DETECTED IT. It surfaced
+# because a diff was read by hand, and the tell was a deletion count on what
+# should have been a pure append.
+#
+# The class: a register whose entries can silently replace one another cannot be
+# trusted to answer "what was ruled under N", which is the register's whole job.
+# This is `removing-a-claim-is-not-removing-the-reliance` at the governance
+# layer — the amendment's dependency on the original survived the original's
+# removal, and became invisible.
+#
+# Detection only, like every check here: REVIEWED.md is [ESCALATE], the
+# steward's hand (Constitutional Constraint #1).
+REVIEWED_MD = HOME / "dotfiles" / "REVIEWED.md"
+
+RE_HEAD = re.compile(r"^##\s+REVIEWED-(\d+)\s*[—-]\s*(.*)$", re.M)
+RE_AMENDS = re.compile(r"\*\*Amends:\*\*\s*REVIEWED-(\d+)")
+
+
+def register_findings(text: str, label: str) -> list[str]:
+    """Every amendment must sit ALONGSIDE the record it amends, never replace it."""
+    out: list[str] = []
+    heads = RE_HEAD.findall(text)
+    originals = {n for n, rest in heads
+                 if not rest.strip().upper().startswith("AMENDMENT")}
+    for n, rest in heads:
+        if rest.strip().upper().startswith("AMENDMENT") and n not in originals:
+            out.append(f"{label}: '## REVIEWED-{n} — AMENDMENT' exists with no "
+                       f"un-amended REVIEWED-{n} entry — the amendment replaced "
+                       f"the record it amends")
+    for n in sorted(set(RE_AMENDS.findall(text))):
+        if n not in originals:
+            out.append(f"{label}: a block declares '**Amends:** REVIEWED-{n}' but "
+                       f"no REVIEWED-{n} entry exists in the file")
+    return out
+
+
+reg_findings: list[str] = []
+if REVIEWED_MD.exists():
+    reg_findings = register_findings(REVIEWED_MD.read_text(errors="replace"),
+                                     "REVIEWED.md")
+
+# Controls. The third is the one that matters and is the lesson of the day:
+# a check that has never fired on a known-bad input is unestablished, so the
+# instrument is run against a synthetic reproduction of the actual failure.
+_GOOD = ("## REVIEWED-87 — PENDING-99 — original\n**Date:** 2026-08-05\n\n"
+         "## REVIEGH\n\n## REVIEWED-87 — AMENDMENT 2026-08-07\n"
+         "**Amends:** REVIEWED-87 (x).\n")
+_BAD = ("## REVIEWED-87 — AMENDMENT 2026-08-07\n"
+        "**Amends:** REVIEWED-87 (x).\n")
+control("register parser finds REVIEWED headings", len(RE_HEAD.findall(_GOOD)) == 2)
+control("register check passes a correctly JOINED amendment",
+        not register_findings(_GOOD, "t"))
+control("register check DETECTS an amendment that replaced its record  "
+        "[reproduces the 2026-08-07 loss]",
+        len(register_findings(_BAD, "t")) == 2)
+control("register file is reachable", REVIEWED_MD.exists())
+
+
 # ------------------------------------------------------------- report
 failed_controls = [lbl for lbl, ok in controls if not ok]
 if failed_controls:
@@ -210,4 +274,20 @@ else:
     print("\n  Correction requires [ESCALATE] (Constitutional Constraint #1). "
           "This report is detection only.")
 
+# Register integrity is reported SEPARATELY. Folding it into the count above
+# would make that line's own claim false — it says "claim(s) in ~/CLAUDE.md",
+# and these are findings about a different file.
+if reg_findings:
+    print(f"\n⚑ register integrity: {len(reg_findings)} broken amendment link(s) "
+          f"in ~/REVIEWED.md")
+    for f in reg_findings:
+        print(f"    {f}")
+    print("\n  An amendment must sit alongside the record it amends, never replace it.")
+    print("  Correction requires [ESCALATE] — REVIEWED.md is the steward's hand.")
+elif REVIEWED_MD.exists():
+    n_am = sum(1 for _, r in RE_HEAD.findall(REVIEWED_MD.read_text(errors="replace"))
+               if r.strip().upper().startswith("AMENDMENT"))
+    print(f"✓ register integrity: every amendment link resolves "
+          f"({n_am} amendment(s) checked)")
+
 sys.exit(0)