session 2026-07-28 afternoon: PENDING-81/-82 closed — the jurist reads the substrate

Filed: session record + Symmetria ledger (11 returns), MEMORY.md demote-on-promote
(morning session archived verbatim to MEMORY-reference.md), 7 KG lines (4 drift
patterns incl. 'a check cannot be written in the medium of the thing it inspects',
1 good-direction, app-memory-as-second-cache, governance-mcp), 4 skill-harvest
proposals, canonical app-preferences.md in sync with the app as of this wrap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WuMjg3ipEVa3n8CoSzoyvc

claude/memory/knowledge-graph.jsonl

@@ -471,3 +471,10 @@
 {"subject": "claude-code", "predicate": "doctrine-ids", "object": "~/CLAUDE.md §Memory Discipline carries 7 stable ids as HTML comments (`<!-- D:memory.check-before-claiming -->` etc). governance-drift-check.py §6 reports duplicate ids and skill citations to undefined ids; it scans ~/.claude/skills/**, deliberately NOT PENDING.md.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-morning-governance-block-closed-and-the-parser-that-defined-its-own-blind-spot.md", "extracted_at": "2026-07-28"}
 {"subject": "cowork", "predicate": "governance-status", "object": "RETIRED as a party 2026-07-28. Its filesystem root `coworkUserFilesPath` is `~/Claude`, which does not exist; all governance substrate is outside it. Five byte-identical copies of a March-22 COWORK.md sit in ~/Library/Application Support/Claude/local-agent-mode-sessions/ and would silently govern any reopened session — replace before reuse.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-morning-governance-block-closed-and-the-parser-that-defined-its-own-blind-spot.md", "extracted_at": "2026-07-28"}
 {"subject": "claude-app", "predicate": "filesystem-access", "object": "The jurist has NO filesystem access and the live preferences exist nowhere on disk. Its state therefore cannot be computed, only cached — duplication with CLAUDE.md is structurally required; only staleness is optional. A pointer is worthless to a reader who cannot open files.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-morning-governance-block-closed-and-the-parser-that-defined-its-own-blind-spot.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern", "object": "a-check-cannot-be-written-in-the-medium-of-the-thing-it-inspects — FOUR instances in one afternoon, the second inside the fix for the first: (1) a read-only audit grepped its own source for '\"w\"', os.remove, shutil. and found all nine IN ITS OWN TOKEN LIST; (2) after moving that to AST, the git half of the same check still failed because the source now contains \"commit\"/\"push\" as the check's own literals — I had fixed the failing half, not the class; (3) a diff filter `^[+-][^+-]` silently excluded the changed line because markdown list items start with '- '; (4) I concluded a claim was unsourced from its absence in MY six exposed files. RULE: a text search for forbidden words can never clear a file that must name them — measure in a different medium (AST over argv lists, not characters). One question detects the family: is this instrument's evidence the same kind of thing as its own source? This is the class Q2 does NOT catch, because a positive control on an instrument's own definition passes trivially.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern", "object": "negative-check-without-establishing-instrument-coverage — I searched six MCP-exposed files and the Obsidian vault for the jurist's cited 'Savall file', found nothing, and reported it with a confabulation framing. The steward supplied the source (Claude.app's memory system) and then that he WATCHED it search memory mid-answer. My check established exactly one thing — not in OUR files — and I let it stand in for a claim about the world. Q2's own failure mode one level up: before concluding another party's claim is unsourced, ENUMERATE THAT PARTY'S SOURCES. An absence in my instruments is a fact about my instruments.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern", "object": "commit-message-names-a-file-it-never-staged — 8abfe88 read 'PENDING.md split 1848->430 + archive'; git ls-files showed PENDING-archive.md untracked. 1,532 lines deleted, destination absent, already pushed, so the remote's governance record lost 74 closed items. `git status` at the wrap showed '?? PENDING-archive.md' and I read it as backup noise beside two .bak files. Recurred the same day: the steward's CLAUDE.md and REVIEWED.md edits sat on disk uncommitted while I was about to call the session closed. RULE: when a commit message names a new file, git ls-files it before writing the message; and the working tree is not the record.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern", "object": "a-hypothesis-about-an-environment-is-not-a-finding-about-it — I stated confidently that Claude.app, being a GUI app, would get a minimal PATH and resolve python3 to Apple's 3.9.6 rather than the Homebrew 3.13.14 I tested against, and called this 'the real failure mode'. The app's own log names the interpreter it used: the Homebrew 3.13.14: it inherited the full 22-entry PATH. The risk class was real; the fact was not. Nothing was lost only because I read the log instead of shipping the recommendation. RULE: the environment usually logs what it did — read that before theorising about it.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern-good-direction", "object": "my-own-instruments-caught-my-own-errors-unprompted — twice in one session a check surfaced a defect it was not looking for: the union-losslessness verifier returned FAIL on 3 header lines, which is how the unlogged header rewrite inside 8abfe88 came to light; and the doctrine byte-identity comparator flagged a difference that turned out to be two consecutive '---' rules left where I had excised a table. Both times the first instinct was that the test was wrong — and both times the test was wrong AND had found something real underneath. Do not dismiss a failing check just because its framing is off.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-app", "predicate": "has-property", "object": "memory-system-is-a-second-uninstrumented-cache-of-project-state — actively retrieved mid-answer, holds state about the steward's projects, and NO instrument on the executor's side can read or audit it: no MCP tool reaches it, no drift-check covers it. Unlike the preferences' §Standing Context it cannot be SEEN going stale. The mitigation placed in the jurist's doctrine (name which of four stores a claim was read from; flag memory-sourced facts for steward cross-check) rests on SELF-REPORT, the channel the contamination problem says to distrust. Candidate [HARDENING], parked 2026-07-28.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "governance-mcp", "predicate": "is-a", "object": "read-only MCP server at ~/dotfiles/scripts/governance-mcp.py giving the jurist (Claude.app chat) verbatim access to the governance substrate: governance_state, governance_item(id), governance_read(file,offset,limit), drift_report, repo_activity. Four refusals with same-run controls: no writes (AST-audited, git log/status only), no path arguments (keys from a fixed enum), no second parser (item_spans imported from wake-digest.py), not an agent. 29 controls under Python 3.13.14 and 3.9.6. PENDING-82 / REVIEWED-82. Install proven from Claude.app's own mcp-server-governance.log.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}