session 2026-07-28 afternoon: PENDING-81/-82 closed — the jurist reads the substrate

Filed: session record + Symmetria ledger (11 returns), MEMORY.md demote-on-promote
(morning session archived verbatim to MEMORY-reference.md), 7 KG lines (4 drift
patterns incl. 'a check cannot be written in the medium of the thing it inspects',
1 good-direction, app-memory-as-second-cache, governance-mcp), 4 skill-harvest
proposals, canonical app-preferences.md in sync with the app as of this wrap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WuMjg3ipEVa3n8CoSzoyvc

claude/memory/skill-harvest-register.md

@@ -650,3 +650,12 @@ No new skill proposal. Two register notes: **(1)** the S1 proposal **implementat
 | `/wake-up` §2.c–2.d | patch | **Consume the SessionStart digest instead of recomputing it.** `wake-digest.py` now fires at every SessionStart and already emits pause, pulling thread, open items, last rulings, drift count and repo states. §2.c/§2.d re-run the same git logs and drift check by hand. Patch the skill to read the digest when present and only fall back to live queries when it is absent or reports itself degraded. | Built + wired 2026-07-28; the wake ran both this session, duplicating ~6 tool calls | PROPOSED |
 | `/wake-up` §2.a | patch | **Fix the link-resolution canary's path handling** — resolve pointers against the memory file's *physical* directory (`os.path.realpath`), not its logical one. The memory dir is a symlink into `~/dotfiles`, so `../../../../` resolves to `/Users/` and every relative pointer reads as dead. | **Second firing.** Proposed 2026-07-27 as an open horizon; reproduced exactly at the 2026-07-28 wake (the maturation-of-the-chamber dialogue reported dead; file exists). A canary that cries wolf trains its reader to ignore it. | PROPOSED |
 | `reference-verification-ladder.md` | new entry | **"The parser defines the census."** When a census counts items, the *item-definition* is itself a claim requiring its own control — and a positive control on the instrument's own definition passes trivially, so the ratified Q2 control does **not** catch this class. The available detector is **instrument disagreement**: run two independently-written counters and treat any mismatch as the finding, not as noise. | Earned hard 2026-07-28: `^## PENDING-<digits>` reported "73 items, line accounting OK"; the file held **93 items in five families**, 20 invisible, **10 of them open**. Every check passed because all inherited the blind spot; the only signal was `grep`=77 vs Python=67. | PROPOSED |
+
+## Proposed 2026-07-28 (afternoon wrap — PENDING-81/-82 closed; the jurist reads the substrate)
+
+| Target | Kind | Proposal | Evidence | Status |
+|---|---|---|---|---|
+| `/symmetria` §3 | patch | **Add the contamination flag: "an instrument whose evidence is the same kind of thing as its own source."** A text search cannot audit a file that must name the forbidden words; a positive control on a parser's own definition of the unit passes trivially. Q2 explicitly does *not* catch this class, so §3 is where it belongs — it is a shape to notice while writing, not a gate to run after. Prescription: measure in a different medium (AST over argv lists, not characters); ask *what defines the unit being counted?* | **Four instances in one afternoon**, the second inside the fix for the first: a grep matching its own token list; the git half of that same check matching `"commit"`/`"push"` as the check's own literals; a diff filter `^[+-][^+-]` excluding markdown `- ` list items; and a negative check on another party's claim run without establishing that my instrument covered their sources. Plus the morning's parser that hid 20 items. | **PROPOSED** |
+| `/wrap-up` §6 / §6.5 | patch | **Verify that every file a commit message names is actually staged, and that steward-authored edits are committed — not just executor ones.** Two concrete additions: (a) before writing a message that names a new file, `git ls-files --error-unmatch <file>`; (b) §6's loose-end check should treat *modified tracked governance files* (`CLAUDE.md`, `REVIEWED.md`) as a blocking finding, not an FYI — they are usually the steward's placements, and the wrap is where they enter the record. | `8abfe88` claimed *"split 1848→430 **+ archive**"* and never staged `PENDING-archive.md`: 1,532 lines deleted, destination absent, pushed. **Recurred the same day** — the steward's `CLAUDE.md` L27 fix and REVIEWED-78/81/82 sat uncommitted while the session was about to be called closed; only a final `git status --porcelain` caught it. | **PROPOSED** |
+| `~/dotfiles/scripts/` | new script | **Promote the union-losslessness verifier** to `verify-union-lossless.py <baseline> <part>...` — asserts *baseline ⊆ union of parts* at **line** granularity (no regex, no notion of "item"), carrying its own positive control (a sentinel absent from the union must be reported missing) and a second control confirming blindness-by-design to additions. | Written ad hoc in scratchpad for the archive repair, where it returned FAIL on 3 lines and thereby surfaced an **unlogged header rewrite inside `8abfe88`** that no other check saw. Third file-surgery this month that would have wanted it. Ad-hoc means the next surgery re-derives it. | **PROPOSED** |
+| `/wake-up` §2.a | patch | **(Re-proposing, third firing.)** Link-canary path resolution — root cause now precise, not merely reproduced: the memory dir's *physical* path is `~/dotfiles/claude/memory` (symlinked from `.claude/projects/…`), so a relative pointer like `../../../../_Dev/…` resolves from there and lands at `/Users/`. Fix: resolve pointers against the memory file's logical directory, or absolutise them. One line. | Fired 2026-07-27, and **twice** on 2026-07-28. Each firing costs a false "dead pointer" in the briefing and a paragraph of explanation. Also learned alongside: `find <symlink>` returns nothing without `-L`, and `ls -t` is shadowed by `eza` here. | **PROPOSED** (carried) |