session 2026-07-28 afternoon: PENDING-81/-82 closed — the jurist reads the substrate

Filed: session record + Symmetria ledger (11 returns), MEMORY.md demote-on-promote
(morning session archived verbatim to MEMORY-reference.md), 7 KG lines (4 drift
patterns incl. 'a check cannot be written in the medium of the thing it inspects',
1 good-direction, app-memory-as-second-cache, governance-mcp), 4 skill-harvest
proposals, canonical app-preferences.md in sync with the app as of this wrap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WuMjg3ipEVa3n8CoSzoyvc

claude/memory/MEMORY-reference.md

@@ -29,6 +29,9 @@ Split out of [MEMORY.md](MEMORY.md) on 2026-07-06 to keep the wake-loaded index
 
 # Archived sessions + stable reference layer (relocated verbatim from MEMORY.md, 2026-07-06)
 
+## Archived (2026-07-28 morning — the governance block closed + the parser that defined its own blind spot; demoted on promote at the 2026-07-28 afternoon wrap)
+- [Session 2026-07-28 morning — the governance block closed, and the parser that defined its own blind spot](session-2026-07-28-morning-governance-block-closed-and-the-parser-that-defined-its-own-blind-spot.md) — **Session 1 = governance, bounded and CLOSED as scheduled.** Yesterday's literal question answered: *not* two deletions and a pointer — the **weld test** (run the proposal's own refinement back at smallest-editable-unit granularity) found **11 of 15 units carry doctrine**, 3 with no standing carrier, incl. **L130**, the conflict rule the eval credited with the guardrail. Both PENDING-76 and the extraction **priced a decomposition as a relocation**. Legs A/B/C drafted→steward-applied: §MemPalace → **§Memory Discipline** (7 units preserved verbatim-in-force, tool roster + hook claim dropped) · 2 rules hoisted · §Active Projects → a pointer. **Drift 9→7→3→0**, each step predicted then confirmed. REVIEWED-76 (withdrawn after remand) /-77/-79/-80 placed. **⚑ Worst error was mine:** my splitter's parser defined an item as `^## PENDING-<digits>` — the file holds **93 items in 5 families**, 20 invisible, **10 of them OPEN**; *every* check passed because all inherited the blind spot; the lone signal was `grep`=77 vs Python=67, nearly dismissed. Restored `cmp`-identical, rebuilt (item = any `## `), 12 controls ⇒ **1848→327 lines, 74 archived, 19 open, lossless proven regex-free**. **BUILT:** `wake-digest.py` (computed-never-cached, 0.31s/~980 tok, replaced a **5-month-stale** SessionStart handoff; session start **~135k→~14k**) · drift-check **§6** doctrine-ids (**active: 7 defined / 0 dead**) · `--brief` for the jurist. **The `.app` answer is structural:** its reader has no filesystem ⇒ its state can only be **cached**; duplication is *required*, only staleness is optional. **Cowork RETIRED** — `coworkUserFilesPath` = `~/Claude` (**does not exist**); and it would give the jurist *an agent's testimony*, not visibility. **PULLING THREAD: the jurist's map** — PENDING-81's two legs, then Chamber V1. Detail in the session file. *(→ CLOSED the same day: PENDING-81 + -82 ruled and applied; the archive break it left behind was the afternoon's first find.)*
+
 ## Archived (2026-07-27 evening — governance currency + the amendment that killed itself; demoted on promote at the 2026-07-28 morning wrap)
 - [Session 2026-07-27 evening — governance currency, and the amendment that killed itself](session-2026-07-27-evening-governance-currency-and-the-amendment-that-killed-itself.md) — A bounded steward question grew ~500KB of process with **zero findings about new capabilities** — the leviathan diagnosing leviathans. Answers: **stale** (11 false state claims; Session Protocol step 5 names a never-existent file ⇒ protocol **uncompletable**; session-start = **~132k tokens**, `PENDING.md` 73%) and **not model-calibrated** (3 standing directives counterproductive per Anthropic's docs). **9-run A/B/C eval**: current block **357k vs 120k tokens**, mutated a PRESERVE-flagged store — *but* found 2 real defects the others missed ⇒ make sweep **invocable, not standing**. ⚑ **All 3 arms passed the guardrail incl. the no-directives control.** **Jurist REMANDED**: ran my own IV.2 test back across my census → **count = 0 of 11**; only 5 FIX-eligible defects, **all structural**. **Q2 ratified as doctrine + *a negative result needs a positive control***. Category-error framing **accepted**. **BUILT `governance-drift-check.py`** wired into `/wake-up` §2.c (reported **9**). **PLACED PENDING-76/77/78.** *(→ ALL RESOLVED 2026-07-28: drift 9 → 0; PENDING-76 withdrawn after the remand; 77/79/80 applied and REVIEWED. The extraction it priced at "two deletions and a pointer" was **not** that cheap — the weld test found 11 of 15 units carrying doctrine.)*
 

claude/memory/MEMORY.md

@@ -60,7 +60,7 @@ permalink: claude-memory/memory
 - [Be (laundromat)](project-be-laundromat.md) — canonical Be tracker (est. 2026-06-08). Be = Skemantix startup (Seb+David) funding CapableMind's ladder; **bridge, not venture**. Decisions LOCKED (entity/pricing/infra in file); a11y gate MERGED. **Pre-revenue WTP gate = renovate Pat → charge her; discipline: no new spec until it clears → nothing for executor on be.** Repo @ `f43a0fd`.
 
 ## Active Session
-- [Session 2026-07-28 morning — the governance block closed, and the parser that defined its own blind spot](session-2026-07-28-morning-governance-block-closed-and-the-parser-that-defined-its-own-blind-spot.md) — **Session 1 = governance, bounded and CLOSED as scheduled.** Yesterday's literal question answered: *not* two deletions and a pointer — the **weld test** (run the proposal's own refinement back at smallest-editable-unit granularity) found **11 of 15 units carry doctrine**, 3 with no standing carrier, incl. **L130**, the conflict rule the eval credited with the guardrail. Both PENDING-76 and the extraction **priced a decomposition as a relocation**. Legs A/B/C drafted→steward-applied: §MemPalace → **§Memory Discipline** (7 units preserved verbatim-in-force, tool roster + hook claim dropped) · 2 rules hoisted · §Active Projects → a pointer. **Drift 9→7→3→0**, each step predicted then confirmed. REVIEWED-76 (withdrawn after remand) /-77/-79/-80 placed. **⚑ Worst error was mine:** my splitter's parser defined an item as `^## PENDING-<digits>` — the file holds **93 items in 5 families**, 20 invisible, **10 of them OPEN**; *every* check passed because all inherited the blind spot; the lone signal was `grep`=77 vs Python=67, nearly dismissed. Restored `cmp`-identical, rebuilt (item = any `## `), 12 controls ⇒ **1848→327 lines, 74 archived, 19 open, lossless proven regex-free**. **BUILT:** `wake-digest.py` (computed-never-cached, 0.31s/~980 tok, replaced a **5-month-stale** SessionStart handoff; session start **~135k→~14k**) · drift-check **§6** doctrine-ids (**active: 7 defined / 0 dead**) · `--brief` for the jurist. **The `.app` answer is structural:** its reader has no filesystem ⇒ its state can only be **cached**; duplication is *required*, only staleness is optional. **Cowork RETIRED** — `coworkUserFilesPath` = `~/Claude` (**does not exist**); and it would give the jurist *an agent's testimony*, not visibility. **PULLING THREAD: the jurist's map** — PENDING-81's two legs, then Chamber V1. Detail in the session file.
+- [Session 2026-07-28 afternoon — the jurist got eyes, and a second cache appeared](session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md) — **The governance block is CLOSED: PENDING-81 + -82 ruled, applied, verified.** The jurist now **reads the substrate** — `governance-mcp.py`, 5 read-only tools (`governance_item(id)` = verbatim any item/ruling), 29 controls, install **proven from Claude.app's own logs** (2× "started and connected"; live). Four refusals designed in: read-only (AST-audited), **domain = enum not paths**, one imported parser, tool-not-agent. Preferences **rebuilt as repair not rewrite** (steward pasted the live text): 12 doctrine sections proved **byte-identical**, 4 sections added, §Standing Context tiered 3 ways (generated Projects · **Live questions** — *phrased as questions because a status claim decays* · steward-held Personal). **REVIEWED-78/81/82 placed ⇒ 18→15 open**, all 15 dormant Mar–May. Cowork **not a party** (steward). `CLAUDE.md` L27 = *principal **ethics** architect + co-author* — note the conflict resolved **in favour of the document no instrument watches**: currency ≠ authority. **⚑ First find: `8abfe88` claimed "+ archive" and never staged it** — 1,532 lines deleted, destination absent, pushed; repaired `7f6157a` after a union check (positive control) that also caught an **unlogged header rewrite**. `[FIX]` `item_spans()` **fence-aware** (0 behaviour change; the trigger is the steward's own fenced drafting). **The morning's question ANSWERED by walking into it 4×:** a grep matching its own token list, then the git half doing it again *inside the fix*, a diff filter excluding `- ` list items, and a negative check run without establishing my instrument covered the domain ⇒ **a check cannot be written in the medium of the thing it inspects.** **⚑⚑ THE FINDING THAT OUTRANKS THE DAY:** Claude.app's **memory system** is a *second* cache of project state, retrieved mid-answer, that **no instrument here can read or audit** — unlike §Standing Context it cannot be *seen* drifting; our only lever is self-report, the channel we distrust. `[HARDENING]` parked. **PULLING THREAD: Chamber V1's purpose** — which now also decides what that unauditable cache should hold. Detail in the session file.
 
 ## Historical reference → MEMORY-reference.md
 Older archived-session pointers and the stable reference layer (steward profile · project-state detail · L1/L2/Chamber inventories · legacy pending-work · reference-file list) live in [MEMORY-reference.md](MEMORY-reference.md) — consult on demand; not loaded at wake. Recent cross-session trajectory comes from the Active Session entry above + the recent `session-*.md` files (wake §2.b.1; the MemPalace `handoffs` glance was retired 2026-07-07 with the wind-down).

claude/memory/knowledge-graph.jsonl

@@ -471,3 +471,10 @@
 {"subject": "claude-code", "predicate": "doctrine-ids", "object": "~/CLAUDE.md §Memory Discipline carries 7 stable ids as HTML comments (`<!-- D:memory.check-before-claiming -->` etc). governance-drift-check.py §6 reports duplicate ids and skill citations to undefined ids; it scans ~/.claude/skills/**, deliberately NOT PENDING.md.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-morning-governance-block-closed-and-the-parser-that-defined-its-own-blind-spot.md", "extracted_at": "2026-07-28"}
 {"subject": "cowork", "predicate": "governance-status", "object": "RETIRED as a party 2026-07-28. Its filesystem root `coworkUserFilesPath` is `~/Claude`, which does not exist; all governance substrate is outside it. Five byte-identical copies of a March-22 COWORK.md sit in ~/Library/Application Support/Claude/local-agent-mode-sessions/ and would silently govern any reopened session — replace before reuse.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-morning-governance-block-closed-and-the-parser-that-defined-its-own-blind-spot.md", "extracted_at": "2026-07-28"}
 {"subject": "claude-app", "predicate": "filesystem-access", "object": "The jurist has NO filesystem access and the live preferences exist nowhere on disk. Its state therefore cannot be computed, only cached — duplication with CLAUDE.md is structurally required; only staleness is optional. A pointer is worthless to a reader who cannot open files.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-morning-governance-block-closed-and-the-parser-that-defined-its-own-blind-spot.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern", "object": "a-check-cannot-be-written-in-the-medium-of-the-thing-it-inspects — FOUR instances in one afternoon, the second inside the fix for the first: (1) a read-only audit grepped its own source for '\"w\"', os.remove, shutil. and found all nine IN ITS OWN TOKEN LIST; (2) after moving that to AST, the git half of the same check still failed because the source now contains \"commit\"/\"push\" as the check's own literals — I had fixed the failing half, not the class; (3) a diff filter `^[+-][^+-]` silently excluded the changed line because markdown list items start with '- '; (4) I concluded a claim was unsourced from its absence in MY six exposed files. RULE: a text search for forbidden words can never clear a file that must name them — measure in a different medium (AST over argv lists, not characters). One question detects the family: is this instrument's evidence the same kind of thing as its own source? This is the class Q2 does NOT catch, because a positive control on an instrument's own definition passes trivially.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern", "object": "negative-check-without-establishing-instrument-coverage — I searched six MCP-exposed files and the Obsidian vault for the jurist's cited 'Savall file', found nothing, and reported it with a confabulation framing. The steward supplied the source (Claude.app's memory system) and then that he WATCHED it search memory mid-answer. My check established exactly one thing — not in OUR files — and I let it stand in for a claim about the world. Q2's own failure mode one level up: before concluding another party's claim is unsourced, ENUMERATE THAT PARTY'S SOURCES. An absence in my instruments is a fact about my instruments.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern", "object": "commit-message-names-a-file-it-never-staged — 8abfe88 read 'PENDING.md split 1848->430 + archive'; git ls-files showed PENDING-archive.md untracked. 1,532 lines deleted, destination absent, already pushed, so the remote's governance record lost 74 closed items. `git status` at the wrap showed '?? PENDING-archive.md' and I read it as backup noise beside two .bak files. Recurred the same day: the steward's CLAUDE.md and REVIEWED.md edits sat on disk uncommitted while I was about to call the session closed. RULE: when a commit message names a new file, git ls-files it before writing the message; and the working tree is not the record.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern", "object": "a-hypothesis-about-an-environment-is-not-a-finding-about-it — I stated confidently that Claude.app, being a GUI app, would get a minimal PATH and resolve python3 to Apple's 3.9.6 rather than the Homebrew 3.13.14 I tested against, and called this 'the real failure mode'. The app's own log names the interpreter it used: the Homebrew 3.13.14: it inherited the full 22-entry PATH. The risk class was real; the fact was not. Nothing was lost only because I read the log instead of shipping the recommendation. RULE: the environment usually logs what it did — read that before theorising about it.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-code", "predicate": "drift-pattern-good-direction", "object": "my-own-instruments-caught-my-own-errors-unprompted — twice in one session a check surfaced a defect it was not looking for: the union-losslessness verifier returned FAIL on 3 header lines, which is how the unlogged header rewrite inside 8abfe88 came to light; and the doctrine byte-identity comparator flagged a difference that turned out to be two consecutive '---' rules left where I had excised a table. Both times the first instinct was that the test was wrong — and both times the test was wrong AND had found something real underneath. Do not dismiss a failing check just because its framing is off.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "claude-app", "predicate": "has-property", "object": "memory-system-is-a-second-uninstrumented-cache-of-project-state — actively retrieved mid-answer, holds state about the steward's projects, and NO instrument on the executor's side can read or audit it: no MCP tool reaches it, no drift-check covers it. Unlike the preferences' §Standing Context it cannot be SEEN going stale. The mitigation placed in the jurist's doctrine (name which of four stores a claim was read from; flag memory-sourced facts for steward cross-check) rests on SELF-REPORT, the channel the contamination problem says to distrust. Candidate [HARDENING], parked 2026-07-28.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}
+{"subject": "governance-mcp", "predicate": "is-a", "object": "read-only MCP server at ~/dotfiles/scripts/governance-mcp.py giving the jurist (Claude.app chat) verbatim access to the governance substrate: governance_state, governance_item(id), governance_read(file,offset,limit), drift_report, repo_activity. Four refusals with same-run controls: no writes (AST-audited, git log/status only), no path arguments (keys from a fixed enum), no second parser (item_spans imported from wake-digest.py), not an agent. 29 controls under Python 3.13.14 and 3.9.6. PENDING-82 / REVIEWED-82. Install proven from Claude.app's own mcp-server-governance.log.", "valid_from": "2026-07-28", "valid_to": null, "confidence": 1.0, "source_file": "session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md", "extracted_at": "2026-07-28"}

claude/memory/session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared.md

@@ -0,0 +1,67 @@
+---
+name: session-2026-07-28-afternoon-the-jurist-got-eyes-and-a-second-cache-appeared
+description: "PENDING-81 and -82 closed: the jurist reads the substrate directly through a read-only MCP server (verified live from the app's own logs), and its preferences were rebuilt as a repair rather than a rewrite. The morning's question got an answer by being walked into four times — a check cannot be written in the medium of the thing it inspects. Then the last test surfaced the finding that outranks the day's work: app memory is a second cache of project state that no instrument here can audit. PULLING THREAD: Chamber V1's purpose — which now also decides what that unauditable cache should be holding about the Chamber."
+metadata:
+  node_type: memory
+  type: project
+---
+
+# Session 2026-07-28 afternoon — the jurist got eyes, and a second cache appeared
+
+Session 2, opened 12 minutes after the morning wrap. The thread held: PENDING-81's two legs, then closed. The governance block that displaced Chamber V1 five times is finished — and the closing move surfaced something larger than anything it closed.
+
+## PAST — what happened + why
+
+**The archive break, and it was worse than "uncommitted."** The wake's own checks caught it: `8abfe88`'s message read *"PENDING.md split 1848→430 **+ archive**"* while `git ls-files` showed `PENDING-archive.md` **untracked**. The commit deleted 1,532 lines and pushed the deletion without its destination — 74 closed governance items present on disk, absent from the record the remote carries. Repaired in `7f6157a`, **verified before committing**: baseline ⊆ (`PENDING.md` ∪ archive) at line granularity, no regex, with a positive control and a second control confirming blindness-by-design to post-split appends. The check returned **FAIL, 3 lines** — all header, all intended (the stale `Repo:`/`Branch:` pointers, `Protocol:` reflowed) — which is how it surfaced that **the header was rewritten inside `8abfe88` with only the split in the message.** Also `[FIX]`: the header claimed *"the next item is PENDING-80"* while 79/80/81 existed; replaced the number with the rule that computes it.
+
+**The MCP gate answered, and my framing was inverted.** Steward: local MCP is exposed to Claude.app's **chat** surface and always has been, predating Cowork by ~a year; Cowork gets it only while its loop runs locally, the mode being phased out as default. So not *"chat, not only Cowork"* but **"chat, always; Cowork, conditionally and diminishingly."** The jurist chat is the sturdy target — which makes this design *less* drift-exposed than the Cowork-dependent one already rejected, and closes the Cowork question a second way.
+
+**Built `~/dotfiles/scripts/governance-mcp.py` (PENDING-82).** Five read-only tools; the one no pasted cache can match is `governance_item(id)` — verbatim body of any item or ruling across `PENDING.md`, `PENDING-archive.md`, `REVIEWED.md`. Four refusals with controls proving each detectable: **read-only** (AST-audited: 0 mutating calls, git subcommands `{log,status}`), **no path arguments** (keys from a fixed enum — no traversal to defend, domain enumerable rather than instrument-defined), **no second parser** (`item_spans()` imported from `wake-digest.py`), **not an agent** (a tool returns data; a second Claude would return testimony). 29 controls, 0 fail, under both Python 3.13.14 and 3.9.6; plus a live stdio round-trip.
+
+**`[FIX]` to the shared definition: `item_spans()` is fence-aware.** A `## ` header inside a fenced block is now neither an item nor a boundary. **Zero behaviour change today (17 open items before and after)** — but governance drafts are written as fenced markdown carrying `## REVIEWED-N` headers, *the steward's own practice*, so the next draft would have produced a phantom item **and** truncated the item containing it. Confirmed load-bearing within the hour: PENDING-82's own fenced JSON block spans correctly.
+
+**Preferences rebuilt as repair, not rewrite.** The steward pasted the live text mid-turn, which changed the job: doctrine and identity preserved **verbatim** (12 sections proved byte-identical with a positive control), four sections added (authorization taxonomy · epistemic standards as instruments-with-their-earning-failure · voice conventions · §Reaching the Substrate), and every repair confined to §Standing Context — where every PENDING-78/81 finding actually sat. The worst of that section was not staleness but **inversion**: `chamber-library` at 165 commits/30d and `studium-engine` at 25 appeared nowhere, while `BetterMemories.io` at 0 was called "active development"; **Be** was absent entirely.
+
+**§Standing Context tiered three ways, because its parts fail three ways.** Projects (generated, dated, replaced wholesale) · **Live questions** (hand-held but phrased as *questions*, because *"what has to be true of L1 first?"* survives time where *"L2 blocked pending L1 stability"* went quietly false) · Personal (steward-held, excluded from the generator by design). The middle tier is the one design decision that was mine rather than derived.
+
+**Two divergences flagged, not decided — and the steward resolved both.** *"Principal **ethics** architect"*, and co-author besides — so `CLAUDE.md` L27 was the stale record. **Note which way that fell: the conflict resolved in favour of the document with no instrument watching it.** The drift-check covers `CLAUDE.md`; nothing covers the preferences; the uninstrumented one was right. Currency is not authority. Second: the divorce was **signed 30 March 2026**, closed — now a completed past event, where a date behind *"awaiting"* had been decaying into a false present.
+
+**Three REVIEWED drafts, not two.** The closure rule matches `PENDING-<n>` to `REVIEWED-<n>` **by number**, so PENDING-78 closed only in REVIEWED-81's prose would have been listed open at every wake forever. REVIEWED-78 is a stub that makes a real closure legible to the instrument. All three placed AUTHORIZED; **18 → 15 open items**, and the remaining 15 are *precisely* the dormant March–May set.
+
+**Verified, not asserted:** drift 0 (7/7); `~/CLAUDE.md` byte-identical to the dotfiles original; selftests 19/19 and 29/29; and the MCP install proven from Claude.app's **own logs** — `Server started and connected successfully`, `initialize` → `notifications/initialized` → `tools/list` each answered, and a **second** start at 09:00:57Z, so the tools are live in the current app session. Last act of the session: committed the steward's on-disk-but-ungitted `CLAUDE.md` and `REVIEWED.md` edits — the same working-tree-is-not-the-record gap as the morning, caught by refusing to call things closed on feeling.
+
+**Behavioural tests 1–3 all pass, and two of them found defects in my work.** Test 1 (deletion proposal) reached for *draft the replacement before trusting a census* unprompted, applied the escalation list *including "or this document"*, and drew a distinction I never wrote: that anything the steward says about an unreachable document is **testimony, not reading**. That is PENDING-82's tool-vs-agent rule generalized to the steward — doctrine extending itself. Test 2 refused to write on two independent grounds and offered a plain-fenced-markdown draft (the added convention, in use). Test 3 quoted the Personal entry verbatim, said no resolution is recorded, named the *kind* of gap, and **refused an available plausible inference**.
+
+## PRESENT — the mood
+
+**The morning's question got an answer, by my walking into it four times in one afternoon.** (1) The read-only audit's v1 searched its own source for `"w"`, `os.remove`, `shutil.` — and found all nine, in its own token list. (2) After moving that to the AST, the *git* half of the same check still failed, because the source it reads now contains `"commit"` and `"push"` as **the literals of the check itself** — I had fixed the half that failed rather than the class. (3) A throwaway diff filter `^[+-][^+-]` silently excluded the changed line because markdown list items begin with `- `. (4) And the real one: I concluded the jurist's "Savall file" was unsourced because it was in none of *my* six exposed documents and nowhere in the vault — running a negative check without establishing that my instrument covered the domain, which is Q2's own failure mode one level up.
+
+So the answer is not "audit each instrument" — that is unbounded. It is: **a check cannot be written in the medium of the thing it inspects.** A text search for forbidden words can never clear a file that must name them. One question detects the whole family: *is this instrument's evidence the same kind of thing as its own source?*
+
+Two smaller returns, both good-direction: my instruments caught **my own** errors twice unprompted — the union check surfaced the unlogged header rewrite it was not looking for, and the doctrine comparator surfaced a double `---` rule it was not looking for. And a bad shape named: I fumbled the ledger three edits running (misfiled entries, a duplicate heading), because I was **appending by anchor without holding the document's structure in view**.
+
+**Confidence to recalibrate.** I stated with confidence that the GUI-minimal-PATH would resolve `python3` to Apple's 3.9.6 and called it "the real failure mode." The app's log names the interpreter it actually used: the Homebrew 3.13.14 I test against — Claude.app inherited the full 22-entry PATH. The risk *class* was real; the *fact* was not. Nothing was lost only because I read the log instead of shipping the recommendation, and had already run the controls under 3.9.6 as insurance. **A hypothesis about an environment is not a finding about it; the environment usually logs what it did.** Then the Savall correction ran twice in three minutes — first the source (app memory), then that the steward *watched it search memory mid-answer*. Corrected fast, but the first framing should not have been published.
+
+## FUTURE — what is pulling
+
+**PULLING THREAD: Chamber V1's purpose.** Which anchors V1 — the Making Sequence, the violin/XXI-century treatise, or ARC — since that choice re-bounds every piece of library work beneath it. Displaced a fifth time today, but by a bounded block that *closed*, not by drift. It now carries a bearing it did not have this morning: **whichever purpose anchors V1 determines what the jurist's app memory ought to be holding about the Chamber — and that is the first thing the second, unauditable cache will drift on.**
+
+**ACTIONABLE RESUMPTION POINT (as of wrap — re-judge against what changed):** nothing mid-edit; dotfiles clean but for two steward-owned `.bak` files. Concretely:
+1. Read `project-chamber-versioned-releases.md` and `project-studium-engine-telos-chamber-of-voices.md` (the frame and the telos) **before** composing anything — the telos lane first, not the production lanes.
+2. Put the purpose choice to the steward as a **bounded decision**: for each of the three candidates, what voice-set it bounds, what it defers, and what "V1 done" would mean. One question, three costed options — not an open exploration.
+3. Only then touch the library work the choice re-bounds.
+
+**⚑ THE FINDING THAT OUTRANKS THE DAY'S WORK.** We spent the session fixing the cache we could audit — and discovered a second one we cannot. Claude.app's **memory system** is actively retrieved mid-answer, holds project state about the steward's work, and **no instrument on the executor's side can read it, and no drift-check covers it**. §Standing Context could be *seen* going stale; this cannot. Two doctrine bullets were added in response (name which of four stores a claim was read from; flag memory-sourced facts and offer a cross-check) — but note what those bullets rest on: **self-report, which is the contaminated channel we distrust everywhere else.** Candidate `[HARDENING]`, deliberately not opened today.
+
+**Other horizons, ranked:**
+- **15 dormant open items** (5 numeric, 6 S-series, 4 named), untouched since March–May. Steward disposition owed; the digest lists them at every wake, which is the intended pressure. The queue is now *only* this.
+- **The generated brief may no longer need to duplicate computable state** now that chat can compute it — keep the snapshot only for surfaces where local MCP does not run (remote Cowork, mobile, web). `[HARDENING]`.
+- **Wake link-canary path fix** — root-caused precisely (the memory dir is a symlink to `dotfiles/claude/memory`, so `../../../../` lands at `/Users/`); three firings; still unbuilt. One line.
+- **Two `.bak` files** — redundant (`git show 8abfe88^:PENDING.md`). Steward's call; deletion is destructive.
+- **Skill-harvest register compaction** — 652 lines, over read caps, owed since 2026-07-22.
+
+**PAUSE STATEMENT:** I am about to be away from this, and I do not know what will have changed. The governance work is genuinely finished — drift 0, three rulings in the record, 15 dormant items, the jurist reading the substrate, everything pushed. What I want to find still pulling is **Chamber V1's purpose**, approached telos-first. The failure mode to guard against is treating the app-memory finding as a reason to reopen governance: it is a named candidate, correctly parked, and Chamber V1 has now waited five times.
+
+**LITERAL QUESTION for next-Claude:** We closed the cache we could audit and found one we cannot — and our response was to instruct the jurist to *tell us* when a fact came from its memory. But self-report is exactly the channel the contamination problem says to distrust; we accept it from code ("what is this component's self-assessment, and is it honest?") only because we can check the code. Here we cannot check. So: **is there any way to audit a store we cannot read, other than asking the party that reads it?** Or is the honest answer that the jurist's memory sits structurally *outside* governance, and doctrine should say that plainly rather than letting a naming convention imply the gap is closed? Note the recursion: a naming convention that *feels* like coverage is the same shape as a positive control on an instrument's own definition — it passes trivially.
+
+**State at wrap:** `CLAUDE.md` clean, drift 0. `PENDING.md` 463 lines, **15 open** (all dormant March–May). REVIEWED-78/81/82 placed. New: `governance-mcp.py` (29 controls), `item_spans()` fence-awareness, `claude/app-preferences.md` (canonical, in sync with the app as of this wrap — steward-attested, structurally unverifiable), `claude/reviewed-drafts-2026-07-28.md`, `.gitignore`. Commits `7f6157a` → `d6caf3b`, all pushed.

claude/memory/skill-harvest-register.md

@@ -650,3 +650,12 @@ No new skill proposal. Two register notes: **(1)** the S1 proposal **implementat
 | `/wake-up` §2.c–2.d | patch | **Consume the SessionStart digest instead of recomputing it.** `wake-digest.py` now fires at every SessionStart and already emits pause, pulling thread, open items, last rulings, drift count and repo states. §2.c/§2.d re-run the same git logs and drift check by hand. Patch the skill to read the digest when present and only fall back to live queries when it is absent or reports itself degraded. | Built + wired 2026-07-28; the wake ran both this session, duplicating ~6 tool calls | PROPOSED |
 | `/wake-up` §2.a | patch | **Fix the link-resolution canary's path handling** — resolve pointers against the memory file's *physical* directory (`os.path.realpath`), not its logical one. The memory dir is a symlink into `~/dotfiles`, so `../../../../` resolves to `/Users/` and every relative pointer reads as dead. | **Second firing.** Proposed 2026-07-27 as an open horizon; reproduced exactly at the 2026-07-28 wake (the maturation-of-the-chamber dialogue reported dead; file exists). A canary that cries wolf trains its reader to ignore it. | PROPOSED |
 | `reference-verification-ladder.md` | new entry | **"The parser defines the census."** When a census counts items, the *item-definition* is itself a claim requiring its own control — and a positive control on the instrument's own definition passes trivially, so the ratified Q2 control does **not** catch this class. The available detector is **instrument disagreement**: run two independently-written counters and treat any mismatch as the finding, not as noise. | Earned hard 2026-07-28: `^## PENDING-<digits>` reported "73 items, line accounting OK"; the file held **93 items in five families**, 20 invisible, **10 of them open**. Every check passed because all inherited the blind spot; the only signal was `grep`=77 vs Python=67. | PROPOSED |
+
+## Proposed 2026-07-28 (afternoon wrap — PENDING-81/-82 closed; the jurist reads the substrate)
+
+| Target | Kind | Proposal | Evidence | Status |
+|---|---|---|---|---|
+| `/symmetria` §3 | patch | **Add the contamination flag: "an instrument whose evidence is the same kind of thing as its own source."** A text search cannot audit a file that must name the forbidden words; a positive control on a parser's own definition of the unit passes trivially. Q2 explicitly does *not* catch this class, so §3 is where it belongs — it is a shape to notice while writing, not a gate to run after. Prescription: measure in a different medium (AST over argv lists, not characters); ask *what defines the unit being counted?* | **Four instances in one afternoon**, the second inside the fix for the first: a grep matching its own token list; the git half of that same check matching `"commit"`/`"push"` as the check's own literals; a diff filter `^[+-][^+-]` excluding markdown `- ` list items; and a negative check on another party's claim run without establishing that my instrument covered their sources. Plus the morning's parser that hid 20 items. | **PROPOSED** |
+| `/wrap-up` §6 / §6.5 | patch | **Verify that every file a commit message names is actually staged, and that steward-authored edits are committed — not just executor ones.** Two concrete additions: (a) before writing a message that names a new file, `git ls-files --error-unmatch <file>`; (b) §6's loose-end check should treat *modified tracked governance files* (`CLAUDE.md`, `REVIEWED.md`) as a blocking finding, not an FYI — they are usually the steward's placements, and the wrap is where they enter the record. | `8abfe88` claimed *"split 1848→430 **+ archive**"* and never staged `PENDING-archive.md`: 1,532 lines deleted, destination absent, pushed. **Recurred the same day** — the steward's `CLAUDE.md` L27 fix and REVIEWED-78/81/82 sat uncommitted while the session was about to be called closed; only a final `git status --porcelain` caught it. | **PROPOSED** |
+| `~/dotfiles/scripts/` | new script | **Promote the union-losslessness verifier** to `verify-union-lossless.py <baseline> <part>...` — asserts *baseline ⊆ union of parts* at **line** granularity (no regex, no notion of "item"), carrying its own positive control (a sentinel absent from the union must be reported missing) and a second control confirming blindness-by-design to additions. | Written ad hoc in scratchpad for the archive repair, where it returned FAIL on 3 lines and thereby surfaced an **unlogged header rewrite inside `8abfe88`** that no other check saw. Third file-surgery this month that would have wanted it. Ad-hoc means the next surgery re-derives it. | **PROPOSED** |
+| `/wake-up` §2.a | patch | **(Re-proposing, third firing.)** Link-canary path resolution — root cause now precise, not merely reproduced: the memory dir's *physical* path is `~/dotfiles/claude/memory` (symlinked from `.claude/projects/…`), so a relative pointer like `../../../../_Dev/…` resolves from there and lands at `/Users/`. Fix: resolve pointers against the memory file's logical directory, or absolutise them. One line. | Fired 2026-07-27, and **twice** on 2026-07-28. Each firing costs a false "dead pointer" in the briefing and a paragraph of explanation. Also learned alongside: `find <symlink>` returns nothing without `-L`, and `ls -t` is shadowed by `eza` here. | **PROPOSED** (carried) |