docs(PENDING-180): ADDENDUM 1 — (c)(b)(a) executed, census answers one, new gap

Filed before any ruling so it is read with the parent, not suppressed under
PENDING-145's case.

Records the execution and three things that would otherwise be lost: the first
census carried the defect it was auditing and misflagged a correct control; a
third control arm was written and removed before commit because its predicate
did not implement its label; and the assemble-from-parts mechanism does not
cover prose in the same file.

The count is deliberately NOT incremented. This item's own deferral binds
PENDING-168's ruling to state its unit before its number, and the drafting hand
choosing the unit that suits its own number is the move that deferral blocks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BsN7nKHjKBsn5bfNRRCNmo

PENDING.md

@@ -4236,3 +4236,32 @@ chk(f"a real session reads as WRAPPED end-to-end  [{_v.count('wrapped')} of {len
 -->
 
 **Awaiting:** Steward authorization. ⚠ **Nothing is blocked:** the control's vacuity costs nothing today, because the behaviour it failed to guard was verified behaviourally in the same sitting. What is time-sensitive is only that PENDING-168 not be ruled on an evidence base this item changes.
+
+### ADDENDUM 1 — 2026-09-09 — (c), (b) and (a) executed; the census answers ONE; and the mechanism has a gap it cannot cover
+
+**Filed before any ruling, so it is read with the parent rather than after it** — the PENDING-145 suppression case applies to addenda filed *after* a ruling, and this is not one. The parent's recommendation was **(c) census → (b) positive-form counterpart → (a) fix the instance**. All three ran, in that order, on steward instruction the same evening.
+
+**(c) CENSUS — the polarity argument predicted siblings, and there are none.** Fifteen positive-form source assertions across eight governed scripts (`tarbuckle-*.py`, `governance-drift-check.py`, `wake-digest.py`, `thread-query.py`). **Exactly one self-planted needle: the one this item filed**, `tarbuckle-seam.py:165`. Controls named before the run: one must-find (the filed instance), two must-not-flag (`TimeoutExpired` and `log_silence(why, line)`, both occurring at real code sites). All three passed. ⚠ **The bound the parent required is restated because it still holds: a needle assembled from parts inside a *defective* control is indistinguishable from a correct one by this method, so the census bounds the problem from below.**
+
+⚠ **THE FIRST CENSUS CARRIED THE DEFECT IT WAS AUDITING, and this is recorded rather than quietly corrected.** Its discriminator was *"the needle occurs once in the file"*. That cannot separate a self-planted needle from a **correct** control whose assertion escapes its quotes — where the single occurrence is the real code site. It misflagged `tarbuckle-seam.py:163`, a correct control, as self-planted. Caught by verifying the finding against the file before reporting it, not by the census. Corrected discriminator: **every occurrence of the needle lies on the assertion's own line.** The parent's own class — a predicate that does not implement its label — arriving inside the sweep filed to find it.
+
+**(b) `source_has()`** now sits beside `source_lacks()` in `tarbuckle-mumble.py`, needle assembled from parts by the same mechanism, carrying the polarity argument and the behavioural limit in its docstring. It ships with the must-fail arm the negative form has had since it was written (`A10` / `A10n`). ⚠ **A third arm was written and then removed before commit** — its predicate did not implement its label. Shipping wrong-subject vacuity inside the fix for self-planting would have been the parent's other class, in the parent's own repair.
+
+**(a) `tarbuckle-seam.py:165` repaired.** The needle was aimed at **this seam's own source** for a string that exists only in `tarbuckle-mumble.py:142` — it could never have found it, and could only ever pass on the copy it had planted in itself. Now aimed at the writer's file, split into two arms that assert different things (*the canonical writer keeps the evidence* / *this seam routes rejections through that writer*), plus `S3nn the predicate can fail`.
+
+**VERIFIED BY MUTATION, NOT BY A GREEN SELFTEST — which is the whole point and was not optional here.**
+
+| mutation | repaired control | old form |
+|---|---|---|
+| seam stops routing rejections through the canonical writer | **FAIL** | **passes** — the defect, demonstrated |
+| control aimed at a file lacking the needle | **FAIL** | — |
+
+**136 controls green across the five surfaces** (`body` 32 · `mumble` 41 · `seam` 17 · `wrap` 25 · `invoke` 21).
+
+⚠⚠ **A NEW GAP, AND IT IS IN THE MECHANISM ITSELF RATHER THAN IN ANY CONTROL.** The first mutation did **not** fail on its first run. Cause: the repair's own explanatory comment named the truncation literally, **planting a contiguous copy of the needle in the file being searched — re-creating this bug inside the sentence explaining it.** `source_lacks()` and `source_has()` assemble the **assertion's** needle from parts; **nothing prevents a comment, or any other prose in the same file, from planting a contiguous copy.** The mechanism covers the assertion, not the file. Caught by the mutation test; **invisible to the selftest, which was 17/17 throughout.** The repaired file now carries a warning at the site.
+
+⚠ **THE COUNT IS NOT INCREMENTED, DELIBERATELY.** The comment above is a further occurrence of the self-planting shape, and the third written by a party actively watching for it. **The executor declines to count it.** This item's own deferral binds PENDING-168's ruling to state its unit before its number, and the drafting hand choosing the unit that suits its own number is exactly the CLASS E move the deferral exists to block. Recorded as an occurrence; **the unit remains the steward's.**
+
+**Files affected:** `scripts/tarbuckle-mumble.py` (`source_has`, `A10`/`A10n`), `scripts/tarbuckle-seam.py` (import, `S3` split into three arms, the prose warning).
+
+**Awaiting:** Steward authorization on the parent. ⚠ **What remains for a ruling is smaller than when this item was filed:** (c), (b) and (a) are executed and the repair is mutation-verified, so the item is **dischargeable on a ruling that settles its count unit**. The new gap above is a separate decidable question and is **not** bundled here — filing it inside this addendum would reproduce the CLASS E defect PENDING-146 names, in the item that just declined to commit it.