governance: REVIEWED-121 AMENDMENT 1 completed and fence closed (steward)

⚠ AUTHORSHIP: written, completed and formatted by the STEWARD and jurist. The
executor is committing it, not authoring it — ~/REVIEWED.md is outside the
executor's write authority (Constitutional Constraint #1) and its content is
untouched here.

Completes the truncation flagged at cd7e5b2: A3's binding rule, A4 and the
closing disposition are now placed, and the unclosed ```yaml fence is closed at
line 1853 so the block holds exactly the three declared fields and the prose
after it renders as prose.

Verified before staging, not taken on report:
  · fences balanced — 2 in the amendment, 6 in the file, both even
  · heading remains at column 0, so RE_HEAD still matches and register
    integrity reports 2 amendments (the body's 2-space indent is cosmetic; had
    the HEADING been indented the entry would have gone invisible to the check)
  · all 10 substantive elements present after the re-paste — Decision, A1, A2,
    A3 + its three fields + the binding rule, A4 + its real check citations,
    "What does not change", and the REVIEWED-121-A1 tag

Known and accepted: the paste stripped ** and ` markers from the binding rule,
A4 and the disposition. Cosmetic; nothing depends on it.

REVIEWED.md

@@ -1812,20 +1812,63 @@ fixture named as such.
 
 ## REVIEWED-121 — AMENDMENT 1 (2026-08-14): the defeater is declared and permanently empty on the inherited set
   **Date:** 2026-08-14
-**Amends:** REVIEWED-121 (PENDING-134), points 7 and 8 and the closing paragraph. Recorded as an amendment sitting alongside the original, not an edit to it: REVIEWED-121 is placed and executed, and no silent revision.
+  **Amends:** REVIEWED-121 (PENDING-134), points 7 and 8 and the closing paragraph. Recorded as an amendment sitting alongside the original, not an
-**Raised by:** the executor, during execution, unprompted by any ruling. The finding was not anticipated by PENDING-134, by the jurist package, or by this seat.
+  edit to it: REVIEWED-121 is placed and executed, and no silent revision.
-**Decision:** The executor's disposition is UPHELD. `defeater_has_ever_been_exercisable: false` stands as written and is the correct shape. One further field is required (A3). The ratified doctrine is unchanged; no span is re-dispositioned; PENDING-134 is not re-opened.
+  **Raised by:** the executor, during execution, unprompted by any ruling. The finding was not anticipated by PENDING-134, by the jurist package, or
+  by this seat.
+  **Decision:** The executor's disposition is UPHELD. `defeater_has_ever_been_exercisable: false` stands as written and is the correct shape. One
+  further field is required (A3). The ratified doctrine is unchanged; no span is re-dispositioned; PENDING-134 is not re-opened.
 
-**What was found.** Point 7 replaced reader-independence with order-independence: a disposition recorded *before* the doctrine is consulted. For all eleven inherited spans that moment is past and unrecoverable. Back-filling the field from a reading taken now would place a post-doctrine judgment in a field whose entire evidential value is that it precedes one — self-confirming, and the doctrine would have been ratified holding a defeater built from itself. The executor declined to populate and recorded the absence instead. That refusal is upheld: recording an honest empty is the discipline, and the distinction it preserves — *never exercisable* is not *not yet defeated* — is the substance of the finding.
+  **What was found.** Point 7 replaced reader-independence with order-independence: a disposition recorded *before* the doctrine is consulted. For
+  all eleven inherited spans that moment is past and unrecoverable. Back-filling the field from a reading taken now would place a post-doctrine
+  judgment in a field whose entire evidential value is that it precedes one — self-confirming, and the doctrine would have been ratified holding a
+  defeater built from itself. The executor declined to populate and recorded the absence instead. That refusal is upheld: recording an honest empty
+  is the discipline, and the distinction it preserves — *never exercisable* is not *not yet defeated* — is the substance of the finding.
 
-**A1 — THE DEFECT IS IN POINT 7 AND IT IS THIS SEAT'S.** Point 7 asserts that order-independence is 'the stronger instrument in any case'. That claim was unpriced in one respect. Personnel-independence is **retroactively** applicable: a second reader, had one existed, could have read spans already dispositioned. Order-independence is **prospective only**. The substitution was therefore not a strict gain — it traded an unavailable instrument for one that is unexercisable on everything that currently exists. Point 7's parenthetical stands as to contamination (two readers who both know the doctrine can both be led by it); it does not stand as an unqualified comparison, and is corrected here.
+  **A1 — THE DEFECT IS IN POINT 7 AND IT IS THIS SEAT'S.** Point 7 asserts that order-independence is 'the stronger instrument in any case'. That
+  claim was unpriced in one respect. Personnel-independence is **retroactively** applicable: a second reader, had one existed, could have read spans
+  already dispositioned. Order-independence is **prospective only**. The substitution was therefore not a strict gain — it traded an unavailable
+  instrument for one that is unexercisable on everything that currently exists. Point 7's parenthetical stands as to contamination (two readers who
+  both know the doctrine can both be led by it); it does not stand as an unqualified comparison, and is corrected here.
 
-**A2 — 'UNTESTED-IN-FORCE' IS RESTATED AS UNTESTABLE, AND H1(b) IS SATISFIED PROSPECTIVELY ONLY.** REVIEWED-121's closing paragraph records the doctrine as 'untested-in-force'. *Untested* implies testable-and-untested. On the inherited set the doctrine has **no defeater at all** — not a weak one, none — and cannot acquire one. The accurate statement: **the whose-proposition test is untestable on the entire inherited fr/en set, permanently, and its defeater is exercisable only by newly-authored pairs.** H1(b)'s requirement that an AUTHORIZED doctrine state what would falsify it is met prospectively and not otherwise. This sharpens point 8 rather than replacing it: the single-reader condition is standing, and this is its first priced consequence.
+  **A2 — 'UNTESTED-IN-FORCE' IS RESTATED AS UNTESTABLE, AND H1(b) IS SATISFIED PROSPECTIVELY ONLY.** REVIEWED-121's closing paragraph records the
+  doctrine as 'untested-in-force'. *Untested* implies testable-and-untested. On the inherited set the doctrine has **no defeater at all** — not a
+  weak one, none — and cannot acquire one. The accurate statement: **the whose-proposition test is untestable on the entire inherited fr/en set,
+  permanently, and its defeater is exercisable only by newly-authored pairs.** H1(b)'s requirement that an AUTHORIZED doctrine state what would
+  falsify it is met prospectively and not otherwise. This sharpens point 8 rather than replacing it: the single-reader condition is standing, and
+  this is its first priced consequence.
 
-**A3 — ⚠ REQUIRED: THE LATCH WILL OTHERWISE DISCHARGE A DISCLOSURE IT DOES NOT COVER.** `defeater_has_ever_been_exercisable` is a monotone latch, which is right as far as it goes. But when the first newly-authored pair records a pre-doctrine disposition, the latch flips to `true` — and thereafter any recall figure pooled over the fr cell carries `true` while the inherited spans still carry no pre-doctrine disposition and never can. One pair from outside the inherited set would silently discharge a disclosure covering eleven spans it has nothing to do with. That is the PENDING-136 denominator class — a fact true of one population read as true of another — and this instance would be **built into the mechanism** rather than committed in prose. Fourth occurrence in this arc; the first that would be structural. Required alongside the latch, in `corpus/v2-stratum-tags.yaml`:
+  **A3 — ⚠ REQUIRED: THE LATCH WILL OTHERWISE DISCHARGE A DISCLOSURE IT DOES NOT COVER.** `defeater_has_ever_been_exercisable` is a monotone latch,
+  which is right as far as it goes. But when the first newly-authored pair records a pre-doctrine disposition, the latch flips to `true` — and
+  thereafter any recall figure pooled over the fr cell carries `true` while the inherited spans still carry no pre-doctrine disposition and never
+  can. One pair from outside the inherited set would silently discharge a disclosure covering eleven spans it has nothing to do with. That is the
+  PENDING-136 denominator class — a fact true of one population read as true of another — and this instance would be **built into the mechanism**
+  rather than committed in prose. Fourth occurrence in this arc; the first that would be structural. Required alongside the latch, in
+  `corpus/v2-stratum-tags.yaml`:
 
   ```yaml
   defeater_has_ever_been_exercisable: false
   defeater_dispositions_recorded: 0
   defeater_population: <cell + the criterion the count is taken over>
 ```
+
+  defeater_population is named, not assumed — this entry deliberately does not fix a number, because choosing the denominator from a point-in-time
+  read is the error the field exists to prevent. Binding rule: the latch may not be read without the count and the population in the same read. A
+  report may carry all three or none.
+
+  A4 — ⚠ THE GROUND THE REFUSAL RESTED ON WAS CITED BY A NAME WITH NO REFERENT, AND THIS PARAGRAPH REPLACES THE DRAFT THAT MERELY CALLED IT
+  UNCITABLE. The refusal to back-fill was grounded in test_legacy_indices_are_not_self_verified, and the executor carried that name into
+  corpus/v2-stratum-tags.yaml, commit 5425414's message and a steward report. No such function exists. This seat searched all 273 items in
+  PENDING.md, PENDING-archive.md and REVIEWED.md for self-verified, found nothing, ran a positive control on defeater returning REVIEWED-121 and
+  PENDING-134 as expected, and concluded the test was reachable only from the executor's side. It was reachable from neither: the name occurs once in
+  the entire repository, in a docstring at tests/test_reading_index.py:23 asserting that it 'holds that shut' — a label whose referent nobody had
+  opened. Fourth instance of cited-a-derived-label-instead-of-the-substrate, the class that let three documents protect a 0-byte fixture for seven
+  weeks. The reasoning is unaffected and the property IS tested, by checks citable by their own text: tests/test_reading_index.py L128 ('NO legacy
+  region is "verified by fingerprint" — none stores one'), L130 ('a region with no stored fingerprint and no name test is UNVERIFIED'), and the
+  synthetic positive control at L281 ('a stored hash that DOES match yields verified by fingerprint') — without which L128's pass could be vacuous,
+  which is precisely why a bare name was never sufficient ground. Corrected in the substrate at 966168b.
+
+  What does not change. The doctrine paragraph as ratified. Point 9's H3 disclosure. The conditionality on PENDING-131 (c) at point 5. No span is
+  re-dispositioned — L926 and L1551 stand as at REVIEWED-118 and REVIEWED-119. ratio_A_to_B remains VOID, still awaiting PENDING-137 and all
+  dispositions (REVIEWED-116 point 5). Tag follow-on commits REVIEWED-121-A1.
+