session 2026-06-18: PENDING-40 (ARC operations protocol) + CV-finalized session memory + ledger

PENDING.md

@@ -947,3 +947,20 @@ The Jurist's six-phase authorization map governs sequencing. Cross-cutting succe
 **Verification:** `stack build` clean; headless-Chrome measured the reveal (opacity 0→1 at title exit), the compass graded reveal (0.15→0.4/0.6/0.8, compass clickable), and band-axis alignment (band centre == breadcrumb centre 598@1280 / 798@1680). Invariant verified: `running_head ∈ {yes,conditional,per} ⊆ title_display: shown`.
 **Files affected:** `scss/AldineXXI/_running-head.scss` (new), `scss/AldineXXI/_frontispiece.scss` (compass approach-reveal), `scss/AldineXXI/_variables.scss` + `_sidenotes.scss` (token move), `scss/main.scss` (`@use`), `templates/post.html` + `templates/frontispiece.html`, `site.hs` (`TypeFacts`/`ApparatusFacts`, `loadRunningHeadClasses`, `showRunningHeadField`, `postCtx` threading). Specs reconciled: `apparatus-specification.md` §VII.f, `AldineXXI-specification.md` §2044 + selector index, `content-typology-specification.md` Sub-table-4 note.
 **Awaiting:** Steward authorized inline throughout (render-review-gated, every step). Remaining: deploy (running head + compass reveal together) on steward's go-ahead. → REVIEWED-43.
+
+## PENDING-40 — ARC operations protocol (`operations.yaml`) — a governed how-to-proceed router for the executor
+**Date:** 2026-06-18
+**Tag:** PROPOSAL
+**Summary:** Establish a single, drift-proof operations protocol Claude Code consults *before* any ARC change — a triage gate + protected-surfaces stop-list + routine-change procedures — so routine work proceeds safely and any change reaching into the refined ARC structure (the spec, the Stage-G site.hs bindings, the @layer cascade) is *surfaced before it is built*, not undone after.
+**Rationale:** Steward-initiated, with a live case study. On 2026-06-18 a routine-looking task ("drop the CV's redundant page title") was treated as content-grade and built out as a structural change to a Stage-G-clarified `site.hs` binding (the title-display gate) — coupling `articleCtx`, pulling `about-page.html` into the matrix gate, rewriting the G2 intent comment — before being surfaced. The steward caught it ("does this muddy the waters we finally clarified?") and ruled full revert. The weeks of Stage-G refinement (G1–G4 single-source bindings, W3R cascade, the sealed Codex) are exactly what an in-stride structural edit endangers. The same session surfaced a second symptom of the gap: the 06-17 cul-de-lampe commits missed the Stage-E `content-types.yml` regen (14 stale values), because no checkpoint enforced it. A protocol with (a) a front triage gate, (b) an explicit protected-surfaces stop-list → PENDING, and (c) codified routine procedures that name the easy-to-miss steps (the content-types regen, the SCSS partial trap, the shared-template all-consumers check) closes both. Modeled on the now-codified chamber-library `conversion-runbook.yaml`.
+**Design commitments (so it does not itself become a liability):**
+- **Router, not rulebook.** It states *how to proceed* + *which spec § governs*; it never restates a rule. The spec stays the single source for *what*. On any apparent conflict, the spec wins and the router is fixed. (Prevents it becoming a second, drifting source — the very failure mode ARC guards.)
+- **Coupled-update (Stage-E generalized).** When a change-type's governing spec § moves, its router entry updates in the same commit.
+- **Non-decorative binding.** Useless unless actually read at the moment of action: kept short by design; proposed to be wired as the mandatory first read via ARC `CLAUDE.md` (and surfaced at wake). Pairs with — does not replace — the `~/CLAUDE.md` authorization taxonomy.
+**Options:**
+1. **`docs/AldineXXI-Codex/operations.yaml`** (steward-chosen) — beside the spec it operationalizes, versioned with it. *(Draft written, status DRAFT.)*
+2. `ops/arc-operations.yaml` at repo root — more visible as a top-level operational artifact.
+3. Fold into ARC `CLAUDE.md` — simplest, but couples to the orientation doc and is harder to keep machine-checkable.
+**Recommendation:** Option 1 (steward-selected). Keep ARC-scoped for now (it serves the AldineXXI spec); it may become a template for L1/be later if it proves itself — do not generalize prematurely.
+**Files affected:** `docs/AldineXXI-Codex/operations.yaml` (new, DRAFT); on authorization, a one-line pointer added to ARC `CLAUDE.md` ("consult first") and a note at `/wake-up` for ARC sessions.
+**Awaiting:** REVIEWED-44 placement by the steward. **Steward authorized verbally 2026-06-18** (away from machine; could not author the REVIEWED text). On that authorization: `operations.yaml` flipped to OPERATIVE; ARC `CLAUDE.md` pointer added; committed + pushed + deployed. REVIEWED-44 to be written by the steward to close the loop on paper.