---
name: skill-harvest-register-proposed-skills-awaiting-steward-authorization
description: Standing register of skill create/patch/retire proposals surfaced by
  /wrap-up §1.6, awaiting steward authorization. The governed analog of PENDING.md,
  turned on our own tooling — propose → authorize → build → record. Surfaced every
  wake via this MEMORY entry.
metadata:
  node_type: memory
  type: reference
  originSessionId: a8eb1d46-314e-4545-a133-f747c69ad5b4
permalink: claude-memory/skill-harvest-register
---

# Skill-harvest register

The single place proposed skills live so they don't evaporate between sessions. `/wrap-up` §1.6 *proposes* here; the steward *authorizes*; only then is a skill created/patched/retired (never autonomously — the loop is load-bearing, per PENDING-23). `/wake-up` surfaces the open proposals via this entry. The governed analog of `~/PENDING.md`, for our own tools.

**Status legend:** `PROPOSED` (awaiting steward) · `AUTHORIZED` (proceed to build) · `BUILT` (done; move to the built-log) · `DEFERRED` (reason + condition) · `REJECTED` (reason; don't revisit without new input).

## Open proposals

*Full review with steward 2026-06-05 (housekeeping session) — every item ruled, evidence-checked against the KG drift/built record. Verdicts below.*

| Skill | Kind | One-line | Origin | Status |
|-------|------|----------|--------|--------|
| `/spec-code-audit` | create | Audit live code against a spec-contract section clause-by-clause; classify each gap; deliverable = gap-map. | 2026-05-29 | **BUILT 2026-06-07** — deferral condition met from the ARC direction (Seb's completeness question revived the justification; steward authorized build-from-this-run). Generalizes the four-pass bidirectional method proven on the full ARC audit (`_audits/spec-code-full-audit-2026-06-07.md`: 172 findings, 66-agent fan-out, adversarial refutation, 2 kills). Skill at `~/.claude/skills/spec-code-audit/`. Serves L1's first spec-vs-code audit as originally intended. |
| `bmf-diagnose` | create | N6 `EXPLAIN`-first root-cause method for L1/BMF storage pathologies. | 2026-05-27 | **AUTHORIZED 2026-06-05** (build at next L1 diagnostic need). |
| `mempalace-diagnose` (was `mcp-drop-diagnose`) | create | Upstream-issue-first method for MemPalace/MCP failures (proved on #1495; HNSW quarantine + search errors 2026-06-05). | 2026-06-02 | **AUTHORIZED 2026-06-05**. *Merge with bmf-diagnose RETRACTED same evening* — the merge was itself the MemPalace≠BMF conflation (steward's 3rd correction): one substrate we build, one we merely use. Two skills, two names. |
| `/pre-build-audit` | create | The four-pass *scope-claimed-vs-scope-tested per claim, with substrate evidence* discipline. | 2026-05-28 | **AUTHORIZED 2026-06-05**, build-on-next-big-build (cascade Stage 2 / vignette Phase 1 / L1). |
| `/vignette` | create | Phase-α vignette genome generation under Symmetria. | 2026-05-28 | DEFERRED (until vignette Phase 2) — condition unchanged, re-confirmed 2026-06-05. |

## Built / authorized (lineage — for context, not action)

- `/landscape-scan` + `/tooling-scan` (the scan-skill family, per-workstream lens cards) — built + in use (2026-05-27).
- `/wrap-up` §1.6 skill-harvest step + `/wake-up` §2.a/§3 glance — the practice itself (PENDING-23, 2026-05-27).
- Chaîne-d'union clasp across wake / Symmetria / wrap (2026-05-26).
- `/wrap-up` §4.0 — MemPalace liveness-ping-before-diary; steward-authorized + applied (2026-06-02; #1495 cold-start drop resilience, so a silent drop never eats the wrap filing).
- `/wrap-up` §6.5 dotfiles session-state commit+push (scoped add, session-stamped message, preservation-not-modification boundary) + `/wake-up` §2.c read-only push-check — steward-proposed and authorized conversationally, built same session (2026-06-05 housekeeping). Closes the governance-state single-disk latency that `sysupdate`'s calendar cadence left open; sysupdate keeps the catch-all sweep + Brewfile dump.
- **Symmetria §3 — two flags added** (2026-06-05, authorized + built same evening): *trust-prior-pass-frame* (frame-inheritance from prior verification into untested domain) + *census-through-truncation* (count first, then look). Closes the long-standing §3 patch proposal.
- **`reference-verification-ladder.md`** (2026-06-05, authorized + built same evening): one canonical home for the proven instruments (byte-identical compile gate, expected-delta/delta-classification, censused-routes, measure-toolchain-before-spec, compiled-selector grep, governed-char byte gate, WCAG compute, fresh-clone gate, live-fetch gate, per-type×per-viewport, re-verify-at-extension-scope). Ends the per-wrap re-proposing; future instruments append there, not here.
- **`/arc-typeset` REJECTED** (2026-06-05): superseded — §I.k.b/c moved the mechanical pass into the build; LINT class carries judgment warnings; multilingual §2.5 carries authoring notes; `french-typography-pass` covers the French preparation layer. Do not re-propose without a new gap.

## Candidate patches not yet proposed (watch-list)

- ~~Register wiring (authorized 2026-05-29)~~ — **APPLIED 2026-06-05 (evening wrap)**: wrap §1.6 now appends here; wake §2.a now reads here. Provenance notes in both skills.
- A Symmetria §3 flag for `verify-counts-two-ways` / mechanical-sweeps-finicky (saved as `feedback-verify-counts-two-ways.md`; may graduate to a flag if it recurs).

## New proposals (2026-06-06 wrap — awaiting steward)

| Skill | Kind | One-line | Origin | Status |
|-------|------|----------|--------|--------|
| `bmf-diagnose` | **build now** (already AUTHORIZED 2026-06-05 "at next L1 diagnostic need") | Today WAS that need and the method is proven+fresh: process sample → log pattern census (`uniq -c` histogram) → SIGUSR1→CDP CPU profile (working script at `/tmp/profile-mindfabric.mjs` — fold in before /tmp clears) → read-only SQLite census (`?mode=ro` URI) → evidence preservation to `l1-reliability/evidence/` → restart-with-capture. Hand-derived today over ~2h; the skill carries it next time in minutes. | 2026-06-06 mindfabric-00 forensics | PROPOSED (build, not authorize — authorization exists) |

## New proposals (2026-06-05 evening wrap — awaiting steward)

| Skill | Kind | One-line | Origin | Status |
|-------|------|----------|--------|--------|
| `/wrap-up` §5 | patch | **Palace-fully-derived, part 1:** mirror every `kg_add`/`kg_invalidate` made at wrap into the session memory file (one line each), so KG facts — the last palace-only data — become file-backed and the palace becomes wholly disposable/rebuildable. | 2026-06-05 MemPalace forensics + tooling scan part (b) | PROPOSED |
| `/wake-up` §2.b | patch | Until upstream #1665 closes: wake searches run **unscoped + post-filter by wing** (wing-scoped `mempalace_search` errors at HEAD). Remove when the feedback memory `feedback-mempalace-wing-filter-broken` is deleted. | 2026-06-05 diagnosis | PROPOSED |
| `/wake-up` (new step or §2 check) | patch | **Wake canary**: seconds-cheap probe at wake — every MEMORY.md pointer + `[[link]]` resolves to an existing memory file; flag dead pointers and load-bearing orphans. Lesson 7 of substrate-failure-lessons-2026-06-07 (BM false-clean sync) applied to our own index, which the harness already part-loads with a warning. | 2026-06-07 evening (memory-verdicts night) | PROPOSED |

## New proposals (2026-06-08 — harvested from Fowler, *Refactoring* 2nd ed. chs 1–3, awaiting steward)

*Read in the Chamber before Wave 3R. Three elements are genuinely NEW to our toolkit (not already carried by the verification ladder / Symmetria); two more are heuristics worth a feedback memory. Proposing the new ones; flagging where each would land on authorization.*

| Element | Kind | One-line | Where it lands | Status |
|---------|------|----------|----------------|--------|
| **Revert-and-redo-smaller** | Symmetria §3 flag OR ladder note | Ch1's strongest working reflex we *don't* have: when a verification/gate fails and the cause isn't immediately visible, **revert to the last green commit and redo the step smaller** — do NOT debug forward. We default to debug-forward; this is a different reflex, and it depends on commit-after-every-green (which we already do via the byte-identical gate). | Symmetria §3 (a flag) or verification-ladder (a named discipline) | PROPOSED |
| **Two-hat commit separation** | verification-ladder entry | Name which hat each commit wears: a *refactor* commit's compiled output is byte-identical (or carries a pre-stated classified delta); a *feature/behaviour* commit is where rendered values change. We already own the byte-identical gate + delta-classification — this names the **commit-level rule** that pairs them ("never mix a structural move and a value change in one step"). The ARC `@layer` re-partition is the textbook case. | verification-ladder (formalizes what the byte-gate implies) | PROPOSED |
| **Bad-smells → refactoring lens** | reference card OR fold into `/code-review` | Ch3's smell catalogue (Mutable/Global Data, Duplicated Code, Shotgun Surgery, Speculative Generality, Comments-as-deodorant…) as an explicit review lens. Today it classified the `!important` census cleanly (global-data smell → `@layer`). Likely too large for a new skill; candidate to fold into `/code-review`'s prompt or a one-page reference beside the ladder. | `/code-review` prompt or new reference | PROPOSED (lowest priority — may be redundant with existing review skill) |

**Heuristics (feedback-memory candidates, no skill needed):**
- **Rule of Three** (ch2): first time do it, second wince, third refactor. Defer abstraction to the third repetition.
- **Preparatory refactoring** (ch2, Kent Beck): *"make the change easy (warning: this may be hard), then make the easy change."* The framing for sequencing Wave 3R *before* Stage G — Jessica Kerr's "drive north to the highway." 

*Note: measure-don't-speculate (ch2 date-range story) is NOT proposed — already carried by the ladder (censused-routes, measure-toolchain-before-spec). Today's census re-proved it; no new instrument needed.*

## New proposals (2026-06-08 evening — the tree + the memory-index archive pass)

**Verification-ladder additions (the session proved both; → `reference-verification-ladder.md`):**
- **content-multiset-identity gate (file-split/extraction under @layer)** — when a refactor *moves rules between partials* (not just reorders one), the byte-identical compile gate FAILS: each new partial adds a legitimate `@layer base { }` wrapper. The correct proof: strip `@layer …{` openers and lone `}` lines, sort, diff → identical content-multiset proves no rule changed/added/dropped while the wrapper count differs as expected. Proven 5× (the `_utilities` dissolution). PROPOSED.
- **CAUTION: property-name-exact collision measures miss shorthand↔longhand + cross-selector-same-specificity** — the `.ornament` margin flip (`margin` shorthand vs `margin-top/bottom` longhand) was invisible to the automated `/tmp/collide.py`; only the source-read caught it. The automated census is the floor; the per-move render gate is the guarantor (byte-identical≠rendered-identical, one layer down). PROPOSED.

**Memory-index (MEMORY.md) — the archive pass + the durable fixes:**
- **DONE 2026-06-08 (steward-authorized, live): compress-in-place archive pass.** 90 archived-session bullets compressed to one-line pointers (detail preserved in the session files), **285KB→157KB**, all 239 pointers preserved, every load-bearing section byte-identical; backup `/tmp/MEMORY.md.bak`. ⚠ A naive split-at-first-`## Archived` was **caught-and-avoided** — the file is INTERLEAVED (archived blocks scattered among load-bearing reference sections: Pending work / Feedback / Drift patterns / ARC project state / CapableMind L1 / Personal Context / Reference Files). Surgical compression of only archived bullets is the correct tool for an interleaved index.
- **[PATCH proposal] `/wrap-up` §3 — compress at demotion.** When demoting Active Session → Archived, compress the entry to a one-liner in the *same move* (it's already in the session file). Prevents index re-bloat at the source — without it the index re-grows ~4–5KB/session and this pass recurs.
- **[PROPOSAL] deeper MEMORY.md reduction (only if 157KB still trips "only part loaded").** The load-bearing REFERENCE sections (steward profile / project states / ARC project state / CapableMind L1 / Reference Files) are large but largely STABLE — candidate to move to a consult-on-demand `MEMORY-reference.md`, leaving the wake-loaded MEMORY.md = standing prefs + trackers + Active Session + recent. Riskier (real memory, not duplication); its own focused pass, not a tail-of-session move.
- **[reminder] the wake-canary** (PROPOSED 2026-06-07, above) still awaits authorization — the paired guardrail (every MEMORY.md pointer + `[[link]]` resolves at wake); should cover MEMORY.md + any future archive/reference split files.

## New proposals (2026-06-09 — the headless-Chrome measurement harness, awaiting steward)

| Element | Kind | One-line | Where it lands | Status |
|---------|------|----------|----------------|--------|
| **Headless-Chrome box-model measurement** | create skill OR verification-ladder note | When a rendered layout *differs* and the cause isn't obvious, **measure the box model before theorizing the mechanism**. Today this caught the phone-compass cause (per-point *padding asymmetry*, not width) after *causal-story-before-reading-render* recurred 2× (a footer-only first pass, then a wrong `align-self:stretch` width-fix). Reusable core: `npm i puppeteer-core` in a tmp dir · `executablePath` = `/Applications/Google Chrome.app/...` · `setViewport({width:375,…,isMobile:true})` · `page.evaluate` reading `getComputedStyle`/`getBoundingClientRect` (widths, padding, row counts). Chrome reproduced the bug → it wasn't the Safari quirk I'd hypothesized. | a `/measure-render` skill, or a verification-ladder entry ("measure the box model before theorizing a layout difference") | **PROPOSED** |
| **Symmetria §3 flag: theorize-before-measuring-a-layout** | Symmetria §3 flag | The drift this caught, as a standing flag: a *causal story about why a layout renders as it does*, asserted before the rendered box model is measured, is contamination shape (same family as `causal-story-before-reading-render`, one step more specific — layout/CSS). Antidote: the harness above. | Symmetria §3 | **PROPOSED** (may be redundant with the existing `causal-story-before-reading-render` flag — steward to judge) |

## New proposals (2026-06-09 pm — the typographic audit / measure / soft-rag day)

| Element | Kind | One-line | Where it lands | Status |
|---------|------|----------|----------------|--------|
| **`/measure-render` (headless-Chrome box-model harness)** | create skill OR ladder note | **RE-FLAG — strongly earned.** Proposed this morning (compass fix); the pm session ran it **4+ more times** (true-advance measurement, viewport resize sweep, auto-vs-none hyphenation test). Proven repeatedly across one day. *Caveat learned: headless Chrome cannot test hyphenation — it ships no hyphenation dictionaries (all configs gave identical heights); the real browser is the only valid hyphenation test.* | `/measure-render` skill OR verification-ladder | **PROPOSED (reinforced)** |
| **Measure the font's true average prose advance before a character-count measure** | verification-ladder entry | When setting a measure to a target character count, **measure the font's average advance over real corpus prose (incl. spaces), not the 0.5em convention.** The convention misestimated EB Garamond by **32%** (0.377em measured vs 0.5em assumed → the column ran ~90 chars, not the believed ~68). The instrument that overturned ARC's measure. | `reference-verification-ladder.md` | **PROPOSED** |
| **ARC build has NO autoprefixer — hand-write `-webkit-` prefixes** | feedback memory | ARC's plain-`sass` build adds no vendor prefixes. When introducing a new CSS property, check Safari's prefix need and hand-write it. The `-webkit-hyphens: auto` Safari bug came from prefixing the *limits* but not the *property* — an inconsistency that read as "hyphenation off in Safari." | `feedback-arc-no-autoprefixer-handwrite-webkit.md` | **PROPOSED** |
| **Justification-judgment bar = Bringhurst even-colour/rivers, NOT Rutter hyphenation** | feedback memory | Load-bearing for the future justification decision: when living with the soft rag to judge whether to justify, ask *"is the colour even, are there rivers"* (Bringhurst paragraph-level), **not** *"is it hyphenating"* (Rutter). The jurist corrected the executor's Rutter-leaning rationale. Either earns the KP/JS gate-amendment or retires it. | `feedback-justification-bar-bringhurst-not-rutter.md` | **PROPOSED** |

## New proposals (2026-06-10 — Stage-G close + spec-internal consistency audit day)

| Element | Kind | One-line | Where it lands | Status |
|---------|------|----------|----------------|--------|
| **spec↔spec coherence dimension** | patch `/spec-code-audit` | The 2026-06-10 audit found §I.f-class contradictions — the measure (38→27.2rem) un-propagated across silence-and-rhythm/apparatus/vignette, an American-quote remnant, v0.5/AUTHORED status leftovers — that bidirectional spec↔**code** could not catch, and that the jurist's read-scope (charter+multilingual only) missed. Add a **cross-document spec↔spec coherence pass**: every cross-referenced rule agrees across files; every late decision swept across ALL companions, not just its primary home. Proven method: a per-file-vs-canon + cross-reference fan-out (6 read-only agents). | `/spec-code-audit` (new dimension) | **PROPOSED** |
| **container-must-embody-the-contained** | feedback memory | When producing an ARTIFACT *of* a spec (a PDF of the spec, a rendered sample), set it per the spec's OWN rules and verify the render **against the doctrine, not for approval.** 2026-06-10: the Codex PDF violated its own §I.d (bold), §I.i (justified), §I.b (lining figures), §I.h (marked blockquotes), §VII.e (grey), and earlier the whole-document small-caps — and I read each render *favourably* instead of testing it against the spec (the SC miss especially). Sibling of `causal-story-before-reading-render` / read-render-favorably, one level up: the artifact must obey what it states. | `feedback-container-must-embody-the-contained.md` | **PROPOSED** |
| **check-for-governed-tooling-before-building** | feedback memory OR Symmetria §3 flag | Before hand-rolling infrastructure (a PDF preamble, a build script, a template), grep the repo for an existing governed version. 2026-06-10: I reinvented a lualatex preamble while `tools/latex/arc-typography.sty` (the governed PDF/print substrate, encoding the very rules I was hand-fixing) existed; the steward's "did we not do a basic pdf spec?" caught it. Kin to `reinvented-governed-tooling-without-checking-it-exists` (KG drift, 2026-06-10). | feedback memory or Symmetria §3 | **PROPOSED** |
| **byte-identical gate: hold/exclude volatile build-stamps** | verification-ladder refinement | When proving a change byte-identical, a build-date/commit stamp (e.g. the colophon `_build_info/stamp`) will differ between baseline and post builds and falsely flag a diff. Hold the stamp constant (don't re-run `make build-info`) or exclude the stamped file, then diff. Caught 2026-06-10 (G1 proof: the lone "diff" was the colophon stamp). | `reference-verification-ladder.md` | **PROPOSED** |

*Not a skill — a parked project task (in the ledger + session file): the **Phase-2 print/PDF-spec session** to update `arc-typography.sty` + `template-pdf-posture.tex` to current doctrine (posture-aware ragged/justified, Medium headings, 27.2rem measure-geometry, British quote-normalization, xelatex glyph routing, v0.3). Governs all future ARC PDFs.*

---

*Discipline reminder: "no harvest" is a valid outcome; do not manufacture proposals to fill the table (the inverse of Hermes's autonomous self-write). The yardstick is the steward's: did the steward have to re-explain something a skill could have carried?*
## New proposals (2026-06-11 — §VII.f / open-work-reckoning day, awaiting steward)

| Element | Kind | One-line | Where it lands | Status |
|---------|------|----------|----------------|--------|
| **Symmetria §3 flag: inherited-marker-read-as-current-state** | Symmetria §3 flag | A status/marker inherited from a RECORD (a selector-index entry, a tracker line, a "-pending" file, a prior framing) asserted as current state without verifying against code/live is contamination shape — **records drift, in BOTH directions** (stale "pending" files describe DONE work; "done" narratives hide OPEN work). Earned hard 2026-06-11: 3 stale-index misreads in one turn (running-head index entry, the "only unbuilt element" overclaim, the colophon) + the steward's two corrective catches (colophon done-mislabeled-pending; cul-de-lampe open-mislabeled-done). Antidote: verify status against the substrate before asserting. Kin to `live-state-discipline` / `reasoning-from-remembered-model-not-current-state`, generalised to ALL records. | Symmetria §3 | **PROPOSED** |
| **`/measure-render` (headless-Chrome box-model/scroll harness)** | create skill OR ladder note | **RE-REINFORCED (4th day of evidence).** Proposed 2026-06-09 (compass fix) + reinforced 06-09 pm; today drove the ENTIRE §VII.f build — reveal opacity across scroll, body-column-axis alignment (598/798 constant), the dissolve-below-rule geometry, the frontispiece no-scroll proof, the compass graded reveal. The build would not have been groundable without it. Earns its own skill. | `/measure-render` skill OR verification-ladder | **PROPOSED (strongly reinforced, 4th instance)** |

*Watch-list (not yet a skill proposal): the **open-work register pattern** — when tracking surfaces drift, consolidate them into ONE code-verified source of truth (built `project-arc-open-work-register.md` today). Overlaps `/spec-code-audit` for the spec↔code half; the new part is the content/governance/Phase-2 reconciliation. May graduate to a `/reconcile-open-work` discipline if it recurs on another workstream (L1/be).*

## New proposals (2026-06-12 — Studium planning charter / model-routing day, awaiting steward)

| Element | Kind | One-line | Where it lands | Status |
|---------|------|----------|----------------|--------|
| **`/model-handoff` (premium-model scope charter)** | create skill OR reference card | When switching to an expensive/premium model (Fable 5 = 2× Opus rate; burn scales with context×session-length) for a **bounded high-leverage phase**, first write the **scope charter on the cheap model** — the bounding/orientation reasoning is cheap, the content reasoning is where the premium pays. Charter shape (proven today, `studium-engine/docs/stage-1-planning-brief-2026-06-12.md`): §0 operating discipline (1M window — `claude-fable-5[1m]` not bare-200k; reset thinking level on switch; no sprawl) · §1 settled decisions (don't re-derive) · §2 already-read summaries (don't re-read) · §3 bounded reading list (verified paths; out-of-scope named) · §4 exact deliverables · §5 report-and-stop. Plus: **clear+wake rather than switch-in-place** so the premium model never rereads the long chat; **artifacts (not chat) are the handoff** (the Reddit "knowledge in files not chat" insight, but **reject** its "query the graph instead of files" — that's the index-as-source-of-truth shape). Recurs every Fable session in the 06-22 window and beyond. | a `/model-handoff` skill OR a reference card beside the verification ladder | **PROPOSED** |
| **verification-ladder: feature-detect gates can lie** | verification-ladder entry | A CSS `@supports(feature)` (or any capability probe) can return **true on a platform where the feature is non-functional** — today the ARC §VII.f running head: `@supports(animation-timeline:view())` is `true` on iOS Safari 26, but mobile WebKit won't *drive* the scroll-reveal on a `position:fixed`+`timeline-scope` consumer (`display:block, opacity:0`); desktop Safari works. So a progressive-enhancement "no-support shows nothing" contract can be **silently false** on a major platform. Antidote: **verify the feature on the real engine/device, not the support table** — `CSS.supports(...)` + computed-`opacity`/`getBoundingClientRect` on-device (the iOS analog of the headless-Chrome box-model harness). Kin to `/measure-render`; one level up (feature-functionality, not box-model). | `reference-verification-ladder.md` | **PROPOSED** |

*(Both genuine, both recurring-shaped — not manufactured. The first will pay off the very next time the steward opens a Fable window; the second generalizes today's running-head correction into a standing instrument.)*

## New proposals (2026-06-12 night — Studium Stage-1 build / source-cleaning, awaiting steward)

| Element | Kind | One-line | Where it lands | Status |
|---------|------|----------|----------------|--------|
| **verification-ladder: parse/validate machine-consumed artifacts that have only ever been human-read** | verification-ladder entry | When an artifact that humans have only ever *read* (a hand-authored YAML index, a config, a data file) is about to be *machine-consumed* for the first time, parse-and-validate it BEFORE trusting it. Today: **all four** chamber reading-index YAMLs were defective and **eye-invisible** — three had unparseable YAML (a list entry starting with a quoted phrase then trailing text, e.g. `- "The Wanderer" (Old English poem)`), one had silent anchor-drift; the Read tool renders them fine, so eye-review and the prior cruft audits never caught them. The engine was the first machine reader. Antidote: `yaml.safe_load` (or the consumer's real parser) + anchor-verify against the substrate, both directions, before binding. Kin to the deliberate-mismatch gate, one level up (artifact-validity, not output-validity). | `reference-verification-ladder.md` | **PROPOSED** |
| **clean cruft at the SOURCE layer, not as a downstream transform** | feedback memory | When a source carries conversion cruft (EPUB footnote-links, image-scan embeds), clean it at the SOURCE — producing a new canonical file (new hash, re-anchor) — not as a chunk-time/read-time transform. A downstream strip makes `text_original` a *transform* of the file rather than a byte-faithful *slice*, silently violating the verbatim guarantee. Spec §5 names this the primary path; the steward's instinct ("attend to the source files") corrected my chunk-time-rule fallback. Technique note: when footnote *display* numbers restart per-section (so `[45]` recurs), pair/label by the globally-unique anchor id (`#nf K`/`#anf K`), not the visible number — Pandoc renumbers on render anyway. Governed cleaner built: `chamber-library/scripts/clean_epub_residue.py`. | `feedback-clean-at-source-not-downstream-transform.md` | **PROPOSED** |

*(Both earned in use, both recurring-shaped. The first generalizes today's all-four-indices-defective finding into a standing gate; the second captures the steward's layer/placement correction — his instincts about WHERE a thing belongs were load-bearing twice today, also worth holding.)*

## New proposals (2026-06-13 — Studium Steps 3-4 / chamber canonical-tier day, awaiting steward)

| Element | Kind | One-line | Where it lands | Status |
|---|---|---|---|---|
| **dry-run-first for bulk file operations** | verification-ladder entry | When a mutation touches many files at once (mass `git mv`, graduation, rename), build it **dry-run by default** and emit the full move-map + collision-guard + reference-scan (`git grep` each old basename) BEFORE `--apply`. Proven 3× today (`canonicalize_filenames.py`, `graduate_to_canonical.py`, and the graduation preview) — the steward approved each from the preview, and the preview caught the 7 stale hand-doc references + 0 collisions before anything moved. Kin to the byte-identical gate, generalized to file-tree moves. | `reference-verification-ladder.md` | **PROPOSED** |
| **Symmetria §3 flag: census-through-a-pattern** | Symmetria §3 flag (refines census-through-truncation) | A filter/regex used to *count* or *partition* a set can silently mis-match and the count reads as authoritative. Today `grep -iE 'LOG'` for meta-files matched "episteme**LOG**y"/"pheno­meno­**log**y"/"eco**log**y" → 49 false "meta" files (real = 4). Antidote: verify the pattern against known positives AND a known negative before trusting the partition; anchor patterns (`_LOG\.md$` not `LOG`). One step more specific than census-through-truncation (which is about *coverage* of the scan; this is about *correctness* of the matcher). | Symmetria §3 | **PROPOSED** |

*(Both genuine, both recurring-shaped. The first will pay off the next bulk corpus move — the 237 dirty files graduate incrementally, each a potential bulk op. The second caught a real false-count today and is a clean refinement of an existing flag.)*

## New proposals (2026-06-13 post-clear — L1 /health PR + Studium Steps 5-7 + the dilution correction)

| Element | Kind | One-line | Where it lands | Status |
|---|---|---|---|---|
| **Symmetria §3 flag: solve-the-constraint-by-discarding-the-value** | Symmetria §3 flag | A "fix" that satisfies a stated constraint by **removing the thing the constraint was protecting** is contamination shape — it optimizes away the value to avoid a failure. Caught HARD today: the steward's dilution memory → my first Step-7 verdict bounded vector to voice-scope-only ("never a global semantic index"), which *solved* dilution by discarding the engine's core value (whole-corpus depth+breadth). The steward caught it; correction restored depth-WITH-breadth (dilution = engineering problem, not a reason to forbid the capability). Antidote: when a constraint forces a fix, check the fix **preserves the value the constraint was guarding**, not merely satisfies the constraint. Kin to the executor-bias-to-satisfy-the-interlocutor, one level up (satisfy the *constraint* over the *truth*). | Symmetria §3 | **PROPOSED** |
| **verification-ladder: re-verify a workflow/sub-agent's per-item dispositions on the real apply** | verification-ladder entry | A sub-agent or background workflow that reports a per-item verdict from a **dry-run on a temp copy** can be wrong on the real apply — the agent's own audit can differ. Caught today: the cleaning-triage workflow classified `la-terre-…-Bachelard` as "cleanable to 0" (dry-run on a temp copy); the real `strip_cruft` run left **460 cruft** (7 passes). 23/25, not 25, graduated. Antidote: treat a workflow's dispositions as *candidates*; re-run the gate on the **real mutation** before trusting/committing. Kin to `/symmetria audit-agent` (calibration/convenience checks on a return), specialized to workflow per-item verdicts + the real-vs-dry-run gap. | `reference-verification-ladder.md` | **PROPOSED** |

*(Both earned in use today. The first is the load-bearing one — a clean name for a contamination shape the steward caught live, and a genuine addition to the §3 catalogue. The second is a concrete guardrail for the now-standard workflow-fan-out pattern.)*

### Harvest 2026-06-15 (chamber-clean + studium charter)

| Element | Kind | One-line | Where it lands | Status |
|---|---|---|---|---|
| **Symmetria §3 flag: assert presence/absence from a fuzzy matcher, not the substrate** | Symmetria §3 flag | A presence/absence claim produced by a **fuzzy/token matcher** (filename tokens, embeddings, author-surname overlap) treated as **fact** is contamination shape — the matcher's false-positives/negatives become confident assertions. Caught **4× in one session**: the physical-library gap analysis claimed *Timeless Way of Building* absent, then 44 of 49 "load-bearing gaps," then physical-worthy candidates, then the gap list — all wrong; the steward corrected each. Cause: the matcher required author-surname + title in the *same* filename, and 1,072 chamber sources have no frontmatter. Antidote: **verify any presence/absence claim against the substrate** (content-grep the actual text) **before asserting** — and prefer reporting *candidates-to-verify* over claims. Kin to the censused-routes flag (don't claim coverage from a sampled read), specialized to matcher-derived membership claims. | Symmetria §3 | **PROPOSED** |

*(One candidate, load-bearing: it recurred four times in a single session and the steward caught every one. A clean §3 flag would have made me reach for the content-grep before the first assertion.)*

### Harvest 2026-06-16 (officina + the chamber conversion-tooling upgrade)

**Standing discipline ESTABLISHED (steward-directed):** *review every conversion/audit/repair tool after each use — success or failure — capture what it taught, iterate until reliable.* Home: `chamber-library/_curation/tool-evolution-log.md` (operationalizes conversion-skill-plan §13). PASS-BUT-FALSELY (tool reports success on a wrong result) is the priority signal. **This is a standing memory:** see [[feedback-tool-review-after-each-use]].

**BUILT + validated 2026-06-16 (the conversion batch's tools, "made most effective they can be"):**
- `audit_cruft.py` hardened — added `md_image` (any `![](…)`, not just `img/`), `svg_raw`, `repl_char` (`U+FFFD`). Re-audit surfaced **160 standing canonical files with residue the old gate hid** (95 image / 64 svg / 8 encoding) → corpus cleaning pass owed.
- `verify_conversion.py` NEW — the composite verifier (the planned `/convert-verify` in script form): cruft + heading-density + ocr-damage + encoding + word-sanity, pass/fail per check. Calibrated (Greek-apparatus false-positive fixed → 948/952 on clean Loeb tier).
- `repair_epub_headings.py` fixed — hyphen-separator bug (Crawford 4→12 headings, all chapters) + honest structural-coverage report (fails loud, no more silent partial ships).

**PROPOSED (register, awaiting steward / for the historical-treatise track):**
- Author the four `/convert-*` skills proper (the v3 plan) — today's manual run is their empirical spec.
- `ocrmac_pdf.py`: retain per-token confidence (currently discarded) → per-page confidence + low-confidence flagging; auto-detect-body-column (the TODO); apparatus-zone separation.
- **OCR frontier = research track, not a tweak:** no validated polytonic-Greek/Latin/fraktur/critical-apparatus path exists (ocrmac=modern-Latin only; Marker CPU-infeasible >50pp). Needs investigation before historical treatises + the apparatus `role` vocabulary (jurist-owed).
- Positive language-validity check (dictionary-valid-word ratio per language) for verify_conversion — catches "no cruft fires but text is OCR garbage."
- Promote today's catalogue census (title+author co-required, evidence-emitting) into a reusable `census_membership` tool.
- Calibration follow-ups logged: word_sanity floor vs genuine short fragments; repair coverage threshold should weight content over front-matter.