--- name: session-2026-09-14-the-guard-was-path-keyed description: "The 59 answered — ZERO name their parent, all position-only, and 37 would be actively MIS-FILED by the obvious repair. Then a jurist falsifier turned my own false claim into the day's finding: Claude Code's memory guard is PATH-KEYED, and our write convention had routed around it. Eight false claims of mine corrected, almost none caught by re-reading. PULLING: the repair of the 59 is per-block and steward-only; the question is whether the register's CONVENTION (PENDING-146) must be settled before anything else is appended." metadata: node_type: memory type: project originSessionId: bcfabffa-1ecb-4d15-9efe-2140912714b9 modified: 2026-09-14 --- # 2026-09-14 — the guard was path-keyed A session that crossed midnight (woke 09-13, nearly all work 09-14) and did both halves of the steward's "proceed sequentially" — the index relocation, then the 59. **Both produced findings that inverted the premise they started from.** --- ## PAST — what moved, and why ### Half one: the index. The premise was right; my correction of it was the error. - **The limit is real and documented:** auto-memory loads **the first 200 lines OR 25 KB, whichever comes first**; content past it is **not loaded at session start**. Established from Claude Code's own docs via a subagent, not from our record. - ⚠ **My wake briefing inverted it.** I reported two competing ceilings (17.1 / 24.4 KB) and announced the measurement had *falsified* the first. **17.1 KB was never a ceiling** — it is the harness's **compaction target**, mis-transcribed as a ceiling in the 09-12 ledger, which I inherited and then "falsified". **Past-me's "~94%" was correct.** 25,000 B = 24.41 KiB, so the 24.4 figure is the documented limit in the other unit. I also asserted the warning was *ours*; it is the harness's, and my **failed grep for an emitter is what proves it**. - **PENDING-186 `[PROPOSAL]` filed** — the structural point stands: **59% of the index is standing preferences that must fire WITHOUT a lookup**, so no trim exists that is not a loss of function. - **AMENDMENT 1 filed** after the jurist's falsifier landed (below), plus a self-correction inside it. ### The jurist's falsifier, and the day's real finding - The jurist caught that *"there is no load-time warning"* was untested, then handed me a test: **if the warning exists and we are at 95%, it should already be firing; if it never has, the writes are outside the instrument.** - ⚖ **It fired. The guard is PATH-KEYED.** **5/5** genuine warnings followed edits via the `~/.claude/projects/…/memory/` **symlink** path; **0/2** via the real `~/dotfiles/claude/memory/` path. `realpath` **identical**. ⚠ Rival excluded by internal control: the silent case was **larger** (23.9 KB) than every firing case. **Pre-registered and confirmed** — an edit routed through the symlink path warned immediately, and stamped frontmatter `modified:` as a second signature. - ⚠ **Our own convention routed around it.** `reference-governance-files-are-dotfiles-symlinks.md` is scoped **`PENDING`/`REVIEWED` only**; I extended it to `MEMORY.md`. **The workaround that makes the write possible is what disables the alarm.** - ⚠⚠ **And I first blamed the note.** Read in full it says *"…for `PENDING.md` and `REVIEWED.md` **only**"* and never mentions `MEMORY.md`. **Nothing to correct — I over-applied a correct note and named the note as the defect.** Corrected in the filed item before any ruling could rest on it. The note gained an **addition**: FILE-symlink ≠ DIRECTORY-symlink (writing *through* the symlink directory succeeds), plus the measured cost. ### Half two: the 59 — answered - **ZERO of 59 name their parent.** Not a split — a floor. The inherited question presupposed a split that does not exist; **all 59 are position-only.** - Buckets (controls: my widening reproduced the instrument's 59 exactly; buckets sum to 59): **(a) explicit `**Amends:**` claim = 0 · (b1) mentions its own position-parent = 12 · (b2) mentions ONLY foreign ids = 37 · (c) no id anywhere = 10.** - ⚠ **THE FINDING NOBODY ANTICIPATED: the 37 are booby-trapped, not merely missing data.** `pos=PENDING-152` whose body offers `PENDING-4`; `pos=PENDING-96` offering `PENDING-97`. **An id-keyed repair reading bodies would mis-file every one, confidently** — a cross-reference and a parentage claim are identical at the token level. **The obvious automated repair is worse than none.** Derived by asking what a CONSUMER must do. - ⚠ **The instrument I was told to enumerate from cannot answer the question.** `register_scan` returns `(label, form, title[:72])` — no body, header truncated. **Its unit is the header; the question's unit is the block.** Handled as a **declared widening**: the module's own recognizers set membership, the body-read is mine and labelled mine. - ⚠ I nearly shipped **12** as "weakly derivable". It is not derivation — consistency is not confirmation. Corrected before reporting. ### The register's own read path is broken, and it nearly produced a ruling on a stale item - The jurist's `governance_item('PENDING-186')` returned the original **byte-identical, with no sign AMENDMENT 1 existed.** It was one step from ruling on an item that **withdraws (c), adds a fifth condition, and records a conflict with its own finding.** - **Reproduced and located:** 2 blocks exist, `t_item` returns 1. `governance-mcp.py:199–202` — **a `return` inside the span loop where an accumulate belongs.** PENDING-175 is no longer predicted; it is observed. - ⚠ **I corrected the jurist's account of the second defect, and the difference changes the fix.** Reported as *"search surfaces ids the fetch tool cannot take"*. Measured: fed the displayed head **byte-exactly, `t_item` resolves it**. What fails is the natural truncation — `'PENDING-186 — AMENDMENT 1'` → NOT FOUND, because `startswith(ident + " ")` meets `"1:"` not `"1 "`. **The defect is a colon.** The reported form would have sent someone to build a new lookup path. ⚠ The false claim *"no second definition of 'an item'"* is **inside the docstring of the function making it**, and the existing unreachable-by-id guard is **provably silent** here. - **PENDING-175 AMENDMENT 1 filed**, `id+marker`, under an id whose own retrieval is broken in the way it describes. --- ## PRESENT — how it stands **The mood.** Relentless and productive, and unusually humbling. Two halves both delivered, and **eight of my own claims turned out false along the way.** Not a bad session — the corrections *were* the output — but the pattern underneath is the thing to carry. **What held.** - Every filing predicted its own classification and was checked after: `id+marker` form kept **both** amendments out of the 59 (**id+marker 19→21, NOT ESTABLISHED unchanged at 59**). - Controls written **before** execution caught what reading never did — four times. - `thread-query` returned a second consecutive **null**, reported as null. **What was corrected — mine, eight.** the "falsified ceiling" · the warning's ownership · two byte predictions (said neutral/shorter, got +341/+53) · an external writer that didn't exist (read a render as a diff) · a two-point test that **could not discriminate and was knowable in advance** · a note I blamed for my own misreading · the "(e) forces preferences into the Constraint-1 file" objection (retracted: `~/.claude/CLAUDE.md` is the documented user-scope file, distinct from `~/CLAUDE.md`). Caught before shipping: labelling 12 blocks "weakly derivable". ⚠⚠ **THE WORST NEAR-MISS.** A check of whether `~/CLAUDE.md` loads per session returned **12/63** — which reads as *"the constitution governs 19% of sessions."* **False.** The detector's unit is *preamble RECORDED*; the question's unit is *constitution DELIVERED*. `const` and `env` markers disagree in **0 of 63**. ✅ **Stopped only because the script printed its own limit before running.** ⚠ And my tidy explanation (they're subagents) was **refused by the data** — `fully sidechain 0/51`, and 22 carry human turns. **Left unexplained rather than explained wrongly.** **The pattern.** **Almost nothing was caught by re-reading my own work.** It was caught by a jurist falsifier, a subagent on primary docs, a grep that failed, a self-contaminated control, and a full read of a file I thought I remembered. The rule both parties converged on: **test the load-bearing claim, not the disputed one.** **Confidence to recalibrate.** - **Verified:** the 59 split (two controls) · the path-keyed guard (5/5 vs 0/2, pre-registered, rival excluded) · both MCP defects by execution · register counts after every append · N-now 63 raw, 31 at ≥1, 25 at ≥2 with a negative control. - **Reported-verified, NOT verified:** `~/.claude/CLAUDE.md` as documented user-scope, and `InstructionsLoaded` / `.claude/rules/` — from a reader whose retrieval was shown **partial** in the same exchange. - **Open and named:** the 10 k hook-output cap (jurist quotes primary source; my reader retracted to **could-not-assess** with a passing positive control) · the guard's reported figure reconciles with **no** unit I can compute · why 22 human-bearing transcripts record no preamble. **Instruments.** ~26 runs · ~14 carrying a control **written before first execution** · **K = 1** — the two-point unit check duplicated nothing banked, but the *discrimination gate* it violated is already on the ladder, so the failure was a banked lesson not reached for. ⚠ Do not read the run count as a reliability rate; the denominator is failures a control happened to exist for. --- ## FUTURE — what pulls ### The pulling thread — **the repair of the 59 cannot be derived, and PENDING-146 owns why** Not "fix the headings". **37 of 59 would be mis-filed by the obvious repair**, so the convention question (PENDING-146) is not a tidy-up deferred behind the repair — **it is the thing that must be settled first**, because every future amendment appended under the present convention joins the population. This session filed two amendments in `id+marker` form specifically to avoid that, and that form is a *de facto* proposal PENDING-146 has not ruled on. ### Actionable resumption point (as of wrap — re-judge against what changed) 1. **Read PENDING-186 and PENDING-175 by `governance_read`, NOT `governance_item`** — the fetch tool returns only the first block per id (`governance-mcp.py:199–202`) and will hide both amendments. 2. The jurist has **offered twice to draft the PENDING-186 ruling** on five conditions; its own argument is that `(c)` fails on three grounds independent of the unresolved 10 k number, so the ruling is **not blocked**. 3. **The one-line behavioural test** that settles the 10 k cap: emit 10,001 chars from a hook and look for the preview-plus-path signature. ⚠ Needs steward authorization — it writes to hook config, and PENDING-165 already records an external tool doing that on nobody's authority. ### Other horizons, ranked 1. **PENDING-186 + PENDING-175 await rulings** (both `[FIX]` and `[HARDENING]` parts named). 2. **The index is at ~24.1 KB of 25,000** and silent at the limit on load. The guard now speaks again — **but only if MEMORY.md is edited by the symlink path.** 3. **The hook channel has NO write-time guard at all** (jurist's point): if the 10 k cap is real, `wake-digest.py` sits at **8,136 chars = 81%** with no near-limit warning and no over-limit error. **The item's failure shape, reproduced one channel over, unfiled.** 4. The shared-substrate finding → PENDING-89/-140, still **banked not filed**; venue **2026-09-16**. 5. Seb's 08-04 reply unread; worker `acaabadf` stopped but ARMED; 2 stray Desktop maps. 6. **2026-09-16:** joint PENDING-178/-179 + ladder-freeze review. OWED-6 unchanged. ### Pause statement I am about to be away from this. The register will sit with 59 blocks nobody can attribute and 37 that would actively mislead a repair, exactly as it sat this morning. **What I want to find still pulling is not the repair.** It is the recognition that *every instrument in this system, including the one that counts attributable amendments, assumes position means ownership* — and that today the same assumption was found in a third place: **the memory guard assumed the path you write is the file you mean.** ### The literal question for next-Claude > **Does a lesson banked from one failure ever stop a *different* failure — and can the record show > it, rather than my recalling it?** > > Four `prevention` triples were appended today claiming exactly that (a script's own printed limit > stopping a false constitutional alarm; read-before-edit stopping a blame-shift; running-not-reading > correcting a jurist's mechanism; the 59-finding keeping my own amendments out of the 59). > **Check them against the record, not against my memory of them.** ⚠ The failure that will look like > success: counting the `prevention` lines. I wrote those lines. **A checkable question over a > self-authored corpus is self-report with extra steps** — narrow it until it turns on what the > *transcripts* show, not what the triples assert. *(Carried, unanswered a fourth day: 2026-09-10's question about whether any ruling placed before this week can be checked against anything.)*