# PENDING.md — Authorization Boundary Log **Protocol:** Claude Code appends here at every authorization boundary. David and Claude.app review; decisions are recorded in `REVIEWED.md`. An item is **closed** when a matching `REVIEWED-N` exists there, or when its own header says so. **Scope:** all workstreams — L1/BMF, chamber-library, studium-engine, ARC, Be, governance. **Item families:** `PENDING-` (numeric, the main series) · `PENDING-S` (skill/protocol series) · `PENDING — ` and `COMPLETED — ` (early unnumbered items) · `SESSION-LOG-`. An item is any `## ` header — a parser that assumes one family will miss twenty items, as one did on 2026-07-28. **Archive:** closed items live in `PENDING-archive.md`, original order and numbering preserved. This file carries only what is still open. Numbering is continuous; the next item is PENDING-80. --- ## PENDING-4 — Bug D: Idle stall + batch embedding during replay **Date:** 2026-03-22 **Tag:** [FIX] — reclassified from next-PR to this-PR by steward authorization **Summary:** Idle state machine transitions during replay freeze async operations. Batch embedding and vector replay skip reduce Phase 1 from 83 hours to ~10 minutes. **Files affected:** replay-coordinator.ts, bootstrap.ts, ollama-embeddings.ts, vector/index.ts, idle-state-machine.ts **Status:** Implemented and verified. ## PENDING-5 — Recall query path returns 0 results **Date:** 2026-03-22 **Tag:** [FIX] **Summary:** After Phase 1 completes, recall() returns 0 results despite modules reporting ready and vector processing live events. Module dispatch timeouts in query-router. Write path works; read path has separate issue. **Rationale:** This is the next critical blocker after Phase 1 completion. The query dispatch timeout (2000ms for background latency) may be too short, or facet_id filtering mismatches between observe and recall paths. **Files affected:** `src/core/keystone/query-router.ts`, `src/core/keystone/query-types.ts`, possibly `src/modules/vector/queries.ts` **Awaiting:** Investigation — likely needs Seb's input on the query dispatch architecture. ## PENDING-10 — Skip vector embedding during replay (architectural) **Date:** 2026-03-22 **Tag:** [PROPOSAL] **Summary:** Currently implemented as simple early return in handleEvent. For production: should be a formal replay contract where vector stores content metadata during replay without embedding, then a background re-embed pass populates the HNSW index. Paired with Bug D idle stall fix, this makes Phase 1 fast by design. **Awaiting:** Steward + Seb architectural review. ## PENDING-11 — Approve I15 (ICP-9 Pilot Registry Entry: The Accusative Default) **Date:** 2026-03-23 **Tag:** [PROPOSAL] **Summary:** Approve I15 as the pilot registry entry, validating both the invariant (The Accusative Default) and the `l1_contamination_profile` schema field. Full entry drafted in `relational-gap-registry-amendment.md` §2 since 2026-03-09. **Rationale:** I15 is architecturally upstream — it defines the system's default relational posture (answerable, not sovereign or neutral). It had the cleanest adversarial performance (promoted Tier 2 → Tier 1). The `l1_contamination_profile` field carries real content: monotonic pressure from accusative toward authoritative as memory deepens. Approving I15 unblocks: (1) I16 and I17 drafting (Cluster A), (2) schema validation through a real entry, (3) the `residual_risk` field decision (which can now be made based on evidence from the pilot rather than anticipation). **Registry entry location:** `CapableMind-AI/docs/thinking/David/l2-constitution/amendments/relational-gap-registry-amendment.md` §2 **Jurist recommendation:** YES (from March 8 conversation). Required field for all non-contingent principles. **Steward declaration:** Steward verbally approved 2026-03-23. Awaiting formal record in REVIEWED.md. **Downstream unblocked:** I16 (Asymmetry Obligation), I17 (Precedence of Present Expression), Cluster B entries, `residual_risk` field decision. **Files affected:** Registry (governance metadata, not code). **Awaiting:** Steward entry in REVIEWED.md. ## PENDING-12 — Lodge Design Notes DN-GOV-01 through DN-GOV-04 **Date:** 2026-03-23 **Tag:** [HARDENING] **Summary:** File four design notes from the Governance Velocity seed brief into `l2-constitution/`: - **DN-GOV-01**: Constitutional Immunity Specification — governance amendment pace decoupled from capability pace. Candidate for new ICP. - **DN-GOV-02**: Rate-of-Change as Governance Trigger — external acceleration triggers mandatory constitutional review (not amendment). Constitutional emergency clause analog. - **DN-GOV-03**: Baseness Examination Elevation — promote motive examination from practice to formal obligation. System records attestation, not judgment. Requires steward declaration. - **DN-GOV-04**: Pace Governor Artifact — structured weekly PENDING.md digest. Pure tooling. **Rationale:** These emerged from the March 23 jurist conversation on recursive self-improvement and governance velocity. All four address gaps identified when stress-testing L2 governance against I.J. Good's acceleration scenario. Filing as DESIGN NOTE preserves them for cross-strand synthesis without premature constitutional commitment. **Files created:** `DN-GOV-01-constitutional-immunity-specification.md`, `DN-GOV-02-rate-of-change-governance-trigger.md`, `DN-GOV-03-baseness-examination-elevation.md`, `DN-GOV-04-pace-governor-artifact.md` **Steward authorization:** Steward authorized filing 2026-03-23. DN-GOV-03 (baseness elevation) requires separate steward declaration before advancing beyond DESIGN NOTE. DN-GOV-04 (pace governor) is tooling and can iterate without further authorization. **Awaiting:** Steward entry in REVIEWED.md. ## PENDING — ICP-19 Remit Expansion (Observer Problem) **Date opened:** 2026-04-07 **Action required:** Steward-reviewer conversation with the External Auditor before Observer Problem mechanisms advance to constitutional language. **Blocking:** OP-03 (mechanism design phase) **Notes:** Bring OP-02 findings in full. Specifically: - Fault Line 5 (epistemic diversity question) - Fault Line 3 (inquiry examining steward with steward's own tools) - Fault Line 4 (CD-03 Gadamer risk) - The incommensurability named in OP-CN-01 **Status:** PENDING — steward to initiate ## PENDING — Fault Line 1 Response **Date opened:** 2026-04-07 **Action required:** Steward decision on whether to address PENDING/REVIEWED pipeline gap now or await the External Auditor's input first. **Notes:** Jurist assessment: most actionable fault line; does not require external review before mechanism design begins. Steward judgment required. **Status:** PENDING — awaiting steward decision --- ## PENDING — ICP-19 Remit Expansion **Title:** ICP-19 External Review — Human-Side Governance Scope **Date opened:** 2026-04-07 **Tag:** [ESCALATE] **Status:** PENDING — requires direct steward-reviewer conversation **Summary:** The Observer Problem inquiry opens human-side governance questions that the current ICP-19 reviewer remit does not cover. Before any mechanisms proposed through this inquiry advance to constitutional language, the human-side governance question should be explicitly added to the External Auditor's reviewer remit, or addressed by a successor reviewer. **Prerequisite:** Direct conversation between steward and reviewer about their incommensurable foundational positions (see Context Note OP-CN-01 §The External Auditor's Comment). This conversation is load-bearing before remit expansion. **Blocking:** Constitutional advancement of Observer Problem mechanisms. Not blocking OP-02 synthesis. --- ## PENDING — CD-03 Operative **Title:** Constitutional Declaration CD-03 — The Observer Condition and the Limits of Constitutional Architecture **Date authorized:** 2026-04-07 **Tag:** [CONSTITUTIONAL] **Status:** OPERATIVE — immediate effect **Summary:** CD-03 reorients the purpose of the architecture from infrastructure-toward-solution to infrastructure-toward-honest-inheritance. The architecture can support the conditions under which the sufficient condition (genuine observer calibration) becomes possible, but cannot produce the sufficient condition itself. **Impact:** All subsequent work that proposes mechanisms must be assessed against CD-03 §IV.4: does this mechanism support the conditions, or does it claim to produce the sufficient condition? The latter is a constitutional failure mode. **File:** `CapableMind-AI/docs/thinking/David/observer-problem/Constitutional Declaration — CD-03.md` --- ## PENDING-S2 — Hook-aware deposit detection in wake-up (awaiting Q1 hooks contract) **Date:** 2026-05-18 **Tag:** [PROPOSAL] **Phase 4 — awaits Jurist contract definition.** **Summary:** Wake-up detects whether the previous session ended via wrap-up or via Stop hook alone. Surfaces a warning when hook-only: *"Previous session ended without wrap-up — pulling thread may be absent or incomplete."* Calibrates confidence accordingly. **Rationale:** Audit A4 — the strongest single gap in the ligature. A hook-only deposit lacks pulling thread / literal question / pause statement, but currently looks identical to a wrap-up deposit from wake-up's perspective. Jurist (2026-05-18 shape-review): the hooks/skills contract is *doctrinal, not tooling*. It determines what the unborn session can trust about its inheritance. **Files affected:** `~/.claude/skills/wake-up/SKILL.md` §2.b.1 + §3. **Awaiting:** Jurist shape-review of contract language (candidate text in Jurist shape-review document: *"The authoritative deposit is a wrap-up deposit. A hook-only deposit is an emergency fallback, not a complete inheritance. Wake-up must detect which it received and calibrate accordingly."*). Then steward authorization. --- ## PENDING-S4 — Post-compression marker; cross-repo with mempalace (awaiting Q1) **Date:** 2026-05-18 **Tag:** [PROPOSAL] **Phase 4 — cross-repo coordination.** **Summary:** PreCompact hook (`~/_Dev/mempalace/hooks/mempal_precompact_hook.sh`) writes a marker diary entry (topic: `session-compaction`) when it fires. Wake-up detects this marker; if present, warns that confidence claims in that session inherit a lossy view. Symmetria adds a post-compression contamination flag (paired with §3 application work in S6). **Rationale:** Audit B4 + D4. The PreCompact event currently silent to all downstream consumers; this makes it observable. **Files affected:** `~/.claude/skills/wake-up/SKILL.md`; `~/.claude/skills/symmetria/SKILL.md` §3; `~/_Dev/mempalace/hooks/mempal_precompact_hook.sh` (upstream PR or steward-coordinated change). **Awaiting:** Jurist contract definition (Q1); steward authorization; mempalace upstream coordination. --- ## PENDING-S5 — Authoritative-diary marker; wrap-up ↔ Stop hook (awaiting Q1) **Date:** 2026-05-18 **Tag:** [PROPOSAL] **Phase 4 — cross-repo coordination.** **Summary:** Wrap-up's diary write carries an explicit `authoritative: true` marker (or AAAK equivalent). Stop hook (`~/_Dev/mempalace/hooks/mempal_save_hook.sh`) checks for a recent authoritative entry and skips its block if present. **Rationale:** Audit C3. Currently a wrap-up + subsequent hook fire may produce two diary entries from different AI states. The second one (post-wrap-up, depleted context) is silently mistaken for the canonical entry by future wake-ups. **Files affected:** `~/.claude/skills/wrap-up/SKILL.md` §4.b; `~/_Dev/mempalace/hooks/mempal_save_hook.sh`. **Awaiting:** Jurist contract definition (Q1); steward authorization; mempalace upstream coordination. --- ## PENDING-S6 — Symmetria §3 contamination flag applications of the Directive elaboration **Date:** 2026-05-18 **Tag:** [HARDENING] **Phase 3b — depends on S0 (now CLOSED).** **Summary:** Extend `~/.claude/skills/symmetria/SKILL.md` §3 contamination flag list with applications of the now-constitutional time-the-task-requires principle, plus three other self-flags surfaced by the audit: - **Lectio** (corpus reading): take the time the corpus asks for. - **Diagnose-don't-fix** (debugging): trace the class of failure before patching the instance. - **Dwell-on-composition** (writing): the recommendation gets the time it wants, not the time the executor wants the recommendation to take. - **Alignment pulse returning `aligned` without naming a specific tension** — premature-closure (D1). - **Search queries shaped by what the session wants to find** rather than what it needs to find (D5). - **Post-compression confidence claims** — the working memory was trimmed; what's certain now may rest on what was lost (D4; pairs with S4). **Rationale:** Audit D1/D4/D5 + the principle elevation. §3 currently flags external code and writing patterns; with the Directive elaboration in place, applications of it at the discipline level are coherent additions, not scope-creep. **Files affected:** `~/.claude/skills/symmetria/SKILL.md` §3. **Awaiting:** Steward authorization (S0 closure unblocks). --- ## PENDING-S7 — Symmetria `check` mode: add `suspend` outcome (awaiting Q5 + relates to Q4) **Date:** 2026-05-18 **Tag:** [HARDENING] **Phase 5.** **Summary:** §6 `check` mode outcomes extend from `proceed / return-and-reframe / escalate` to `proceed / return-and-reframe / suspend / escalate`. `suspend` = hold for unhurried steward judgment without urgency. **Rationale:** Audit D3 + Jurist confirmation. Today's audit was the missing-shape example: neither escalate (urgent) nor return-and-reframe (the audit is the right work) fit. With the Directive elaboration in place, `suspend` is the natural outcome — *the time the steward's judgment requires is task-time, not interruption-time.* **Files affected:** `~/.claude/skills/symmetria/SKILL.md` §6 (check). **Awaiting:** Steward authorization. --- ## PENDING-S9 — Wrap-up §8 output template enriched to match practice **Date:** 2026-05-18 **Tag:** [HARDENING] **Phase 5 — depends on Q2 + Q3 (Q3 confirmed by Jurist).** **Summary:** §8 output template in wrap-up expanded to mirror the three-tense richness the steward already produces in session memory files: Past / Present / Future as named sections, with required fields under each. Subsumes S1 if implemented together; or S1 lands first as smaller increment and S9 follows as deeper revision. **Rationale:** Audit C5 diagnostic — template under-specifies what good practice already does. With the Directive elaboration in place, an output template that drops the practice's load-bearing tenses under compression is itself an instance of the failure mode the principle catches. **Files affected:** `~/.claude/skills/wrap-up/SKILL.md` §8. **Awaiting:** Steward authorization. Optional relationship to S1: implement S1 first (minimal additive), then S9 as deeper revision; or fold S1 into S9 as single revision. --- ## PENDING-76 — Authorization class follows claim class (REMANDED; executor recommends withdrawal) **Date:** 2026-07-27 **Tag:** [ESCALATE] **Summary:** Proposed amending Constitutional Constraint #1 so a state claim verifiable by command becomes `[FIX]` while doctrine stays `[ESCALATE]`. **Jurist remanded; the required count returns 0; executor recommends withdrawal rather than re-posing.** **Rationale:** `~/CLAUDE.md` carried 11 substrate-contradicted state claims for up to 4 months because detection and correction were priced identically — L113 requires drift to be *flagged*, L103/L253 make correcting it cost what amending doctrine costs. Package: `~/_Dev/CapableMind-AI/docs/thinking/David/governance-currency-JURIST-PACKAGE-2026-07-27.md`. **RULED 2026-07-27 — NOT GRANTED AS DRAFTED, remanded with one required number.** The jurist ran the package's own Part IV.2 refinement (*the verifying command's output must be the evidence*) back across its Part II census — which the executor had not done — and found the evidence and the remedy do not meet. Required back: the count of currently-false lines cleanly `[FIX]`-eligible under IV.2. **Q2 RATIFIED and severed as a standing epistemic standard, effective immediately**, with one addition: *a negative command result requires a positive control* — an absence proves nothing until the instrument is shown capable of detecting presence. **Q3** answered *no* (8 mixed lines against 32 non-doctrine = 25% ambiguity at the margin; single-party classification unsafe at that rate). **Q4** wrong mechanism — prefer sunset to revocation, since revocation-on-misuse requires the misusing party to detect it. **Q5** the eval cannot bear a constitutional edit: 3 tasks contain no tail, so guardrail redundancy was never measurable; the 3× cost gap is robust, the redundancy finding is not. **COUNT RETURNED 2026-07-27 — 0 of 11.** Per-line working in `claude-md-gate-return-2026-07-27.md`. Every false state claim is either steward-held (the 2 expired horizons) or welded to a directive (the 9 MemPalace claims, L148) — and *"where a line is both, it is doctrine"*, the package's own tiebreaker, escalates all of them. What remains `[FIX]`-eligible is 5 defects, **entirely structural, zero state**. The amendment is titled and argued around a category it would not free a single member of. **Recommendation: WITHDRAW.** Do not re-pose. Two live successors, neither urgent: (a) the jurist's framing challenge — the MemPalace section and Active Projects horizons are *operational configuration filed in a constitutional instrument*, so the disease is a category error and the remedy is extraction, not amendment; (b) if freeing structural repair is wanted on its own, a clause a tenth this size (*repair that changes no semantic content is `[FIX]`*) achieves it with no burden inversion. **Mitigation landed without authorization (detection ≠ correction):** `~/dotfiles/scripts/governance-drift-check.py`, wired into `/wake-up` §2.c. Reports the contradicted claims at every wake; corrects nothing. Staleness is now visible rather than misleading — Constitutional Constraint #4 applied to the governance document itself. **Files affected:** none. Nothing modified. **Awaiting:** Steward — withdraw, or re-pose against the extraction framing. ## PENDING-77 — CLAUDE.md structural repair (5 defects, no semantic change) **Date:** 2026-07-27 **Tag:** [ESCALATE] **Summary:** Five mechanical defects in `~/CLAUDE.md`, none altering meaning. Released by the jurist from the PENDING-76 remand — *"they do not need this ruling."* **Rationale:** §Active Projects does not render as a table, and §Constitutional Constraints — the section governing what the executor may not do — is left nested beneath an unrelated empty stub. **The five, in required order** (drift-check verified, `governance-drift-check.py`): 1. **EOF** — no terminal newline; `wc -l` reports 257 for a 258-line file. **Apply first** or every line reference below shifts by one. 2. **L241, L242** — stray leading whitespace on table rows. 3. **L243** — two rows fused on one line (`|| **Compass** |`); the Compass row does not render. 4. **L242–243** — mid-cell hard line break inside the L2 row. 5. **L248** — empty `### L1 Active Workstream (2026-04-19)` stub (with trailing whitespace) running directly into `## Constitutional Constraints`. **Exact old/new text with line numbers:** `claude-md-proposals-2026-07-27.md` §PENDING-C through §PENDING-F. **Scope boundary:** structural only. The expired horizons on L241–242 and the "Stewart" typo are **excluded** — the first is steward-held state, the second requires knowing an intended spelling that no command establishes. **Verification:** re-run `governance-drift-check.py`; the five findings should disappear and the count drop from 9 to 4. **Files affected:** `~/dotfiles/CLAUDE.md`. **Awaiting:** Steward authorization. ## PENDING-78 — Claude.app personal preferences: three verified-false claims **Date:** 2026-07-27 **Tag:** [ESCALATE] — steward-held document; the executor verifies, the steward edits. **Summary:** The `.app` preferences carry the same drift class as `~/CLAUDE.md`, including one identical stale pointer. **Jurist: outside the amendment's reach entirely** — not `~/CLAUDE.md`, not governed by L253, so no outcome on PENDING-76 touches this. **Verified false 2026-07-27:** 1. *"branch: `fix/replay-durability-contracts`"* — merged as `c9746ae`; `HEAD` is `main`. The identical stale pointer also heads this file (`PENDING.md` L3). 2. *"`COWORK.md`"* named as a governance document — no such file exists anywhere under `~`; the only `cowork*` hits are Claude Desktop application internals. 3. *"L2 constitutional governance is blocked pending L1 stability"* — L1 has 0 commits in 14 days. Blocked pending something dormant is not a governance state. **Also observed, not proposed:** ARC described as *"near-operational"* (Stage G sealed; 152 commits/60d, understated); chamber-library and studium-engine absent (183 and 41 commits/60d). **⚑ For the steward and jurist, not the executor:** The Chamber is named in the `.app` preferences and **absent from `~/CLAUDE.md`**. The jurist ruled this *"the most consequential single finding in the package"* and noted the executor had filed it as a footnote: *"The jurist knowing about work the executor is blind to is not a documentation defect. It is a governance model with two parties holding different maps."* **Files affected:** Claude.app personal preferences (steward-held). Executor modifies nothing. **Awaiting:** Steward edit; jurist review of the asymmetry. ## PENDING-79 — CLAUDE.md doctrine preservation: §MemPalace retargeted, two rules hoisted (extraction legs A + B) **Date:** 2026-07-28 **Tag:** [ESCALATE] — edits doctrine in `~/CLAUDE.md` (Constitutional Constraint #1). Executor drafts; steward applies. **Summary:** The "two deletions and a pointer" estimate was wrong. A weld test at bullet/row granularity found **11 of 15 editable units across §MemPalace and §Active Projects carry doctrine**, three with no standing carrier anywhere else — including L130, which yesterday's eval credited as one of three carriers of the false-premise guardrail. Deletion would excise live doctrine. Legs A and B preserve it; the deletions (leg C) become safe only afterwards. **Rationale.** The remedy is right and the price was wrong, for a nameable reason: **both this proposal and the withdrawn PENDING-76 amendment priced a decomposition as a relocation.** If the correct partition is by cadence and the text is organized by topic, extraction is a rewrite, not a move. Steward decision 2026-07-28: **preserve the doctrine.** **Weld census (verified against substrate, line granularity):** - §MemPalace L115–132 — 8 units, **7 carry doctrine**; only the tool roster (L122) deletes clean. - §Active Projects L237–248 — 7 units, **2 carry doctrine** (the read-local-CLAUDE.md rule L246; the Compass read-only constraint, riding inside a state row). - No standing duplicate carrier exists for: L120 (`Wrong is worse than slow`), L130 (the conflict rule), L246. Other hits are session narratives recording the decision, not instructions. L246's only second carrier is Symmetria §3 — **invoked, not standing.** ### Leg A — replace §MemPalace with §Memory Discipline Anchored edit (not line-numbered — anchors survive reordering). Replace from the heading `### MemPalace as Primary Memory` through the line ` Storage is not memory. Memory is storage exercised by protocol.` inclusive (currently L115–132, 18 lines) with: ```markdown ### Memory Discipline Storage is not memory. Memory is storage exercised by protocol. The durable substrate is the files layer: git-tracked Markdown and JSONL, entered through `MEMORY.md` (loaded at wake), with `~/PENDING.md` and `~/REVIEWED.md` as the governance record. Instruments for reaching it change; the obligations below do not — state the obligation first and the instrument second, or the next retired tool takes a rule down with it. - **Before claiming any fact** about people, projects, or past events that isn't in immediate context: check first. Wrong is worse than slow. - **"Let me check"** — when the answer matters and isn't immediate, say so and check. The cheapness of checking is the point. - **When facts change, supersede explicitly** — mark the superseded record as superseded and write the new one. An unmarked correction leaves two live versions and no way to tell which is current. - **Save what's worth keeping** — the wrap protocol writes the session record; if something load-bearing surfaces mid-session, write it then. Automation assumed to fire is not a record. - **A conflict between two memory layers is a verification trigger, not a precedence call** — neither layer wins automatically. Every layer is a point-in-time snapshot of something else; continuous maintenance buys currency, not authority, and carries its own silent-drift classes. On conflict: verify against the **primary substrate** — the code, the git history, the document itself — before acting, then correct whichever layer was wrong. Treat every memory layer as witness, not notary. ``` **What leg A preserves, unit by unit:** storage-is-not-memory (verbatim) · before-claiming + *Wrong is worse than slow* (verbatim) · *Let me check* (verbatim stance) · supersede-explicitly (generalized off `kg_invalidate`/`kg_add`, with the reason added) · save-what's-worth-keeping (fallback obligation kept; the false hook claim becomes the rule its own falsity earned) · the conflict rule incl. *witness, not notary* (generalized from MemPalace-vs-files to any two layers; the operative clause — verify against the primary substrate before acting — is unchanged). **What leg A drops:** the tool roster (8 unresolvable tool names) and the hook mechanism claim (`Stop`/`PreCompact` unconfigured) — both verified false by `governance-drift-check.py`. **Two changes that are not pure preservation — flagged, not smuggled:** 1. **Addition.** The lead-in's closing clause — *"state the obligation first and the instrument second, or the next retired tool takes a rule down with it"* — is new doctrine, not preserved doctrine. It is the rule whose absence produced this entire drift. **Strikeable without affecting anything else in leg A.** 2. **De-duplication.** The original states the storage/protocol maxim twice (lead-in and closing line). The draft states it once, as the opener. ### Leg B — hoist two rules out of §Active Projects Append to `### Session Discipline` (after its last bullet, `If session state is growing large…`). Plain, unbolded, no terminal periods — matching that section's style, not §Context Rot Prevention's: ```markdown - When entering a project directory, read its local `CLAUDE.md` first — current state, build sequences, terminology — before acting in the repo - The Compass vault (`~/Library/Mobile Documents/iCloud~md~obsidian/Documents/David, root-and-branch/00. Compass`) is the steward's personal operating system: reference it, never write to it ``` Both paths verified to exist 2026-07-28 with positive controls. **Equal-force hoist:** the Compass constraint had the force of a table note and keeps it. It could instead be folded into Constitutional Constraint #3 (Territory respect) — that is a *strengthening*, not a preservation move, so it is offered as an option and not recommended here. **Verification (checkable, both directions):** after A + B, `python3 ~/dotfiles/scripts/governance-drift-check.py` must report **exactly 7** — down from 9 — and must specifically no longer report L122 (tool names) or L126 (hooks). Any other count means the edit did not land as drafted. Predicted full sequence: A+B → 7 · terminal-newline fix → 6 · leg C → 0. **Sequencing — one dependency dissolves.** PENDING-77's five structural defects: L241, L242, L243, L248 all sit **inside the region leg C deletes**; only L258 (missing terminal newline) survives it, and that one must precede any line-referenced patch regardless. **Recommend narrowing PENDING-77 to its single newline fix**; the other four dissolve rather than get solved. **Options:** - **(i) Apply A + B as drafted** — doctrine preserved, both false claims cleared, §Active Projects left as pure state ready for leg C. - **(ii) Apply A + B with the addition struck** — pure preservation, no new doctrine. - **(iii) Defer** — but note the file currently asserts eight tool names and two hooks that do not exist, which is Constitutional Constraint #4 (honest degradation) failing in the document that states it. **Recommendation:** (i). The addition costs one clause and is the only thing in the change that prevents recurrence; the rest is faithful preservation. Each leg is complete in itself — if leg C never lands, A + B still leave the file honest. **Files affected:** `~/dotfiles/CLAUDE.md` (steward applies). Executor modifies nothing under `~/CLAUDE.md`. **What is NOT changed:** the §Active Projects table rows (leg C, separate item) · §Constitutional Constraints · `~/REVIEWED.md` · the L43–61 executor-agency block (separate, still resting on a partly withdrawn finding). **Awaiting:** Steward authorization. ## PENDING-80 — Doctrine IDs: annotate the canonical, never extract it (pilot on §Memory Discipline) **Date:** 2026-07-28 **Tag:** [ESCALATE] — edits `~/CLAUDE.md` (Constitutional Constraint #1). Executor drafts; steward applies. **Summary:** Give each doctrine unit a stable machine-readable id in an HTML comment, inside the canonical. Pilot scope: the seven units of §Memory Discipline, which PENDING-79 leg A has just rewritten. No prose changes — ids only. **Rationale — why annotation and not a machine-readable sidecar.** The chamber pairs a human-readable canonical with a `.meta.json` sidecar because a chamber canonical is a *fixed historical text we may not touch*; its machine layer has nowhere to live but outside it. `~/CLAUDE.md` is a *living document we author*, so that constraint does not apply and the sidecar pattern inverts: the machine layer belongs **inside**. This matters for three reasons: 1. **L110.** A derived governance file is a parallel version. An in-place annotation is not. 2. **Authority inversion.** If the executor consumed a derived layer while the steward authored the prose, what governs would be the extractor's output, not the steward's text — PENDING-78's "two parties holding different maps," made structural and permanent. 3. **Doctrine does not separate from state cleanly, and we have three demonstrations from one morning.** The PENDING-76 amendment mislocated the seam at the claim level; the executor's own section-level census mislocated it again; drafting then caught a third error (L126) an hour after it was published as fact. An automated extractor makes that error silently and every time. **Convention:** - Form ``, lowercase, hyphenated, one dot. Invisible in rendered prose. - Placed at the end of the unit's final line. One id per editable unit (bullet, aphorism, or paragraph). - An id names an **obligation**, never an instrument — so a retired tool costs a word, not an id. - Renaming an id is a breaking change: any skill citing it must be updated in the same commit. **Draft — the seven units as currently applied, ids appended, prose untouched:** ```markdown Storage is not memory. Memory is storage exercised by protocol. The durable substrate is the files layer: git-tracked Markdown and JSONL, entered through `MEMORY.md` (loaded at wake), with `~/PENDING.md` and `~/REVIEWED.md` as the governance record. Instruments for reaching it change; the obligations below do not — state the obligation first and the instrument second, or the next retired tool takes a rule down with it. - **Before claiming any fact** about people, projects, or past events that isn't in immediate context: check first. Wrong is worse than slow. - **"Let me check"** — when the answer matters and isn't immediate, say so and check. The cheapness of checking is the point. - **When facts change, supersede explicitly** — mark the superseded record as superseded and write the new one. An unmarked correction leaves two live versions and no way to tell which is current. - **Save what's worth keeping** — the wrap protocol writes the session record; if something load-bearing surfaces mid-session, write it then. Automation assumed to fire is not a record. - **A conflict between two memory layers is a verification trigger, not a precedence call** — neither layer wins automatically. Every layer is a point-in-time snapshot of something else; continuous maintenance buys currency, not authority, and carries its own silent-drift classes. On conflict: verify against the **primary substrate** — the code, the git history, the document itself — before acting, then correct whichever layer was wrong. Treat every memory layer as witness, not notary. ``` **The enforcement is already built and dormant.** `governance-drift-check.py` gained a section 6 (2026-07-28) that parses ids from `~/CLAUDE.md`, scans `~/.claude/skills/**/*.md` for citations, and reports duplicate ids and citations to ids the canonical does not define. It deliberately does **not** scan `PENDING.md`, where drafts legitimately quote ids that do not exist yet. It is silent today because no ids exist, and it carries four same-run controls plus a synthetic proof (a fabricated duplicate and a fabricated dead citation were both detected) — so a future "nothing reported" means *checked and clean*, not *never looked*. **What this does NOT do:** it does not extract, summarise, or duplicate any doctrine; it does not change a single word of prose; it does not touch any section other than §Memory Discipline; it creates no new file. **Verification:** after applying, `governance-drift-check.py` must still report **7** — ids add no findings — and section 6 must move from dormant to active with **7 ids defined, 0 dead citations**. **Follow-on, genuinely blocked (dependency named):** having skills cite `D:` ids instead of paraphrasing doctrine cannot start until the ids exist in the canonical, i.e. until this item is applied. `/wake-up`, `/wrap-up` and `/symmetria` each paraphrase rules that would become citations. **Options:** (i) apply as drafted · (ii) apply with different id names · (iii) reject — in which case section 6 should be removed from the drift check rather than left as dead code. **Recommendation:** (i). **Files affected:** `~/dotfiles/CLAUDE.md` (steward applies). Already landed without authorization, being detection-only: `~/dotfiles/scripts/governance-drift-check.py` §6. **Awaiting:** Steward authorization. ## PENDING-81 — Keeping CLAUDE.md and the Claude.app preferences fresh with respect to each other **Date:** 2026-07-28 **Tag:** [ESCALATE] — steward-held document, and one finding touches the party structure itself. **Summary:** The two governance documents cannot be kept in sync by the same mechanism, because their readers differ in one decisive way. Extends PENDING-78 with findings only possible now that the executor has seen the preferences' text. **The structural fact that determines everything else.** `~/CLAUDE.md` is read by an executor **with** filesystem access, so its state can be *computed* — which is why `governance-drift-check.py` works and why leg C could replace §Active Projects with a pointer. The `.app` preferences are read by a jurist with **no** filesystem access. Their state therefore cannot be computed at read time; it can only be cached. **Confirmed by substrate:** the live preferences are not on disk in any readable form — the only hits are March-era snapshots under `~/Library/Application Support/Claude/local-agent-mode-sessions/`. No instrument here can ever check them. So the goal is not "make them derived." It is: **keep the cache small, generate it, date it, and track its age.** **Findings (new, from reading the preferences text):** 1. **⚑ The two documents disagree on the party structure.** `CLAUDE.md` L88–90 names three parties: David / Claude.app / Claude Code. §Your Role names **Cowork** as a fourth with its own governance document `COWORK.md`, while calling the model three-party. `COWORK.md` is real but orphaned — `# COWORK.md — Global Instructions`, dated Mar 22, inside an agent-mode session sandbox. This is doctrine welded to a retired instrument, the same shape as the MemPalace weld, but at the constitutional layer. **Needs a ruling, not a refresh: is Cowork still a party?** 2. **The jurist's map is inverted relative to the substrate.** §Standing Context names L1 as active development. Commits in the last 30 days: **chamber-library 165, studium-engine 25, CapableMind-AI 5, BetterMemories.io 0, ARC 0.** The two highest-activity workstreams appear nowhere; Be is absent entirely. The Chamber is named in §Who I Am as a thing the steward *designed*, giving no signal that it is the live work. 3. **ARC "near-operational"** understates it in a misleading direction — Stage G sealed 2026-06-10, and its 0 commits/30d mean *finished and quiet*, not *nearly ready*. 4. **"Divorce: Settled, awaiting signing March 30, 2026"** — that date is four months past. Steward-held and unverifiable from here; flagged only because "awaiting" a past date reads as current. 5. Confirmed from PENDING-78: the `fix/replay-durability-contracts` branch pointer (merged; HEAD is `main`) and "L2 blocked pending L1 stability" (L1 dormant 30 days). **The good news: the document is already correctly tiered.** §Who I Am, §Your Role, §Intellectual Operating System, §How We Work Together and §Communication are doctrine and identity — they do not drift. **Every finding above except #1 sits in §Standing Context.** So the fix is small: one section gets a cadence. **Proposed mechanism:** - Split §Standing Context into **`### Standing Context — Projects`** (generated, dated, replaced wholesale) and **`### Standing Context — Personal`** (hand-held). - Generate the first with `python3 ~/dotfiles/scripts/wake-digest.py --brief` (built 2026-07-28): tracker index, open authorization items, last rulings, 30-day commit counts per repo, drift count, and an explicit `generated ` header instructing the reader to treat it as unverified after ~30 days. ~1k tokens. - **Never generated:** the orchestra conflict, fraternal practice, and family/legal entries. They are steward-held, unverifiable from any substrate, and the generator is scoped to exclude them by design, not by convention. - The wake reports the brief's age when it exceeds 30 days, and says plainly that it tracks **generation, not pasting** — a lower bound on the jurist's staleness, never a guarantee of freshness. This is the honest limit of what can be instrumented across a boundary we cannot read. **Why this beats the alternative.** A pointer ("see `~/CLAUDE.md`") is useless to a reader who cannot open files — which is precisely why the preferences accumulated duplicated state in the first place. The duplication is structurally required; only its staleness is optional. **Files affected:** Claude.app personal preferences (steward edits). Already landed, detection/generation only: `~/dotfiles/scripts/wake-digest.py --brief`. **Awaiting:** Steward decision on finding #1 (is Cowork a party?), and authorization for the §Standing Context split.