dotfiles/claude/governance/fool/census-01-negative-instances-RESULT.md

Census 01 — RESULT

Run: 2026-08-03. Pre-registered at census-01-negative-instances-PREREGISTRATION.md before any instrument source or the ladder was read. Question: which of our instruments have no real negative instance, and is that absence recorded, or does it look like coverage?

---

Verdict in one line

The instruments built under this discipline are sound. The instruments built before it decay silently — and three of them are currently reporting a clean number they are structurally incapable of dirtying.

The census discriminated (both buckets populated, per the pre-registered condition), so it is reportable as a result rather than as nothing.

---

Population A — fool/ (7 instruments, censused entire)

Instrument	Negative instance	Verdict
test_degraded_guard.py	The real trial-03 artefact that defeated its predecessor. Fails loudly (INSTRUMENT NOT VERIFIED) if the artefact is absent.	DEMONSTRATED — gold standard
test_discrimination.py	Two real governance documents; shown rejecting the §3.3 pattern as it actually shipped.	DEMONSTRATED — gold standard
test_twin.py	The real CONTROL-A/B pair; shown failing in both laundering directions.	DEMONSTRATED
test_reduce.py	Mixed: fixtures are synthetic, but each is a minimisation of a real defect found by contact with a real ruling/package; plus a real-document tiling check and the real false-pass string.	DEMONSTRATED (derived)
reduce.py §3.3 screen	Tested in test_reduce.py against heading strings in isolation — the exact code-not-result shape. Backstopped by test_discrimination.py at document level.	weak alone, covered by the suite
reduce.py §3.2 Q-resolution	Real CLAUDE.md + a genuine clause and a plausible fabrication; rejects the fabrication.	DEMONSTRATED
twin.py bidirectional gate	Covered by test_twin.py.	DEMONSTRATED

Prediction 2 was wrong. I expected test_reduce.py and test_twin.py to be fixture-based and silent about it. Both explicitly derive fixtures from the property and say so. Nothing here is concealing an absence.

Population B — the verification ladder (75 entries, censused entire)

Mechanically extracted all 75 entry names, then counted citations elsewhere in memory/, governance/, skills/. Instrument positive-controlled first (the same grep finds Fowler in 28 files, verify-before-compose in 18, pre-registration in 13 — it detects presence readily).

• 71 of 75 entries are referred to by name nowhere outside the ladder.
• The 4 that are cited: Byte-identical compile gate · Two-hat commit separation · Revert-and-redo-smaller · The gate itself can be PASS-BUT-FALSELY. Three of the four are meta-instruments — about the practice of gating, not about a domain.

What this does NOT establish: that 71 entries never fire. Name-absence is not use-absence; a discipline can be applied without anyone writing its name. Overclaiming here would be the same error the census exists to catch.

What it does establish: the ladder's own header calls these "the named gates any session reaches for instead of re-deriving." Naming is the whole mechanism. If 71 names appear nowhere, then either the naming does no work, or the entries are not reached for — and the record cannot distinguish the two. Each entry records its origin (the real failure that earned it) and nothing about its subsequent life.

The ladder contains the rule that judges it:

A silent safety net is uninformative, not reassuring — a fallback that never fires across N real cases has not been shown to work.

75 entries read as 75 units of coverage. What the record attests is 75 units of past catch.

Structural cause: ladder entries have no IDs. They are bolded prose. There is no handle to write in a session record, so firing history cannot be recorded even by someone who wanted to.

Population C — the wake instruments (the numbers the steward acts on)

governance-drift-check.py — reported 0 substrate-contradicted claims this morning

Five check families. Tested each against the real ~/CLAUDE.md:

#	Family	State	Evidence
1	Referenced paths	LIVE — examines 4 paths	but silently skips any backticked path containing a space: the Compass vault path is never checked. It happens to exist today, so no false negative — but if it broke, the report would still read 0.
2	Named MCP tools	INERT — 0 tool names found	keyed to kg_*/diary_*/mempalace, which the 2026-07-07 wind-down and the obligation-before-instrument rewrite removed from the document
3	Hooks claimed to fire	INERT — 0 claims found	and its control sits inside the if, so the control does not run either
4	Expired horizons	INERT — 0 phrases found	its control is written to pass on absence (… or "through end of" not in text)
5	Doctrine-id parser	LIVE, with a proper discriminating triple (detects definition, detects citation, rejects non-id)	the good one

Three of five families cannot currently report anything, all controls pass, and the instrument never says INSTRUMENT NOT VERIFIED. The 0 is honest about what it measured and silent about what it can no longer see.

The general class this exposes — and it is new:

A drift-checker keyed to a document's current wording goes inert when the document is improved. It can only ever detect the drift that existed the day it was written.

Family 2 died because of a good change: the memory-discipline rewrite that states "Instruments for reaching it change; the obligations below do not — state the obligation first and the instrument second, or the next retired tool takes a rule down with it." That rewrite protected the doctrine from instrument-decay and silently retired the checker watching the doctrine. The rule caught everything except its own watchman.

wake-digest.py — reported 361 pointers, 0 dead

Self-test carries presence and absence controls and names the specific real bugs each was built from (the v1 splitter's blind spot, the 2026-08-01 bug, the drafting-habit trigger). Same shape as test_reduce.py: synthetic fixtures that are minimisations of real defects. DEMONSTRATED (derived). No finding.

---

Scope boundary — what this census did NOT cover

Named so the result is not read as complete:

• the verify-before-compose PreToolUse hook
• chamber-library tooling (audit_cruft, verify_conversion, resolve_archived_source, apply_char_glyphs, …)
• studium-engine verify-quote V1 / fidelity_equivalence@2
• BMF/L1 test suites

Each is a live instrument whose verdicts license claims. Uncensused is uncensused.

---

Predictions, graded

1. Discrimination gate → DEMONSTRATED. Held.
2. test_reduce.py / test_twin.py → ABSENT-UNRECORDED. Wrong — both are property-derived and explicit.
3. Trial-03 degraded guard → ABSENT, now RECORDED. Held, and stronger than predicted: it fails loudly when the real artefact is missing.
4. Ladder entries skewed DEMONSTRATED-at-origin. Held — every entry names its origin failure. The gap is subsequent history, which I did not anticipate as the axis.
5. ABSENT-UNRECORDED dominant overall. Held, but for the opposite reason. I expected weakness in the newest work. It is in the oldest. Instruments do not start blind; they go blind as the substrate they watch improves.

The prediction-5 inversion is the finding worth carrying: freshly-built instruments are strong because the lesson is fresh. Decay is the failure mode, not construction.