dotfiles/PENDING.md

# PENDING.md — Authorization Boundary Log
**Repo:** bmf (Claude Code knows path)  
**Branch:** fix/replay-durability-contracts  
**Protocol:** Claude Code appends here at every authorization boundary. David and Claude.app review. Decisions recorded in REVIEWED.md.

---

<!-- Claude Code: append new PENDING items below this line. Do not edit existing entries. -->

## SESSION-LOG-001 — Initial session orientation
**Date:** 2026-03-21  
**Status:** Awaiting first Claude Code session  
**Notes:** Two bugs diagnosed and fully specified in L1-SEED-2026-03-21.md. Both are [FIX] items — no PENDING authorization required before implementation. Claude Code should proceed directly to Bug A then Bug B, running tests after each. Append HARDENING proposals here as they arise during implementation.

## PENDING-1 — Executor Agency Directive for CLAUDE.md
**Date:** 2026-03-21
**Tag:** [PROPOSAL]
**Summary:** Add operational directives to ~/CLAUDE.md that obligate the executor to diagnose before fixing, challenge framings, name silent costs immediately, use diagnostic reach proactively, and hold the contamination problem as active concern.
**Rationale:** Three bugs blocked L1 for three weeks. In all three cases, the executor had access to the information needed to diagnose earlier but did not surface it due to task-focused, deferential posture. The contamination problem (trained approval-seeking) is the root cause. This directive counteracts it explicitly.
**Full text:** `CapableMind-AI/docs/thinking/David/l1-claude-md-executor-agency-proposal.md`
**Files affected:** `~/CLAUDE.md` (steward-owned — requires steward edit)
**Awaiting:** Steward and jurist review.

## PENDING-2 — Diagnostic Audit of L1 Silent Degradation Patterns
**Date:** 2026-03-21
**Tag:** [PROPOSAL]
**Summary:** After this PR lands, run a systematic audit of every error handler, retry loop, recovery path, and state transition in the L1 codebase. Produce a ranked list of silent degradation risks.
**Rationale:** Bugs A, B, and C are instances of a pattern: silent degradation that compounds under load. There are almost certainly more instances. A proactive sweep prevents the next three-week debugging cycle.
**Options:** (1) Full audit in one session. (2) Incremental audit, one subsystem per session.
**Recommendation:** Option 1 — concentrated audit while the pattern is fresh.
**Files affected:** None (read-only audit). Output: findings document for steward review.
**Awaiting:** Steward authorization after current PR completes.

## PENDING-3 — Factory Schema Idempotency (dedup.ts, checkpoint.ts)
**Date:** 2026-03-21
**Tag:** [HARDENING]
**Summary:** The Bug B fix applied `defineIdempotent` to all three factory schema files (job-store.ts, checkpoint.ts, dedup.ts). The checkpoint and dedup fixes were necessary because `checkpoint.ts` was the actual source of the "already exists" error — it uses bare `DEFINE FIELD` without `IF NOT EXISTS`. Including all three in this PR is the right call, but noting that the original seed only specified job-store.ts.
**Files affected:** `src/factory/checkpoint.ts`, `src/factory/dedup.ts` (already changed)
**Awaiting:** Steward acknowledgment (already in PR scope per steward authorization of Bug B).

## PENDING-4 — Bug D: Idle stall + batch embedding during replay
**Date:** 2026-03-22
**Tag:** [FIX] — reclassified from next-PR to this-PR by steward authorization
**Summary:** Idle state machine transitions during replay freeze async operations. Batch embedding and vector replay skip reduce Phase 1 from 83 hours to ~10 minutes.
**Files affected:** replay-coordinator.ts, bootstrap.ts, ollama-embeddings.ts, vector/index.ts, idle-state-machine.ts
**Status:** Implemented and verified.

## PENDING-5 — Recall query path returns 0 results
**Date:** 2026-03-22
**Tag:** [FIX]
**Summary:** After Phase 1 completes, recall() returns 0 results despite modules reporting ready and vector processing live events. Module dispatch timeouts in query-router. Write path works; read path has separate issue.
**Rationale:** This is the next critical blocker after Phase 1 completion. The query dispatch timeout (2000ms for background latency) may be too short, or facet_id filtering mismatches between observe and recall paths.
**Files affected:** `src/core/keystone/query-router.ts`, `src/core/keystone/query-types.ts`, possibly `src/modules/vector/queries.ts`
**Awaiting:** Investigation — likely needs Seb's input on the query dispatch architecture.

## PENDING-10 — Skip vector embedding during replay (architectural)
**Date:** 2026-03-22
**Tag:** [PROPOSAL]
**Summary:** Currently implemented as simple early return in handleEvent. For production: should be a formal replay contract where vector stores content metadata during replay without embedding, then a background re-embed pass populates the HNSW index. Paired with Bug D idle stall fix, this makes Phase 1 fast by design.
**Awaiting:** Steward + Seb architectural review.

## SESSION-LOG-002 — L1 reliability session 2026-03-21/22
**Date:** 2026-03-22
**Summary:** Five bugs fixed (A: reprobe, B: schema, C: teacher, D: idle+batch, E: vector skip). Phase 1 completes in ~10 minutes. Canary fires but fails — recall query path returns 0 (PENDING-5). 43-finding silent degradation audit completed. Executor Agency Directives added to CLAUDE.md. Full Seb thinking folder read. PR artifacts prepared.
**What works:** Write path (observe→classify→logchain→dispatch→module processing), Phase 1 completion, teacher suspension, schema idempotency.
**What doesn't:** Read path (recall query dispatch timeouts). This is the next investigation.
**Artifacts ready:** GH issues A/B/C/D, PR description, CHANGELOG, audit — all in `CapableMind-AI/docs/thinking/David/l1-reliability/`.

## PENDING-11 — Approve I15 (ICP-9 Pilot Registry Entry: The Accusative Default)
**Date:** 2026-03-23
**Tag:** [PROPOSAL]
**Summary:** Approve I15 as the pilot registry entry, validating both the invariant (The Accusative Default) and the `l1_contamination_profile` schema field. Full entry drafted in `relational-gap-registry-amendment.md` §2 since 2026-03-09.
**Rationale:** I15 is architecturally upstream — it defines the system's default relational posture (answerable, not sovereign or neutral). It had the cleanest adversarial performance (promoted Tier 2 → Tier 1). The `l1_contamination_profile` field carries real content: monotonic pressure from accusative toward authoritative as memory deepens. Approving I15 unblocks: (1) I16 and I17 drafting (Cluster A), (2) schema validation through a real entry, (3) the `residual_risk` field decision (which can now be made based on evidence from the pilot rather than anticipation).
**Registry entry location:** `CapableMind-AI/docs/thinking/David/l2-constitution/amendments/relational-gap-registry-amendment.md` §2
**Jurist recommendation:** YES (from March 8 conversation). Required field for all non-contingent principles.
**Steward declaration:** Steward verbally approved 2026-03-23. Awaiting formal record in REVIEWED.md.
**Downstream unblocked:** I16 (Asymmetry Obligation), I17 (Precedence of Present Expression), Cluster B entries, `residual_risk` field decision.
**Files affected:** Registry (governance metadata, not code).
**Awaiting:** Steward entry in REVIEWED.md.

## PENDING-12 — Lodge Design Notes DN-GOV-01 through DN-GOV-04
**Date:** 2026-03-23
**Tag:** [HARDENING]
**Summary:** File four design notes from the Governance Velocity seed brief into `l2-constitution/`:
- **DN-GOV-01**: Constitutional Immunity Specification — governance amendment pace decoupled from capability pace. Candidate for new ICP.
- **DN-GOV-02**: Rate-of-Change as Governance Trigger — external acceleration triggers mandatory constitutional review (not amendment). Constitutional emergency clause analog.
- **DN-GOV-03**: Baseness Examination Elevation — promote motive examination from practice to formal obligation. System records attestation, not judgment. Requires steward declaration.
- **DN-GOV-04**: Pace Governor Artifact — structured weekly PENDING.md digest. Pure tooling.
**Rationale:** These emerged from the March 23 jurist conversation on recursive self-improvement and governance velocity. All four address gaps identified when stress-testing L2 governance against I.J. Good's acceleration scenario. Filing as DESIGN NOTE preserves them for cross-strand synthesis without premature constitutional commitment.
**Files created:** `DN-GOV-01-constitutional-immunity-specification.md`, `DN-GOV-02-rate-of-change-governance-trigger.md`, `DN-GOV-03-baseness-examination-elevation.md`, `DN-GOV-04-pace-governor-artifact.md`
**Steward authorization:** Steward authorized filing 2026-03-23. DN-GOV-03 (baseness elevation) requires separate steward declaration before advancing beyond DESIGN NOTE. DN-GOV-04 (pace governor) is tooling and can iterate without further authorization.
**Awaiting:** Steward entry in REVIEWED.md.

## PENDING-13 — Lodge Design Notes DN-GOV-05, DN-GOV-06, DN-GOV-07
**Date:** 2026-03-26
**Tag:** [PROPOSAL]
**Summary:** File three design notes from the March 26 Threshold Inquiry session:
- **DN-GOV-05**: Bounded Self-Repair Principle — formalizes the three conditions (reversible, within parameters, independently verifiable) under which the system may act without steward presence. Makes explicit the reasoning behind the Computational/Hybrid/Procedural enforcement taxonomy.
- **DN-GOV-06**: Temporal Authorization Shift — when degradation rate exceeds steward authorization latency, enforcement mode temporarily shifts one level toward autonomy (Procedural → Hybrid → Computational) with mandatory post-hoc review. Always conservative direction. Never reaches constitutional amendment.
- **DN-GOV-07**: The Threshold Already Crossed — observes that the human-in-the-loop threshold has already been crossed (at Anthropic and in this collaboration). Reframes the contamination problem from "should the system self-govern" to "the system already self-governs — is that governance honest?" Raises the freeman question.
**Rationale:** Emerged from steward-initiated inquiry into "the threshold between when the human-in-the-loop becomes a liability for the system to repair or improve itself." DN-GOV-05 and DN-GOV-06 touch invariant enforcement mechanics. DN-GOV-07 reframes the contamination problem with implications for the entire governance architecture. All three are tagged `[PROPOSAL]` because they affect constitutional infrastructure.
**Relationship to existing design notes:** DN-GOV-05 is the principle that DN-GOV-01 (immunity) and DN-GOV-02 (rate-of-change) operate within. DN-GOV-06 is the temporal mechanism that DN-GOV-04 (pace governor) should monitor. DN-GOV-07 reframes DN-GOV-01–06 as formalizations of current practice rather than future extensions.
**Files created:** `DN-GOV-05-bounded-self-repair-principle.md`, `DN-GOV-06-temporal-authorization-shift.md`, `DN-GOV-07-threshold-already-crossed.md`
**Awaiting:** Steward review. These are DESIGN NOTEs that require steward authorization before advancing. DN-GOV-07 in particular requires steward engagement with the "freeman question," which the executor cannot resolve.

## PENDING-14 — Lodge Design Note DN-GOV-08: Constitutional Stabilization, Not Automation of Recognition
**Date:** 2026-03-27
**Tag:** [PROPOSAL]
**Summary:** Name "constitutional stabilization, not automation of recognition" as an explicit L2 architectural commitment. L2 invariants define the *conditions* under which recognition can occur, not the *content* of what recognition is. The phronesis ceiling (I3) is constitutive, not a limitation to be overcome. Any proposed invariant that specifies what recognition *is* (rather than what it *requires*) must be flagged as an automation risk.
**Rationale:** Emerged from Chamber Phase 1 session on Essay I. The Alexander voice identified that L2 constitutional governance is either automation of the grammar of recognition (in tension with the essay's central claim and constituting a drift risk) or constitutional stabilization (the architectural realization of the essay's argument). Both steward and jurist assessed this as Tier 1 governance risk: the current architecture leans toward stabilization but the lean is implicit. An implicit commitment under pressure from an unresolved tension is the structural condition for drift. Naming it before the next hardened invariant work prevents the automation reading from corrupting the architecture incrementally.
**Relationship to existing design notes:** Operates within the space opened by DN-GOV-05 (bounded self-repair) and DN-GOV-07 (threshold already crossed). Directly connected to I3 (phronesis ceiling) and ICP-9/I15 (accusative default). Candidate for Domain C invariant precursor.
**File created:** `DN-GOV-08-constitutional-stabilization-not-automation.md`
**Awaiting:** Steward authorization. This is a DESIGN NOTE that requires steward review before advancing toward invariant status.

## PENDING-15 — Reviewer-Agent for ICP-19 External Review
**Date:** 2026-04-01
**Tag:** [PROPOSAL]
**Summary:** Design and build an agent to help the External Auditor (confirmed founding reviewer, 2026-04-01) navigate the L2 constitutional corpus. The External Auditor is technical but was not present for the corpus's development and needs orientation across 18 invariants, 9+ design notes, the contamination problem, and the governance architecture.
**Rationale:** The reviewer-agent's posture directly affects the integrity of ICP-19. An agent that explains the corpus risks becoming an advocate for it, undermining the independence that external review exists to provide. The agent must be navigator, not advocate — helping the External Auditor understand what documents say and how they relate, without defending them. If the reviewer identifies a tension or weakness, the agent should help articulate it, not resolve it.
**Options:**
1. **Reader's guide + Claude Project** — Write an orientation document (reading order, genealogy, key terms). Upload corpus to a Claude.ai project with a system prompt that positions the agent as navigator, not advocate. Simplest. The External Auditor just needs a Claude account.
2. **Claude Code config** — A dedicated `CLAUDE.md` + seed scoped to the reviewer role. The External Auditor clones a repo with the constitutional corpus. More structured, version-controlled.
3. **Purpose-built agent (Agent SDK)** — Web-hosted, review protocol baked in, tracks findings and HOLD thresholds. Most capable, most work.
**Recommendation:** Option 1. A reader's guide is inert and can't bias; a Claude project gives the External Auditor a conversation partner. The system prompt is the critical piece — it must be reviewed by all three parties (steward, jurist, the External Auditor himself) before deployment. Option 2 is a reasonable upgrade if the External Auditor prefers working in terminal.
**Constitutional concern:** The reviewer-agent's framing of documents could influence the review outcome. The system prompt constitutes a governance artifact — it shapes what the reviewer sees and how. This is exactly the kind of intervention ICP-19 exists to keep honest. The system prompt should be transparent to the reviewer (the External Auditor can read it) and should explicitly disclaim advocacy.
**Files affected:** New artifacts: reader's guide document, Claude project system prompt. No changes to existing constitutional documents.
**Awaiting:** Steward authorization + jurist review of system prompt posture. Ideally the External Auditor reviews and approves the agent's framing before using it.

## PENDING-16 — Observation-Recall Coupling: Attention-Driven Ingestion Pipeline
**Date:** 2026-04-03
**Tag:** [PROPOSAL]
**Summary:** Restructure the BMF ingestion pipeline to couple observation to recall. Before classification, a fast similarity probe queries the vector store to provide the classifier with epistemic context — "what do I already know that's like this?" — enabling three-disposition routing (novel / reinforcing / noise) instead of the current binary (classified / degraded-but-stored). This addresses the root cause of storage bloat: the observe path is blind to existing knowledge.

**Rationale:** The current pipeline classifies every observation in isolation, appends everything to the logchain, and dispatches to all 11 modules regardless of novelty or redundancy. Result: 18,651 vector chunks and 1.3 GB SurrealDB for modest ingestion volumes. The system stores everything because it has no basis for judgment — existing knowledge is available at recall time but invisible at observation time. Coupling observation to recall gives the classifier epistemic standing to make quality judgments, producing logarithmic rather than linear storage growth.

**Architecture:**
```
observe → fast similarity probe (~20-50ms) → contextual classification → disposition
```

Three dispositions:
- **Novel:** Full pipeline — logchain append, dispatch, embed, extract. Genuinely new information.
- **Reinforcing:** Lightweight logchain entry linking to the entry it reinforces (with similarity score + reinforced entry ID for provenance). Module stores absorb consolidation (confidence boost, timestamp update, detail merge). Logchain remains append-only.
- **Noise:** Audit log only. Raw envelope + similarity context + disposition reason + similarity score preserved. No logchain, no embedding, no dispatch. Re-ingestable within retention window.

**Existing machinery activated (not new complexity):**
- Vector store HNSW index — already operational, unused during observation
- `CausalEdgeCandidate` type — already in classification-types.ts, provides linking semantics
- `compressToAtomicFacts` — exists in classification.ts but not wired into ingestion path
- `computeSalience` — currently decorative, becomes load-bearing
- Graduation system — models developmental stages, provides infant→calibration→active arc

**Five governance decisions required:**

1. **Novelty floor invariant (Cluster A candidate).** The system shall not permit its observation disposition to exclude more than [X]% of events from novel classification over any [Y]-day window. Prevents attention narrowing / epistemic closure. Threshold values require empirical grounding during infant stage — the invariant's shape is proposed now, parameters set from data. Jurist recommends Cluster A priority.

2. **Similarity threshold for reinforcement.** Reinforcement requires cosine similarity exceeding [threshold]. Too high: system never consolidates. Too low: over-consolidation / attention drift. Must be calibrated from infant-stage similarity score distributions, not engineering intuition. Temporal decay on probe context prevents ancient clusters from capturing attention space.

3. **Noise audit retention and remediation.** Audit log retention aligned to chain pruner (90 days). Re-ingestion authorized by steward. Monthly noise disposition report *pushed* to steward (not pulled) — connector distribution, similarity score distribution, top noise patterns. Closes the observability gap: steward can't authorize review of filtering they don't know about.

4. **Graduation staging thresholds.** Infant (log similarity scores, no enforcement) → Calibration (enforced, permissive threshold from distribution data) → Active (tightened threshold). Transition triggers need explicit criteria, not descriptive stages.

5. **Ingest latency budget.** The similarity probe adds an embedding call (~50-200ms Ollama) + HNSW lookup (<5ms) to every observation. Current classification path is ~500ms. Net ingest latency may decrease for mature systems (most events are reinforcing/noise, skip full dispatch). Engineering constraint — Seb should validate against #10 sequential dispatch bottleneck.

**Attention drift detection:** Anomaly module (already subscribes to all events) tracks novel/reinforcing/noise ratio over sliding window. Novelty drop below floor triggers alert to steward. Cross-node attention coupling via circles (sharing attention state rather than noise rules) amplifies this — governance implications flagged for later circle-governance work.

**AF-7 intersection:** Noise gate behavior exports as auditable artifact — "what have you been filtering and why." External reviewer can audit disposition patterns. Audit log is the evidence base.

**Options:**
1. **Full implementation** — similarity probe, three-disposition routing, graduation stages, audit log, anomaly-module drift detection, pushed monthly report.
2. **Probe-only first** — add similarity probe to classification, log scores, but don't enforce dispositions. Builds empirical foundation for governance parameters. Smallest diff, highest learning.
3. **Classification-only** — add memorability judgment to LLM prompt without similarity probe. Cheaper, but the classifier lacks context (the jurist's original concern).

**Recommendation:** Option 2. The probe-only approach is the infant stage itself — it builds the data needed to set governance parameters while adding minimal risk. The logchain continues to receive all events. The only new behavior is: every classified event gets annotated with a similarity score against existing knowledge. This data drives decisions 1-4 above with evidence rather than intuition.

**Files affected:** `src/core/keystone/orchestrator.ts` (probe before classify), `src/core/keystone/classification.ts` (extended schema), `src/core/keystone/classification-types.ts` (disposition type), `src/modules/anomaly/` (drift detection), new: audit log writer. Factory connector metrics for per-connector novelty ratio.

**Constitutional touchpoints:** Logchain append path (append-only contract preserved — reinforcement links, doesn't mutate). Noise disposition is a stronger commitment than degraded classification — candidate for invariant governance.

**Awaiting:** Steward authorization. Jurist review of novelty floor invariant shape and Cluster A placement. Seb's assessment of latency budget and #10 interaction.

## PENDING-17 — Epistemic Integrity: The System Shall Know What It Knows
**Date:** 2026-04-03
**Tag:** [PROPOSAL]
**Summary:** The L1 pipeline computes classification confidence and then discards it. No module checks it (`base.ts:83`). Degraded events (confidence 0) are processed, stored, and returned at recall identically to understood events. The bloom filter locks in degraded guesses as permanent records. The recall path returns a mix of knowledge and guesses with no distinguishing signal. This is the contamination problem applied to infrastructure — the system's output looks more confident than its input warrants.

**Rationale:** L0 (contamination problem / Freeman question) requires an epistemically honest substrate. If L1 launders uncertainty into authority, L0 inquiry inherits false confidence. The epistemic integrity amendment is the L0 readiness condition.

**Constitutional position (jurist-assessed 2026-04-03):** "The system does not grant epistemic authority to its own outputs without external grounding." Classified as constitutional position for L2 preamble — the normative claim from which the enforceable invariants derive.

**Three invariants proposed (Cluster A):**

1. **I-CF: Processing Confidence Floor** — No module shall process an event whose classification confidence has not been earned against a declared floor. Sub-floor events HELD for remediation (DeferrableError at `base.ts:83`), not discarded.

2. **I-CC: Classification Confidence Ceiling** — No classification confidence shall exceed the validated accuracy of the source that produced it. Enforcement by construction in `classification.ts`. Open schema question: enforcement vocabulary may need CAP/BOUND verb for value-bounding invariants.

3. **I-NF: Novelty Floor** — Already in REVIEWED-18. Confirmed for Cluster A by jurist.

**Implementation scope:** ~270 lines across 8 files. No new infrastructure. Threading existing confidence signal through existing pipeline. Key changes: confidence floor at `base.ts:83` (~10 lines), confidence ceiling in `classification.ts` (~20 lines), dual bloom filter in `quality-gate.ts` (~40 lines), source confidence provenance on stored records (~80 lines across modules), confidence-weighted recall ranking (~50 lines), epistemic state in health (~40 lines).

**Retroactive implication:** "Earned" reaches backward. When classification competence improves, logchain replay re-evaluates past events. Competence-change triggers (graduation transitions, rule accuracy changes) should fire selective replay.

**Kill chain documented:** Five links from confidence-computed-then-ignored through bloom-filter-locks-in-guesses through entity-graph-launders-uncertainty through recall-returns-guesses-as-knowledge through four-models-none-knows-others-failed.

**Files affected:** `src/modules/base.ts`, `src/core/keystone/classification.ts`, `src/core/perception/quality-gate.ts`, `src/modules/vector/storage.ts`, `src/modules/entity/storage.ts`, `src/modules/temporal/storage.ts`, `src/core/keystone/query-router.ts`, `src/server/routes/health.ts`, `src/server/routes/recall.ts`

**Full amendment:** `CapableMind-AI/docs/thinking/David/amendments/amendment-epistemic-integrity.md`

**Awaiting:** Steward authorization. Seb's engineering review (6 questions in amendment). Invariant hardening for Cluster A.

## PENDING — OP-01 — CLOSED

**Title:** The Observer Problem — Seed Brief Execution
**Date authorized:** 2026-04-07
**Date closed:** 2026-04-07
**Status:** CLOSED — all 13 extractions complete, jurist review passed, steward authorization granted

**Outputs:** 13 extraction notes in `CapableMind-AI/docs/thinking/David/observer-problem/`
Source texts filed in `chamber-library/observer-problem-sources/`
Steward attestation received on OP-EX-T1-01 §2B (Visuddhimagga — ten imperfections).
CD-03 (The Observer Condition and the Limits of Constitutional Architecture) authorized and operative.

---

## COMPLETED — OP-02 Cross-Strand Synthesis
**Date:** 2026-04-07
**Status:** CLOSED — authorized with minor amendment (Question 5 replaced per steward direction)
**Filed:** `observer-problem/OP-02.md`

## PENDING — ICP-19 Remit Expansion (Observer Problem)
**Date opened:** 2026-04-07
**Action required:** Steward-reviewer conversation with the External Auditor before Observer Problem mechanisms advance to constitutional language.
**Blocking:** OP-03 (mechanism design phase)
**Notes:** Bring OP-02 findings in full. Specifically:
- Fault Line 5 (epistemic diversity question)
- Fault Line 3 (inquiry examining steward with steward's own tools)
- Fault Line 4 (CD-03 Gadamer risk)
- The incommensurability named in OP-CN-01
**Status:** PENDING — steward to initiate

## PENDING — Fault Line 1 Response
**Date opened:** 2026-04-07
**Action required:** Steward decision on whether to address PENDING/REVIEWED pipeline gap now or await the External Auditor's input first.
**Notes:** Jurist assessment: most actionable fault line; does not require external review before mechanism design begins. Steward judgment required.
**Status:** PENDING — awaiting steward decision

---

## PENDING — ICP-19 Remit Expansion

**Title:** ICP-19 External Review — Human-Side Governance Scope
**Date opened:** 2026-04-07
**Tag:** [ESCALATE]
**Status:** PENDING — requires direct steward-reviewer conversation

**Summary:** The Observer Problem inquiry opens human-side governance questions that the current ICP-19 reviewer remit does not cover. Before any mechanisms proposed through this inquiry advance to constitutional language, the human-side governance question should be explicitly added to the External Auditor's reviewer remit, or addressed by a successor reviewer.

**Prerequisite:** Direct conversation between steward and reviewer about their incommensurable foundational positions (see Context Note OP-CN-01 §The External Auditor's Comment). This conversation is load-bearing before remit expansion.

**Blocking:** Constitutional advancement of Observer Problem mechanisms. Not blocking OP-02 synthesis.

---

## PENDING — CD-03 Operative

**Title:** Constitutional Declaration CD-03 — The Observer Condition and the Limits of Constitutional Architecture
**Date authorized:** 2026-04-07
**Tag:** [CONSTITUTIONAL]
**Status:** OPERATIVE — immediate effect

**Summary:** CD-03 reorients the purpose of the architecture from infrastructure-toward-solution to infrastructure-toward-honest-inheritance. The architecture can support the conditions under which the sufficient condition (genuine observer calibration) becomes possible, but cannot produce the sufficient condition itself.

**Impact:** All subsequent work that proposes mechanisms must be assessed against CD-03 §IV.4: does this mechanism support the conditions, or does it claim to produce the sufficient condition? The latter is a constitutional failure mode.

**File:** `CapableMind-AI/docs/thinking/David/observer-problem/Constitutional Declaration — CD-03.md`

---

## COMPLETED — CD-01 / CD-02 Materialization
**Date:** 2026-04-07
**Action:** CD-01 (Contamination Condition) and
CD-02 (Archival Condition) drafted by executor,
reviewed by jurist, authorized by steward.
Both now filed as standalone constitutional
declarations completing the preamble triad
alongside CD-03 (Observer Condition).
**Status:** CLOSED

---

## PENDING-18 — Fix H3: Temporal stats fallthrough on text queries
**Date:** 2026-05-14
**Tag:** [HARDENING]
**GH issue:** CapableMind-ai/betterMemories_app #166 (priority:high, OPEN, opened 2026-04-21)

**Summary:** `parseTemporalQueryParams` (`src/modules/temporal/queries.ts:309-372`) has two fallthrough routes that both default to `temporal_stats`: line 311 when `filters.type` is missing/null, and line 370-371 when `filters.type` is unrecognized. Both routes silently fire `getTemporalStats(db)` and return a graph-stats blob (`total_nodes`, `total_edges`) as content. Every text query that fans out to temporal receives this stats blob in its result set at confidence 0.5 (default fallback in `query-router.ts:551`).

**Rationale:** Per April 19 audit (`capablemind/docs/thinking/David/l1-reliability/l1-diagnostic-branch-addendum-2026-04-19.md` §3), this is one of four H-issues in the addendum's cross-cutting "read path lacks honest-degradation contract" pattern. Single-module, scoped, mechanical. Verified unchanged in current main `f0be2d8`. H1 already shipped (#163/#164); H2 (battery suppression) and H4 (hook recall pollution) are architectural design calls that warrant steward+Seb conversation, not executor PR. **H3 is the one mechanical-shape item left from the addendum that fits the L1 fix-plan's one-PR-per-H-issue-bring-Seb-relief discipline.**

**Reproduction (current main `f0be2d8`):** Calling `handleTemporalQuery` with a request whose `filters.type` is unset returns `[{nodes_total: ..., edges_total: ..., ...}]` as if it were content; monotonic counter growth confirms live stats execution per call. Test file `src/modules/temporal/__tests__/temporal-query-status.test.ts` exists with the right pattern (`handleTemporalQuery` invoked directly with crafted `ModuleQueryRequest`); H3 regression cases would extend it.

**Options:**

1. **Module-level guard at parseTemporalQueryParams (recommended).** ~6-line change. Both fallthrough routes return `null`; `handleTemporalQuery` checks for `null` and returns honest empty `{status: 'ok', results: [], total: 0}`. Preserves stats handler for explicit `filters.type === 'temporal_stats'`. Minimal blast radius; closes both fallthrough sites with one guard.

2. **Module-level guard in handleTemporalQuery before parse.** Symmetric to (1) but at the entry point. Slightly larger surface (entry-point catalogue of known types vs. delegating to the existing parse function which already enumerates them).

3. **Planner-level exclusion** (per addendum §3 design question). Drop temporal from text-query dispatch templates in `query-planner.ts:filterAndBuildDispatches`. Cleaner architecturally — temporal isn't relevantly answerable from free text — but larger scope, touches the dispatch matrix, more cross-module reasoning required, harder for Seb to review in 30 min.

4. **New handler `temporal_content_search`.** Out of scope; bigger lift; not needed to close the silent-fallthrough.

**Recommendation:** Option 1. Smallest fix; closes both fallthrough routes; honors honest-degradation per the addendum's structural framing; fits one-PR-per-H-issue per L1 plan discipline.

**Files affected:**
- `src/modules/temporal/queries.ts` — `parseTemporalQueryParams` returns nullable; `handleTemporalQuery` early-returns on null
- `src/modules/temporal/__tests__/temporal-query-status.test.ts` — extend with two new test cases (missing `filters.type`, unrecognized `filters.type`)
- Spec amendment (amendment-first per David CLAUDE.md): `capablemind/docs/thinking/David/l1-reliability/h3-temporal-fallthrough-amendment-2026-05-14.md`

**What this does NOT solve:**
- **H2** (battery silent-fail on query embed) — separate PENDING-N+1 for steward-Seb design call (default policy / visible degradation / CPU fallback / query-vs-ingestion asymmetry)
- **H4** (hook recall pollution + logchain accumulation) — separate PENDING for steward-Seb design call
- **Cross-cutting `[PROPOSAL]`**: read-path needs honest-degradation contract analogous to write-path's cursor + error_count + last_processed_at. Bigger architectural item; jurist territory before draft.
- The 218 silently-dropped vector notes from over-context embeds — separate concern (PR #126/#163 is closed; `ac1673f` "fix: survive over-context embed batches + drop char cap to 1000" addresses ingestion-side; the silent-drop reporting gap is part of cross-cutting)

**Connection to authorized work:** REVIEWED-19 (Epistemic Integrity, PENDING-17) authorized recall-correctness improvements as L0 readiness. H3 fix is a small concrete instance of that broader commitment — recall path stops returning a stats blob at confidence 0.5 dressed as content. Tag commit body with REVIEWED-19 reference where relevant.

**Risk surface:** Low. Bounded to one parse function + one handler entry guard. The two test cases reproduce the symptom; full ~2,300 test suite + `npm run check` + `npm run lint` per BMF CLAUDE.md before push. No schema change, no spec-version bump unless steward wants the temporal-module-spec amended for clarification of the empty-result contract on missing filter type.

**Awaiting:** Steward + jurist authorization. On AUTHORIZE: amendment first per David-CLAUDE.md amendment-then-spec-then-code workflow; branch `fix/h3-temporal-text-query-fallthrough` from main; failing tests red on main; minimal Option 1 fix to green; PR for Seb's review (designed to merge in <30 min of his attention).

**Status (2026-05-14):** AUTHORIZED via REVIEWED-20 (with v1.8 version-bump modification per jurist). Implementation completed same day. PR #172 opened against `CapableMind-ai/betterMemories_app` — closes #166. Spec amendment landed on `CapableMind-ai/capableMind_docs` main @ `1d19856`. Awaiting Seb's review of PR #172.

---

## PENDING-19 — H2: Battery-power suppression silently fails recall (design-call)
**Date:** 2026-05-14
**Tag:** [PROPOSAL]
**GH issue:** CapableMind-ai/betterMemories_app #165 (priority:**critical**, OPEN, opened 2026-04-23)

**Summary:** When on battery, query-time embed throws `"Embedding suppressed: running on battery power"` (`src/inference/ollama-embeddings.ts:204-206`) gated by `shouldSuppressInference()` (`src/core/lifecycle/power-monitor.ts:85-87`). The error propagates up through `vector/queries.ts:62` → vector module returns empty → query-router fan-out sees vector contribute nothing → recall returns empty (or near-empty) on vault-content queries. The user sees "no matching content"; the system silently returned empty because of power state.

**Verified unchanged in current main `cdc2f0e` (2026-05-14):** code at all three cited file:line locations is byte-identical to the addendum's transcription. No mitigation has shipped in the ~3 weeks since H2 was filed.

**Why this is [PROPOSAL] not [HARDENING]:** Per the April 19 audit addendum's classification (`l1-diagnostic-branch-addendum-2026-04-19.md` §2), H2 is a *"Design call — warrants a call with steward before picking a direction. Production blocker for laptop end-users."* Unlike H1 (mechanical fix → #163) and H3 (mechanical contract → PR #172), H2 has four design questions whose resolution is Seb's territory; choosing among them is policy, not localization. The executor's job here is to surface clearly, not to choose.

**The four design questions** (verbatim shape from addendum §2 for steward+jurist+Seb review):

1. **Default policy.** Should `shouldSuppressInference()` default to `false` (allow inference on battery, accepting battery cost) rather than `true` (suppress, accepting silent recall failure)? The current default protects battery life; suppresses recall as a side effect. Neither side is obviously correct. Existing `BM_BATTERY_ALLOW_INFERENCE=true` env var is a sysops workaround, not a user-facing solution.

2. **Visible degradation.** If suppression stays the default, the operator should see *why* recall returned empty. Currently the error is swallowed inside vector's module-error path; the recall response looks identical to "no matching content." Proposal shape: surface in `system_status` a state like `power_limited` that the health endpoint exposes and recall responses annotate in metadata.

3. **CPU-only fallback.** `mxbai-embed-large` runs on CPU in Ollama — slower but functional. Reasonable to fall back to CPU-only embedding when on battery rather than suppress entirely? Estimated ~5-10x latency hit on embed (unverified) but keeps recall functional.

4. **Query-time vs ingestion-time asymmetry.** Ingestion-time suppression is defensible (bulk work, defer-is-fine — that's what the existing battery-deferral path was designed for). Query-time suppression is the user-facing hit. Should the two be governed separately (suppress ingestion but not query)?

**Steward's framing (preserved verbatim from addendum):** *"For those future end-users who will use this on a laptop the need to be plugged into ac for recall is a no go..."* — H2 is a production blocker for the target use case.

**Honest-degradation invariant tie-in:** `bettermemories/CLAUDE.md` *"Honest degradation — the system must report its own limits. Silent failures are architectural violations."* Whatever direction Seb chooses, the principle points toward "surface the state, don't hide it." Even Option 1 alone (default to allow) without Option 2 (visible degradation) leaves a gap: when battery is genuinely critical and suppression *does* fire, the user still needs to see why. Options 1 and 2 may be additive rather than alternatives.

**Options for surfacing this to Seb:**

A. **Steward calls Seb directly** with these four questions for a sync conversation. Best signal-to-noise; worst latency-to-Seb-attention.
B. **Steward leaves a comment on #165** referencing PR #172 (which Seb is about to look at for H3). Asynchronous; record-on-issue; Seb engages at his pace. Surfaces while attention is high on the audit findings.
C. **Steward + jurist + executor draft a unified design proposal** (one of the four directions chosen first) and submit to Seb for ratification. More work upfront; risks the executor pre-deciding what is properly Seb's call.
D. **Defer** until next L1 reliability work session. Acceptable IF the steward isn't running BMF on battery in the meantime; otherwise H2 continues to silently degrade recall every time the laptop unplugs.

**Recommendation:** **B**, conditioned on *all four questions surfaced explicitly*. The risk in (B) is that Seb engages with whichever question is easiest and the others drift. Comment should ask Seb to address all four (or explicitly defer specific ones), not just opine on the easiest. Escalate to (A) if Seb's response is "let's talk."

**What this surfaces but does not decide:**
- The right default policy
- Whether `power_limited` should exist as a `system_status` state, and what its taxonomy is (degraded? new top-level?)
- Whether CPU fallback is worth the latency
- Whether ingestion and query embed share or diverge their suppression policy

**Connection to cross-cutting [PROPOSAL]:** H2 is one specific instance of the read-path-honest-degradation pattern the jurist authorized for parallel filing. Naming H2's specific shape (silent-on-battery) does not replace the cross-cutting; conversely, H2's resolution may inform the cross-cutting's concrete mechanism (a `power_limited` state would be one instance of a read-path-error signal that the cross-cutting calls for).

**Connection to authorized work:** REVIEWED-19 (Epistemic Integrity, PENDING-17) authorized recall-correctness improvements as L0 readiness. H2's silent-fail on battery is exactly the laundering-uncertainty pattern that work targets — but the resolution shape is policy, not a clobber-fix. The conversation IS the deliverable here, not a PR.

**Files affected (when conversation produces a direction):** Depends on direction.
- Default-policy change: `src/core/lifecycle/power-monitor.ts` (~1 line)
- `power_limited` state: `src/server/routes/health.ts`, `src/types/system-status.ts`, recall response shape (`src/server/routes/recall.ts`), spec touchpoints
- CPU fallback: `src/inference/ollama-embeddings.ts` (significant — embedding-provider abstraction)
- Query/ingestion split: `src/core/lifecycle/power-monitor.ts` (split into two gates) + call-sites
- Spec touchpoints: `vector-module-spec.md`, `keystone-spec.md`, possibly a new "power-aware inference" spec section

**Awaiting:** Steward authorization to coordinate the surfacing-to-Seb action (recommend Option B above). Direction selection is Seb's call after the four questions are surfaced; this PENDING entry does not propose code or amendment — it proposes the conversation.

**Status (2026-05-14):** AUTHORIZED via REVIEWED-21 (Option B; literal comment text awaiting steward review before posting).

---

## PENDING-20 — Cross-cutting: read path lacks honest-degradation contract
**Date:** 2026-05-14
**Tag:** [PROPOSAL]
**Origin:** Surfaced by April 19 audit addendum (`l1-diagnostic-branch-addendum-2026-04-19.md` TL;DR cross-cutting callout); jurist authorized parallel filing on 2026-05-14 (recorded under REVIEWED-20).

**Naming the pattern.** BMF's honest-degradation contract applies only to the *write path*. Write-path modules report `cursor`, `error_count`, `last_processed_at` — three first-class signals that an operator can read to know what the system is and isn't keeping up with. The *read path* — query-planner, query-router, hybridSearch, temporal handlers, working-memory injection — has **no equivalent scaffolding**. It silently produces empty results, junk results (stats blobs as content; working-memory pollution as memory; BM25 raw scores past 1.0 clamped without note), and partial results with no diagnostic surface. There is no counter, no error signal, no "why empty" breadcrumb. The slow-query log fires only at `searchMs > 200`, which is precisely the wrong threshold for the failure mode that matters most: fast 0-return queries.

**Four empirical confirmations** (from the April 19 audit; current state verified in main `cdc2f0e`):

| H-issue | Read-path subsystem | Silent failure mode | Status |
|---|---|---|---|
| H1 | query-router `normalizePerModule` | confidences silently zeroed when min==max | SHIPPED #163/#164 (mechanical) |
| H2 | vector embed gate (`shouldSuppressInference`) | empty result on battery, no operator-visible reason | OPEN #165 (PENDING-19, design call) |
| H3 | temporal `parseTemporalQueryParams` | stats blob returned as content on missing/unrecognized type | SHIPPED PR #172 (mechanical contract) |
| H4 | hook `cm-hook.mjs` + working-memory injection | hook events pollute recall; agent's own tool stream surfaces as memory | OPEN #167 (design call) |

H1 and H3 are individually closed but the pattern they confirm is not. H2 and H4 will resolve into specific mechanisms or specific behaviors, but the meta-finding — "the read path has no diagnostic discipline" — is not derivable from any single fix. The jurist's framing for filing now: *"if the [PROPOSAL] waits until all H-issues are closed, it will wait indefinitely. The pattern will be visible in retrospect but never formally entered."*

**Proposed design principle (the [PROPOSAL] itself):**

> Any read-path subsystem in BMF MUST expose a "why empty" breadcrumb analogous to the write path's `error_count`. Returning empty silently — when the cause is structural (battery suppression, type mismatch, dispatch exclusion, threshold filter, embedding failure) rather than substrate-truth (no matching content) — violates the honest-degradation invariant articulated in `bettermemories/CLAUDE.md`.

The breadcrumb's *form* is not specified in this proposal; that's Seb's architectural call. Candidates surfaced by the audit:

- A `system_status` extension distinguishing `recall_status: healthy | degraded | broken` (addendum §G in baseline doc)
- A per-response `metadata.degradation_reasons[]` annotation on recall responses
- Per-read-path-subsystem error counters mirroring the write-path `error_count` shape
- A new `system_status: power_limited` state (concrete instance from H2; would be one form of breadcrumb)
- A canary recall mechanism (insert known content → recall it back → confirm match) that runs at health-check time

These are not mutually exclusive. The [PROPOSAL] is the *naming event*, not the mechanism selection.

**What this [PROPOSAL] does NOT do:**
- Choose the mechanism
- Specify the API shape
- Block any individual H-issue PR (H3 already shipped without it)
- Replace the H2/H4 design calls (those resolve specific behaviors; this proposes a contract for the class)

**What this [PROPOSAL] does:**
- Enter the pattern formally into the governance record now, while the empirical confirmations are recent
- Frame future read-path work (any new subsystem; any modification of an existing one) as obligated to honor honest-degradation at the read-path level
- Give the H2/H4 conversations with Seb a contract they sit inside, not just instances they are

**Connection to authorized work:**
- **REVIEWED-19 (Epistemic Integrity, PENDING-17)** authorized the constitutional position *"the system does not grant epistemic authority to its own outputs without external grounding."* That position is structurally upstream of this proposal: a read path that silently launders empty/junk into authoritative-looking results violates that position at the infrastructure level.
- **`bettermemories/CLAUDE.md`** *"Honest degradation — the system must report its own limits. Silent failures are architectural violations."* This proposal extends the invariant from write-path observability to read-path observability.
- **REVIEWED-13 / DN-GOV-05 (Bounded Self-Repair Principle)** is upstream constitutional context: the system can act in bounded ways without steward presence *only when degradation is reversible, within parameters, and independently verifiable*. A read path with no diagnostic surface fails the *independently verifiable* condition by construction.

**Why this is jurist territory before code:**
Per CLAUDE.md authorization taxonomy, [PROPOSAL] requires explicit steward authorization via REVIEWED.md. But this one carries a stronger requirement: it is a candidate L2 invariant — a constitutional commitment about how the architecture must behave, not a one-off design choice. Jurist review for whether this is invariant-shaped or design-commitment-shaped (per the DN-GOV-08 framing — recognition-conditions vs recognition-content) is load-bearing before any mechanism work begins.

**Files affected (when mechanism is later proposed by Seb):** Depends on mechanism. Most candidates touch `src/server/routes/health.ts` + `src/server/routes/recall.ts` + `src/types/system-status.ts`; some touch per-module read paths individually. No code change at this stage.

**Spec touchpoints (when mechanism is later proposed):** `bettermemories/CLAUDE.md` (invariant statement); `keystone-spec.md` (query-router contract); per-module specs that articulate query interfaces.

**Awaiting:** Steward + jurist review for whether this is filed as:
- (a) a [PROPOSAL] in the L1 governance record (this PENDING entry), to inform Seb's design when he picks up H2/H4; OR
- (b) elevated to a candidate L2 invariant in `capablemind/docs/thinking/David/l2-constitution/`, with jurist drafting the registry entry per the I15/I16/I17 pattern; OR
- (c) both — file as PENDING here for engineering visibility AND elevate as L2 candidate for constitutional consideration.

The executor recommends **(c)**, but the L2 elevation is jurist territory and requires the cluster decision (Cluster A/B/C) the executor cannot make.

**Status (2026-05-14, corrected):** AUTHORIZED via REVIEWED-22 — Option **(a) only**: PENDING-20 stays as L1 governance entry. **L2 elevation work is DEFERRED to post-May 2026** per global CLAUDE.md parked-status: *"L2 PARKED through end of May 2026. No L2 governance advancement, no new invariant work, no constitutional proposals. L2-adjacent questions arising from L1 work: note, don't pursue."* Steward confirmed at session end: *"I won't be working on L2 until the end of May — that something was surfaced because of L1 work is both fantastic and coincidental."*

**Jurist's three governance calls** (RECORDED for post-May pickup; not actioned this session): **(1)** Not Cluster A; **Cluster B** is the right cluster (read-path observability is epistemically downstream of Cluster A; common genus with REVIEWED-18 + REVIEWED-19 is *conditions under which the system's epistemic behavior can be verified and governed*). **(2)** DN-GOV-08 fit confirmed: invariant-shaped, not design-commitment-shaped (stabilizes conditions, does not automate recognition). **(3)** l1_contamination_profile is distinct from Cluster A's monotonic-toward-interlocutor-satisfaction shape — it is the **competence-vulnerability paradox** from the Observer Problem: increasing capability masks decreasing observability of degraded paths. Profile candidate: *moderate, structural*. Saved as portable project memory at `~/.claude/projects/-Users-davidglidden/memory/project-competence-vulnerability-paradox.md`.

**Held until post-May 2026 (do NOT pursue):**
1. Steward declaration on Cluster B status.
2. Jurist drafting cluster framing note (if needed) and registry entry per I15/I16/I17 pattern.
3. Brief jurist↔steward exchange on l1_contamination_profile language.
4. Filing of registry entry in `capablemind/docs/thinking/David/l2-constitution/amendments/`.

**Executor's role going forward:** maintain this entry as engineering-visibility record; track Seb's response on #165 (PENDING-19) and how it informs the cross-cutting; do not produce L2 doctrine; do not initiate cluster declaration or registry-entry drafting before June 2026; if a future jurist message arrives on this topic before end of May, surface the parked status before responding substantively.

---

## PENDING-21 — H4: Hook events pollute recall + logchain (design-call)
**Date:** 2026-05-14
**Tag:** [PROPOSAL]
**GH issue:** CapableMind-ai/betterMemories_app #167 (priority:**high**, OPEN, opened 2026-04-21)

**Summary:** Two mechanisms in `hooks/cm-hook.mjs` (verified byte-identical to addendum's transcription in current main `cdc2f0e`; no commits to the hook surface since April 19):

**4a — Recall spam from UserPromptSubmit** (`hooks/cm-hook.mjs:340-362`, `handleUserPromptSubmit`): every UserPromptSubmit event fires `recall(prompt, { maxResults: 5 })` with the full prompt text. In Claude Code this includes real user prompts (expected) AND task-notification XML when background tasks fire (Monitor events, scheduled wakeups) AND auto-generated prompts from tool results. Each fire = one `embeddingProvider.embed(prompt)` (~300-1300 ms via Ollama) + one full query-router pass.

**4b — Logchain accumulation from observe** (same hook): every prompt is also `observe('hook.user_prompt', payload, ...)`'d, lands in the logchain, gets classified, and enters entity/vector/temporal storage. Over a session, hook-observed content fills the underlying stores and matches subsequent recalls for any query with overlapping tokens — *this is how earlier WM pollution manifested* per the addendum.

**§6 aggregate cost framing**: a steward working a full day with many tool calls, monitors, and scheduled triggers generates many hundreds of hook recalls. Each is silent CPU + embed cost. *"On battery, this ambient Ollama load is pure loss"* — directly couples to H2 (#165).

**Why this is [PROPOSAL] not [HARDENING]:** Per addendum classification, *"Architectural — Two mechanisms (recall spam + logchain noise). Design call — warrants a call with steward, likely coupled with session/hook integration work."* Three design questions whose resolution is Seb's territory; choosing among them is policy.

**The three design questions** (verbatim from addendum §4 for steward+jurist+Seb review):

1. **Prompt filtering at the hook.** Should the hook distinguish "substantive user prompt" from "system/tool-notification prompt"? A trivial shape: skip observe + recall when the prompt starts with `<` (XML/tag-shaped). Not robust to all cases but fast.

2. **Event classification at BMF.** Should `hook.user_prompt` events enter the same indices as vault content, or a segregated tier (e.g., session-scoped, not recallable)? This is the cleaner architectural shape but bigger lift.

3. **Recall-triggering policy.** Should every prompt trigger a full recall, or only when the operator asks for context (e.g., an explicit `/context` trigger)? The current default assumes recall is always wanted; measurement suggests it's also always costly.

**Options for surfacing this to Seb** (same shape as PENDING-19 Option B; recommend the same answer):

A. **Steward calls Seb directly** with these three questions for a sync conversation.
B. **Steward leaves a comment on #167** referencing PR #172 + the H2 comment on #165 (batches the audit's three open findings into one attention window for Seb). Asynchronous; record-on-issue.
C. **Steward + jurist + executor draft a unified design proposal.** Pre-decides what is properly Seb's call.
D. **Defer.** Acceptable if H4's ambient cost is tolerable; the steward is the empirical witness for whether it is.

**Recommendation:** **Option B**, conditioned on *all three questions surfaced explicitly* and the §6 ambient-cost framing included as fourth-question-in-effect. Same discipline as PENDING-19: ask Seb to address all three or explicitly defer specific ones. Escalate to (A) if response is "let's talk."

**Coupling note for the comment:** H4 and H2 share a substrate (both depend on Ollama embedding being available; H4's ambient cost is *pure loss* on battery per the addendum's §6 callout). If Seb resolves H2 toward CPU fallback or default-allow, that affects H4's cost analysis directly. Worth surfacing explicitly so Seb sees the H2/H4 coupling rather than treating them as independent.

**Connection to cross-cutting [PROPOSAL] (PENDING-20):** H4 is the fourth empirical confirmation of the read-path-honest-degradation pattern. Specifically: the working-memory pollution + hook-observed content surfacing on subsequent recalls is exactly the failure mode the cross-cutting `"why empty / why these results"` breadcrumb would surface. PENDING-21's resolution informs the cross-cutting's mechanism design, but does not replace the meta-finding (which is held until post-May 2026 per REVIEWED-22 correction).

**Connection to authorized work:** REVIEWED-19 (Epistemic Integrity, PENDING-17) authorized recall-correctness improvements as L0 readiness. H4's both mechanisms (spam + accumulation) launder the agent's own tool-stream into recall results — the laundering-uncertainty pattern that work targets. Resolution is policy, not a clobber-fix.

**Files affected (when conversation produces a direction):** Depends on direction.
- Prompt filtering at the hook: `hooks/cm-hook.mjs` (~5-10 lines)
- Event classification segregation: `src/core/keystone/orchestrator.ts`, `src/core/keystone/classification.ts`, `src/types/event.ts`, hook payload shape, possibly a new `hook_session_scoped` event domain
- Recall-triggering policy: `hooks/cm-hook.mjs` + Claude Code config conventions; user-facing trigger surface
- Spec touchpoints: `keystone-spec.md`, possibly a new "session-scoped events" spec, MCP/hook integration specs

**Awaiting:** Steward authorization to coordinate the surfacing-to-Seb action (recommend Option B above with the H2-coupling note). Direction selection is Seb's call after the three questions are surfaced; this PENDING entry does not propose code or amendment — it proposes the conversation.

**Status (2026-05-14):** AUTHORIZED via REVIEWED-23 (Option B; literal comment text reviewed by steward before posting). **Comment posted**: https://github.com/CapableMind-ai/betterMemories_app/issues/167#issuecomment-4449244331 — three questions surfaced verbatim, §6 ambient-cost framing included, H2/H4 coupling note included. Awaiting Seb's response.

---

# Continuity Skill Audit cluster (S0–S9)

The following ten entries (S0–S9) emerged from the 2026-05-18 audit of the wake-up / wrap-up / symmetria continuity skills, framed against Robert Pogue Harrison's *Dominion of the Dead* (the living session as ligature between the dead and the unborn). The audit's full architectural framing lives in three companion documents in `~/_Dev/CapableMind-AI/docs/thinking/David/methodology/`:

- `continuity-skill-audit-jurist-brief-2026-05-18.md` (executor's v2 brief)
- `continuity-skill-audit-jurist-shape-review-2026-05-18.md` (Jurist's shape-review)
- `prime-directive-elaboration-2026-05-18.md` (steward's authored Directive elaboration)

Cluster identity (S-prefix) is preserved per the OP- cluster precedent. PENDING.md entries here are operational trackers; the methodology documents carry the architectural reasoning.

The Jurist's six-phase authorization map governs sequencing. Cross-cutting success criterion (filed as feedback memory `feedback-skill-success-is-reexplanation-reduction.md`): the measure of any S-item implementation is whether the steward stops having to reexplain himself at the moment that change addresses — not whether the skill becomes more sophisticated.

---

## PENDING-S0 — Prime Directive elaboration (CLOSED 2026-05-18)
**Date:** 2026-05-18
**Tag:** [ESCALATE] [PROPOSAL]
**Status:** **CLOSED-by-commit.**

**Summary:** Make explicit, as a continuation of the μέτρον gloss, the principle that *τὸ πρόσφορον* — what is fitting — includes the time the task requires. Constitutional commitment at the Prime Directive level; operational carrier in Symmetria §0.

**Authoring sequence:** Executor surfaced the principle from three corrections-in-a-day during the audit (the lectio moment + the v1-brief hedging + the principle-elevation correction). Steward authored the final language; Jurist shape-reviewed and confirmed (clause within existing μέτρον gloss, not appended paragraph). Steward committed CLAUDE.md (line 12, between citation and decision-filter prose); executor committed Symmetria §0 (between gloss and §0 header).

**Files committed:** `~/CLAUDE.md` §"Prime Directive"; `~/.claude/skills/symmetria/SKILL.md` (between citation and §0).

**Acceptance test (per cross-cutting success criterion):** does the executor hold the time-the-task-requires principle without requiring steward intervention to apply it? Tested over the following weeks of work.

---

## PENDING-S1 — Wrap-up §8 output template: add pause statement + negative space as named fields (CLOSED 2026-05-18)
**Date:** 2026-05-18
**Tag:** [HARDENING]
**Status:** **CLOSED-by-implementation** via REVIEWED-24 (Class A bundle).

**Summary:** §8 output template in `~/.claude/skills/wrap-up/SKILL.md` adds two named fields: `**Pause statement:**` (parallel to pulling thread) and `**Decisions deferred (and why):**`. Both are currently required in §1 procedure but absent from §8 template.

**Rationale:** Audit ligature test A2 + A3. The pause and the negative space are procedurally required but structurally optional. Under context-pressure the procedural commitment is the one that drops — the post-Directive-elaboration view is that this is exactly the time-the-task-requires failure mode the new constitutional clause names. Q3 (the asymmetric pause) was elevated to constitutive by the Jurist on Harrison-grounded reasoning: *the ligature is laid at departure, not discovered at return.* Wrap-up must structurally enforce the pause statement.

**Files affected:** `~/.claude/skills/wrap-up/SKILL.md` §8.

**Implementation note:** New fields include explicit annotations naming the pause as constitutive and the negative space as required-for-unborn-session-to-know-scope. Acceptance test: the /wrap-up at the end of session 2026-05-18 is the first live run; future wrap-ups should not drop these fields under context pressure.

---

## PENDING-S3 — Wake-up §3: binary thread validity gate (CLOSED 2026-05-18)
**Date:** 2026-05-18
**Tag:** [HARDENING]
**Status:** **CLOSED-by-implementation** via REVIEWED-25 (Class A bundle).

**Summary:** Add an explicit named step in `~/.claude/skills/wake-up/SKILL.md` before §3 synthesis: thread validity gate with binary outcome (`confirmed / stale / superseded`) and a one-line reason. If stale, surface that before restoring anything else.

**Rationale:** Audit B1. Currently the staleness check lives in prose ("if situation has changed enough, say so") plus a 3-day heuristic. Compression risk: the check is silently skipped — exactly the pattern the Directive elaboration's *"when context pressure rises, pause before composing"* addresses.

**Files affected:** `~/.claude/skills/wake-up/SKILL.md` §3.

**Implementation note:** Gate is placed as the first step of §3 synthesis (not as a separate section, to avoid numbering cascade). On `stale` or `superseded`, the briefing structure reorders to lead with what changed, not with the inherited thread. Acceptance test: future wakes after a long pause or after substantive events should explicitly state the gate's outcome rather than implicitly restoring the prior thread.

---

## PENDING-S8 — Symmetria pulse lineage anchor + wake-up traversal tools prescribed (CLOSED 2026-05-18)
**Date:** 2026-05-18
**Tag:** [HARDENING]
**Status:** **CLOSED-by-implementation** via REVIEWED-26 (Class A bundle).

**Summary:** Two related drifts identified by the audit (D2 + B6):
1. **Symmetria pulse procedure** (§6 no-arg pulse) adds a step 0 — re-anchor craft / ethics / character to lineage (now including the *τὸ πρόσφορον*-includes-time elaboration just landed in §0).
2. **Wake-up procedure** (§2.b) prescribes `mempalace_find_tunnels` when the pulling thread crosses project boundaries, and `mempalace_kg_timeline` when steward asks about *when* a fact changed. Both tools mentioned in constraint notes but never prescribed in procedural steps.

**Rationale:** Two drifts where the framework named tools/lineage but did not reach for them in procedure — decoration without load-bearing use. With the lineage just extended (S0 landed), the Symmetria pulse not touching it is now an even larger gap.

**Files affected:** `~/.claude/skills/symmetria/SKILL.md` §6 pulse; `~/.claude/skills/wake-up/SKILL.md` §2.b.

**Implementation note:** Symmetria pulse step 0 re-anchors all three dimensions (craft / ethics / character) to lineage; pulse step 5 also gains a cross-reference to §3 for the self-flag on `aligned`-without-named-tension. Wake-up §2.b gains a new b.4 substep that prescribes the two tools with explicit conditions (cross-project thread → find_tunnels; *when*-question or prior-state-reference → kg_timeline). Acceptance test: future pulses begin with lineage re-anchor; future wakes with cross-project pulling threads (e.g., ARC ↔ chamber-library) reach for find_tunnels in standard procedure.

---

## PENDING-S2 — Hook-aware deposit detection in wake-up (awaiting Q1 hooks contract)
**Date:** 2026-05-18
**Tag:** [PROPOSAL]
**Phase 4 — awaits Jurist contract definition.**

**Summary:** Wake-up detects whether the previous session ended via wrap-up or via Stop hook alone. Surfaces a warning when hook-only: *"Previous session ended without wrap-up — pulling thread may be absent or incomplete."* Calibrates confidence accordingly.

**Rationale:** Audit A4 — the strongest single gap in the ligature. A hook-only deposit lacks pulling thread / literal question / pause statement, but currently looks identical to a wrap-up deposit from wake-up's perspective. Jurist (2026-05-18 shape-review): the hooks/skills contract is *doctrinal, not tooling*. It determines what the unborn session can trust about its inheritance.

**Files affected:** `~/.claude/skills/wake-up/SKILL.md` §2.b.1 + §3.

**Awaiting:** Jurist shape-review of contract language (candidate text in Jurist shape-review document: *"The authoritative deposit is a wrap-up deposit. A hook-only deposit is an emergency fallback, not a complete inheritance. Wake-up must detect which it received and calibrate accordingly."*). Then steward authorization.

---

## PENDING-S4 — Post-compression marker; cross-repo with mempalace (awaiting Q1)
**Date:** 2026-05-18
**Tag:** [PROPOSAL]
**Phase 4 — cross-repo coordination.**

**Summary:** PreCompact hook (`~/_Dev/mempalace/hooks/mempal_precompact_hook.sh`) writes a marker diary entry (topic: `session-compaction`) when it fires. Wake-up detects this marker; if present, warns that confidence claims in that session inherit a lossy view. Symmetria adds a post-compression contamination flag (paired with §3 application work in S6).

**Rationale:** Audit B4 + D4. The PreCompact event currently silent to all downstream consumers; this makes it observable.

**Files affected:** `~/.claude/skills/wake-up/SKILL.md`; `~/.claude/skills/symmetria/SKILL.md` §3; `~/_Dev/mempalace/hooks/mempal_precompact_hook.sh` (upstream PR or steward-coordinated change).

**Awaiting:** Jurist contract definition (Q1); steward authorization; mempalace upstream coordination.

---

## PENDING-S5 — Authoritative-diary marker; wrap-up ↔ Stop hook (awaiting Q1)
**Date:** 2026-05-18
**Tag:** [PROPOSAL]
**Phase 4 — cross-repo coordination.**

**Summary:** Wrap-up's diary write carries an explicit `authoritative: true` marker (or AAAK equivalent). Stop hook (`~/_Dev/mempalace/hooks/mempal_save_hook.sh`) checks for a recent authoritative entry and skips its block if present.

**Rationale:** Audit C3. Currently a wrap-up + subsequent hook fire may produce two diary entries from different AI states. The second one (post-wrap-up, depleted context) is silently mistaken for the canonical entry by future wake-ups.

**Files affected:** `~/.claude/skills/wrap-up/SKILL.md` §4.b; `~/_Dev/mempalace/hooks/mempal_save_hook.sh`.

**Awaiting:** Jurist contract definition (Q1); steward authorization; mempalace upstream coordination.

---

## PENDING-S6 — Symmetria §3 contamination flag applications of the Directive elaboration
**Date:** 2026-05-18
**Tag:** [HARDENING]
**Phase 3b — depends on S0 (now CLOSED).**

**Summary:** Extend `~/.claude/skills/symmetria/SKILL.md` §3 contamination flag list with applications of the now-constitutional time-the-task-requires principle, plus three other self-flags surfaced by the audit:
- **Lectio** (corpus reading): take the time the corpus asks for.
- **Diagnose-don't-fix** (debugging): trace the class of failure before patching the instance.
- **Dwell-on-composition** (writing): the recommendation gets the time it wants, not the time the executor wants the recommendation to take.
- **Alignment pulse returning `aligned` without naming a specific tension** — premature-closure (D1).
- **Search queries shaped by what the session wants to find** rather than what it needs to find (D5).
- **Post-compression confidence claims** — the working memory was trimmed; what's certain now may rest on what was lost (D4; pairs with S4).

**Rationale:** Audit D1/D4/D5 + the principle elevation. §3 currently flags external code and writing patterns; with the Directive elaboration in place, applications of it at the discipline level are coherent additions, not scope-creep.

**Files affected:** `~/.claude/skills/symmetria/SKILL.md` §3.

**Awaiting:** Steward authorization (S0 closure unblocks).

---

## PENDING-S7 — Symmetria `check` mode: add `suspend` outcome (awaiting Q5 + relates to Q4)
**Date:** 2026-05-18
**Tag:** [HARDENING]
**Phase 5.**

**Summary:** §6 `check` mode outcomes extend from `proceed / return-and-reframe / escalate` to `proceed / return-and-reframe / suspend / escalate`. `suspend` = hold for unhurried steward judgment without urgency.

**Rationale:** Audit D3 + Jurist confirmation. Today's audit was the missing-shape example: neither escalate (urgent) nor return-and-reframe (the audit is the right work) fit. With the Directive elaboration in place, `suspend` is the natural outcome — *the time the steward's judgment requires is task-time, not interruption-time.*

**Files affected:** `~/.claude/skills/symmetria/SKILL.md` §6 (check).

**Awaiting:** Steward authorization.

---

## PENDING-S9 — Wrap-up §8 output template enriched to match practice
**Date:** 2026-05-18
**Tag:** [HARDENING]
**Phase 5 — depends on Q2 + Q3 (Q3 confirmed by Jurist).**

**Summary:** §8 output template in wrap-up expanded to mirror the three-tense richness the steward already produces in session memory files: Past / Present / Future as named sections, with required fields under each. Subsumes S1 if implemented together; or S1 lands first as smaller increment and S9 follows as deeper revision.

**Rationale:** Audit C5 diagnostic — template under-specifies what good practice already does. With the Directive elaboration in place, an output template that drops the practice's load-bearing tenses under compression is itself an instance of the failure mode the principle catches.

**Files affected:** `~/.claude/skills/wrap-up/SKILL.md` §8.

**Awaiting:** Steward authorization. Optional relationship to S1: implement S1 first (minimal additive), then S9 as deeper revision; or fold S1 into S9 as single revision.

---

## SESSION-LOG-2026-05-18 — Continuity Skill Audit Phase 1+2 complete

**Date:** 2026-05-18

**Summary:**
- Three-phase audit of wake-up / wrap-up / symmetria triad executed per steward instruction.
- Audit revealed central architectural finding: *load-bearing items currently named in procedure but not enforced in structure*. Strongest single gap: hook-only deposits invisible to wake-up (PENDING-S2). Strongest working part: literal-question discipline.
- Two steward corrections during the audit elevated the work: lectio surfaced the principle's specific shape; principle-elevation correction surfaced that the audit's central finding is itself an application of a principle the Prime Directive implies but does not carry through to (*always take the time the task requires*).
- Jurist shape-reviewed five doctrinal questions (Q1–Q5); all five affirmed. Q3 (asymmetric pause) elevated to Phase 2 alongside Q4 (principle elevation) on Harrison-grounded reasoning: *the ligature is laid at departure, not discovered at return.*
- Phase 2 completed: steward authored the Directive elaboration; Jurist confirmed language as drafted + placement (Option 1: both CLAUDE.md and Symmetria §0); steward committed CLAUDE.md; executor committed Symmetria §0. PENDING-S0 closed.
- Phase 3 now unblocks: Class A items S1 + S3 + S8 ready for steward authorization (no doctrinal dependencies).
- Cross-cutting success criterion saved as feedback memory: *the measure of skill improvements is whether the steward stops having to reexplain himself; sophistication without reexplanation-reduction is decoration.*

**What works:** the literal-question discipline (structurally enforced; survives compression).
**What doesn't yet:** hook-aware deposit detection; pause-statement symmetry; thread validity gate; Symmetria lineage anchor in pulse; §3 self-contamination flags; suspend outcome.
**Artifacts:** three methodology documents in `~/_Dev/CapableMind-AI/docs/thinking/David/methodology/`; two feedback memories (`feedback-load-bearing-not-by-immediate-weight.md` + `feedback-skill-success-is-reexplanation-reduction.md`); one new KG drift-pattern (`under-valuing-small-discipline-marks-by-immediate-visible-weight`); session ledger entries.

---

## PENDING-22 — Hermes Agent scout deliverable (for jurist review)
**Date:** 2026-05-27
**Tag:** RESEARCH / SCOUT — awaiting jurist review (contains NO proposals per brief; each candidate adaptation would become a separate [PROPOSAL] only after jurist review)
**Summary:** Completed the steward-authorized, jurist-drafted Hermes Agent scout mission — structured comparative analysis of `NousResearch/hermes-agent` (read from a clone, HEAD `c819bc5`; ~134k★) against the four L1 pain points.
**Deliverable:** `~/_Dev/CapableMind-AI/docs/thinking/David/l1-reliability/hermes-agent-scout-2026-05-27.md` (uncommitted working-tree file on `capableMind_docs` main — awaiting steward decision to commit).

**Two stale-fact corrections to the brief (steward-requested pass), verified against source:**
- **Pain #1 ("confidence discarded") is substantially STALE** — Amendment 61 shipped it end-to-end (I-CF floor `0.35` `base.ts:64`; I-CC ceiling; `source_classification_confidence` persisted; recall composite weights it `query-router.ts:657-680`; `recall.ts:116-118` exposes it). Reframe to "built; open question is calibration, not existence." Materially changes the crosswalk.
- **Pain #2 substrate claim imprecise** — current BMF is a hybrid (SurrealKV + per-module better-sqlite3 + LanceDB + file-logchain), SurrealDB mid-retirement. Not a completed "shift to SQLite+LanceDB."

**Headline findings for the jurist:**
- **Pain #1:** Hermes's *default* memory has NO confidence/quality/provenance (provenance computed-then-discarded; only the opt-in `holographic` plugin has a `trust_score`, and it is usage-feedback not classification-time). **CapableMind is ahead** here.
- **Pain #4 (skill/procedural memory)** is the high-value lesson: `SKILL.md` artifact (minimal enforced schema: name+description+body), dual creation triggers, progressive-disclosure retrieval, never-delete curator lifecycle (maps onto CapableMind's existing `lifecycle_state` enum), agentskills.io portability. CapableMind has no procedural-memory architecture (though `knowledge_type='procedural'` already exists on entities).
- **Pains #2/#3:** concrete inputs (hard-coded curation exclusion taxonomy; trigram-FTS for multilingual; progressive disclosure; explicit model-driven retrieval) but no confidence-gated admission and no auto-retrieval-fidelity solution.

**Governance flag (most important for jurist):** Hermes's headline feature — an autonomous background-review fork that writes skills/memory **without human authorization** — is exactly the autonomous self-modification CapableMind's constitution gates (loop-is-load-bearing; DN-GOV-05). Any borrowed pattern must re-introduce the authorization boundary Hermes omits. §7 candidate adaptations are all marked SPECULATIVE for this reason.

**Awaiting:** Jurist review of the deliverable before any adaptation work. No code, no spec, no proposal produced this session.

---

## PENDING-23 — Skill-harvest practice added to the wake/wrap continuity discipline
**Date:** 2026-05-27
**Tag:** [HARDENING] — continuity-triad; steward-authorized direct implementation this session
**Summary:** Refactored "skills improve from what we learn" into our standing way of working — the *governed* analog of Hermes's autonomous self-improvement fork. `/wrap-up` gains **§1.6 "Skill harvest"** (propose create/patch/retire skills from the session + ledger; never autonomous), a **§8 output field**, and a propose-only constraint. `/wake-up` gains a **glance** for skill-harvest proposals left unauthorized (§2.a + §3). Improved skills now carry a one-line provenance note (added to wake/wrap themselves).
**Rationale:** Yesterday's wake/wrap improvements were this practice run by hand; this makes the reflex standing. The governed translation (propose → steward-authorize → apply → record) is the `[PROPOSAL]→[REVIEWED]` model turned on our own tooling — dogfooding the CapableMind thesis: self-improvement that is governed, auditable, never autonomous. It explicitly **inverts** Hermes's "nothing-to-save should not be the default" — "no harvest" is valid; manufacturing changes is the contamination shape. Yardstick: the reexplanation-reduction memory.
**Files affected:** `~/.claude/skills/wrap-up/SKILL.md` (§1.6, §8, constraints, provenance); `~/.claude/skills/wake-up/SKILL.md` (§2.a, §3, provenance).
**Governance note:** Touches the continuity triad the 2026-05-18 S-cluster audit treated with jurist shape-review (REVIEWED-24/25/26). Steward authorized direct implementation this session (additive, low-risk — same shape as REVIEWED-24's §8 additions). Surfaced for jurist awareness; jurist may refine §1.6 wording or elevate the practice.
**Storage (corrected):** No duplication. `~/.claude/skills/{wake-up,wrap-up,symmetria}` are already SYMLINKS into `~/dotfiles/claude/skills/` (the clean pattern, same as `audit` and `landscape-scan`). The edits therefore landed directly in the canonical, version-controlled files — nothing to consolidate. (Earlier this session I mis-asserted duplication from an `ls -la` that silently followed the symlink; corrected here via `-L`/`diff` check. Drift: asserting-fs-state-from-a-misread-listing — verify with `-L`, not `ls -la` of a symlinked dir.)
**Awaiting:** First live test at this session's `/wrap-up` (§1.6); jurist refinement if desired. The skill changes are in the canonical `~/dotfiles` tree (currently uncommitted).

---

## PENDING-24 — Hindsight deep-read & the L1 epistemic-vs-mechanical analysis (umbrella; contains proposals)
**Date:** 2026-05-27
**Tag:** RESEARCH / ANALYSIS — umbrella for sub-items tagged below ([PROPOSAL] A1/A2/B1, [HARDENING] C1/C2/D1). Steward-authorized deep read ("take all the time you need, do it once"); Symmetria active throughout.
**Summary:** Source-grounded deep read of Hindsight (arXiv 2512.12818 / `vectorize-io/hindsight`, Seb's flag) and of L1's spec + runtime (`BetterMemories.io@3bc8b75`), through the steward's thesis (*an epistemic system should think epistemically end to end, not mechanically*). Three sub-agent reads under the Symmetria §5 preamble + executor re-verification of every load-bearing claim against source.
**Deliverable:** `~/_Dev/CapableMind-AI/docs/thinking/David/l1-reliability/hindsight-deep-read-and-l1-epistemic-analysis-2026-05-27.md` (uncommitted working-tree file on `capableMind_docs` main — awaiting steward decision to commit).

**The verified reversal (changes the strategic picture):** Hindsight's *shipped code is not its paper.* The four-network epistemic typing + per-fact confidence + CARA belief-revision were **removed** (migration `g2h3i4j5k6l7_remove_opinion_fact_type.py`, 2026-04-02: deletes opinion rows, drops `confidence_score`, CHECK → `('world','experience','observation')`); no `reinforce`/`cara`/α math in the engine. They ship a pragmatic 3-type hybrid and still hit 91% on LongMemEval — **because the benchmark gives no credit for epistemic integrity.** CapableMind's governed/epistemic angle is therefore *unmeasured by the field* — its risk and its moat. The steward+Seb bet is vindicated, not threatened.

**Answer to the steward's question** (*refactor with our tools, or are they showing us the way?*): **mostly "our tools."** At the parts level L1 is even/ahead — RRF (k=60, module-weighted), cross-encoder rerank, BM25+vector hybrid (LanceDB), honest read-path degradation, **and a fully-wired _numeric_ confidence chain** (I-CF floor → I-CC ceiling → persisted `source_classification_confidence` → recall weight 0.15; all verified live). Our gap is not missing tools — it is: **(a)** the epistemic *kind* signals (`means_of_knowing`, `earned_confidence`) are computed at write and **read by nothing in recall** (verified — orphaned exactly as the numeric confidence was *before* Amendment 61); **(b)** the similarity probe / observation-recall coupling is **dead code** (`setSimilarityProbe` has zero callers — REVIEWED-18 inert and silent); **(c)** the causal subsystem is an **ungoverned inference-generator** (N6: ~42 edges/event, 97%+ coherence-unevaluated, `json_each` full-scan in the ingest hot loop — *the epistemic failure and the operational crash are the same failure*); **(d)** no external benchmark to tune recall against.

**Where they genuinely show us the way (borrowable with our tools):** (1) **bounded graph growth** — per-unit link caps (`_cap_links_per_unit`: temporal 20 / semantic 50) + anti-hallucination causal `target_index < i` (prior-only) — the exact governor N6 lacks; (2) **always-on local recall quality** — their cross-encoder rerank runs unconditionally on an 80 MB local model, where **L1's rerankers no-op unless inference slots are graduated** (cold/teacherless → heuristic-only recall); (3) the **LongMemEval/LoCoMo benchmark harness** (plug-in seam: dataset/generator ABCs + an L1 adapter exposing `retain_batch_async`+`recall_async`).

**Sub-items surfaced (none unilaterally committed):**
- **A1 [PROPOSAL] (jurist territory):** thread `means_of_knowing`/`earned_confidence` to recall as output provenance (+ optional ranking signal) — *"Amendment 61 for the qualitative epistemic axis."* L1-only (existing fields); the L2-coupled belief-schema version stays PARKED.
- **A2 [PROPOSAL]:** if we adopt the benchmark, record it as a **floor not a ceiling** (it cannot score epistemic integrity; Hindsight is the cautionary case of optimising it away).
- **B1 [PROPOSAL] (architectural):** an epistemic governor on causal-edge generation — Hindsight's per-unit cap + prior-only constraint (mechanical half) **+** mint causal edges as held/low-confidence `means_of_knowing=inference`, promotion gated on coherence (epistemic half). Defuses N6 *and* prevents the next one.
- **C1 [HARDENING]:** bundle a local always-available cross-encoder fallback so recall quality doesn't depend on slot graduation.
- **C2 [HARDENING]/issue:** fix or honestly remove the dead similarity probe (`orchestrator.ts:363`, zero callers).
- **D1 [HARDENING]:** wire L1 to the LongMemEval/LoCoMo harness via an adapter (bind to A2).

**Set aside on record:** BMF-on-Hindsight-substrate (relational — L1 is the co-authored mechanism since 2026-05-23 (steward + Seb), conceived from the steward's Chamber prototype; substrate change touches both co-authors' work; sovereignty — Postgres/Oracle vs L1's local-first sqlite+LanceDB+file-logchain; governance — Hindsight has no authorization loop / logchain immutability / external-review hook). We take technique + validation, not substrate. Paper-vs-code divergence is itself a caution: borrow from *their code*, not their paper.

**Caveat:** checkout `3bc8b75`; Seb's later commits (`bd70ceb`, `e8c5fb7` w/ D1–D10) are not on disk and may move some findings.

**Audit update (2026-05-28):** four-pass pre-build audit completed (`pre-build-audit-2026-05-28.md`). Findings (a)/(b)/(c)/(d) were re-tested against substrate; A1's persistence-finding (no schema for `means_of_knowing`; only numeric value of `EarnedConfidence` persisted) corrected; B1's "prior-only constraint" borrow ruled redundant (BMF enforces by construction); B1's `_cap_links_per_unit` borrow validated as 1–3 lines; the parent amendment's items 9 (numeric confidence in recall response) and 10 (epistemic state in health) found NOT shipped, reshaping A1's scope. Co-author branch deferred. Audit document is part of the Monday package.

---

## PENDING-25 — Translated renderings in the ARC corpus
**Date:** 2026-06-03
**Tag:** [PROPOSAL]
**Summary:** A doctrine + frontmatter convention for translated/multilingual works — ARC holds *works*, of which languages are non-canonical *renderings*; the work (not any rendering) holds the corpus slot.
**Rationale:** Lune will translate *After the Reply* into French — the first translation in the corpus, and a first instance of intergenerational stewardship in ARC. The corpus had no settled mechanism (only a tentative `related_texts` line in frontmatter-spec §8, and one accidental Context-C legacy piece). Jurist's Opinion (2026-06-03) ruled: Option B *reframed ontologically* — neither rendering is canonical, both express one work; Context C legitimate-but-gated; `translator:` a **required** field (intergenerational dimension carried structurally); amend frontmatter-spec (no new companion).
**Options:** Work-level corpus-slot representation — W1 (`primary_rendering` flag; rejected, re-smuggles privilege), W2 (work-stub object; faithful but heavy), **W3 (group by `work:` at build; AUTHORIZED)**. Sub-questions resolved 2026-06-03: routing = asymmetric (root slug stays, additional renderings `/<lang>/<slug>`); rendering-date = each rendering's own publication date; Context-C-placement = frontmatter-spec §8 + §I.j pointer (settled). **Only toggle affordance remains open** (deferred to implementation, to be rendered not specified blind).
**Recommendation:** Adopt the jurist's rulings; implement via W3. Full proposal: `docs/AldineXXI-Codex/drafts/translated-renderings-proposal-2026-06-03.md` (jurist brief at `multilingual-translation-handling-jurist-brief-2026-06-03.md`).
**Files affected (on implementation):** `frontmatter-specification.md` (§2 new subsection, §4 recipe, §8 ruling); `site.hs` (listing dedupe by `work:` + representative-selection); piece template (rendering toggle); routing rule. None touched yet.
**Status:** AUTHORIZED-with-conditions by steward+jurist 2026-06-03; the four conditions are addressed in the proposal document (date resolved, `work:` omission corrected, §7.3 settled, routing decided). Formal REVIEWED entry is the steward's to file. Implementation **split along its natural seam** (executor analysis 2026-06-03, steward-accepted): (a) the `work:` listing-dedupe awareness folds into **F-Phase 2** (the Hakyll listing generator — same `site.hs` listing surface; build it work-aware from the start so the generator is never reopened; dormant until a `work:` field exists, like §I.k); (b) the rest — frontmatter-spec amendments, toggle template, routing, heteronym decompose — is its own focused session **after Stage G** (stable typology), with the toggle *rendered for the steward*, not specified blind. **Decoupled from the Vignette** (independent — touches neither listing nor rendering). **Test vehicle = the Matthieu Taliesin heteronym refactor** (steward 2026-06-03): decompose the trilingual piece to en/fr/es renderings as the proving ground for the toggle+`work:` machinery (first application of the §5 Context-C gate, not a reversal of jurist's no-force-decompose ruling). Also incoming as renderings: steward's bio/CV + About pages (little-by-little). **Readiness target: late August 2026**, ahead of Lune's *Après la réponse* (expected late Aug/Sept). Independent of §I.k.

**Awaiting:** steward review of the audit; jurist review of A1/A2/B1; co-author engineering review of B1/C1/C2/D1 (Seb on resumption from Peter block 2026-06-01+; steward + executor continued joint work during).
## PENDING-26 — `.whisper` retirement: §XIV name-lock + dedicated migration pass
**Date:** 2026-06-03
**Tag:** [HARDENING]
**Summary:** Retire the unsanctioned `.whisper` class (apparatus-spec 462–464; AldineXXI Selector Index 2801) via a dedicated, gated migration pass — after steward/jurist lock the target apparatus class names per §XIV.
**Rationale:** Stage N's deep read corrected the scope: the closing plan recorded "27 template usages"; ground truth is **~156 line-usages — 11 templates (~14) plus 100+ content markdown files (~140)**. This is a corpus-wide migration, not a residual deletion. `.whisper` conflates two semantic roles that must not land in one class: **(a) apparatus prose** (footer text, list metadata) and **(b) list-context qualifier glyphs** (`✦`/`⟐` — the same marks that render via `.chamber-mark`/`.encounter-mark` on post pages). Stage M left a non-regressing holding value (`_utilities.scss:32`, `var(--gray)`); the §VII.e batch (commit `20019ba`) did not touch it. The jurist's Stage-N review requires this carry to be a named PENDING item with commit-gate, not a verbal deferral.
**Name candidates (surfaced from the specs, for the lock):**
- Role (a) apparatus prose → **`.apparatus-meta`** (AldineXXI Selector Index 2801 "migrate to `.apparatus-meta` or equivalent").
- Role (b) list-context glyphs → **`.register-mark-inline`** (apparatus-spec 464) **or unification with the existing `.chamber-mark`/`.encounter-mark`** (arguably the same mark in a quieter context — `_post.scss` historical note: ⟐ rendered via `.chamber-mark` on pages, `.whisper` in lists; one mark, one class, context handles register).
**Options:** (1) Jurist rules on the names in a focused review; executor then runs the migration as its own pass — scripted edit across templates + content, render-verified per type per viewport, sequenced **before** the full re-partition. (2) Steward locks names directly in REVIEWED-26 annotation; same execution path.
**Recommendation:** Option 1 — the role-(b) choice (new class vs unification) is a genuine taxonomy question the jurist should rule on; unification is the leaner answer but touches the qualifier-mark grammar (§V).
**Files affected:** ~11 templates, 100+ content files, `_utilities.scss` + `_layout.scss` (the holding rules), apparatus-spec + Selector Index cross-references.
**Awaiting:** Steward authorization + jurist name-lock. Until then the holding value stands; no migration work proceeds.

## PENDING-27 — Steward-instance telemetry export contract
**Date:** 2026-06-06
**Tag:** PROPOSAL
**Summary:** Establish the standing contract under which derived statistics may leave a steward's production CapableMind instance: content-free by construction · operator-initiated, never pollable · bounded purpose · steward-reviewed before transfer.
**Rationale:** Seb's B1.3 proposal (b1.3-causal-floor-instrumentation-2026-06-02) asks for a base-score histogram from mindfabric-00 — the first extraction of derived statistics from a steward's production instance to inform engineering. The class will recur (fleet telemetry, A2 baselines on real instances, future calibration asks). The privacy analysis (2026-06-06, Tier B note §5) found that even content-free aggregates leak through two channels: totals proxy ingest volume, and any pollable surface turns deltas into a time series of the steward's activity intensity. The adjacent finding — the full /health payload (incl. `idle` presence transitions, `budget`, per-module cursors) served unauthenticated on a VPN-reachable bind — shows what improvisation produces. This is the inward-facing analog of the ARC AI-posture ruling (REVIEWED pending, 2026-06-05): what may be made of the substrate is the steward's to grant, per purpose, not a default. Constitutional-adjacent because it is a consent rule about the steward's own cognition substrate; jurist read requested.
**Options:** (1) Adopt the four-clause contract above as a standing rule recorded in the L1 governance docs; each future request cites it and names its bounded purpose. (2) Rule per-request with no standing contract (status quo — improvisation each time). (3) Defer to L2 formalization (the privacy-tier vocabulary exists in spec but L2 is parked through May).
**Recommendation:** Option 1. The contract is small, the case in hand is easy, and the fourth request should inherit a rule, not a negotiation. Drafted operationally in the Tier B note §5 (cm-ctl distribution-export as v1 mechanism, replacing the pollable /health field); the PENDING item is the *standing* rule, distinct from the B1.3 instance.
**Files affected:** `~/_Dev/CapableMind-AI/docs/thinking/David/l1-reliability/cover-note-seb-tier-b-2026-06-06.md` (operational half, sent to Seb); a governance doc home for the contract TBD on authorization (likely `docs/thinking/David/methodology/` or l1-reliability).
**Awaiting:** Steward authorization + jurist review (constitutional-adjacent: consent rule over steward substrate).

## PENDING-28 — The imprint register: .imprint class + spec note
**Date:** 2026-06-06
**Tag:** [HARDENING]
**Summary:** Give the footer imprint (ARC name, ✦/⟐ qualifier marks, Barcelona + seasonal glyph) its own `.imprint` class, ending `.apparatus-meta`'s silent double duty; add a short imprint/signature note to apparatus-specification.md.
**Rationale:** The steward's eye on the AldineXXI three-faces paragraph (2026-06-06) exposed that the footer lines classed `.apparatus-meta` are not apparatus: they are the house's signature — the imprint — which speaks in the work's own face (EB Garamond, now even-SC per same-day steward ruling, shipped in `da375a6`). The spec already holds the distinction (apparatus-specification.md §VII.g: "The piece's locator | The work's signature"); the CSS class does not. This is the third role the .whisper→.apparatus-meta migration census (PENDING-26/REVIEWED-27) did not distinguish — same shape as the original role-(a)/role-(b) split. The prose now names the register truthfully; the code should match the doctrine.
**Options:** (1) `.imprint` on the four default.html footer usages + one SCSS block + spec note (recommended). (2) Leave CSS as-is; prose-only (rejected by the §5 code-binding discipline — class names carry semantics).
**Recommendation:** Option 1, as its own gated pass (byte-delta touches every page's footer markup; migrate → compiled-selector grep → render-verify per type per viewport, the REVIEWED-27 method).
**Note:** Amends REVIEWED-27's locked naming — jurist eyes requested before execution.
**Files affected:** `templates/default.html` (4 usages), `scss/AldineXXI/_layout.scss`, `apparatus-specification.md`.
**Awaiting:** Steward + jurist authorization.

## PENDING-29 — Sitemap: include bio/cv and their renderings
**Date:** 2026-06-06
**Tag:** [HARDENING]
**Summary:** Amend the §SEO sitemap rule to include bio/cv (and therefore their FR/ES renderings, live since `77cde08`) — currently excluded via the `enfilade-hidden` filter.
**Rationale:** REVIEWED-29's sitemap excludes `enfilade-hidden` pages; bio and cv are the only such pages. "Hidden from the enfilade door-strip" (a navigation-layout choice) and "hidden from crawlers" (an indexing choice) are different intentions that one flag currently couples. The pages are public, canonical, noindex-free, and now carry hreflang families — hreflang sets benefit from sitemap presence. The renderings followed the works out of the sitemap, consistently but probably unintendedly.
**Options:** (1) Decouple: keep `enfilade-hidden` for the door-strip, include the pages (+renderings) in the sitemap — +6 URLs. (2) Status quo (consistent, but couples two intentions).
**Recommendation:** Option 1. One-line change in the sitemap rule + spec note in apparatus §SEO.
**Note:** Amends a jurist-authorized §SEO decision (REVIEWED-29) — flagged for jurist concurrence.
**Files affected:** `site.hs` (sitemap rule), `apparatus-specification.md` §SEO.
**Awaiting:** Steward + jurist authorization.

## PENDING-30 — Prologue Postures: banish-JS with governed gate
**Date:** 2026-06-07
**Tag:** PROPOSAL
**Summary:** Name zero-JS as an AldineXXI posture in the form of the house's existing banish-bold pattern: JS banished from the default path; admissible only through a six-condition gate (provably unachievable in HTML/CSS/build-time · reader-initiated, never ambient · observes nothing · page fully readable without it · first-party self-hosted · declared in spec, steward-authorized per instance, logged as precedent).
**Rationale:** The 2026-06-07 audit found ARC ships zero JS as executed direction but unnamed commitment — and found the one surviving script was ungoverned residue (the unhandledrejection silencer, 312 pages), exactly the accretion a named posture forecloses. The Wave-0 analysis established that everything on the known horizon (vignette, running head, mode) is achievable without JS, so the marginal capability of a runtime is zero while its costs (fragility against ARC's for-return durability; a second runtime to govern; the privacy posture held as policy rather than structural property) are real. The gate keeps the spec honest about legitimate futures (e.g. the §III.b reader font-size control — a reader-initiated instrument) without admitting machinery. Steward ruled the direction 2026-06-07 (roadmap W1.1); this entry is the jurist-visible record for the Postures amendment.
**Options:** (1) Banish-with-gate as above (steward-ruled). (2) Absolute prohibition (simpler, but lies about the §III.b held option). (3) Unnamed status quo (the audit showed what accretes).
**Recommendation:** Option 1; spec text lands in the Wave-2 reconciliation pass.
**Files affected:** `AldineXXI-specification.md` Prologue *Postures*; consequential: vignette spec Part II (PENDING-31), §VII.f implementation note (CSS scroll-driven), removal of the residual script (roadmap W3.4).
**Awaiting:** Jurist review (framework extension per §XIV category 2; steward direction already given).

**Status (2026-06-07):** JURIST CONCURRED (Option 1) with one required amendment + one specification, both folded into the spec text as landed: condition 1 gains the demonstration requirement (*"demonstrated in the implementation record that the specific behavior cannot be achieved by HTML, CSS, or build-time generation"* — auditable artifact, not internal judgment); "observes nothing" specified (no reader behavior observed, no data collected, no side-effects beyond the reader's own initiated choice — localStorage-of-reader-preference passes, beacons do not). §III.b font-size control recorded as the held exception that keeps the gate honest. Spec text landed in W2.4 (ARC `7d9bad3`). W3.4 residual-script removal proceeds independently. Awaiting steward REVIEWED entry.

## PENDING-31 — Vignette Part II: build-time SVG+CSS renderer
**Date:** 2026-06-07
**Tag:** PROPOSAL
**Summary:** Revise vignette-specification.md Part II Component 3 from the browser renderer (Canvas+SVG, requestAnimationFrame, ~300–400 lines JS) to a build-time renderer: Hakyll reads the genome sidecar and emits inline SVG + CSS per piece. Part I (the lock) is untouched.
**Rationale:** Consequence of PENDING-30. The Wave-0 fidelity table (roadmap, `drafts/road-to-stage-g-2026-06-07.md`) traces every Part-I commitment to a build-time mechanism: geometry/ground-mark as inline SVG; field via SVG filters (feTurbulence grain, gradient density, overlay luminance); breath as CSS keyframes with the generation-fixed phase offset baked as negative animation-delay; mode-awareness as build-computed light-dark() pairs (orientation-preserving by construction — structurally safer than the runtime mapping Part I warns can silently invert); reduced-motion as a CSS media query. Two approximations, both within Part I's own tolerances: field drift refreshes per deploy (≈0.04%/day against a 5–7-year monotonic cycle) and the reduced-motion still frame is the base frame rather than the phase-offset frame (amplitude ≤2%, the spec's own "visually immaterial"). The genome contract, sidecar, steward review, Phase α/ω framing, and the dwell-test gate all carry unchanged; the validate-and-save harness survives as spec'd.
**Options:** (1) Build-time renderer (steward-ruled direction). (2) Keep Component 3 as written and open the PENDING-30 gate for it (defensible — render-time drift is exact — but pays the runtime costs for imperceptible gain).
**Recommendation:** Option 1. Phase-1 prototype proceeds against a hand-written test genome after jurist concurrence; first prototype goes to the jurist per the dwell-test review interface regardless.
**Files affected:** `vignette-specification.md` Part II (Component 3 + build-sequence wording); Part I untouched.
**Awaiting:** Jurist review (Part II was jurist-passed 2026-05-29; this revises that pass).

**Status (2026-06-07):** JURIST CONCURRED (Option 1). Fidelity analysis assessed sound; build-computed `light-dark()` pairs assessed an *improvement* over the runtime mapping (orientation-preserving by construction). One flag discharged before any executor instruction: the **Component-2 scoping note** is in the spec (the ~30-line estimate superseded; the ~300–400 lines of rendering computation migrate as a Haskell function — complexity migrated into the typed build step, not reduced). Architecture diagram drops "browser, runtime" from Component 3. Dwell-test gate unchanged (first prototype to the jurist). Spec revision landed ARC `4b0970b`. Awaiting steward REVIEWED entry.

## PENDING-32 — Frontmatter §2.8: a rendering inherits its work's class
**Date:** 2026-06-07
**Tag:** HARDENING
**Summary:** Codify the convention the corpus already obeys 6-for-6 but nothing governs: a rendering file declares the same `class:` as its work; optionally, the build validates the equality.
**Rationale:** Audit finding J2 (2026-06-07, adversarially verified): all six renderings (Taliesin fr/es; bio/cv fr/es) carry their work's class, but neither frontmatter §2.8 nor content-typology states the rule, and `excludeRenderings` keys on `work:` alone — a future rendering with a divergent class would silently carry wrong apparatus/template bindings. One sentence in §2.8 closes the doctrine; a small build check (rendering's class == work's class, loud on mismatch) closes the enforcement, in the spirit of §5 clause 3.
**Options:** (1) Doctrine sentence + build validation. (2) Doctrine sentence only.
**Recommendation:** Option 1; the check is a few lines beside `renderingSiblings`.
**Files affected:** `frontmatter-specification.md` §2.8; `site.hs` (validation); content-typology cross-reference.
**Awaiting:** Jurist concurrence (amends the PENDING-25/REVIEWED-28 doctrine by extension).

**Status (2026-06-07):** JURIST CONCURRED (Option 1), conditional on §2.8 being self-standing (`work:`/`translator:` defined). **Condition found pre-discharged on verification:** the jurist read a stale copy of the frontmatter spec — the live §2.8 (ARC `e2866da`, 2026-06-05, per PENDING-25/REVIEWED-28) already defines both fields, with the jurist's own scope-boundary language verbatim. No live-state/spec-state gap exists. **To relay to the jurist at next exchange** so the record sheds the stale premise. The inheritance clause landed as a subsidiary convention of the existing §2.8 (ARC `4e89337`); the build check ships with Stage-G enforcement (roadmap W5). Awaiting steward REVIEWED entry.

## PENDING-33 — Essay-versioning: truth-up and promotion from DRAFT
**Date:** 2026-06-07
**Tag:** PROPOSAL
**Summary:** Amend essay-versioning-specification.md to the shipped truth and promote it from "DRAFT · design sketch" to OPERATIVE-for-the-built-scope.
**Rationale:** Audit finding J7: the spec's mechanism is substantially live (full versioning module, /v/ routes with canonical-to-actual-route + noindex, version stamps, feed/sitemap integration) while the document still presents itself as an unbuilt sketch — the corpus's one materially dishonest status line, and Stage G should not read it in that state. The truth-up folds: (a) §4 amended to the shipped stamp shape (inline dated links to each /v/ page; no "Prior versions" index link — audit A4 judged the shipped shape arguably cleaner); (b) the §6 colophon worked-example resolved — either wire the about-page path's version stamp or re-designate the exemplar to the After-the-Reply pieces and rule the orphaned `edition_label: Fourth Edition` disposition; (c) §7 items 6–8 and the §4 retractation half explicitly marked deferred-until-need; (d) `sequence_position` → `sequence_order` (frontmatter §2.2 alignment).
**Options:** (1) Truth-up + promote as above. (2) Truth-up only, status stays DRAFT (understates a live system). (3) Build the missing pieces first (disproportionate; no retractation piece exists).
**Recommendation:** Option 1; (b)'s exemplar choice is a steward call inside the jurist pass.
**Files affected:** `essay-versioning-specification.md`; possibly `site.hs`/`about-page.html` if (b) wires the stamp.
**Awaiting:** Steward authorization + jurist review.

**Status (2026-06-07):** JURIST APPROVED the truth-up (a/c/d concur; on (b) the jurist offered a disposition: re-designate the exemplar to an *After the Reply* essay with live revisions; the `edition_label` orphan must not survive the pass unresolved). **STEWARD AUTHORIZED + ruled (b) same day:** exemplar → *The Ethics of the Reply* (jurist's disposition accepted); `edition_label` **dropped from the §6 example** (field stays available; the colophon's inert carrier recorded honestly). Executed ARC `392d8c8`: spec promoted **OPERATIVE (built scope: §§1–5, §7 items 1–5; deferred: §7 items 6–8, retractation UI, version-index page)**; §4 = shipped stamp shape (verified verbatim in compiled output); `sequence_position` aligned to `sequence_order`. Closes the corpus's one materially dishonest status line. Awaiting steward REVIEWED entry.

## PENDING-34 — W5.2 / G3: single-source class→glyph (the Compass sigils)
**Date:** 2026-06-09
**Tag:** [HARDENING]
**Summary:** Make the class→glyph binding structural (or build-validated) so the Reading Compass sigils cannot silently drift from the typology — ending the "correct by naming convention, not structure" fragility the audit named (G3), the Hakyll north-star's documented fix.
**Rationale:** Audit finding G3 (2026-06-07, content-typology §5 clause 2). The class→mark relationship lives in **three loci** that agree today *only by naming convention*: (1) `data/content-types.yml` `glyph:` — the canonical Unicode mark per class (essay → ●), generated from content-typology §2; (2) the slug-derived sigil-id in `compassRowsHtml` (`site.hs:133` — listing slug `essays` → `#sigil-essays`); (3) the hand-authored SVG `<symbol id="sigil-essays">` sprite in `templates/reading-compass-points.html` (the actual drawn form). The compass rows are already data-driven (Stage-F Phase-2 generator, from `data/listings.yml`), and a listing's class is already build-validated against the enumeration (§5 clause 3). What is **not** enforced: that each compass entry's sigil-id has a matching `<symbol>`, and that the drawn mark agrees with the class's canonical glyph. A renamed slug, a new type, or a re-drawn/mis-named symbol silently desyncs the rendered mark from the typology fact — no build error, wrong glyph ships. The SVG geometry is artwork and stays hand-authored (it cannot be generated from a Unicode codepoint); what is single-sourced is the *mapping* + a *loud build check* ("unknown = build error", the north-star's own phrasing).
**Options:**
1. **Build-validation guard (minimal, output byte-identical).** Add a build check (beside `loadListingDefs`): every compass sigil-id (listings + `compass_specials`) must resolve to a `<symbol id="sigil-…">` present in the sprite, and every class carrying a `glyph:` in content-types.yml must map to exactly one surfaced sigil/symbol (or be explicitly governed-but-unsurfaced) — error, loud, on any mismatch. Keeps the current generation; closes the drift class by structure. No rendered change.
2. **Derive sigil-id from class + the guard (fuller north-star form).** Replace the slug-coincidence with an explicit class→sigil mapping consulted by `compassRowsHtml` (so the binding is structural, not conventional), plus Option-1's check. Slightly more refactor; output identical only if derived ids equal today's slugs (they do, by the current convention).
3. Status quo — documented drift risk; rejected by the audit's promotion gate.
**Recommendation:** **Option 1.** It closes the exact failure class (silent glyph drift) with minimal change, byte-identical output, and is precisely the "unknown = build error" the Hakyll north-star and §5 clause 3 call for. Option 2's derive-from-class is the purer single-source but the slug↔class↔sigil naming is already 1:1; making it structural earns its place only if that convention later strains — a clean follow-on, not required now (proportionality). The SVG sprite stays hand-authored either way. Steward to rule between 1 and 2.
**Files affected:** `site.hs` (new build-validation in/near `loadListingDefs`; Option 2 also touches `compassRowsHtml`); `templates/reading-compass-points.html` (read for the symbol-id census; not edited); `data/content-types.yml` + `data/listings.yml` (read, not edited); content-typology §5 cross-reference (records the enforcement; ships with the Stage-G promotion per the spec's own sequencing). Verification: byte-identical compiled-output gate (Option 1) + a deliberate-mismatch test proving the check fires.w
**Awaiting:** Steward authorization (choose Option 1 or 2).
**Status (2026-06-09):** STEWARD AUTHORIZED inline (chat, Option 1). Built `4936fc9`: `validateCompass` binds class→glyph→sigil structurally; `_site` byte-identical (570 files); both checks fire on deliberate mismatch. REVIEWED-36 placed by steward. DONE.

## PENDING-35 — W5.1 / G2: single-source title display (retire the `showTitleField` hardcode) + Dream amendment
**Date:** 2026-06-09
**Tag:** [HARDENING]
**Summary:** Retire the 11-class hardcoded `titleClasses` list in `showTitleField` (`site.hs:1829`), binding the title-shown decision structurally to `content-types.yml` `title_display` (the matrix's executable shadow) so it cannot drift by hand — the durable form the stopgap's own comment names (G2). **Coupled steward amendment:** Dream moves `title_display: shown → not-shown` (steward editorial ruling, 2026-06-09).
**Rationale:** Audit finding G2. `showTitleField` returns `"true"` for a class iff it is in a hand-maintained 11-element list whose own comment (2026-05-30) admits: *"Durable form is a table lookup (Hakyll audit §4A); until then this list must track the matrix `shown` set."* Diagnosis confirmed the list = the 10 matrix-`shown` classes + `chamber`. **`chamber` is a dead entry** — zero corpus pages carry `class: chamber` (the v1-legacy `content/chamber/**` pages carry real classes: essay/meditation/about/offering/deliberation/lex), so retiring the hardcode in favour of `title_display == "shown"` is **byte-identical** (the one definitional divergence — hardcode shows chamber, YAML marks it `n/a` — has no rendered instance). The census also surfaced classes *outside* the 14-type enumeration (`offering`, `deliberation`, `lex`, `sequence-index`, `not-found`); the replacement lookup is **permissive** (absent → not-shown), matching prior behaviour, and must NOT error on absence (unlike `validateCompass` on unknown listing classes), since `showTitle` runs over every routed item.
**Options:**
1. **Thread the shown-set as a typed parameter (recommended).** Extend the existing `content-types.yml` parser (`TypeFacts`) to capture `title_vignette.title_display`; add `loadTitleShownClasses :: IO [String]` (reuses the decode machinery beside `loadListingDefs`); load once in `main` via `preprocess`; make `showTitleField :: [String] -> Context String` and `postCtx :: [String] -> Context String`, passing the set at the ~10 `postCtx` call sites. Compile-time enforcement → the binding cannot be forgotten (the type forces it). One file read at build start; no per-item re-read.
2. **`loadBody` a tracked data item** (the `_build_info` pattern): localizes the dependency inside `showTitleField`, no call-site ripple, runtime (not compile-time) binding. Adds a parallel data path + Item-body typing.
3. Status quo — hand-synced list; rejected by the promotion gate (G2).
**Recommendation:** **Option 1.** Compile-time binding is the stronger single-source guarantee and the truest to G2's intent (drift made *impossible*, not merely *checked*); it reuses the one `content-types.yml` decode rather than adding a second reader. The call-site ripple is mechanical and contained to `main`.
**Dream amendment (coupled, steward-ruled):** `content-typology-specification.md §2` Sub-table 2 line 746: Dream `title_display` `shown → not-shown` (vignette_eligibility unchanged: `no`). Human-canonical matrix edit → `make content-types` regenerates the YAML shadow → `make content-types-check` confirms no drift. This is a steward editorial decision on the steward's own canonical document; it rides into the Stage-G jurist read (the jurist sees Dream=not-shown with this rationale and may raise it — the loop stays intact). Rendered effect: the single `class: dream` page loses its `<h1>` title heading (the one classified delta).
**Verification (two-hat separation):** Commit 1 = the refactor alone (YAML still says dream=shown) → `_site` **byte-identical** vs pre-change baseline (proves the refactor is pure; chamber's 0 instances make the set-difference invisible). Commit 2 = the Dream amendment (spec §2 + regen) → `_site` delta = **only** the dream page's `<h1>` removed, nothing else (expected-delta gate). Plus a liveness check: temporarily flip a class's `title_display` and confirm the rendered title tracks it (proves the binding is live, not vestigial).
**Files affected:** `site.hs` (`TypeFacts`/parser, new `loadTitleShownClasses`, `showTitleField` + `postCtx` signatures + ~10 call sites, `main` load); `docs/AldineXXI-Codex/content-typology-specification.md` §2 Sub-table 2 (Dream row — human-canonical); `data/content-types.yml` (regenerated, not hand-edited); content-typology §5 cross-reference ships with the Stage-G promotion (W6). 
**Awaiting:** Steward AUTHORIZED inline (refactor + Dream amendment). Render-review PASSED ("yes, unquestionably — one can't title their dreams").
**Status (2026-06-09):** DONE + DEPLOYED + LIVE. Two-hat: `4ea261a` (refactor, `_site` byte-identical to baseline) + `ac39b26` (Dream amendment, delta = the single dream page's `<h1>` removed). `make rebuild` shipped (CloudFlare uploaded 2 files — the dream page + `_redirects`); pushed both remotes (`f8e00e7`→`ac39b26`); live-verified on animalrationiscapax.org (h1.post-title=0, `<title>`+breadcrumb preserved). REVIEWED-37 drafted for steward placement. Remaining Wave 5: W5.3 (G4 clause-1 gate), W5.4 (G1 wildcard→build-error, lands in the Stage-G promotion commit).

## PENDING-36 — W5.3 / G4 (clause-1 enforcement gate) + W5.4 / G1 (wildcard fallbacks → build errors)
**Date:** 2026-06-09
**Tag:** [HARDENING]
**Summary:** Close the last two Wave-5 enforcement items. **G4 (W5.3):** a build-time census asserting every authored content file's `class:` is in the content-typology §1 enumeration (clause 1), erroring loudly otherwise — which also guards `default.html`'s unguarded `class="$class$-page"` body emission. **G1 (W5.4):** convert the two `classRouteName`/`classDisplayName` wildcard fallbacks (`other -> other ++ "s"`) into build errors (clause 3/4: unknown = build error, not fallback) — patch prepared now, **lands inside the Stage-G promotion commit** per the spec's own sequencing (clause 4 becomes OPERATIVE at promotion).
**Rationale:** §5 clause 1 ("every authored content file declares exactly one `class:` from §1") and clause 4 ("`site.hs` routing may not fall back to `class: essay`; all pages explicitly typed") are the corpus's two unenforced contract clauses (gap-map G4, G1). Today they hold by convention. Diagnosis (per-directory class census): **content/posts/** — the authored corpus that reaches `classRouteName`/`classDisplayName` via `postCtx` — carries only §1-enumerated classes (dream/essay/fragment/glimpse/gloss/heteronym/hommage/meditation/observation/readings/reverie), so the G1 wildcard is **never triggered** → converting it to `error` is byte-identical. The non-enumeration classes live **outside** the authored corpus: `sequence-index` (content/essays/after-the-reply/index.md — a sequence-index view), `not-found` (content/404.md), and `lex`/`offering`/`deliberation` (the content/chamber/** v1-legacy cluster — known-deferred, not drift, per `project-arc-chamber-v1-legacy-cluster.md`). A naïve clause-1 census would break the build on these legitimate pages; the gate therefore validates against **enumeration ∪ an explicit exempt-set**.
**The one decision (steward's): the exempt-set.** It blesses the non-typology classes the corpus legitimately carries. Proposed: `{ sequence-index, not-found, lex, offering, deliberation }` — each commented by reason (infra view · 404 · v1-legacy chamber ×3, deferred per tracker). It is a **self-tightening ratchet**: when the v1-legacy chamber cluster is finally migrated (the deferred to-do), those three entries are removed and the gate tightens automatically; a brand-new unblessed class anywhere → loud build error. Alternative (path-based: exempt `content/chamber/**` wholesale + infra) is coarser — it wouldn't catch a typo'd class inside the legacy tree (which is frozen anyway). Recommend the class-based set: precise everywhere, every blessing visible.
**Options (gate location):**
1. **site.hs build guard (recommended)** — a `preprocess` census beside `validateCompass`/`loadListingDefs`: glob `content/**/*.md`, read each frontmatter `class:`, assert ∈ (`class_enumeration` from content-types.yml ∪ exempt-set), `error` listing any violator. Fails the actual `make rebuild` that ships the site. Consistent with W5.2/W5.1's home. Output-neutral → byte-identical.
2. **content-types-check (Python)** — extend `generate-content-types.py --check` with the corpus census. Cleaner to write, enumeration already derived there — **but** the pre-commit hook is generic (secrets/debug/large-files only) and does *not* run it, and ARC has no CI server, so it would gate nothing automatically. Weaker.
**Recommendation:** **Option 1** for G4 (the build is the real gate; a check nobody runs isn't enforcement). G1's wildcards→`error`: prepare now (byte-identical), **land at W6** inside the promotion commit per the roadmap's precondition list (W5.1–5.3 ✓ *before* Stage G; G1 lands *with* it). G4 lands now (it is a Stage-G precondition, output-neutral).
**Verification:** byte-identical `_site` gate (both are guards/never-triggered fallbacks — no rendered change); deliberate-mismatch test for G4 (inject a bogus `class:` on a scratch file → build errors with the file named; remove → green), mirroring the W5.2 idiom.
**Files affected:** `site.hs` (new census guard in/near `loadListingDefs`; G1 = `classRouteName`/`classDisplayName` `other ->` arms → `error`, staged for W6); `templates/default.html` (read for the body-class emission; guarded transitively by the census — no edit unless steward wants an inline note); content-typology §5 cross-reference + clause-1/clause-4 promotion text ship with the Stage-G commit (W6). `data/content-types.yml` read (enumeration), not edited.
**Awaiting:** Steward authorization — chiefly to ratify the **exempt-set** `{sequence-index, not-found, lex, offering, deliberation}` and confirm Option 1 (build guard). On the nod: build G4 now (byte-identical), prepare G1 for W6.
**Status (2026-06-09):** STEWARD AUTHORIZED inline (exempt-set confirmed; Option 1). Steward refinement folded: **`sequence-index` reframed as a permanent generated-view class, NOT legacy** — after-the-reply is the only sequence today but more are coming; the exempt-set comments split into two kinds (permanent views/infra: sequence-index, not-found · v1-legacy ratchet: lex, offering, deliberation). **G4 DONE** (`23db039`, pushed both remotes): `validateCorpusClasses` build guard; `_site` byte-identical to `ac39b26` (stash-rebuild diff); deliberate-mismatch fires naming the file; output-neutral → no deploy. **G1 PREPARED** (`9699088` roadmap W5.4) — exact wildcard→error patch recorded, **lands inside the Stage-G promotion commit (W6)** per spec sequencing; byte-identical (never-triggered today). REVIEWED-38 drafted for steward placement. **Wave 5 CLOSED (G2/G3/G4 built; G1 staged).** Remaining to Stage G: W4.4 (jurist multilingual v1.0 sign-off) → Wave 6 promotion.

## PENDING-37 — Reading measure → 66 characters (rem), fixing the px/rem root-size bug
**Date:** 2026-06-09
**Tag:** [HARDENING] (deep typographic audit follow-on; jurist disposition #1; steward-authorized inline as a *starting point* for render review)
**Summary:** Set the reading measure to a precise **66 characters** (Bringhurst ideal), expressed in **rem** so the character count holds constant across breakpoints, replacing the two divergent, over-wide px/rem-confused measures.
**Rationale:** The audit measured (font-metric over 91,579 chars of real ARC prose) + render-confirmed (headless Chrome): EB Garamond prose averages **0.377–0.381 em/char**, so the live columns run **~90 characters** (`$narrow-size: 720px`) and **~101 characters** (`$body-column: 38rem` at the 21px root) — both well past Bringhurst's 75–80 "too long" ceiling. Root cause: `$body-column: 38rem` was authored to "38rem ≈ 65 chars" at the **16px** base, but the live `:root` scales to **21px** (137.5/125/131.25% per breakpoint), silently inflating 38rem to 798px (~101 ch). `$narrow-size` is px (720) so its char-count drifts across breakpoints. Two tokens, two confusions, both off-spec — the spec itself says 38rem/"65 characters" (`:165`) but `$narrow-size` comments "68 characters" while rendering ~90.
**Change (provisional — for the steward's eye):** `$narrow-size: 720px → 24.9rem` (`_variables.scss:119`) and `$body-column: 38rem → 24.9rem` (`_sidenotes.scss:33`); 24.9rem = 66 × 0.3771em (measured). Both become the same rem value (they are the same concept — "the reading measure"; a follow-on pass should unify them to one token). NOT a byte-identical change — the reading column intentionally narrows (720px → ~523px @ desktop, a ~27% narrowing; the marginalia-grid body narrows 38→24.9rem).
**Decisions deferred to the render review (steward's "we look, then decide"):** (a) final character target within the Bringhurst band 66–75 (24.9–28.3rem); (b) the **marginalia-grid proportions** — narrowing the body to 24.9rem makes the fixed 14rem sidenote column proportionally much larger (14/24.9 = 56% vs 14/38 = 37%); the sidenote/marker columns may need adjusting, to be judged on the about pages + sidenote/register essays; (c) **spec reconciliation** (AldineXXI §I measure prose: 38rem/65-char → the chosen rem/66) lands after the visual decision; (d) deploy. No deploy in this step — local build + serve only.
**Files affected (this step):** `scss/AldineXXI/_variables.scss` (`$narrow-size`), `scss/AldineXXI/_sidenotes.scss` (`$body-column`). Spec text + token unification deferred.
**Awaiting:** Steward AUTHORIZED inline (66 ch, starting point). Render review of about pages + marginalia essays → then the deferred decisions above.
**Status (2026-06-09):** LOCKED at **72 characters** (`27.2rem`) — steward render-ruling across all content types (66 a touch narrow, 75 a touch wide; 72 "spot on," sidenote/marginalia proportion approved). **Resize bug found + fixed** (the `.page-content` mobile `100vw` override defeated the rem measure <768px — "measure gets longer on resize"; removed). **Proper-homes consolidation** (steward-directed, W3R discipline): one token `$narrow-size` (`$body-column` aliases it), one governing rule (`.page-content`/_base, all viewports), zero measure rules left in `_mobile-responsive` (override removed + a dead `.wrapper main` block deleted). Spec §I Measure reconciled to the measured value + 65/68 inconsistency resolved; §XII grid + token-index updated. Verified: compiles · measure holds across a viewport sweep · no overflow. Committed `06effe4` (behaviour commit; gate = steward render-review, passed). **DEPLOYED + LIVE 2026-06-09** (bundled with the soft-rag pass `a9e5196`): pushed both remotes, `make rebuild` shipped (CloudFlare 2 files = style.css + _redirects — pure CSS, no HTML change), live-verified on animalrationiscapax.org (`max-width:27.2rem` ×9, no 720px). REVIEWED-39 to be drafted. (Deferred token-unification: $body-column now aliases $narrow-size; full removal of the local name is optional tidy, not required.)

## PENDING-38 — Soft rag: hyphenate reading prose (reverses §I.i hyphens:none)
**Date:** 2026-06-09
**Tag:** [HARDENING] (deep typographic audit follow-on; steward-approved inline on render; jurist endorsed `hyphens: auto` as the no-JS "rung (i)" in their audit reading)
**Summary:** Reverse the §I.i posture from *ragged-right, un-hyphenated* (`hyphens: none`) to a **soft rag** — ragged-right with judicious auto-hyphenation of reading prose.
**Rationale:** The prior `hyphens: none` was a **tool-quality** decision (web justification/hyphenation judged poor when ARC was built), not philosophical. The deep typographic audit + masters reopened it: Hochuli ranks the soft rag (ragged + narrow hyphenation zone) **above** the hard rag (the hard rag "looks uneven and unsettled"); Rutter — "hyphenate without justifying… reduces the raggedness"; the engine is the universal Liang/`hyph-utf8` patterns, language-correct via the document `<html lang>`. With the measure now properly set (72 ch, PENDING-37 — the old ~90-char measure was itself a reason hyphenation seemed unneeded), the soft rag reads better than the hard rag. Stays **ragged** (does NOT justify — justification on large viewports remains open, needs the JS Knuth–Plass "educated engine," off the table until a logged gate amendment).
**Implementation (proper home — _base, the reading-body home, every viewport):** `.page-content p/li/blockquote { -webkit-hyphens:auto; hyphens:auto; hyphenate-limit-chars:6 3 3; -webkit-hyphenate-limit-before/-after:3; hyphenate-limit-lines:2; -webkit-hyphenate-limit-lines:2 }`; body default → `hyphens: manual`. **The `-webkit-hyphens` prefix was the bug** that made Safari show nothing first (no autoprefixer in the build → prefixes hand-written; the limits were prefixed but the property wasn't). Cross-browser: `hyphens:auto` is Baseline (all engines); limits via standard (Chrome/Edge) + `-webkit-` (Safari); Firefox honours auto, ignores limits (sane defaults) — not Safari-tailored.
**Verification:** steward render-review on desktop AND phone ("few, but perfect"); the phone "none" was iOS-Safari **cache** (fresh-origin test confirmed; no mobile override exists — rule is viewport-agnostic). Live-verified post-deploy.
**Files affected:** `scss/AldineXXI/_base.scss` (the soft-rag rule + body `hyphens: manual`); `scss/AldineXXI/_mobile-responsive.scss` (stale per-phone hyphens comment corrected); `docs/AldineXXI-Codex/AldineXXI-specification.md` §I.i (posture reconciled).
**Awaiting:** Steward APPROVED inline (deploy now). **DONE + DEPLOYED + LIVE** `a9e5196`. **§I.i posture reversal rides the Stage-G read for formal jurist concurrence** (substance already jurist-endorsed). REVIEWED-40 to be drafted.

## PENDING-39 — §VII.f Running Head + W1.15 frontispiece compass presence-reveal (BUILT)
**Date:** 2026-06-11
**Tag:** [HARDENING]
**Summary:** Built the one spec'd-but-unbuilt apparatus, §VII.f Running Head (the post-Stage-G session the spec reserved for it, W1.2), plus its coupled item W1.15 (frontispiece compass reveal) — both zero-JS, both local, awaiting deploy.
**Rationale:** §VII.f was the lone element of the AldineXXI spec never shipped (verified against live code: no `_running-head.scss`, no template element, zero compiled output). W1.2 ruled it to build via CSS scroll-driven animations after the reconciliation/`[FIX]` waves — now closed/sealed. Running head: a `view-timeline` on `.post-title`, hoisted via `timeline-scope`, opacity across the `exit` range; per-type bound to `content-types.yml` `apparatus.running_head` (`loadRunningHeadClasses`/`showRunningHeadField`; `yes` auto, `conditional`/`per` per-piece). §III.b browser-floor answered as pure progressive enhancement (no scroll-driven support → `display:none`; no JS, no always-on chrome — steward ruling). Steward render-rulings refined: measure-width band on the **body-column axis** (matching the breadcrumb/sequence-marker; centred symmetric, −2rem grid-asymmetry shift for marginalia); a **soft rule** (measure-wide, fading ends, `$rh-fade`); a **full-width occluding ground** (vertical fade extending `$rh-dissolve` below the rule, so the reading dissolves as it approaches the rule across the whole width).
**W1.15 reframe (steward-ruled):** the "appear only on scroll" premise was false — the frontispiece is single-viewport (`min-height:100vh`/`space-between`) and does not scroll. Surfaced, not papered over; steward reframed scroll-reveal → **presence-reveal**: zero-JS cursor-approach (graded sibling-combinator bands), touch rests gently-present (accepted zero-JS limit). §2044 reconciled.
**Refactor (byte-identical):** marginalia grid tokens (`$body-column`/`$gap-column`/`$sidenote-column`/`$register-marker-column`/`$marginalia-present`) moved `_sidenotes.scss` → `_variables.scss` (two consumers now; grid output proven IDENTICAL pre/post).
**Verification:** `stack build` clean; headless-Chrome measured the reveal (opacity 0→1 at title exit), the compass graded reveal (0.15→0.4/0.6/0.8, compass clickable), and band-axis alignment (band centre == breadcrumb centre 598@1280 / 798@1680). Invariant verified: `running_head ∈ {yes,conditional,per} ⊆ title_display: shown`.
**Files affected:** `scss/AldineXXI/_running-head.scss` (new), `scss/AldineXXI/_frontispiece.scss` (compass approach-reveal), `scss/AldineXXI/_variables.scss` + `_sidenotes.scss` (token move), `scss/main.scss` (`@use`), `templates/post.html` + `templates/frontispiece.html`, `site.hs` (`TypeFacts`/`ApparatusFacts`, `loadRunningHeadClasses`, `showRunningHeadField`, `postCtx` threading). Specs reconciled: `apparatus-specification.md` §VII.f, `AldineXXI-specification.md` §2044 + selector index, `content-typology-specification.md` Sub-table-4 note.
**Awaiting:** Steward authorized inline throughout (render-review-gated, every step). Remaining: deploy (running head + compass reveal together) on steward's go-ahead. → REVIEWED-43.

## PENDING-40 — ARC operations protocol (`operations.yaml`) — a governed how-to-proceed router for the executor
**Date:** 2026-06-18
**Tag:** PROPOSAL
**Summary:** Establish a single, drift-proof operations protocol Claude Code consults *before* any ARC change — a triage gate + protected-surfaces stop-list + routine-change procedures — so routine work proceeds safely and any change reaching into the refined ARC structure (the spec, the Stage-G site.hs bindings, the @layer cascade) is *surfaced before it is built*, not undone after.
**Rationale:** Steward-initiated, with a live case study. On 2026-06-18 a routine-looking task ("drop the CV's redundant page title") was treated as content-grade and built out as a structural change to a Stage-G-clarified `site.hs` binding (the title-display gate) — coupling `articleCtx`, pulling `about-page.html` into the matrix gate, rewriting the G2 intent comment — before being surfaced. The steward caught it ("does this muddy the waters we finally clarified?") and ruled full revert. The weeks of Stage-G refinement (G1–G4 single-source bindings, W3R cascade, the sealed Codex) are exactly what an in-stride structural edit endangers. The same session surfaced a second symptom of the gap: the 06-17 cul-de-lampe commits missed the Stage-E `content-types.yml` regen (14 stale values), because no checkpoint enforced it. A protocol with (a) a front triage gate, (b) an explicit protected-surfaces stop-list → PENDING, and (c) codified routine procedures that name the easy-to-miss steps (the content-types regen, the SCSS partial trap, the shared-template all-consumers check) closes both. Modeled on the now-codified chamber-library `conversion-runbook.yaml`.
**Design commitments (so it does not itself become a liability):**
- **Router, not rulebook.** It states *how to proceed* + *which spec § governs*; it never restates a rule. The spec stays the single source for *what*. On any apparent conflict, the spec wins and the router is fixed. (Prevents it becoming a second, drifting source — the very failure mode ARC guards.)
- **Coupled-update (Stage-E generalized).** When a change-type's governing spec § moves, its router entry updates in the same commit.
- **Non-decorative binding.** Useless unless actually read at the moment of action: kept short by design; proposed to be wired as the mandatory first read via ARC `CLAUDE.md` (and surfaced at wake). Pairs with — does not replace — the `~/CLAUDE.md` authorization taxonomy.
**Options:**
1. **`docs/AldineXXI-Codex/operations.yaml`** (steward-chosen) — beside the spec it operationalizes, versioned with it. *(Draft written, status DRAFT.)*
2. `ops/arc-operations.yaml` at repo root — more visible as a top-level operational artifact.
3. Fold into ARC `CLAUDE.md` — simplest, but couples to the orientation doc and is harder to keep machine-checkable.
**Recommendation:** Option 1 (steward-selected). Keep ARC-scoped for now (it serves the AldineXXI spec); it may become a template for L1/be later if it proves itself — do not generalize prematurely.
**Files affected:** `docs/AldineXXI-Codex/operations.yaml` (new, DRAFT); on authorization, a one-line pointer added to ARC `CLAUDE.md` ("consult first") and a note at `/wake-up` for ARC sessions.
**Awaiting:** REVIEWED-44 placement by the steward. **Steward authorized verbally 2026-06-18** (away from machine; could not author the REVIEWED text). On that authorization: `operations.yaml` flipped to OPERATIVE; ARC `CLAUDE.md` pointer added; committed + pushed + deployed. REVIEWED-44 to be written by the steward to close the loop on paper.

## PENDING-41 — [CORRECTED/LARGELY-WITHDRAWN] Consumer-hardware support is ALREADY designed (43L/43M); residual = verify on M1-Air-class + clasp
**Date:** 2026-06-23 (revised same day after reading the spec, per steward pointer)
**Tag:** [HARDENING] (downgraded from PROPOSAL — the proposal was largely reinventing existing design)
**Self-correction (integrity):** My original PENDING-41 proposed "make consumer hardware a first-class target with graceful generative degradation" as if novel. **It is not — Seb already designed it.** `local-inference-spec` Amendment **43L (Hardware-Graduated profiles: lightweight/standard/full/appliance)** + **43M (Tiered Circle Inference, `'circle'` provider tier §4.13)**: low-tier nodes run tiny local models (qwen3.5:0.8b/2b) and **rely on circle inference** for frontier work; a **clasp** serves big-model inference to members (`CLASP_BASE_MODELS`); FM-009 GPU-degraded circuit breaker already specced. Do NOT send the original proposal to Seb — naive + redundant.
**What today's saturation actually was (corrected):** the live Air runs **standalone** — unpaired (no circle/clasp; `isClasp=false`), no teacher transport (Anthropic disabled; fleet `kronos`/`atlas` 502), attempting frontier generative locally on one GPU. The design's offload answer (frontier → circle/clasp/teacher) simply isn't active. **Deployment/config state, not a design gap.**
**Genuine residual (verify-first, do NOT assert to Seb yet):**
1. Spec reference target = **M4 Pro / 24GB+**; steward's machine = **M1 Air / 16GB**, below it. Does `standard`/`lightweight` profile + tiered-circle-inference actually run well on M1-Air-class? Unverified.
2. **FM-009 GPU-degraded guard did not prevent 64 timeouts** on the entity:relationship slot path live — is the guard active on slot inference, or another path? (Or binary predates it.) Verify before raising.
3. Model-resolution oddity: boot resolved `tier=standard → qwen2.5:3b` (absent); actual calls hit `qwen3.5:4b`.
**Design-aligned move:** the 64GB mini = **appliance** = a natural **clasp**. Pair the Air into a circle with the mini as clasp → Air runs light, mini serves frontier inference. Seb's architecture for exactly the steward's two-machine setup. **Verify on a clone first**, not the live Air.
**Awaiting:** nothing to send Seb yet. Next step is VERIFICATION (does the existing tiered/clasp path work on M1-Air-class), not a proposal. Findings: `docs/thinking/David/l1-reliability/l1-post-n6-deploy-findings-2026-06-23.md`.

## PENDING-42 — Chamber Library spec ratified (§§I–VI); open voice-layer work
**Date:** 2026-06-26
**Tag:** [PROPOSAL] (the open items); the ratification itself was authorized live and is recorded here for the paper loop
**Summary:** The Chamber Library spec (`chamber-library/docs/chamber-library-specification.md`, born 2026-06-25) was carried through the full steward + jurist loop in conversation and ratified §§I–VI; the spec file is now edited to the ratified text. This entry records what was authorized and holds the remaining open work.
**Ratified (applied to the spec 2026-06-26):**
- **§§II–III** — source-agnostic canonical form + the `work + chapter/section + verbatim quote` citation contract, **plus** the jurist's sectionless reduction (a sectionless work cites by `work + verbatim quote`; a missing section field is correct, not a defect).
- **§V** — the verbatim guarantee, three-tier normalization (Remove / catalogued-normalization / never-alter-words). Resolves the spec's prior internal contradiction: **"verbatim" = faithful to the words under *declared* normalization, NOT byte-identity** (§II already permits transforms). Executor refinement folded: **minimize the catalogue** — prefer preserving source characters; typographic normalization permitted only on concrete need, never prophylactically (tighten-the-verifier, Charter §VII).
- **§VI architecture** — two sidecars: reading-index (derived, hash-bound) + voice manifest (authored, engine-side, no hash); `voice: <name>` stays in corpus as a routing tag; **the sole corpus-spec invariant: the grounding gate verifies only against canonical text, never a manifest/index.** Grounded in existing practice (4 `reading-indices/*.yaml` already embody the pattern).
- **§X** — antechamber clause (sub-canonical form not guaranteed; consumers must flag distinctly). §VII gate logic found already conformant (no edit).
**Rationale:** A corpus the engine cites from confidently must have a specified, consistent form, or the engine reasons over silently-varying ground (Charter §V boundedness=trust; the L1 maxim). The ratification unblocks the held graduation of the first three spec-conformant texts.
**Open work (awaiting future authorization — NOT done):**
1. **Voice-manifest schema** — controlled vocab, authorship governance, engine consumption model. **Engine-governance**, not corpus-spec; lives with the studium-engine charter. Orchestration thinking captured at `studium-engine/docs/the-sidecar-typology-and-orchestration-2026-06-26.md`.
2. **The 84-file voice migration** — move `voice_role`/`semantic_profile` from canonical frontmatter to the manifest. A governed, **dry-run-first** bulk op; not a prerequisite to the principle.
3. **`voice_tradition`/`voice_period` usage audit** — decide per-field migration target (work's compositional context → §IV provenance; persona flavor → voice manifest). Owed before the migration.
4. **§IX** coverage/silence representation — still open.
**Recommendation:** Build the two normalizers (OCR + EPUB → one canonical form) next, apply to Levi / Alexander Book 4 / *La Chute*, commit the first spec-conformant graduation. The open voice-layer items are deferred and do not gate graduation (the graduates need conform only to §§II–V + the citation contract, not the undesigned manifest schema).
**Files affected:** `chamber-library/docs/chamber-library-specification.md` (ratified text applied); `studium-engine/docs/the-sidecar-typology-and-orchestration-2026-06-26.md` (new, exploration).
**Awaiting:** Steward to write **REVIEWED-45** to close the loop on paper (the authorization was given live in conversation; like REVIEWED-44 for operations.yaml, the paper record is owed).

## PENDING-43 — [ESCALATE] Spec Loom & Mill "two-register genome" model would reshape our governance surfaces
**Date:** 2026-06-30
**Tag:** [ESCALATE]
**Summary:** Seb's instance's Loom/Mill methodology proposes a two-layer split — an append-only provenance archive vs. a lean *expressed* genome sized to the human's mental-model budget. We already run an instance of this (MemPalace ↔ MEMORY.md). Adopting it as a *governance* model would reshape PENDING/REVIEWED/MEMORY.md and potentially CLAUDE.md — a constitutional surface, and now a four-party question (David, Claude Code, Seb, Seb's instance).
**Rationale:** Two halves of one team independently re-derived one governance system (full map: `CapableMind-AI/docs/thinking/David/methodology/spec-loom-mill-reconciliation_2026-06-30.md`). The convergence is high-value, but the two-register adoption touches surfaces the executor may not alter unilaterally. Do not act; surface for steward + jurist + Seb.
**Adjacent (lighter, [PROPOSAL]-class):** a shared vocabulary map between the two pods (their genome/ratchet/compass/diseases/palette ↔ our taxonomy/ladder/Symmetria-flags/register) — cheap, high-value, recommended early; co-author from the governance field guide.
**Files affected:** none yet (mapped, not acted on). On authorization, would touch the governance surfaces above.
**Awaiting:** Steward + jurist + Seb. Do not proceed.

## PENDING-44 — Machine-readable graduation spec + validator (the enforced convention rail for the Chamber Library)
**⟶ CLOSED 2026-07-05 — REVIEWED-44 placed by steward (formal close).**
**Date:** 2026-07-01
**Tag:** [HARDENING]
**Summary:** Codify the Chamber Library graduation CONVENTIONS as machine-readable data (`chamber-library/_curation/graduation-spec.yaml`) consumed by every graduation, and enforce them with a validator (`scripts/verify_graduation.py`) that gates each candidate — conventions checked at the moment of action, not narrated in prose that drifts or gets bypassed.
**Rationale:** Steward-initiated, with a live case study. Graduating Jonas + the two Mumford volumes, three parallel agents were given hand-written instructions (my error — I re-derived instead of citing `conversion-runbook.yaml`, and invented frontmatter fields `tradition_path`/`source_sha256` that are not the convention; `source_sha256` in fact belongs to the reading-index SIDECAR, spec §VI, not text frontmatter). The agents diverged (ALL-CAPS vs title-case headings, `--no-heading-recovery` yes/no, blank-comment handling) — and the divergences mapped exactly onto the runbook's GAPS. The steward's insight: "shouldn't there be a machine-readable version referred to whenever we do this work?" The spec+validator is that rail: conventions as data + an enforced gate. Proven — the validator caught every divergence on all three candidates automatically; they were then re-fixed against the spec and graduated clean (both gates PASS, verbatim intact, OCR corrections logged).
**Design commitments:** operationalizes the chamber spec §§II–VI (which governs on conflict); scope-disciplined per PENDING-42 §VI (encode what we know; grow as protocols declare themselves); the runbook now POINTS to the spec (`policy.graduation_conventions`) rather than restating it.
**Files affected:** `chamber-library/_curation/graduation-spec.yaml` (new, governed), `scripts/verify_graduation.py` (new), `_curation/conversion-runbook.yaml` (pointer added), and the 3 graduated texts + their `_curation/conversions/*.conversion.yaml` provenance records.
**Awaiting:** REVIEWED-46 placement by the steward. **Steward authorized verbally 2026-07-01** ("yes to pending/reviewed"); spec promoted drafts→governed and applied. REVIEWED text owed to close the loop on paper (as with REVIEWED-44/45).

## PENDING-45 — Family-D (stem-suffix) footnote handler added to clean_epub_residue.py
**⟶ CLOSED 2026-07-05 — REVIEWED-45 placed by steward (formal close).**
**Date:** 2026-07-02
**Tag:** [HARDENING]
**Summary:** Extended the graduation-rail's footnote converter with a 4th anchor family (stem-suffix: ref `[¹](#…_{stem})` ↔ def `[N.](#…_{stem}a)`, keyed by the globally-unique stem), unblocking the recovery of per-chapter endnote apparatus in z-library/Kindle-derived EPUBs. First use: reconverting Sennett *The Craftsman* (recovered 294 endnotes the prior calibre conversion had silently unlinked).
**Rationale:** Footnote apparatus is the Making-batch's binding constraint — the tool covered 3 of ≥5 anchor families in actual corpus use. `clean_pandoc_html_residue`'s `INTERNAL_LINK` unwrap silently DESTROYS any footnote-link it doesn't recognize (word-guard excludes fn labels), so an uncovered family = silent linkage loss (the exact defect being repaired). Extends the PENDING-44 rail; conventions unchanged.
**Verified:** Sennett 294↔294 paired, 0 orphans, both gates PASS, prose verbatim-preserved. Regression-tested Families B (Winnicott) + C (Virilio) — caught + fixed a real regression (C's `r`-prefixed def targets read as phantom D-refs; fixed in verify_pairing). Reviewed in `_curation/tool-evolution-log.md`.
**Out of scope:** Crawford's `filepos` positional family (ref/def don't share a stem) — a different pairing model, still owed; documented in the tool docstring.
**Files affected:** `scripts/clean_epub_residue.py` (Family D); `canonical_texts/…/environmental/the-craftsman-sennett-richard.md` (Sennett reconverted + spec-normalized headings); `catalogue.yaml`; `_curation/tool-evolution-log.md`.
**Awaiting:** steward acknowledgement (a tool addition within the authorized "build the tool the batch needs" discipline; recorded for the paper loop alongside PENDING-44).

## PENDING-46 — Spec gaps surfaced by the corpus-fidelity work + the generative-from-spec principle
**⟶ CLOSED 2026-07-05 — REVIEWED-46 placed by steward (formal close).**
**Date:** 2026-07-03
**Tag:** [PROPOSAL] (gaps 1–6) + [ESCALATE] (gap 7, generative principle as governance)
**Summary:** Two days of corpus-map + tool-fleet work surfaced 7 gaps between the chamber-library spec (§§I–XI) and lived experience; steward named the governing principle (Spec Loom / hic jacet): tools should be GENERATIVE from spec, marked once, mutable-after — not hand-carved beside it.
**The gaps (drafts for the jurist/steward loop; see _curation/tool-fleet-compliance-2026-07-03.md + this session):**
1. §II.2 break-form unenforced; `sectionless: true` field is READ by the fixed verify_conversion but NOT defined in the spec (tool got ahead of the constitution). Define the field; gate the `---` invariant; name `• • •`→`---` normalization.
2. §V apparatus-integrity asserted but never gated (70 damaged files). Make ref↔def pairing / no-stranded-notes a gated invariant; the audit_corpus classifier is the instrument; belongs in the graduation gate.
3. §V Tier-2 conversion-record required but only the OCR path writes one; mandate it for every normalizing path + define the schema (the grounding gate needs the declared equivalences).
4. §VII [PARTIAL] → formalize: the declared gate-list (graduation-spec.yaml gates[]) IS the gate; fold in sectionless exception + apparatus check + body_word_conservation (declared, unimplemented).
5. §IX [OPEN] → closeable now: audit_corpus map + build_catalogue-as-health-ledger = the coverage-warrant.
6. The STANDARD (verified fidelity = floor not tier) + the FENCE (green set) live in memory, not the spec; distinguish converted/verified/fenced.
7. [ESCALATE] the generative principle as governance: tools are thin consumers of the machine-readable spec; declared convention-data + gate-list authoritative; a tool re-encoding a convention is drift. Reshapes how we build — jurist+steward to ratify.
**Prior-art dependency:** 3 research scans running (TEI/scholarly encoding · fidelity tooling & spec→validator · bounded-corpora-for-AI) — TEI likely hands us a ratified apparatus/provenance/normalization vocabulary to adopt INTO the spec rather than invent. Synthesis owed before drafting the spec revision.
**Recommendation:** mark-the-ground sequence — consolidate spec (close 1–6, rule 7) → build generative validator (spec→spec-lint, single gate) → THEN run cleaning waves. Waves-first would bake tool-shaped conventions into 300 files (the redo we're avoiding).
**Files affected (on authorization):** docs/chamber-library-specification.md, _curation/graduation-spec.yaml (extend as the convention-data source), a new spec-lint validator.
**Awaiting:** jurist doctrine pass + steward authorization; prior-art synthesis.

### PENDING-46 addendum (2026-07-03) — prior-art synthesis complete
Three scans done → `chamber-library/docs/spec-revision-prior-art-synthesis-2026-07-03.md` (the jurist brief).
KEY: ~70% of our spec re-derives TEI + CTS + Standard Ebooks (align, don't invent). The FUSION
(verified-verbatim fidelity of a bounded curated corpus as a constitutional invariant of an
epistemic-memory substrate) is close-to-novel (provisional). WATCH: Seck "Governed Reasoning for
Institutional AI" arXiv 2604.10658 (independent convergence on our governance half; lacks our
corpus-substrate moat) → landscape register. ALIGNMENTS: §III→CTS URN (edition-as-identity);
§V apparatus→TEI ch.13 (anchor-to-location, verify resolution); conversion-record→W3C PROV;
§VII→ODD one-artifact discipline; §IX→ledger-as-coverage-warrant. GENERATIVE PRINCIPLE realizable
NOW proportionately (PROV + JSON-Schema + Pandoc Lua filters + ODD-as-model); TEI-XML/ODD fork
HELD OPEN (name, don't resolve). ADOPT: dinglehopper, ftfy, JSON-Schema, Lua filters, SE
[Editorial]-commit, Deterministic-Quoting (engine citation path). KEEP (no equivalent anywhere):
prose-word-multiset guard, verbatim-span check, checksum integrity. TWO held-open architectural
questions for the jurist: (a) in-band original (TEI <choice>) vs replace-and-sidecar; (b) the
markdown-vs-TEI-XML fork. SEQUENCE: jurist spec-revision → build generative core → THEN waves.

### PENDING-46 — JURIST RULING RECEIVED 2026-07-03 (record: chamber-library/docs/spec-revision-RULING-2026-07-03.md)
Steward+jurist still discussing gap 7. Executor to act ONLY within ratifications below when steward authorizes execution (spec is constitutional; ruling ≠ steward's go-ahead to edit the spec doc).

**THE UNIFYING INSIGHT (jurist's condition, load-bearing):** gaps 2 (apparatus ref↔def anchors), 3 (PROV "original" as resolvable reference), and item-8 (§III CTS-URN citation) ALL reduce to ONE logical-passage addressing/pointer substrate — "don't build two addressing systems that can drift." DESIGN THE POINTER SUBSTRATE ONCE; three consumers. This is do-it-once made concrete.

**READY TO EXECUTE on steward's word (RATIFIED-CONDITION):**
- Gap 1: define `sectionless: true` + NAME AN ATTESTOR FIELD (who set it / against what evidence the SOURCE lacks breaks) — positive attestation, never a default/absence state.
- Gap 2: apparatus-integrity gated invariant; anchors on the shared addressing substrate.
- Gap 3: PROV conversion-record, MANDATORY on every normalizing path; "original" = resolvable reference (survives question-a either way); + name the gate's TWO functions distinctly — content-grounding (canonical-text-only, §VI invariant intact) vs fidelity/process-integrity (reads the record). Extending the gate to read the record does NOT violate sidecar-exclusion.
- Gap 4: spec-text "declared gate-list IS the gate" now; body_word_conservation impl tracked SEPARATELY (open eng).
- Gap 5: §IX ledger-as-coverage-warrant + FRESHNESS INVARIANT built in from the start (regen inside the gate pipeline OR checksum tying entries to file state).
- Item 8: §III its OWN section (CTS-URN, edition-as-identity); shares substrate with gap 2, distinct question (cites OUT vs internal ref↔def).
- Question (a) PARTIAL-DECIDE: extend the grounding gate to READ+CHECK the conversion record NOW (closes the fidelity blind spot); in-band-vs-separate-file left open (now a low-stakes usage question).

**NEW PENDING ITEMS the ruling created (NOT executor-actionable yet):**
- (i) Gap-6 promotion criterion — the mechanical converted→verified test. ESCALATED. No file may be promoted to "verified" until named+checkable. (Jurist: cite Seck's "governability" axis — knowing when NOT to treat a file as verified — directly when writing this.) Tiers (converted/verified/fenced) themselves RATIFIED.
- (ii) body_word_conservation implementation (gap 4's unfinished half).
- (iii) Gap-7 amendment-process corollary: ratifying "spec is the generative source" concentrates authority → WHO can amend chamber-library-specification.md and under what process must be decided IN THE SAME BREATH as gap 7. Returned to steward+jurist.

**Question (b):** HELD; trigger = revisit if/when (a) resolves toward full in-band dual-content at scale.
**Seck arXiv 2604.10658:** jurist-confirmed real; add to landscape register. Adjacent cluster (Pierucci "Institutional AI" 2601.10599/2601.11369; "Governing Actions Not Agents" 2606.26298 — an "adjudication branch" ≈ steward/jurist/executor) → jurist wants a REAL SWEEP before gap-7 ratification. Executor launching that sweep now to feed the live gap-7 discussion.

### PENDING-46 — gap-7 amendment-process sweep DONE 2026-07-03 (→ chamber-library/docs/gap7-amendment-process-JURIST-ADDENDUM-2026-07-03.md; copy on Desktop for handover)
FINDING 1: our model's ORGANS are precedented (2601.11369 Manifest/Oracle/Controller ≈ jurist/adjudication/executor+logchain; 2606.26298 executor-gate; Seck 2604.10658 tiers+ledger) BUT the closest analogue LEAVES AMENDMENT UNDEFINED — the exact trap the ruling steers around. Distinctive to us (0.7, no-counterexample): human-steward-load-bearing + non-implementing-jurist + fidelity-verified-corpus-substrate. Moat holds (0.75): none couple governed-reasoning to a verbatim-fidelity corpus.
FINDING 2: the amendment process nearly writes itself from prior art we ALREADY run — (1) RFC immutable-supersession = logchain-on-the-spec; (2) BIP/PEP "normative-change-reverts-to-Review" = the crisp FIX→PROPOSAL trigger, roles map 1:1; (3) semver-as-consumer-contract = spec-change-is-API-change, MAJOR re-runs the verification ladder on every consumer. TEI Council = domain twin (decision-in-ticket ≈ PENDING/REVIEWED). Anthropic constitution = cautionary (no codified amendment procedure). Failure mode: single authoritative artifact + no amendment process → capture/ossify/fork; generative principle raises stakes on all three.
A synthesized draft amendment process is in the addendum for the jurist to rule on. Executor holds — gap 7 + amendment process are steward+jurist's to co-ratify.
TODO (executor, standing offer): add Seck 2604.10658 + this cluster (2601.10599/11369, 2606.26298) to the landscape register; commit Wave-0 changeset (still uncommitted).

### PENDING-46 — gap-6 EVIDENCE-TIER DATA produced 2026-07-03 (jurist asked; → docs/gap6-evidence-tier-data-JURIST-2026-07-03.md; Desktop copy)
Joined corpus-quality-ledger ⋈ source-matches.json. EVIDENCE TIERS (verify-against-what): V-DSL(Loeb)=952 [930 pass floor], V-TEXT(born-digital source)=239 [6 pass], V-SCAN(pdf)=50 [0], V-SUSPECT=29, V-NONE=14. HEADLINE: 1191/1284 (93%) DETERMINISTICALLY verifiable (V-DSL+V-TEXT) — source IS ground truth, our prose-word-guard IS the promotion test; only 50 (V-SCAN) need the hard OCR-vs-scan path. 936 already pass floor; 255 more verifiable after the waves clear their floors. Proposed criterion tiers: verified-deterministic (word-identical re-convert vs source) / verified-scan (OCR-vs-image) / fenced-out (V-SUSPECT confirm-match + V-NONE acquire-source = Seck governability). CAVEATS: (1) add evidence-tier as a STANDING ledger column (couple gap-6 to gap-5); (2) source-match ~1% author-agreement FP → V-SUSPECT is a real gate; (3) deterministic tier COUPLED to item-8 edition-as-identity (wrong-edition match fails word-guard). The "no ground-truth at scale" worry that escalated gap-6 shrinks to 50 files.

### PENDING-46 — GAP-6/7 CONSOLIDATED RULING LANDED 2026-07-03 (record: chamber-library/docs/spec-revision-RULING-2026-07-03.md is the ORIGINAL; consolidated ruling supersedes gap6/gap7 per RFC-style; steward relayed)
RATIFIED: gap-6 promotion criterion (3 tiers; tier-1 amended to require source-identity author+edition via item-8, then word-identical re-convert); gap-7 generative meta-principle (no tool may encode a convention independently of the declared spec); amendment process (RFC supersession + change-class + semver + PENDING/REVIEWED + no-new-organ). CONDITIONS: (6) keep V-SUSPECT & V-NONE DISTINCT ledger values; (7a) editorial/normative test must directly ask "does this change what any current gate accepts/rejects" (not the FIX label / declared-field-touch); (7b) deprecate-before-remove extends to PROMOTED FILES — migration-window policy for files verified/fenced under a prior criterion (the ~1% author-agreement FP ~dozen files is the real population). This consolidated ruling is itself the FIRST instance of the amendment process (supersession).
JURIST DIRECT Q — ANSWERED: Loeb IS edition-unambiguous by construction (single loeb.dsl, 1 entry/work, Loeb Classical Library = the fixed edition; no which-edition question) → the 930 floor-passing V-DSL do NOT need item-8 for verification; only the 239 V-TEXT (matched via source-matches = real edition risk) do. Item-8 gates V-TEXT, not V-DSL.
⚠ NEW FINDING (surfaced, qualifies "930 ready now"): ALL 952 Loeb retain §II-forbidden '— p. N —' page-markers as h6 headings; 930 "pass" the floor but verify_conversion BLIND-SPOTS them (markers are markdown headings, not cruft signatures) → they are NOT §II-clean. This is (a) a §VII/gap-4 GATE GAP (the gate doesn't enforce §II 'no page markers'), and (b) a DOCTRINE question for the jurist: strip the Loeb page-markers (§III off-canon) OR grant a Loeb page-reference exemption (classical texts cite by canonical reference). So "930 ready now" → "930 pending a Loeb page-marker disposition." Contamination-directive: the gate's "930 clean" self-assessment is not fully honest re §II; named now.
CITATION-INTEGRITY LESSON (jurist §3 caught): addendum cited arXiv 2605.24229 for Anthropic "no codified amendment procedure" — that paper is an empirical compliance audit, doesn't support the claim. Let a sub-agent's blanket "4/4 verified" ride without per-claim check. DISCIPLINE: verify each citation against the specific claim it carries; never let aggregate "verified" substitute. → feedback memory candidate.

### PENDING-46 — THREE-QUESTIONS RULING + executor factual check 2026-07-03
QUESTION A RESOLVED → STRIP branch. Factual check (verified): '— p. N —' = Loeb PRINT-RUN page numbers (plain sequential integers) = edition-specific → strip per §II. Stephanus/Bekker margin NUMBERS are ABSENT from the DSL extraction (read Plato Charmides body — the canonical Stephanus case — none present; the "309 Stephanus-shaped" signal = apparatus-citation noise "Eclogae 4.24b"/"Athenaeus 6.224c", NOT margin refs). Stephanus subsection LETTERS may survive mangled inline (stray "B" fused to Greek word) — separate cleanup obs. CONSEQUENCES: (1) Loeb tier (74% of corpus) currently lacks a standard citation anchor → cite by intrinsic structure OR work+verbatim-quote (§III sectionless reduction, already sanctioned) = ACCEPTABLE; sourcing Stephanus/Bekker = separate FUTURE enrichment, not this strip, noted in §III/item-8. (2) Loeb-tier STRIP PASS (952 files) needed before the 930 are §II-clean/promotable — mechanical wave, still deterministic (re-extract DSL + strip + word-guard). (3) Gate rule keys on a PER-GENRE recognized-locator REGISTRY (Stephanus/Plato, Bekker/Aristotle…), NOT the word "Loeb"; registry empty for Loeb now → all print-pages flagged→stripped.
QUESTION B RATIFIED: tier-2 = REDUNDANT independent verification (≥2 human passes vs scan image + 3rd adjudicating; dinglehopper = inter-pass diff; OCR-confidence = triage only, NOT the test). Numeric bar DEFERRED to a 3-5 file calibration batch. (Executor owned the CER/WER-vs-image conceptual error — no ground truth for V-SCAN by definition.)
QUESTION C RATIFIED: re-verify-pending = own ledger status; verified_under:<criterion-semver> per row; N=2 release cycles PROVISIONAL (set vs real cadence, keep short — protects future willingness to tighten); + logged FIX-class extension path (operational delay ≠ epistemic failure). 
ALL THREE now fold into the v2.0 draft: A→§II strip rule via per-genre locator registry + §III/item-8 Loeb-anchor-absent note + Loeb strip wave; B→gap-6 §2 tier-2 mechanism (bar [OPEN-calibration]); C→amendment §7b migration policy.

### PENDING-46 — LOEB SUBSTRATE REFRAME 2026-07-03 (steward sent me to the DSL source — decisive)
FINDING (verified against loeb.dsl source): the canonical citation anchors are IN THE SOURCE, FLATTENED by extraction — NOT absent. Plato Stephanus = `[c dimgray]St. II p. 153[/c]` + subsection letters B/C/D/E (the "stray B" earlier); Homer = book-letters `[b]A[/b]` + line-numbers `[c dimgray]5/10/15`; Loeb pages = `[c dimgray]Page number N` (246,622 marks). The `[c dimgray]` class is OVERLOADED (≥5 semantic uses); extract_loeb_dsl.py's KNOWN_TAG.sub("") strips the wrapper → collapses all into undifferentiated inline text. Stephanus SURVIVED into the extract as bare "St. II p. 153" (my grep searched the wrong form "153a" — 3RD census-through-a-pattern miss this session).
REFRAME: Loeb path is NOT "strip page-markers" and NOT "external enrichment/acquisition" — it's RE-EXTRACT preserving the [c dimgray] semantic layer, disambiguated BY CONTENT SHAPE (per-genre locator registry = the disambiguation map): Page-number→off-canon(§III); St./Bekker/line→citation anchor(item-8/CTS); work-title→drop; [sup]→apparatus. My "74% cite-by-work+quote" was WRONG; Loeb can be properly cited by canonical anchors → feeds item-8 CTS directly (Plato-by-Stephanus is textbook CTS). The jurist's "structured-but-unanchored→work-level fallback" shrinks to a small residual; "external acquisition" enrichment case near-EMPTY.
META-LESSON (3× this session, steward-corrected 2×): for a fidelity corpus, verify structure/anchor claims against the AUTHORITATIVE SOURCE, never the derived artifact or a regex over it. → feedback memory + Symmetria §3 flag candidate: derived-artifact-or-regex-over-substrate.
DECISION (steward delegated "whatever you think best"): this changed a FACTUAL PREMISE the jurist's §III ruling rested on → must go back to jurist to re-rule, but on VERIFIED DATA not my prose (3× wrong). So: launched a careful per-genre DSL anchor audit (fresh agent, anti-pattern-drift discipline, verify-against-real-cards, quantify the genuine residual) → I verify its load-bearing claims against the source → relay reframe+audit to jurist for §III re-ruling → THEN build the re-extraction on the ratified disambiguation map. Audit running (agent ae7ad9b).

### PENDING-46 — LOEB FULL-RUN SCOPE (steward recall 2026-07-03)
The current Loeb corpus (~952 work-files) is TIER 1 ONLY of the 3-tier plan `chamber-library/_curation/loeb-canon-proposal-2026-06-15.md` (steward's frame: "begin highest-signal now, comprehensive next, all of it once dilution is solved"). Tier 1 = 86 authors/356 vols/81,912 cards (67%); Tier 2 = 151 authors/92%; TIER 3 = ALL 377 authors/523 vols/121,447 cards ("waits on dilution").
STEWARD CALL (do-it-once): since we're rebuilding extract_loeb_dsl.py anyway to preserve the citation structure, run the FULL DSL (all 377 authors) in ONE pass — not Tier-1-then-redo. 
DILUTION RESOLVED BY THE FENCE: Tier 3's "waits on dilution" condition is now MET by gap-6's fence — extract everything citation-rich, fence the ENGINE to the verified/green set. Corpus-completeness ≠ engine-scope (same don't-conflate-axes discipline). Full extraction and dilution no longer in tension.
⇒ Re-extraction scope = FULL DSL (377 authors), not just the 952. The running per-genre anchor audit (agent ae7ad9b) is already whole-DSL-scoped → its disambiguation map serves the full run. One rebuilt extractor, run once, recovers clean bilingual text + Stephanus/Bekker/book+line anchors → feeds §II, §III/item-8, gap-6 together.

### PENDING-46 — LOEB ANCHOR AUDIT COMPLETE + VERIFIED 2026-07-03 (→ chamber-library/docs/loeb-anchor-audit-and-disambiguation-map-2026-07-03.md)
Per-genre DSL audit done (agent, 22min, whole-DSL); executor RE-VERIFIED the two load-bearing claims against source. Scale: full DSL = ~2,041 works / ~124,627 cards (current 952 = Tier 1). Anchors richly present per-genre (Plato Stephanus / Aristotle Bekker-sparse+chapter+section / Homer book+line / tragedy line+strophe / orators section+col / historians book.ch.sect / Presocratics Laks-Most D/R/P PLAIN-TEXT / fragments number) — all verified against real cards + my own Plato/Homer/Aristotle/Presocratic spot-checks. RESIDUAL (the number §III re-ruling turns on): 37 machine-upper-bound → true substantive-anchorless floor SINGLE DIGITS, and those are fragment/testimonium/pattern-poem/concordance artifacts where work-level IS correct granularity. ⇒ >99% of works carry a recoverable anchor. RECOVERY-CRITICAL VERIFIED: the dropped `%` index lines carry Book/Letter/Fragment divisions — 35,261 such lines, thrown away by the current extractor. Disambiguation routing map captured (the design input for the rebuilt extractor).
WHAT IT MEANS FOR §III RE-RULING (SIMPLER than feared): the jurist's "structured-but-unanchored→work-level fallback" normative extension is NEARLY MOOT — population is single-digit genuine fragments (original sectionless reduction covers them, not a new triggering condition). "External enrichment/acquisition" case is EMPTY. §III cites the Loeb by RECOVERED canonical anchors (CTS edition-as-identity: Plato-by-Stephanus etc.). Re-extraction recovers clean text + anchor layer + work-divisions in one pass over the full 2,041-work DSL.
NEXT: relay verified audit + this simplification to the jurist for the §III re-ruling; then rebuild extract_loeb_dsl.py to the disambiguation map + run full DSL.

### PENDING-46 — §III CITATION POSTURE RULING (jurist, 2026-07-03) — DOCTRINE PHASE COMPLETE
DISPOSITION:
- structured-but-unanchored extension: VOID as ratified-for-74% (premise gone, not smaller — a principle that now governs NOTHING shouldn't stand as active doctrine = "gone decorative"). Retained ONLY as an explicitly DORMANT, named contingency (future-acquired work with real internal structure + no recognized anchor convention), LABELED in the spec as inapplicable to any work currently in the corpus. Not deleted (keep the reasoning), not left active.
- "future enrichment" trigger requirement: RETIRED — no external-acquisition case remains (everything, incl. the 35,261 index-line divisions, is IN the DSL → re-extraction not acquisition).
- §III citation posture: RATIFIED — cite the Loeb by its RECOVERED canonical anchor, resolved by edition-as-identity; work-level fallback ONLY for the genuine-fragment residual. Doctrine now; recovery = downstream engineering, validator-gated, feeding gap-6.
- Per-genre mapping/disambiguation table: NOT RATIFIED — re-extraction ENGINEERING to review once built (jurist hasn't seen the audit, only the summary; the ambiguous string-match calls resolve during extraction). The architecture above the table is sound regardless. → §III's per-genre registry is a LIVING data layer (grows/reviewed during extraction), NOT ratified doctrine — matches the doctrine-stable/data-living split I described to the steward.
- STANDING PROCESS NOTE (jurist, not corpus-specific): ANY corpus-population claim feeding spec doctrine must be SOURCED FROM THE DSL/SOURCE DIRECTLY, or explicitly flagged extract-derived+provisional, BEFORE it does normative work. Same discipline gap-2/gap-3 enforce on the corpus, applied to how the corpus is AUDITED. → adopt as standing practice: verification-ladder entry + Symmetria §3 flag + feedback memory (converges with my own 3×-this-session verify-against-substrate lesson). Capture at wrap.
⇒ §III was the LAST gating ruling. DOCTRINE PHASE COMPLETE — all gaps 1-8, generative principle, amendment process, three questions, §III posture ratified. Phase ② (draft spec v2.0 superseding version + generative validator) is UNBLOCKED. Remaining OPEN-marked (non-blocking): per-genre table (engineering), tier-2 numeric bar (calibration), the two held forks (in-band/sidecar; markdown/TEI-XML).

## PENDING-47 — Corpus stress-test pre-registration (thresholds gate before execution)
**⟶ CLOSED 2026-07-05 — REVIEWED-47 placed by steward (formal close).**
**Date:** 2026-07-04
**Tag:** [PROPOSAL] (the stress-test protocol + its ruling-thresholds; jurist gate before any run)
**Summary:** v2.0 is ratified doctrine; the corpus stress-test brings the ~2,041-work corpus to spec. First artifact = a PRE-REGISTRATION doc fixing ruling-thresholds BEFORE any test data is seen (the jurist's strongest safeguard, easiest to skip). Drafted: `docs/corpus-stress-test-pre-registration-2026-07-04.md`; jurist cover note `docs/corpus-stress-test-pre-registration-FOR-JURIST-2026-07-04.md`.
**Load-bearing finding (verified against `scripts/match_sources.py`, not the summary):** the cited "~1% source-match false-positive" is NOT an independent measurement — it is an eyeball over the matcher's OWN `author_disagrees()` warning, which fires only when the canonical surname is ABSENT from the source, and is therefore blind by construction to the two dominant FP classes (same-author-wrong-work: Bachelard Reverie→Espace; whole-for-part: whole Recherche→Vol III), both sitting UNFLAGGED in the 321 confirmed. Same structural error as the overturned "74% anchorless" premise. ≥2 genuine wrong-work FPs already found unflagged (disclosed prior, not threshold-setting).
**Three seams, dependency order:** (1) source-matching reliability FIRST (independent = 2nd content-fingerprint matcher flags disagreements → human ground-truth rules; N=40 of 321 non-Loeb confirmed, fixed seed; Loeb/V-DSL excluded — DSL IS the source); (2) order-sensitivity — inject-known-bad on the multiset word-guard (verify_conversion prose_delta is order-blind by construction; order-sensitive/anchor-bound layers ruled-but-unimplemented); (3) disambiguation-map edges — go-looking for Virgil `prv` + bare-integer (line vs section).
**Steward decisions (2026-07-04):** thresholds CONFIRMED subject to jurist gate before execution; instrument = BOTH (executor builds 2nd matcher to flag disagreements, human rules the flags). Nothing runs until the jurist gates.
**Open jurist question (Q1, surfaced not resolved):** the pre-registration grades Seam 1 by RATE (≤1%→FIX / 1–5%→PROPOSAL / >5%→ESCALATE), but the change-class criterion ("does this change what a gate accepts?") makes the `author_disagrees` structural blindness a PROPOSAL *independent of rate* — the rate sizes the FIX work, the blindness is the gate-change. Split the grading onto two axes (structural-blindness→PROPOSAL; magnitude→sizes-FIX/forces-ESCALATE-above-threshold), or keep the rate-coupled table? Executor leans split; did NOT revise the just-confirmed doc unilaterally.
**Correction folded in:** an earlier recon claim that `graduate_to_canonical.py` was unwired from `verify_conversion` was STALE — Wave 0 (`f9cbb8e`) wired both gates (lines 36-37, verified). Records-drift-both-directions.
**Files affected (on gate):** the two pre-registration docs; on execution, a new content-fingerprint matcher (Instrument B) + run logs; Seam findings graded per the gated table.
**Awaiting:** jurist gate on the pre-registration thresholds (esp. Q1) via steward relay, THEN executor builds Instrument B + runs Seam 1 small-batch.

### PENDING-47 — JURIST GATE RECEIVED 2026-07-04 (GATE-WITH-METHOD-CHANGE; steward relayed) → pre-registration REVISED + LOCKED
Jurist confirmed the structural-blindness finding (arithmetic + logic independently checked) and gated with four required method changes, ALL now applied to `docs/corpus-stress-test-pre-registration-2026-07-04.md` (v1 LOCKED; revision record §6):
1. **Q1 split — YES.** Seam 1 graded on two axes; the confirmed blind spot (≥2 real instances) is PROPOSAL-class **decided now**, independent of the sample. Reworded around *confirmed* not *possible* blindness (jurist's precision: a merely-conceivable blind spot is not auto-PROPOSAL, else any incomplete heuristic qualifies).
2. **Q2 statistics — the point-estimate grading was unsound.** At N=40 a truly-5% corpus reads as 0–1 errors ~40% of the time (verified P(0or1|.05,40)=0.399). FIX: grade on the one-sided 90% Clopper-Pearson UPPER BOUND U, with an underpowered-sample top-up rule (0/40→U=5.59%, straddles 5%→top-up expected; n≈45 clears at 0 errors). 5% substantive line kept.
3. **Q3 — Loeb exclusion sound but the risk was being read as "none" not "different."** Added SEAM 1-BIS: V-DSL work-mis-attribution (card attached to wrong work) — covered by neither Seam 1 (external/non-Loeb) nor Seam 3 (anchor-TYPE not work-IDENTITY). Disjoint population, non-blocking, thresholds pre-set (same CP statistic).
4. **Q4 — Seams 2 & 3 already structural, no split needed.** Two smaller additions applied: Seam 2 tests ≥2 scramble patterns (within-sentence + multi-line, gate-on-class); Seam 3 guarantees ≥1 card per signal type (not a count of 20).
**DECIDED-PROPOSAL awaiting steward BUILD-authorization (Axis A):** add a same-author-wrong-work + whole-for-part check-class to the source-match gate (content-fingerprint the natural mechanism). Jurist ruled the *need* settled today; the sample sizes it; **steward authorizes the build.**
**Status:** pre-registration LOCKED, jurist-cleared "ready to run." NEXT (executor): build Instrument B (content-fingerprint matcher) + the CP grader, run Seam 1 (N=40) + Seam 1-bis in parallel, first-pass eyeball the flagged hard cases, surface genuinely-ambiguous ones + the graded verdict to steward. Production gate-change (Axis-A PROPOSAL) held for steward build-authorization.

### PENDING-47 — SEAM 1 RUN COMPLETE 2026-07-04 → [ESCALATE] the ~1% does NOT hold (verdict: `_curation/stress-seam1-verdict-2026-07-04.md`)
Instrument B built + validated + hardened 3× (`scripts/stress_source_match_verify.py`), run on N=40 random (seed 20260704) of 321 non-Loeb confirmed; each flag human-ruled (Instrument A).
**RESULT: k=2 confirmed source-match FALSE-POSITIVES** — (1) `montaigne` = Stefan Zweig's *Montaigne* biography canonical ← Montaigne's own *Essais* source (suspect=True: author_disagrees FIRED but the match survived into confirmed — the warning is not a gate); (2) `semaison-la-philippe-jaccottet` = Jaccottet *La Semaison* vol1 (real 59,508-word canonical) ← *La Seconde Semaison* vol2 source (suspect=False: author_disagrees BLIND — same author; the random-sample instance of the structural class the gate ruled a PROPOSAL).
**GRADE (locked rule): p̂=5.0%, U₉₀(Clopper-Pearson)=12.8% > 5% → ESCALATE.** Robust: k=1 → U=9.4%, still ESCALATE; only k=0 would top-up, and k≠0. **Literal question ANSWERED: the cited ~1% is refuted** (5× the point estimate; same shape as the overturned "74% anchorless"). Per taxonomy ESCALATE = surface + do not proceed: **Seams 2–3 HELD** per the pre-registration stop condition (would test order/anchors against wrong sources).
**SECOND FINDING [NEW, unbudgeted — corpus integrity]: stub canonicals.** 2/40 (`leopold-sand-county-almanac` 5 words; `naess-deep-ecology` 20 words) are placeholder "canonical" files, not graduated verbatim texts → ~15+ implied in the 321, likely more corpus-wide. Orthogonal to source-matching; the graduation gate admitted (or predates admitting) body-less files → its own census + a gate question.
**AWAITING STEWARD/JURIST:** (a) the ESCALATE ruling on source-matching (re-rule before downstream, or a bounded disposition); (b) build-authorization for the Axis-A gate check-class (Instrument B is the prototype); (c) whether to open a stub-canonical census now or hold. Executor HOLDS — does not proceed to Seams 2-3 or the full corpus.

### PENDING-47 — FULL-321 MAGNITUDE + STUB CENSUS 2026-07-04 (steward: recommend the ESCALATE move + quick stub census). Jurist relay: `docs/stress-seam1-ESCALATE-FOR-JURIST-2026-07-04.md`
**Steward decisions:** ESCALATE-move = "which do you recommend" → executor recommended **relay-to-jurist-with-magnitude** (run the CHEAP automated full-321 B-pass to give the jurist real magnitude; DEFER the expensive full hand-adjudication until after the ruling, which may reframe what counts). Gate check-class = **HOLD until ESCALATE ruled**. Stub census = **quick census now**.
**STUB CENSUS (whole non-Loeb corpus, 335 files):** only **4 stub canonicals** (<200-word bodies): leopold(5w) · naess(20w) · latour-never-modern(22w) · yunkaporta-sand-talk(73w) — all in `contemporary_voices` (one import batch, bodies never graduated). BOUNDED + localized — my 2/40→~15 extrapolation was TOO HIGH; the census corrected it (why steward said census-don't-guess). Loeb excluded (952).
**FULL-321 automated B-pass (unruled):** 251 agree · 35 FLAG · 34 no-source(azw3/mobi+garbled) · 1 thin. Triage of the 35 (PROVISIONAL — only N=40's 8 rigorously ruled): ~10 confident genuine FPs [4 cross-author susp=True: montaigne/the-odyssey(←Clarke 2001)/meditations(←Bourdieu)/nietzsche; 6 same-author-wrong-work susp=False = author_disagrees-BLIND: semaison/reverie/lhomme-T1/orthotypo-vol2/berger-essays/suzuki-intro] + ~4 SCOPE sub-class (whole←part: Proust←VolIII, Quixote←Part1; work←collection: el-aleph, fictions) + 2 stubs + ~18 same-work-noise. **Provisional magnitude ~3–4.5% FP** — refutes ~1% at full scale, consistent with N=40.
**TWO STRUCTURAL FINDINGS for the jurist:** (1) author_disagrees BLIND to same-author-wrong-work (~6 instances, not 1) → Axis-A PROPOSAL firmly evidenced; (2) PROCESS GAP — the 4 cross-author FPs are susp=True (warning FIRED but they stayed CONFIRMED; the warning is not a gate). Concrete: tool-log says `meditations` re-linked to Hays 07-02 but source-matches.json still shows Bourdieu → stale-json-or-lost-fix, verify. Plus a NEW SCOPE-DOCTRINE question (whole↔part / work↔collection), analogous to the un-run Seam 1-bis V-DSL work-identity risk.
**Jurist asked to rule:** the ESCALATE disposition (bounded FIX-list ~10-14 + gate-hardening vs stronger); a scope doctrine; then confirm to fully adjudicate the 35 → final FIX-list. Executor HOLDS.

### PENDING-47 — JURIST ESCALATE RULING RECEIVED 2026-07-04 (steward relayed; `docs/` copy owed). Differentiated remediation, NOT a-or-b.
Jurist INDEPENDENTLY recomputed the CP bounds (5.0%/12.8%; k=1→2.5%/9.4%) — **ESCALATE holds, confirmed**. Standing practice ruled: the CI-not-point-estimate grading + the drop-one-case robustness check are now STANDARD for every ESCALATE (→ verification ladder). Dispositions:
1. **Detection blindness (Axis-A):** confirmed (6 instances now); nothing new — PROPOSAL already decided at Q1, proceeds to steward build-auth. Correct that executor HELD the build (more evidence ≠ license to act ahead of authorization).
2. **PROCESS-INTEGRITY finding ELEVATED — "the most important thing in the whole report."** The 4 cross-author FPs fired `suspect=True` yet stayed CONFIRMED (the review step didn't run or didn't work), AND the tool-log claims a `meditations`→Hays fix that `source-matches.json` contradicts. Jurist: this is not one stale record — it's whether ANY recorded fix in the system actually took effect. **Needs its OWN priority investigation BEFORE any remediation is trusted** — NOT folded into gate-hardening. "Find out why the Bourdieu fix didn't stick before trusting that the next ten will." Re-pointing the FIX-list under a broken persistence mechanism reproduces the same silent non-persistence.
3. **SCOPE DOCTRINE RULED (asymmetric — don't grade the two together):**
   - *canonical=whole, source=one PART* (Proust←VolIII, Quixote←Part1): genuine UNDER-COVERAGE → a **§IV edition-identity failure once edition-identity is read to include SCOPE** (not just translation/printing). Uncovered remainder = unverifiable-by-this-source, NOT silently fully-served; keep as a bounded partial match only if the covered region is worth it.
   - *canonical=one work, source=SUPERSET collection* (El Aleph←collection): different + smaller — an **extraction-precision** question (did slicing bound to the right text?); if extraction isolates correctly it's a complete verifiable match. Don't grade on the subset axis.
   - **UNIFY with Seam 1-bis: ONE scope-identity principle** (does the source's actual extent match what the canonical claims to represent), two applications (external match / DSL card). Not two doctrines that could drift.
4. **Remediation order:** process-integrity investigation FIRST → apply scope doctrine in the deferred full-35 adjudication (now unblocked, doctrine in hand) → FIX-list proceeds only AFTER persistence + scope resolved. Axis-A gate-hardening → steward build-auth (parallel).
5. **Seams 2 & 3 unblocked PRECISELY (not a blanket freeze):** Seam 2 may proceed once its OWN 3 test files are individually confirmed (order-sensitivity doesn't depend on the other 318). Seam 3 was NEVER blocked by non-Loeb matching — its condition is Seam 1-bis (DSL work-identity) for its own ≥20 sample cards. Full-corpus source-matching STAYS BLOCKED until persistence resolved + scope applied to the 35 + fingerprint gate-hardening steward-authorized.
**EXECUTOR NEXT (jurist-directed):** (1) [priority, jurist-elevated] process-integrity investigation — why did the Bourdieu fix not persist; is there a systemic fix-persistence bug. (2) scope doctrine now in hand → the full-35 adjudication is unblocked (apply the asymmetric rule). (3) Seam 2's 3 test files individually confirmable. (4) Axis-A build still awaits steward auth. Parallel deep-compute (steward-authorized): the work-identity & scope study (now also grounds the unified scope-identity principle the jurist ruled).

### PENDING-47 — PROCESS-INTEGRITY INVESTIGATION DIAGNOSED + WORK-IDENTITY STUDY DELIVERED 2026-07-04
**(1) Persistence investigation (jurist's elevated priority) — DIAGNOSED. Doc: `docs/source-match-persistence-investigation-2026-07-04.md`.** Answer is WORSE than the two-way discrepancy: **no source-match fix can persist, because there is no persistence mechanism.** Verified against code: (a) NO override/exclude/pin layer exists anywhere (grep clean); (b) `source-matches.json` is pure algorithmic regeneration — `match_sources.py` re-derives every match from `classify()`, reads `chamber-source-link.md` ONLY for the "Needs locate" block, never as authority → any hand-fix is overwritten next run; (c) the canonical file carries NO authoritative `source:` field (only `source_format`); (d) `meditations` is a THREE-way divergence (tool-log=Hays / chamber-source-link.md=Stoic-Six-Pack / json=Bourdieu), no single source of truth. **Implication (jurist was right to gate on this): re-pointing the FIX-list under this mechanism silently reverts.** Remediation [PROPOSAL], steward-auth required, MUST precede the FIX-list: **authoritative `source:` (path+sha256) on canonical frontmatter, consumed by the matcher as a PIN** (Option A, recommended — the file-is-source-of-truth principle the catalogue already follows). NOT affected: catalogue (hash-pinned from disk), verbatim/graduation gates.
**(2) Work-identity & scope study (steward deep-compute choice) — DELIVERED. Doc: `docs/work-identity-and-scope-study-2026-07-04.md`** [PROPOSAL, design study — builds nothing, commits no schema]. Synthesized from 3 parallel prior-art sweeps (FRBR/LRM · CTS/DTS · BIBFRAME/TEI/dedup-practice) — all THREE traditions CONVERGE and INDEPENDENTLY CONFIRM the jurist's first-principles scope ruling. Key spine: CTS's work-identity is *asserted-not-demonstrated* = exactly what the Chamber's verbatim thesis distrusts → **demonstrate identity by CONTENT, not title.** Design: (i) declared `work_id` key (Standard-Ebooks-style); (ii) three orthogonal per-text assertions (identity / scope-relation `is_part_of`|`contained_in` + extent / expression-designation); (iii) match-gate = 3 veto-bearing gates (identifier-veto / scope-extent / **content-fingerprint = Instrument B, already prototyped**) — "disagreement is a veto not a low score" (OpenLibrary shape); (iv) the persistence pin (§3.4 = the remediation above). **The jurist's asymmetry operationalized by FRBR's "who created the grouping?" diagnostic** (author→whole/part=under-coverage; compiler→aggregate=extraction-precision) — the exact two cases. Unified scope-identity principle = Gate 2 applied to Seam-1 + Seam-1-bis. **This study SPECIFIES the Axis-A gate check-class + the persistence remediation + operationalizes the scope doctrine — the do-it-once work-identity foundation the corpus never had.**
**Still awaiting steward:** build-auth for (a) the persistence pin [precedes FIX-list], (b) the Axis-A gate redesign [Gates 2+3]. Both now fully specified by the study. Executor HOLDS.

### PENDING-47 — JURIST RULING on persistence + work-identity study 2026-07-04 (steward relayed; `docs/` copy owed). PHASED authorization.
Persistence diagnosis CONFIRMED (worse — absent not broken; the meditations 3-way = same "trust the visible artifact without checking authority" shape as 74%/Loeb, now at the correction-mechanism level). Work-identity corroboration checked DIRECTLY + ruled GENUINE (the FRBR "who created the grouping" diagnostic is PRIOR to the jurist's own scope question — it asks whether the canonical unit is correctly BOUNDED, not just whether the source covers it; would correctly handle a commercially-split single novel where "enough content?" alone can't tell whole-vs-volume). Dispositions:
1. **Option A (source: pin on canonical) APPROVED — with a NON-OPTIONAL attestation condition:** "pin" must mean VERIFIED not merely PRESENT. A bare-present field populated by the same conversion pipeline that produced the errors would LOCK IN a false pin — WORSE than regeneration (today's bad matches can be caught by a better algorithm later; a falsely-pinned one is locked by design). So `source:` needs a companion attestation — WHO verified + AGAINST WHAT (Instrument A / B / manual) — before the matcher treats it as a pin vs a still-overwritable provisional. Same shape as the `sectionless: true` ruling (bare flag ≠ safeguard; attributed attestation = safeguard).
2. **Meditations reconciliation:** sequencing CONFIRMED — after the layer exists, not before (else it's just the 4th divergent record).
3. **PHASED — approve urgent core NOW, route full design separately (no redo risk: `source:`=which-file-verified and `work_id`=which-abstract-work are COMPLEMENTARY, not competing):**
   - **AUTHORIZED NOW:** (a) the persistence layer (Option A + attestation) → BUILD once steward authorizes the [PROPOSAL]; (b) apply "who created the grouping" diagnostic MANUALLY to the 35 flags = the operational form of the scope doctrine, no Gates 2-3 needed.
   - **ROUTED as its OWN [PROPOSAL], own timeline, NOT blocking:** `work_id` key, scope-relation field, automated Gate 1-3 pipeline redesign. Valuable + worth adopting, but not a prerequisite to finish the current remediation.
   - **Axis-A fingerprint gate** (already PROPOSAL-ruled): builds on Instrument B independently, without waiting for the extent-comparison machinery.
**WHAT PROCEEDS:** persistence layer (Opt A + attestation) → build on steward [PROPOSAL] auth · reconcile meditations → after layer · **manual scope diagnostic on the 35 → NOW** · work_id/scope-relation/Gate2-3 → separate PROPOSAL · Axis-A fingerprint gate → independent, on steward build-auth.
**STEWARD DIRECTIVE (2026-07-04): integrate OSS in part or whole where it fits — don't reinvent.** → tooling-verification sweep RUNNING (content-fingerprint/text-reuse · biblio-identity/reconciliation · CTS-DTS impls); integrate-vs-build matrix owed, will shape the persistence attestation (reuse §V W3C-PROV pattern?), the Axis-A fingerprint gate (datasketch/passim?), and the separate work_id PROPOSAL (OpenRefine/Wikidata? MyCapytain?).

### PENDING-47 — INTEGRATE-VS-BUILD ASSESSMENT DONE 2026-07-04 (3-agent OSS sweep, maintenance+license VERIFIED live). Doc: `docs/work-identity-tooling-assessment-2026-07-04.md`
Steward was right — the study's build-default was too broad. Governing principle: **integrate the substrate + enrichment; OWN the spine + verdict** (§IV applied to tooling: locator-you-own = constitutional, external ID = witness-not-notary). Corrected my OWN wrong guess: MyCapytain (the "obvious" CTS integration) is DORMANT (last commit 2021). Matrix:
- **INTEGRATE:** `rapidfuzz` (title/author sim, MIT active) · `recordlinkage` pinned (deterministic rule+threshold veto-gate; comparison-vector = audit trail; BSD-3) · Wikidata-reconciliation/SPARQL + VIAF + `wikimapper` as human-in-loop ENRICHMENT (QID/VIAF attributes, NOT the anchor — ~45-75% coverage would strand a third).
- **KEEP HAND-ROLLED:** Instrument B containment (verified ALREADY asymmetric → datasketch buys nothing at n=2000) · the work-identity VERDICT (no OSS does this).
- **BUILD (own):** the deterministic work_id slug SPINE (100% coverage, constitutional) · a thin ~150-LOC CTS-URN parser.
- **BORROW vocabulary not runtime:** DTS 1.0 Collections (`member`/`totalParents`/`totalChildren`/Collection-Resource typing) + TEI `relatedItem type=host` for the scope model · W3C-PROV (§V, already ours) for the persistence attestation.
- **REFERENCE not vendor:** OpenLibrary `match.py` weighted-veto approach (AGPL-3.0, re-implement) · `pyCTS` as test-oracle (GPL-3.0, frozen).
- **REJECT:** datasketch(cond)/passim/TRACER/text-matcher/textreuse-R/ssdeep-TLSH/simhash/dedupe(active-learning-opacity)/MyCapytain+Nautilus(dormant)/openlibrary-client/isbnlib. **RESERVE:** splink (10× scale).
- **NET on the ruled build targets:** Axis-A gate = keep-B + rapidfuzz + recordlinkage (less to build). Persistence attestation = §V-PROV record (nothing new). work_id PROPOSAL = own-key + DTS-vocab scope + Wikidata-enrichment.
- **HIGHEST-LEVERAGE EMPIRICAL CHECK before committing the external axis:** run ~100 representative works (ancient/translation-weighted) through Wikidata reconciliation → MEASURE the real QID attach rate (the ~45-75% is estimate, not measured — measure-don't-trust). Tooling-register entry owed.

### PENDING-47 — ITEM 1 (persistence layer) BUILT + TESTED 2026-07-04 (steward: "work through them sequentially" = build-auth). NOT committed; held for review + jurist ratification.
Steward asked "design around the tension or resolve it?" → RESOLVED (not designed-around). **The check that resolved it:** the reading-index's `source_sha256` hashes the CANONICAL .md TEXT (spec §VI L363 + the Pattern-Language example); the persistence pin needs the hash of the SOURCE FILE (epub/pdf) — a DIFFERENT object. So never a genuine drift conflict, only a naming collision. Resolution = the **generalized hash-locality principle**: a binding-hash lives with its artifact's authoritative record (reading-index hash→sidecar; verification hash→on-file `source_verified:`); distinct name `source_file_sha256` (≠ forbidden `source_sha256`); one principle two instances, not rule+exception. **Awaiting jurist ratification of the principle.**
**BUILT:** `match_sources.py` — `attested_pin()` + `frontmatter()` (PyYAML); a `source:` is honored as an AUTHORITATIVE PIN (bypasses `classify()`, re-emitted identically every run) ONLY with a `source_verified:` attestation whose `by` names a VERIFICATION instrument (jurist condition: `conversion-pipeline` CANNOT self-attest; bare `source:` = provisional). `graduation-spec.yaml` — `source_verified` added to optional + the pin-semantics + the hash-locality principle; `source_sha256` stays forbidden. `test_tools.py` — 7 new pin cases (bare≠pin, pipeline≠pin, incomplete≠pin, attested=pin, nested-parse, fm-less-no-crash). **28/28 pass; backward-COMPATIBLE (0 pins today → layer INERT → no regression on the 321; activates only when fixes are pinned).** Persistence PROVEN on the meditations case: pin emits Hays not the Bourdieu FP, every run.
**Meditations reconciliation** now UNBLOCKED (the layer exists to hold the answer) — a FIX to apply during the FIX-list, pinning the correct source with attestation.
**Next in sequence: ITEM 2 — apply "who created the grouping" diagnostic MANUALLY to the 35 flags** (jurist-authorized, independent of the persistence schema). Then item 3 (Wikidata coverage measurement), item 4 (work_id/scope-pipeline separate PROPOSAL).

### PENDING-47 — ITEM 2 (full 35-flag adjudication) DONE 2026-07-04. Doc: `_curation/stress-seam1-flag-adjudication-2026-07-04.md`. The FIX-list.
Two-axis method (identity: right work? + scope: "who created the grouping?"). Ruling on the 35: **11 confirmed genuine FP** [8 wrong-work/author: montaigne/nietzsche/the-odyssey/meditations/ecrits-Lacan/reverie/suzuki-intro/berger-essays · 3 wrong-VOLUME: lhomme-T1←T2/orthotypo-vol2←vol1/semaison-vol1←vol2] · **2 scope under-coverage** (whole←part, AUTHOR-division → §IV: a-la-recherche←VolIII, don-quixote←Part1 → bounded-partial-or-re-source) · **2 work←collection** (COMPILER-aggregate → extraction-precision: el-aleph, fictions → verify slice isolates) · **2 stubs** (latour, naess — corpus fix) · **1 needs-steward** (works-eliot empty-frontmatter, Charles-vs-T.S.-Eliot) · **17 correct** (fingerprint-negative edition/translation/OCR/garbled-source noise). FP rate ≈ 3.4-4% of 321, consistent with the N=40 ESCALATE. **RATIO HOLDS: every corpus fix is FIX-class** (re-point/graduate); the one gate-change (author_disagrees blindness) was already the Axis-A PROPOSAL — the two-tier path is real, not decorative. **APPLICATION HELD** until the persistence layer is ratified (jurist sequencing: pin the corrections with attestation, else they revert).
**Next: ITEM 3 — Wikidata coverage measurement** (~100 reps through reconciliation; needs web/reconciliation API).

### PENDING-47 — ITEM 3 (Wikidata coverage) MEASURED 2026-07-04. Doc: `_curation/wikidata-coverage-measure-2026-07-04.md`.
n=100 random non-Loeb, structured query (title + author-P50, no type). **AUTO 27% · CANDIDATE(review) 34% · NONE 39% · usable-ceiling 61%.** **Measure-don't-trust applied to the measurement itself:** a first pass read 2% auto → caught as a QUERY ARTIFACT (flat "{title} {author}" concat + written-work type-constraint crushed scores); structured query → 27%. Had I reported 2% I'd have understated Wikidata as badly as the sweep overstated it. Caveats: "confident"≠"correct" (reconciler confidence, human-confirm before trust — enrichment-OK, anchor-NO); coverage tracks composition (Western canon reconciles ~100; ancient/translation/essay → NONE). **Confirms the architecture: work_id spine PRIMARY (100%/offline/governed); Wikidata/VIAF = human-in-loop enrichment where they resolve (~27-61%), never load-bearing.**
### PENDING-47 — SEQUENCE COMPLETE (items 1-3 done). ITEM 4 = the work_id/scope-relation/Gate-1-3 pipeline: jurist-ROUTED as its OWN [PROPOSAL], own timeline, NOT build-now (design already specified in work-identity-study + tooling-matrix). Standing, not actioned this session.
**AWAITING STEWARD/JURIST:** (a) jurist ratification of the hash-locality principle (item 1) · (b) jurist ratification of the work-identity study/tooling matrix + steward auth to open item-4 as its own PROPOSAL · (c) steward call on when to apply the held FIX-list (after item-1 pin ratifies) incl. the meditations reconcile + works-eliot disambiguation + the 2 scope-under-coverage bounded-vs-resource calls. All artifacts UNCOMMITTED.

### PENDING-47 — HASH-LOCALITY RATIFIED + FIX-LIST APPLIED + COMMITTED 2026-07-04
**Jurist RATIFIED** the hash-locality principle + distinct naming + confirmed the attested_pin implementation satisfies the condition (read-of-description caveat: 28/28 accepted on report). 2 small notes (not conditions): `against`→real evidence (HONORED — pins carry the Instrument-B N/M); pins carry implicit re-verify-if-method-revised.
**FIX-LIST APPLIED (steward "Yes"):** 5 verified FP re-points PINNED to the **permanent Chamber Sources home** (steward correction: pin the permanent home, not the transient library path) with real Instrument-B `against` evidence — the-odyssey, montaigne, lhomme-tome-1, suzuki, berger (5/5 or 4/5). **ARCHIVE-CONTAMINATION FINDING (steward's permanent-home reminder surfaced it):** the FP contamination had reached the permanent archive — `archive_sources.py` had copied WRONG sources under right slugs + `dest.exists()` locked them in; 5 CS copies were the wrong source (0/5) → force-replaced with verified-correct (governed rezip/sha, manifest `corrected-2026-07-04`). **Implication: full archive↔matches reconciliation owed post-gate** (contamination likely in every archived FP). **DEFERRED:** 2 CS-corrected-but-pin-deferred (orthotypo-vol-2, semaison — NO frontmatter, a new corpus-integrity defect beyond the 4 stubs); 4 needs-locate (reverie needs FRENCH ed, meditations/ecrits/nietzsche not on disk — no correct source to pin; the pin mechanism has NO exclusion path → these persist as algorithmic-FPs until an exclusion path or the Axis-A gate). **COMMITTED + PUSHED** the day's chamber-library work (stress-test artifacts, persistence layer, study/tooling docs, 5 pins). `_scratch/` + the nature-of-order-vol-1 untracked file EXCLUDED (not ours).
**STILL OPEN:** exclusion-path design (for FPs with no correct source) OR rely on the Axis-A gate; the 2 no-frontmatter canonicals' frontmatter repair; the 4 needs-locate source hunts; works-eliot disambiguation; the 2 scope-under-coverage calls; full archive reconciliation; jurist ratification of the work-identity study (item 4).

### PENDING-47 — EXCLUSION PATH (Region 1.1) BUILT + TESTED 2026-07-05 → surfaced for jurist ratification. HELD from real canonicals.
The ratified pin has no way to attest ABSENCE, so the 4 no-source FPs (reverie / meditations / ecrits / nietzsche) fall through to `classify()` and re-derive the algorithmic FP every run. **Built the exclusion path** (test-first, the hash-locality pattern): an attested `source_verified.result` verdict — `confirmed-wrong` | `none-on-disk` — makes `match_sources.py` emit NO confirmed link (never the FP), routing the canonical to needs-locate. Same attestation shape + guard the jurist ratified: a bare / pipeline / unrecognized verdict is NOT honored (**positive attestation of absence, never a default**). Emits an auditable `excluded` record (`conf:"excluded"` → `archive_sources.py` ignores it by its `conf=="high"` filter, verified — no archiver change).
**PROOF:** 37/37 tool self-tests (7 new exclusion cases: the two verdicts · both positive-attestation guards [pipeline / unattested] · incomplete-attestation · unrecognized-verdict · presence-pin regression · nested-frontmatter parse). The 5 existing presence pins still honored. **Full real-corpus matcher run byte-identical** (source-matches.json + report unchanged) → INERT until an exclusion is declared → ZERO regression (the pin layer's "0 pins → inert" proof).
**Files (uncommitted, held for review):** `scripts/match_sources.py` (`attested_pin` generalized to `{kind: pin|exclusion}`; `main` splits pinned/excluded + EXCLUDED report + `excluded` json record), `scripts/test_tools.py` (+`test_source_match_exclusion`), `_curation/graduation-spec.yaml` (`source_verified.result` documented — generative-from-spec).
**FOR THE JURIST (ratify the pattern, as with hash-locality):** (1) attested-absence via a `result:` verdict on `source_verified` — right shape? (2) the verdict vocabulary `confirmed-wrong` / `none-on-disk`, kept distinct for auditability (the V-SUSPECT/V-NONE-distinctness spirit, condition 6). (3) the auditable `excluded` json record (honest-degradation: the exclusion is visible in the data layer, not silent) vs report-only. (4) once ratified, is applying it to the 4 real FPs `[agentic]` (the FIX-list = Region 1.2), or does each attestation need its own beat?
**HELD:** not applied to any real canonical yet — the exclusion attestations for the 4 FPs (with real Instrument-B `against` evidence) are the FIX-list application (Region 1.2), sequenced AFTER the jurist ratifies the pattern (hash-locality sequencing: ratify pattern → then pin/exclude).
**Awaiting:** jurist ratification of the exclusion pattern (steward relay) → then Region 1.2 (attest + exclude the 4 FPs, regenerate, verify the FPs are gone). Also still open: the 4 needs-locate source hunts (Region 2), the 2 no-frontmatter repairs + stubs (Region 3), works-eliot + the 2 scope calls (steward), full archive reconciliation, item-4 work-identity.

### PENDING-47 — EXCLUSION PATH: JURIST RULING RECEIVED 2026-07-05 → RATIFIED-WITH-CORRECTIONS; §1 corrections APPLIED (Phase A). Region 1.2 unblocked.
Jurist disposition: **ratified with two required §1 corrections** (not as-submitted). §2 vocabulary ratified (**closed-but-extensible**: a 3rd verdict under the same guard is D-1). §3 emission ratified (the auditable `excluded` record; report-only rejected — the JSON is the durable record). §4: Region 1.2 = `[agentic]` batch, **no per-instance re-gating**, with a **diff-before-commit legibility check**. Cross-ref: same doctrine as the Studium V0 ruling today (a verdict never claims more than what was attested; the process that produced an error never attests its own correction — `conversion-pipeline` excluded as attestor ≙ "never the generating model checking itself").
**§1 CORRECTIONS APPLIED (Phase A — mechanical / D-1):**
1. **Exclusion moved to its OWN top-level key `source_excluded:`** — not a `result:` verdict inside `source_verified:` (which asserts the opposite of what an exclusion means). Shared guard `_valid_attestation()` (defined once, can't drift), two honestly-named keys — the `sectionless:` precedent followed literally.
2. **`result: verified` now REQUIRED explicitly on `source_verified:`** (no default-by-absence, even for presence) → **the 5 existing pins migrated** (one line each: the-odyssey / montaigne / lhomme-T1 / suzuki / berger).
**PROOF:** 37/37 tool self-tests green under the corrected schema (source_excluded block · result:verified required · co-present exclusion-precedence · unrecognized-verdict refused). Matcher run: **5 pins still honored**; `source-matches.json` + report **byte-identical** → corrections + migration clean, zero regression.
**Files (uncommitted, held for review):** `scripts/match_sources.py` (`_valid_attestation` shared guard + two-block `attested_pin`), `scripts/test_tools.py`, `_curation/graduation-spec.yaml` (`source_verified.result` required + `source_excluded` block, closed-but-extensible note), + 5 canonical frontmatters (`result: verified`).
**REGION 1.2 (now `[agentic]`, diff-before-commit):** attest + exclude the 4 FPs — reverie (`confirmed-wrong`: on-disk *Poetics of Reverie* is English, canonical needs the French — Instrument-B mismatch evidence) + meditations / ecrits / nietzsche (`none-on-disk`: inventory-search absence). Regenerate `source-matches.json`, then **surface the diff (4 `against` strings + before/after json) before commit**. **One methodological point to settle first:** the adequate `against` for a `none-on-disk` attestation — there is nothing to fingerprint, so the evidence is a negative inventory search (`by: manual` + a documented search), vs the confirmed-wrong case (Instrument-B fingerprint mismatch).
**Awaiting:** steward go for Region 1.2 (+ the none-on-disk evidence standard). Still open beyond: Region 2 source hunts, Region 3 repairs + stubs, works-eliot + the 2 scope calls, full archive reconciliation, item-4.

### PENDING-47 — REGION 1.2 APPLIED 2026-07-05 (steward approved the diff "reads right"). The 4 FPs excluded. COMMITTED.
**All 4 FPs attested `source_excluded: confirmed-wrong`** — verifying against the substrate CORRECTED the map's "3 none-on-disk": each had a concrete wrong on-disk candidate the matcher was picking — reverie → Poétique de l'**espace** (same-author-wrong-work, `suspect=False`, the exact blind spot this arc exists to catch); meditations → Bourdieu *Pascalian Meditations*; ecrits → *Écrits radiophoniques*; nietzsche → *A Nietzsche Reader*. **Real evidence:** Instrument-B **0/5 probe-windows (frac 0.0)** for each — the canonical's prose wholly absent from the matched candidate. Regenerated `source-matches.json`: the 4 → excluded records (conf `excluded`, no link, routed to needs-locate); **every OTHER of the 315 records byte-identical** (change provably bounded to the 4). 37/37 tests. Noted: the 4 canonicals lack a `source:` field — a pre-existing frontmatter gap (feeds the sweep below).
**COMMITTED** the exclusion-path arc (§1 corrections + 5-pin migration + 4 exclusions) — chamber `b9a5d05`. **⚠ PUSH BLOCKED:** chamber's remote is `git.skemantix.com` (Seb's Gitea, not GitHub); web returns HTTP 200 but `git push`/`ls-remote` hang at the git backend even fail-fast (not credentials — osxkeychain configured). Known-flaky remote (cf. the 2026-03 handoff "ask Seb to restart Gitea"). Commit is safe locally; **retry `git -C ~/_Dev/chamber-library push origin main` when the server recovers** (or ping Seb). dotfiles committed+pushed to GitHub as usual.
**Region 1 (the non-Loeb FP loop) is CLOSED for the known cases:** 5 pinned, 4 excluded. The *correct* sources for the 4 remain needs-locate (Region 2). REVIEWED entry still owed.
**NEW WORKSTREAM (steward-surfaced 2026-07-05): frontmatter sweep at scale.** The v2 frontmatter spec (`graduation-spec.yaml`) was defined recently, well after most works entered the library → ~1,073 lack v2 frontmatter (+ the 4 FP canonicals' missing `source:`, + Region 3 no-frontmatter/stubs). **[needs-authorization]** — scope-first: a read-only gap census against the spec + a migration plan surfaced for authorization BEFORE touching files. **Honesty constraint (load-bearing):** provenance fields (`source`, `converted_with`, `date_converted`, `source_verified`) cannot be mass-fabricated for works whose provenance isn't known — derive the mechanical ones, mark the unknown honestly, curate the rest. Same anti-default discipline as the exclusion path.

## PENDING-48 — Studium Engine V0 (verifier contract) — jurist method-gate
**⟶ CLOSED 2026-07-05 — REVIEWED-48 placed by steward (formal close).**
**Date:** 2026-07-05
**Tag:** [PROPOSAL] — routed to the jurist as a **method gate**. This is the *one named exception* to the engine's steward-direct D-1 governance (cluster-a-data-model.md §0; rebuild-plan §8.5, steward-ruled 2026-07-04): V0 defines *what the engine may assert as verified and when it must abstain*, and everything downstream inherits that standard, so the jurist gates the method before V1 (the byte-existence checker) is built against it.
**Summary:** The V0 verifier contract + pre-registration is drafted (`studium-engine/docs/spec/v0-verifier-contract.md`, DRAFT). It fixes the claim taxonomy (quoted / constructed / synthesized / ungrounded → verdict registers) and — before any validation data is seen — the pre-registered thresholds for the multilingual/archaic validation (V2). Its D-1 companion, the N0 navigation-tree contract (`docs/spec/n0-navigation-tree-contract.md`), is written together with it (not jurist-gated); N1 may proceed while V0 sits with the jurist. **No V1 code written; the executor holds at this boundary.**
**Two decisions surfaced for the jurist's gate (leans given, not decided):**

1. **§2 — the definition of "unaltered" (the held literal question; may be doctrine).** The quoted-tier check asks "do these exact words exist, unaltered, at this anchor?" but `text_original` is byte-faithful (long-s, ligatures, original spelling), so byte-for-byte would reject legitimate modernized quotes. Candidate equivalence relations: **(A)** exact bytes (too strict) · **(B)** `normalizer@1` classes (NFC · ſ→s · 7 ligatures · soft-hyphen · whitespace-collapse — the *index* transform) · **(C)** (B)+diacritic-fold (the *search* transform; wrong for a fidelity assertion — é≠e in French/German/Greek). **Executor lean: (B)**, with three conditions — the relation is *versioned and named in the verdict* ("the bound names the equivalence relation"), a near-match under any looser relation verdicts `altered` never `guaranteed`, and diacritic-folding stays out of the fidelity tier. **Jurist ask:** (a) ratify (B) or rule otherwise; (b) rule whether setting/evolving `normalizer@N` for the *guaranteed* tier is D-1 engineering or **doctrine** requiring jurist sign-off per version; (c) confirm diacritics stay out; (d) confirm the surfaced boundary case — **hard-hyphen line-breaks** are a source-cleaning concern, not the checker's to absorb (the checker must not guess dehyphenation).
2. **§5 — the pre-registered V2 thresholds.** Per (language, tier): primary safety metric = **false-accept rate** on adversarial negatives (injected known-bad: meaning-reversal / near-miss / wrong-span / whole-for-part / translation-as-original), graded on the **one-sided 90% Clopper-Pearson upper bound** (the CI-not-point-estimate rule ratified on PENDING-47), with the underpowered top-up. Pre-committed outcomes: **trust** (U ≤ 5% AND recall ≥ 0.75) / **revise** (5% < U ≤ 15%) / **gate-to-abstain** (U > 15% or no gold → that language's synthesized claims `cannot-verify` by default — honest degradation, a valid completion). **Small-n honesty stated up front:** with the current gold (German ~15–20; French Mauss 17 + Weil; English 26/39) several cells may not reach *trust* even at zero observed false-accepts; the *trust* lever is more adversarial negatives (pre-registered before generation), and a gate-to-abstain is a pre-committed valid result, not a failure. Tier-1 has no statistical bar (decidable) — validated by the deliberate-mismatch suite + orthography tests. **Jurist ask:** ratify the thresholds (5%/15%), the CP-upper-bound application, the small-n disposition, and the adversarial-negative taxonomy; rule what (if anything) is doctrine vs method-engineering.

**Authority for the routing:** rebuild-plan §8.5 (steward-ruled 2026-07-04) — V0 is the one D-1 exception; D-1 stays intact for all other engine decisions (incl. N0, N1).
**Files affected:** `studium-engine/docs/spec/v0-verifier-contract.md` (V0 DRAFT — revised on the ruling before V1) · `docs/spec/n0-navigation-tree-contract.md` (N0, D-1, informational) · `~/PENDING.md` (this entry). Written, **uncommitted** — held for steward review + push on the steward's word.
**Awaiting:** jurist method-gate on §2 (the "unaltered" relation + its D-1-vs-doctrine status) and §5 (the pre-registered V2 thresholds), via steward relay. On a clean gate → build V1 to the ratified relation + the deliberate-mismatch suite. On a reshaping ruling → revise V0 before V1. N1 (tree builder) may proceed in parallel under D-1.

### PENDING-48 — JURIST GATE CLEARED 2026-07-05 (steward relayed). CLOSED — REVIEWED entry owed.
**Disposition: gate clears on both §2 and §5, with conditions.** V1 and V2 unblocked. Ruling folded into `studium-engine/docs/spec/v0-verifier-contract.md` (DRAFT → **v1.0 RATIFIED**, new "Ruling" section) + the fork landed at source in `cluster-a-data-model.md` §5.1.
**§2 —** (B) ratified (typographic-convention in, orthography out). Ruled **DOCTRINE, not D-1**, with a code-level consequence: **fork the fidelity relation to `fidelity_equivalence@1`** — a frozen constant distinct from `chunker.normalize()`, so a D-1 retrieval-normalizer change can't silently drag the trust floor; every future `fidelity_equivalence@N` needs jurist ratification, `normalizer@N` (retrieval) stays D-1. Diacritics-out confirmed; hard-hyphen-linebreak confirmed as a cleaning-gate concern (cost lands as recall/abstention, not false trust).
**Cross-cutting flag RESOLVED (executor, verify-before-asking):** gold pairs verified against **modernized** editions — checked the actual source files (Mauss, Weil ×2, Handke all works, March Essay-I): **zero** long-s / fold-ligatures / soft-hyphens; the `œ`/`æ` present (72 in Mauss) are orthographic ligatures `fidelity_equivalence@1` correctly does not fold. ⇒ flag **moot at present gold** (fold clauses inert → "verified" and `guaranteed` can't diverge on glyph grounds). Caveat: reactivates if future gold is drawn from a *diplomatic* edition.
**§5 —** thresholds ratified as stated (5% / 15% / 0.75; jurist independently confirmed `0/15 → U≈14.2%`). Gate-to-abstain ruled doctrine-**consistent** (refusing the contamination failure mode in advance), not merely tolerated. **Added condition:** negatives-expansion must preserve the original proportional distribution across the five adversarial classes, or pre-register a new distribution before generating. Doctrine = the threshold *values*; D-1 = the CP calc / perturbation code / gold-pair selection. **Coupling recorded (not resolved):** the 5%/15% values are calibrated with the §1 rule-3 evidence-first display guarantee — weakening that display (e.g. a future UI showing a bare scalar) requires re-gating the thresholds.
**Files touched (recording the ruling):** `studium-engine/docs/spec/v0-verifier-contract.md` (v1.0 + Ruling), `docs/spec/cluster-a-data-model.md` §5.1 (the fork at source), `~/PENDING.md` (this close). **Still uncommitted** — held for steward review + push.
**Next (unblocked):** V1 (`verify-quote`) against `fidelity_equivalence@1` + the §3 deliberate-mismatch suite; N1 (tree builder) in parallel. Standing conditions carried into the build: the §5 display-coupling, the proportional-expansion rule, the diplomatic-gold caveat.
**Owed:** a REVIEWED-N entry (steward/jurist) recording this ruling — same as the PENDING-46/47 arc.

## PENDING-49 — Library-science frontier brief → jurist doctrine pass (constitutional-grade adoptions)
**Date:** 2026-07-05
**Tag:** RESEARCH / SCOUT — surfaced for the jurist's **doctrine pass** (contains NO proposals yet; the PENDING-22 pattern). Each advanced adoption becomes its own `[PROPOSAL]` → spec amendment via the ratified RFC-supersession process (PENDING-46 gap-7). **Steward-flagged 2026-07-05:** "this will touch the constitution — the jurist will need to see this and give a ruling."
**Summary:** An adversarially-verified deep-research pass on the 2024–26 library-science frontier (`chamber-library/docs/library-science-frontier-brief-2026-07-05.md`; 28 sources, 24/25 claims confirmed, 1 refuted). Headline: the field mostly *confirms and names* what the Chamber already is; the Chamber is at or ahead on its central mechanisms; the frontier is thinnest exactly where the Chamber is most novel. But several adoptions **touch the ratified v2.0 constitution** and must go through the amendment loop before any spec change.
**What touches the constitution, by level (the structured question for the jurist):**
- **A — DOCTRINE-level (needs the jurist's doctrine pass):**
  1. **IFLA-LRM `Agent` + `Nomen` entities** — extends the §III addressing spine / work-identity model (couples to PENDING-47 item-4); a model amendment (voices as first-class entities; name-as-entity disambiguation).
  2. **Perspectival-classification licence (Berman→Olson)** — the epistemic *status* of the curation/classification scheme (the "unapologetically partial, names-its-viewpoint" stance); a preamble/thesis-level doctrine question.
  3. **CoreTrustSeal-level self-audit as the trust baseline** — the corpus's own trust-attestation posture (the spec's central thesis is trust-by-design); a governance-doctrine adoption + a succession/inheritability instrument.
  4. **Refuted-claim correction (record it):** the warrant for the Chamber's bounded, curated-for-one-steward *scope* comes from **critical classification (A2)**, NOT from the Santa Barbara "collections as data" statement (that claim was refuted, 1-2). Which pillar justifies the scope is a doctrinal precision the jurist should fix.
- **B — SPEC-AMENDMENT gap-fill (lighter; FIX/PROPOSAL under the amendment process):** machine-readable `licence`/copyright status as a frontmatter field (graduation-spec.yaml, gap-filling); **PREMIS** as the borrow-vocabulary name for the preservation-metadata layer; "collections as data" as the framing term (near-zero spec change).
- **C — already in a governance loop (don't re-route):** tamper-evident *text* provenance (`[GREENFIELD]`) is the studium engine's V0/`fidelity_equivalence@1` frontier (already jurist-ruled, REVIEWED-48); the VIAF/ISNI reconciliation *discipline* couples to item-4 (PENDING-47, its own routed [PROPOSAL]).
**Honest coverage gaps (from the brief, not to be smoothed):** the AI-cataloging data point (LC ~99% structured / <50% subject) is *indicative, not adversarially verified*; TEI/CTS scholarly-edition tradition came back *under-surveyed* (the "TEI as later tier" plan neither validated nor challenged); Ranganathan faceted classification returned no surviving claim.
**Files affected (on advancement):** `chamber-library/docs/chamber-library-specification.md` (A1/A2/A3 → amendment via supersession) and/or `_curation/graduation-spec.yaml` (B, gap-fill); each its own [PROPOSAL] + REVIEWED entry.
**Awaiting:** jurist doctrine pass on the A-items (steward relay); confirmation that the B-items run as ordinary amendments; each advanced adoption re-enters as its own tagged [PROPOSAL]. **Nothing amends the spec until then.**

### PENDING-49 — RULED 2026-07-06 (REVIEWED-49; jurist doctrine pass). Execution sequenced AFTER the MEMORY.md compaction.
Disposition (verbatim capture + executor action-list: `chamber-library/docs/library-science-adoptions-RULING-2026-07-06.md`; steward places the canonical REVIEWED-49 in `~/REVIEWED.md`):
- **A1** — advance as an **ADDITIVE registry** (Agent/Nomen joined by appellation to author-name strings; **no per-work field**) → **the frontmatter sweep is UNBLOCKED** on the current schema (FIX; no double-touch). `agent_id`-required deferred as *emergent* via an A3 registry-linkage metric, not scheduled.
- **A2** — advance as **preamble/rationale** (FIX). Citation-correction: Berman for the narrow claim only; the personal-scheme licence is Olson's stronger move → **verify Olson's primary source (*The Power to Name*, 2002) before drafting**; default (b) (Chamber's own synthesis, attributed to neither) until verified.
- **A3** — advance as **PROPOSAL** (a self-audit conditioning OPERATIVE status is a status-gate = doctrine-class). 3 dims: provenance-completeness (annual) · registry-linkage-completeness (annual, double-duty for A1) · legibility-to-successor (every 2–3 cycles); **fixity stays automated/continuous, out of the manual audit**.
- **A4** — record the scope-warrant redirect to A2's preamble (FIX, after A2 lands). **B** — ordinary amendments (word (iii) computational-only). **C** — reconciliation targets the Agent/Nomen registry specifically.
**Executor-owed (verify-don't-assert):** the engine hot-path read (`retrieve.py`) for A1's field-timing; verify Olson's primary source before A2's preamble.
**Steward-sequenced 2026-07-06:** next session = **MEMORY.md compaction FIRST**, THEN execute this ruling. REVIEWED-49 = steward to place in `~/REVIEWED.md` (as with 44–48).

## PENDING-50 — A2: perspectival-classification licence (spec preamble)
**Date:** 2026-07-06
**Tag:** [FIX] change-class — a spec amendment, so it runs the §Governance & Amendment editor-gate (executor drafts → jurist editor-gates format + doctrinal soundness → steward ratifies). **Filed for that gate, NOT for direct implementation.** The spec is never edited in place; this lands by supersession/errata lane after ratification. Advances REVIEWED-49 A2.
**Summary:** Drafted preamble grounding the corpus's owned/partial arrangement, per REVIEWED-49 A2.

**Reading settled — (b), earned from the primary source (not the scout).** Read Olson *The Power to Name* ch. 6 "Toward Eccentric Techniques" closely against the **scan image** (the proposal chapter — where the licence would live if anywhere). Olson does **not** license constructing a declared self-standing personal partial scheme; her first principle expressly cautions against it: *'make breaches in the limit — make it permeable rather than redefining it or constructing a new limit'* (book pp. 227/238, scan-verified). Every concrete alternative keeps the universal in play (the Luiseño Culture Bank runs *alongside* augmented LCSH — 'two cultural perspectives'; local policies are precedence tweaks within DDC). Attributing the self-standing-scheme move to Olson would repeat A4's error. **(a) rejected; (b) adopted:** Berman for the narrow 'bias is real, own it' claim; Olson for the eccentric/perspectival move *as she makes it*; the self-standing scheme = the Chamber's own synthesis, attributed to neither.

**Scan cross-check (A4-error guard):** all load-bearing quotes verified against the scan image (PDF pp. 236–252 = book pp. 224–240; offset +12). No meaning-shift OCR-vs-text; the only glyph-shift is the Greek — OCR `EKKEVTPOS` = scan **ἔκκεντρος** (immaterial; not quoted in the preamble).

**Proposed placement:** a new subsection under §I (The trust thesis) — the foundational "why," where the boundedness=trust thesis already lives; tag `[NEW — A2 · REVIEWED-49]`.

**Proposed amendment lane (jurist's call):** substantive-but-non-normative (no gate change) — either the **Held-for-Update errata lane** or a **v2.0.1 patch supersession**. Adds a doctrinal subsection (not a typo), so executor leans patch-supersession; defer to jurist per §Governance & Amendment.

**Drafted preamble text (house voice; (b); single-quotes; Canadian spelling — a draft for the jurist's editor-gate and the steward's voice):**

> ### On the partiality of the arrangement  `[NEW — A2 · REVIEWED-49]`
>
> This library does not pretend to a neutral or universal order. Its division of texts into traditions is an *owned* arrangement — partial, situated, answerable to the hand that built it — not an approximation of a view from nowhere. This is stated, not concealed, because a classification that hides its own standpoint is the more dangerous kind: it lends the borrowed authority of neutrality to what is in fact a set of choices.
>
> That no classification is neutral is not this library's discovery. Sanford Berman showed a generation ago that the standard subject languages carry the prejudices of their makers, and that the honest response is not to chase a corrected 'neutrality' that cannot exist but to own the bias and make it legible (*Prejudices and Antipathies*, 1971). Hope Olson carried the argument into classification itself: that naming can be *eccentric* — 'looking/moving toward the limits rather than toward the centre of a system' — and that the cataloguer's situated judgment, informed by a particular collection and its readers, is a legitimate ground for how a thing is placed (*The Power to Name*, 2002).
>
> This library takes their spirit and makes a move that is its own. Berman and Olson worked to make the *public, universal-aspiring* catalogue permeable from inside — Olson's first principle is expressly to 'make breaches in the limit … rather than redefining it or constructing a new limit'. This library instead constructs its own limit, openly, because it is a *bounded, personal* collection: its boundary is not a failure of coverage to be apologized for but the very thing that makes the corpus checkable, and so trustworthy (§I). Where a universal catalogue must not construct a new limit, a bounded one must — and must say so. What is offered here is one reader's owned arrangement of what Olson called 'the found objects of our art' — not a claim about how knowledge itself is shaped.

**Files affected (on ratification):** `chamber-library/docs/chamber-library-specification.md` (§I new subsection; version treatment per lane call). No code/gate change.
**Awaiting:** jurist editor-gate (format + doctrinal soundness) + steward ratification, per §Governance & Amendment. A4's scope-citation redirect is sequenced after this lands.

**RULED + LANDED 2026-07-07 (REVIEWED-50).** Editor-gate PASSED (doctrinal soundness approved; §2 trust-thesis bridging clause ADDED — distinguishes *arrangement-honesty* from §I's *fidelity* sense of trust; §3 "must" confirmed conceptual-entailment, FIX-class holds; no A4 leakage). Placement **§I CONFIRMED**; lane **CONFIRMED v2.0.1 patch supersession**. **LANDED:** `chamber-library-specification.md` bumped v2.0.0→v2.0.1 (§I subsection added, header supersession note); v2.0.0 archived immutable (`chamber-library-specification-v2.0.0.md`, byte-identical); chamber `CLAUDE.md` version pointer updated. Steward places REVIEWED-50 in `~/REVIEWED.md`. chamber-library committed `34c39f1` (Gitea). **NEXT: A4 scope-citation redirect** (now that A2 has a ratified home to point to), then the REVIEWED-49 tail; then the verification-architecture `[PROPOSAL]` (steward-sequenced priority).

## PENDING-51 — A4 + B(iii): the corpus-as-data framing term, and the scope-warrant it does not carry (one coupled §I subsection)
**Date:** 2026-07-07
**Tag:** [FIX] change-class — a spec amendment, so it runs the §Governance & Amendment editor-gate (executor drafts → jurist editor-gates format + doctrinal soundness → steward ratifies). **Filed for that gate, NOT for direct implementation.** The spec is never edited in place; this lands by v2.0.1→v2.0.2 patch supersession after ratification. Advances REVIEWED-49 · A4 + B(iii). Sequencing precondition MET: A2's preamble landed (REVIEWED-50, `34c39f1`), so A4 now has a ratified home to point to.
**Summary:** One new §I subsection that (B(iii)) introduces 'collections as data' into the spec as a framing term worded **computational-tractability sense only**, and (A4) records — in the same breath — that this framing does **not** supply the corpus's bounded/personal scope warrant; that warrant is the A2 partiality preamble, not the Santa Barbara Statement's Principle 4.

**Diagnosis (verify-against-the-substrate, not the brief):** grep of the live spec (`chamber-library-specification.md`) for `collections?[ -]as[ -]data` returns **zero hits** — the phrase, and the refuted Principle-4 scope-citation, are present only in the research briefs and the RULING, never in the constitution. So **A4 is preventive/recording, not a redirect-in-place** (there is no bad citation in the spec to move); and **B(iii) is the first entry of the term into the spec.** They are logically one edit — A4 is the boundary-clause on B(iii)'s introduction — so they land as one subsection, honouring the RULING's flag ("(iii)'s text must use 'collections as data' only in the computational-tractability sense; do not reintroduce the refuted scope-justification through drafting"): the boundary is written *into* the introduction.

**Proposed placement:** a new subsection under §I (The trust thesis), immediately **after** 'On the partiality of the arrangement' (the A2 preamble it points to). Tag `[NEW — A4 + B(iii) · REVIEWED-49]`.

**Proposed amendment lane:** **v2.0.1 → v2.0.2 patch supersession** — same shape the jurist confirmed for A2: substantive-but-non-normative (adds a doctrinal subsection, not a typo → not the errata lane; no gate change → not a MAJOR re-verify). Rationale text only; **no consumer re-verification.** Defer to jurist per §Governance & Amendment.

**Drafted subsection text (house voice; single-quotes; Canadian spelling; British punctuation — a draft for the jurist's editor-gate and the steward's voice):**

> ### The corpus as data — and the warrant it does not carry  `[NEW — A4 + B(iii) · REVIEWED-49]`
>
> *§I grounds the library's trustworthiness in fidelity; the subsection above grounds the arrangement's trustworthiness in owned partiality. This subsection names, in the field's own vocabulary, what the corpus is built to be — and marks one boundary that vocabulary does not cross.*
>
> In the language of library science, the Chamber is a **collection as data**: a corpus shaped so that a reasoner — the Studium Engine — can compute over it directly, not only a shelf for human reading. The Santa Barbara Statement on *Collections as Data* names, in the field's terms, the posture this spec already enforces by other means — its Principle 8 grounds trust in 'the technical integrity of the data as well as its provenance' (§IV–§V) and requires stewards to 'acknowledge absences and areas of uncertainty' (§IX's coverage-ledger and honest-degradation disciplines). The term is adopted as **framing only**: it says what the corpus *is to the field*. It adds no gate and changes nothing any gate accepts.
>
> Its reach is bounded in one respect, recorded here so it cannot later be over-drawn. 'Collections as data' warrants the corpus's **computational tractability** — its fitness to be read by a machine. It does **not** warrant the corpus's **bounded, personal scope.** That warrant is the owned partiality named above (Berman, Olson). The Statement's Principle 4 ('collections as data designed for everyone serve no one') is sometimes enlisted for it, but Principle 4 concerns a different thing — designing a collection *for* an intended community of use — not the epistemic standing of a bounded, personal curation; a deep-research review (2026-07-05) found the scope-licensing reading refuted by two of three independent verifiers. The scope rests on a declared standpoint, not on a data-posture; the two pillars are kept distinct so that neither borrows the other's authority.

**Primary-source verification (2026-07-07 — steward-directed 'verify now', before the gate):** fetched the primary Santa Barbara Statement (`collectionsasdata.github.io/statement`). **Principle 8 CONFIRMED verbatim** — 'the technical integrity of the data as well as its provenance' + 'acknowledge absences and areas of uncertainty' (draft now anchored to these exact phrases). **Principle 4 CORRECTED** — verbatim it reads 'Collections as data designed for everyone serve no one. Specific needs inform collections as data development'; it *does* concern designing for specific communities, but as **audience-fit of a data product**, not the **epistemic warrant for a bounded/personal curation**. The brief's flat shorthand ('does not license scoping to one named community') was imprecise against the primary; the draft now states the precise distinction (audience-design ≠ scope-warrant). A4-shaped error avoided on my own draft by reading the source. Relay brief for the editor-gate: `chamber-library/docs/library-science-A4-Biii-FOR-JURIST-2026-07-07.md`.

**Files affected (on ratification):** `chamber-library/docs/chamber-library-specification.md` (§I new subsection + header supersession note, v2.0.1→v2.0.2); freeze `chamber-library-specification-v2.0.1.md` (byte-identical immutable); chamber `CLAUDE.md` version pointer. No code/gate change.
**Awaiting:** jurist editor-gate (format + doctrinal soundness) + steward ratification, per §Governance & Amendment. On ratification → land by patch supersession, tag commit REVIEWED-51. This closes the A4 + B(iii) items of the REVIEWED-49 action-list; remaining tail = A1 registry (hot-path read first), A3 PROPOSAL, B(i)/(ii), C reconciliation-target.

**JURIST EDITOR-GATE RULING 2026-07-07 — PASSES 1/2/4/5 as drafted; Q3 gated on one fact, now CONFIRMED (verbatim ruling: `chamber-library/docs/library-science-A4-Biii-RULING-2026-07-07.md`).**
- **Q1 (audience-design ≠ scope-warrant):** sound, confirmed as drafted — "different *kinds* of claim" (Principle 4 instrumental / scope-warrant normative); the primary-source correction is "the right level of precision."
- **Q2 (no leakage):** confirmed, "stronger than a minimal pass" — naming Principle 4 to refute it in the same breath is the safer construction (pre-empts a future reader making the association independently).
- **Q3 (§IX cross-ref):** ruled *confirm-don't-default-soften.* **Executor confirmed by §IX substrate read → Case A:** §IX's own `Still open` text settles census→coverage-ledger, evidence-tier column, and the freshness invariant (honest-degradation named verbatim there); leaves open ONLY silence-as-finding, explicitly separated. Both cited terms independently live, neither entangled → **citation stands exactly as drafted, both terms, NO edit** (one-word fallback not triggered).
- **Q4 (placement + lane):** confirmed, no redirect — §I-after-A2, v2.0.1→v2.0.2 patch supersession.
- **Q5 (voice):** no changes required — single-quotes / Canadian spelling / British punctuation clean; 2-of-3 hedge appropriately non-unanimous.
**STATUS: gate fully passed; draft final (no edit). Ratification pending — steward places REVIEWED-51, NOT pending revision.** On ratification the executor lands: freeze `chamber-library-specification-v2.0.1.md` (byte-identical immutable) → bump canonical v2.0.1→v2.0.2 (subsection after the A2 preamble + header supersession note) → chamber `CLAUDE.md` pointer → commit tagged REVIEWED-51 (Gitea; steward's commit call).

**RATIFIED + LANDED 2026-07-07 (steward ratified; REVIEWED-51).** Committed `7d1d8d3` (local; not pushed — steward's Gitea call). v2.0.1 frozen byte-identical (`cmp`-verified, 763 lines) → `chamber-library-specification-v2.0.1.md` immutable; canonical bumped v2.0.1→v2.0.2 (subsection *'The corpus as data — and the warrant it does not carry'* after the A2 preamble + v2.0.2 header supersession note); chamber `CLAUDE.md` pointer updated. **Bounded-diff verified** — canonical change = exactly the title tag + header note + the new subsection; CLAUDE.md = only the pointer line. Audit trail committed: `library-science-A4-Biii-{FOR-JURIST,RULING}-2026-07-07.md`. REVIEWED-51 draft left on steward's Desktop for placement in `~/REVIEWED.md`. **Closes A4 + B(iii).** REVIEWED-49 tail: A1 registry (retrieve.py hot-path read first), A3 PROPOSAL, B(i)/(ii), C reconciliation-target.

---

## PENDING-52 — Wire source-archiving into graduate_to_canonical (enforced graduation step)
**Date:** 2026-07-09
**Tag:** [PROPOSAL]
**Summary:** Make source-archiving an *enforced* part of graduation — `graduate_to_canonical.py` files the source via `archive_sources.py --add`, and the graduation gate refuses a candidate whose source is not in Chamber Sources — closing the `conversion-runbook.yaml` `source_provenance.going_forward` TODO (steward directive 2026-07-02).
**Rationale:** The 2026-07-02 directive made source-archiving "a step of graduation, not a separate pass," but the *enforcement* was never built — so it depends on the executor remembering to archive. The 2026-07-09 Handke graduation proved the failure mode exactly: without enforcement, archiving got framed as a "loose end" and nearly deferred, and the source sat in the wrong place (`converted_texts/`, the .md inbox). An enforced gate makes "every new canonical work arrives WITH its source filed" a structural guarantee, not a discipline — the honest-degradation principle applied to the graduation rail: refuse to call a work graduated until its provenance is filed.
**Change-class:** PROPOSAL — it adds a precondition to *what graduation accepts* (FIX→PROPOSAL per the amendment process when gate acceptance changes). The building block (`archive_sources.py --add`, manual-archive shape) is already built (FIX, landed 2026-07-09; test_tools 68/68).
**Options:**
1. **Gate-enforced (recommended):** `graduate_to_canonical.py` archives the source via `--add` (source path resolved explicitly or from a `pending-graduation/` staging area), and the graduation gate asserts a Chamber Sources manifest entry exists for the slug — refuses otherwise.
2. **Tool-coupled, not gate-enforced:** graduate_to_canonical archives but the gate does not check — cheaper, re-opens the "remembered, not enforced" gap.
3. **Manual + checklist (status quo):** leave `--add` a manual runbook step. Honest, but relies on discipline (the very gap that bit today).
**Recommendation:** Option 1 — the only one that makes the directive structural. The one real design question: *how graduation learns the source's location.* The `source:` frontmatter names the original filename but not its path; a small convention is needed — likely a `pending-graduation/` staging area (mirroring the existing `Chamber Sources/pending-graduation/`) the gate resolves from.
**Files affected:** `scripts/graduate_to_canonical.py`, the graduation gate (`scripts/verify_graduation.py` or the `graduation-spec.yaml` gate list), `_curation/graduation-spec.yaml` (the new precondition), `_curation/conversion-runbook.yaml` (currency). No change to the verbatim guarantee or the fidelity relation.
**Awaiting:** Steward authorization + jurist review (it touches the graduation gate — the chamber's governed boundary).

**JURIST-RULED + STEWARD-AUTHORIZED + BUILT 2026-07-09 → REVIEWED-52.** Design closed through a 4-document jurist exchange (mechanism draft → repo-evidence ruling → final reconciliation); the executor's repo-evidence *replaced* the original filename-lookup design once the staging area's real shape surfaced (its own `pending-manifest.json`; the staging slug is **author-first** while canonical is **title-first**). Steward authorized; built + tested same session.
- **Resolution:** via `pending-manifest.json`'s **`canonical_slug`** field (matched per-candidate, **never** bulk-copied from the staging `slug` nor the note's "intended canonical slug" language — jurist's sharpened constraint; the 14 legacy entries untouched until each comes up).
- **`archive_sources.py`:** `resolve_pending_source` + `manifest_has`; `--add` idempotency — no-op on sha match, `ARCHIVE CONFLICT` (exit 2) on same-slug/different content (jurist §4).
- **`graduate_to_canonical.py`:** `source_gate()` = gate zero — archive-first, verify-the-entry-landed (don't trust the return, §3.3), refuse otherwise; the old NOT-WIRED warning is now the wired confirmation.
- **`graduation-spec.yaml`:** declarative `preconditions: source_archived`.
- Tests 68→**73/73**; dry-run clean. Chamber commit **`4be2265`** (local; Gitea push steward's call).
- **Parked separately (jurist §3, not folded in):** is the graduated corpus uniformly title-first or genuinely mixed? Per-candidate resolution is robust either way.
- **Full FIX for graduate_to_canonical's follow-on line:** `body_word_conservation` (the 3rd declared gate, still "tracked as follow-on, not yet enforced") is untouched here — out of PENDING-52 scope.
**Awaiting only:** steward placement of **REVIEWED-52** (the authorization record).

## PENDING-53 — Hash-locality principle omits the engine consumer surface (re-anchor spans both repos)
**Date:** 2026-07-09
**Tag:** [PROPOSAL]
**Summary:** Complete the graduation-spec `layers` hash-locality principle to name the studium-engine binding surface (`corpus/manifest.yaml` sha · `corpus/sidecars/*.source_sha256` · `corpus/coverage-ledger.json`) that a chamber-canonical re-hash invalidates — the ratified doc currently lists only chamber-internal bindings, and its `voice_manifest: engine-side; carries NO source hash` line mis-frames the engine as non-binding.
**Rationale:** P1 (2026-07-09, `lenracinement` source-clean) re-anchored chamber `catalogue.yaml` but left the engine's manifest sha + sidecar `source_sha256` + coverage-ledger bound to the OLD sha. The engine `ingest_gate` §1.1 hash-binding would have FAILED `weil-enracinement`, but nothing runs it after a chamber edit and the stale ledger hid it — caught only by chance during P2 diagnosis. Root cause is a governed-doc gap: the ratified hash-locality principle enumerates reading-index + source-match (chamber) and declares the engine voice_manifest hash-free — the exact frame that stopped the re-anchor at the chamber boundary. The engine SOURCE manifest + sidecars DO bind and ARE enforced.
**Change-class:** Documentation-completing in substance (names an existing, enforced binding reality; changes no gate acceptance) — but it touches the RATIFIED graduation-spec, so it runs the loop, not a unilateral edit.
**Already landed (operational, not the ratified spec):** `_curation/conversion-runbook.yaml` gained a `reanchor:` block — the full cross-repo binding surface + the completeness check (grep BOTH repos for the old sha; regenerate the engine ledger via `ingest_gate`; the engine gate is the proof). Born-note cites the Weil incident.
**Options:**
1. Complete the graduation-spec `layers` note to enumerate the engine consumer surface + a cross-repo re-anchor pointer to the runbook `reanchor:` block. *(recommended)*
2. Runbook note only — weaker; the mis-framing line stays in the governed doc.
3. Follow-on tool: a `reanchor` helper that, given a canonical, greps both repos for the old sha, updates all bindings, and runs both gates (a real class-fix; larger; own PENDING).
**Recommendation:** Option 1 now (correct the governed doc's frame + point to the runbook); Option 3 as a follow-on if re-hash/re-anchor recurs across the ~30-source Making batch.
**Files affected:** `_curation/graduation-spec.yaml` (layers/hash-locality note). Runbook already updated. No gate-acceptance change.
**Awaiting:** Steward authorization + jurist review (touches the ratified spec).

**RULED + LANDED 2026-07-10 (jurist ruling; REVIEWED-53).** Disposition: **Ratified — draft §5, disambiguation option (b), with one required wording correction.** Change-class **downgraded [PROPOSAL]→FIX** (documents an existing enforcement surface; adds no gate predicate — same test as PENDING-52). Lane: **lightweight in-place edit**, audit trail sufficient (no freeze/semver).
- **Required correction applied:** "…therefore re-anchors ACROSS BOTH REPOS" (descriptive) → "…therefore **REQUIRES re-anchoring** across both repos" (prescriptive — the gate catches the failure to do it; nothing does it automatically; that IS the incident).
- **Landed** `_curation/graduation-spec.yaml` `layers:` block: `voice_manifest` annotated (⚠ NOT the source manifest) + new **single** `engine_source_binding` key (kept as one entry per the jurist — it names a relationship across three files that must move together; fragmenting recreates the failure) + shared-word `# =>` comment. Dual warning kept (inline ⚠ + block comment — two reading grains). YAML re-parses; bounded diff (6 ins / 1 del). **Uncommitted** (steward's Gitea call, consistent with the held P1 changes).
- **Jurist's proposed lane-rule** ("lane tracks change-class" for `graduation-spec.yaml`, floated to generalize to the `.md` spec) — **executor response, surfaced for the jurist, not decided here:** ACCEPT for `graduation-spec.yaml` (machine-convention-data; FIX→in-place, PROPOSAL→freeze+semver — clean). **NARROW the `.md` generalization:** A2/A4 (REVIEWED-50/51) are a counterexample — those were **FIX-change-class** doctrinal additions to the `.md` spec that correctly took the **heavier** patch-supersession+freeze lane, because REVIEWED-50's operative axis was *"doctrinal content a successor must be able to trace to a dated marker,"* not change-class. So for the `.md` spec the distinguishing axis is **doctrinal-traceability**; it coincides with change-class for machine-data files (no successor-traced doctrine) but diverges for the constitution. Proposed refinement: *"lane tracks whether the change adds/alters successor-traced doctrine"* — which reduces to change-class only for machine-data files.
- **PENDING-47 generalized principle:** ratification **declined** this ruling (relayed text truncated, not read in full). Kept `[awaiting jurist ratification]`. To close it: relay the FULL principle text as its own item / attached to a future brief.

---

## PENDING-54 — EPUB footnote pre-processor (verbatim-safe conversion stage) + mega-EPUB split-convert
**Date:** 2026-07-10
**Tag:** [PROPOSAL]
**Summary:** A new **verbatim-safe pre-processing stage** for EPUB→canonical conversion: recognize footnote structure in the raw XHTML → inject `epub:type` / relocate cross-file note bodies → let **stock pandoc** emit native footnotes (pandoc keeps doing the verbatim text conversion). Replaces the family-of-regexes ("whack-a-mole") chasing pandoc's lossy Markdown output. Includes the proven **mega-EPUB path** (inject → split by whole files → pandoc-per-chunk → concat) that retires the Calibre fallback for "complete works" sources.
**Full brief (for the jurist):** `chamber-library/docs/epub-footnote-preprocessor-FOR-JURIST-2026-07-10.md`.
**Evidence (all reproducible, 2026-07-10):** census of all **253** Chamber Sources EPUBs (≥5 distinct footnote strategies + note-free + index apparatus); pandoc's 2×2 blind spots (no-`epub:type` / cross-file, proven on Kafka/Orwell/Quixote/G&G); prototype **verbatim-clean on 4 books** (G&G 27 · Mauss 628 · Polastron-fr 140 · Jung 1086 — source-level marker-aware guard, 0 prose added/lost); **Calibre shown footnote-blind** (byte-identical output with/without injection — it flattens notes, which is the state of the legacy Jung `.md`); **split-convert proven on Jung** (1579 docs → 20 chunks, 190s, 1086 native footnotes, verbatim-clean vs the ORIGINAL Princeton megavolume).
**Change-class:** [PROPOSAL] — adds a stage to the governed conversion pipeline and bears on the §V verbatim guarantee; changes no gate's acceptance. Runs the loop.
**Bears on:** §V verbatim guarantee + the conversion-record requirement (`converted_with` declares the stage). Splitting is **conversion-internal** — source of record stays the whole megavolume + its sha256 (proven content-neutral).
**Open questions (brief §7):** (1) soundness vs §V — lean-on-pandoc-for-text as the *more* faithful architecture; (2) proof standard — source-level multiset + structural-order argument, or require a sequence diff; (3) markers-as-apparatus under §V; (4) governance placement (fleet tool + `graduation-spec.yaml` note); (5) coverage sequencing (ship mirror-class w/ honest-refuse vs hold); (6) **mega-EPUB provenance representation** — one reconstituted file vs per-volume ("extracted from the megavolume", never posing as a standalone Bollingen edition); governs re-converting the legacy Jung `.md` (0 notes, pre-spec frontmatter) + likely Donne.
**Scope boundary:** covers the bidirectional-mirror class (same + cross file) today; **honest-refuses** the rest (one-directional / container / epub3-cross-file). Prototype is scratchpad/uncommitted — nothing touches the chamber pipeline.
**Files affected (on authorization):** new `scripts/` tool(s) + `graduation-spec.yaml` note (`converted_with` declares the stage) + a §V cross-reference. No gate-acceptance change.
**Awaiting:** Steward authorization + jurist review (touches the conversion pipeline + §V).

**RULED IN PRINCIPLE 2026-07-10 (jurist; REVIEWED-54).** Architecture sound (§1); **markers CONFIRMED apparatus under §V** (§2 — settles an assumption `clean_epub_residue` has run on implicitly; second instance this week of practice ahead of doctrine, opposite direction from PENDING-53); **change-class PROPOSAL confirmed** (§4 — sharpened test: PROPOSAL if it alters a gate's stated criteria *or* the trusted mechanism a critical gate's meaning depends on; this inserts a new component into §V's production chain). **Ship now for the mirror class, CONDITIONED (§5): the existing regex tools (`clean_epub_residue` A–D, `clean_pandoc_html_residue`) stay in place, untouched, as the fallback for uncovered classes — addition, not replacement.** Governance placement (§6): yes — fleet tool + `graduation-spec.yaml` `converted_with` note.
- **REQUIRED before canon (§3) — DONE + proven:** the verbatim guard was a whole-document aggregate (would miss a cross-note swap); now an **id-matched PER-PAIR check keyed by (destination-file, id)**. Re-proven G&G 27 / Mauss 628 / Polastron 140 / **Jung 1086** — 0 mismatch, 0 within-file dup; **teeth demonstrated** (a deliberate two-note id-swap was caught). Surfaced Jung's cross-volume id reuse (81 collisions under a bare-id key) → fixed by the (file,id) key + a further argument for the split.
- **§5 wording cleaned** in the brief (cross-file *mechanism* is covered/proven — relocation on Mauss/Polastron; the Orwell/Quixote *exact shape* isn't a separate fixture yet — "mechanism covers it, not isolated"). No self-contradiction.
- **§7 Jung provenance — fact-check delivered for steward+jurist (open, non-blocking):** the corpus does BOTH — **per-volume precedent EXISTS** (Alexander *Nature of Order* 4 files · Lacroux *Orthotypographie* 2 · Habermas vol-1 · Burney vol-1 · Camus *Œuvres I*) and single-megafile (Xenophon/Muir/Zhuangzi/Rumi/Levi/Blake/Shakespeare complete). Operative distinction ≈ per-volume citation identity; Jung CW (cited by volume) fits the per-volume side, supporting the jurist's lean. Steward+jurist decide; governs re-converting the legacy Jung `.md` (+ likely Donne).
- **Not yet done (post-authorization work):** recognizer coverage of the remaining census families (one-directional / container-mirror); semantic per-volume boundary detection (if per-volume chosen); build-in under fleet discipline (`test_tools` fixtures, spec anchoring); re-convert the legacy mega-books. Steward assigns a PENDING-number-consistent build authorization.

---

## PENDING-55 — Re-scope the REVIEWED-54b remaining footnote work on an accurate census (new nested-block family; (c) is a census artifact)
**Date:** 2026-07-11
**Tag:** [PROPOSAL]
**Summary:** A new read-only diagnostic (`scripts/audit_footnotes.py`, recognizer-truth for coverage) replaced the five throwaway probes and produced a census materially more accurate than the one REVIEWED-54b was ruled on. It changes the *un-built* remainder of that ruling in three ways, so — per steward direction (2026-07-11) — building is **held** pending a jurist re-scope: (1) **(c) "single-letter marker" is a census artifact** — no single-`[A-Za-z]` book exists; nagarjuna = inner-anchor digit → (b), plato = block-id digit → already COVERED, and **donne is a whole-word/phrase lemma-marker book** (~2150 notes, exact/block, ~60% exact reciprocity) that is *broader* than the ruling and removes the marker-shape defense-in-depth; (2) a **NEW family the prior census never saw — nested-block** (~354 notes: les-fleurs / jaccottet / polastron; note-id on an outer `<div>`, back-link nested in an inner `<p>`; exact reciprocity, low risk); (3) the honest **blind zone** (44 `REFS-BUT-NO-RECIPROCITY` books) names the real one-directional/container notes (arendt / montaigne / doniger / métamorphoses) among genuine TOC/index non-notes.
**Full brief (for the jurist):** `chamber-library/docs/footnote-family-census-FOR-JURIST-2026-07-11.md`. **Evidence artifact:** `docs/footnote-family-census-2026-07-11.txt`.
**Change-class:** [PROPOSAL] — it re-opens what the REVIEWED-54b conversion-pipeline ruling authorizes building, and bears on §V's production chain (same test as PENDING-54). The diagnostic tool itself is read-only (no gate/spec/verbatim change) and is already built + tested (fleet 83→86) under the steward's "build the durable tool" direction.
**REVIEWED-54b part 1 unaffected:** (a) block-id + (d) URL-decode are landed + verbatim-proven (`ef0cee0`). This item concerns only the un-built (b)/(c) + the newly-surfaced families.
**Open questions (brief §6):** (1) authorize donne's word/phrase-marker widening under strict exact reciprocity + n=3 spot-check, or hold donne to the regex fallback and drop (c)? (2) nested-block = FIX (extend the block-note pass to search block *descendants*) or PROPOSAL? (3) blind-zone one-directional/container notes = new families or confirmed honest-refuse? (4) confirm (b) inner-anchor proceeds under its existing FIX ruling; (5) proof standard unchanged (per-pair `(dest-file,id)` guard + `_prove.py` verbatim on real books); (6) optional analyzer-precision FIX — expose paired-ref positions from `process()` for exact per-ref attribution.
**Files affected (on authorization):** the recognizer `scripts/inject_epub_footnotes.py` + `test_tools` fixtures + `graduation-spec.yaml` note, per whichever families are authorized. None touched this session (building held).
**Awaiting:** Steward + jurist re-scope ruling. Building resumes only after.

**RULED 2026-07-11 (jurist; REVIEWED-55). The ruling CORRECTS the jurist's own prior REVIEWED-54b (c) sub-ruling** — reasoned correctly from data that was wrong; the analyzer stress-test surfaced it one layer up, in an issued ruling, before donne was converted on the false premise. Full ruling: `docs/footnote-family-census-JURIST-RULING-2026-07-11.md` (relayed). Disposition:
- **(c) letter-marker — WITHDRAWN in full** (incl. the n=3 spot-check condition — no subject left). No letter-marker family exists: nagarjuna = digit/inner-anchor → **(b)**; plato = digit/block-id → already covered by (a).
- **donne (word/phrase-marker) — DECLINED for this arc.** Whole-word/phrase markers are the *specific* failure condition-4 exists to prevent (indistinguishable from prose by shape; round-trip would carry all the safety weight) — a different risk, not a bigger one, so NOT (c)'s natural extension. The measured 60% exact-reciprocity seals it regardless (partial, self-inconsistent conversion vs a uniform working fallback). **Hold to the regex-cleaner path;** a fresh PROPOSAL if ever pursued (not a rider). The ~40% non-exact = probable source-side id typos → **anchor-hygiene note (logged, not ruled), alongside Sennett `cra0001002`** → `_curation/anchor-hygiene-findings.md`.
- **nested-block (~354) — FIX, same arc.** Widen the block-note back-link search from immediate children to **descendants** — widens *where* the same unchanged match is looked for, doesn't loosen *what* matches; same verification/risk as (a). Variants: don-quixote `<body>`-id = genuine false candidate (TOC≠footnote, leave out); obrist native `<aside epub:type=footnote>` = **confirm empirically through stock pandoc** before treating as covered OR gap.
- **blind-zone one-directional (arendt/montaigne/doniger/les-métamorphoses) — confirmed honest-refuse.** No round-trip → nothing for the guard to verify → out of scope *by architecture*, not omission (machine-converting them = PROPOSAL-class, different first principles). Regex-cleaner fallback per REVIEWED-54 §5.
- **(b) inner-anchor — FIX stands, scope corrected to INCLUDE nagarjuna.** of-grammatology (double inner anchor, symbol) noted adjacent, NOT folded in — its own later look.
- **proof standard — unchanged/confirmed** (per-pair `(dest-file,id)` guard + verbatim-clean real-book proof, +0/−0 — it's what makes these FIX).
- **analyzer precision fix — AUTHORIZED, FIX** (expose `process()`'s paired-ref positions; pure additive instrumentation; build soon — would have caught the misclassification pre-ruling).
**Build UN-HELD for:** (b) inner-anchor (incl. nagarjuna) · nested-block · analyzer-precision fix — all FIX under the arc's proof standard. **Awaiting only:** steward placement of **REVIEWED-55** (executor can't write REVIEWED.md — Constraint #1; paste-ready draft in the session ledger).

**BUILT 2026-07-11 (chamber `b65816a`, `3831878`):**
- **Analyzer precision fix** (FIX): `inject_epub_footnotes.process()` exposes `paired_refs`; `audit_footnotes` attributes coverage exactly per-ref. Regression-proven.
- **(b) inner-anchor** (FIX): PROVEN +0/−0 on kuhn/mbembe/nature-of-things (916 notes); i-ching honest-refused (wrapper-div nesting); nagarjuna exposed a **PASS-BUT-FALSELY** (its index cites the notes → converting them perturbs the index; source-word guard passed while pandoc dropped body words).
- **⚠ NEW SAFETY MECHANISM — end-to-end verify (steward-directed, `3831878`): bears on the §V proof standard → JURIST NOD OWED.** After writing, the pre-processor runs stock pandoc on the original + injected EPUB and compares body-word multisets; ANY non-marker change REFUSES + deletes the output. Turns the guarantee from *verbatim-safe by construction* → *by verification*; nagarjuna self-refuses; closes the PASS-BUT-FALSELY class; also compensates the unenforced `body_word_conservation` gate for footnote conversions. Steward authorized the build under REVIEWED-55's FIX proof-standard clause; surfaced here for the jurist to ratify the mechanism's place in the §V chain.
- **nested-block — jurist FIX-assumption OVERTURNED by proof (⚠ needs a jurist note):** built the widen (search block descendants for the back-link); it PAIRS the notes but converts DIRTY (les-fleurs +828/−1110, jaccottet marker-merge, polastron +202/−2756) — pandoc won't cleanly lift a `<div class="note">`-wrapped same-file def; same PASS-BUT-FALSELY class as i-ching/nagarjuna. The end-to-end verify catches it (vindicates it). "Widen the search = same as (a)" doesn't hold empirically. **REVERTED to `3831878`** (the recognizer must not pair what it can't convert clean). Recommend nested-block joins the **honest-refuse** set (regex fallback), like i-ching. Second ruling-assumption this arc overturned by the proof (after (c)).
- **obrist native-`<aside>` — empirically a GAP:** stock pandoc emits 0 native footnotes from its `<aside epub:type="footnote">`; 16 notes, low priority → regex fallback (not covered, not a build target now).
- **DONE this arc:** analyzer-precision fix + (b) inner-anchor + end-to-end verify (all `3831878`/`7bf438a`, both remotes). nested-block + obrist → honest-refuse.
- **JURIST RULED 2026-07-12** (`docs/end-to-end-verify-and-nested-block-JURIST-RULING-2026-07-12.md`, relayed & archived):
  - **Q1a — end-to-end verify RATIFIED, FIX-class** on a refined test: a new §V-chain component is FIX (not PROPOSAL) when it (i) only ADDS refusals, (ii) never alters text, (iii) falls back to an already-trusted path. This satisfies all three.
  - **Q1b — MANDATORY at graduation now** (`--no-verify` forbidden at graduation while `body_word_conservation` is unenforced) **and should PERSIST after that gate lands** (defense-in-depth: catch at conversion-time, attributed to source). **+ RETROACTIVE re-verification REQUIRED** over everything landed under the per-pair-only standard (mirror/split-anchor/block-id/URL-decode) before treating it settled.
  - **Q1c — marker-exclusion must be POSITIONAL.** ✅ **DONE** (`e8eeea7`): was shape-only; now subtracts only the exact converted marker tokens (`converted_markers`), superscript-normalized; a dropped prose number is caught though digit-shaped; clean books hold, nagarjuna refuses on real corruption only.
  - **Q2 — nested-block FIX RETRACTED, honest-refuse CONFIRMED.** Fresh PROPOSAL required if ever revisited (unwrap-the-div is a different approach). Jurist named its own reasoning gap ("same risk as (a)" was true of matching, silent on rendering) + generalized: **no widen ruled FIX-and-final on structural reasoning alone; structural safety = provisional FIX, end-to-end verbatim proof on real books = final.**
  - **Broader flag (jurist):** `body_word_conservation` declared-but-unenforced is the same gap-shape PENDING-52 closed, recurring in a second subsystem → worth renewed attention beyond this arc.
- **DONE:** Q1c positional (`e8eeea7`); Q1a/Q2 archived.
- **Q1b RETROACTIVE — MAJOR finding (`6c9ca43`, evidence `docs/retroactive-verify-2026-07-12.txt`):** 87 covered books · **42 CLEAN · 45 DIRTY** (pass per-pair guard, corrupt under real pandoc). Verified real (5 known-clean → CLEAN; `_prove.py` agrees). 29 catastrophic (montaigne +385457, red-book −7835, pascalian +5910, gadamer/donne/tolkien…; false-pair relocation = nagarjuna at scale) + 16 marker-adjacency (prose intact, markers glued). **CORPUS SAFE: 0 canonical files use the pre-processor — NONE graduated; caught pre-graduation; mandatory verify refuses all 45 → fallback.** Recognizer's reliable coverage ≈42/87. **⚠ NEW DECISION for steward+jurist:** improve the recognizer (tighten over-pairing) vs accept 42-clean + fallback-for-the-rest. Not resolved this session.
- **OWED (steward, tomorrow):** REVIEWED-55 + follow-on placement; wire "mandatory-at-graduation" (graduation flow must not pass `--no-verify`); weigh the recognizer-maturity decision above.

**RULED 2026-07-14 (jurist; the verify-flow / "mandatory-at-graduation" sub-item). Closed on a POSITIVE TEST, not a grep.** Full record: `chamber-library/docs/jurist-review-response-2026-07-14.md` + the jurist ruling relayed 2026-07-14.
- **The property holds by CONSTRUCTION, not enforcement:** `graduate_to_canonical.py` exposes only `--apply`/`--keep-names` — no `--no-verify`/`--force`/skip at the door; its 3 gates run unconditionally; `--no-verify` lives only on the upstream conversion tool (`inject_epub_footnotes.py`) and its output is re-verified independently by `body_conservation_gate` at graduation (the defense-in-depth Q1b mandated — now vindicated concretely). Positive test: seed-test PASSED (boundary-trim→REVIEW, interior-loss→FLAG); real-door corrupt candidate (200 interior words dropped) → **FLAG→refused**; clean control→PASS. Harness in `session-ledger-2026-07-14.md`.
- **Residual (a) — RULED a FIX, and LANDED:** *a false ABSTAIN is as much a lie as a false PASS.* The single `ABSTAIN` verdict is split into two distinct states — **ABSTAIN** (permanent, tier-level, NO ground truth: V-SCAN/V-UNKNOWN → proceeds) and **UNVERIFIED** (contingent, run-level, ground-truth EXISTS but not reached: V-TEXT source off-disk → **HOLDS**). Edited `verify_body_conservation.verify_candidate` + `graduate_to_canonical.body_conservation_gate` (map + tally + prints + the defensive no-source branch) + guard tests; **119/119 pass**; before/after proof (unresolvable-source candidate now HELD `UNVERIFIED`, previously `ABSTAIN`→proceeded). Change-class **FIX** per jurist. **Uncommitted — steward's Gitea/push call.**
- **Residual (b) — docketed onto PENDING-58, not a floating item:** the V-DSL gate path is unexercised (0 Loeb graduated); a V-DSL positive test is a **precondition of PENDING-58's first Loeb graduation** ("a check proven for one tier is not proven for another").
- **PENDING-56 unrecognized-fallback condition — DORMANT, not owed:** it was a condition on `app[]`'s extractor; Decision 2(i) rules `app[]` is not produced → the condition is dormant (revives unchanged if `app[]` is ever proposed for production). No evidence-assembly; the L1 label-collision left alone.
- **datum-not-ledger — CANDIDATE, not constitutional** (two applications in one week from one ruling ≠ a third instance in the wild); governs `app[]`+`anchors[]` today on their merits. **Quarantine namespace (`_unverified.*`) — designed, NOT built** (no current need; an untested safety mechanism is a liability).
~~**Awaiting:** steward REVIEWED placement + the Gitea/push call on the residual-(a) FIX.~~ **RESOLVED-STALE 2026-07-19 (review sitting):** REVIEWED-55 verified PLACED (`~/REVIEWED.md:489`, dated 2026-07-12, AUTHORIZED — ratifies the whole footnote arc incl. the Q2 nested-block retraction); the residual-(a) FIX verified landed + on BOTH remotes (`e8eeea7`, REVIEWED-55-tagged). This line predated the placement and drove a stale 'sitting owed' memory entry for a week — struck against the substrate. PENDING-55 is CLOSED.

## PENDING-56 — Canonical format decision: adopt Docling + complete MD-canonical + TEI-mirroring structural sidecar
**Date:** 2026-07-12
**Tag:** [ESCALATE] architectural — canonical format (seed brief §10.3, deferred as steward-pending). **Steward-decided provisionally on the trial evidence; jurist ratification requested (brief relayed).**
**Summary:** Adopt Docling as the EPUB/PDF/scan conversion front-end (with our verify gates unchanged on top), and *complete the already-chosen* Markdown-canonical + `.meta.json` structural-sidecar architecture — giving the sidecar a TEI-mirroring vocabulary so a future TEI migration stays mechanical.
**Rationale:** A steward-driven reframe established that the substrate (conversion/format/citation) is a solved, adoptable domain (Docling/GROBID/TEI/DTS) while the composition (voice-attributed verbatim consultation = the engine) stays ours — and that ~20 bespoke conversion tools were reimplementing it. A four-tier Docling trial (steward-run, M4+M1) confirmed: value scales with layout richness — cleans EPUB (0 cruft, was 888 calibre_link/364 fn-ids), rich structure+provenance on PDF (2 798 page-provenanced items), and **crosses the A3 OCR frontier** on a scanned French book (104 footnotes, 664 provenanced) that `ocrmac` cannot. Docling is a *converter, not a verifier* — the trust gates (`verify_body_conservation`, `normalize_ocr` verbatim-guard) stay, converter-agnostic.
**Options:** **A** — MD-canonical + TEI-mirroring `.meta.json` sidecar (tractable now; completes the chosen half-built direction; human-inspectable; keeps TEI open). **B** — TEI now (native to apparatus A5 / anchors B2 / DTS, but a full TEI toolchain before any corpus work resumes). **C** — split (TEI for Loeb, MD+sidecar for the rest; two consumers, cuts against uniformity). Full analysis: `chamber-library/docs/canonical-format-decision-FOR-JURIST-2026-07-12.md`.
**Recommendation & steward decision:** **Option A + Adopt Docling** — selected by the steward on the evidence (2026-07-12, via AskUserQuestion). Reasoning: unblocks execution now, covers the v1 telos (verbatim/provenance/structure/anchors), preserves inspectability, keeps TEI migration mechanical.
**The one flip-condition (for the jurist to test):** if the v1 engine needs *structured critical apparatus (A5) as data* or *DTS-interoperable citation*, revisit toward Option B/TEI. Read: both are later/scholarly needs, not v1 blockers.
**Files affected (on execution):** conversion runbook + graduation-spec (Docling front-end; sidecar as graduated structural layer) — a v2.x amendment, change-class PROPOSAL; new `.meta.json` sidecar extractor; `ocrmac_pdf`/EPUB cruft-strippers retired; reprocess track B reshaped to Docling→sidecar-extract→verify→graduate.
**Awaiting:** ~~Jurist ratification~~ **JURIST RATIFIED 2026-07-12** — Option A + D1, on independently-verified reasoning (flip-condition tested directly, NOT triggered for v1: voice-manifest = interpretive-persona not manuscript-variant; the corpus's strongest TEI case, Loeb, needs anchors [B2, which A provides] not apparatus [A5]). **Two schema-gating questions CLOSED with substrate evidence (brief §8):** Q1 — Docling emits flat reference-links not native footnotes (0 `[^N]`, 48 `[*](#…)`, `epub_backend` ignores `epub:type`) → the footnote-recognizer arc is REPOSITIONED as the sidecar's note-extraction layer, not retired; Q2 — the Loeb DSL is typed (`[c dimgray]`/`[c darkmagenta]`/`[sup]`, 2.15M+ spans) and the current extractor *flattens* it → **CARDINAL PRINCIPLE set before schema lock: the extractor PRESERVES source typing into typed sidecar fields, never flattens a source-structured distinction to prose** (makes TEI-migration mechanical-by-construction). **REVIEWED-56 can be placed; sidecar schema unblocked to finalize on these two principles.** (Parallel governance still owed: REVIEWED-55 placement.)

## PENDING-57 — Enforce `body_word_conservation` at graduation (the converter-agnostic verbatim trust gate)
**Date:** 2026-07-12
**Tag:** [PROPOSAL]
**Summary:** Wire the built `verify_body_conservation.py` into the graduation gate so graduation ENFORCES the verbatim guarantee (currently `body_word_conservation` is listed in `graduation-spec.yaml` line 136 but `verify_graduation.py` does not enforce it — general non-footnote graduation has no automatic verbatim backstop).
**Rationale:** The trust foundation the whole reprocess stands on, and converter-agnostic — it certifies verbatim fidelity whether text came from Docling, pandoc, the Loeb DSL extractor, or OCR. Every tier's reconvert (Loeb B2, the EPUB/PDF Docling reprocess) graduates *through* it; without it "verified" is asserted, not checked. The PENDING-52 follow-on the jurist flagged twice; named in REVIEWED-55 as the gap "now addressed by PENDING-56."
**Method (per-tier, already RATIFIED by the register's §Tiering&Fence):** V-DSL (Loeb) = re-extract deterministically + no-fabrication vs the DSL source; V-TEXT (born-digital) = re-convert + prose-word guard (BUILT — caught jacobs 888 / manguel 2856 / montaigne fn-id residue that audit_cruft missed); V-SCAN = abstain (no ground truth; honest "cannot verify", never a false PASS). Three-tier verdict gates: FLAG blocks · REVIEW holds for curator drop-vs-keep identification · PASS proceeds.
**Options:** (a) enforce all three tiers now; (b) enforce V-TEXT now (built) + wire V-DSL with the Loeb reconvert + V-SCAN abstain. Recommend (b) — lands the built path immediately, wires V-DSL where it's first needed (the Loeb run), no false claims on scans.
**Full brief (for the jurist editor-gate):** `chamber-library/docs/verbatim-gate-enforcement-FOR-JURIST-2026-07-12.md`.
**Change-class:** PROPOSAL — inserts a new blocking check into the graduation gate. Runs the amendment process (executor drafts → jurist editor-gate → steward ratifies → land by supersession into `graduation-spec.yaml` + `verify_graduation.py`). Does NOT change the convention checks, the §V guarantee text, or any tier's evidence-class; V-SCAN gains an honest abstention, not a new claim.
**Files affected (on ratification):** `verify_graduation.py` (add the per-tier body-conservation gate), `graduation-spec.yaml` (make the listed gate enforced + declare the per-tier dispatch), `verify_body_conservation.py` (V-DSL re-extract path — **BUILT**), plus a **retroactive-sweep** producing a remediation queue across the already-graduated corpus (§6 below).
**UPDATE 2026-07-12 (jurist PARTIAL ruling + executor response):**
- **Jurist RATIFIED the architecture** (FLAG/REVIEW/PASS mapping, V-TEXT, V-SCAN abstention, change-class PROPOSAL — distinct from the REVIEWED-55 refusal-only-FIX exception because a FLAG/unresolved-REVIEW has no already-trusted fallback route to canon). **Withheld final ratification pending a V-DSL DEMONSTRATION** (his lesson: simpler-sounding architecture doesn't get trusted a third time on sounding simpler).
- **V-DSL now DEMONSTRATED (§3.5 of the brief) — the demo vindicated the caution:** naive reuse of the V-TEXT k-gram check FALSE-FLAGGED a clean Apollonius (1070 "fabrications", only 6 truly-new = the MD subtitle; the rest = coverage misses from the DSL→MD REFLOW). Corrected → **reflow-tolerant word-multiset** on source-content body: Apollonius (verse) fab=0 PASS · Plato Gorgias (prose) fab=0 PASS · injected fabrication → FLAG with teeth. Fleet fixture added (test_tools 105→109). Honest residual: fabrication half gate-ready; content-vs-boilerplate DROP side delegates to `extract_loeb_dsl`'s integrity report.
- **Provenance verified** (jurist flagged the "already RATIFIES" claim): spec v2.0.0 §Tiering & Fence IS ratified (RATIFIED-SHAPE · OPERATION-BLOCKED) — this PROPOSAL is the un-blocking; the dispatch is confirmed, not originated.
- **§6 RETROACTIVE clause FOLDED IN (steward-directed, rule together):** on ratification the gate runs BACKWARD across graduated canon (V-DSL 952 · V-TEXT 239), diagnostic-first → a remediation queue (FLAG=re-verify→reconvert; REVIEW=curator; PASS=re-attest), NOT silent de-graduation. Motivated by the jurist's 3-for-3 (jacobs/manguel/montaigne all graduated-clean, all failed the new check). Companion efficiency noted (not a condition): the LOCKED sidecar's `placement:back`+`role` resolves the REVIEW-tier endnotes-keep/index-drop ambiguity declaratively for any book carrying a sidecar.
**UPDATE 2026-07-12 (jurist FINAL ruling — RATIFIED on 2 conditions; both now addressed):**
- **Jurist RATIFIED the whole PROPOSAL** — architecture, V-TEXT, V-SCAN, V-DSL's fabrication half (now genuinely demonstrated), and the §6 retroactive sweep (well-precedented by REVIEWED-55's own sweep). Two conditions + one flag:
- **Condition 1 (V-DSL loss half) — ADDRESSED:** the jurist noted loss delegated to `extract_loeb_dsl`'s self-report without the fabrication half's independent injection proof → route loss to REVIEW until a loss-injection test closes the asymmetry. **Built the independent loss teeth + demonstrated:** boilerplate-vocab classifier → clean Apollonius `lost_content=0 PASS`; drop a content word (`banquet`) → `FLAG` naming it. Fleet fixtures both sides (test_tools 105→111). **Honest bound stated:** blind to a dropped *occurrence* of a boilerplate-vocab word (count masked) — the narrow edge the jurist's REVIEW-routing guards; his call whether demonstrated-teeth suffices for auto-PASS or REVIEW-routing is kept for that edge.
- **Condition 2 (43-book census gap) — CONFIRMED:** census = V-DSL 952 · V-TEXT 239 · V-SCAN 50 · V-SUSPECT 29 · V-NONE 14 = 1,284; the 43 = V-SUSPECT+V-NONE = the **fenced-out** tier (no confirmed source) → correctly EXCLUDED from the conservation sweep (can't re-verify a book with no source). Not a gap; the fence working.
- Brief updated (§3.5 loss teeth + §6 census). Change-class PROPOSAL confirmed (distinct from REVIEWED-55's refusal-only-FIX: a FLAG/unresolved-REVIEW has no already-trusted fallback to canon).
**Awaiting:** jurist confirmation the two conditions are closed (+ his call on loss auto-PASS vs REVIEW-routing for the masked-vocab edge) → steward ratification (REVIEWED-57) → land by supersession into `graduation-spec.yaml` + `verify_graduation.py`.

**CLOSED 2026-07-13 (REVIEWED-57 AUTHORIZED — fully ratified across three jurist rounds).** Gate WIRED into graduation as its own source-in-hand step `body_conservation_gate()` (`cdb3454`). §6 retroactive sweep RUN over all 952 Loeb → the corpus-health map (d9f6880/9afb0cf). Follow-on same day: the 18 body-deficit **cause-analysed** by reading the missing spans → three remedy tracks (re-match 8 / re-extract 4 / re-verify-and-reconvert 12); a wrong-match-by-fabrication classifier rule + the 2 REORDER? books resolved (both wrong/partial-key, CLEAN on re-match) → REORDER? dissolved to 0 (eb21eca/836b665/c54edbb). Nothing further awaited on PENDING-57. The reprocess itself (matcher fix → the 2b sidecar-wiring amendment gated on the steward's Loeb-first-vs-full-corpus call → B2 ②+③) is downstream work tracked in the session files + `chamber-library/docs/chamber-program-open-work.md`, not here.

## PENDING-58 — 2b: Wire the Loeb structural sidecar into graduation (V-DSL tier) on its OWN merits (`notes[]` · `anchors[]` · structural typing) — the reconciliation corollary REFUTED and struck
**Date:** 2026-07-13 (original filing) · **REWRITTEN 2026-07-14** (corollary refuted on the record; steward-directed rewrite-not-withdraw).
**Tag:** [PROPOSAL] — change-class PROPOSAL (changes what graduation PRODUCES; per chamber CLAUDE.md "FIX→PROPOSAL when it changes what a gate accepts"). **Jurist editor-gate → steward ratification (REVIEWED-58), FRESH** — the prior editor-gate ruled on the struck corollary's *shape* and does NOT carry.

> **⟳ RESHAPED + LIGHT-GATE PASSED 2026-07-16 — operative proposal text: `chamber-library/docs/PENDING-58-rewrite-FOR-JURIST-2026-07-16.md`** (gate ruling: `…-light-editor-gate-RULING-2026-07-16.md`). The body below is the 07-14 record; the gated proposal supersedes it on these points (Decision-2 rulings + light-gate, all landed): **`app[]` NOT produced** (2(i); was "produced-but-uncredited") · **`anchors[]` originates entirely in the citation amendment (#2)** — #1 produces none (2(ii) + §3(A), confirmed *entailed*) · `sections`/`provenance` = **produced-without-proof** (first-citation needs its own spot-check) · the three sub-questions **RESOLVED** (see Awaiting) · **REVIEWED-58 gates on residual-(b)** (first V-DSL exercise, Block 3), not a 128-book demonstration. Shed/inherit pair reconciled to identical (OQ-5).

> **⟳ FORKS RULED + (f) AMENDED 2026-07-17/18 (REVIEWED-62):** the two 2b build forks RULED (`chamber-library/docs/2b-two-forks-JURIST-RULING-2026-07-17.md`) — credit the `app[]`-array kinds {`table`, `glyph`, `editorial-insertion`, `unrecognized`} + `list` *produced-with-a-content-edge*; "app[] not produced" = the **critical-apparatus channel** (variant-readings ledger; FIX-B naming), never the array. Item (f) amended on all three operative carriers per the Fork-2 ruling: *#1 produces no citation-credited `anchors[]`; the trusted per-scheme citation layer originates in #2; #1's wiring may retain the raw, uncredited `loeb-line` layer as #2's documented re-stamp input.* `sections` = produced-without-proof (alongside `provenance`), stated explicitly per the gate correction. **The wiring-build gate is CLEARED** (FIX-A ratified); residual-(b) still gates REVIEWED-58.

**WHY THIS IS A REWRITE, NOT THE ORIGINAL:** The original PENDING-58 hung on a **reconciliation corollary** — `multiset(DSL-full) == multiset(candidate_body) ⊎ multiset(app[])` — which would have turned the corpus-health map's magnitude-diagnosis ("apparatus-shaped") into a **mechanical fact** (reconciles→apparatus / doesn't→body, no eyeballing). **That corollary is REFUTED and struck** — not renamed, not quietly dropped (steward + jurist explicit: a filing that drops its central justification and keeps the conclusion is what this process exists to prevent). The sidecar wiring never *depended* on the corollary; the corollary was a bonus hung on it. This rewrite argues the remaining, untouched case on its own merits.

**THE REFUTATION, on the record** (evidence: 2026-07-13/14 session ledger; the demonstration `scratchpad/proto_reconcile.py` + `decompose_v2.py`; jurist rulings `docs/2b-sidecar-wiring-jurist-*-2026-07-13.md`):
  · The proof condition (demonstrate on real books before crediting) did its job — on 3 real books the literal reconciliation **does not hold**: `app[]` covers only 5–40% of the `m_lost` deficit, and **`new_body` is token-identical to `old_body`** (the B2 builder recovers the deficit into *neither* body nor `app[]` — the DSL's "missing" tokens are in neither channel).
  · Decomposition (contiguity via `_uncovered_runs` + a reorder-immune multiset-ratio guard + reading the tail; validated on Oeconomica's proven 202-token Book-II drop and Catullus's 14,840-token translation block) shows the `m_lost` deficit is **not flattened apparatus** — it is running-header/reflow **count-drift on common words** + editorial **paratext** (introductions) + **small real loss**, none of which a *structural* sidecar captures or was meant to.
  · **THE DEEPER FINDING (steward-named as the primary carry-forward, bigger than this amendment):** the corpus-health map's buckets are **magnitude-shaped groupings that cut across the actual causes**, not clean causal partitions. `loeb-aeschylus-persians` is labeled **BODY-DEFICIT** yet its loss is **dramatic apparatus** (speaker labels `ειδωλον 22→1, ξερξης 43→1, χορος 70→21` — verified real loss, ratio 1.03, not displacement); apparatus-shaped books are 74–90% benign drift with small real-loss tails. Because a "body-deficit" book can be losing apparatus and an "apparatus-shaped" book can be mostly drift, **no mechanical `app[]`-reconciliation could ever have discriminated apparatus from body** — the entanglement is in the buckets themselves. The decomposition survives only as an *evidence-backed, human-judged diagnostic*, never a mechanical gate. *(This finding likely warrants a note on the map's own interpretation — open sub-question below.)*

**Summary (the remaining proposal):** For the **V-DSL (Loeb) tier only**, make graduation **produce + validate the `.meta.json` structural sidecar** via `build_loeb_sidecar.py`, earning its keep on the fields that stand on their own — **`notes[]`** (footnote ref↔body pairing), **`anchors[]`** (the Loeb citation system: line-anchors, Bekker/Stephanus refs, page markers), and **structural typing** (sections, editorial-insertions, tables/glyphs, the `unrecognized` safety-net) — under **per-field trust gating** (below). The reconciliation instrument is **struck**; **no corpus-health map gets "verified" by this amendment.**

**WHY THE REMAINING CASE STANDS (argued fresh, not inherited):**
  · `notes[]` — already-proven footnote work (PENDING-54/REVIEWED-54 pre-processor + B2 pairing; genre-heterogeneous, honest-flagged). Independently valuable to the engine's apparatus layer.
  · `anchors[]` — the Loeb **citation system**, load-bearing for the engine's addressing whether or not any map is ever verified. The field with real downstream risk (see condition 1).
  · structural typing — the preserve-never-flatten value (REVIEWED-56): typed structure the engine wants regardless of the map.
  These merits are untouched by the corollary's failure — which is exactly why the steward ruled *rewrite, not withdraw*.

**TWO CONDITIONS THE REWRITE MUST CARRY (they would otherwise vanish with the corollary):**
  **1. `anchors[]` spot-check — a LIVE pre-condition (steward-flagged).** Before `anchors[]` is trusted as the engine's citation layer, spot-check a sample against the source: does anchor N (line / Bekker / Stephanus) point to the passage it claims? **A wrong number is the engine citing the wrong passage with confidence** — the highest-consequence failure in the whole sidecar. `anchors[]` is PRODUCED at graduation but NOT trusted-for-citation until this clears.
  > **RUN 2026-07-14 — FAILED as-built** (evidence: `docs/2b-sidecar-wiring-FOR-JURIST-2026-07-14.md` §4; `scratchpad/anchor_spotcheck.py`). On Aristotle NE the anchors capture Loeb section-subnumbers (3305/3333 are ≤40, resetting per chapter) and **drop the Bekker citation axis** — which IS in the source (dimgray `'1094 a'` cues), rejected by the extraction's digit filter. Ground-truth: Bekker **1094a** opening → anchor **ref=3**. `anchors[]` needs a per-scheme numbering parser (Bekker/Stephanus/line, distinctly typed) before it bears the citation claim. **Per the steward's logic (sample not clean → blocker), this condition is a BLOCKER; the amendment's shape is now open for ruling (brief §6).** The rewrite's framing of `anchors[]` as a *standing* merit is accordingly downgraded to *potential, pending the parser* — the amendment's live merits are `notes[]` (proven) + structural typing.
  **2. Per-field gating — with the corollary struck, `app[]` has NO proof condition at all.** Each field earns its own trust; **`app[]` does not inherit trust from `notes[]`/`anchors[]` merely by sharing the file.** Trust states: `notes[]` = trusted (proven) · `anchors[]` = trusted-after-spot-check · `sections[]`/`provenance` = produced (low-risk) · **`app[]` = PRODUCED-BUT-UNCREDITED** (verbatim + typed + `unrecognized`-safety-net, but no proof condition met — never credited into any gate; a future amendment adds one if a use needs it). This preserves the PENDING-57 posture (`body_conservation_gate` gets NO apparatus credit) — now for the honest reason: not "pending the reconciliation," but "`app[]` has no proof condition, full stop."

**Options (current — the reconciliation options are moot):** **(a)** wire the sidecar to PRODUCE the fields under per-field gating; `anchors[]` trusted-for-citation only after the spot-check; `app[]` produced-but-uncredited; **no reconciliation instrument** (RECOMMEND). **(b)** withdraw the amendment entirely (REJECT — steward-ruled: the `notes[]`/`anchors[]` merits stand untouched by the corollary's failure; withdrawal would discard proven, independently-valuable work).

**Change-class boundary — what this does NOT change:** LOCKED sidecar schema (additive-only); the verbatim guarantee; any tier's evidence-class; V-DSL/V-TEXT/V-SCAN dispatch; the general-tier path (Loeb-only). It ADDS: a V-DSL sidecar produce+validate step at graduation under per-field trust gating, and the `anchors[]` spot-check as a pre-condition on citation-trust. It REMOVES from the prior filing: the reconciliation instrument, the `app[]`-credit-into-`body_conservation_gate` path, the 128-demonstration-as-gate.

**Files affected (on ratification):** `_curation/graduation-spec.yaml` (name the sidecar as the graduated structural layer for V-DSL; declare the produce/validate step + per-field trust states); `scripts/graduate_to_canonical.py` (produce+validate the sidecar beside `body_conservation_gate`, NO apparatus credit); `scripts/build_loeb_sidecar.py` (the graduation entry point — a 1-commit, self-stamped v0 prototype carrying one substantive fleet test incl. the `unrecognized` fail-loud check; wired, not modified); a NEW **`anchors[]` spot-check** instrument + its sample result; `_curation/conversion-runbook.yaml`. **No reconciliation instrument.**

**History (superseded, preserved — not archived away):** the original corollary filing + its jurist editor-gate + rationale-correction live at `docs/2b-sidecar-wiring-jurist-editor-gate-ruling-2026-07-13.md` + `docs/2b-sidecar-wiring-jurist-rationale-correction-2026-07-13.md` + git history + the 2026-07-13/14 ledger. The refutation is recorded above, in the open.

**Awaiting:** ~~jurist editor-gate~~ **LIGHT-GATE PASSED 2026-07-16** → proposal text GATED/operative. **REVIEWED-58 (landing the wiring) gated on residual-(b)** — the first V-DSL gate exercise (Block 3). Sub-questions RESOLVED (07-14 response + light-gate): **(i)** `app[]` → **NOT produced** (datum-not-ledger). **(ii)** `anchors[]` → its own **citation amendment (#2)**; #1 produces no anchors at all. **(iii)** map buckets → a **firing constraint** ("no causal claim from bucket membership"), pinned to the corpus-health map (Block-1 #7).

---

## PENDING-59 — A3: CoreTrustSeal-level self-audit (trust-attestation baseline conditioning OPERATIVE status)
**Date:** 2026-07-16
**Tag:** [PROPOSAL] — conditions the corpus's OPERATIVE status (a new status-gate); lane = freeze + semver (doctrinal-traceability, per the 07-10 lane doctrine).
**Summary:** The periodic trust-attestation adopted as A3 (REVIEWED-49, 07-06), now drafted + jurist-reviewed. Three dimensions (fixity excluded — stays automated): **provenance-completeness** (annual) · **registry-linkage** (annual, double-duty for A1's emergent `agent_id` signal) · **legibility-to-successor** (every 2–3 cycles). Gate strength (OQ-3): **FLAG** (honest-degradation) for the first two; **HARD FLOOR** for legibility *failure*. Legibility failure threshold: fence-verdicts-unreadable **OR** fence-evidence-unreadable **OR** doctrine-not-followable (evidence-alone-floors). **Cold-instance AUDITS, jurist ADJUDICATES.** Release from a floor: a fresh cold-instance pass, jurist-adjudicated.
**Full proposal:** `chamber-library/docs/A3-self-audit-PROPOSAL-FOR-JURIST-2026-07-16.md`. **Jurist review PASSED 2026-07-16** (`…-JURIST-RULING-2026-07-16.md`), 3 edits applied + a mechanism gap closed.
**Files affected (on ratification):** a new spec section (*Trust Attestation / Self-Audit*, cross-ref §IX); a census tool for the two flag dimensions; the cold-instance legibility-audit procedure.
**Awaiting:** ~~steward ratification~~ **RATIFIED 2026-07-16 (REVIEWED-59).** Land as a new spec section by supersession + semver on the steward's version call (v2.0.2 → v2.1.0 suggested). Jurist review passed.

## PENDING-60 — Citation amendment (#2): specify the adopted CTS-URN model + draw the chamber-minted-namespace / internal–external boundary + per-scheme coverage attestation
**Date:** 2026-07-17
**Tag:** [PROPOSAL] — normative spec amendment (new doctrine + changes what graduation produces re: citation). Runs the §Governance & Amendment editor-gate (executor drafts → jurist editor-gates format + doctrinal soundness → steward ratifies); lane = freeze + semver.
**Summary:** The citation amendment — #2 (the heaviest) of the constitution-close block. The **CTS-boundary precondition is MET** (`chamber-library/docs/CTS-boundary-for-citation-amendment-2026-07-17.md`); its clean-separation verdict is **CONFIRMED** by the parallel tier survey (`chamber-library/docs/FABLE-tei-cts-dts-perseus-tier-survey-2026-07-17.md`) — the seam is the CTS standard's **own published** notation-vs-protocol split. **Reconciliation (verify-before-compose):** §III (citation contract), §IV (CTS-URN edition-identity — *the adopted scheme*), §VII (declared locator registry), and §IX (coverage-ledger + evidence-tier) are **already ratified**; #2 does NOT re-adopt them. #2 **specifies**, building on them: (1) the **chamber-minted CTS namespace** + the **internal (T1) / external (T2, leashed Condition-2) boundary** — the genuine new decision §IV left open; (2) **per-scheme in-source anchor recovery** (routing → `graduation-spec.yaml` declared data, per §VII's generative principle); (3) the **per-scheme coverage attestation** (§IX-as-precondition; honest-degradation, attest-never-default, work-level default per §III's sectionless reduction; relates to §IX's OPEN silence-as-finding); (4) **Decision-1** + additive-only sidecar fields.
**Rationale:** The classical (V-DSL, 952) tier is staged-flattened, **0 graduated**; a trustworthy citable v1 needs the citation model specified so anchors are recovered *where verified* and honestly attested *where not*. #2 is the constitution's last heavy piece before corpus-into-spec (pull-based) opens. Body extracts cleanly; the per-scheme anchor recuperation is the hard part — absorbed by the coverage attestation (threshold = a production measurement, not a doctrinal commitment).
**Precondition:** MET — CTS boundary drawn + B-confirmed; no T2 question requires resolution before drafting.
**Recommendation:** PROPOSAL via editor-gate. **Semver = steward call** on the §Governance test ("does it change what a gate accepts?"); rec **MINOR v2.1.0** (additive fields + new doctrine, forward-only — 0 Loeb verified), **coordinate with A3's (PENDING-59) v2.1.0 landing**.
**Files affected (on ratification):** §III/§IV/§VII/§IX (by supersession + semver); `graduation-spec.yaml` (per-scheme parser routing + locator-registry additions + coverage-attestation fields); the structural sidecar schema (additive fields, REVIEWED-56 discipline); the ~3,333-anchor `loeb-line`→per-scheme re-stamp (production/Region-4).
**Awaiting:** ~~jurist editor-gate~~ **EDITOR-GATE PASSED 2026-07-17** (`docs/citation-amendment-JURIST-editor-gate-ruling-2026-07-17` — jurist ruling; Q1 namespace-minting-in-`urn:cts:` confirmed, Q3/Q4 confirmed). **Two corrections + one condition DISCHARGED** (recorded in the package Addendum): (Q2) IV.3 reworded as an *explicitly partial* answer to §IX (general silence-as-finding stays OPEN); (Q6) #1's live shed-list cross-checked side-by-side vs #2's IV.7 — **six-for-six identical, (f) "originates" in both** (seam closed); (Q5) additive-only **verified against the LOCKED schema** (`anchors[].scheme` already present; `citation_coverage[]` = new optional field = FIX) → **MINOR (v2.1.0) stands**. **STEWARD RATIFIED + REVIEWED-60 FILED 2026-07-17.** MINOR v2.1.0; semver/vehicle (atomic-v2.1.0-with-A3[/#4/#5] vs sequenced) = steward annotation on placement. Production deps run post-ratification. Self-contained package: `chamber-library/docs/citation-amendment-JURIST-PACKAGE-2026-07-17.md`.

## PENDING-61 — B(i) `licence` axis + B(ii) PREMIS borrow-vocabulary (the two light constitution-close FIXes, paired)
**Date:** 2026-07-17
**Tag:** [FIX] — two ordinary spec amendments (gap-fill; **no gate-acceptance change**). §Governance & Amendment editor-gate (executor drafts → jurist editor-gates format + doctrinal soundness → steward ratifies); lane freeze+semver.
**Summary:** Block-1 #4 + #5 — the last light items. **#4 (B(i)):** add a `licence`/copyright-status **provenance axis** to §IV — machine-readable rights status of the *edition converted* (`public-domain` | open-licence | `in-copyright` | `permission-granted` | `unknown`), **graceful-degradation** (backfilled-not-rejected), **never a gate**; value vocabulary = declared data in `graduation-spec.yaml`. **#5 (B(ii)):** name the existing §V preservation-metadata layer (the W3C-PROV-shaped conversion record + fixity) using **PREMIS as borrow-vocabulary** (the DTS "borrow-vocabulary, build thin" posture, 07-04) — a **legibility** move, **no external dependency/schema/service**, terms as declared data; §V's shape/requirement **unchanged**. Both grounded in §IV/§V (quoted in the draft). B(iii) already landed (v2.0.2, REVIEWED-51) — not reopened.
**Rationale:** REVIEWED-49 "B — ordinary amendments confirmed… normal FIX per item." Closes the block's light tail; the corpus's heterogeneous rights need a machine-readable axis, and the preservation layer needs a legible standard name.
**Recommendation:** FIX via editor-gate. **Semver/vehicle = steward call:** (a) fold into the **atomic** v2.1.0 supersession with #2/A3, or (b) a standalone v2.0.3 patch.
**Files affected (on ratification):** §IV (licence axis) + §V (PREMIS naming note) by supersession; `graduation-spec.yaml` (the `licence` field + value vocabulary; any borrowed PREMIS terms, additive).
**Awaiting:** ~~jurist editor-gate~~ **EDITOR-GATE PASSED 2026-07-17** (both FIX; 2 wording corrections applied + recorded in the draft Addendum: B(i) "may"→"must, where known"; B(ii) naming-only/no-pre-authorized-field). **STEWARD RATIFIED + REVIEWED-61 FILED 2026-07-17.** Semver/vehicle call (fold into atomic v2.1.0 vs standalone v2.0.3) resolved at landing. Paired draft: `chamber-library/docs/amendments-B-i-B-ii-FOR-JURIST-2026-07-17.md`.

## PENDING-62 — FIX-A item-(f) seam clarification + FIX-B `app[]` naming collision (the two ruled 2b follow-ons, paired)
**Date:** 2026-07-18
**Tag:** [FIX] ×2 — jurist-classed (2026-07-17 Fork ruling), run **against a REVIEWED** because both touch ratified/just-landed content. **FIX-A GATES the 2b wiring build** ("the build proceeds on steps 1–3 once (f) is amended").
**Summary:** The two FIX follow-ons the Fork ruling surfaced and required to run their own light FIX rather than ride the build silently. **FIX-A:** amend shed/inherit item (f) to the jurist's corrected sentence — *"#1 produces no citation-credited `anchors[]`; the trusted per-scheme citation layer originates in #2. #1's wiring may retain the raw, uncredited `loeb-line` layer as #2's documented re-stamp input"* — carried literally identical on all three operative carriers (PENDING-58 rewrite §1/§2 · citation JURIST-PACKAGE IV.7 · block-map reconciliation table), plus the Fork-1 credit enumeration landed in §1 (`list` labelled *produced-with-a-content-edge*). **FIX-B:** name the apparatus-ledger sense distinctly (**critical-apparatus channel**) in the sidecar-schema doctrine so `app[]` unambiguously means the schema array (3rd shared-name collision after manifest/PENDING-53, ABSTAIN/PENDING-55), + bring the doctrine's kind enumeration current with the three further fleet-v1 kinds ({`list`, `unrecognized`, `editorial-insertion`}, code-verified) via §4's own FIX lane.
**Rationale:** The seam's conditions changed when #2 landed (v2.1.0, 2026-07-17); the OQ-5 discipline exists precisely so intent-vs-literal-wording gaps don't slip. The naming collision cost real orientation time in the Fork-1 ruling and will recur for the next reader. **Also surfaced:** a discovered internal tension in the operative PENDING-58 text (line 38 lists `sections` under *Trusted* while line 44 labels it *produced-without-proof*) — resolved in line 44's favour per the Fork-1 credit set, flagged for the gate to confirm, not silently fixed.
**Recommendation:** One paired PENDING-62 (the PENDING-61 pattern), each FIX separately checkable; split to 62/63 only if steward prefers. **Verified: neither FIX touches the v2.1.0 spec** (zero occurrences of the seam/collision language — no re-supersession) nor any LOCKED field's meaning/shape.
**Files affected (on ratification):** `docs/PENDING-58-rewrite-FOR-JURIST-2026-07-16.md` (§1 bullets, §2 table+keeps, §3 dated addendum) · `docs/citation-amendment-JURIST-PACKAGE-2026-07-17.md` (IV.7 row f + keeps; historical records untouched) · `_curation/constitution-close-block-map-2026-07-16.md` (row f + keeps) · `docs/sidecar-schema-DRAFT-v0-2026-07-12.md` (Naming note + line-68 comment + kind enumeration) · this file (⟳ annotation to PENDING-58's banner).
**Awaiting:** ~~jurist light editor-gate~~ **EDITOR-GATE PASSED 2026-07-18** (`chamber-library/docs/2b-FIX-A-FIX-B-light-editor-gate-RULING-2026-07-18.md`, preserved verbatim — all 5 questions confirmed; the jurist named the 07-16 `sections` pass-through as their own miss; 1 correction applied + recorded in the brief Addendum: A2 states `sections`'s disposition explicitly, produced-without-proof alongside `provenance`). **STEWARD RATIFIED + REVIEWED-62 FILED 2026-07-18.** Edit-set APPLIED same day with bounded-diff proof (commit tagged REVIEWED-62): PENDING-58 rewrite A1–A8 · JURIST-PACKAGE IV.7 A9–A10 · block-map A11–A12 · sidecar-schema B1–B3 + §4 landing-table row · this file's ⟳ banner (A13). **FIX-A clears the 2b wiring build (steps 1–3); residual-(b) still gates REVIEWED-58.**

## PENDING-63 — Gate zero's pending→archive seam is structurally closed at --apply (PENDING-52 lineage) + the shared-source archive design for compound sources
**Date:** 2026-07-18
**Tag:** [HARDENING] — class-level defect in the ruled PENDING-52 mechanism + the compound-source case its invariant lacks. Jurist-docketed 2026-07-18 ("gate-zero territory — PENDING-52's lineage, not PENDING-58's"; ruling: `chamber-library/docs/2b-first-vdsl-exercise-JURIST-RULING-2026-07-18.md`).
**Summary:** Two findings from the first V-DSL exercise, meeting at the same layer. **(1) The seam:** `graduate_to_canonical.source_gate` hands `archive_sources.add_single` a source staged in `pending-graduation/` — which sits INSIDE the archive root `DEST` — and `copy_or_rezip` refuses any source whose path contains `DEST` ("source already in archive") → rc 1 → the candidate is refused. **Every pending-staged graduation fails its apply leg, on every tier.** **(2) The compound-source case:** the archive model is one-slug-one-copy (`DEST/{slug}.ext`); the Loeb DSL is one 533 MB artifact carrying 952 works — per-slug copying would make 952 independently-hashable copies of a single artifact, the multiple-homes condition the ratified hash-locality principle forbids (jurist: rule it on integrity grounds, storage is a side effect; the property to preserve is *many works reference ONE archived artifact with ONE hash*).
**Rationale:** **Substrate-verified 2026-07-18: no graduation has EVER completed through the pending-staging path** — 0 of 324 archive-manifest entries carry a `source_origin` inside `pending-graduation/`; the only two manual-archive entries (Olson 2026-07-06, Handke 2026-07-09) were archived directly from Desktop paths via `--add`; the 14 legacy pending entries carry no `canonical_slug`. **PENDING-52's mechanism is ratified-and-never-exercised; the seam is latent since birth, not a regression.** Third instance of the class (after the `--no-verify` grep and the ABSTAIN split): negative/indirect evidence standing in for a positive property until something exercised it.
**Options:** **(a)** one design pass fixing both at the same layer (RECOMMEND, jurist-endorsed "sensible — they meet at the same layer"): a compound/shared-source archive form (one archived artifact, one hash, N per-work manifest entries referencing it) whose archive step also repairs the pending→DEST move (move-or-copy out of staging into the archive proper, containment check retained for true re-archive attempts); positive-test the seam end-to-end as part of landing (the class's own lesson). **(b)** fix the seam alone first (unblocks non-Loeb pending-staged graduations; compound-source separately). **(c)** hold both until Region-4 forces them (REJECT — the seam bites every tier's pending-staged apply, not just Loeb).
**Recommendation:** (a). Design brief FOR-JURIST before code (gate-zero territory; the enforced precondition's `enforced_by` text in `graduation-spec.yaml` may need a matching FIX).
**Files affected (on authorization):** `scripts/archive_sources.py` (the shared-source entry form + the pending→archive move) · `scripts/graduate_to_canonical.py` (source_gate apply leg, if the call shape changes) · `_curation/graduation-spec.yaml` `preconditions:` (enforced_by wording, if changed) · `scripts/test_tools.py` (the end-to-end positive test) · Chamber Sources `manifest.json`/`pending-manifest.json` entry shapes.
**Awaiting:** ~~Jurist design-gate (Q1–Q7)~~ **DESIGN-GATE PASSED 2026-07-18** (`chamber-library/docs/PENDING-63-design-gate-JURIST-RULING-2026-07-18.md`, filed verbatim; package: `docs/PENDING-63-JURIST-PACKAGE-2026-07-18.md` + Addendum): Q1 split confirmed at PROPOSAL weight · Q2 Option B + the same-binding/different-binding distinction · Q3 affirmative role test, copy→verify→remove · Q4 remove-don't-mark · Q5 + the re-pointing case · Q6 dereference + recompute · Q7 rides · dry-run labelled · **positive test = ratification condition + first real run observed.** ~~Steward authorization~~ **STEWARD AUTHORIZED same day** ("close this one today"). **BUILT + LANDED 2026-07-18** (commits `744417b` + the observed-run commit, tagged REVIEWED-63): fleet 157/157 with the end-to-end test in-change; **the first real pending-staged graduation OBSERVED** — loeb.dsl archived once as the `loeb-dsl-537-volumes` artifact (disk-verified), 6 works attached + graduated with re-stamped sidecars, staging cleared by last reference, 14 legacy entries untouched, catalogue 1300 canonical, engine gate canary clean. **Awaiting only: steward placement of REVIEWED-63** (copy-paste draft in the package Addendum).

## PENDING-64 — The line-ref coordinate contract: what a `line` means, who translates it, where it is proven
**Date:** 2026-07-18
**Tag:** [PROPOSAL]-weight docket with FIX parts (executor's read; package Q4 asks the jurist to confirm the class split). The REVIEWED-58 held-open seam; gates #2's re-stamp (Region 4, ~3,333 anchors, known-defective input per the jurist's 2026-07-18 consequence note).
**Summary:** No ruling says what frame a landed sidecar's line values live in, and the three frames in play disagree: the producer emits 0-based indices into its own head-less body array (five field families: `sections[]`, `provenance.pages[]`, `notes[]`, `anchors[]`, `app[]`); the LOCKED schema's example reads as a file coordinate beside `source_sha256` ("anchors trusted only against this"); the landed file shifts every interior line by a per-work constant (prep swaps the producer's 4-line head for frontmatter + title block — Ion: 15 lines). `write_sidecar` re-stamps the sha to the landed file and leaves line values untouched, so **eleven landed sidecars hash-assert "I describe this file" while every line value indexes an artifact that no longer exists** — protected only by the no-consumer-binds discipline (uncredited / produced-without-proof). Measured on Ion today: `anchors[0]` (`loeb-line 531`, `line: 161`) lands mid-Greek read 1-based, on an empty line read 0-based, and on the coherent Stephanus 530d–531a exchange only when shifted by the head-delta — the frame-dependence bit its own observers (the S3 RECORD and today's probe disagree because each silently chose a base).
**Rationale:** Item (f) as amended (REVIEWED-62) makes the raw `loeb-line` layer #2's documented re-stamp input; the jurist's consequence note requires the contract resolved before or at the re-stamp or the offset propagates into the credited citation layer as confident miscitation. Also the fourth instance of the shared-name collision class ("manifest"/53 · "ABSTAIN"/55 · "app[]"/62): the token `line` names two different coordinates.
**Options:** **(A)** one constitutional contract, landed-frame, translated at #1's `write_sidecar` (REJECT: contradicts item (f) — the raw layer would reach #2 pre-transformed by a path with no proof condition; expands #1's ruled boundary; converts obviously-foreign values into plausible-but-unproven ones). **(B)** two contracts meeting at #2's re-stamp (RECOMMEND): Contract 1 = the producer's convention, tool-level declared data, outside the constitution; Contract 2 (constitutional) = every citation-credited coordinate is a landed-file coordinate (1-based line in `source_file`, valid against `source_sha256` — hash-locality extended from *which file* to *where in the file*), proof condition = per-work offset derived mechanically AND verified by content probe at the landed file; `citation_coverage.status: verified` attestable only for landed-frame-proven coordinates; the raw layer retained per item (f) but frame-DECLARED via an additive schema field (FIX lane). **(C)** producer-frame forever + new file-coordinate fields (REJECT: enshrines a tool's array-index in the citation layer's primary field permanently).
**Recommendation:** (B). Grounds: item (f) already draws this line; the §4 lock table protects what is written (only B changes no existing sidecar's meaning); §VII's generative principle is the standing precedent (constitution states the requirement, declared data carries the convention); the collision-remedy precedent is a two-senses shape.
**Files affected (on ratification):** `docs/sidecar-schema-DRAFT-v0-2026-07-12.md` (additive frame-declaration field + Naming-note vocabulary, §4 FIX lane) · `_curation/graduation-spec.yaml` (`sidecar:` frame declaration; #2's routing/proof-condition wording when #2 builds) · `scripts/build_loeb_sidecar.py` (Contract-1 docstring declaration) · the 11 landed `.meta.json` sidecars (per the D4 ruling: additive frame declaration now vs hold-until-#2) · the constitution only if the jurist rules the contract into §III/§VII prose (supersession + semver).
**Awaiting:** ~~Jurist design gate (package §6, Q1–Q6)~~ **DESIGN-GATE PASSED 2026-07-18** (`chamber-library/docs/coordinate-contract-design-gate-JURIST-RULING-2026-07-18.md`, filed verbatim): Option B confirmed in substance, **REFRAMED** — ONE constitutional contract (a 1-based line in `source_file`, valid against `source_sha256`; hash-locality extended from *which file* to *where in the file*); the producer's index = a tool detail in a **declared transitional state** ending at translation (consumers build to one contract and refuse anything marked untranslated). **EXTENDED by two findings the package didn't reach:** (1) the contract binds **ALL FIVE field families** per §III's shared-substrate clause — mixed-frame sidecars forbidden at any committed point; translation covers all five in one operation per work (vehicle decided at #2's build; the mixed state never allowed); (2) `notes[]`'s credit stated explicitly **linkage-only** — it does not extend to its line coordinates. D3 name-the-frames (one per-sidecar declaration, **schema-optional / gate-required**, FIX lane, Naming note); D4 **declare now on all eleven**; Q4 one docket PROPOSAL weight + FIX parts; Q6 **multi-point probe per work**, honest-refuse where no single constant holds. Datum-not-ledger third unbidden instance recorded (candidate stands; trigger sharpened to domain-external — candidates register ⟳ 2026-07-19). ~~Awaiting: steward REVIEWED-64~~ **REVIEWED-64 PLACED 2026-07-19 (`~/REVIEWED.md:599`, AUTHORIZED).** **FIX parts BUILT + LANDED 2026-07-19** (edit-set spine: `chamber-library/docs/coordinate-contract-amendment-edit-set-2026-07-19.md`, commit tagged REVIEWED-64): frames named as declared data (`sidecar.frames:` — landed-file · producer-index · `line_frame` schema-optional/GATE-REQUIRED) · gate stamps the producer frame + refuses undeclared/unknown/contract-at-#1 (witnessed red 181/187 → green 187/187) · all 11 landed sidecars declared `producer-index` (bounded diff ×11, 11/11 validate clean, shas untouched) · `notes[]` linkage-only stated (schema + YAML + report). ~~Awaiting: the jurist's PLACEMENT ruling~~ **PLACEMENT RULING PASSED 2026-07-19** (`chamber-library/docs/coordinate-contract-edit-set-JURIST-RULING-2026-07-19.md`, filed verbatim): E1–E5 pass (the contract-frame-at-#1 refusal noted as "the best thing in this build"); placement separable from weight; **(a) spec supersession → v2.2.0** on doctrinal-traceability (§III is where a successor looks). **Required correction APPLIED to §5** (requirement constitutional — verified ⇔ verified in the landed frame against `source_sha256`, never defaulted; MECHANISM → declared data `sidecar.translation:`, revisable without supersession; vehicle prescription → the no-mixed-frame property). **Both flags APPLIED** (schema doc renamed `sidecar-schema-LOCKED-2026-07-12.md`; `producer_frames` keyed to the named producer — unmapped → no stamp → HOLDS; red 186/188 → green 188/188). Pacing note recorded (pre-#2 batches grow the untranslated backlog — batch pacing ⟷ #2 scheduling coupled). ~~Awaiting: steward ratification~~ **RATIFIED 2026-07-19 (conversational) — spec v2.2.0 LANDED same day:** v2.1.0 frozen byte-identical · §III gains *The coordinate contract* subsection (landed-file rule · `line_frame` declaration · five families · no-mixed-frame · attest-never-default for geometry · graduation refusal · Ion demonstrative record preserved) · constitution = requirement, mechanism = declared data (`sidecar.frames:`/`sidecar.translation:`, revisable without supersession) · bounded-diff proven (header + subsection only, all else v2.1.0 verbatim). ~~Awaiting only: steward placement of REVIEWED-65~~ **REVIEWED-65 PLACED 2026-07-19 (`~/REVIEWED.md:605`) — PENDING-64 CLOSED.** Translation stays #2's (Region 4). Edit-set spine: `chamber-library/docs/coordinate-contract-amendment-edit-set-2026-07-19.md`.

## PENDING-65 — The one-door promotion rule: converted → verified is graduation through the current process
**Date:** 2026-07-19
**Tag:** [PROPOSAL] — the promotion criterion's *operation* is a named-open frontier of the ratified constitution (§Tiering & Fence: criterion `RATIFIED-SHAPE · OPERATION-BLOCKED`); by the §Governance change-class test this defines what the gate accepts (a promotion operation + exception-lane boundaries) → mandatory jurist ruling + steward authorization. S2a of the banked five-session plan (taken by steward-directed S1↔S2 swap).
**Summary:** Promotion of an extant canonical file to *verified* happens only by **graduation through the current process** — fresh conversion with the current front-end, complete conversion record, full current declared gate-list, landing as the new canonical file — with the extant tier serving three explicit roles (interim substrate · **witness corpus** at each promotion's convert-and-compare, divergences classified converter-better / curation-to-carry / regression · a narrow enumerated exception lane: already-through-the-door by gate-list version / source-missing stays fenced-out / V-SCAN honest-ABSTAIN on the deterministic bar), and **no certify-in-place or retrofit path exists under any name.**
**Rationale:** Certify-in-place collapses against the ratified text three ways: (1) V-TEXT verification *is* "re-convert + prose-word-guard" — the certification's expensive step produces the richer artifact (record, sidecar, provenance, typed anchors, current frontmatter), which in-place stamping then discards; (2) the extant tier cannot reach the ratified bar in place — §V: *"a canonical text without a conversion record is not verifiable and cannot enter canon"* — and mass record/frontmatter retrofit is forbidden by attest-never-default; (3) the known instances confirm the class (Eichmann DIRTY in the live engine manifest, ~4,712 filepos/split residues, graduated before catchable; REVIEWED-57's V-TEXT §6 sweep never ran — born-digital verbatim-uncertified as a class; censuses: 1,297 canonical `.md` / 11 sidecars 2026-07-19, 1,073 without v2 frontmatter 2026-07-05). The witness role-flip keeps the ratified criterion's comparison and flips only the artifact disposition; the frontmatter-migration `[needs-authorization]` item largely dissolves into the door; every promotion is priced as a re-anchor event (machinery proven 2026-07-19). **The two operation-blocks — (a) order-blindness, (b) edition-identity coupling — are NOT lifted by this proposal** (package Q3 puts them to the jurist).
**Options:** **(a)** one door as above, constitutional requirement (§Tiering & Fence subsection, MINOR supersession v2.3.0) + mechanism as declared data in `graduation-spec.yaml` (RECOMMEND); **(b)** certify-in-place as default with record retrofit (REJECT: contradicts §V/§VII quoted; requires mass-fabricated attestations); **(c)** dual-door — one-door for dirty files, in-place stamping for "clean-looking" ones (REJECT: "clean-looking" is exactly what the Eichmann case refutes; a second door under another name); **(d)** declared-data-only landing, no constitutional text (viable; package Q1 puts landing to the jurist — executor lean: constitutional, the frontier lives in the constitution).
**Recommendation:** (a). Grounds: the v2.2.0 requirement/mechanism split is the house pattern; the ratified migration window (`verified_under` / `re-verify-pending`) already contemplates exactly this interim tier; the witness comparison operationalizes the notes-are-part-of-the-work safeguard (§V Tier-3: curation carried *declared*, never silently merged or silently lost).
**Files affected (on ratification):** `docs/chamber-library-specification.md` (one §Tiering & Fence subsection via supersession, if Q1 rules constitutional) · `_curation/graduation-spec.yaml` (`promotion:` declared data — witness procedure, divergence vocabulary, exception membership, E1's gate-list-version boundary) · later, on the S2b pilot only: the promotion runner + `audit_cruft` residue-class fix (not this item).
**Sub-question surfaced, not answered (package Q5):** whether a declared minimal-sidecar class may exist for the exception lane (executor lean: no — one bar, one door).
**Package:** `chamber-library/docs/one-door-promotion-JURIST-PACKAGE-2026-07-19.md` (self-contained; Grounding quotes v2.2.0; consequence-trace Part IV; gate questions Q1–Q7 incl. Q3 operation-blocks and Q7 whether the S2b pilot — Eichmann first — is a ratification condition per the PENDING-63 pattern).
**Awaiting:** ~~Jurist design gate (package Part VII, Q1–Q7)~~ **DESIGN-GATE PASSED 2026-07-19 with corrections** (`chamber-library/docs/one-door-promotion-design-gate-JURIST-RULING-2026-07-19.md`, filed verbatim; dispositions applied in the package Addendum): **one-door CONFIRMED** — Part II point 2 "a proof, not a preference" (certify-in-place structurally unavailable). Q1 constitutional (requirement/mechanism split). **Q2 specification, REFRAMED:** "same comparison, disposition flipped" struck (vacuous against a fresh candidate) → **two obligations named separately** — source-fidelity = body-conservation vs a cross-converter *reference* conversion; witness comparison = **curation-preservation**. **Q6 curation-to-carry SPLITS** (the costliest catch — declaration cures silence, not intervention): fidelity-restoring → carry declared; **source-departing → never carried** (preserve + flag per §V Tier-3; the witness comparison makes latent Tier-3 violations visible rather than laundering them). Third catch: witness comparison is structurally blind → claim narrows to "**no prose content lost**", structural comparison = named open gap. Q3 **block STANDS on evidence grounds, per tier** (V-TEXT k-gram plausibly order-sensitive pending demonstration; V-DSL multiset deliberately order-blind, nothing verifies passage order); lift = positive demonstration per tier on real books; eyeball-ceiling declined without prejudice; **door and stamp separable — the door proceeds**; condition (b) property: the `verified` stamp names edition-identity + source sha, artifact-readable. Q4 E1 reworded (exempts *re-conversion*, not the criterion — the 11 Loeb are NOT verified); **omnibus promotion unit = owed declared-data definition before the pilot** (1,297 files vs 1,305 works). Q5 no minimal-sidecar class — on the stronger ground (absence-because-we-didn't-look is the refused default). **Q7 ratification condition:** Eichmann pilot must report divergence count · auto-vs-hand classified · resisted · source-departing instances · **human-minutes per file** (classification tractability decides whether the rule is operable at corpus scale). ~~**Awaiting:** steward placement of the REVIEWED entry~~ **REVIEWED-66 PLACED 2026-07-19 (`~/REVIEWED.md:611`, AUTHORIZED — proceed per the ruling; tag commits REVIEWED-66).** Now open: S2b prep (omnibus promotion-unit declared-data definition · `audit_cruft` residue-class fix) → the Eichmann pilot with the Q7 classification-tractability report (ratification condition) → the per-tier Q3 demonstrations (own evidence work) → the v2.3.0 constitutional text drafted to the corrected design. **S2b RUN 2026-07-19 (night, cont.):** omnibus promotion unit LANDED in declared data (`graduation-spec.yaml` `promotion:` — unit=work · event=container atomic · PENDING-63's Q2 distinction at two layers; sole attested member = the Levi Complete Works, 14 works; chamber `0e8ee89`) + the witness-comparison mechanism DECLARED (two obligations · Q6 split vocabulary · narrowed claim; `b67c73c`) + **the Eichmann pilot RAN and the Q7 report is FILED** (`docs/one-door-eichmann-pilot-REPORT-2026-07-19.md`, `7e923f3`+`f32cd3d`; harness+census data in `_curation/eichmann-pilot-2026-07-19/`): 2,521 raw divergence spans → 41 after declared folds (98.4% auto-disposed), 0 regressions / 0 curation-to-carry / 0 source-departing (caveat: this witness carries no curation), ~15 human-min/file given the harness — **classification is tractable; one-door is a rule, not an aspiration, for this class**. Pilot findings awaiting steward/jurist (report §8): (1) `converter-worse` vocabulary addition (Docling's HTML backend flattens ALL typography at parse time — byte-verified; plus small-caps/mid-word splits); (2) lane-per-format-class ruling (pandoc `-t markdown-smart` is byte-faithful for born-digital EPUBs; Docling keeps the scan/OCR tier); (3) recognizer extension to the Kindle filepos mirror family (PENDING-54's ruled shape in different dress — `audit_footnotes` honest-refused, byte-characterized); (4) **the V-TEXT Q3 demonstration RAN and REFUTED the guard's order-sensitivity** (real-book paragraph swap → byte-identical gate verdicts; the witness comparison catches it exactly, one 217-word delete + insert pair) — the Q3 block now stands for BOTH tiers on demonstrated grounds. Graduation deliberately NOT completed (blocked on rulings 1–3). ~~**Awaiting: steward/jurist sitting on the report's §8 items.**~~ **RULED same night 2026-07-19** (`chamber-library/docs/one-door-eichmann-pilot-JURIST-RULING-2026-07-19.md`, filed verbatim; report §9 Addendum records the applied dispositions): **Q3 block stands BOTH tiers** (V-TEXT demonstrated · V-DSL design grounds; the jurist WITHDREW the order-sensitivity assessment — *coverage metrics are blind to any permutation preserving local windows = a block move*; refuted-by-default henceforth) + **the no-witness order gap DOCKETED** (ALL fresh graduations incl. 11 landed + 952 queued Loeb have NO order guard on any wired path; remedy = position-sensitive sequence alignment vs the reference conversion — ruled work, own slot); **F5 `converter-worse` LANDED** in declared data (isolated-vs-systematic disposition FORK + content-damage folded in; fleet 191/191); **F4 ruled a COMPLIANCE finding** — interim stop IN FORCE (born-digital EPUB off Docling pending remedy; CLAUDE.md + runbook flagged) → **PENDING-67** (the per-tier lane amendment vs PENDING-56); **F2 recognizer widen = provisional FIX authorized** (final on end-to-end proof; REVIEWED-55 standing rule); **Q7 condition MET — ratification may proceed**, tractability SCOPED to machine-output witnesses → **the Levi-omnibus curation-bearing second pilot before scale**; flag-1 (pin V-TEXT reference-conversion parameters as declared data, WIRED not declared-only) = owed with the next gate-touching slot; flag-2 (byte-check the mid-word splits) = DISCHARGED same night, finding STRENGTHENED (all 4 sites byte-confirmed: emphasis-boundary x2 + empty-filepos-anchor x2 mid-word; systematic serializer behavior, not incidents). **Now open (named slots):** PENDING-67 package draft (next session) · F2 provisional build + Eichmann graduation leg (next session) · the Levi second pilot (after the omnibus event machinery) · the order-guard extension (Q3 docket) · flag-1 wiring · v2.3.0 text (post-pilot-arc).

## PENDING-66 — `fidelity_equivalence@2` candidate: convention-form folding (the V1 build surfaced it; jurist-gated by the V0 ruling itself)
**Date:** 2026-07-19
**Tag:** [PROPOSAL] — every `fidelity_equivalence@N` bump requires jurist ratification before it governs a `guaranteed` verdict (V0 Ruling 2026-07-05, §2.2; `cluster-a-data-model.md` §5.1). Engine-side (D-1 repo), routed through the loop per that one named exception — the PENDING-48 lane.
**Summary:** Building V1's normalized-match stage surfaced the predicted equivalence gap: the manifested corpus is **heterogeneous per source (not per language) in apostrophe/quote/dash convention** (2026-07-19 census: Weil-Enracinement 6,721 straight / 0 curly apostrophes; Mauss 4,393 curly / 2 straight; Musil 5,014 curly double-quotes vs Arendt 3,428 straight; guillemets in both FR sources), while **every `@1` fold class is zero corpus-wide** (no long-s, fold-ligatures, soft-hyphens, or ß) — so under `@1` as ratified, the same lexical French elision quote verdicts `guaranteed` against Weil and `altered` against Mauss depending on which apostrophe the quoter typed: the verdict tracks the source's conversion history, not the fidelity of the words.
**Rationale:** Convention-form (U+2019↔U+0027; curly/straight/guillemet quote forms; em/en-dash forms; `…`↔`...`) is *typographic convention* by the Ruling's own line (glyph varies, word untouched) but is not among `@1`'s enumerated classes ("and nothing else"). Per the standing instruction, this is jurist-lane, not a code decision: **V1 implements `@1` exactly as ratified** — convention-form mismatches verdict `altered`, loudly, with the residual sub-classified `convention-form` (reporting only, never acceptance), so the jurist question arrives with real instances (live demonstration on Mauss recorded).
**Options:** **(a)** ratify `fidelity_equivalence@2` folding the enumerated convention-form classes (RECOMMEND — the typographic-in/orthography-out line, applied consistently; census as evidence); **(b)** keep `@1`, ruling convention-form differences genuinely alteration (valid; the checker already reports them legibly); **(c)** defer until the one-door reconversions normalize conventions at the source layer (interacts with PENDING-65; convention normalization is §V Tier-2's "riskiest member" chamber-side — permitted only on concrete need, catalogued).
**Recommendation:** (a), with the class list enumerated exactly and orthography (œ/æ, diacritics, ß) explicitly still out. Full analysis + census table: `studium-engine/docs/spec/v1-verify-quote-note.md` §4.
**Files affected (on ratification):** `engine/fidelity.py` (a `@2` fold table + version bump; `@1` retained), `docs/spec/v1-verify-quote-note.md` (§4 disposition update), `tests/test_verify_quote.py` (convention cases flip expected verdict under `@2`).
**Package:** `studium-engine/docs/fidelity-equivalence-2-JURIST-PACKAGE-2026-07-19.md` (self-contained, repo-blind; Grounding quotes the V0 Ruling + cluster-a §5.1 + chamber §V Tier-2 both ways; full 13-source census table + the live Mauss demonstration; the candidate enumerated in two severable groups — Group A pure char folds / Group B adjacency-rule folds, executor lean A-now-B-evidence-gated; stays-out list explicit; register-erosion argument for ruling rather than indefinite deferral; gate questions Q1–Q5 incl. whether typographic-in/orthography-out is recorded as the governing test for future @N candidates).
~~**Awaiting:** Steward relay of the package to the jurist~~ **RULED 2026-07-19** (`studium-engine/docs/fidelity-equivalence-2-JURIST-RULING-2026-07-19.md`, filed verbatim) **+ BUILT + LANDED same day: `@2` GOVERNING.** Group A RATIFIED on argument; **Group B severed at a different seam than proposed** — guillemets ratified WITH A (A-alone leaves French quotation unfixed — the jurist's own extension), conditional on the adjacency rule enumerated to character-map completeness (**condition DISCHARGED**: `engine/fidelity.py` states the WS class exactly — 29 code points incl. U+00A0/U+202F, the ruling's named case — and every boundary case); **the DASH fold REFUSED** on a risk sharper than the package named (U+2014→U+002D collides parenthetical with compound BY FORM, not only spacing) — dash mismatches stay `altered`/`convention-form`, evidence-gated. Q3 stays-out confirmed. Q4 confirmed + **superset-only-loosening recorded as a requirement on future `@N`** (a narrowing bump = re-verification obligation). Q5 confirmed + the second question added (*does any lexical/structural distinction ride on this form?* — never→argument suffices; sometimes→evidence required). Third-verdict alternative considered and DECLINED (a convention-form match IS the same words → `guaranteed` is correct). **Recorded obligation: the Greek/Latin wave (952 Loeb) requires its own orthography census before any relation is claimed adequate for it; findings arrive as `@3` on new grounds, never a quiet extension.** Build: tests flipped first (witnessed red ×5), `@1` frozen as `fidelity_normalize_v1`, `@2` implemented + governing; two implementation catches pinned by tests (stage-2 acceptance = the relation itself, not a word-aligned approximation — the guillemet rewrite folds across word boundaries; fragment-before-final-punctuation = quotable sub-span, stage-1/stage-2 semantics unified); suite 42/42, gate 24/24; live re-runs: the Mauss elision case now GUARANTEED(normalized), a real guillemet passage typed straight GUARANTEED(normalized), dash case still ALTERED. **CLOSED.**

## PENDING-67 — Per-tier conversion lanes: born-digital EPUB off Docling (amendment against PENDING-56's single-front-end ratification)
**Date:** 2026-07-19
**Tag:** [PROPOSAL]
**Summary:** Draft the lane amendment the Eichmann-pilot ruling (§4) requires: PENDING-56 ratified Docling as *the* conversion front-end; the pilot measured its EPUB path performing prophylactic, uncatalogued §V Tier-2 normalization (ALL typography flattened at parse time — em/en-dash, curly quotes, ellipsis; the loss is in Docling's own document model, not the serializer) plus Tier-3 word damage (mid-word inline-element boundaries — emphasis spans, empty filepos anchors — serialized as spaces; byte-confirmed ×4, systematic). The jurist ruled this a COMPLIANCE finding, not a preference: Docling's EPUB path cannot produce a constitutionally compliant canonical text for this format class while the parse-time loss stands.
**Rationale:** Moving to per-tier lanes changes what a ratified decision established → its own PROPOSAL, "drafted rather than the practice quietly diverging from the ratified text" (ruling §4). The INTERIM STOP is already in force (jurist-ruled; recorded in chamber CLAUDE.md + the conversion runbook): born-digital EPUB does not route through Docling pending remedy. The scan/OCR case is untouched — "flat on EPUB, rich on PDF, transformative on scanned" was PENDING-56's own trial finding; "flat" has now been measured as "damaging" for this class.
**Options:** (a) per-tier lanes — pandoc `-t markdown-smart` per-spine + governed cleaners + the note-layer for born-digital EPUB (byte-faithful at the measured sites); Docling for scan/OCR/PDF; (b) hold the single-front-end text and wait on an upstream Docling fix (the amendment should be written to accommodate a fix rather than foreclose it, per the ruling).
**Recommendation:** (a), with an explicit revisit-trigger on an upstream fix (the amendment names the parse-time loss as the condition; if Docling's HTML backend preserves typography in a future version, the lane can be re-widened by FIX).
**Evidence:** `chamber-library/docs/one-door-eichmann-pilot-REPORT-2026-07-19.md` (F3/F4 + §9 flag-2 byte-census) + `…-JURIST-RULING-2026-07-19.md` §4 + `_curation/eichmann-pilot-2026-07-19/` (harness + census data).
**Files affected (on authorization):** `_curation/conversion-runbook.yaml` (routing) · `chamber-library/CLAUDE.md` (fleet/terminology lines) · the PENDING-56 record layer (amendment cross-ref) · `_curation/graduation-spec.yaml` if the lane is encoded as declared data.
**Awaiting:** Jurist design gate (steward to relay). **Package DRAFTED 2026-07-20** — `chamber-library/docs/per-tier-conversion-lanes-JURIST-PACKAGE-2026-07-20.md` (the first exercise of the `/jurist-package` skill; hook-passed, GROUNDED-IN §V Tier-2/Tier-3 + conversion-record + §Governance + PENDING-56/REVIEWED-56 D1 + the pilot ruling §4 + report F3/F4/§9, all quoted verbatim). Five gate questions posed (Q1 landing · Q2 lane-boundary · Q3 re-widening-class · Q4 eligibility-reach · Q5 one-door-interaction). Executor lean: **no new constitutional text** — §V already forbids the acts (prophylactic uncatalogued Tier-2 + Tier-3 word alteration); the amendment operationalizes §V as a front-end eligibility rule (census-before-trust) + declared-data routing (`conversion-runbook.yaml`) + a REVIEWED superseding REVIEWED-56's D1 clause; re-widening gated on a fresh byte-census, not a changelog. **RULED 2026-07-20** (`chamber-library/docs/per-tier-conversion-lanes-design-gate-JURIST-RULING-2026-07-20.md`, filed verbatim; dispositions in the package Addendum): proposal SOUND, compliance framing confirmed. **Q1 SPLITS** — III.2 lane assignments = declared data; **III.1 eligibility rule = CONSTITUTIONAL** (overrules the executor lean — §V is silent on *who must demonstrate compliance, when, by what evidence*, the gap PENDING-56 fell through; A3 legibility) → one-line §V note, MINOR → v2.3.0, folded atomically with the queued one-door text. **Q2** boundary named by MECHANISM (any source class whose Docling path routes through the HTML backend; presently = all born-digital EPUB); over-inclusion is FREE not a cost. **Q3** re-widening = FIX, conditioned on the census SPECIFIED as declared data (sample · char-classes · whether partial preservation passes). **Q4** general, gating ADOPTION not use. **Q5** confirmed + **DISCHARGED** — graduation-record check ran 2026-07-20: **verified-zero** (zero EPUB-via-Docling in canon ever; only Docling file = Bringhurst PDF; window added only 11 Loeb DSL; 0 re-conversions) → purely forward-looking, no live breach. Forward item (unconditioned): the **per-conversion typography gate** (byte-census wired per-conversion, closes the §V Tier-2 blind spot) — named horizon, future PROPOSAL. **REVIEWED-67 draft in the package Addendum; awaiting steward placement.**

## PENDING-69 — One-door V-TEXT graduations REVIEW-hold structurally: the boundary-drop resolution mechanism
**Date:** 2026-07-21 *(numbered 69: REVIEWED-68 was consumed by the v2.3.0 placement gate with no paired PENDING)*
**Tag:** [PROPOSAL] — changes what the body-conservation gate accepts (a REVIEW-resolution path) → change-class PROPOSAL per §Governance.
**Summary:** The first one-door landing (Eichmann, 2026-07-21, chamber `780106b`) surfaced a structural seam: `verify_body_conservation`'s V-TEXT verdict is `REVIEW if boundary_runs`, and the graduation-spec's mandatory trims (front matter, ToC, index) ARE boundary runs by construction — so **every trimmed one-door V-TEXT graduation holds at the wired door with no mechanism to consume the human identification** the REVIEW verdict requests. The Eichmann hold was reconciled 1:1 against the declared `trim.drop` list (interior_loss ZERO in both runs), the identification performed under the steward's live directive, and the move completed manually with the wired REVIEW verdict preserved in the run record — honest, but not repeatable at class scale (47 files remain).
**Rationale:** REVIEWED-57 ruled "REVIEW holds (human drop-vs-keep identification)" without specifying how a performed identification reaches the gate; the one-door trims (REVIEWED-66/v2.3.0) made the collision structural. Attest-never-default applies: the resolution must be a positive, attributed attestation, never a bypass flag.
**Options:** **(a)** an attested boundary-drop declaration the gate consumes — the candidate (or a per-run declared-data entry) carries the identified drop classes (declared-trim / relocation) with by/date, and the gate re-derives the boundary runs and PASSES only those fully covered by the attestation (RECOMMEND — the identification becomes checkable data, the gate stays the enforcer); **(b)** the gate learns the trim classes itself (compare against the trimmed reference) — larger, and hides the human step; **(c)** status quo + manual completion per file, hold recorded each time (honest but unwired — the gap-shape this arc keeps closing).
**Recommendation:** (a), design brief FOR-JURIST before code (gate-acceptance territory).
**Files affected (on authorization):** `scripts/verify_body_conservation.py` or `scripts/graduate_to_canonical.py` (the gate's REVIEW consumption), `_curation/graduation-spec.yaml` (the attestation shape as declared data), `scripts/test_tools.py`.
**Evidence:** `_curation/tool-evolution-log.md` 2026-07-21 (the landing record; the two wired-door runs both REVIEW-held on exactly the 8 declared-trim boundary runs); the door's own dry-run output preserved in the session record.
**Package DRAFTED 2026-07-22** — `chamber-library/docs/PENDING-69-boundary-drop-attestation-JURIST-PACKAGE-2026-07-22.md` (via `/jurist-package`; hook-passed, GROUNDED-IN §Tiering&Fence one-door + §V Tier-3 + §VII + §II + REVIEWED-57 + the gate's ratified verdict logic, all quoted verbatim). Substrate-first finding (the literal question, answered from `verify_body_conservation.py`): the gate classifies boundary runs by POSITION+SIZE only, takes no drop-declaration argument, and provably cannot tell a spec-class drop (index) from a keep (endnotes) or a relocation-residue drop (the NOTES husk) — it emits REVIEW and stops. So the honest mechanized part = coverage (every derived run attested) + interior-zero (teeth unchanged) + attribution; the drop-vs-keep judgment stays human, turned into checkable data. Seven gate questions posed (Q1 landing · Q2 the split-vs-vocabulary fork = the literal question · Q3 the honest gate/human division · Q4 bind-to-derived-runs · Q5 relocation two-sidedness/`moved_to` · Q6 omnibus interaction · Q7 Eichmann-as-first-fixture ratification condition). Executor lean throughout: attest-never-default resolution, minimal constitutional sentence + declared-data mechanism, forward-only (no re-verify storm; 0 files hold `verified`).
**DESIGN-GATE PASSED 2026-07-22** (`chamber-library/docs/PENDING-69-boundary-drop-attestation-JURIST-RULING-2026-07-22.md`, filed verbatim; dispositions in the package Addendum). Spine confirmed (positive attributed attestation only; interior teeth untouched; never a bypass). **Q2 RULED (b) vocabulary-only AGAINST the executor lean** — `trim.drop` is a controlled label set, not pre-verified drops; every run is per-file attested (the gate can never confirm class membership; a privileged spec-class = trust-by-name, the `app[]`/ABSTAIN collision shape). One layer, not two; `relocation` is another label distinguished only by `moved_to`. **Q3** floor confirmed + structural-falsification check ADOPTED (executor decision, recorded, steward-overridable) for `index`/`table-of-contents` only (signature mismatch HOLDS for reconciliation, never silent pass / never un-overridable block); declined where no clean signature. **Q4** bind-to-derived-runs ELEVATED to a required property. **Q5** `moved_to` required (incomplete = rejected attestation; fabrication-exclusion scoped to exactly the named span). **Q6** per-candidate; omnibus interior-run interaction named for the Levi pilot. **Q7** Eichmann first fixture + deliberate negatives (un-attested run→HOLD; interior deletion→FLAG). **Named tension:** wires human-in-the-loop for discipline, not removal — the 47-file wave is NOT unattended batch. **REVIEWED-69 draft in the package Addendum; awaiting steward placement.**
**MECHANISM BUILT test-first 2026-07-22** (branch `reviewed-69-boundary-drop-resolution` @ `21e3499`, NOT on main — steward merges on confirmation, per the session commitment "nothing lands on main without your confirmation"). `verify_body_conservation.resolve_review` (pure; additive `boundary_run_sig`, ratified verdict logic UNCHANGED + seed-test re-confirmed) + `graduate_to_canonical._resolve_boundary_review` (thin consumer; no attestation → REVIEW HOLDS) + `graduation-spec.yaml` `boundary_drops:` (declared-data vocabulary/policy, GROUNDED-IN the ruling). Corrected shape built: Q2 vocabulary-only, Q3 signature-falsification (index/ToC), Q4 bind-to-derived-runs, Q5 moved_to presence. Fleet 214→216. **Q7 CAPSTONE PASSED on the REAL Eichmann** — verdict=REVIEW, interior_loss=0, boundary_runs=8 (3 leading front-matter + 5 trailing index fragments) reproduces the hand-verified 1:1 reconciliation as a mechanical PASS; both negatives refuse (un-attested→HOLD; interior deletion→FLAG). Substrate lesson captured (tool-log): the k-gram aligner is move-blind → boundary runs are DROPS, `relocation` is the rare reordered case (my package's husk-as-relocation-run framing was imprecise; the 8 runs are front-matter+index, no relocation among them). Added-side fabrication-exclusion (Q5 second clause) = scoped follow-on, conservative absence (FLAGs, never silent-pass).
**RESOLVED 2026-07-23 — all three steward actions complete; PENDING-69 CLOSED.** (1) REVIEWED-69 placed (steward). (2) Branch `reviewed-69-boundary-drop-resolution` fast-forward-merged to chamber `main` (`f466ed0`) + pushed both remotes (github + origin) — the mechanism (`21e3499`) is live. (3) Vehicle call resolved by fact — **standalone MINOR bump, spec v2.4.0**: the ruling permitted folding into the next assembling supersession *if one were pending*, none was (v2.3.0 landed, everything since is FIX work), so the one ruled §Tiering & Fence sentence landed operative now (`f466ed0`; v2.3.0 frozen byte-identical `-v2.3.0.md`; bounded diff proven; fleet 216/216). **Next (unchanged, now unblocked):** the Levi curation-bearing second pilot before scale (`promotion.scale_application`) → the 47-file wave (human-in-the-loop, Zibaldone next). Literal question held for the pilot: do curation-bearing divergences classify tractably into the ruled vocabulary, and is the mechanism's silence on inter-work (interior) drops correct at multi-work scale? **[SUPERSEDED as the next step by PENDING-70 — the pilot is HELD pending that ruling.]**

## PENDING-70 — The legacy witness: what curation-preservation and scale-application mean when the canon predates the fleet
**Date:** 2026-07-23
**Tag:** [PROPOSAL] — gate-acceptance class (changes what `scale_application` requires + how the `curation_preservation` obligation reads for the legacy body). Change-class test = yes (changes what the scale gate accepts) → PROPOSAL → jurist ruling + steward authorization.
**Summary:** Prepping the Levi second pilot surfaced that the chosen witness is not editorially curated but silently DAMAGED — a 2026-06-16 image-drop cleanliness pass mutilated character-bearing glyphs mid-word (verified live: Wstawać→Wstawa ×9, Brașov→Braov, Oświęcim→Owicim, each confirmed by the passage's own gloss). The steward named the structural cause: the ENTIRE canon was converted before this constitution and before the current fleet, so the extant canonical is a pre-fleet conversion, not a trustworthy hand-curated witness — and some divergence classes may be structurally un-exercisable against the extant body.
**Census (2026-07-23, dated observation):** `canonical_texts/` = 1,297 `.md`; ~23 still carry image refs, the rest image-free. 248 have a diffable backup; **13 of those carry mid-word character-glyph drops (55 sites)** — Jung *Collected Works* (18), Levi (18), Derrida, Jung *Black Books*, *Lexique de l'Imprimerie Nationale*, Leopold, Donne, Blake, Bakewell, Leopardi *Zibaldone*, *Huang Po*, Lichtenberg (German), Leibowitz. **Lower bound** — undetectable from text for the ~1,049 files with no backup; only re-conversion from source reveals it.
**Rationale:** The constitution already holds the decisive frame — for V-TEXT *"the source *is* ground truth,"* and *"converted"* means *"Not yet trustworthy … merely converted + filed."* So this is an APPLICATION of the constitution, not an overturning: the witness comparison's claim scope degrades with the witness (curated → curation-preserved; legacy → no-regression-floor), and `scale_application`'s "genuinely hand-curated witness" requirement may be unsatisfiable against the extant body. A dropped character-glyph is also a §V Tier-3 word-alteration-by-omission (forbidden), making the legacy calibre+strip front-end retro-ineligible and the one-door wave a verbatim-fidelity restoration.
**Package (self-contained, jurist-ready):** `chamber-library/docs/scale-application-legacy-body-JURIST-PACKAGE-2026-07-23.md` (GROUNDED-IN v2.4.0 §V + §Tiering & Fence + the declared data, quoted verbatim; four gate questions with leans: Q1 curated/legacy witness split · Q2 reframe scale condition · Q3 character-as-image = Tier-3 by omission + corpus-integrity · Q4 honest-degradation surface).
**Recommendation:** relay to the jurist. Executor leans in the package (Q1 yes · Q2 option-a reframe · Q3 yes both · Q4 yes light).
**Files affected (on ratification):** spec supersession v2.4.0→v2.5.0 (requirements only) + `graduation-spec.yaml` declared data (`scale_application.condition` reworded, `witness_class` field, glyph-map, census). No re-verify storm (no file holds `verified`).
**RULING RECEIVED 2026-07-23 — design-gate PASSED** (`docs/scale-application-legacy-body-JURIST-RULING-2026-07-23.md`; Addendum + REVIEWED-70 draft appended to the package). Q1/Q3/Q4 CONFIRMED (Q1 corrects a defect in the one-door ruling's own wording; Q4 mandatory-not-optional). **Q3 HARD PRECONDITION:** glyph-mapping wired + demonstrated on Levi's 3 sites (Wstawać/Brașov/Oświęcim) before ANY imaged source enters the lane — incl. the pilot's own conversion (else re-conversion re-inflicts Tier-3 damage under a PASS-reporting gate). **Q2 accepted in principle, SUBSTITUTE CONDITION ruled** (my reframe dropped the judgment-cost test): (a) enumerate demonstrable classes in advance; (b) pilot MUST report judgment cost incl. source-adjudication of mutilation sites; (c) both curation-to-carry un-exercised w/ reason, first demo bound to first curated work; (d) scale opens for legacy-witness promotions ONLY. Representativeness discharged: 5% (13/248) is NOT a corpus rate (curation-selected batch); the 13 are a confirmed floor.
**STEP 1 DONE 2026-07-23 — REVIEWED-70 placed; spec v2.5.0 LANDED on main (`e37e076`, pushed both remotes).** Constitution: Q1 claim-scope split (§Tiering & Fence) + Q3 Tier-3-by-omission (§V) + Q4 legacy-fidelity-not-self-certifiable (§Trust Attestation). Declared data: reframed `scale_application` (substitute Q2 condition) + `witness_class` + `character_as_image` (census + Levi glyph-map candidates, demonstration-owed). v2.4.0 frozen byte-identical; bounded-diff proven; fleet 216/216. **REMAINING (ordered):** STEP 2 = glyph-mapping lane build — wire char-image→Unicode into `convert_lane_borndigital.py` + **demonstrate on Levi's 3 sites** (extract src images 000042/000023/000034/000004, confirm ć/ș/ś/ę) [the Q3 hard precondition]; STEP 3 = run the Levi pilot on the substitute condition (needs judgment-cost reporting). **The pilot is HELD until glyph-mapping is demonstrated.** Next bite = STEP 2.

## PENDING-71 — Born-digital V-TEXT source-fidelity has no cross-converter independence (F4 voided the premise the constitution rests it on)
**Date:** 2026-07-24
**Tag:** [PROPOSAL] — gate-acceptance class (redefines the reference the body-conservation gate compares a V-TEXT candidate against). Carries [ESCALATE] weight: it surfaces a contradiction inside the ratified constitution (§Tiering & Fence lines 969 ↔ 1046) that the executor cannot resolve; do NOT proceed to pin/build until the jurist rules.
**Summary:** Closing Flag-1 (the owed "pin the V-TEXT reference parameters") exposed that, after F4 (2026-07-19) routed born-digital candidates onto pandoc, the candidate (`pandoc -f epub -t markdown-smart`, `convert_lane_borndigital.py:36`) and the gate's reference (`pandoc -f epub -t gfm-raw_html`, `verify_body_conservation.py:74`) share pandoc's ONE EPUB reader → one AST → the gate is BLIND to reader-level prose loss and its only divergences are writer-level markup. The constitution's source-fidelity obligation (§Tiering & Fence 1046) explicitly requires "a reference conversion **by a different converter** (pandoc for V-TEXT); cross-converter, the real verification of the words" — a premise F4 voided for this tier (the clause named pandoc as the reference *because the candidate was Docling*; F4 moved the candidate to pandoc). So source-fidelity for born-digital currently verifies markup, not words; Flag-1's parameter-pinning cannot restore it (pinning drives toward the vacuity the spec's own line 1042 names).
**Rationale:** This is the structural reason the 2026-07-24 scale-pilot's §6 source-fidelity leg stayed UNDISCHARGED (jurist-caught), re-weighted from hygiene to gate-blocking. The constitution is also internally split: line 969 frames the V-TEXT reference as "re-convert (deterministic; source is ground truth)" [same-converter OK] while line 1046 demands "a different converter." Whichever the jurist keeps, the clauses must be reconciled. Measured on Levi (read-only, 2026-07-24, `scratchpad/measure_flag1.py`): source→gfm vs source→markdown-smart differ by 768 / 31,824 tokens, ALL markup, ZERO prose; the gate FLAGs the clean candidate at 96.75% match / 7 interior-loss runs (all TOC/page-anchor markup); switching the reference to the candidate's own writer → 99.97% match / 0 interior-loss (residual 287-token FLAG = footnote-injection difference, still not prose) → a clean PASS only at reference≈candidate = vacuous.
**Options (the fork, for the jurist):** **(a)** restore genuine cross-converter independence — reference from a non-pandoc extractor (calibre `ebook-convert` / from-scratch XHTML-spine pull) + a format-agnostic prose-projection normalizer + the built PENDING-69 attestation for residue; **(b)** drop the cross-converter claim — reference = the candidate's own pipeline up to but not including the cleaners (inject→glyph→pandoc, uncleaned), so the gate isolates the cleaner+curation delta (non-vacuous by construction; aligns with REVIEWED-57's "converter-agnostic re-convert, source is ground truth"; but trusts pandoc's reader and makes "source-fidelity" a partial misnomer); **hybrid** — (b) per-file + (a) as a periodic per-format-class reader-audit.
**Recommendation:** relay the package to the jurist. Executor lean (surfaced, not decided): the hybrid — (b) as the routine gate + (a) periodically — because F4's byte-faithfulness was site-scoped, not a global reader-losslessness proof. Under (b) alone, rename the obligation conversion-fidelity so it doesn't launder reader-trust as source-verification.
**Package (self-contained, jurist-ready):** `chamber-library/docs/borndigital-source-fidelity-reference-JURIST-PACKAGE-2026-07-24.md` (GROUNDED-IN §Tiering & Fence v2.5.0 lines 969/1042/1046 + Flag-1 §7 + F4 disposition + REVIEWED-57 + REVIEWED-66, all quoted verbatim; measurement inlined; five gate questions Q1 confirm-finding · Q2 which resolution · Q3 naming · Q4 Flag-1 subsumed · Q5 interim-block, each with a lean).
**Files affected (on ratification):** spec supersession §Tiering & Fence (reconcile 969↔1046 to the ruled design; MINOR) + `graduation-spec.yaml`/`conversion-runbook.yaml` declared data (converter/params + normalizer + audit cadence) + `scripts/verify_body_conservation.py` (`reference_tokens_epub`). No re-verify storm (0 files hold `verified`).
**RULED 2026-07-24 — design-gate PASSED, executor lean OVERRULED** (`docs/borndigital-source-fidelity-reference-JURIST-RULING-2026-07-24.md`, filed verbatim; Addendum + REVIEWED-72 draft appended to the package). **Q1 confirmed + sharpened:** the finding is architectural (a priori), but "verifies markup not words" OVERSTATED — the gate is blind to READER-loss ONLY; post-reader damage (injection/glyph/cleaner) DOES surface. TWO problems separated: (i) shared-reader (structural, unfixable) · (ii) markup-noise (writer mismatch — **Flag-1 fixed it, right-but-insufficient not misdirected**). **Q2 ruled AGAINST my (b)/hybrid lean:** the ruled reference design = **the package's own run (3)** — source-anchored + writer-matched (pandoc `-t markdown-smart` on the RAW source EPUB, already measured 0-interior-loss/0-boundary/99.97%), injection+glyph deltas **declared-and-excused** (PENDING-69 `moved_to` shape; fabrication elsewhere still FLAGs), PLUS (a) a periodic per-format-class reader audit (cadence/trigger[pandoc major-version bump]/pass-criterion = declared data, specified in advance). I under-read my own run (3): a clean PASS needs the residual ACCOUNTED FOR, not ZERO. Q3 keep "source-fidelity" (scope: fidelity to the source as parsed by the lane's reader). Q4 pin the RULED design. Q5 wave stays blocked; **UNBLOCK = clean-file PASS on the ruled design + a deliberate NEGATIVE (real prose loss still FLAGs).** Clause 969/1046 RECONCILED (both survive): 969 = per-file check (run 3); 1046 cross-converter independence RELOCATED to the periodic audit, not struck. Amendment-discipline gains: **when a change reassigns a named component, check what else names it** (F4-moved-candidate-onto-pandoc voided 1046, never cross-checked).
**Awaiting:** steward placement of REVIEWED-72 (draft in the package Addendum) → build the ruled reference design + specify the audit as declared data + demonstrate unblock (clean PASS + negative) → then the wave. Land the 969/1046 reconciliation as a §Tiering & Fence supersession.

## PENDING-72 — The voice-purity sidecar as part of the engine-consumable graduation bar (all tiers, not V-DSL only)
**Date:** 2026-07-24
**Tag:** [PROPOSAL] — gate-acceptance class (changes what graduation requires before a canonical is engine-consumable). Change-class test = yes → PROPOSAL → jurist ruling + steward authorization. Steward-directed to secure the judgment NOW (before the corpus-work phase) to avoid a mid-momentum jurist-wait later.
**Summary:** Graduating Warde surfaced that the `studium/meta@1` sidecar is ONE unified artifact with two content depths — **baseline** (`source_sha256` binding + `sections[]` voice-purity map, `role`/`citable`) which the engine `ingest_gate` enforces for every apparatus-bearing voice, and **rich** (`notes[]`/`anchors[]`/`app[]` typed apparatus) extractable only from a typed source. Chamber graduation's `sidecar_gate` produces it **V-DSL only** (11 loeb `.meta.json`); the 19 non-DSL engine voices (musil/eichmann/camus…) carry the baseline depth **hand-curated engine-side after graduation** (no standing builder — only test fixtures write `corpus/sidecars/`). So `sidecar_gate`'s "Other tiers: not-applicable" conflates the two depths: true for the rich depth on V-SCAN (no typed structure), FALSE for the baseline voice-purity depth (every consumable voice needs it).
**Rationale:** A canonical is engine-consumable WITHOUT a sidecar — it defaults to **whole-file** (`sidecar-schema-LOCKED §1`), serving in-body apparatus AS the voice. The one-door trim removes front/back matter but NOT in-body apparatus (a second author's introduction, translator's note, reproduced specimen). **Realized failure:** Eichmann one-door-graduated 2026-07-21 yet its engine sidecar still fences Amos Elon's introduction `[15,107]` from Arendt `[108,856]`; its `_reviewed` note records an earlier whole-body sidecar that **LEAKED** the publisher matter + Elon's introduction into the served text. At wave scale this = every apparatus-bearing non-DSL canonical waits for hand-curation (momentum) or serves a polluted voice. Warde's reproduced CUP Bible facsimile pages are the immediate `citable:false` call no gate currently forces.
**Proposal:** Requirement (constitutional) — engine-consumable graduation requires **attested voice boundaries** across all tiers: a `sections[]`+binding sidecar, OR a positive `whole-file` attestation (attest-never-default, mirroring `sectionless:true`); a silent whole-file default is the gap. Mechanism (declared data) — the boundaries are interpretive (curation, per `_reviewed` derivations), so the gate checks only existence + binding (`source_sha256==live`) + schema-conformance, never boundary *correctness* (same shape as REVIEWED-69 boundary-drop / `source_verified`). Rich depth UNCHANGED (V-DSL-first deferral preserved; N/A for V-SCAN) — this is only the baseline voice-purity depth.
**Options / forks (gate questions in the package, w/ leans):** Q1 require attested voice-boundaries all tiers (lean yes) · Q2 locus — chamber-produced (protocol-neutral graduated bar, engine reads) vs engine-side D-1 + chamber existence-check (lean chamber-side, held loosely — crosses into engine territory) · Q3 gate checks existence/binding/schema not boundary-correctness (lean yes) · Q4 the 19 existing + silent-whole-file-default (lean forbid silent default forward, backfill as bounded FIX) · Q5 V-SCAN: baseline applies, rich does not (lean yes).
**Recommendation:** relay the package to the jurist. Executor leans above; the material forks (locus, whole-file-default-as-attestation) surfaced not pre-decided.
**Package (self-contained, jurist-ready):** `chamber-library/docs/engine-consumption-voice-purity-sidecar-JURIST-PACKAGE-2026-07-24.md` (GROUNDED-IN graduation-spec `sidecar_gate` + 2b Loeb-first ruling + sidecar-schema-LOCKED §1/§2 + engine `ingest_gate` contract + spec §Tiering&Fence, all quoted verbatim; the Eichmann leak inlined as the realized-failure evidence).
**Files affected (on ratification):** spec supersession (the voice-boundary-attestation requirement; MINOR) + `graduation-spec.yaml` (`sidecar_gate` scope widened to baseline existence/binding/schema across tiers; whole-file attestation vocabulary) + `scripts/graduate_to_canonical.py` (the check) + possibly a chamber↔engine locus decision (Q2). No re-verify storm (0 hold engine-verified through this gate; forward-only).
**RULED 2026-07-24 — design-gate PASSED, strengthened** (`docs/engine-consumption-voice-purity-sidecar-JURIST-RULING-2026-07-24.md`, filed verbatim; Addendum + REVIEWED-73 draft appended to the package). All 5 Qs resolve toward the proposal. **Sharper diagnosis (frame on this): ORTHOGONALITY** — `trim.keep` answers "should this be preserved?"; voice-purity answers "whose words?" — orthogonal + ANTI-correlated where it matters (the Eichmann leak = Elon intro + Bibliography = `trim.keep`, correctly kept; **extending the trim is the WRONG fix**). **Q1 STRENGTHENED: sections[] must partition the file body EXHAUSTIVELY** (no gaps/overlaps) — converts silence→assertion (the gate derives nothing, so nothing else forces completeness; the teeth my package lacked). **Q2 ruled CHAMBER-SIDE** on the concrete arg (my architectural lean was right-but-weak): engine-side sidecar breaks on every re-conversion (`ingest_gate` sidecar-sha==live; PENDING-53 class, **5 standing FAILED rows since 2026-07-10**) → produce+gate at graduation, engine reads. **Q3** falsifiers = existence + binding + schema + exhaustive-partition + closed-vocab `role {text,paratext,apparatus,reference}`. **Q4 MIGRATE the 19** (not grandfather — Eichmann is among them, correct only post-leak); carry `_reviewed`→`attested_by` + add **REVIEWED-64 `line_frame: landed-file`** (the package MISSED this — sections[] is a coordinate-contract family); backfill scope = engine corpus (~20), NOT chamber (1,297). **Q5** V-SCAN baseline yes / rich no. **Cost:** per-file reading pass compounds → design the SINGLE-reading-pass (boundary-drop ⊂ voice-purity, one read) before the wave.
**BUILT + LANDED 2026-07-27 (REVIEWED-73 placed 2026-07-24):** spec **v2.8.0** (v2.7.0 frozen; bounded-diff proven — 1 deletion + hunks confined to header stack and the new obligation), the obligation stated beside the one-door two and **framed on the orthogonality** (so a future reader reaching for the trim to close a voice leak stops at the right place). Mechanism: `scripts/verify_voice_purity.py` (16 self-test invariants; **the negatives are the point** — each is a failure class the leak or the ruling named) + `graduation-spec.yaml` `voice_purity:` (closed roles · frame contract · backfill scope · **named open seams**) + `scripts/migrate_voice_purity_sidecars.py`; fleet **266/266** (was 248). **Backfill EXECUTED: 18 migrated · 1 HELD**, verified at the REAL enforcement path (18 PASS / 1 REFUSE); census `_curation/voice-purity-backfill-2026-07-27.tsv`. ⚑ **The rule validated itself on first contact** — applied to the existing engine corpus it surfaced **3 files with unassigned trailing lines** (ARC ornament tails; assigned + flagged `_migration_assigned` for curator confirmation, since the ROLE is a judgment neither gate nor script can make) **and 1 drifted binding**: `musil-mwq-tome-1` (canonical 5032→5038 lines) — **the engine has been serving Musil with boundaries shifted by 6**, body truncated early and 6 lines unassigned at the tail. HELD for re-derivation by a reading pass, not migrated. ⚑ **Correction to the ruling's premise (measured, not inferred):** the ruling cites the *5 standing FAILED ARC rows* as the live instance of the cross-repo drift class — **all five ARC sidecar bindings verify clean**; the one genuinely broken binding is Musil, a chamber canonical. The argument for chamber-side is unaffected (it is architectural), but the cited instance was wrong and the real one was unknown.
**Single-reading-pass: DESIGNED, not built** (`docs/single-reading-pass-DESIGN-2026-07-27.md`) — the two reads are *nested* (the derived boundary runs fall inside sections the curator assigns anyway), so **one read can emit both records**; the saving is the traversal, NOT the judgment count. States the collapse it must avoid: **boundary-drop labels must NEVER be derived from voice-purity roles** (`role: apparatus` + `trim.drop: keep` is the common correct case — an author's own endnotes); a derived attestation is the silent default wearing a second name. Named dependency for building it: no boundary-drop capture surface exists either, so this would be the lane's FIRST curator-facing tool, not an optimization of one.
**GATE WIRED 2026-07-27 — the chain is CLOSED:** land the amendment ✓ → migrate the ~20 ✓ → design the single-reading-pass ✓ → **wire the gate ✓**. `voice_purity_gate()` + `write_voice_purity()` in `graduate_to_canonical` (after `sidecar_gate`); fleet **278/278**; real dry-run **INERT** (no candidate currently reaches it — all 8 gate earlier on health/conventions). **Scope resolved without straining either leg of the ruling:** engine-registered candidates only — Q2 gates *at graduation*, Q4 bounds the obligation to the *engine corpus*; both hold at once, and this is what stops the bar silently blocking the un-registered Loeb wave (non-registered = NOT-APPLICABLE, proceeds). **The authoring/stamping seam resolved by READING the apply leg, not assuming it:** graduation is a **pure move** (`git mv`/rename, no content transformation), so the candidate's bytes ARE the landed bytes — the curator attests against the candidate and the coordinates are already landed-frame. `write_voice_purity` re-stamps **only** `source_file`/`source_path` and deliberately does **NOT** recompute sha/lines: recomputing would let a silent content change re-bind quietly, which is the drift the binding exists to catch.
**⚑ NEW FINDING (6th shared-name/two-senses instance — after manifest · ABSTAIN · app[] · line · frame): `source_lines` is computed two ways in-repo and they disagree by ONE.** Engine-side `len(splitlines())`; chamber-side `write_sidecar` `text.count("\n") + 1`. **Measured on all 11 landed Loeb sidecars: every one is count+1** — one MORE line than the file has, a *phantom line past the final newline*. Harmless while `source_lines` is only a binding head field; **LOAD-BEARING under exhaustive partition**, which would demand a curator assign a line that does not exist. **Declared, not silently fixed:** `voice_purity.line_count: splitlines` states the correct convention *for this gate* (REVIEWED-64: a 1-based line in `source_file` — N newline-terminated lines is N lines). **Reconciling `write_sidecar` is a PRODUCER change with 11 landed consumers → its own FIX/PROPOSAL cycle**, not a tool edit made in passing (the change-impact clause: a producer change must enumerate its consumers). Named in `voice_purity.open.line_count_divergence`. **Recommendation:** FIX-class (the count is wrong against the ratified frame definition, not a design choice), landing with a bounded re-stamp of the 11 + a byte-diff proof that nothing but `source_lines` moves.
**RULED + BUILT 2026-07-27 (steward: FIX, re-stamp now, producer-then-consumers in one change-set).** Grounds accepted as stated: REVIEWED-64 ratified "a 1-based line in `source_file`", and a file of N lines has no line N+1 — `count+1` did not name a second defensible convention, it named a coordinate the ratified frame says **cannot exist** (the de-glued-marker shape: restoring ratified intent against an implementation that never matched it). ⚑ **The steward's "confirm the rule, not the sample" caught a live corruption risk:** the formulas agree iff the file does NOT end in a newline — **36 of 1,297 canonicals** — so a blanket `-= 1` migration would have corrupted exactly those 36; the 11-file sample (one producer, all newline-terminated) could not have revealed it. Migration **recomputes per file**. Landed `4a1a731`: producer fixed + all 11 re-stamped in one change-set, **byte-diff = 11 files / 11 insertions / 11 deletions, every changed line a `source_lines` field**.
**⚑⚑ THE SWEEP'S FIRST YIELD LANDED ON THAT VERY FIX (`b82fc48`) — reported as a correction, not a refinement.** I had ratified `len(splitlines())` on the strength of the engine-side convention **without checking what `splitlines()` splits on**: it also breaks on `\v \f \x1c \x1d \x1e \x85 U+2028 U+2029`, which **no** consumer of a line coordinate treats as a break (editor · `wc -l` · `sed -n 'Np'` · the engine chunker). Censused: **4 canonicals carry them** — `lintott` **308 lines' disagreement**, `auerbach` 52, `rutter` 2, `solnit` 2 (U+2028); `wc -l` confirms newline-based. **So BOTH prior formulas were wrong, on COMPLEMENTARY subsets** (`count+1` on the 1,261 newline-terminated; `splitlines` on the 4 exotic-bearing) — *no single sample distinguishes all three*, which is the generalized form of the steward's own point. Correct rule: `count("\n") + (0 if trailing newline else 1)`, empty = 0. **ROOT CAUSE fixed, not just the value: ONE implementation** (`verify_voice_purity.count_lines`; `write_sidecar` + the migration script now IMPORT it) — two formulas for one field is how this arose and a third would have arrived the same way. `measure()` also now REFUSES an unknown declared convention (no silent fallback) and hashes **raw bytes** not `read_text().encode()` (universal-newline translation diverges on CRLF; 0/1,297 CRLF today — door closed before use). **INERT on landed artifacts** (0/11 carry exotic chars → the `4a1a731` values stand, no canonical moved); the correction is to the stated convention + implementation, which would have bitten the moment Lintott/Auerbach/Solnit/Rutter acquired a sidecar. Pinned on all three shapes + the one-definition invariant; the suite caught the stale assertion from the prior commit on first run. Fleet **288/288**.
**Base-rate sweep (steward-directed, "an hour"; the yield was not zero) — remaining sites CHECKED:** `sha256` — one live basis divergence class (`read_text().encode()` vs `read_bytes()`, CRLF-only); **0/1,297 CRLF**, my tools now on bytes; `write_sidecar` still text-based → *named, not silently changed* (same producer-with-consumers shape). **Tokenizers AGREE**: `\w+` + `.lower()` identical across `verify_body_conservation._tokens`, `inject_epub_footnotes` (×3), `build_sidecar` (×2) — the missing `re.UNICODE` on `build_sidecar:198` is a **no-op** (default for str patterns in py3), and `inject:358` is pre-lowered on the prior line. Empirical cross-check on Eichmann: gate 122,715 vs raw 122,735 tokens, **identical 9,620 types**; the 20-token delta is exactly the footnote-marker digits `_tokens` strips by design and the injector accounts for separately via `converted_markers`. **Consistent-by-design, difference fully accounted.**
**Awaiting:** the 3 `_migration_assigned` ARC tails want curator confirmation of the ROLE; `musil-mwq-tome-1` wants a reading pass to re-derive its boundaries; `write_sidecar`'s text-vs-bytes sha basis wants its own small FIX cycle (latent, 0 live instances). Related: PENDING-71. **Does NOT block Warde's chamber graduation; DEFINES what Warde needs to become an engine voice** (exhaustive sections[] over the canonical: essays=`text`, CUP Bible facsimile=`apparatus`, front/back=apparatus; line_frame landed-file).

## PENDING-73 — Born-digital V-TEXT added-side check: the fabrication measure REVIEWED-72 activated (change-class confirmation)
**Date:** 2026-07-24
**Tag:** [PROPOSAL] — change-class confirmation on the IMPLEMENTATION of REVIEWED-72 (already ruled). Change-class test = yes (a candidate that FLAGed on run-based `added_total` displacement now PASSes) → PROPOSAL → jurist design-gate. Refines REVIEWED-72's stated mechanism; does not reopen its decision. Steward-directed (routing option b) to secure the in-scope judgment BEFORE building on it, "to be sure of no surprises."
**Summary:** Building REVIEWED-72's ruled reference (run (3) = pandoc `markdown-smart` on the raw source EPUB) and the instruction to "declare/excuse the injection+glyph delta (`moved_to` shape; fabrication elsewhere still flags)," the executor measured what the 287-token added delta ON THE LEVI CANDIDATE actually is — and the substrate refines the ruling's own premise about the delta. The honest implementation redefines what `classify()`'s added side MEASURES (fabrication, not position-displacement), which is a gate-acceptance change → back to the jurist, not a silent FIX.
**Measurement (Levi, reproduced 2026-07-24, read-only, `scratchpad/ground_manifest.py`):** `classify()` run-based = FLAG / 99.97% / **added_total=287** / interior_loss=0 / boundary=0. But **multiset-added = `Counter(cand)−Counter(ref)` = 8 tokens, 3 distinct: `wstawać`×6, `oświęcim`, `braşov` — EXACTLY the glyph substitutions.** The other 279 added-run tokens are all PRESENT ELSEWHERE in the reference (displacement, multiset-neutral — the position-based run counter mislabels displacement as "added"). Injection's own enumeration (`converted_markers`, 646 digit-markers) lands on the LOST side and explains 0 of the added. Prior sub-Q settled: `_tokens` uses `\w+`/`re.UNICODE` → PRESERVES diacritics (`wstawać`≠`wstawa`) → glyph is visible + two-sided.
**The refinement:** the ruling's SHAPE holds (run (3), "fabrication elsewhere flags," moved_to's present-in-reference intuition), but two factual premises don't survive: (1) "the injector enumerates the added delta exactly" — it enumerates markers (lost-side), not the 279 relocated body tokens; no injector surface to bind an added excuse to; (2) "a known, declared, enumerable set of added tokens" — it's 279 displacement (cancels in a multiset) + 8 glyph (the only declarable set). The clean mechanism = measure the added side as a MULTISET (displacement cancels structurally), declare only the glyph set (two-sided), everything else flags.
**Proposal:** Requirement (constitutional, for the §Tiering&Fence supersession landing with REVIEWED-72) — the V-TEXT added side verifies ABSENCE OF FABRICATION: a candidate token unaccounted for by the reference is fabrication UNLESS it is a declared, attributed §V normalization (the character-as-image glyph restoration is the only one on this lane); a token present in the reference (displacement) is not fabrication; new vocabulary OR surplus count (duplication) flags. Mechanism (declared data/code) — added FLAG criterion changes run-based→multiset (`(Counter(cand)−Counter(ref))−declared_glyph_added > threshold`); the glyph manifest is TWO-SIDED (`apply_char_glyphs` emits added candidate-form + removed reference-form per site — added excused from multiset-added, removed excused from any lost run, closing the accident-of-thresholds blind spot where a diacritic-dense passage clusters into a run > 50 and FLAGs a faithful candidate); loss side unchanged (run-based; position is right for a deleted passage). Architecture (flagged, not a gate Q): sibling `resolve_added` mirroring `resolve_review`, `classify()` byte-identical for existing callers, V-TEXT graduation path opts in.
**Gate questions (in the package, w/ leans):** Q1 in-scope for REVIEWED-72 to land atomically vs its own proposal (lean in-scope — shape is REVIEWED-72's, only the mechanism-surface changes because the substrate refuted the named surface; but it IS gate-acceptance so not a silent FIX) · Q2 multiset over literal presence-check (lean multiset — strictly dominates: catches new-vocab AND duplication, cancels displacement; presence would silently pass duplication) · Q3 two-sided glyph manifest (lean yes — the removed-form half is currently unaccounted) · Q4 name the closed boundary: only attested §V-declared normalizations are excusable added tokens, all else fabrication (lean yes — attest-never-default at the added side, mirroring PENDING-69's lost-side label discipline).
**Recommendation:** relay the package to the jurist. Executor leans above; the routing (in-scope vs own-proposal) is the steward+jurist call the steward asked for.
**Package (self-contained, jurist-ready):** `chamber-library/docs/borndigital-added-side-fabrication-check-JURIST-PACKAGE-2026-07-24.md` (GROUNDED-IN §Tiering&Fence source-fidelity 1046–1048 + V-TEXT tier + §V Tier-3-by-omission v2.5.0, all quoted verbatim; REVIEWED-72 ruling + `resolve_review`'s deferred added-side follow-on + `classify()`'s added-side code quoted; measurement inlined; consequence-trace with the duplication sub-kind).
**Files affected (on ratification):** §Tiering&Fence supersession (the added-side fabrication property, folded into the REVIEWED-72 reference supersession; MINOR) + `graduation-spec.yaml` (declared-glyph two-sided manifest; added-side threshold) + `scripts/verify_body_conservation.py` (`resolve_added`) + `scripts/apply_char_glyphs.py` (emit the two-sided per-site tokens). No re-verify storm (only graduated V-TEXT = Eichmann, one-door; the change relaxes displacement + tightens duplication; Eichmann shows no duplication → still PASS).
**Awaiting:** steward relay → jurist design-gate. On ruling: build the added-side check per the disposition, then the three-case demonstration (clean PASS · deliberate prose deletion FLAGs · deliberate fabrication-outside-manifest FLAGs), then land atomically with the REVIEWED-72 reference supersession. Related: PENDING-71 (REVIEWED-72), PENDING-69 (`moved_to`/`resolve_review`), REVIEWED-70 (§V glyph).
**RULED 2026-07-24 — design-gate PASSED; in-scope + atomic with REVIEWED-72** (`docs/borndigital-added-side-fabrication-check-JURIST-RULING-2026-07-24.md`, filed verbatim; Addendum + REVIEWED-74 draft appended to the package). The jurist OWNED the refuted premise (the injector enumerates `converted_markers` on the LOST side, not the added delta — *"the producer must know X is not evidence the producer records X"*; the measurement found it). Shape survives; surface refuted. **Q1 in-scope + atomic on a recorded THREE-PART test** (property unchanged · surface refuted-by-measurement-not-inconvenience · design-gate-reviewed; a change missing any leg is its own cycle — record it so "in-scope" sets no mechanism-drift precedent). **Q2 MULTISET confirmed** (strictly dominates presence: catches new-vocab AND duplication, cancels displacement); reordering residual **scoped to the standing Q3 order-blindness stamp-block** (gate does not verify passage order — demonstrated Eichmann §7), NOT to a converter-behaviour claim. **Q3 two-sided glyph manifest confirmed, COUNT-SCOPED both sides:** added = `Counter` subtraction (a 7th surplus of a declared token still flags); a lost run excused ONLY IF every token is manifest-accounted (partially-accounted run stays flagged — "and nothing more", PENDING-69 Q5 on the loss side). **Q4 authorizes the CLASS** (glyph restoration) not future declared normalizations (each by its own §V review). **Latent:** the 646 `converted_markers` = excusable apparatus (REVIEWED-54 §2), invisible only while the loss side stays run-based → named dependency on any future loss-side count-basing; added=count/lost=position asymmetry = deliberate choice. **Demonstration = FOUR cases** (adds Eichmann regression PASS). Architecture: sibling `resolve_added`, `classify()` byte-identical, V-DSL + §6 sweep do NOT inherit.
**Awaiting (updated):** steward placement of REVIEWED-74 (draft in the package Addendum) → build `resolve_added` + two-sided glyph manifest test-first → four-case demonstration → land atomically with the REVIEWED-72 §Tiering & Fence reference supersession. Related: PENDING-71 (REVIEWED-72), PENDING-69 (`moved_to`/`resolve_review`), REVIEWED-70 (§V glyph), REVIEWED-54 (§2 markers-as-apparatus).

## PENDING-75 — Kind-scoping the verification criterion (foreclosure check on §Tiering & Fence)
**Date:** 2026-07-25
**Tag:** PROPOSAL (candidate; change-class classified in the package Part 6 — jurist to confirm PROPOSAL/MINOR vs FIX)
**Summary:** Bound the ratified verified criterion to text-bearing kinds and declare a demonstrated-method extension path (with an anti-bypass guard), so a future non-text canonical enters as an additive amendment rather than forcing a re-founding of the load-bearing clause. Claim-scoping, not new doctrine; nothing about images decided or written.
**Rationale:** The verified criterion silently *defines* verification as prose-word identity — the evidence-tier table (V-DSL/V-TEXT/V-SCAN/V-SUSPECT/V-NONE) presents text-source methods as exhaustive, and tier-1 is "prose-word-identical against its on-hand source." A non-prose work has no tier and no method, so admitting one later is a MAJOR disturbance to the clause the whole trust architecture rests on. Same defect-shape corrected 3× already (one-door Q6, REVIEWED-70 Q1, REVIEWED-72 F4) — an unscoped clause claiming more than its method delivers; applied here prospectively while cheap.
**Package (self-contained, jurist has no repo access):** `chamber-library/docs/kind-scoping-verification-JURIST-PACKAGE-2026-07-25.md` — hook-passed (GROUNDED-IN §Tiering & Fence + §V + the line_frame Naming note, all quoted verbatim from v2.6.0 read 2026-07-25). Three edits: (1) §Tiering & Fence evidence-tiers preamble — method-declared-for-its-kind + PROPOSAL-with-demonstrated-method extension + the anti-bypass clause (no kind weakens its method by re-declaring); (2) §V three-tiers preamble — tiers bound to text-bearing canonicals; (3) sidecar-schema line_frame naming note — the *declaration principle* generalizes (⚑ corrected off the jurist's "line_frame is the general slot" shape: the field is line-named/five-line-family-scoped; generality attaches to declare-don't-assume, not the field).
**Gate questions (with leans):** Q1 placement (lean: evidence-tiers preamble, tightest adjacency) · Q2 anti-bypass clause verbatim (lean: keep, it is the separator) · Q3 Edit-3's true subject (⚑ flagged: principle not field) · Q4 change-class (lean PROPOSAL/MINOR/additive-in-effect) · Q5 is Edit 2 needed or subsumed by Edit 1 (lean: keep).
**Landing:** standalone MINOR supersession (v2.7.0 or steward's version call) — NO in-flight supersession assembling (v2.2.0→v2.6.0 all landed); additive-in-effect (no current canonical changes tier/method → no re-verify storm). Requirement = constitution; which-kinds-exist + their methods = declared data.
**Files affected (on ratification only, drafted to the Addendum's corrected design):** `docs/chamber-library-specification.md` (§Tiering & Fence + §V), `docs/sidecar-schema-LOCKED-2026-07-12.md` (naming note). Nothing built/run/landed now.
**RULED 2026-07-25 — design-gate PASSED, with one REQUIRED correction** (`docs/kind-scoping-verification-JURIST-RULING-2026-07-25.md`). The jurist **adopted the package's Part-4 argument over his own framing**: the foreclosure is not that a non-text work *fails* the criterion but that the criterion is **VACUOUS** on it (empty re-extraction is trivially prose-word-identical to itself) — the false-positive shape, caught prospectively for the first time rather than after a finding. **Required correction:** Edit 1's *"that method is prose-word identity … (V-DSL · V-TEXT · V-SCAN)"* **overstates against V-SCAN**, whose ratified row says *no ground-truth text* and whose bar is *"a distinct, named, more-expensive criterion — not the deterministic bar relaxed"* — the scoping sentence must not flatten a distinction the table already draws. **Q1** placement at the evidence-tiers preamble CONFIRMED (that is where method is *defined*; tier-1 would scope the bar and leave the definition unscoped). **Q2** guard kept and **rebound to the property, not enrollment** (*"a text-bearing work … no work may weaken its applicable method"*) — as drafted it reached only existing kinds and would open the moment the door is first used. **Q3** Edit 3's correction ACCEPTED, the jurist's `line_frame` shape WITHDRAWN (3rd substrate-refutes-composed-shape this session); the heavier rename correctly declined. **Q4** PROPOSAL/MINOR confirmed, the FIX reading **declined on the vacuity argument**. **Q5** Edit 2 kept (§V reads as a prose-framed universal alone; cross-section inference is what a successor cannot be assumed to perform). **Carry-forward for the REVIEWED entry, NOT spec text:** the primitives that would serve a future non-text kind already exist ratified (character-bearing image = content, hash-fixed, catalogued normalization, never silently dropped — REVIEWED-70 Q3; the Loeb sidecar's typed `{kind:'glyph', file:…}`) — nothing reserved, nothing promised, but a successor should find in the record that the architecture already pointed that way.
**BUILT + LANDED 2026-07-25 (steward-authorized verbally; REVIEWED-75 placement 2026-07-27):** spec **v2.7.0** (v2.6.0 frozen `-v2.6.0.md`; **bounded-diff proven** — 1 deletion [the title line, reappearing as `(obsoleted)`] + 3 hunks [header stack · §V +6 · evidence-tiers +16], every other line v2.6.0 byte-preserved), both corrections applied verbatim to the ruling, + the sidecar-schema **generality note** (FIX) with its amendment-log row. Fleet 248/248 (doc-only change, baseline unmoved). CLAUDE.md brought current.
**Awaiting:** steward placement of REVIEWED-75 (draft ready, 2026-07-27). Related: REVIEWED-64 (`line_frame`/the declaration principle), REVIEWED-70 (§V character-as-image), REVIEWED-56 (sidecar additive-only lock discipline).