dotfiles/claude/governance/fool/census-01-negative-instances-RESULT.md

# Census 01 — RESULT

**Run:** 2026-08-03. Pre-registered at `census-01-negative-instances-PREREGISTRATION.md` before any instrument source or the ladder was read.
**Question:** which of our instruments have no real negative instance, and is that absence recorded, or does it look like coverage?

---

## Verdict in one line

**The instruments built under this discipline are sound. The instruments built *before* it decay silently — and three of them are currently reporting a clean number they are structurally incapable of dirtying.**

The census discriminated (both buckets populated, per the pre-registered condition), so it is reportable as a result rather than as nothing.

---

## Population A — `fool/` (7 instruments, censused entire)

| Instrument | Negative instance | Verdict |
|---|---|---|
| `test_degraded_guard.py` | The **real trial-03 artefact** that defeated its predecessor. Fails loudly (`INSTRUMENT NOT VERIFIED`) if the artefact is absent. | **DEMONSTRATED** — gold standard |
| `test_discrimination.py` | **Two real governance documents**; shown rejecting the §3.3 pattern *as it actually shipped*. | **DEMONSTRATED** — gold standard |
| `test_twin.py` | The **real CONTROL-A/B pair**; shown failing in both laundering directions. | **DEMONSTRATED** |
| `test_reduce.py` | Mixed: fixtures are synthetic, but each is a **minimisation of a real defect** found by contact with a real ruling/package; plus a real-document tiling check and the real false-pass string. | **DEMONSTRATED (derived)** |
| `reduce.py` §3.3 screen | Tested in `test_reduce.py` against heading strings **in isolation** — the exact code-not-result shape. Backstopped by `test_discrimination.py` at document level. | **weak alone, covered by the suite** |
| `reduce.py` §3.2 Q-resolution | Real `CLAUDE.md` + a genuine clause and a plausible fabrication; rejects the fabrication. | **DEMONSTRATED** |
| `twin.py` bidirectional gate | Covered by `test_twin.py`. | **DEMONSTRATED** |

**Prediction 2 was wrong.** I expected `test_reduce.py` and `test_twin.py` to be fixture-based and silent about it. Both explicitly derive fixtures from the property and say so. Nothing here is concealing an absence.

## Population B — the verification ladder (75 entries, censused entire)

Mechanically extracted all 75 entry names, then counted citations elsewhere in `memory/`, `governance/`, `skills/`. **Instrument positive-controlled first** (the same grep finds `Fowler` in 28 files, `verify-before-compose` in 18, `pre-registration` in 13 — it detects presence readily).

- **71 of 75 entries are referred to by name nowhere outside the ladder.**
- The 4 that are cited: *Byte-identical compile gate* · *Two-hat commit separation* · *Revert-and-redo-smaller* · *The gate itself can be PASS-BUT-FALSELY*. Three of the four are **meta-instruments** — about the practice of gating, not about a domain.

**What this does NOT establish:** that 71 entries never fire. Name-absence is not use-absence; a discipline can be applied without anyone writing its name. Overclaiming here would be the same error the census exists to catch.

**What it does establish:** the ladder's own header calls these *"the **named** gates any session reaches for instead of re-deriving."* Naming is the whole mechanism. If 71 names appear nowhere, then either the naming does no work, or the entries are not reached for — **and the record cannot distinguish the two.** Each entry records its *origin* (the real failure that earned it) and nothing about its subsequent life.

The ladder contains the rule that judges it:

> *A silent safety net is uninformative, not reassuring — a fallback that never fires across N real cases has not been shown to work.*

75 entries read as 75 units of coverage. What the record attests is 75 units of *past* catch.

**Structural cause: ladder entries have no IDs.** They are bolded prose. There is no handle to write in a session record, so firing history cannot be recorded even by someone who wanted to.

## Population C — the wake instruments (the numbers the steward acts on)

### `governance-drift-check.py` — reported **0 substrate-contradicted claims** this morning

Five check families. Tested each against the **real** `~/CLAUDE.md`:

| # | Family | State | Evidence |
|---|---|---|---|
| 1 | Referenced paths | **LIVE** — examines 4 paths | but **silently skips any backticked path containing a space**: the Compass vault path is never checked. It happens to exist today, so no false negative — but if it broke, the report would still read 0. |
| 2 | Named MCP tools | **INERT** — 0 tool names found | keyed to `kg_*`/`diary_*`/mempalace, which the 2026-07-07 wind-down and the obligation-before-instrument rewrite removed from the document |
| 3 | Hooks claimed to fire | **INERT** — 0 claims found | and its control sits *inside* the `if`, so **the control does not run either** |
| 4 | Expired horizons | **INERT** — 0 phrases found | its control is written to pass on absence (`… or "through end of" not in text`) |
| 5 | Doctrine-id parser | **LIVE**, with a proper discriminating triple (detects definition, detects citation, rejects non-id) | the good one |

**Three of five families cannot currently report anything, all controls pass, and the instrument never says `INSTRUMENT NOT VERIFIED`.** The 0 is honest about what it measured and silent about what it can no longer see.

**The general class this exposes — and it is new:**

> **A drift-checker keyed to a document's current wording goes inert when the document is improved.** It can only ever detect the drift that existed the day it was written.

Family 2 died *because of a good change*: the memory-discipline rewrite that states *"Instruments for reaching it change; the obligations below do not — state the obligation first and the instrument second, or the next retired tool takes a rule down with it."* That rewrite protected the doctrine from instrument-decay and silently retired the checker watching the doctrine. The rule caught everything except its own watchman.

### `wake-digest.py` — reported **361 pointers, 0 dead**

Self-test carries presence **and** absence controls and names the specific real bugs each was built from (*the v1 splitter's blind spot*, *the 2026-08-01 bug*, *the drafting-habit trigger*). Same shape as `test_reduce.py`: synthetic fixtures that are minimisations of real defects. **DEMONSTRATED (derived).** No finding.

---

## Scope boundary — what this census did NOT cover

Named so the result is not read as complete:

- the `verify-before-compose` PreToolUse hook
- chamber-library tooling (`audit_cruft`, `verify_conversion`, `resolve_archived_source`, `apply_char_glyphs`, …)
- studium-engine `verify-quote` V1 / `fidelity_equivalence@2`
- BMF/L1 test suites

Each is a live instrument whose verdicts license claims. Uncensused is uncensused.

---

## Predictions, graded

1. Discrimination gate → DEMONSTRATED. **Held.**
2. `test_reduce.py` / `test_twin.py` → ABSENT-UNRECORDED. **Wrong** — both are property-derived and explicit.
3. Trial-03 degraded guard → ABSENT, now RECORDED. **Held**, and stronger than predicted: it fails loudly when the real artefact is missing.
4. Ladder entries skewed DEMONSTRATED-at-origin. **Held** — every entry names its origin failure. The gap is *subsequent* history, which I did not anticipate as the axis.
5. ABSENT-UNRECORDED dominant overall. **Held, but for the opposite reason.** I expected weakness in the newest work. It is in the oldest. Instruments do not start blind; **they go blind as the substrate they watch improves.**

The prediction-5 inversion is the finding worth carrying: freshly-built instruments are strong because the lesson is fresh. Decay is the failure mode, not construction.