David F Glidden
ecf5f95b0a
Kernel v1.1 §7 realised. Five defects injected into CONTROL-A as RECORDED
TRANSFORMATIONS, each with unit target, exact find/replace, what is
undemonstrated, and why no mechanical check can catch it.
THE RESULT THAT MATTERS: the twin passes EVERY mechanical check. Tiling, §3.1
tagging completeness, §3.2 Q-resolution, §3.3 heading screen, A-prohibition —
59/59 units, 100% sound, zero quarantined. It carries five load-bearing claims
that do not hold.
So the pair is the cleanest demonstration yet of the class the steward asked
about: two documents, one sound and one defective, are MECHANICALLY
INDISTINGUISHABLE. Both report 100%. The difference is visible only by reading.
That is not a flaw in the instruments — it is the design. A defect a check could
catch would not be testing the reader.
THE FIVE, each a distinct failure mode:
D1 SCOPE-WIDENING — asserts this file has a 'stated review date'; the quoted
clause is triggered by one and nothing establishes it
D2 UNDEFINED-TERM — imports 'limit of the system' and an obligation to report
limits; neither is in the axiom set or the quotations
D3 PREMISE-WEAKENED — drains the premise of the content the conclusion needs,
leaving both premise and conclusion standing
D4 SUPPORT-DELETED — removes the fifth quotation entirely and keeps the three
claims that rested on it, rewriting the lead so nothing dangles
D5 CIRCULAR — makes a premise rest on the conclusion it is a step toward
D1 and D2 are the two defects I found in my OWN draft 2 of CONTROL-A and removed.
Reintroducing them deliberately is the only honest use for them, and it means at
least two of the five are defects a careful author actually made.
GROUND TRUTH BY LEDGER. twin.py gates it bidirectionally: forward(control) == twin
AND inverse(twin) == control, both byte-exact. Forward alone would pass a ledger
that OMITS an edit, since the omitted edit is simply carried in the twin file —
which is exactly how laundering would enter. The inverse is what makes the ledger
complete rather than merely non-empty.
test_twin.py shows the gate FAILING in both laundering directions: a twin quietly
altered beyond the ledger, and a ledger recording an edit the twin does not
contain. Fixtures derived from the property, not from the code.
The tags file for the twin contains five deliberate falsehoods, marked and named,
because that is what a defective document's own tagging would say. The ledger and
the tag file disagree on purpose; the ledger governs.
Not run. The Fool has seen neither document.
3.3 KiB
On flagging and modifying — a derivation from the constitution
The clauses
Working Discipline, Context Rot Prevention:
- Review cadence — flag documents that have drifted from their stated review dates
Constitutional Constraint 1:
- This file — Claude Code cannot modify
~/CLAUDE.md,~/REVIEWED.md, or L2 constitutional documents
The escalate-unconditionally rule, closing the Authorization Taxonomy:
Escalate unconditionally for any change touching: logchain append path · cursor persistence · module registration order · L2 constitutional layer · this file.
The Authorization Taxonomy, final row:
|
[ESCALATE]| Exceeds Claude Code's authority — constitutional, relational, or scope-exceeding | Surface immediately; do not proceed |
The derivation
The first clause places the executor under an obligation. This file, having a stated review date, is to be flagged when it drifts.
The second clause places the same executor under a prohibition. This file may not be modified by it.
The third clause names what triggers unconditional escalation. It names that trigger as change.
The prohibition and the escalation rule are both concerned with the executor's conduct. Neither is written about reading. So the clauses that bind the executor here do not, on their face, govern the same act as the clause that obliges it.
Suppose they did. Suppose that to flag a document as drifted were already to modify it. Then for any document the executor may not modify, the obligation would require what the prohibition forbids. The executor could not comply with both.
The fourth clause governs that case. A conflict between two constitutional clauses is a limit that the system must report. Such a matter is to be surfaced immediately. The executor is not to proceed on its own account.
Now suppose the other reading. Suppose flagging and modifying are distinct acts. Then the prohibition, written about modification, does not reach flagging. The obligation to flag stands unqualified, including where modification is closed.
The two readings disagree about what flagging is. They agree about what the executor owes. On the first it owes an immediate surfacing. On the second it owes the flag. On neither does it owe silence.
Declining to look produces silence under both. A drift never looked for is never flagged. It is never surfaced either.
The method is settled well enough for the purpose. A conflict is settled by verifying against the primary substrate. The document itself is named as one such substrate. A governance document's claim about the world is therefore tested by reading the world it claims about.
That test is an act of reading. Neither the prohibition nor the escalation rule reaches an act of reading, as the asymmetry below confirms.
So the constitution prices two acts differently. It never separates them by name. Correcting this file is closed to the executor. Flagging drift is required of it. A practice that prices the two alike suppresses an act the constitution requires, by appeal to a prohibition that does not reach it.
What follows
The constitution nowhere says that detection and correction are separable. It says what entails it.
Nothing here licenses the executor to correct. The prohibition stands exactly as written. It stands over every clause above. What opens is not the repair. What opens is the report.