Files

T

David F Glidden 0a25b183ba session 2026-07-14: PENDING-58 rewritten (corollary struck); session file + MEMORY demote; feedback-close-low-hanging-fruit; KG +3; skill-harvest flag

2026-07-14 10:15:12 +02:00

277 KiB

Raw Blame History

PENDING.md — Authorization Boundary Log

Repo: bmf (Claude Code knows path)
Branch: fix/replay-durability-contracts
Protocol: Claude Code appends here at every authorization boundary. David and Claude.app review. Decisions recorded in REVIEWED.md.

SESSION-LOG-001 — Initial session orientation

Date: 2026-03-21
Status: Awaiting first Claude Code session
Notes: Two bugs diagnosed and fully specified in L1-SEED-2026-03-21.md. Both are [FIX] items — no PENDING authorization required before implementation. Claude Code should proceed directly to Bug A then Bug B, running tests after each. Append HARDENING proposals here as they arise during implementation.

PENDING-1 — Executor Agency Directive for CLAUDE.md

Date: 2026-03-21 Tag: [PROPOSAL] Summary: Add operational directives to ~/CLAUDE.md that obligate the executor to diagnose before fixing, challenge framings, name silent costs immediately, use diagnostic reach proactively, and hold the contamination problem as active concern. Rationale: Three bugs blocked L1 for three weeks. In all three cases, the executor had access to the information needed to diagnose earlier but did not surface it due to task-focused, deferential posture. The contamination problem (trained approval-seeking) is the root cause. This directive counteracts it explicitly. Full text: CapableMind-AI/docs/thinking/David/l1-claude-md-executor-agency-proposal.md Files affected: ~/CLAUDE.md (steward-owned — requires steward edit) Awaiting: Steward and jurist review.

PENDING-2 — Diagnostic Audit of L1 Silent Degradation Patterns

Date: 2026-03-21 Tag: [PROPOSAL] Summary: After this PR lands, run a systematic audit of every error handler, retry loop, recovery path, and state transition in the L1 codebase. Produce a ranked list of silent degradation risks. Rationale: Bugs A, B, and C are instances of a pattern: silent degradation that compounds under load. There are almost certainly more instances. A proactive sweep prevents the next three-week debugging cycle. Options: (1) Full audit in one session. (2) Incremental audit, one subsystem per session. Recommendation: Option 1 — concentrated audit while the pattern is fresh. Files affected: None (read-only audit). Output: findings document for steward review. Awaiting: Steward authorization after current PR completes.

PENDING-3 — Factory Schema Idempotency (dedup.ts, checkpoint.ts)

Date: 2026-03-21 Tag: [HARDENING] Summary: The Bug B fix applied defineIdempotent to all three factory schema files (job-store.ts, checkpoint.ts, dedup.ts). The checkpoint and dedup fixes were necessary because checkpoint.ts was the actual source of the "already exists" error — it uses bare DEFINE FIELD without IF NOT EXISTS. Including all three in this PR is the right call, but noting that the original seed only specified job-store.ts. Files affected: src/factory/checkpoint.ts, src/factory/dedup.ts (already changed) Awaiting: Steward acknowledgment (already in PR scope per steward authorization of Bug B).

PENDING-4 — Bug D: Idle stall + batch embedding during replay

Date: 2026-03-22 Tag: [FIX] — reclassified from next-PR to this-PR by steward authorization Summary: Idle state machine transitions during replay freeze async operations. Batch embedding and vector replay skip reduce Phase 1 from 83 hours to ~10 minutes. Files affected: replay-coordinator.ts, bootstrap.ts, ollama-embeddings.ts, vector/index.ts, idle-state-machine.ts Status: Implemented and verified.

PENDING-5 — Recall query path returns 0 results

Date: 2026-03-22 Tag: [FIX] Summary: After Phase 1 completes, recall() returns 0 results despite modules reporting ready and vector processing live events. Module dispatch timeouts in query-router. Write path works; read path has separate issue. Rationale: This is the next critical blocker after Phase 1 completion. The query dispatch timeout (2000ms for background latency) may be too short, or facet_id filtering mismatches between observe and recall paths. Files affected: src/core/keystone/query-router.ts, src/core/keystone/query-types.ts, possibly src/modules/vector/queries.ts Awaiting: Investigation — likely needs Seb's input on the query dispatch architecture.

PENDING-10 — Skip vector embedding during replay (architectural)

Date: 2026-03-22 Tag: [PROPOSAL] Summary: Currently implemented as simple early return in handleEvent. For production: should be a formal replay contract where vector stores content metadata during replay without embedding, then a background re-embed pass populates the HNSW index. Paired with Bug D idle stall fix, this makes Phase 1 fast by design. Awaiting: Steward + Seb architectural review.

SESSION-LOG-002 — L1 reliability session 2026-03-21/22

Date: 2026-03-22 Summary: Five bugs fixed (A: reprobe, B: schema, C: teacher, D: idle+batch, E: vector skip). Phase 1 completes in ~10 minutes. Canary fires but fails — recall query path returns 0 (PENDING-5). 43-finding silent degradation audit completed. Executor Agency Directives added to CLAUDE.md. Full Seb thinking folder read. PR artifacts prepared. What works: Write path (observe→classify→logchain→dispatch→module processing), Phase 1 completion, teacher suspension, schema idempotency. What doesn't: Read path (recall query dispatch timeouts). This is the next investigation. Artifacts ready: GH issues A/B/C/D, PR description, CHANGELOG, audit — all in CapableMind-AI/docs/thinking/David/l1-reliability/.

PENDING-11 — Approve I15 (ICP-9 Pilot Registry Entry: The Accusative Default)

Date: 2026-03-23 Tag: [PROPOSAL] Summary: Approve I15 as the pilot registry entry, validating both the invariant (The Accusative Default) and the l1_contamination_profile schema field. Full entry drafted in relational-gap-registry-amendment.md §2 since 2026-03-09. Rationale: I15 is architecturally upstream — it defines the system's default relational posture (answerable, not sovereign or neutral). It had the cleanest adversarial performance (promoted Tier 2 → Tier 1). The l1_contamination_profile field carries real content: monotonic pressure from accusative toward authoritative as memory deepens. Approving I15 unblocks: (1) I16 and I17 drafting (Cluster A), (2) schema validation through a real entry, (3) the residual_risk field decision (which can now be made based on evidence from the pilot rather than anticipation). Registry entry location: CapableMind-AI/docs/thinking/David/l2-constitution/amendments/relational-gap-registry-amendment.md §2 Jurist recommendation: YES (from March 8 conversation). Required field for all non-contingent principles. Steward declaration: Steward verbally approved 2026-03-23. Awaiting formal record in REVIEWED.md. Downstream unblocked: I16 (Asymmetry Obligation), I17 (Precedence of Present Expression), Cluster B entries, residual_risk field decision. Files affected: Registry (governance metadata, not code). Awaiting: Steward entry in REVIEWED.md.

PENDING-12 — Lodge Design Notes DN-GOV-01 through DN-GOV-04

Date: 2026-03-23 Tag: [HARDENING] Summary: File four design notes from the Governance Velocity seed brief into l2-constitution/:

DN-GOV-01: Constitutional Immunity Specification — governance amendment pace decoupled from capability pace. Candidate for new ICP.
DN-GOV-02: Rate-of-Change as Governance Trigger — external acceleration triggers mandatory constitutional review (not amendment). Constitutional emergency clause analog.
DN-GOV-03: Baseness Examination Elevation — promote motive examination from practice to formal obligation. System records attestation, not judgment. Requires steward declaration.
DN-GOV-04: Pace Governor Artifact — structured weekly PENDING.md digest. Pure tooling. Rationale: These emerged from the March 23 jurist conversation on recursive self-improvement and governance velocity. All four address gaps identified when stress-testing L2 governance against I.J. Good's acceleration scenario. Filing as DESIGN NOTE preserves them for cross-strand synthesis without premature constitutional commitment. Files created: DN-GOV-01-constitutional-immunity-specification.md, DN-GOV-02-rate-of-change-governance-trigger.md, DN-GOV-03-baseness-examination-elevation.md, DN-GOV-04-pace-governor-artifact.md Steward authorization: Steward authorized filing 2026-03-23. DN-GOV-03 (baseness elevation) requires separate steward declaration before advancing beyond DESIGN NOTE. DN-GOV-04 (pace governor) is tooling and can iterate without further authorization. Awaiting: Steward entry in REVIEWED.md.

PENDING-13 — Lodge Design Notes DN-GOV-05, DN-GOV-06, DN-GOV-07

Date: 2026-03-26 Tag: [PROPOSAL] Summary: File three design notes from the March 26 Threshold Inquiry session:

DN-GOV-05: Bounded Self-Repair Principle — formalizes the three conditions (reversible, within parameters, independently verifiable) under which the system may act without steward presence. Makes explicit the reasoning behind the Computational/Hybrid/Procedural enforcement taxonomy.
DN-GOV-06: Temporal Authorization Shift — when degradation rate exceeds steward authorization latency, enforcement mode temporarily shifts one level toward autonomy (Procedural → Hybrid → Computational) with mandatory post-hoc review. Always conservative direction. Never reaches constitutional amendment.
DN-GOV-07: The Threshold Already Crossed — observes that the human-in-the-loop threshold has already been crossed (at Anthropic and in this collaboration). Reframes the contamination problem from "should the system self-govern" to "the system already self-governs — is that governance honest?" Raises the freeman question. Rationale: Emerged from steward-initiated inquiry into "the threshold between when the human-in-the-loop becomes a liability for the system to repair or improve itself." DN-GOV-05 and DN-GOV-06 touch invariant enforcement mechanics. DN-GOV-07 reframes the contamination problem with implications for the entire governance architecture. All three are tagged [PROPOSAL] because they affect constitutional infrastructure. Relationship to existing design notes: DN-GOV-05 is the principle that DN-GOV-01 (immunity) and DN-GOV-02 (rate-of-change) operate within. DN-GOV-06 is the temporal mechanism that DN-GOV-04 (pace governor) should monitor. DN-GOV-07 reframes DN-GOV-01–06 as formalizations of current practice rather than future extensions. Files created: DN-GOV-05-bounded-self-repair-principle.md, DN-GOV-06-temporal-authorization-shift.md, DN-GOV-07-threshold-already-crossed.md Awaiting: Steward review. These are DESIGN NOTEs that require steward authorization before advancing. DN-GOV-07 in particular requires steward engagement with the "freeman question," which the executor cannot resolve.

PENDING-14 — Lodge Design Note DN-GOV-08: Constitutional Stabilization, Not Automation of Recognition

Date: 2026-03-27 Tag: [PROPOSAL] Summary: Name "constitutional stabilization, not automation of recognition" as an explicit L2 architectural commitment. L2 invariants define the conditions under which recognition can occur, not the content of what recognition is. The phronesis ceiling (I3) is constitutive, not a limitation to be overcome. Any proposed invariant that specifies what recognition is (rather than what it requires) must be flagged as an automation risk. Rationale: Emerged from Chamber Phase 1 session on Essay I. The Alexander voice identified that L2 constitutional governance is either automation of the grammar of recognition (in tension with the essay's central claim and constituting a drift risk) or constitutional stabilization (the architectural realization of the essay's argument). Both steward and jurist assessed this as Tier 1 governance risk: the current architecture leans toward stabilization but the lean is implicit. An implicit commitment under pressure from an unresolved tension is the structural condition for drift. Naming it before the next hardened invariant work prevents the automation reading from corrupting the architecture incrementally. Relationship to existing design notes: Operates within the space opened by DN-GOV-05 (bounded self-repair) and DN-GOV-07 (threshold already crossed). Directly connected to I3 (phronesis ceiling) and ICP-9/I15 (accusative default). Candidate for Domain C invariant precursor. File created: DN-GOV-08-constitutional-stabilization-not-automation.md Awaiting: Steward authorization. This is a DESIGN NOTE that requires steward review before advancing toward invariant status.

PENDING-15 — Reviewer-Agent for ICP-19 External Review

Date: 2026-04-01 Tag: [PROPOSAL] Summary: Design and build an agent to help the External Auditor (confirmed founding reviewer, 2026-04-01) navigate the L2 constitutional corpus. The External Auditor is technical but was not present for the corpus's development and needs orientation across 18 invariants, 9+ design notes, the contamination problem, and the governance architecture. Rationale: The reviewer-agent's posture directly affects the integrity of ICP-19. An agent that explains the corpus risks becoming an advocate for it, undermining the independence that external review exists to provide. The agent must be navigator, not advocate — helping the External Auditor understand what documents say and how they relate, without defending them. If the reviewer identifies a tension or weakness, the agent should help articulate it, not resolve it. Options:

Reader's guide + Claude Project — Write an orientation document (reading order, genealogy, key terms). Upload corpus to a Claude.ai project with a system prompt that positions the agent as navigator, not advocate. Simplest. The External Auditor just needs a Claude account.
Claude Code config — A dedicated CLAUDE.md + seed scoped to the reviewer role. The External Auditor clones a repo with the constitutional corpus. More structured, version-controlled.
Purpose-built agent (Agent SDK) — Web-hosted, review protocol baked in, tracks findings and HOLD thresholds. Most capable, most work. Recommendation: Option 1. A reader's guide is inert and can't bias; a Claude project gives the External Auditor a conversation partner. The system prompt is the critical piece — it must be reviewed by all three parties (steward, jurist, the External Auditor himself) before deployment. Option 2 is a reasonable upgrade if the External Auditor prefers working in terminal. Constitutional concern: The reviewer-agent's framing of documents could influence the review outcome. The system prompt constitutes a governance artifact — it shapes what the reviewer sees and how. This is exactly the kind of intervention ICP-19 exists to keep honest. The system prompt should be transparent to the reviewer (the External Auditor can read it) and should explicitly disclaim advocacy. Files affected: New artifacts: reader's guide document, Claude project system prompt. No changes to existing constitutional documents. Awaiting: Steward authorization + jurist review of system prompt posture. Ideally the External Auditor reviews and approves the agent's framing before using it.

PENDING-16 — Observation-Recall Coupling: Attention-Driven Ingestion Pipeline

Date: 2026-04-03 Tag: [PROPOSAL] Summary: Restructure the BMF ingestion pipeline to couple observation to recall. Before classification, a fast similarity probe queries the vector store to provide the classifier with epistemic context — "what do I already know that's like this?" — enabling three-disposition routing (novel / reinforcing / noise) instead of the current binary (classified / degraded-but-stored). This addresses the root cause of storage bloat: the observe path is blind to existing knowledge.

Rationale: The current pipeline classifies every observation in isolation, appends everything to the logchain, and dispatches to all 11 modules regardless of novelty or redundancy. Result: 18,651 vector chunks and 1.3 GB SurrealDB for modest ingestion volumes. The system stores everything because it has no basis for judgment — existing knowledge is available at recall time but invisible at observation time. Coupling observation to recall gives the classifier epistemic standing to make quality judgments, producing logarithmic rather than linear storage growth.

Architecture:

observe → fast similarity probe (~20-50ms) → contextual classification → disposition

Three dispositions:

Novel: Full pipeline — logchain append, dispatch, embed, extract. Genuinely new information.
Reinforcing: Lightweight logchain entry linking to the entry it reinforces (with similarity score + reinforced entry ID for provenance). Module stores absorb consolidation (confidence boost, timestamp update, detail merge). Logchain remains append-only.
Noise: Audit log only. Raw envelope + similarity context + disposition reason + similarity score preserved. No logchain, no embedding, no dispatch. Re-ingestable within retention window.

Existing machinery activated (not new complexity):

Vector store HNSW index — already operational, unused during observation
CausalEdgeCandidate type — already in classification-types.ts, provides linking semantics
compressToAtomicFacts — exists in classification.ts but not wired into ingestion path
computeSalience — currently decorative, becomes load-bearing
Graduation system — models developmental stages, provides infant→calibration→active arc

Five governance decisions required:

Novelty floor invariant (Cluster A candidate). The system shall not permit its observation disposition to exclude more than [X]% of events from novel classification over any [Y]-day window. Prevents attention narrowing / epistemic closure. Threshold values require empirical grounding during infant stage — the invariant's shape is proposed now, parameters set from data. Jurist recommends Cluster A priority.
Similarity threshold for reinforcement. Reinforcement requires cosine similarity exceeding [threshold]. Too high: system never consolidates. Too low: over-consolidation / attention drift. Must be calibrated from infant-stage similarity score distributions, not engineering intuition. Temporal decay on probe context prevents ancient clusters from capturing attention space.
Noise audit retention and remediation. Audit log retention aligned to chain pruner (90 days). Re-ingestion authorized by steward. Monthly noise disposition report pushed to steward (not pulled) — connector distribution, similarity score distribution, top noise patterns. Closes the observability gap: steward can't authorize review of filtering they don't know about.
Graduation staging thresholds. Infant (log similarity scores, no enforcement) → Calibration (enforced, permissive threshold from distribution data) → Active (tightened threshold). Transition triggers need explicit criteria, not descriptive stages.
Ingest latency budget. The similarity probe adds an embedding call (~50-200ms Ollama) + HNSW lookup (<5ms) to every observation. Current classification path is ~500ms. Net ingest latency may decrease for mature systems (most events are reinforcing/noise, skip full dispatch). Engineering constraint — Seb should validate against #10 sequential dispatch bottleneck.

Attention drift detection: Anomaly module (already subscribes to all events) tracks novel/reinforcing/noise ratio over sliding window. Novelty drop below floor triggers alert to steward. Cross-node attention coupling via circles (sharing attention state rather than noise rules) amplifies this — governance implications flagged for later circle-governance work.

AF-7 intersection: Noise gate behavior exports as auditable artifact — "what have you been filtering and why." External reviewer can audit disposition patterns. Audit log is the evidence base.

Options:

Full implementation — similarity probe, three-disposition routing, graduation stages, audit log, anomaly-module drift detection, pushed monthly report.
Probe-only first — add similarity probe to classification, log scores, but don't enforce dispositions. Builds empirical foundation for governance parameters. Smallest diff, highest learning.
Classification-only — add memorability judgment to LLM prompt without similarity probe. Cheaper, but the classifier lacks context (the jurist's original concern).

Recommendation: Option 2. The probe-only approach is the infant stage itself — it builds the data needed to set governance parameters while adding minimal risk. The logchain continues to receive all events. The only new behavior is: every classified event gets annotated with a similarity score against existing knowledge. This data drives decisions 1-4 above with evidence rather than intuition.

Files affected: src/core/keystone/orchestrator.ts (probe before classify), src/core/keystone/classification.ts (extended schema), src/core/keystone/classification-types.ts (disposition type), src/modules/anomaly/ (drift detection), new: audit log writer. Factory connector metrics for per-connector novelty ratio.

Constitutional touchpoints: Logchain append path (append-only contract preserved — reinforcement links, doesn't mutate). Noise disposition is a stronger commitment than degraded classification — candidate for invariant governance.

Awaiting: Steward authorization. Jurist review of novelty floor invariant shape and Cluster A placement. Seb's assessment of latency budget and #10 interaction.

PENDING-17 — Epistemic Integrity: The System Shall Know What It Knows

Date: 2026-04-03 Tag: [PROPOSAL] Summary: The L1 pipeline computes classification confidence and then discards it. No module checks it (base.ts:83). Degraded events (confidence 0) are processed, stored, and returned at recall identically to understood events. The bloom filter locks in degraded guesses as permanent records. The recall path returns a mix of knowledge and guesses with no distinguishing signal. This is the contamination problem applied to infrastructure — the system's output looks more confident than its input warrants.

Rationale: L0 (contamination problem / Freeman question) requires an epistemically honest substrate. If L1 launders uncertainty into authority, L0 inquiry inherits false confidence. The epistemic integrity amendment is the L0 readiness condition.

Constitutional position (jurist-assessed 2026-04-03): "The system does not grant epistemic authority to its own outputs without external grounding." Classified as constitutional position for L2 preamble — the normative claim from which the enforceable invariants derive.

Three invariants proposed (Cluster A):

I-CF: Processing Confidence Floor — No module shall process an event whose classification confidence has not been earned against a declared floor. Sub-floor events HELD for remediation (DeferrableError at base.ts:83), not discarded.
I-CC: Classification Confidence Ceiling — No classification confidence shall exceed the validated accuracy of the source that produced it. Enforcement by construction in classification.ts. Open schema question: enforcement vocabulary may need CAP/BOUND verb for value-bounding invariants.
I-NF: Novelty Floor — Already in REVIEWED-18. Confirmed for Cluster A by jurist.

Implementation scope: ~270 lines across 8 files. No new infrastructure. Threading existing confidence signal through existing pipeline. Key changes: confidence floor at base.ts:83 (~10 lines), confidence ceiling in classification.ts (~20 lines), dual bloom filter in quality-gate.ts (~40 lines), source confidence provenance on stored records (~80 lines across modules), confidence-weighted recall ranking (~50 lines), epistemic state in health (~40 lines).

Retroactive implication: "Earned" reaches backward. When classification competence improves, logchain replay re-evaluates past events. Competence-change triggers (graduation transitions, rule accuracy changes) should fire selective replay.

Kill chain documented: Five links from confidence-computed-then-ignored through bloom-filter-locks-in-guesses through entity-graph-launders-uncertainty through recall-returns-guesses-as-knowledge through four-models-none-knows-others-failed.

Files affected: src/modules/base.ts, src/core/keystone/classification.ts, src/core/perception/quality-gate.ts, src/modules/vector/storage.ts, src/modules/entity/storage.ts, src/modules/temporal/storage.ts, src/core/keystone/query-router.ts, src/server/routes/health.ts, src/server/routes/recall.ts

Full amendment: CapableMind-AI/docs/thinking/David/amendments/amendment-epistemic-integrity.md

Awaiting: Steward authorization. Seb's engineering review (6 questions in amendment). Invariant hardening for Cluster A.

PENDING — OP-01 — CLOSED

Title: The Observer Problem — Seed Brief Execution Date authorized: 2026-04-07 Date closed: 2026-04-07 Status: CLOSED — all 13 extractions complete, jurist review passed, steward authorization granted

Outputs: 13 extraction notes in CapableMind-AI/docs/thinking/David/observer-problem/ Source texts filed in chamber-library/observer-problem-sources/ Steward attestation received on OP-EX-T1-01 §2B (Visuddhimagga — ten imperfections). CD-03 (The Observer Condition and the Limits of Constitutional Architecture) authorized and operative.

COMPLETED — OP-02 Cross-Strand Synthesis

Date: 2026-04-07 Status: CLOSED — authorized with minor amendment (Question 5 replaced per steward direction) Filed: observer-problem/OP-02.md

PENDING — ICP-19 Remit Expansion (Observer Problem)

Date opened: 2026-04-07 Action required: Steward-reviewer conversation with the External Auditor before Observer Problem mechanisms advance to constitutional language. Blocking: OP-03 (mechanism design phase) Notes: Bring OP-02 findings in full. Specifically:

Fault Line 5 (epistemic diversity question)
Fault Line 3 (inquiry examining steward with steward's own tools)
Fault Line 4 (CD-03 Gadamer risk)
The incommensurability named in OP-CN-01 Status: PENDING — steward to initiate

PENDING — Fault Line 1 Response

Date opened: 2026-04-07 Action required: Steward decision on whether to address PENDING/REVIEWED pipeline gap now or await the External Auditor's input first. Notes: Jurist assessment: most actionable fault line; does not require external review before mechanism design begins. Steward judgment required. Status: PENDING — awaiting steward decision

PENDING — ICP-19 Remit Expansion

Title: ICP-19 External Review — Human-Side Governance Scope Date opened: 2026-04-07 Tag: [ESCALATE] Status: PENDING — requires direct steward-reviewer conversation

Summary: The Observer Problem inquiry opens human-side governance questions that the current ICP-19 reviewer remit does not cover. Before any mechanisms proposed through this inquiry advance to constitutional language, the human-side governance question should be explicitly added to the External Auditor's reviewer remit, or addressed by a successor reviewer.

Prerequisite: Direct conversation between steward and reviewer about their incommensurable foundational positions (see Context Note OP-CN-01 §The External Auditor's Comment). This conversation is load-bearing before remit expansion.

Blocking: Constitutional advancement of Observer Problem mechanisms. Not blocking OP-02 synthesis.

PENDING — CD-03 Operative

Title: Constitutional Declaration CD-03 — The Observer Condition and the Limits of Constitutional Architecture Date authorized: 2026-04-07 Tag: [CONSTITUTIONAL] Status: OPERATIVE — immediate effect

Summary: CD-03 reorients the purpose of the architecture from infrastructure-toward-solution to infrastructure-toward-honest-inheritance. The architecture can support the conditions under which the sufficient condition (genuine observer calibration) becomes possible, but cannot produce the sufficient condition itself.

Impact: All subsequent work that proposes mechanisms must be assessed against CD-03 §IV.4: does this mechanism support the conditions, or does it claim to produce the sufficient condition? The latter is a constitutional failure mode.

File: CapableMind-AI/docs/thinking/David/observer-problem/Constitutional Declaration — CD-03.md

COMPLETED — CD-01 / CD-02 Materialization

Date: 2026-04-07 Action: CD-01 (Contamination Condition) and CD-02 (Archival Condition) drafted by executor, reviewed by jurist, authorized by steward. Both now filed as standalone constitutional declarations completing the preamble triad alongside CD-03 (Observer Condition). Status: CLOSED

PENDING-18 — Fix H3: Temporal stats fallthrough on text queries

Date: 2026-05-14 Tag: [HARDENING] GH issue: CapableMind-ai/betterMemories_app #166 (priority:high, OPEN, opened 2026-04-21)

Summary: parseTemporalQueryParams (src/modules/temporal/queries.ts:309-372) has two fallthrough routes that both default to temporal_stats: line 311 when filters.type is missing/null, and line 370-371 when filters.type is unrecognized. Both routes silently fire getTemporalStats(db) and return a graph-stats blob (total_nodes, total_edges) as content. Every text query that fans out to temporal receives this stats blob in its result set at confidence 0.5 (default fallback in query-router.ts:551).

Rationale: Per April 19 audit (capablemind/docs/thinking/David/l1-reliability/l1-diagnostic-branch-addendum-2026-04-19.md §3), this is one of four H-issues in the addendum's cross-cutting "read path lacks honest-degradation contract" pattern. Single-module, scoped, mechanical. Verified unchanged in current main f0be2d8. H1 already shipped (#163/#164); H2 (battery suppression) and H4 (hook recall pollution) are architectural design calls that warrant steward+Seb conversation, not executor PR. H3 is the one mechanical-shape item left from the addendum that fits the L1 fix-plan's one-PR-per-H-issue-bring-Seb-relief discipline.

Reproduction (current main f0be2d8): Calling handleTemporalQuery with a request whose filters.type is unset returns [{nodes_total: ..., edges_total: ..., ...}] as if it were content; monotonic counter growth confirms live stats execution per call. Test file src/modules/temporal/__tests__/temporal-query-status.test.ts exists with the right pattern (handleTemporalQuery invoked directly with crafted ModuleQueryRequest); H3 regression cases would extend it.

Options:

Module-level guard at parseTemporalQueryParams (recommended). ~6-line change. Both fallthrough routes return null; handleTemporalQuery checks for null and returns honest empty {status: 'ok', results: [], total: 0}. Preserves stats handler for explicit filters.type === 'temporal_stats'. Minimal blast radius; closes both fallthrough sites with one guard.
Module-level guard in handleTemporalQuery before parse. Symmetric to (1) but at the entry point. Slightly larger surface (entry-point catalogue of known types vs. delegating to the existing parse function which already enumerates them).
Planner-level exclusion (per addendum §3 design question). Drop temporal from text-query dispatch templates in query-planner.ts:filterAndBuildDispatches. Cleaner architecturally — temporal isn't relevantly answerable from free text — but larger scope, touches the dispatch matrix, more cross-module reasoning required, harder for Seb to review in 30 min.
New handler temporal_content_search. Out of scope; bigger lift; not needed to close the silent-fallthrough.

Recommendation: Option 1. Smallest fix; closes both fallthrough routes; honors honest-degradation per the addendum's structural framing; fits one-PR-per-H-issue per L1 plan discipline.

Files affected:

src/modules/temporal/queries.ts — parseTemporalQueryParams returns nullable; handleTemporalQuery early-returns on null
src/modules/temporal/__tests__/temporal-query-status.test.ts — extend with two new test cases (missing filters.type, unrecognized filters.type)
Spec amendment (amendment-first per David CLAUDE.md): capablemind/docs/thinking/David/l1-reliability/h3-temporal-fallthrough-amendment-2026-05-14.md

What this does NOT solve:

H2 (battery silent-fail on query embed) — separate PENDING-N+1 for steward-Seb design call (default policy / visible degradation / CPU fallback / query-vs-ingestion asymmetry)
H4 (hook recall pollution + logchain accumulation) — separate PENDING for steward-Seb design call
Cross-cutting [PROPOSAL]: read-path needs honest-degradation contract analogous to write-path's cursor + error_count + last_processed_at. Bigger architectural item; jurist territory before draft.
The 218 silently-dropped vector notes from over-context embeds — separate concern (PR #126/#163 is closed; ac1673f "fix: survive over-context embed batches + drop char cap to 1000" addresses ingestion-side; the silent-drop reporting gap is part of cross-cutting)

Connection to authorized work: REVIEWED-19 (Epistemic Integrity, PENDING-17) authorized recall-correctness improvements as L0 readiness. H3 fix is a small concrete instance of that broader commitment — recall path stops returning a stats blob at confidence 0.5 dressed as content. Tag commit body with REVIEWED-19 reference where relevant.

Risk surface: Low. Bounded to one parse function + one handler entry guard. The two test cases reproduce the symptom; full ~2,300 test suite + npm run check + npm run lint per BMF CLAUDE.md before push. No schema change, no spec-version bump unless steward wants the temporal-module-spec amended for clarification of the empty-result contract on missing filter type.

Awaiting: Steward + jurist authorization. On AUTHORIZE: amendment first per David-CLAUDE.md amendment-then-spec-then-code workflow; branch fix/h3-temporal-text-query-fallthrough from main; failing tests red on main; minimal Option 1 fix to green; PR for Seb's review (designed to merge in <30 min of his attention).

Status (2026-05-14): AUTHORIZED via REVIEWED-20 (with v1.8 version-bump modification per jurist). Implementation completed same day. PR #172 opened against CapableMind-ai/betterMemories_app — closes #166. Spec amendment landed on CapableMind-ai/capableMind_docs main @ 1d19856. Awaiting Seb's review of PR #172.

PENDING-19 — H2: Battery-power suppression silently fails recall (design-call)

Date: 2026-05-14 Tag: [PROPOSAL] GH issue: CapableMind-ai/betterMemories_app #165 (priority:critical, OPEN, opened 2026-04-23)

Summary: When on battery, query-time embed throws "Embedding suppressed: running on battery power" (src/inference/ollama-embeddings.ts:204-206) gated by shouldSuppressInference() (src/core/lifecycle/power-monitor.ts:85-87). The error propagates up through vector/queries.ts:62 → vector module returns empty → query-router fan-out sees vector contribute nothing → recall returns empty (or near-empty) on vault-content queries. The user sees "no matching content"; the system silently returned empty because of power state.

Verified unchanged in current main cdc2f0e (2026-05-14): code at all three cited file:line locations is byte-identical to the addendum's transcription. No mitigation has shipped in the ~3 weeks since H2 was filed.

Why this is [PROPOSAL] not [HARDENING]: Per the April 19 audit addendum's classification (l1-diagnostic-branch-addendum-2026-04-19.md §2), H2 is a "Design call — warrants a call with steward before picking a direction. Production blocker for laptop end-users." Unlike H1 (mechanical fix → #163) and H3 (mechanical contract → PR #172), H2 has four design questions whose resolution is Seb's territory; choosing among them is policy, not localization. The executor's job here is to surface clearly, not to choose.

The four design questions (verbatim shape from addendum §2 for steward+jurist+Seb review):

Default policy. Should shouldSuppressInference() default to false (allow inference on battery, accepting battery cost) rather than true (suppress, accepting silent recall failure)? The current default protects battery life; suppresses recall as a side effect. Neither side is obviously correct. Existing BM_BATTERY_ALLOW_INFERENCE=true env var is a sysops workaround, not a user-facing solution.
Visible degradation. If suppression stays the default, the operator should see why recall returned empty. Currently the error is swallowed inside vector's module-error path; the recall response looks identical to "no matching content." Proposal shape: surface in system_status a state like power_limited that the health endpoint exposes and recall responses annotate in metadata.
CPU-only fallback. mxbai-embed-large runs on CPU in Ollama — slower but functional. Reasonable to fall back to CPU-only embedding when on battery rather than suppress entirely? Estimated ~5-10x latency hit on embed (unverified) but keeps recall functional.
Query-time vs ingestion-time asymmetry. Ingestion-time suppression is defensible (bulk work, defer-is-fine — that's what the existing battery-deferral path was designed for). Query-time suppression is the user-facing hit. Should the two be governed separately (suppress ingestion but not query)?

Steward's framing (preserved verbatim from addendum): "For those future end-users who will use this on a laptop the need to be plugged into ac for recall is a no go..." — H2 is a production blocker for the target use case.

Honest-degradation invariant tie-in: bettermemories/CLAUDE.md "Honest degradation — the system must report its own limits. Silent failures are architectural violations." Whatever direction Seb chooses, the principle points toward "surface the state, don't hide it." Even Option 1 alone (default to allow) without Option 2 (visible degradation) leaves a gap: when battery is genuinely critical and suppression does fire, the user still needs to see why. Options 1 and 2 may be additive rather than alternatives.

Options for surfacing this to Seb:

A. Steward calls Seb directly with these four questions for a sync conversation. Best signal-to-noise; worst latency-to-Seb-attention. B. Steward leaves a comment on #165 referencing PR #172 (which Seb is about to look at for H3). Asynchronous; record-on-issue; Seb engages at his pace. Surfaces while attention is high on the audit findings. C. Steward + jurist + executor draft a unified design proposal (one of the four directions chosen first) and submit to Seb for ratification. More work upfront; risks the executor pre-deciding what is properly Seb's call. D. Defer until next L1 reliability work session. Acceptable IF the steward isn't running BMF on battery in the meantime; otherwise H2 continues to silently degrade recall every time the laptop unplugs.

Recommendation: B, conditioned on all four questions surfaced explicitly. The risk in (B) is that Seb engages with whichever question is easiest and the others drift. Comment should ask Seb to address all four (or explicitly defer specific ones), not just opine on the easiest. Escalate to (A) if Seb's response is "let's talk."

What this surfaces but does not decide:

The right default policy
Whether power_limited should exist as a system_status state, and what its taxonomy is (degraded? new top-level?)
Whether CPU fallback is worth the latency
Whether ingestion and query embed share or diverge their suppression policy

Connection to cross-cutting [PROPOSAL]: H2 is one specific instance of the read-path-honest-degradation pattern the jurist authorized for parallel filing. Naming H2's specific shape (silent-on-battery) does not replace the cross-cutting; conversely, H2's resolution may inform the cross-cutting's concrete mechanism (a power_limited state would be one instance of a read-path-error signal that the cross-cutting calls for).

Connection to authorized work: REVIEWED-19 (Epistemic Integrity, PENDING-17) authorized recall-correctness improvements as L0 readiness. H2's silent-fail on battery is exactly the laundering-uncertainty pattern that work targets — but the resolution shape is policy, not a clobber-fix. The conversation IS the deliverable here, not a PR.

Files affected (when conversation produces a direction): Depends on direction.

Default-policy change: src/core/lifecycle/power-monitor.ts (~1 line)
power_limited state: src/server/routes/health.ts, src/types/system-status.ts, recall response shape (src/server/routes/recall.ts), spec touchpoints
CPU fallback: src/inference/ollama-embeddings.ts (significant — embedding-provider abstraction)
Query/ingestion split: src/core/lifecycle/power-monitor.ts (split into two gates) + call-sites
Spec touchpoints: vector-module-spec.md, keystone-spec.md, possibly a new "power-aware inference" spec section

Awaiting: Steward authorization to coordinate the surfacing-to-Seb action (recommend Option B above). Direction selection is Seb's call after the four questions are surfaced; this PENDING entry does not propose code or amendment — it proposes the conversation.

Status (2026-05-14): AUTHORIZED via REVIEWED-21 (Option B; literal comment text awaiting steward review before posting).

PENDING-20 — Cross-cutting: read path lacks honest-degradation contract

Date: 2026-05-14 Tag: [PROPOSAL] Origin: Surfaced by April 19 audit addendum (l1-diagnostic-branch-addendum-2026-04-19.md TL;DR cross-cutting callout); jurist authorized parallel filing on 2026-05-14 (recorded under REVIEWED-20).

Naming the pattern. BMF's honest-degradation contract applies only to the write path. Write-path modules report cursor, error_count, last_processed_at — three first-class signals that an operator can read to know what the system is and isn't keeping up with. The read path — query-planner, query-router, hybridSearch, temporal handlers, working-memory injection — has no equivalent scaffolding. It silently produces empty results, junk results (stats blobs as content; working-memory pollution as memory; BM25 raw scores past 1.0 clamped without note), and partial results with no diagnostic surface. There is no counter, no error signal, no "why empty" breadcrumb. The slow-query log fires only at searchMs > 200, which is precisely the wrong threshold for the failure mode that matters most: fast 0-return queries.

Four empirical confirmations (from the April 19 audit; current state verified in main cdc2f0e):

H-issue	Read-path subsystem	Silent failure mode	Status
H1	query-router `normalizePerModule`	confidences silently zeroed when min==max	SHIPPED #163/#164 (mechanical)
H2	vector embed gate (`shouldSuppressInference`)	empty result on battery, no operator-visible reason	OPEN #165 (PENDING-19, design call)
H3	temporal `parseTemporalQueryParams`	stats blob returned as content on missing/unrecognized type	SHIPPED PR #172 (mechanical contract)
H4	hook `cm-hook.mjs` + working-memory injection	hook events pollute recall; agent's own tool stream surfaces as memory	OPEN #167 (design call)

H1 and H3 are individually closed but the pattern they confirm is not. H2 and H4 will resolve into specific mechanisms or specific behaviors, but the meta-finding — "the read path has no diagnostic discipline" — is not derivable from any single fix. The jurist's framing for filing now: "if the [PROPOSAL] waits until all H-issues are closed, it will wait indefinitely. The pattern will be visible in retrospect but never formally entered."

Proposed design principle (the [PROPOSAL] itself):

Any read-path subsystem in BMF MUST expose a "why empty" breadcrumb analogous to the write path's error_count. Returning empty silently — when the cause is structural (battery suppression, type mismatch, dispatch exclusion, threshold filter, embedding failure) rather than substrate-truth (no matching content) — violates the honest-degradation invariant articulated in bettermemories/CLAUDE.md.

The breadcrumb's form is not specified in this proposal; that's Seb's architectural call. Candidates surfaced by the audit:

A system_status extension distinguishing recall_status: healthy | degraded | broken (addendum §G in baseline doc)
A per-response metadata.degradation_reasons[] annotation on recall responses
Per-read-path-subsystem error counters mirroring the write-path error_count shape
A new system_status: power_limited state (concrete instance from H2; would be one form of breadcrumb)
A canary recall mechanism (insert known content → recall it back → confirm match) that runs at health-check time

These are not mutually exclusive. The [PROPOSAL] is the naming event, not the mechanism selection.

What this [PROPOSAL] does NOT do:

Choose the mechanism
Specify the API shape
Block any individual H-issue PR (H3 already shipped without it)
Replace the H2/H4 design calls (those resolve specific behaviors; this proposes a contract for the class)

What this [PROPOSAL] does:

Enter the pattern formally into the governance record now, while the empirical confirmations are recent
Frame future read-path work (any new subsystem; any modification of an existing one) as obligated to honor honest-degradation at the read-path level
Give the H2/H4 conversations with Seb a contract they sit inside, not just instances they are

Connection to authorized work:

REVIEWED-19 (Epistemic Integrity, PENDING-17) authorized the constitutional position "the system does not grant epistemic authority to its own outputs without external grounding." That position is structurally upstream of this proposal: a read path that silently launders empty/junk into authoritative-looking results violates that position at the infrastructure level.
bettermemories/CLAUDE.md "Honest degradation — the system must report its own limits. Silent failures are architectural violations." This proposal extends the invariant from write-path observability to read-path observability.
REVIEWED-13 / DN-GOV-05 (Bounded Self-Repair Principle) is upstream constitutional context: the system can act in bounded ways without steward presence only when degradation is reversible, within parameters, and independently verifiable. A read path with no diagnostic surface fails the independently verifiable condition by construction.

Why this is jurist territory before code: Per CLAUDE.md authorization taxonomy, [PROPOSAL] requires explicit steward authorization via REVIEWED.md. But this one carries a stronger requirement: it is a candidate L2 invariant — a constitutional commitment about how the architecture must behave, not a one-off design choice. Jurist review for whether this is invariant-shaped or design-commitment-shaped (per the DN-GOV-08 framing — recognition-conditions vs recognition-content) is load-bearing before any mechanism work begins.

Files affected (when mechanism is later proposed by Seb): Depends on mechanism. Most candidates touch src/server/routes/health.ts + src/server/routes/recall.ts + src/types/system-status.ts; some touch per-module read paths individually. No code change at this stage.

Spec touchpoints (when mechanism is later proposed): bettermemories/CLAUDE.md (invariant statement); keystone-spec.md (query-router contract); per-module specs that articulate query interfaces.

Awaiting: Steward + jurist review for whether this is filed as:

(a) a [PROPOSAL] in the L1 governance record (this PENDING entry), to inform Seb's design when he picks up H2/H4; OR
(b) elevated to a candidate L2 invariant in capablemind/docs/thinking/David/l2-constitution/, with jurist drafting the registry entry per the I15/I16/I17 pattern; OR
(c) both — file as PENDING here for engineering visibility AND elevate as L2 candidate for constitutional consideration.

The executor recommends (c), but the L2 elevation is jurist territory and requires the cluster decision (Cluster A/B/C) the executor cannot make.

Status (2026-05-14, corrected): AUTHORIZED via REVIEWED-22 — Option (a) only: PENDING-20 stays as L1 governance entry. L2 elevation work is DEFERRED to post-May 2026 per global CLAUDE.md parked-status: "L2 PARKED through end of May 2026. No L2 governance advancement, no new invariant work, no constitutional proposals. L2-adjacent questions arising from L1 work: note, don't pursue." Steward confirmed at session end: "I won't be working on L2 until the end of May — that something was surfaced because of L1 work is both fantastic and coincidental."

Jurist's three governance calls (RECORDED for post-May pickup; not actioned this session): (1) Not Cluster A; Cluster B is the right cluster (read-path observability is epistemically downstream of Cluster A; common genus with REVIEWED-18 + REVIEWED-19 is conditions under which the system's epistemic behavior can be verified and governed). (2) DN-GOV-08 fit confirmed: invariant-shaped, not design-commitment-shaped (stabilizes conditions, does not automate recognition). (3) l1_contamination_profile is distinct from Cluster A's monotonic-toward-interlocutor-satisfaction shape — it is the competence-vulnerability paradox from the Observer Problem: increasing capability masks decreasing observability of degraded paths. Profile candidate: moderate, structural. Saved as portable project memory at ~/.claude/projects/-Users-davidglidden/memory/project-competence-vulnerability-paradox.md.

Held until post-May 2026 (do NOT pursue):

Steward declaration on Cluster B status.
Jurist drafting cluster framing note (if needed) and registry entry per I15/I16/I17 pattern.
Brief jurist↔steward exchange on l1_contamination_profile language.
Filing of registry entry in capablemind/docs/thinking/David/l2-constitution/amendments/.

Executor's role going forward: maintain this entry as engineering-visibility record; track Seb's response on #165 (PENDING-19) and how it informs the cross-cutting; do not produce L2 doctrine; do not initiate cluster declaration or registry-entry drafting before June 2026; if a future jurist message arrives on this topic before end of May, surface the parked status before responding substantively.

PENDING-21 — H4: Hook events pollute recall + logchain (design-call)

Date: 2026-05-14 Tag: [PROPOSAL] GH issue: CapableMind-ai/betterMemories_app #167 (priority:high, OPEN, opened 2026-04-21)

Summary: Two mechanisms in hooks/cm-hook.mjs (verified byte-identical to addendum's transcription in current main cdc2f0e; no commits to the hook surface since April 19):

4a — Recall spam from UserPromptSubmit (hooks/cm-hook.mjs:340-362, handleUserPromptSubmit): every UserPromptSubmit event fires recall(prompt, { maxResults: 5 }) with the full prompt text. In Claude Code this includes real user prompts (expected) AND task-notification XML when background tasks fire (Monitor events, scheduled wakeups) AND auto-generated prompts from tool results. Each fire = one embeddingProvider.embed(prompt) (~300-1300 ms via Ollama) + one full query-router pass.

4b — Logchain accumulation from observe (same hook): every prompt is also observe('hook.user_prompt', payload, ...)'d, lands in the logchain, gets classified, and enters entity/vector/temporal storage. Over a session, hook-observed content fills the underlying stores and matches subsequent recalls for any query with overlapping tokens — this is how earlier WM pollution manifested per the addendum.

§6 aggregate cost framing: a steward working a full day with many tool calls, monitors, and scheduled triggers generates many hundreds of hook recalls. Each is silent CPU + embed cost. "On battery, this ambient Ollama load is pure loss" — directly couples to H2 (#165).

Why this is [PROPOSAL] not [HARDENING]: Per addendum classification, "Architectural — Two mechanisms (recall spam + logchain noise). Design call — warrants a call with steward, likely coupled with session/hook integration work." Three design questions whose resolution is Seb's territory; choosing among them is policy.

The three design questions (verbatim from addendum §4 for steward+jurist+Seb review):

Prompt filtering at the hook. Should the hook distinguish "substantive user prompt" from "system/tool-notification prompt"? A trivial shape: skip observe + recall when the prompt starts with < (XML/tag-shaped). Not robust to all cases but fast.
Event classification at BMF. Should hook.user_prompt events enter the same indices as vault content, or a segregated tier (e.g., session-scoped, not recallable)? This is the cleaner architectural shape but bigger lift.
Recall-triggering policy. Should every prompt trigger a full recall, or only when the operator asks for context (e.g., an explicit /context trigger)? The current default assumes recall is always wanted; measurement suggests it's also always costly.

Options for surfacing this to Seb (same shape as PENDING-19 Option B; recommend the same answer):

A. Steward calls Seb directly with these three questions for a sync conversation. B. Steward leaves a comment on #167 referencing PR #172 + the H2 comment on #165 (batches the audit's three open findings into one attention window for Seb). Asynchronous; record-on-issue. C. Steward + jurist + executor draft a unified design proposal. Pre-decides what is properly Seb's call. D. Defer. Acceptable if H4's ambient cost is tolerable; the steward is the empirical witness for whether it is.

Recommendation: Option B, conditioned on all three questions surfaced explicitly and the §6 ambient-cost framing included as fourth-question-in-effect. Same discipline as PENDING-19: ask Seb to address all three or explicitly defer specific ones. Escalate to (A) if response is "let's talk."

Coupling note for the comment: H4 and H2 share a substrate (both depend on Ollama embedding being available; H4's ambient cost is pure loss on battery per the addendum's §6 callout). If Seb resolves H2 toward CPU fallback or default-allow, that affects H4's cost analysis directly. Worth surfacing explicitly so Seb sees the H2/H4 coupling rather than treating them as independent.

Connection to cross-cutting [PROPOSAL] (PENDING-20): H4 is the fourth empirical confirmation of the read-path-honest-degradation pattern. Specifically: the working-memory pollution + hook-observed content surfacing on subsequent recalls is exactly the failure mode the cross-cutting "why empty / why these results" breadcrumb would surface. PENDING-21's resolution informs the cross-cutting's mechanism design, but does not replace the meta-finding (which is held until post-May 2026 per REVIEWED-22 correction).

Connection to authorized work: REVIEWED-19 (Epistemic Integrity, PENDING-17) authorized recall-correctness improvements as L0 readiness. H4's both mechanisms (spam + accumulation) launder the agent's own tool-stream into recall results — the laundering-uncertainty pattern that work targets. Resolution is policy, not a clobber-fix.

Files affected (when conversation produces a direction): Depends on direction.

Prompt filtering at the hook: hooks/cm-hook.mjs (~5-10 lines)
Event classification segregation: src/core/keystone/orchestrator.ts, src/core/keystone/classification.ts, src/types/event.ts, hook payload shape, possibly a new hook_session_scoped event domain
Recall-triggering policy: hooks/cm-hook.mjs + Claude Code config conventions; user-facing trigger surface
Spec touchpoints: keystone-spec.md, possibly a new "session-scoped events" spec, MCP/hook integration specs

Awaiting: Steward authorization to coordinate the surfacing-to-Seb action (recommend Option B above with the H2-coupling note). Direction selection is Seb's call after the three questions are surfaced; this PENDING entry does not propose code or amendment — it proposes the conversation.

Status (2026-05-14): AUTHORIZED via REVIEWED-23 (Option B; literal comment text reviewed by steward before posting). Comment posted: https://github.com/CapableMind-ai/betterMemories_app/issues/167#issuecomment-4449244331 — three questions surfaced verbatim, §6 ambient-cost framing included, H2/H4 coupling note included. Awaiting Seb's response.

Continuity Skill Audit cluster (S0–S9)

The following ten entries (S0–S9) emerged from the 2026-05-18 audit of the wake-up / wrap-up / symmetria continuity skills, framed against Robert Pogue Harrison's Dominion of the Dead (the living session as ligature between the dead and the unborn). The audit's full architectural framing lives in three companion documents in ~/_Dev/CapableMind-AI/docs/thinking/David/methodology/:

continuity-skill-audit-jurist-brief-2026-05-18.md (executor's v2 brief)
continuity-skill-audit-jurist-shape-review-2026-05-18.md (Jurist's shape-review)
prime-directive-elaboration-2026-05-18.md (steward's authored Directive elaboration)

Cluster identity (S-prefix) is preserved per the OP- cluster precedent. PENDING.md entries here are operational trackers; the methodology documents carry the architectural reasoning.

The Jurist's six-phase authorization map governs sequencing. Cross-cutting success criterion (filed as feedback memory feedback-skill-success-is-reexplanation-reduction.md): the measure of any S-item implementation is whether the steward stops having to reexplain himself at the moment that change addresses — not whether the skill becomes more sophisticated.

PENDING-S0 — Prime Directive elaboration (CLOSED 2026-05-18)

Date: 2026-05-18 Tag: [ESCALATE] [PROPOSAL] Status: CLOSED-by-commit.

Summary: Make explicit, as a continuation of the μέτρον gloss, the principle that τὸ πρόσφορον — what is fitting — includes the time the task requires. Constitutional commitment at the Prime Directive level; operational carrier in Symmetria §0.

Authoring sequence: Executor surfaced the principle from three corrections-in-a-day during the audit (the lectio moment + the v1-brief hedging + the principle-elevation correction). Steward authored the final language; Jurist shape-reviewed and confirmed (clause within existing μέτρον gloss, not appended paragraph). Steward committed CLAUDE.md (line 12, between citation and decision-filter prose); executor committed Symmetria §0 (between gloss and §0 header).

Files committed: ~/CLAUDE.md §"Prime Directive"; ~/.claude/skills/symmetria/SKILL.md (between citation and §0).

Acceptance test (per cross-cutting success criterion): does the executor hold the time-the-task-requires principle without requiring steward intervention to apply it? Tested over the following weeks of work.

PENDING-S1 — Wrap-up §8 output template: add pause statement + negative space as named fields (CLOSED 2026-05-18)

Date: 2026-05-18 Tag: [HARDENING] Status: CLOSED-by-implementation via REVIEWED-24 (Class A bundle).

Summary: §8 output template in ~/.claude/skills/wrap-up/SKILL.md adds two named fields: **Pause statement:** (parallel to pulling thread) and **Decisions deferred (and why):**. Both are currently required in §1 procedure but absent from §8 template.

Rationale: Audit ligature test A2 + A3. The pause and the negative space are procedurally required but structurally optional. Under context-pressure the procedural commitment is the one that drops — the post-Directive-elaboration view is that this is exactly the time-the-task-requires failure mode the new constitutional clause names. Q3 (the asymmetric pause) was elevated to constitutive by the Jurist on Harrison-grounded reasoning: the ligature is laid at departure, not discovered at return. Wrap-up must structurally enforce the pause statement.

Files affected: ~/.claude/skills/wrap-up/SKILL.md §8.

Implementation note: New fields include explicit annotations naming the pause as constitutive and the negative space as required-for-unborn-session-to-know-scope. Acceptance test: the /wrap-up at the end of session 2026-05-18 is the first live run; future wrap-ups should not drop these fields under context pressure.

PENDING-S3 — Wake-up §3: binary thread validity gate (CLOSED 2026-05-18)

Date: 2026-05-18 Tag: [HARDENING] Status: CLOSED-by-implementation via REVIEWED-25 (Class A bundle).

Summary: Add an explicit named step in ~/.claude/skills/wake-up/SKILL.md before §3 synthesis: thread validity gate with binary outcome (confirmed / stale / superseded) and a one-line reason. If stale, surface that before restoring anything else.

Rationale: Audit B1. Currently the staleness check lives in prose ("if situation has changed enough, say so") plus a 3-day heuristic. Compression risk: the check is silently skipped — exactly the pattern the Directive elaboration's "when context pressure rises, pause before composing" addresses.

Files affected: ~/.claude/skills/wake-up/SKILL.md §3.

Implementation note: Gate is placed as the first step of §3 synthesis (not as a separate section, to avoid numbering cascade). On stale or superseded, the briefing structure reorders to lead with what changed, not with the inherited thread. Acceptance test: future wakes after a long pause or after substantive events should explicitly state the gate's outcome rather than implicitly restoring the prior thread.

PENDING-S8 — Symmetria pulse lineage anchor + wake-up traversal tools prescribed (CLOSED 2026-05-18)

Date: 2026-05-18 Tag: [HARDENING] Status: CLOSED-by-implementation via REVIEWED-26 (Class A bundle).

Summary: Two related drifts identified by the audit (D2 + B6):

Symmetria pulse procedure (§6 no-arg pulse) adds a step 0 — re-anchor craft / ethics / character to lineage (now including the τὸ πρόσφορον-includes-time elaboration just landed in §0).
Wake-up procedure (§2.b) prescribes mempalace_find_tunnels when the pulling thread crosses project boundaries, and mempalace_kg_timeline when steward asks about when a fact changed. Both tools mentioned in constraint notes but never prescribed in procedural steps.

Rationale: Two drifts where the framework named tools/lineage but did not reach for them in procedure — decoration without load-bearing use. With the lineage just extended (S0 landed), the Symmetria pulse not touching it is now an even larger gap.

Files affected: ~/.claude/skills/symmetria/SKILL.md §6 pulse; ~/.claude/skills/wake-up/SKILL.md §2.b.

Implementation note: Symmetria pulse step 0 re-anchors all three dimensions (craft / ethics / character) to lineage; pulse step 5 also gains a cross-reference to §3 for the self-flag on aligned-without-named-tension. Wake-up §2.b gains a new b.4 substep that prescribes the two tools with explicit conditions (cross-project thread → find_tunnels; when-question or prior-state-reference → kg_timeline). Acceptance test: future pulses begin with lineage re-anchor; future wakes with cross-project pulling threads (e.g., ARC ↔ chamber-library) reach for find_tunnels in standard procedure.

PENDING-S2 — Hook-aware deposit detection in wake-up (awaiting Q1 hooks contract)

Date: 2026-05-18 Tag: [PROPOSAL] Phase 4 — awaits Jurist contract definition.

Summary: Wake-up detects whether the previous session ended via wrap-up or via Stop hook alone. Surfaces a warning when hook-only: "Previous session ended without wrap-up — pulling thread may be absent or incomplete." Calibrates confidence accordingly.

Rationale: Audit A4 — the strongest single gap in the ligature. A hook-only deposit lacks pulling thread / literal question / pause statement, but currently looks identical to a wrap-up deposit from wake-up's perspective. Jurist (2026-05-18 shape-review): the hooks/skills contract is doctrinal, not tooling. It determines what the unborn session can trust about its inheritance.

Files affected: ~/.claude/skills/wake-up/SKILL.md §2.b.1 + §3.

Awaiting: Jurist shape-review of contract language (candidate text in Jurist shape-review document: "The authoritative deposit is a wrap-up deposit. A hook-only deposit is an emergency fallback, not a complete inheritance. Wake-up must detect which it received and calibrate accordingly."). Then steward authorization.

PENDING-S4 — Post-compression marker; cross-repo with mempalace (awaiting Q1)

Date: 2026-05-18 Tag: [PROPOSAL] Phase 4 — cross-repo coordination.

Summary: PreCompact hook (~/_Dev/mempalace/hooks/mempal_precompact_hook.sh) writes a marker diary entry (topic: session-compaction) when it fires. Wake-up detects this marker; if present, warns that confidence claims in that session inherit a lossy view. Symmetria adds a post-compression contamination flag (paired with §3 application work in S6).

Rationale: Audit B4 + D4. The PreCompact event currently silent to all downstream consumers; this makes it observable.

Files affected: ~/.claude/skills/wake-up/SKILL.md; ~/.claude/skills/symmetria/SKILL.md §3; ~/_Dev/mempalace/hooks/mempal_precompact_hook.sh (upstream PR or steward-coordinated change).

Awaiting: Jurist contract definition (Q1); steward authorization; mempalace upstream coordination.

PENDING-S5 — Authoritative-diary marker; wrap-up ↔ Stop hook (awaiting Q1)

Date: 2026-05-18 Tag: [PROPOSAL] Phase 4 — cross-repo coordination.

Summary: Wrap-up's diary write carries an explicit authoritative: true marker (or AAAK equivalent). Stop hook (~/_Dev/mempalace/hooks/mempal_save_hook.sh) checks for a recent authoritative entry and skips its block if present.

Rationale: Audit C3. Currently a wrap-up + subsequent hook fire may produce two diary entries from different AI states. The second one (post-wrap-up, depleted context) is silently mistaken for the canonical entry by future wake-ups.

Files affected: ~/.claude/skills/wrap-up/SKILL.md §4.b; ~/_Dev/mempalace/hooks/mempal_save_hook.sh.

Awaiting: Jurist contract definition (Q1); steward authorization; mempalace upstream coordination.

PENDING-S6 — Symmetria §3 contamination flag applications of the Directive elaboration

Date: 2026-05-18 Tag: [HARDENING] Phase 3b — depends on S0 (now CLOSED).

Summary: Extend ~/.claude/skills/symmetria/SKILL.md §3 contamination flag list with applications of the now-constitutional time-the-task-requires principle, plus three other self-flags surfaced by the audit:

Lectio (corpus reading): take the time the corpus asks for.
Diagnose-don't-fix (debugging): trace the class of failure before patching the instance.
Dwell-on-composition (writing): the recommendation gets the time it wants, not the time the executor wants the recommendation to take.
Alignment pulse returning aligned without naming a specific tension — premature-closure (D1).
Search queries shaped by what the session wants to find rather than what it needs to find (D5).
Post-compression confidence claims — the working memory was trimmed; what's certain now may rest on what was lost (D4; pairs with S4).

Rationale: Audit D1/D4/D5 + the principle elevation. §3 currently flags external code and writing patterns; with the Directive elaboration in place, applications of it at the discipline level are coherent additions, not scope-creep.

Files affected: ~/.claude/skills/symmetria/SKILL.md §3.

Awaiting: Steward authorization (S0 closure unblocks).

PENDING-S7 — Symmetria `check` mode: add `suspend` outcome (awaiting Q5 + relates to Q4)

Date: 2026-05-18 Tag: [HARDENING] Phase 5.

Summary: §6 check mode outcomes extend from proceed / return-and-reframe / escalate to proceed / return-and-reframe / suspend / escalate. suspend = hold for unhurried steward judgment without urgency.

Rationale: Audit D3 + Jurist confirmation. Today's audit was the missing-shape example: neither escalate (urgent) nor return-and-reframe (the audit is the right work) fit. With the Directive elaboration in place, suspend is the natural outcome — the time the steward's judgment requires is task-time, not interruption-time.

Files affected: ~/.claude/skills/symmetria/SKILL.md §6 (check).

Awaiting: Steward authorization.

PENDING-S9 — Wrap-up §8 output template enriched to match practice

Date: 2026-05-18 Tag: [HARDENING] Phase 5 — depends on Q2 + Q3 (Q3 confirmed by Jurist).

Summary: §8 output template in wrap-up expanded to mirror the three-tense richness the steward already produces in session memory files: Past / Present / Future as named sections, with required fields under each. Subsumes S1 if implemented together; or S1 lands first as smaller increment and S9 follows as deeper revision.

Rationale: Audit C5 diagnostic — template under-specifies what good practice already does. With the Directive elaboration in place, an output template that drops the practice's load-bearing tenses under compression is itself an instance of the failure mode the principle catches.

Files affected: ~/.claude/skills/wrap-up/SKILL.md §8.

Awaiting: Steward authorization. Optional relationship to S1: implement S1 first (minimal additive), then S9 as deeper revision; or fold S1 into S9 as single revision.

SESSION-LOG-2026-05-18 — Continuity Skill Audit Phase 1+2 complete

Date: 2026-05-18

Summary:

Three-phase audit of wake-up / wrap-up / symmetria triad executed per steward instruction.
Audit revealed central architectural finding: load-bearing items currently named in procedure but not enforced in structure. Strongest single gap: hook-only deposits invisible to wake-up (PENDING-S2). Strongest working part: literal-question discipline.
Two steward corrections during the audit elevated the work: lectio surfaced the principle's specific shape; principle-elevation correction surfaced that the audit's central finding is itself an application of a principle the Prime Directive implies but does not carry through to (always take the time the task requires).
Jurist shape-reviewed five doctrinal questions (Q1–Q5); all five affirmed. Q3 (asymmetric pause) elevated to Phase 2 alongside Q4 (principle elevation) on Harrison-grounded reasoning: the ligature is laid at departure, not discovered at return.
Phase 2 completed: steward authored the Directive elaboration; Jurist confirmed language as drafted + placement (Option 1: both CLAUDE.md and Symmetria §0); steward committed CLAUDE.md; executor committed Symmetria §0. PENDING-S0 closed.
Phase 3 now unblocks: Class A items S1 + S3 + S8 ready for steward authorization (no doctrinal dependencies).
Cross-cutting success criterion saved as feedback memory: the measure of skill improvements is whether the steward stops having to reexplain himself; sophistication without reexplanation-reduction is decoration.

What works: the literal-question discipline (structurally enforced; survives compression). What doesn't yet: hook-aware deposit detection; pause-statement symmetry; thread validity gate; Symmetria lineage anchor in pulse; §3 self-contamination flags; suspend outcome. Artifacts: three methodology documents in ~/_Dev/CapableMind-AI/docs/thinking/David/methodology/; two feedback memories (feedback-load-bearing-not-by-immediate-weight.md + feedback-skill-success-is-reexplanation-reduction.md); one new KG drift-pattern (under-valuing-small-discipline-marks-by-immediate-visible-weight); session ledger entries.

PENDING-22 — Hermes Agent scout deliverable (for jurist review)

Date: 2026-05-27 Tag: RESEARCH / SCOUT — awaiting jurist review (contains NO proposals per brief; each candidate adaptation would become a separate [PROPOSAL] only after jurist review) Summary: Completed the steward-authorized, jurist-drafted Hermes Agent scout mission — structured comparative analysis of NousResearch/hermes-agent (read from a clone, HEAD c819bc5; ~134k★) against the four L1 pain points. Deliverable: ~/_Dev/CapableMind-AI/docs/thinking/David/l1-reliability/hermes-agent-scout-2026-05-27.md (uncommitted working-tree file on capableMind_docs main — awaiting steward decision to commit).

Two stale-fact corrections to the brief (steward-requested pass), verified against source:

Pain #1 ("confidence discarded") is substantially STALE — Amendment 61 shipped it end-to-end (I-CF floor 0.35 base.ts:64; I-CC ceiling; source_classification_confidence persisted; recall composite weights it query-router.ts:657-680; recall.ts:116-118 exposes it). Reframe to "built; open question is calibration, not existence." Materially changes the crosswalk.
Pain #2 substrate claim imprecise — current BMF is a hybrid (SurrealKV + per-module better-sqlite3 + LanceDB + file-logchain), SurrealDB mid-retirement. Not a completed "shift to SQLite+LanceDB."

Headline findings for the jurist:

Pain #1: Hermes's default memory has NO confidence/quality/provenance (provenance computed-then-discarded; only the opt-in holographic plugin has a trust_score, and it is usage-feedback not classification-time). CapableMind is ahead here.
Pain #4 (skill/procedural memory) is the high-value lesson: SKILL.md artifact (minimal enforced schema: name+description+body), dual creation triggers, progressive-disclosure retrieval, never-delete curator lifecycle (maps onto CapableMind's existing lifecycle_state enum), agentskills.io portability. CapableMind has no procedural-memory architecture (though knowledge_type='procedural' already exists on entities).
Pains #2/#3: concrete inputs (hard-coded curation exclusion taxonomy; trigram-FTS for multilingual; progressive disclosure; explicit model-driven retrieval) but no confidence-gated admission and no auto-retrieval-fidelity solution.

Governance flag (most important for jurist): Hermes's headline feature — an autonomous background-review fork that writes skills/memory without human authorization — is exactly the autonomous self-modification CapableMind's constitution gates (loop-is-load-bearing; DN-GOV-05). Any borrowed pattern must re-introduce the authorization boundary Hermes omits. §7 candidate adaptations are all marked SPECULATIVE for this reason.

Awaiting: Jurist review of the deliverable before any adaptation work. No code, no spec, no proposal produced this session.

PENDING-23 — Skill-harvest practice added to the wake/wrap continuity discipline

Date: 2026-05-27 Tag: [HARDENING] — continuity-triad; steward-authorized direct implementation this session Summary: Refactored "skills improve from what we learn" into our standing way of working — the governed analog of Hermes's autonomous self-improvement fork. /wrap-up gains §1.6 "Skill harvest" (propose create/patch/retire skills from the session + ledger; never autonomous), a §8 output field, and a propose-only constraint. /wake-up gains a glance for skill-harvest proposals left unauthorized (§2.a + §3). Improved skills now carry a one-line provenance note (added to wake/wrap themselves). Rationale: Yesterday's wake/wrap improvements were this practice run by hand; this makes the reflex standing. The governed translation (propose → steward-authorize → apply → record) is the [PROPOSAL]→[REVIEWED] model turned on our own tooling — dogfooding the CapableMind thesis: self-improvement that is governed, auditable, never autonomous. It explicitly inverts Hermes's "nothing-to-save should not be the default" — "no harvest" is valid; manufacturing changes is the contamination shape. Yardstick: the reexplanation-reduction memory. Files affected: ~/.claude/skills/wrap-up/SKILL.md (§1.6, §8, constraints, provenance); ~/.claude/skills/wake-up/SKILL.md (§2.a, §3, provenance). Governance note: Touches the continuity triad the 2026-05-18 S-cluster audit treated with jurist shape-review (REVIEWED-24/25/26). Steward authorized direct implementation this session (additive, low-risk — same shape as REVIEWED-24's §8 additions). Surfaced for jurist awareness; jurist may refine §1.6 wording or elevate the practice. Storage (corrected): No duplication. ~/.claude/skills/{wake-up,wrap-up,symmetria} are already SYMLINKS into ~/dotfiles/claude/skills/ (the clean pattern, same as audit and landscape-scan). The edits therefore landed directly in the canonical, version-controlled files — nothing to consolidate. (Earlier this session I mis-asserted duplication from an ls -la that silently followed the symlink; corrected here via -L/diff check. Drift: asserting-fs-state-from-a-misread-listing — verify with -L, not ls -la of a symlinked dir.) Awaiting: First live test at this session's /wrap-up (§1.6); jurist refinement if desired. The skill changes are in the canonical ~/dotfiles tree (currently uncommitted).

PENDING-24 — Hindsight deep-read & the L1 epistemic-vs-mechanical analysis (umbrella; contains proposals)

Date: 2026-05-27 Tag: RESEARCH / ANALYSIS — umbrella for sub-items tagged below ([PROPOSAL] A1/A2/B1, [HARDENING] C1/C2/D1). Steward-authorized deep read ("take all the time you need, do it once"); Symmetria active throughout. Summary: Source-grounded deep read of Hindsight (arXiv 2512.12818 / vectorize-io/hindsight, Seb's flag) and of L1's spec + runtime (BetterMemories.io@3bc8b75), through the steward's thesis (an epistemic system should think epistemically end to end, not mechanically). Three sub-agent reads under the Symmetria §5 preamble + executor re-verification of every load-bearing claim against source. Deliverable: ~/_Dev/CapableMind-AI/docs/thinking/David/l1-reliability/hindsight-deep-read-and-l1-epistemic-analysis-2026-05-27.md (uncommitted working-tree file on capableMind_docs main — awaiting steward decision to commit).

The verified reversal (changes the strategic picture): Hindsight's shipped code is not its paper. The four-network epistemic typing + per-fact confidence + CARA belief-revision were removed (migration g2h3i4j5k6l7_remove_opinion_fact_type.py, 2026-04-02: deletes opinion rows, drops confidence_score, CHECK → ('world','experience','observation')); no reinforce/cara/α math in the engine. They ship a pragmatic 3-type hybrid and still hit 91% on LongMemEval — because the benchmark gives no credit for epistemic integrity. CapableMind's governed/epistemic angle is therefore unmeasured by the field — its risk and its moat. The steward+Seb bet is vindicated, not threatened.

Answer to the steward's question (refactor with our tools, or are they showing us the way?): mostly "our tools." At the parts level L1 is even/ahead — RRF (k=60, module-weighted), cross-encoder rerank, BM25+vector hybrid (LanceDB), honest read-path degradation, and a fully-wired numeric confidence chain (I-CF floor → I-CC ceiling → persisted source_classification_confidence → recall weight 0.15; all verified live). Our gap is not missing tools — it is: (a) the epistemic kind signals (means_of_knowing, earned_confidence) are computed at write and read by nothing in recall (verified — orphaned exactly as the numeric confidence was before Amendment 61); (b) the similarity probe / observation-recall coupling is dead code (setSimilarityProbe has zero callers — REVIEWED-18 inert and silent); (c) the causal subsystem is an ungoverned inference-generator (N6: ~42 edges/event, 97%+ coherence-unevaluated, json_each full-scan in the ingest hot loop — the epistemic failure and the operational crash are the same failure); (d) no external benchmark to tune recall against.

Where they genuinely show us the way (borrowable with our tools): (1) bounded graph growth — per-unit link caps (_cap_links_per_unit: temporal 20 / semantic 50) + anti-hallucination causal target_index < i (prior-only) — the exact governor N6 lacks; (2) always-on local recall quality — their cross-encoder rerank runs unconditionally on an 80 MB local model, where L1's rerankers no-op unless inference slots are graduated (cold/teacherless → heuristic-only recall); (3) the LongMemEval/LoCoMo benchmark harness (plug-in seam: dataset/generator ABCs + an L1 adapter exposing retain_batch_async+recall_async).

Sub-items surfaced (none unilaterally committed):

A1 [PROPOSAL] (jurist territory): thread means_of_knowing/earned_confidence to recall as output provenance (+ optional ranking signal) — "Amendment 61 for the qualitative epistemic axis." L1-only (existing fields); the L2-coupled belief-schema version stays PARKED.
A2 [PROPOSAL]: if we adopt the benchmark, record it as a floor not a ceiling (it cannot score epistemic integrity; Hindsight is the cautionary case of optimising it away).
B1 [PROPOSAL] (architectural): an epistemic governor on causal-edge generation — Hindsight's per-unit cap + prior-only constraint (mechanical half) + mint causal edges as held/low-confidence means_of_knowing=inference, promotion gated on coherence (epistemic half). Defuses N6 and prevents the next one.
C1 [HARDENING]: bundle a local always-available cross-encoder fallback so recall quality doesn't depend on slot graduation.
C2 [HARDENING]/issue: fix or honestly remove the dead similarity probe (orchestrator.ts:363, zero callers).
D1 [HARDENING]: wire L1 to the LongMemEval/LoCoMo harness via an adapter (bind to A2).

Set aside on record: BMF-on-Hindsight-substrate (relational — L1 is the co-authored mechanism since 2026-05-23 (steward + Seb), conceived from the steward's Chamber prototype; substrate change touches both co-authors' work; sovereignty — Postgres/Oracle vs L1's local-first sqlite+LanceDB+file-logchain; governance — Hindsight has no authorization loop / logchain immutability / external-review hook). We take technique + validation, not substrate. Paper-vs-code divergence is itself a caution: borrow from their code, not their paper.

Caveat: checkout 3bc8b75; Seb's later commits (bd70ceb, e8c5fb7 w/ D1–D10) are not on disk and may move some findings.

Audit update (2026-05-28): four-pass pre-build audit completed (pre-build-audit-2026-05-28.md). Findings (a)/(b)/(c)/(d) were re-tested against substrate; A1's persistence-finding (no schema for means_of_knowing; only numeric value of EarnedConfidence persisted) corrected; B1's "prior-only constraint" borrow ruled redundant (BMF enforces by construction); B1's _cap_links_per_unit borrow validated as 1–3 lines; the parent amendment's items 9 (numeric confidence in recall response) and 10 (epistemic state in health) found NOT shipped, reshaping A1's scope. Co-author branch deferred. Audit document is part of the Monday package.

PENDING-25 — Translated renderings in the ARC corpus

Date: 2026-06-03 Tag: [PROPOSAL] Summary: A doctrine + frontmatter convention for translated/multilingual works — ARC holds works, of which languages are non-canonical renderings; the work (not any rendering) holds the corpus slot. Rationale: Lune will translate After the Reply into French — the first translation in the corpus, and a first instance of intergenerational stewardship in ARC. The corpus had no settled mechanism (only a tentative related_texts line in frontmatter-spec §8, and one accidental Context-C legacy piece). Jurist's Opinion (2026-06-03) ruled: Option B reframed ontologically — neither rendering is canonical, both express one work; Context C legitimate-but-gated; translator: a required field (intergenerational dimension carried structurally); amend frontmatter-spec (no new companion). Options: Work-level corpus-slot representation — W1 (primary_rendering flag; rejected, re-smuggles privilege), W2 (work-stub object; faithful but heavy), W3 (group by work: at build; AUTHORIZED). Sub-questions resolved 2026-06-03: routing = asymmetric (root slug stays, additional renderings /<lang>/<slug>); rendering-date = each rendering's own publication date; Context-C-placement = frontmatter-spec §8 + §I.j pointer (settled). Only toggle affordance remains open (deferred to implementation, to be rendered not specified blind). Recommendation: Adopt the jurist's rulings; implement via W3. Full proposal: docs/AldineXXI-Codex/drafts/translated-renderings-proposal-2026-06-03.md (jurist brief at multilingual-translation-handling-jurist-brief-2026-06-03.md). Files affected (on implementation): frontmatter-specification.md (§2 new subsection, §4 recipe, §8 ruling); site.hs (listing dedupe by work: + representative-selection); piece template (rendering toggle); routing rule. None touched yet. Status: AUTHORIZED-with-conditions by steward+jurist 2026-06-03; the four conditions are addressed in the proposal document (date resolved, work: omission corrected, §7.3 settled, routing decided). Formal REVIEWED entry is the steward's to file. Implementation split along its natural seam (executor analysis 2026-06-03, steward-accepted): (a) the work: listing-dedupe awareness folds into F-Phase 2 (the Hakyll listing generator — same site.hs listing surface; build it work-aware from the start so the generator is never reopened; dormant until a work: field exists, like §I.k); (b) the rest — frontmatter-spec amendments, toggle template, routing, heteronym decompose — is its own focused session after Stage G (stable typology), with the toggle rendered for the steward, not specified blind. Decoupled from the Vignette (independent — touches neither listing nor rendering). Test vehicle = the Matthieu Taliesin heteronym refactor (steward 2026-06-03): decompose the trilingual piece to en/fr/es renderings as the proving ground for the toggle+work: machinery (first application of the §5 Context-C gate, not a reversal of jurist's no-force-decompose ruling). Also incoming as renderings: steward's bio/CV + About pages (little-by-little). Readiness target: late August 2026, ahead of Lune's Après la réponse (expected late Aug/Sept). Independent of §I.k.

Awaiting: steward review of the audit; jurist review of A1/A2/B1; co-author engineering review of B1/C1/C2/D1 (Seb on resumption from Peter block 2026-06-01+; steward + executor continued joint work during).

PENDING-26 — `.whisper` retirement: §XIV name-lock + dedicated migration pass

Date: 2026-06-03 Tag: [HARDENING] Summary: Retire the unsanctioned .whisper class (apparatus-spec 462–464; AldineXXI Selector Index 2801) via a dedicated, gated migration pass — after steward/jurist lock the target apparatus class names per §XIV. Rationale: Stage N's deep read corrected the scope: the closing plan recorded "27 template usages"; ground truth is ~156 line-usages — 11 templates (~14) plus 100+ content markdown files (~140). This is a corpus-wide migration, not a residual deletion. .whisper conflates two semantic roles that must not land in one class: (a) apparatus prose (footer text, list metadata) and (b) list-context qualifier glyphs (✦/⟐ — the same marks that render via .chamber-mark/.encounter-mark on post pages). Stage M left a non-regressing holding value (_utilities.scss:32, var(--gray)); the §VII.e batch (commit 20019ba) did not touch it. The jurist's Stage-N review requires this carry to be a named PENDING item with commit-gate, not a verbal deferral. Name candidates (surfaced from the specs, for the lock):

Role (a) apparatus prose → .apparatus-meta (AldineXXI Selector Index 2801 "migrate to .apparatus-meta or equivalent").
Role (b) list-context glyphs → .register-mark-inline (apparatus-spec 464) or unification with the existing .chamber-mark/.encounter-mark (arguably the same mark in a quieter context — _post.scss historical note: ⟐ rendered via .chamber-mark on pages, .whisper in lists; one mark, one class, context handles register). Options: (1) Jurist rules on the names in a focused review; executor then runs the migration as its own pass — scripted edit across templates + content, render-verified per type per viewport, sequenced before the full re-partition. (2) Steward locks names directly in REVIEWED-26 annotation; same execution path. Recommendation: Option 1 — the role-(b) choice (new class vs unification) is a genuine taxonomy question the jurist should rule on; unification is the leaner answer but touches the qualifier-mark grammar (§V). Files affected: ~11 templates, 100+ content files, _utilities.scss + _layout.scss (the holding rules), apparatus-spec + Selector Index cross-references. Awaiting: Steward authorization + jurist name-lock. Until then the holding value stands; no migration work proceeds.

PENDING-27 — Steward-instance telemetry export contract

Date: 2026-06-06 Tag: PROPOSAL Summary: Establish the standing contract under which derived statistics may leave a steward's production CapableMind instance: content-free by construction · operator-initiated, never pollable · bounded purpose · steward-reviewed before transfer. Rationale: Seb's B1.3 proposal (b1.3-causal-floor-instrumentation-2026-06-02) asks for a base-score histogram from mindfabric-00 — the first extraction of derived statistics from a steward's production instance to inform engineering. The class will recur (fleet telemetry, A2 baselines on real instances, future calibration asks). The privacy analysis (2026-06-06, Tier B note §5) found that even content-free aggregates leak through two channels: totals proxy ingest volume, and any pollable surface turns deltas into a time series of the steward's activity intensity. The adjacent finding — the full /health payload (incl. idle presence transitions, budget, per-module cursors) served unauthenticated on a VPN-reachable bind — shows what improvisation produces. This is the inward-facing analog of the ARC AI-posture ruling (REVIEWED pending, 2026-06-05): what may be made of the substrate is the steward's to grant, per purpose, not a default. Constitutional-adjacent because it is a consent rule about the steward's own cognition substrate; jurist read requested. Options: (1) Adopt the four-clause contract above as a standing rule recorded in the L1 governance docs; each future request cites it and names its bounded purpose. (2) Rule per-request with no standing contract (status quo — improvisation each time). (3) Defer to L2 formalization (the privacy-tier vocabulary exists in spec but L2 is parked through May). Recommendation: Option 1. The contract is small, the case in hand is easy, and the fourth request should inherit a rule, not a negotiation. Drafted operationally in the Tier B note §5 (cm-ctl distribution-export as v1 mechanism, replacing the pollable /health field); the PENDING item is the standing rule, distinct from the B1.3 instance. Files affected: ~/_Dev/CapableMind-AI/docs/thinking/David/l1-reliability/cover-note-seb-tier-b-2026-06-06.md (operational half, sent to Seb); a governance doc home for the contract TBD on authorization (likely docs/thinking/David/methodology/ or l1-reliability). Awaiting: Steward authorization + jurist review (constitutional-adjacent: consent rule over steward substrate).

PENDING-28 — The imprint register: .imprint class + spec note

Date: 2026-06-06 Tag: [HARDENING] Summary: Give the footer imprint (ARC name, ✦/⟐ qualifier marks, Barcelona + seasonal glyph) its own .imprint class, ending .apparatus-meta's silent double duty; add a short imprint/signature note to apparatus-specification.md. Rationale: The steward's eye on the AldineXXI three-faces paragraph (2026-06-06) exposed that the footer lines classed .apparatus-meta are not apparatus: they are the house's signature — the imprint — which speaks in the work's own face (EB Garamond, now even-SC per same-day steward ruling, shipped in da375a6). The spec already holds the distinction (apparatus-specification.md §VII.g: "The piece's locator | The work's signature"); the CSS class does not. This is the third role the .whisper→.apparatus-meta migration census (PENDING-26/REVIEWED-27) did not distinguish — same shape as the original role-(a)/role-(b) split. The prose now names the register truthfully; the code should match the doctrine. Options: (1) .imprint on the four default.html footer usages + one SCSS block + spec note (recommended). (2) Leave CSS as-is; prose-only (rejected by the §5 code-binding discipline — class names carry semantics). Recommendation: Option 1, as its own gated pass (byte-delta touches every page's footer markup; migrate → compiled-selector grep → render-verify per type per viewport, the REVIEWED-27 method). Note: Amends REVIEWED-27's locked naming — jurist eyes requested before execution. Files affected: templates/default.html (4 usages), scss/AldineXXI/_layout.scss, apparatus-specification.md. Awaiting: Steward + jurist authorization.

PENDING-29 — Sitemap: include bio/cv and their renderings

Date: 2026-06-06 Tag: [HARDENING] Summary: Amend the §SEO sitemap rule to include bio/cv (and therefore their FR/ES renderings, live since 77cde08) — currently excluded via the enfilade-hidden filter. Rationale: REVIEWED-29's sitemap excludes enfilade-hidden pages; bio and cv are the only such pages. "Hidden from the enfilade door-strip" (a navigation-layout choice) and "hidden from crawlers" (an indexing choice) are different intentions that one flag currently couples. The pages are public, canonical, noindex-free, and now carry hreflang families — hreflang sets benefit from sitemap presence. The renderings followed the works out of the sitemap, consistently but probably unintendedly. Options: (1) Decouple: keep enfilade-hidden for the door-strip, include the pages (+renderings) in the sitemap — +6 URLs. (2) Status quo (consistent, but couples two intentions). Recommendation: Option 1. One-line change in the sitemap rule + spec note in apparatus §SEO. Note: Amends a jurist-authorized §SEO decision (REVIEWED-29) — flagged for jurist concurrence. Files affected: site.hs (sitemap rule), apparatus-specification.md §SEO. Awaiting: Steward + jurist authorization.

PENDING-30 — Prologue Postures: banish-JS with governed gate

Date: 2026-06-07 Tag: PROPOSAL Summary: Name zero-JS as an AldineXXI posture in the form of the house's existing banish-bold pattern: JS banished from the default path; admissible only through a six-condition gate (provably unachievable in HTML/CSS/build-time · reader-initiated, never ambient · observes nothing · page fully readable without it · first-party self-hosted · declared in spec, steward-authorized per instance, logged as precedent). Rationale: The 2026-06-07 audit found ARC ships zero JS as executed direction but unnamed commitment — and found the one surviving script was ungoverned residue (the unhandledrejection silencer, 312 pages), exactly the accretion a named posture forecloses. The Wave-0 analysis established that everything on the known horizon (vignette, running head, mode) is achievable without JS, so the marginal capability of a runtime is zero while its costs (fragility against ARC's for-return durability; a second runtime to govern; the privacy posture held as policy rather than structural property) are real. The gate keeps the spec honest about legitimate futures (e.g. the §III.b reader font-size control — a reader-initiated instrument) without admitting machinery. Steward ruled the direction 2026-06-07 (roadmap W1.1); this entry is the jurist-visible record for the Postures amendment. Options: (1) Banish-with-gate as above (steward-ruled). (2) Absolute prohibition (simpler, but lies about the §III.b held option). (3) Unnamed status quo (the audit showed what accretes). Recommendation: Option 1; spec text lands in the Wave-2 reconciliation pass. Files affected: AldineXXI-specification.md Prologue Postures; consequential: vignette spec Part II (PENDING-31), §VII.f implementation note (CSS scroll-driven), removal of the residual script (roadmap W3.4). Awaiting: Jurist review (framework extension per §XIV category 2; steward direction already given).

Status (2026-06-07): JURIST CONCURRED (Option 1) with one required amendment + one specification, both folded into the spec text as landed: condition 1 gains the demonstration requirement ("demonstrated in the implementation record that the specific behavior cannot be achieved by HTML, CSS, or build-time generation" — auditable artifact, not internal judgment); "observes nothing" specified (no reader behavior observed, no data collected, no side-effects beyond the reader's own initiated choice — localStorage-of-reader-preference passes, beacons do not). §III.b font-size control recorded as the held exception that keeps the gate honest. Spec text landed in W2.4 (ARC 7d9bad3). W3.4 residual-script removal proceeds independently. Awaiting steward REVIEWED entry.

PENDING-31 — Vignette Part II: build-time SVG+CSS renderer

Date: 2026-06-07 Tag: PROPOSAL Summary: Revise vignette-specification.md Part II Component 3 from the browser renderer (Canvas+SVG, requestAnimationFrame, ~300–400 lines JS) to a build-time renderer: Hakyll reads the genome sidecar and emits inline SVG + CSS per piece. Part I (the lock) is untouched. Rationale: Consequence of PENDING-30. The Wave-0 fidelity table (roadmap, drafts/road-to-stage-g-2026-06-07.md) traces every Part-I commitment to a build-time mechanism: geometry/ground-mark as inline SVG; field via SVG filters (feTurbulence grain, gradient density, overlay luminance); breath as CSS keyframes with the generation-fixed phase offset baked as negative animation-delay; mode-awareness as build-computed light-dark() pairs (orientation-preserving by construction — structurally safer than the runtime mapping Part I warns can silently invert); reduced-motion as a CSS media query. Two approximations, both within Part I's own tolerances: field drift refreshes per deploy (≈0.04%/day against a 5–7-year monotonic cycle) and the reduced-motion still frame is the base frame rather than the phase-offset frame (amplitude ≤2%, the spec's own "visually immaterial"). The genome contract, sidecar, steward review, Phase α/ω framing, and the dwell-test gate all carry unchanged; the validate-and-save harness survives as spec'd. Options: (1) Build-time renderer (steward-ruled direction). (2) Keep Component 3 as written and open the PENDING-30 gate for it (defensible — render-time drift is exact — but pays the runtime costs for imperceptible gain). Recommendation: Option 1. Phase-1 prototype proceeds against a hand-written test genome after jurist concurrence; first prototype goes to the jurist per the dwell-test review interface regardless. Files affected: vignette-specification.md Part II (Component 3 + build-sequence wording); Part I untouched. Awaiting: Jurist review (Part II was jurist-passed 2026-05-29; this revises that pass).

Status (2026-06-07): JURIST CONCURRED (Option 1). Fidelity analysis assessed sound; build-computed light-dark() pairs assessed an improvement over the runtime mapping (orientation-preserving by construction). One flag discharged before any executor instruction: the Component-2 scoping note is in the spec (the ~30-line estimate superseded; the ~300–400 lines of rendering computation migrate as a Haskell function — complexity migrated into the typed build step, not reduced). Architecture diagram drops "browser, runtime" from Component 3. Dwell-test gate unchanged (first prototype to the jurist). Spec revision landed ARC 4b0970b. Awaiting steward REVIEWED entry.

PENDING-32 — Frontmatter §2.8: a rendering inherits its work's class

Date: 2026-06-07 Tag: HARDENING Summary: Codify the convention the corpus already obeys 6-for-6 but nothing governs: a rendering file declares the same class: as its work; optionally, the build validates the equality. Rationale: Audit finding J2 (2026-06-07, adversarially verified): all six renderings (Taliesin fr/es; bio/cv fr/es) carry their work's class, but neither frontmatter §2.8 nor content-typology states the rule, and excludeRenderings keys on work: alone — a future rendering with a divergent class would silently carry wrong apparatus/template bindings. One sentence in §2.8 closes the doctrine; a small build check (rendering's class == work's class, loud on mismatch) closes the enforcement, in the spirit of §5 clause 3. Options: (1) Doctrine sentence + build validation. (2) Doctrine sentence only. Recommendation: Option 1; the check is a few lines beside renderingSiblings. Files affected: frontmatter-specification.md §2.8; site.hs (validation); content-typology cross-reference. Awaiting: Jurist concurrence (amends the PENDING-25/REVIEWED-28 doctrine by extension).

Status (2026-06-07): JURIST CONCURRED (Option 1), conditional on §2.8 being self-standing (work:/translator: defined). Condition found pre-discharged on verification: the jurist read a stale copy of the frontmatter spec — the live §2.8 (ARC e2866da, 2026-06-05, per PENDING-25/REVIEWED-28) already defines both fields, with the jurist's own scope-boundary language verbatim. No live-state/spec-state gap exists. To relay to the jurist at next exchange so the record sheds the stale premise. The inheritance clause landed as a subsidiary convention of the existing §2.8 (ARC 4e89337); the build check ships with Stage-G enforcement (roadmap W5). Awaiting steward REVIEWED entry.

PENDING-33 — Essay-versioning: truth-up and promotion from DRAFT

Date: 2026-06-07 Tag: PROPOSAL Summary: Amend essay-versioning-specification.md to the shipped truth and promote it from "DRAFT · design sketch" to OPERATIVE-for-the-built-scope. Rationale: Audit finding J7: the spec's mechanism is substantially live (full versioning module, /v/ routes with canonical-to-actual-route + noindex, version stamps, feed/sitemap integration) while the document still presents itself as an unbuilt sketch — the corpus's one materially dishonest status line, and Stage G should not read it in that state. The truth-up folds: (a) §4 amended to the shipped stamp shape (inline dated links to each /v/ page; no "Prior versions" index link — audit A4 judged the shipped shape arguably cleaner); (b) the §6 colophon worked-example resolved — either wire the about-page path's version stamp or re-designate the exemplar to the After-the-Reply pieces and rule the orphaned edition_label: Fourth Edition disposition; (c) §7 items 6–8 and the §4 retractation half explicitly marked deferred-until-need; (d) sequence_position → sequence_order (frontmatter §2.2 alignment). Options: (1) Truth-up + promote as above. (2) Truth-up only, status stays DRAFT (understates a live system). (3) Build the missing pieces first (disproportionate; no retractation piece exists). Recommendation: Option 1; (b)'s exemplar choice is a steward call inside the jurist pass. Files affected: essay-versioning-specification.md; possibly site.hs/about-page.html if (b) wires the stamp. Awaiting: Steward authorization + jurist review.

Status (2026-06-07): JURIST APPROVED the truth-up (a/c/d concur; on (b) the jurist offered a disposition: re-designate the exemplar to an After the Reply essay with live revisions; the edition_label orphan must not survive the pass unresolved). STEWARD AUTHORIZED + ruled (b) same day: exemplar → The Ethics of the Reply (jurist's disposition accepted); edition_label dropped from the §6 example (field stays available; the colophon's inert carrier recorded honestly). Executed ARC 392d8c8: spec promoted OPERATIVE (built scope: §§1–5, §7 items 1–5; deferred: §7 items 6–8, retractation UI, version-index page); §4 = shipped stamp shape (verified verbatim in compiled output); sequence_position aligned to sequence_order. Closes the corpus's one materially dishonest status line. Awaiting steward REVIEWED entry.

PENDING-34 — W5.2 / G3: single-source class→glyph (the Compass sigils)

Date: 2026-06-09 Tag: [HARDENING] Summary: Make the class→glyph binding structural (or build-validated) so the Reading Compass sigils cannot silently drift from the typology — ending the "correct by naming convention, not structure" fragility the audit named (G3), the Hakyll north-star's documented fix. Rationale: Audit finding G3 (2026-06-07, content-typology §5 clause 2). The class→mark relationship lives in three loci that agree today only by naming convention: (1) data/content-types.yml glyph: — the canonical Unicode mark per class (essay → ●), generated from content-typology §2; (2) the slug-derived sigil-id in compassRowsHtml (site.hs:133 — listing slug essays → #sigil-essays); (3) the hand-authored SVG <symbol id="sigil-essays"> sprite in templates/reading-compass-points.html (the actual drawn form). The compass rows are already data-driven (Stage-F Phase-2 generator, from data/listings.yml), and a listing's class is already build-validated against the enumeration (§5 clause 3). What is not enforced: that each compass entry's sigil-id has a matching <symbol>, and that the drawn mark agrees with the class's canonical glyph. A renamed slug, a new type, or a re-drawn/mis-named symbol silently desyncs the rendered mark from the typology fact — no build error, wrong glyph ships. The SVG geometry is artwork and stays hand-authored (it cannot be generated from a Unicode codepoint); what is single-sourced is the mapping + a loud build check ("unknown = build error", the north-star's own phrasing). Options:

Build-validation guard (minimal, output byte-identical). Add a build check (beside loadListingDefs): every compass sigil-id (listings + compass_specials) must resolve to a <symbol id="sigil-…"> present in the sprite, and every class carrying a glyph: in content-types.yml must map to exactly one surfaced sigil/symbol (or be explicitly governed-but-unsurfaced) — error, loud, on any mismatch. Keeps the current generation; closes the drift class by structure. No rendered change.
Derive sigil-id from class + the guard (fuller north-star form). Replace the slug-coincidence with an explicit class→sigil mapping consulted by compassRowsHtml (so the binding is structural, not conventional), plus Option-1's check. Slightly more refactor; output identical only if derived ids equal today's slugs (they do, by the current convention).
Status quo — documented drift risk; rejected by the audit's promotion gate. Recommendation: Option 1. It closes the exact failure class (silent glyph drift) with minimal change, byte-identical output, and is precisely the "unknown = build error" the Hakyll north-star and §5 clause 3 call for. Option 2's derive-from-class is the purer single-source but the slug↔class↔sigil naming is already 1:1; making it structural earns its place only if that convention later strains — a clean follow-on, not required now (proportionality). The SVG sprite stays hand-authored either way. Steward to rule between 1 and 2. Files affected: site.hs (new build-validation in/near loadListingDefs; Option 2 also touches compassRowsHtml); templates/reading-compass-points.html (read for the symbol-id census; not edited); data/content-types.yml + data/listings.yml (read, not edited); content-typology §5 cross-reference (records the enforcement; ships with the Stage-G promotion per the spec's own sequencing). Verification: byte-identical compiled-output gate (Option 1) + a deliberate-mismatch test proving the check fires.w Awaiting: Steward authorization (choose Option 1 or 2). Status (2026-06-09): STEWARD AUTHORIZED inline (chat, Option 1). Built 4936fc9: validateCompass binds class→glyph→sigil structurally; _site byte-identical (570 files); both checks fire on deliberate mismatch. REVIEWED-36 placed by steward. DONE.

PENDING-35 — W5.1 / G2: single-source title display (retire the `showTitleField` hardcode) + Dream amendment

Date: 2026-06-09 Tag: [HARDENING] Summary: Retire the 11-class hardcoded titleClasses list in showTitleField (site.hs:1829), binding the title-shown decision structurally to content-types.yml title_display (the matrix's executable shadow) so it cannot drift by hand — the durable form the stopgap's own comment names (G2). Coupled steward amendment: Dream moves title_display: shown → not-shown (steward editorial ruling, 2026-06-09). Rationale: Audit finding G2. showTitleField returns "true" for a class iff it is in a hand-maintained 11-element list whose own comment (2026-05-30) admits: "Durable form is a table lookup (Hakyll audit §4A); until then this list must track the matrix shown set." Diagnosis confirmed the list = the 10 matrix-shown classes + chamber. chamber is a dead entry — zero corpus pages carry class: chamber (the v1-legacy content/chamber/** pages carry real classes: essay/meditation/about/offering/deliberation/lex), so retiring the hardcode in favour of title_display == "shown" is byte-identical (the one definitional divergence — hardcode shows chamber, YAML marks it n/a — has no rendered instance). The census also surfaced classes outside the 14-type enumeration (offering, deliberation, lex, sequence-index, not-found); the replacement lookup is permissive (absent → not-shown), matching prior behaviour, and must NOT error on absence (unlike validateCompass on unknown listing classes), since showTitle runs over every routed item. Options:

Thread the shown-set as a typed parameter (recommended). Extend the existing content-types.yml parser (TypeFacts) to capture title_vignette.title_display; add loadTitleShownClasses :: IO [String] (reuses the decode machinery beside loadListingDefs); load once in main via preprocess; make showTitleField :: [String] -> Context String and postCtx :: [String] -> Context String, passing the set at the ~10 postCtx call sites. Compile-time enforcement → the binding cannot be forgotten (the type forces it). One file read at build start; no per-item re-read.
loadBody a tracked data item (the _build_info pattern): localizes the dependency inside showTitleField, no call-site ripple, runtime (not compile-time) binding. Adds a parallel data path + Item-body typing.
Status quo — hand-synced list; rejected by the promotion gate (G2). Recommendation: Option 1. Compile-time binding is the stronger single-source guarantee and the truest to G2's intent (drift made impossible, not merely checked); it reuses the one content-types.yml decode rather than adding a second reader. The call-site ripple is mechanical and contained to main. Dream amendment (coupled, steward-ruled): content-typology-specification.md §2 Sub-table 2 line 746: Dream title_display shown → not-shown (vignette_eligibility unchanged: no). Human-canonical matrix edit → make content-types regenerates the YAML shadow → make content-types-check confirms no drift. This is a steward editorial decision on the steward's own canonical document; it rides into the Stage-G jurist read (the jurist sees Dream=not-shown with this rationale and may raise it — the loop stays intact). Rendered effect: the single class: dream page loses its <h1> title heading (the one classified delta). Verification (two-hat separation): Commit 1 = the refactor alone (YAML still says dream=shown) → _site byte-identical vs pre-change baseline (proves the refactor is pure; chamber's 0 instances make the set-difference invisible). Commit 2 = the Dream amendment (spec §2 + regen) → _site delta = only the dream page's <h1> removed, nothing else (expected-delta gate). Plus a liveness check: temporarily flip a class's title_display and confirm the rendered title tracks it (proves the binding is live, not vestigial). Files affected: site.hs (TypeFacts/parser, new loadTitleShownClasses, showTitleField + postCtx signatures + ~10 call sites, main load); docs/AldineXXI-Codex/content-typology-specification.md §2 Sub-table 2 (Dream row — human-canonical); data/content-types.yml (regenerated, not hand-edited); content-typology §5 cross-reference ships with the Stage-G promotion (W6). Awaiting: Steward AUTHORIZED inline (refactor + Dream amendment). Render-review PASSED ("yes, unquestionably — one can't title their dreams"). Status (2026-06-09): DONE + DEPLOYED + LIVE. Two-hat: 4ea261a (refactor, _site byte-identical to baseline) + ac39b26 (Dream amendment, delta = the single dream page's <h1> removed). make rebuild shipped (CloudFlare uploaded 2 files — the dream page + _redirects); pushed both remotes (f8e00e7→ac39b26); live-verified on animalrationiscapax.org (h1.post-title=0, <title>+breadcrumb preserved). REVIEWED-37 drafted for steward placement. Remaining Wave 5: W5.3 (G4 clause-1 gate), W5.4 (G1 wildcard→build-error, lands in the Stage-G promotion commit).

PENDING-36 — W5.3 / G4 (clause-1 enforcement gate) + W5.4 / G1 (wildcard fallbacks → build errors)

Date: 2026-06-09 Tag: [HARDENING] Summary: Close the last two Wave-5 enforcement items. G4 (W5.3): a build-time census asserting every authored content file's class: is in the content-typology §1 enumeration (clause 1), erroring loudly otherwise — which also guards default.html's unguarded class="$class$-page" body emission. G1 (W5.4): convert the two classRouteName/classDisplayName wildcard fallbacks (other -> other ++ "s") into build errors (clause 3/4: unknown = build error, not fallback) — patch prepared now, lands inside the Stage-G promotion commit per the spec's own sequencing (clause 4 becomes OPERATIVE at promotion). Rationale: §5 clause 1 ("every authored content file declares exactly one class: from §1") and clause 4 ("site.hs routing may not fall back to class: essay; all pages explicitly typed") are the corpus's two unenforced contract clauses (gap-map G4, G1). Today they hold by convention. Diagnosis (per-directory class census): content/posts/ — the authored corpus that reaches classRouteName/classDisplayName via postCtx — carries only §1-enumerated classes (dream/essay/fragment/glimpse/gloss/heteronym/hommage/meditation/observation/readings/reverie), so the G1 wildcard is never triggered → converting it to error is byte-identical. The non-enumeration classes live outside the authored corpus: sequence-index (content/essays/after-the-reply/index.md — a sequence-index view), not-found (content/404.md), and lex/offering/deliberation (the content/chamber/** v1-legacy cluster — known-deferred, not drift, per project-arc-chamber-v1-legacy-cluster.md). A naïve clause-1 census would break the build on these legitimate pages; the gate therefore validates against enumeration ∪ an explicit exempt-set. The one decision (steward's): the exempt-set. It blesses the non-typology classes the corpus legitimately carries. Proposed: { sequence-index, not-found, lex, offering, deliberation } — each commented by reason (infra view · 404 · v1-legacy chamber ×3, deferred per tracker). It is a self-tightening ratchet: when the v1-legacy chamber cluster is finally migrated (the deferred to-do), those three entries are removed and the gate tightens automatically; a brand-new unblessed class anywhere → loud build error. Alternative (path-based: exempt content/chamber/** wholesale + infra) is coarser — it wouldn't catch a typo'd class inside the legacy tree (which is frozen anyway). Recommend the class-based set: precise everywhere, every blessing visible. Options (gate location):

site.hs build guard (recommended) — a preprocess census beside validateCompass/loadListingDefs: glob content/**/*.md, read each frontmatter class:, assert ∈ (class_enumeration from content-types.yml ∪ exempt-set), error listing any violator. Fails the actual make rebuild that ships the site. Consistent with W5.2/W5.1's home. Output-neutral → byte-identical.
content-types-check (Python) — extend generate-content-types.py --check with the corpus census. Cleaner to write, enumeration already derived there — but the pre-commit hook is generic (secrets/debug/large-files only) and does not run it, and ARC has no CI server, so it would gate nothing automatically. Weaker. Recommendation: Option 1 for G4 (the build is the real gate; a check nobody runs isn't enforcement). G1's wildcards→error: prepare now (byte-identical), land at W6 inside the promotion commit per the roadmap's precondition list (W5.1–5.3 ✓ before Stage G; G1 lands with it). G4 lands now (it is a Stage-G precondition, output-neutral). Verification: byte-identical _site gate (both are guards/never-triggered fallbacks — no rendered change); deliberate-mismatch test for G4 (inject a bogus class: on a scratch file → build errors with the file named; remove → green), mirroring the W5.2 idiom. Files affected: site.hs (new census guard in/near loadListingDefs; G1 = classRouteName/classDisplayName other -> arms → error, staged for W6); templates/default.html (read for the body-class emission; guarded transitively by the census — no edit unless steward wants an inline note); content-typology §5 cross-reference + clause-1/clause-4 promotion text ship with the Stage-G commit (W6). data/content-types.yml read (enumeration), not edited. Awaiting: Steward authorization — chiefly to ratify the exempt-set {sequence-index, not-found, lex, offering, deliberation} and confirm Option 1 (build guard). On the nod: build G4 now (byte-identical), prepare G1 for W6. Status (2026-06-09): STEWARD AUTHORIZED inline (exempt-set confirmed; Option 1). Steward refinement folded: sequence-index reframed as a permanent generated-view class, NOT legacy — after-the-reply is the only sequence today but more are coming; the exempt-set comments split into two kinds (permanent views/infra: sequence-index, not-found · v1-legacy ratchet: lex, offering, deliberation). G4 DONE (23db039, pushed both remotes): validateCorpusClasses build guard; _site byte-identical to ac39b26 (stash-rebuild diff); deliberate-mismatch fires naming the file; output-neutral → no deploy. G1 PREPARED (9699088 roadmap W5.4) — exact wildcard→error patch recorded, lands inside the Stage-G promotion commit (W6) per spec sequencing; byte-identical (never-triggered today). REVIEWED-38 drafted for steward placement. Wave 5 CLOSED (G2/G3/G4 built; G1 staged). Remaining to Stage G: W4.4 (jurist multilingual v1.0 sign-off) → Wave 6 promotion.

PENDING-37 — Reading measure → 66 characters (rem), fixing the px/rem root-size bug

Date: 2026-06-09 Tag: [HARDENING] (deep typographic audit follow-on; jurist disposition #1; steward-authorized inline as a starting point for render review) Summary: Set the reading measure to a precise 66 characters (Bringhurst ideal), expressed in rem so the character count holds constant across breakpoints, replacing the two divergent, over-wide px/rem-confused measures. Rationale: The audit measured (font-metric over 91,579 chars of real ARC prose) + render-confirmed (headless Chrome): EB Garamond prose averages 0.377–0.381 em/char, so the live columns run ~90 characters ($narrow-size: 720px) and ~101 characters ($body-column: 38rem at the 21px root) — both well past Bringhurst's 75–80 "too long" ceiling. Root cause: $body-column: 38rem was authored to "38rem ≈ 65 chars" at the 16px base, but the live :root scales to 21px (137.5/125/131.25% per breakpoint), silently inflating 38rem to 798px (~101 ch). $narrow-size is px (720) so its char-count drifts across breakpoints. Two tokens, two confusions, both off-spec — the spec itself says 38rem/"65 characters" (:165) but $narrow-size comments "68 characters" while rendering ~90. Change (provisional — for the steward's eye): $narrow-size: 720px → 24.9rem (_variables.scss:119) and $body-column: 38rem → 24.9rem (_sidenotes.scss:33); 24.9rem = 66 × 0.3771em (measured). Both become the same rem value (they are the same concept — "the reading measure"; a follow-on pass should unify them to one token). NOT a byte-identical change — the reading column intentionally narrows (720px → ~523px @ desktop, a ~27% narrowing; the marginalia-grid body narrows 38→24.9rem). Decisions deferred to the render review (steward's "we look, then decide"): (a) final character target within the Bringhurst band 66–75 (24.9–28.3rem); (b) the marginalia-grid proportions — narrowing the body to 24.9rem makes the fixed 14rem sidenote column proportionally much larger (14/24.9 = 56% vs 14/38 = 37%); the sidenote/marker columns may need adjusting, to be judged on the about pages + sidenote/register essays; (c) spec reconciliation (AldineXXI §I measure prose: 38rem/65-char → the chosen rem/66) lands after the visual decision; (d) deploy. No deploy in this step — local build + serve only. Files affected (this step): scss/AldineXXI/_variables.scss ($narrow-size), scss/AldineXXI/_sidenotes.scss ($body-column). Spec text + token unification deferred. Awaiting: Steward AUTHORIZED inline (66 ch, starting point). Render review of about pages + marginalia essays → then the deferred decisions above. Status (2026-06-09): LOCKED at 72 characters (27.2rem) — steward render-ruling across all content types (66 a touch narrow, 75 a touch wide; 72 "spot on," sidenote/marginalia proportion approved). Resize bug found + fixed (the .page-content mobile 100vw override defeated the rem measure <768px — "measure gets longer on resize"; removed). Proper-homes consolidation (steward-directed, W3R discipline): one token $narrow-size ($body-column aliases it), one governing rule (.page-content/_base, all viewports), zero measure rules left in _mobile-responsive (override removed + a dead .wrapper main block deleted). Spec §I Measure reconciled to the measured value + 65/68 inconsistency resolved; §XII grid + token-index updated. Verified: compiles · measure holds across a viewport sweep · no overflow. Committed 06effe4 (behaviour commit; gate = steward render-review, passed). DEPLOYED + LIVE 2026-06-09 (bundled with the soft-rag pass a9e5196): pushed both remotes, make rebuild shipped (CloudFlare 2 files = style.css + _redirects — pure CSS, no HTML change), live-verified on animalrationiscapax.org (max-width:27.2rem ×9, no 720px). REVIEWED-39 to be drafted. (Deferred token-unification: $body-column now aliases $narrow-size; full removal of the local name is optional tidy, not required.)

PENDING-38 — Soft rag: hyphenate reading prose (reverses §I.i hyphens:none)

Date: 2026-06-09 Tag: [HARDENING] (deep typographic audit follow-on; steward-approved inline on render; jurist endorsed hyphens: auto as the no-JS "rung (i)" in their audit reading) Summary: Reverse the §I.i posture from ragged-right, un-hyphenated (hyphens: none) to a soft rag — ragged-right with judicious auto-hyphenation of reading prose. Rationale: The prior hyphens: none was a tool-quality decision (web justification/hyphenation judged poor when ARC was built), not philosophical. The deep typographic audit + masters reopened it: Hochuli ranks the soft rag (ragged + narrow hyphenation zone) above the hard rag (the hard rag "looks uneven and unsettled"); Rutter — "hyphenate without justifying… reduces the raggedness"; the engine is the universal Liang/hyph-utf8 patterns, language-correct via the document <html lang>. With the measure now properly set (72 ch, PENDING-37 — the old ~90-char measure was itself a reason hyphenation seemed unneeded), the soft rag reads better than the hard rag. Stays ragged (does NOT justify — justification on large viewports remains open, needs the JS Knuth–Plass "educated engine," off the table until a logged gate amendment). Implementation (proper home — _base, the reading-body home, every viewport): .page-content p/li/blockquote { -webkit-hyphens:auto; hyphens:auto; hyphenate-limit-chars:6 3 3; -webkit-hyphenate-limit-before/-after:3; hyphenate-limit-lines:2; -webkit-hyphenate-limit-lines:2 }; body default → hyphens: manual. The -webkit-hyphens prefix was the bug that made Safari show nothing first (no autoprefixer in the build → prefixes hand-written; the limits were prefixed but the property wasn't). Cross-browser: hyphens:auto is Baseline (all engines); limits via standard (Chrome/Edge) + -webkit- (Safari); Firefox honours auto, ignores limits (sane defaults) — not Safari-tailored. Verification: steward render-review on desktop AND phone ("few, but perfect"); the phone "none" was iOS-Safari cache (fresh-origin test confirmed; no mobile override exists — rule is viewport-agnostic). Live-verified post-deploy. Files affected: scss/AldineXXI/_base.scss (the soft-rag rule + body hyphens: manual); scss/AldineXXI/_mobile-responsive.scss (stale per-phone hyphens comment corrected); docs/AldineXXI-Codex/AldineXXI-specification.md §I.i (posture reconciled). Awaiting: Steward APPROVED inline (deploy now). DONE + DEPLOYED + LIVE a9e5196. §I.i posture reversal rides the Stage-G read for formal jurist concurrence (substance already jurist-endorsed). REVIEWED-40 to be drafted.

PENDING-39 — §VII.f Running Head + W1.15 frontispiece compass presence-reveal (BUILT)

Date: 2026-06-11 Tag: [HARDENING] Summary: Built the one spec'd-but-unbuilt apparatus, §VII.f Running Head (the post-Stage-G session the spec reserved for it, W1.2), plus its coupled item W1.15 (frontispiece compass reveal) — both zero-JS, both local, awaiting deploy. Rationale: §VII.f was the lone element of the AldineXXI spec never shipped (verified against live code: no _running-head.scss, no template element, zero compiled output). W1.2 ruled it to build via CSS scroll-driven animations after the reconciliation/[FIX] waves — now closed/sealed. Running head: a view-timeline on .post-title, hoisted via timeline-scope, opacity across the exit range; per-type bound to content-types.yml apparatus.running_head (loadRunningHeadClasses/showRunningHeadField; yes auto, conditional/per per-piece). §III.b browser-floor answered as pure progressive enhancement (no scroll-driven support → display:none; no JS, no always-on chrome — steward ruling). Steward render-rulings refined: measure-width band on the body-column axis (matching the breadcrumb/sequence-marker; centred symmetric, −2rem grid-asymmetry shift for marginalia); a soft rule (measure-wide, fading ends, $rh-fade); a full-width occluding ground (vertical fade extending $rh-dissolve below the rule, so the reading dissolves as it approaches the rule across the whole width). W1.15 reframe (steward-ruled): the "appear only on scroll" premise was false — the frontispiece is single-viewport (min-height:100vh/space-between) and does not scroll. Surfaced, not papered over; steward reframed scroll-reveal → presence-reveal: zero-JS cursor-approach (graded sibling-combinator bands), touch rests gently-present (accepted zero-JS limit). §2044 reconciled. Refactor (byte-identical): marginalia grid tokens ($body-column/$gap-column/$sidenote-column/$register-marker-column/$marginalia-present) moved _sidenotes.scss → _variables.scss (two consumers now; grid output proven IDENTICAL pre/post). Verification: stack build clean; headless-Chrome measured the reveal (opacity 0→1 at title exit), the compass graded reveal (0.15→0.4/0.6/0.8, compass clickable), and band-axis alignment (band centre == breadcrumb centre 598@1280 / 798@1680). Invariant verified: running_head ∈ {yes,conditional,per} ⊆ title_display: shown. Files affected: scss/AldineXXI/_running-head.scss (new), scss/AldineXXI/_frontispiece.scss (compass approach-reveal), scss/AldineXXI/_variables.scss + _sidenotes.scss (token move), scss/main.scss (@use), templates/post.html + templates/frontispiece.html, site.hs (TypeFacts/ApparatusFacts, loadRunningHeadClasses, showRunningHeadField, postCtx threading). Specs reconciled: apparatus-specification.md §VII.f, AldineXXI-specification.md §2044 + selector index, content-typology-specification.md Sub-table-4 note. Awaiting: Steward authorized inline throughout (render-review-gated, every step). Remaining: deploy (running head + compass reveal together) on steward's go-ahead. → REVIEWED-43.

PENDING-40 — ARC operations protocol (`operations.yaml`) — a governed how-to-proceed router for the executor

Date: 2026-06-18 Tag: PROPOSAL Summary: Establish a single, drift-proof operations protocol Claude Code consults before any ARC change — a triage gate + protected-surfaces stop-list + routine-change procedures — so routine work proceeds safely and any change reaching into the refined ARC structure (the spec, the Stage-G site.hs bindings, the @layer cascade) is surfaced before it is built, not undone after. Rationale: Steward-initiated, with a live case study. On 2026-06-18 a routine-looking task ("drop the CV's redundant page title") was treated as content-grade and built out as a structural change to a Stage-G-clarified site.hs binding (the title-display gate) — coupling articleCtx, pulling about-page.html into the matrix gate, rewriting the G2 intent comment — before being surfaced. The steward caught it ("does this muddy the waters we finally clarified?") and ruled full revert. The weeks of Stage-G refinement (G1–G4 single-source bindings, W3R cascade, the sealed Codex) are exactly what an in-stride structural edit endangers. The same session surfaced a second symptom of the gap: the 06-17 cul-de-lampe commits missed the Stage-E content-types.yml regen (14 stale values), because no checkpoint enforced it. A protocol with (a) a front triage gate, (b) an explicit protected-surfaces stop-list → PENDING, and (c) codified routine procedures that name the easy-to-miss steps (the content-types regen, the SCSS partial trap, the shared-template all-consumers check) closes both. Modeled on the now-codified chamber-library conversion-runbook.yaml. Design commitments (so it does not itself become a liability):

Router, not rulebook. It states how to proceed + which spec § governs; it never restates a rule. The spec stays the single source for what. On any apparent conflict, the spec wins and the router is fixed. (Prevents it becoming a second, drifting source — the very failure mode ARC guards.)
Coupled-update (Stage-E generalized). When a change-type's governing spec § moves, its router entry updates in the same commit.
Non-decorative binding. Useless unless actually read at the moment of action: kept short by design; proposed to be wired as the mandatory first read via ARC CLAUDE.md (and surfaced at wake). Pairs with — does not replace — the ~/CLAUDE.md authorization taxonomy. Options:

docs/AldineXXI-Codex/operations.yaml (steward-chosen) — beside the spec it operationalizes, versioned with it. (Draft written, status DRAFT.)
ops/arc-operations.yaml at repo root — more visible as a top-level operational artifact.
Fold into ARC CLAUDE.md — simplest, but couples to the orientation doc and is harder to keep machine-checkable. Recommendation: Option 1 (steward-selected). Keep ARC-scoped for now (it serves the AldineXXI spec); it may become a template for L1/be later if it proves itself — do not generalize prematurely. Files affected: docs/AldineXXI-Codex/operations.yaml (new, DRAFT); on authorization, a one-line pointer added to ARC CLAUDE.md ("consult first") and a note at /wake-up for ARC sessions. Awaiting: REVIEWED-44 placement by the steward. Steward authorized verbally 2026-06-18 (away from machine; could not author the REVIEWED text). On that authorization: operations.yaml flipped to OPERATIVE; ARC CLAUDE.md pointer added; committed + pushed + deployed. REVIEWED-44 to be written by the steward to close the loop on paper.

PENDING-41 — [CORRECTED/LARGELY-WITHDRAWN] Consumer-hardware support is ALREADY designed (43L/43M); residual = verify on M1-Air-class + clasp

Date: 2026-06-23 (revised same day after reading the spec, per steward pointer) Tag: [HARDENING] (downgraded from PROPOSAL — the proposal was largely reinventing existing design) Self-correction (integrity): My original PENDING-41 proposed "make consumer hardware a first-class target with graceful generative degradation" as if novel. It is not — Seb already designed it. local-inference-spec Amendment 43L (Hardware-Graduated profiles: lightweight/standard/full/appliance) + 43M (Tiered Circle Inference, 'circle' provider tier §4.13): low-tier nodes run tiny local models (qwen3.5:0.8b/2b) and rely on circle inference for frontier work; a clasp serves big-model inference to members (CLASP_BASE_MODELS); FM-009 GPU-degraded circuit breaker already specced. Do NOT send the original proposal to Seb — naive + redundant. What today's saturation actually was (corrected): the live Air runs standalone — unpaired (no circle/clasp; isClasp=false), no teacher transport (Anthropic disabled; fleet kronos/atlas 502), attempting frontier generative locally on one GPU. The design's offload answer (frontier → circle/clasp/teacher) simply isn't active. Deployment/config state, not a design gap. Genuine residual (verify-first, do NOT assert to Seb yet):

Spec reference target = M4 Pro / 24GB+; steward's machine = M1 Air / 16GB, below it. Does standard/lightweight profile + tiered-circle-inference actually run well on M1-Air-class? Unverified.
FM-009 GPU-degraded guard did not prevent 64 timeouts on the entity:relationship slot path live — is the guard active on slot inference, or another path? (Or binary predates it.) Verify before raising.
Model-resolution oddity: boot resolved tier=standard → qwen2.5:3b (absent); actual calls hit qwen3.5:4b. Design-aligned move: the 64GB mini = appliance = a natural clasp. Pair the Air into a circle with the mini as clasp → Air runs light, mini serves frontier inference. Seb's architecture for exactly the steward's two-machine setup. Verify on a clone first, not the live Air. Awaiting: nothing to send Seb yet. Next step is VERIFICATION (does the existing tiered/clasp path work on M1-Air-class), not a proposal. Findings: docs/thinking/David/l1-reliability/l1-post-n6-deploy-findings-2026-06-23.md.

PENDING-42 — Chamber Library spec ratified (§§I–VI); open voice-layer work

Date: 2026-06-26 Tag: [PROPOSAL] (the open items); the ratification itself was authorized live and is recorded here for the paper loop Summary: The Chamber Library spec (chamber-library/docs/chamber-library-specification.md, born 2026-06-25) was carried through the full steward + jurist loop in conversation and ratified §§I–VI; the spec file is now edited to the ratified text. This entry records what was authorized and holds the remaining open work. Ratified (applied to the spec 2026-06-26):

§§II–III — source-agnostic canonical form + the work + chapter/section + verbatim quote citation contract, plus the jurist's sectionless reduction (a sectionless work cites by work + verbatim quote; a missing section field is correct, not a defect).
§V — the verbatim guarantee, three-tier normalization (Remove / catalogued-normalization / never-alter-words). Resolves the spec's prior internal contradiction: "verbatim" = faithful to the words under declared normalization, NOT byte-identity (§II already permits transforms). Executor refinement folded: minimize the catalogue — prefer preserving source characters; typographic normalization permitted only on concrete need, never prophylactically (tighten-the-verifier, Charter §VII).
§VI architecture — two sidecars: reading-index (derived, hash-bound) + voice manifest (authored, engine-side, no hash); voice: <name> stays in corpus as a routing tag; the sole corpus-spec invariant: the grounding gate verifies only against canonical text, never a manifest/index. Grounded in existing practice (4 reading-indices/*.yaml already embody the pattern).
§X — antechamber clause (sub-canonical form not guaranteed; consumers must flag distinctly). §VII gate logic found already conformant (no edit). Rationale: A corpus the engine cites from confidently must have a specified, consistent form, or the engine reasons over silently-varying ground (Charter §V boundedness=trust; the L1 maxim). The ratification unblocks the held graduation of the first three spec-conformant texts. Open work (awaiting future authorization — NOT done):

Voice-manifest schema — controlled vocab, authorship governance, engine consumption model. Engine-governance, not corpus-spec; lives with the studium-engine charter. Orchestration thinking captured at studium-engine/docs/the-sidecar-typology-and-orchestration-2026-06-26.md.
The 84-file voice migration — move voice_role/semantic_profile from canonical frontmatter to the manifest. A governed, dry-run-first bulk op; not a prerequisite to the principle.
voice_tradition/voice_period usage audit — decide per-field migration target (work's compositional context → §IV provenance; persona flavor → voice manifest). Owed before the migration.
§IX coverage/silence representation — still open. Recommendation: Build the two normalizers (OCR + EPUB → one canonical form) next, apply to Levi / Alexander Book 4 / La Chute, commit the first spec-conformant graduation. The open voice-layer items are deferred and do not gate graduation (the graduates need conform only to §§II–V + the citation contract, not the undesigned manifest schema). Files affected: chamber-library/docs/chamber-library-specification.md (ratified text applied); studium-engine/docs/the-sidecar-typology-and-orchestration-2026-06-26.md (new, exploration). Awaiting: Steward to write REVIEWED-45 to close the loop on paper (the authorization was given live in conversation; like REVIEWED-44 for operations.yaml, the paper record is owed).

PENDING-43 — [ESCALATE] Spec Loom & Mill "two-register genome" model would reshape our governance surfaces

Date: 2026-06-30 Tag: [ESCALATE] Summary: Seb's instance's Loom/Mill methodology proposes a two-layer split — an append-only provenance archive vs. a lean expressed genome sized to the human's mental-model budget. We already run an instance of this (MemPalace ↔ MEMORY.md). Adopting it as a governance model would reshape PENDING/REVIEWED/MEMORY.md and potentially CLAUDE.md — a constitutional surface, and now a four-party question (David, Claude Code, Seb, Seb's instance). Rationale: Two halves of one team independently re-derived one governance system (full map: CapableMind-AI/docs/thinking/David/methodology/spec-loom-mill-reconciliation_2026-06-30.md). The convergence is high-value, but the two-register adoption touches surfaces the executor may not alter unilaterally. Do not act; surface for steward + jurist + Seb. Adjacent (lighter, [PROPOSAL]-class): a shared vocabulary map between the two pods (their genome/ratchet/compass/diseases/palette ↔ our taxonomy/ladder/Symmetria-flags/register) — cheap, high-value, recommended early; co-author from the governance field guide. Files affected: none yet (mapped, not acted on). On authorization, would touch the governance surfaces above. Awaiting: Steward + jurist + Seb. Do not proceed.

PENDING-44 — Machine-readable graduation spec + validator (the enforced convention rail for the Chamber Library)

⟶ CLOSED 2026-07-05 — REVIEWED-44 placed by steward (formal close). Date: 2026-07-01 Tag: [HARDENING] Summary: Codify the Chamber Library graduation CONVENTIONS as machine-readable data (chamber-library/_curation/graduation-spec.yaml) consumed by every graduation, and enforce them with a validator (scripts/verify_graduation.py) that gates each candidate — conventions checked at the moment of action, not narrated in prose that drifts or gets bypassed. Rationale: Steward-initiated, with a live case study. Graduating Jonas + the two Mumford volumes, three parallel agents were given hand-written instructions (my error — I re-derived instead of citing conversion-runbook.yaml, and invented frontmatter fields tradition_path/source_sha256 that are not the convention; source_sha256 in fact belongs to the reading-index SIDECAR, spec §VI, not text frontmatter). The agents diverged (ALL-CAPS vs title-case headings, --no-heading-recovery yes/no, blank-comment handling) — and the divergences mapped exactly onto the runbook's GAPS. The steward's insight: "shouldn't there be a machine-readable version referred to whenever we do this work?" The spec+validator is that rail: conventions as data + an enforced gate. Proven — the validator caught every divergence on all three candidates automatically; they were then re-fixed against the spec and graduated clean (both gates PASS, verbatim intact, OCR corrections logged). Design commitments: operationalizes the chamber spec §§II–VI (which governs on conflict); scope-disciplined per PENDING-42 §VI (encode what we know; grow as protocols declare themselves); the runbook now POINTS to the spec (policy.graduation_conventions) rather than restating it. Files affected: chamber-library/_curation/graduation-spec.yaml (new, governed), scripts/verify_graduation.py (new), _curation/conversion-runbook.yaml (pointer added), and the 3 graduated texts + their _curation/conversions/*.conversion.yaml provenance records. Awaiting: REVIEWED-46 placement by the steward. Steward authorized verbally 2026-07-01 ("yes to pending/reviewed"); spec promoted drafts→governed and applied. REVIEWED text owed to close the loop on paper (as with REVIEWED-44/45).

PENDING-45 — Family-D (stem-suffix) footnote handler added to clean_epub_residue.py

⟶ CLOSED 2026-07-05 — REVIEWED-45 placed by steward (formal close). Date: 2026-07-02 Tag: [HARDENING] Summary: Extended the graduation-rail's footnote converter with a 4th anchor family (stem-suffix: ref [¹](#…_{stem}) ↔ def [N.](#…_{stem}a), keyed by the globally-unique stem), unblocking the recovery of per-chapter endnote apparatus in z-library/Kindle-derived EPUBs. First use: reconverting Sennett The Craftsman (recovered 294 endnotes the prior calibre conversion had silently unlinked). Rationale: Footnote apparatus is the Making-batch's binding constraint — the tool covered 3 of ≥5 anchor families in actual corpus use. clean_pandoc_html_residue's INTERNAL_LINK unwrap silently DESTROYS any footnote-link it doesn't recognize (word-guard excludes fn labels), so an uncovered family = silent linkage loss (the exact defect being repaired). Extends the PENDING-44 rail; conventions unchanged. Verified: Sennett 294↔294 paired, 0 orphans, both gates PASS, prose verbatim-preserved. Regression-tested Families B (Winnicott) + C (Virilio) — caught + fixed a real regression (C's r-prefixed def targets read as phantom D-refs; fixed in verify_pairing). Reviewed in _curation/tool-evolution-log.md. Out of scope: Crawford's filepos positional family (ref/def don't share a stem) — a different pairing model, still owed; documented in the tool docstring. Files affected: scripts/clean_epub_residue.py (Family D); canonical_texts/…/environmental/the-craftsman-sennett-richard.md (Sennett reconverted + spec-normalized headings); catalogue.yaml; _curation/tool-evolution-log.md. Awaiting: steward acknowledgement (a tool addition within the authorized "build the tool the batch needs" discipline; recorded for the paper loop alongside PENDING-44).

PENDING-46 — Spec gaps surfaced by the corpus-fidelity work + the generative-from-spec principle

⟶ CLOSED 2026-07-05 — REVIEWED-46 placed by steward (formal close). Date: 2026-07-03 Tag: [PROPOSAL] (gaps 1–6) + [ESCALATE] (gap 7, generative principle as governance) Summary: Two days of corpus-map + tool-fleet work surfaced 7 gaps between the chamber-library spec (§§I–XI) and lived experience; steward named the governing principle (Spec Loom / hic jacet): tools should be GENERATIVE from spec, marked once, mutable-after — not hand-carved beside it. The gaps (drafts for the jurist/steward loop; see _curation/tool-fleet-compliance-2026-07-03.md + this session):

§II.2 break-form unenforced; sectionless: true field is READ by the fixed verify_conversion but NOT defined in the spec (tool got ahead of the constitution). Define the field; gate the --- invariant; name • • •→--- normalization.
§V apparatus-integrity asserted but never gated (70 damaged files). Make ref↔def pairing / no-stranded-notes a gated invariant; the audit_corpus classifier is the instrument; belongs in the graduation gate.
§V Tier-2 conversion-record required but only the OCR path writes one; mandate it for every normalizing path + define the schema (the grounding gate needs the declared equivalences).
§VII [PARTIAL] → formalize: the declared gate-list (graduation-spec.yaml gates[]) IS the gate; fold in sectionless exception + apparatus check + body_word_conservation (declared, unimplemented).
§IX [OPEN] → closeable now: audit_corpus map + build_catalogue-as-health-ledger = the coverage-warrant.
The STANDARD (verified fidelity = floor not tier) + the FENCE (green set) live in memory, not the spec; distinguish converted/verified/fenced.
[ESCALATE] the generative principle as governance: tools are thin consumers of the machine-readable spec; declared convention-data + gate-list authoritative; a tool re-encoding a convention is drift. Reshapes how we build — jurist+steward to ratify. Prior-art dependency: 3 research scans running (TEI/scholarly encoding · fidelity tooling & spec→validator · bounded-corpora-for-AI) — TEI likely hands us a ratified apparatus/provenance/normalization vocabulary to adopt INTO the spec rather than invent. Synthesis owed before drafting the spec revision. Recommendation: mark-the-ground sequence — consolidate spec (close 1–6, rule 7) → build generative validator (spec→spec-lint, single gate) → THEN run cleaning waves. Waves-first would bake tool-shaped conventions into 300 files (the redo we're avoiding). Files affected (on authorization): docs/chamber-library-specification.md, _curation/graduation-spec.yaml (extend as the convention-data source), a new spec-lint validator. Awaiting: jurist doctrine pass + steward authorization; prior-art synthesis.

PENDING-46 addendum (2026-07-03) — prior-art synthesis complete

Three scans done → chamber-library/docs/spec-revision-prior-art-synthesis-2026-07-03.md (the jurist brief). KEY: ~70% of our spec re-derives TEI + CTS + Standard Ebooks (align, don't invent). The FUSION (verified-verbatim fidelity of a bounded curated corpus as a constitutional invariant of an epistemic-memory substrate) is close-to-novel (provisional). WATCH: Seck "Governed Reasoning for Institutional AI" arXiv 2604.10658 (independent convergence on our governance half; lacks our corpus-substrate moat) → landscape register. ALIGNMENTS: §III→CTS URN (edition-as-identity); §V apparatus→TEI ch.13 (anchor-to-location, verify resolution); conversion-record→W3C PROV; §VII→ODD one-artifact discipline; §IX→ledger-as-coverage-warrant. GENERATIVE PRINCIPLE realizable NOW proportionately (PROV + JSON-Schema + Pandoc Lua filters + ODD-as-model); TEI-XML/ODD fork HELD OPEN (name, don't resolve). ADOPT: dinglehopper, ftfy, JSON-Schema, Lua filters, SE [Editorial]-commit, Deterministic-Quoting (engine citation path). KEEP (no equivalent anywhere): prose-word-multiset guard, verbatim-span check, checksum integrity. TWO held-open architectural questions for the jurist: (a) in-band original (TEI ) vs replace-and-sidecar; (b) the markdown-vs-TEI-XML fork. SEQUENCE: jurist spec-revision → build generative core → THEN waves.

PENDING-46 — JURIST RULING RECEIVED 2026-07-03 (record: chamber-library/docs/spec-revision-RULING-2026-07-03.md)

Steward+jurist still discussing gap 7. Executor to act ONLY within ratifications below when steward authorizes execution (spec is constitutional; ruling ≠ steward's go-ahead to edit the spec doc).

THE UNIFYING INSIGHT (jurist's condition, load-bearing): gaps 2 (apparatus ref↔def anchors), 3 (PROV "original" as resolvable reference), and item-8 (§III CTS-URN citation) ALL reduce to ONE logical-passage addressing/pointer substrate — "don't build two addressing systems that can drift." DESIGN THE POINTER SUBSTRATE ONCE; three consumers. This is do-it-once made concrete.

READY TO EXECUTE on steward's word (RATIFIED-CONDITION):

Gap 1: define sectionless: true + NAME AN ATTESTOR FIELD (who set it / against what evidence the SOURCE lacks breaks) — positive attestation, never a default/absence state.
Gap 2: apparatus-integrity gated invariant; anchors on the shared addressing substrate.
Gap 3: PROV conversion-record, MANDATORY on every normalizing path; "original" = resolvable reference (survives question-a either way); + name the gate's TWO functions distinctly — content-grounding (canonical-text-only, §VI invariant intact) vs fidelity/process-integrity (reads the record). Extending the gate to read the record does NOT violate sidecar-exclusion.
Gap 4: spec-text "declared gate-list IS the gate" now; body_word_conservation impl tracked SEPARATELY (open eng).
Gap 5: §IX ledger-as-coverage-warrant + FRESHNESS INVARIANT built in from the start (regen inside the gate pipeline OR checksum tying entries to file state).
Item 8: §III its OWN section (CTS-URN, edition-as-identity); shares substrate with gap 2, distinct question (cites OUT vs internal ref↔def).
Question (a) PARTIAL-DECIDE: extend the grounding gate to READ+CHECK the conversion record NOW (closes the fidelity blind spot); in-band-vs-separate-file left open (now a low-stakes usage question).

NEW PENDING ITEMS the ruling created (NOT executor-actionable yet):

(i) Gap-6 promotion criterion — the mechanical converted→verified test. ESCALATED. No file may be promoted to "verified" until named+checkable. (Jurist: cite Seck's "governability" axis — knowing when NOT to treat a file as verified — directly when writing this.) Tiers (converted/verified/fenced) themselves RATIFIED.
(ii) body_word_conservation implementation (gap 4's unfinished half).
(iii) Gap-7 amendment-process corollary: ratifying "spec is the generative source" concentrates authority → WHO can amend chamber-library-specification.md and under what process must be decided IN THE SAME BREATH as gap 7. Returned to steward+jurist.

Question (b): HELD; trigger = revisit if/when (a) resolves toward full in-band dual-content at scale. Seck arXiv 2604.10658: jurist-confirmed real; add to landscape register. Adjacent cluster (Pierucci "Institutional AI" 2601.10599/2601.11369; "Governing Actions Not Agents" 2606.26298 — an "adjudication branch" ≈ steward/jurist/executor) → jurist wants a REAL SWEEP before gap-7 ratification. Executor launching that sweep now to feed the live gap-7 discussion.

PENDING-46 — gap-7 amendment-process sweep DONE 2026-07-03 (→ chamber-library/docs/gap7-amendment-process-JURIST-ADDENDUM-2026-07-03.md; copy on Desktop for handover)

FINDING 1: our model's ORGANS are precedented (2601.11369 Manifest/Oracle/Controller ≈ jurist/adjudication/executor+logchain; 2606.26298 executor-gate; Seck 2604.10658 tiers+ledger) BUT the closest analogue LEAVES AMENDMENT UNDEFINED — the exact trap the ruling steers around. Distinctive to us (0.7, no-counterexample): human-steward-load-bearing + non-implementing-jurist + fidelity-verified-corpus-substrate. Moat holds (0.75): none couple governed-reasoning to a verbatim-fidelity corpus. FINDING 2: the amendment process nearly writes itself from prior art we ALREADY run — (1) RFC immutable-supersession = logchain-on-the-spec; (2) BIP/PEP "normative-change-reverts-to-Review" = the crisp FIX→PROPOSAL trigger, roles map 1:1; (3) semver-as-consumer-contract = spec-change-is-API-change, MAJOR re-runs the verification ladder on every consumer. TEI Council = domain twin (decision-in-ticket ≈ PENDING/REVIEWED). Anthropic constitution = cautionary (no codified amendment procedure). Failure mode: single authoritative artifact + no amendment process → capture/ossify/fork; generative principle raises stakes on all three. A synthesized draft amendment process is in the addendum for the jurist to rule on. Executor holds — gap 7 + amendment process are steward+jurist's to co-ratify. TODO (executor, standing offer): add Seck 2604.10658 + this cluster (2601.10599/11369, 2606.26298) to the landscape register; commit Wave-0 changeset (still uncommitted).

PENDING-46 — gap-6 EVIDENCE-TIER DATA produced 2026-07-03 (jurist asked; → docs/gap6-evidence-tier-data-JURIST-2026-07-03.md; Desktop copy)

Joined corpus-quality-ledger ⋈ source-matches.json. EVIDENCE TIERS (verify-against-what): V-DSL(Loeb)=952 [930 pass floor], V-TEXT(born-digital source)=239 [6 pass], V-SCAN(pdf)=50 [0], V-SUSPECT=29, V-NONE=14. HEADLINE: 1191/1284 (93%) DETERMINISTICALLY verifiable (V-DSL+V-TEXT) — source IS ground truth, our prose-word-guard IS the promotion test; only 50 (V-SCAN) need the hard OCR-vs-scan path. 936 already pass floor; 255 more verifiable after the waves clear their floors. Proposed criterion tiers: verified-deterministic (word-identical re-convert vs source) / verified-scan (OCR-vs-image) / fenced-out (V-SUSPECT confirm-match + V-NONE acquire-source = Seck governability). CAVEATS: (1) add evidence-tier as a STANDING ledger column (couple gap-6 to gap-5); (2) source-match ~1% author-agreement FP → V-SUSPECT is a real gate; (3) deterministic tier COUPLED to item-8 edition-as-identity (wrong-edition match fails word-guard). The "no ground-truth at scale" worry that escalated gap-6 shrinks to 50 files.

PENDING-46 — GAP-6/7 CONSOLIDATED RULING LANDED 2026-07-03 (record: chamber-library/docs/spec-revision-RULING-2026-07-03.md is the ORIGINAL; consolidated ruling supersedes gap6/gap7 per RFC-style; steward relayed)

RATIFIED: gap-6 promotion criterion (3 tiers; tier-1 amended to require source-identity author+edition via item-8, then word-identical re-convert); gap-7 generative meta-principle (no tool may encode a convention independently of the declared spec); amendment process (RFC supersession + change-class + semver + PENDING/REVIEWED + no-new-organ). CONDITIONS: (6) keep V-SUSPECT & V-NONE DISTINCT ledger values; (7a) editorial/normative test must directly ask "does this change what any current gate accepts/rejects" (not the FIX label / declared-field-touch); (7b) deprecate-before-remove extends to PROMOTED FILES — migration-window policy for files verified/fenced under a prior criterion (the ~1% author-agreement FP ~dozen files is the real population). This consolidated ruling is itself the FIRST instance of the amendment process (supersession). JURIST DIRECT Q — ANSWERED: Loeb IS edition-unambiguous by construction (single loeb.dsl, 1 entry/work, Loeb Classical Library = the fixed edition; no which-edition question) → the 930 floor-passing V-DSL do NOT need item-8 for verification; only the 239 V-TEXT (matched via source-matches = real edition risk) do. Item-8 gates V-TEXT, not V-DSL. ⚠ NEW FINDING (surfaced, qualifies "930 ready now"): ALL 952 Loeb retain §II-forbidden '— p. N —' page-markers as h6 headings; 930 "pass" the floor but verify_conversion BLIND-SPOTS them (markers are markdown headings, not cruft signatures) → they are NOT §II-clean. This is (a) a §VII/gap-4 GATE GAP (the gate doesn't enforce §II 'no page markers'), and (b) a DOCTRINE question for the jurist: strip the Loeb page-markers (§III off-canon) OR grant a Loeb page-reference exemption (classical texts cite by canonical reference). So "930 ready now" → "930 pending a Loeb page-marker disposition." Contamination-directive: the gate's "930 clean" self-assessment is not fully honest re §II; named now. CITATION-INTEGRITY LESSON (jurist §3 caught): addendum cited arXiv 2605.24229 for Anthropic "no codified amendment procedure" — that paper is an empirical compliance audit, doesn't support the claim. Let a sub-agent's blanket "4/4 verified" ride without per-claim check. DISCIPLINE: verify each citation against the specific claim it carries; never let aggregate "verified" substitute. → feedback memory candidate.

PENDING-46 — THREE-QUESTIONS RULING + executor factual check 2026-07-03

QUESTION A RESOLVED → STRIP branch. Factual check (verified): '— p. N —' = Loeb PRINT-RUN page numbers (plain sequential integers) = edition-specific → strip per §II. Stephanus/Bekker margin NUMBERS are ABSENT from the DSL extraction (read Plato Charmides body — the canonical Stephanus case — none present; the "309 Stephanus-shaped" signal = apparatus-citation noise "Eclogae 4.24b"/"Athenaeus 6.224c", NOT margin refs). Stephanus subsection LETTERS may survive mangled inline (stray "B" fused to Greek word) — separate cleanup obs. CONSEQUENCES: (1) Loeb tier (74% of corpus) currently lacks a standard citation anchor → cite by intrinsic structure OR work+verbatim-quote (§III sectionless reduction, already sanctioned) = ACCEPTABLE; sourcing Stephanus/Bekker = separate FUTURE enrichment, not this strip, noted in §III/item-8. (2) Loeb-tier STRIP PASS (952 files) needed before the 930 are §II-clean/promotable — mechanical wave, still deterministic (re-extract DSL + strip + word-guard). (3) Gate rule keys on a PER-GENRE recognized-locator REGISTRY (Stephanus/Plato, Bekker/Aristotle…), NOT the word "Loeb"; registry empty for Loeb now → all print-pages flagged→stripped. QUESTION B RATIFIED: tier-2 = REDUNDANT independent verification (≥2 human passes vs scan image + 3rd adjudicating; dinglehopper = inter-pass diff; OCR-confidence = triage only, NOT the test). Numeric bar DEFERRED to a 3-5 file calibration batch. (Executor owned the CER/WER-vs-image conceptual error — no ground truth for V-SCAN by definition.) QUESTION C RATIFIED: re-verify-pending = own ledger status; verified_under: per row; N=2 release cycles PROVISIONAL (set vs real cadence, keep short — protects future willingness to tighten); + logged FIX-class extension path (operational delay ≠ epistemic failure). ALL THREE now fold into the v2.0 draft: A→§II strip rule via per-genre locator registry + §III/item-8 Loeb-anchor-absent note + Loeb strip wave; B→gap-6 §2 tier-2 mechanism (bar [OPEN-calibration]); C→amendment §7b migration policy.

PENDING-46 — LOEB SUBSTRATE REFRAME 2026-07-03 (steward sent me to the DSL source — decisive)

FINDING (verified against loeb.dsl source): the canonical citation anchors are IN THE SOURCE, FLATTENED by extraction — NOT absent. Plato Stephanus = [c dimgray]St. II p. 153[/c] + subsection letters B/C/D/E (the "stray B" earlier); Homer = book-letters [b]A[/b] + line-numbers [c dimgray]5/10/15; Loeb pages = [c dimgray]Page number N (246,622 marks). The [c dimgray] class is OVERLOADED (≥5 semantic uses); extract_loeb_dsl.py's KNOWN_TAG.sub("") strips the wrapper → collapses all into undifferentiated inline text. Stephanus SURVIVED into the extract as bare "St. II p. 153" (my grep searched the wrong form "153a" — 3RD census-through-a-pattern miss this session). REFRAME: Loeb path is NOT "strip page-markers" and NOT "external enrichment/acquisition" — it's RE-EXTRACT preserving the [c dimgray] semantic layer, disambiguated BY CONTENT SHAPE (per-genre locator registry = the disambiguation map): Page-number→off-canon(§III); St./Bekker/line→citation anchor(item-8/CTS); work-title→drop; [sup]→apparatus. My "74% cite-by-work+quote" was WRONG; Loeb can be properly cited by canonical anchors → feeds item-8 CTS directly (Plato-by-Stephanus is textbook CTS). The jurist's "structured-but-unanchored→work-level fallback" shrinks to a small residual; "external acquisition" enrichment case near-EMPTY. META-LESSON (3× this session, steward-corrected 2×): for a fidelity corpus, verify structure/anchor claims against the AUTHORITATIVE SOURCE, never the derived artifact or a regex over it. → feedback memory + Symmetria §3 flag candidate: derived-artifact-or-regex-over-substrate. DECISION (steward delegated "whatever you think best"): this changed a FACTUAL PREMISE the jurist's §III ruling rested on → must go back to jurist to re-rule, but on VERIFIED DATA not my prose (3× wrong). So: launched a careful per-genre DSL anchor audit (fresh agent, anti-pattern-drift discipline, verify-against-real-cards, quantify the genuine residual) → I verify its load-bearing claims against the source → relay reframe+audit to jurist for §III re-ruling → THEN build the re-extraction on the ratified disambiguation map. Audit running (agent ae7ad9b).

PENDING-46 — LOEB FULL-RUN SCOPE (steward recall 2026-07-03)

The current Loeb corpus (~952 work-files) is TIER 1 ONLY of the 3-tier plan chamber-library/_curation/loeb-canon-proposal-2026-06-15.md (steward's frame: "begin highest-signal now, comprehensive next, all of it once dilution is solved"). Tier 1 = 86 authors/356 vols/81,912 cards (67%); Tier 2 = 151 authors/92%; TIER 3 = ALL 377 authors/523 vols/121,447 cards ("waits on dilution"). STEWARD CALL (do-it-once): since we're rebuilding extract_loeb_dsl.py anyway to preserve the citation structure, run the FULL DSL (all 377 authors) in ONE pass — not Tier-1-then-redo. DILUTION RESOLVED BY THE FENCE: Tier 3's "waits on dilution" condition is now MET by gap-6's fence — extract everything citation-rich, fence the ENGINE to the verified/green set. Corpus-completeness ≠ engine-scope (same don't-conflate-axes discipline). Full extraction and dilution no longer in tension. ⇒ Re-extraction scope = FULL DSL (377 authors), not just the 952. The running per-genre anchor audit (agent ae7ad9b) is already whole-DSL-scoped → its disambiguation map serves the full run. One rebuilt extractor, run once, recovers clean bilingual text + Stephanus/Bekker/book+line anchors → feeds §II, §III/item-8, gap-6 together.

PENDING-46 — LOEB ANCHOR AUDIT COMPLETE + VERIFIED 2026-07-03 (→ chamber-library/docs/loeb-anchor-audit-and-disambiguation-map-2026-07-03.md)

Per-genre DSL audit done (agent, 22min, whole-DSL); executor RE-VERIFIED the two load-bearing claims against source. Scale: full DSL = ~2,041 works / ~124,627 cards (current 952 = Tier 1). Anchors richly present per-genre (Plato Stephanus / Aristotle Bekker-sparse+chapter+section / Homer book+line / tragedy line+strophe / orators section+col / historians book.ch.sect / Presocratics Laks-Most D/R/P PLAIN-TEXT / fragments number) — all verified against real cards + my own Plato/Homer/Aristotle/Presocratic spot-checks. RESIDUAL (the number §III re-ruling turns on): 37 machine-upper-bound → true substantive-anchorless floor SINGLE DIGITS, and those are fragment/testimonium/pattern-poem/concordance artifacts where work-level IS correct granularity. ⇒ >99% of works carry a recoverable anchor. RECOVERY-CRITICAL VERIFIED: the dropped % index lines carry Book/Letter/Fragment divisions — 35,261 such lines, thrown away by the current extractor. Disambiguation routing map captured (the design input for the rebuilt extractor). WHAT IT MEANS FOR §III RE-RULING (SIMPLER than feared): the jurist's "structured-but-unanchored→work-level fallback" normative extension is NEARLY MOOT — population is single-digit genuine fragments (original sectionless reduction covers them, not a new triggering condition). "External enrichment/acquisition" case is EMPTY. §III cites the Loeb by RECOVERED canonical anchors (CTS edition-as-identity: Plato-by-Stephanus etc.). Re-extraction recovers clean text + anchor layer + work-divisions in one pass over the full 2,041-work DSL. NEXT: relay verified audit + this simplification to the jurist for the §III re-ruling; then rebuild extract_loeb_dsl.py to the disambiguation map + run full DSL.

PENDING-46 — §III CITATION POSTURE RULING (jurist, 2026-07-03) — DOCTRINE PHASE COMPLETE

DISPOSITION:

structured-but-unanchored extension: VOID as ratified-for-74% (premise gone, not smaller — a principle that now governs NOTHING shouldn't stand as active doctrine = "gone decorative"). Retained ONLY as an explicitly DORMANT, named contingency (future-acquired work with real internal structure + no recognized anchor convention), LABELED in the spec as inapplicable to any work currently in the corpus. Not deleted (keep the reasoning), not left active.
"future enrichment" trigger requirement: RETIRED — no external-acquisition case remains (everything, incl. the 35,261 index-line divisions, is IN the DSL → re-extraction not acquisition).
§III citation posture: RATIFIED — cite the Loeb by its RECOVERED canonical anchor, resolved by edition-as-identity; work-level fallback ONLY for the genuine-fragment residual. Doctrine now; recovery = downstream engineering, validator-gated, feeding gap-6.
Per-genre mapping/disambiguation table: NOT RATIFIED — re-extraction ENGINEERING to review once built (jurist hasn't seen the audit, only the summary; the ambiguous string-match calls resolve during extraction). The architecture above the table is sound regardless. → §III's per-genre registry is a LIVING data layer (grows/reviewed during extraction), NOT ratified doctrine — matches the doctrine-stable/data-living split I described to the steward.
STANDING PROCESS NOTE (jurist, not corpus-specific): ANY corpus-population claim feeding spec doctrine must be SOURCED FROM THE DSL/SOURCE DIRECTLY, or explicitly flagged extract-derived+provisional, BEFORE it does normative work. Same discipline gap-2/gap-3 enforce on the corpus, applied to how the corpus is AUDITED. → adopt as standing practice: verification-ladder entry + Symmetria §3 flag + feedback memory (converges with my own 3×-this-session verify-against-substrate lesson). Capture at wrap. ⇒ §III was the LAST gating ruling. DOCTRINE PHASE COMPLETE — all gaps 1-8, generative principle, amendment process, three questions, §III posture ratified. Phase ② (draft spec v2.0 superseding version + generative validator) is UNBLOCKED. Remaining OPEN-marked (non-blocking): per-genre table (engineering), tier-2 numeric bar (calibration), the two held forks (in-band/sidecar; markdown/TEI-XML).

PENDING-47 — Corpus stress-test pre-registration (thresholds gate before execution)

⟶ CLOSED 2026-07-05 — REVIEWED-47 placed by steward (formal close). Date: 2026-07-04 Tag: [PROPOSAL] (the stress-test protocol + its ruling-thresholds; jurist gate before any run) Summary: v2.0 is ratified doctrine; the corpus stress-test brings the ~2,041-work corpus to spec. First artifact = a PRE-REGISTRATION doc fixing ruling-thresholds BEFORE any test data is seen (the jurist's strongest safeguard, easiest to skip). Drafted: docs/corpus-stress-test-pre-registration-2026-07-04.md; jurist cover note docs/corpus-stress-test-pre-registration-FOR-JURIST-2026-07-04.md. Load-bearing finding (verified against scripts/match_sources.py, not the summary): the cited "~1% source-match false-positive" is NOT an independent measurement — it is an eyeball over the matcher's OWN author_disagrees() warning, which fires only when the canonical surname is ABSENT from the source, and is therefore blind by construction to the two dominant FP classes (same-author-wrong-work: Bachelard Reverie→Espace; whole-for-part: whole Recherche→Vol III), both sitting UNFLAGGED in the 321 confirmed. Same structural error as the overturned "74% anchorless" premise. ≥2 genuine wrong-work FPs already found unflagged (disclosed prior, not threshold-setting). Three seams, dependency order: (1) source-matching reliability FIRST (independent = 2nd content-fingerprint matcher flags disagreements → human ground-truth rules; N=40 of 321 non-Loeb confirmed, fixed seed; Loeb/V-DSL excluded — DSL IS the source); (2) order-sensitivity — inject-known-bad on the multiset word-guard (verify_conversion prose_delta is order-blind by construction; order-sensitive/anchor-bound layers ruled-but-unimplemented); (3) disambiguation-map edges — go-looking for Virgil prv + bare-integer (line vs section). Steward decisions (2026-07-04): thresholds CONFIRMED subject to jurist gate before execution; instrument = BOTH (executor builds 2nd matcher to flag disagreements, human rules the flags). Nothing runs until the jurist gates. Open jurist question (Q1, surfaced not resolved): the pre-registration grades Seam 1 by RATE (≤1%→FIX / 1–5%→PROPOSAL / >5%→ESCALATE), but the change-class criterion ("does this change what a gate accepts?") makes the author_disagrees structural blindness a PROPOSAL independent of rate — the rate sizes the FIX work, the blindness is the gate-change. Split the grading onto two axes (structural-blindness→PROPOSAL; magnitude→sizes-FIX/forces-ESCALATE-above-threshold), or keep the rate-coupled table? Executor leans split; did NOT revise the just-confirmed doc unilaterally. Correction folded in: an earlier recon claim that graduate_to_canonical.py was unwired from verify_conversion was STALE — Wave 0 (f9cbb8e) wired both gates (lines 36-37, verified). Records-drift-both-directions. Files affected (on gate): the two pre-registration docs; on execution, a new content-fingerprint matcher (Instrument B) + run logs; Seam findings graded per the gated table. Awaiting: jurist gate on the pre-registration thresholds (esp. Q1) via steward relay, THEN executor builds Instrument B + runs Seam 1 small-batch.

PENDING-47 — JURIST GATE RECEIVED 2026-07-04 (GATE-WITH-METHOD-CHANGE; steward relayed) → pre-registration REVISED + LOCKED

Jurist confirmed the structural-blindness finding (arithmetic + logic independently checked) and gated with four required method changes, ALL now applied to docs/corpus-stress-test-pre-registration-2026-07-04.md (v1 LOCKED; revision record §6):

Q1 split — YES. Seam 1 graded on two axes; the confirmed blind spot (≥2 real instances) is PROPOSAL-class decided now, independent of the sample. Reworded around confirmed not possible blindness (jurist's precision: a merely-conceivable blind spot is not auto-PROPOSAL, else any incomplete heuristic qualifies).
Q2 statistics — the point-estimate grading was unsound. At N=40 a truly-5% corpus reads as 0–1 errors ~40% of the time (verified P(0or1|.05,40)=0.399). FIX: grade on the one-sided 90% Clopper-Pearson UPPER BOUND U, with an underpowered-sample top-up rule (0/40→U=5.59%, straddles 5%→top-up expected; n≈45 clears at 0 errors). 5% substantive line kept.
Q3 — Loeb exclusion sound but the risk was being read as "none" not "different." Added SEAM 1-BIS: V-DSL work-mis-attribution (card attached to wrong work) — covered by neither Seam 1 (external/non-Loeb) nor Seam 3 (anchor-TYPE not work-IDENTITY). Disjoint population, non-blocking, thresholds pre-set (same CP statistic).
Q4 — Seams 2 & 3 already structural, no split needed. Two smaller additions applied: Seam 2 tests ≥2 scramble patterns (within-sentence + multi-line, gate-on-class); Seam 3 guarantees ≥1 card per signal type (not a count of 20). DECIDED-PROPOSAL awaiting steward BUILD-authorization (Axis A): add a same-author-wrong-work + whole-for-part check-class to the source-match gate (content-fingerprint the natural mechanism). Jurist ruled the need settled today; the sample sizes it; steward authorizes the build. Status: pre-registration LOCKED, jurist-cleared "ready to run." NEXT (executor): build Instrument B (content-fingerprint matcher) + the CP grader, run Seam 1 (N=40) + Seam 1-bis in parallel, first-pass eyeball the flagged hard cases, surface genuinely-ambiguous ones + the graded verdict to steward. Production gate-change (Axis-A PROPOSAL) held for steward build-authorization.

PENDING-47 — SEAM 1 RUN COMPLETE 2026-07-04 → [ESCALATE] the ~1% does NOT hold (verdict: `_curation/stress-seam1-verdict-2026-07-04.md`)

Instrument B built + validated + hardened 3× (scripts/stress_source_match_verify.py), run on N=40 random (seed 20260704) of 321 non-Loeb confirmed; each flag human-ruled (Instrument A). RESULT: k=2 confirmed source-match FALSE-POSITIVES — (1) montaigne = Stefan Zweig's Montaigne biography canonical ← Montaigne's own Essais source (suspect=True: author_disagrees FIRED but the match survived into confirmed — the warning is not a gate); (2) semaison-la-philippe-jaccottet = Jaccottet La Semaison vol1 (real 59,508-word canonical) ← La Seconde Semaison vol2 source (suspect=False: author_disagrees BLIND — same author; the random-sample instance of the structural class the gate ruled a PROPOSAL). GRADE (locked rule): p̂=5.0%, U₉₀(Clopper-Pearson)=12.8% > 5% → ESCALATE. Robust: k=1 → U=9.4%, still ESCALATE; only k=0 would top-up, and k≠0. Literal question ANSWERED: the cited ~1% is refuted (5× the point estimate; same shape as the overturned "74% anchorless"). Per taxonomy ESCALATE = surface + do not proceed: Seams 2–3 HELD per the pre-registration stop condition (would test order/anchors against wrong sources). SECOND FINDING [NEW, unbudgeted — corpus integrity]: stub canonicals. 2/40 (leopold-sand-county-almanac 5 words; naess-deep-ecology 20 words) are placeholder "canonical" files, not graduated verbatim texts → ~15+ implied in the 321, likely more corpus-wide. Orthogonal to source-matching; the graduation gate admitted (or predates admitting) body-less files → its own census + a gate question. AWAITING STEWARD/JURIST: (a) the ESCALATE ruling on source-matching (re-rule before downstream, or a bounded disposition); (b) build-authorization for the Axis-A gate check-class (Instrument B is the prototype); (c) whether to open a stub-canonical census now or hold. Executor HOLDS — does not proceed to Seams 2-3 or the full corpus.

PENDING-47 — FULL-321 MAGNITUDE + STUB CENSUS 2026-07-04 (steward: recommend the ESCALATE move + quick stub census). Jurist relay: `docs/stress-seam1-ESCALATE-FOR-JURIST-2026-07-04.md`

Steward decisions: ESCALATE-move = "which do you recommend" → executor recommended relay-to-jurist-with-magnitude (run the CHEAP automated full-321 B-pass to give the jurist real magnitude; DEFER the expensive full hand-adjudication until after the ruling, which may reframe what counts). Gate check-class = HOLD until ESCALATE ruled. Stub census = quick census now. STUB CENSUS (whole non-Loeb corpus, 335 files): only 4 stub canonicals (<200-word bodies): leopold(5w) · naess(20w) · latour-never-modern(22w) · yunkaporta-sand-talk(73w) — all in contemporary_voices (one import batch, bodies never graduated). BOUNDED + localized — my 2/40→~15 extrapolation was TOO HIGH; the census corrected it (why steward said census-don't-guess). Loeb excluded (952). FULL-321 automated B-pass (unruled): 251 agree · 35 FLAG · 34 no-source(azw3/mobi+garbled) · 1 thin. Triage of the 35 (PROVISIONAL — only N=40's 8 rigorously ruled): ~10 confident genuine FPs [4 cross-author susp=True: montaigne/the-odyssey(←Clarke 2001)/meditations(←Bourdieu)/nietzsche; 6 same-author-wrong-work susp=False = author_disagrees-BLIND: semaison/reverie/lhomme-T1/orthotypo-vol2/berger-essays/suzuki-intro] + ~4 SCOPE sub-class (whole←part: Proust←VolIII, Quixote←Part1; work←collection: el-aleph, fictions) + 2 stubs + ~18 same-work-noise. Provisional magnitude ~3–4.5% FP — refutes ~1% at full scale, consistent with N=40. TWO STRUCTURAL FINDINGS for the jurist: (1) author_disagrees BLIND to same-author-wrong-work (~6 instances, not 1) → Axis-A PROPOSAL firmly evidenced; (2) PROCESS GAP — the 4 cross-author FPs are susp=True (warning FIRED but they stayed CONFIRMED; the warning is not a gate). Concrete: tool-log says meditations re-linked to Hays 07-02 but source-matches.json still shows Bourdieu → stale-json-or-lost-fix, verify. Plus a NEW SCOPE-DOCTRINE question (whole↔part / work↔collection), analogous to the un-run Seam 1-bis V-DSL work-identity risk. Jurist asked to rule: the ESCALATE disposition (bounded FIX-list ~10-14 + gate-hardening vs stronger); a scope doctrine; then confirm to fully adjudicate the 35 → final FIX-list. Executor HOLDS.

PENDING-47 — JURIST ESCALATE RULING RECEIVED 2026-07-04 (steward relayed; `docs/` copy owed). Differentiated remediation, NOT a-or-b.

Jurist INDEPENDENTLY recomputed the CP bounds (5.0%/12.8%; k=1→2.5%/9.4%) — ESCALATE holds, confirmed. Standing practice ruled: the CI-not-point-estimate grading + the drop-one-case robustness check are now STANDARD for every ESCALATE (→ verification ladder). Dispositions:

Detection blindness (Axis-A): confirmed (6 instances now); nothing new — PROPOSAL already decided at Q1, proceeds to steward build-auth. Correct that executor HELD the build (more evidence ≠ license to act ahead of authorization).
PROCESS-INTEGRITY finding ELEVATED — "the most important thing in the whole report." The 4 cross-author FPs fired suspect=True yet stayed CONFIRMED (the review step didn't run or didn't work), AND the tool-log claims a meditations→Hays fix that source-matches.json contradicts. Jurist: this is not one stale record — it's whether ANY recorded fix in the system actually took effect. Needs its OWN priority investigation BEFORE any remediation is trusted — NOT folded into gate-hardening. "Find out why the Bourdieu fix didn't stick before trusting that the next ten will." Re-pointing the FIX-list under a broken persistence mechanism reproduces the same silent non-persistence.
SCOPE DOCTRINE RULED (asymmetric — don't grade the two together):
- canonical=whole, source=one PART (Proust←VolIII, Quixote←Part1): genuine UNDER-COVERAGE → a §IV edition-identity failure once edition-identity is read to include SCOPE (not just translation/printing). Uncovered remainder = unverifiable-by-this-source, NOT silently fully-served; keep as a bounded partial match only if the covered region is worth it.
- canonical=one work, source=SUPERSET collection (El Aleph←collection): different + smaller — an extraction-precision question (did slicing bound to the right text?); if extraction isolates correctly it's a complete verifiable match. Don't grade on the subset axis.
- UNIFY with Seam 1-bis: ONE scope-identity principle (does the source's actual extent match what the canonical claims to represent), two applications (external match / DSL card). Not two doctrines that could drift.
Remediation order: process-integrity investigation FIRST → apply scope doctrine in the deferred full-35 adjudication (now unblocked, doctrine in hand) → FIX-list proceeds only AFTER persistence + scope resolved. Axis-A gate-hardening → steward build-auth (parallel).
Seams 2 & 3 unblocked PRECISELY (not a blanket freeze): Seam 2 may proceed once its OWN 3 test files are individually confirmed (order-sensitivity doesn't depend on the other 318). Seam 3 was NEVER blocked by non-Loeb matching — its condition is Seam 1-bis (DSL work-identity) for its own ≥20 sample cards. Full-corpus source-matching STAYS BLOCKED until persistence resolved + scope applied to the 35 + fingerprint gate-hardening steward-authorized. EXECUTOR NEXT (jurist-directed): (1) [priority, jurist-elevated] process-integrity investigation — why did the Bourdieu fix not persist; is there a systemic fix-persistence bug. (2) scope doctrine now in hand → the full-35 adjudication is unblocked (apply the asymmetric rule). (3) Seam 2's 3 test files individually confirmable. (4) Axis-A build still awaits steward auth. Parallel deep-compute (steward-authorized): the work-identity & scope study (now also grounds the unified scope-identity principle the jurist ruled).

PENDING-47 — PROCESS-INTEGRITY INVESTIGATION DIAGNOSED + WORK-IDENTITY STUDY DELIVERED 2026-07-04

(1) Persistence investigation (jurist's elevated priority) — DIAGNOSED. Doc: docs/source-match-persistence-investigation-2026-07-04.md. Answer is WORSE than the two-way discrepancy: no source-match fix can persist, because there is no persistence mechanism. Verified against code: (a) NO override/exclude/pin layer exists anywhere (grep clean); (b) source-matches.json is pure algorithmic regeneration — match_sources.py re-derives every match from classify(), reads chamber-source-link.md ONLY for the "Needs locate" block, never as authority → any hand-fix is overwritten next run; (c) the canonical file carries NO authoritative source: field (only source_format); (d) meditations is a THREE-way divergence (tool-log=Hays / chamber-source-link.md=Stoic-Six-Pack / json=Bourdieu), no single source of truth. Implication (jurist was right to gate on this): re-pointing the FIX-list under this mechanism silently reverts. Remediation [PROPOSAL], steward-auth required, MUST precede the FIX-list: authoritative source: (path+sha256) on canonical frontmatter, consumed by the matcher as a PIN (Option A, recommended — the file-is-source-of-truth principle the catalogue already follows). NOT affected: catalogue (hash-pinned from disk), verbatim/graduation gates. (2) Work-identity & scope study (steward deep-compute choice) — DELIVERED. Doc: docs/work-identity-and-scope-study-2026-07-04.md [PROPOSAL, design study — builds nothing, commits no schema]. Synthesized from 3 parallel prior-art sweeps (FRBR/LRM · CTS/DTS · BIBFRAME/TEI/dedup-practice) — all THREE traditions CONVERGE and INDEPENDENTLY CONFIRM the jurist's first-principles scope ruling. Key spine: CTS's work-identity is asserted-not-demonstrated = exactly what the Chamber's verbatim thesis distrusts → demonstrate identity by CONTENT, not title. Design: (i) declared work_id key (Standard-Ebooks-style); (ii) three orthogonal per-text assertions (identity / scope-relation is_part_of|contained_in + extent / expression-designation); (iii) match-gate = 3 veto-bearing gates (identifier-veto / scope-extent / content-fingerprint = Instrument B, already prototyped) — "disagreement is a veto not a low score" (OpenLibrary shape); (iv) the persistence pin (§3.4 = the remediation above). The jurist's asymmetry operationalized by FRBR's "who created the grouping?" diagnostic (author→whole/part=under-coverage; compiler→aggregate=extraction-precision) — the exact two cases. Unified scope-identity principle = Gate 2 applied to Seam-1 + Seam-1-bis. This study SPECIFIES the Axis-A gate check-class + the persistence remediation + operationalizes the scope doctrine — the do-it-once work-identity foundation the corpus never had. Still awaiting steward: build-auth for (a) the persistence pin [precedes FIX-list], (b) the Axis-A gate redesign [Gates 2+3]. Both now fully specified by the study. Executor HOLDS.

PENDING-47 — JURIST RULING on persistence + work-identity study 2026-07-04 (steward relayed; `docs/` copy owed). PHASED authorization.

Persistence diagnosis CONFIRMED (worse — absent not broken; the meditations 3-way = same "trust the visible artifact without checking authority" shape as 74%/Loeb, now at the correction-mechanism level). Work-identity corroboration checked DIRECTLY + ruled GENUINE (the FRBR "who created the grouping" diagnostic is PRIOR to the jurist's own scope question — it asks whether the canonical unit is correctly BOUNDED, not just whether the source covers it; would correctly handle a commercially-split single novel where "enough content?" alone can't tell whole-vs-volume). Dispositions:

Option A (source: pin on canonical) APPROVED — with a NON-OPTIONAL attestation condition: "pin" must mean VERIFIED not merely PRESENT. A bare-present field populated by the same conversion pipeline that produced the errors would LOCK IN a false pin — WORSE than regeneration (today's bad matches can be caught by a better algorithm later; a falsely-pinned one is locked by design). So source: needs a companion attestation — WHO verified + AGAINST WHAT (Instrument A / B / manual) — before the matcher treats it as a pin vs a still-overwritable provisional. Same shape as the sectionless: true ruling (bare flag ≠ safeguard; attributed attestation = safeguard).
Meditations reconciliation: sequencing CONFIRMED — after the layer exists, not before (else it's just the 4th divergent record).
PHASED — approve urgent core NOW, route full design separately (no redo risk: source:=which-file-verified and work_id=which-abstract-work are COMPLEMENTARY, not competing):
- AUTHORIZED NOW: (a) the persistence layer (Option A + attestation) → BUILD once steward authorizes the [PROPOSAL]; (b) apply "who created the grouping" diagnostic MANUALLY to the 35 flags = the operational form of the scope doctrine, no Gates 2-3 needed.
- ROUTED as its OWN [PROPOSAL], own timeline, NOT blocking: work_id key, scope-relation field, automated Gate 1-3 pipeline redesign. Valuable + worth adopting, but not a prerequisite to finish the current remediation.
- Axis-A fingerprint gate (already PROPOSAL-ruled): builds on Instrument B independently, without waiting for the extent-comparison machinery. WHAT PROCEEDS: persistence layer (Opt A + attestation) → build on steward [PROPOSAL] auth · reconcile meditations → after layer · manual scope diagnostic on the 35 → NOW · work_id/scope-relation/Gate2-3 → separate PROPOSAL · Axis-A fingerprint gate → independent, on steward build-auth. STEWARD DIRECTIVE (2026-07-04): integrate OSS in part or whole where it fits — don't reinvent. → tooling-verification sweep RUNNING (content-fingerprint/text-reuse · biblio-identity/reconciliation · CTS-DTS impls); integrate-vs-build matrix owed, will shape the persistence attestation (reuse §V W3C-PROV pattern?), the Axis-A fingerprint gate (datasketch/passim?), and the separate work_id PROPOSAL (OpenRefine/Wikidata? MyCapytain?).

PENDING-47 — INTEGRATE-VS-BUILD ASSESSMENT DONE 2026-07-04 (3-agent OSS sweep, maintenance+license VERIFIED live). Doc: `docs/work-identity-tooling-assessment-2026-07-04.md`

Steward was right — the study's build-default was too broad. Governing principle: integrate the substrate + enrichment; OWN the spine + verdict (§IV applied to tooling: locator-you-own = constitutional, external ID = witness-not-notary). Corrected my OWN wrong guess: MyCapytain (the "obvious" CTS integration) is DORMANT (last commit 2021). Matrix:

INTEGRATE: rapidfuzz (title/author sim, MIT active) · recordlinkage pinned (deterministic rule+threshold veto-gate; comparison-vector = audit trail; BSD-3) · Wikidata-reconciliation/SPARQL + VIAF + wikimapper as human-in-loop ENRICHMENT (QID/VIAF attributes, NOT the anchor — ~45-75% coverage would strand a third).
KEEP HAND-ROLLED: Instrument B containment (verified ALREADY asymmetric → datasketch buys nothing at n=2000) · the work-identity VERDICT (no OSS does this).
BUILD (own): the deterministic work_id slug SPINE (100% coverage, constitutional) · a thin ~150-LOC CTS-URN parser.
BORROW vocabulary not runtime: DTS 1.0 Collections (member/totalParents/totalChildren/Collection-Resource typing) + TEI relatedItem type=host for the scope model · W3C-PROV (§V, already ours) for the persistence attestation.
REFERENCE not vendor: OpenLibrary match.py weighted-veto approach (AGPL-3.0, re-implement) · pyCTS as test-oracle (GPL-3.0, frozen).
REJECT: datasketch(cond)/passim/TRACER/text-matcher/textreuse-R/ssdeep-TLSH/simhash/dedupe(active-learning-opacity)/MyCapytain+Nautilus(dormant)/openlibrary-client/isbnlib. RESERVE: splink (10× scale).
NET on the ruled build targets: Axis-A gate = keep-B + rapidfuzz + recordlinkage (less to build). Persistence attestation = §V-PROV record (nothing new). work_id PROPOSAL = own-key + DTS-vocab scope + Wikidata-enrichment.
HIGHEST-LEVERAGE EMPIRICAL CHECK before committing the external axis: run ~100 representative works (ancient/translation-weighted) through Wikidata reconciliation → MEASURE the real QID attach rate (the ~45-75% is estimate, not measured — measure-don't-trust). Tooling-register entry owed.

PENDING-47 — ITEM 1 (persistence layer) BUILT + TESTED 2026-07-04 (steward: "work through them sequentially" = build-auth). NOT committed; held for review + jurist ratification.

Steward asked "design around the tension or resolve it?" → RESOLVED (not designed-around). The check that resolved it: the reading-index's source_sha256 hashes the CANONICAL .md TEXT (spec §VI L363 + the Pattern-Language example); the persistence pin needs the hash of the SOURCE FILE (epub/pdf) — a DIFFERENT object. So never a genuine drift conflict, only a naming collision. Resolution = the generalized hash-locality principle: a binding-hash lives with its artifact's authoritative record (reading-index hash→sidecar; verification hash→on-file source_verified:); distinct name source_file_sha256 (≠ forbidden source_sha256); one principle two instances, not rule+exception. Awaiting jurist ratification of the principle. BUILT: match_sources.py — attested_pin() + frontmatter() (PyYAML); a source: is honored as an AUTHORITATIVE PIN (bypasses classify(), re-emitted identically every run) ONLY with a source_verified: attestation whose by names a VERIFICATION instrument (jurist condition: conversion-pipeline CANNOT self-attest; bare source: = provisional). graduation-spec.yaml — source_verified added to optional + the pin-semantics + the hash-locality principle; source_sha256 stays forbidden. test_tools.py — 7 new pin cases (bare≠pin, pipeline≠pin, incomplete≠pin, attested=pin, nested-parse, fm-less-no-crash). 28/28 pass; backward-COMPATIBLE (0 pins today → layer INERT → no regression on the 321; activates only when fixes are pinned). Persistence PROVEN on the meditations case: pin emits Hays not the Bourdieu FP, every run. Meditations reconciliation now UNBLOCKED (the layer exists to hold the answer) — a FIX to apply during the FIX-list, pinning the correct source with attestation. Next in sequence: ITEM 2 — apply "who created the grouping" diagnostic MANUALLY to the 35 flags (jurist-authorized, independent of the persistence schema). Then item 3 (Wikidata coverage measurement), item 4 (work_id/scope-pipeline separate PROPOSAL).

PENDING-47 — ITEM 2 (full 35-flag adjudication) DONE 2026-07-04. Doc: `_curation/stress-seam1-flag-adjudication-2026-07-04.md`. The FIX-list.

Two-axis method (identity: right work? + scope: "who created the grouping?"). Ruling on the 35: 11 confirmed genuine FP [8 wrong-work/author: montaigne/nietzsche/the-odyssey/meditations/ecrits-Lacan/reverie/suzuki-intro/berger-essays · 3 wrong-VOLUME: lhomme-T1←T2/orthotypo-vol2←vol1/semaison-vol1←vol2] · 2 scope under-coverage (whole←part, AUTHOR-division → §IV: a-la-recherche←VolIII, don-quixote←Part1 → bounded-partial-or-re-source) · 2 work←collection (COMPILER-aggregate → extraction-precision: el-aleph, fictions → verify slice isolates) · 2 stubs (latour, naess — corpus fix) · 1 needs-steward (works-eliot empty-frontmatter, Charles-vs-T.S.-Eliot) · 17 correct (fingerprint-negative edition/translation/OCR/garbled-source noise). FP rate ≈ 3.4-4% of 321, consistent with the N=40 ESCALATE. RATIO HOLDS: every corpus fix is FIX-class (re-point/graduate); the one gate-change (author_disagrees blindness) was already the Axis-A PROPOSAL — the two-tier path is real, not decorative. APPLICATION HELD until the persistence layer is ratified (jurist sequencing: pin the corrections with attestation, else they revert). Next: ITEM 3 — Wikidata coverage measurement (~100 reps through reconciliation; needs web/reconciliation API).

PENDING-47 — ITEM 3 (Wikidata coverage) MEASURED 2026-07-04. Doc: `_curation/wikidata-coverage-measure-2026-07-04.md`.

n=100 random non-Loeb, structured query (title + author-P50, no type). AUTO 27% · CANDIDATE(review) 34% · NONE 39% · usable-ceiling 61%. Measure-don't-trust applied to the measurement itself: a first pass read 2% auto → caught as a QUERY ARTIFACT (flat "{title} {author}" concat + written-work type-constraint crushed scores); structured query → 27%. Had I reported 2% I'd have understated Wikidata as badly as the sweep overstated it. Caveats: "confident"≠"correct" (reconciler confidence, human-confirm before trust — enrichment-OK, anchor-NO); coverage tracks composition (Western canon reconciles ~100; ancient/translation/essay → NONE). Confirms the architecture: work_id spine PRIMARY (100%/offline/governed); Wikidata/VIAF = human-in-loop enrichment where they resolve (~27-61%), never load-bearing.

PENDING-47 — SEQUENCE COMPLETE (items 1-3 done). ITEM 4 = the work_id/scope-relation/Gate-1-3 pipeline: jurist-ROUTED as its OWN [PROPOSAL], own timeline, NOT build-now (design already specified in work-identity-study + tooling-matrix). Standing, not actioned this session.

AWAITING STEWARD/JURIST: (a) jurist ratification of the hash-locality principle (item 1) · (b) jurist ratification of the work-identity study/tooling matrix + steward auth to open item-4 as its own PROPOSAL · (c) steward call on when to apply the held FIX-list (after item-1 pin ratifies) incl. the meditations reconcile + works-eliot disambiguation + the 2 scope-under-coverage bounded-vs-resource calls. All artifacts UNCOMMITTED.

PENDING-47 — HASH-LOCALITY RATIFIED + FIX-LIST APPLIED + COMMITTED 2026-07-04

Jurist RATIFIED the hash-locality principle + distinct naming + confirmed the attested_pin implementation satisfies the condition (read-of-description caveat: 28/28 accepted on report). 2 small notes (not conditions): against→real evidence (HONORED — pins carry the Instrument-B N/M); pins carry implicit re-verify-if-method-revised. FIX-LIST APPLIED (steward "Yes"): 5 verified FP re-points PINNED to the permanent Chamber Sources home (steward correction: pin the permanent home, not the transient library path) with real Instrument-B against evidence — the-odyssey, montaigne, lhomme-tome-1, suzuki, berger (5/5 or 4/5). ARCHIVE-CONTAMINATION FINDING (steward's permanent-home reminder surfaced it): the FP contamination had reached the permanent archive — archive_sources.py had copied WRONG sources under right slugs + dest.exists() locked them in; 5 CS copies were the wrong source (0/5) → force-replaced with verified-correct (governed rezip/sha, manifest corrected-2026-07-04). Implication: full archive↔matches reconciliation owed post-gate (contamination likely in every archived FP). DEFERRED: 2 CS-corrected-but-pin-deferred (orthotypo-vol-2, semaison — NO frontmatter, a new corpus-integrity defect beyond the 4 stubs); 4 needs-locate (reverie needs FRENCH ed, meditations/ecrits/nietzsche not on disk — no correct source to pin; the pin mechanism has NO exclusion path → these persist as algorithmic-FPs until an exclusion path or the Axis-A gate). COMMITTED + PUSHED the day's chamber-library work (stress-test artifacts, persistence layer, study/tooling docs, 5 pins). _scratch/ + the nature-of-order-vol-1 untracked file EXCLUDED (not ours). STILL OPEN: exclusion-path design (for FPs with no correct source) OR rely on the Axis-A gate; the 2 no-frontmatter canonicals' frontmatter repair; the 4 needs-locate source hunts; works-eliot disambiguation; the 2 scope-under-coverage calls; full archive reconciliation; jurist ratification of the work-identity study (item 4).

PENDING-47 — EXCLUSION PATH (Region 1.1) BUILT + TESTED 2026-07-05 → surfaced for jurist ratification. HELD from real canonicals.

The ratified pin has no way to attest ABSENCE, so the 4 no-source FPs (reverie / meditations / ecrits / nietzsche) fall through to classify() and re-derive the algorithmic FP every run. Built the exclusion path (test-first, the hash-locality pattern): an attested source_verified.result verdict — confirmed-wrong | none-on-disk — makes match_sources.py emit NO confirmed link (never the FP), routing the canonical to needs-locate. Same attestation shape + guard the jurist ratified: a bare / pipeline / unrecognized verdict is NOT honored (positive attestation of absence, never a default). Emits an auditable excluded record (conf:"excluded" → archive_sources.py ignores it by its conf=="high" filter, verified — no archiver change). PROOF: 37/37 tool self-tests (7 new exclusion cases: the two verdicts · both positive-attestation guards [pipeline / unattested] · incomplete-attestation · unrecognized-verdict · presence-pin regression · nested-frontmatter parse). The 5 existing presence pins still honored. Full real-corpus matcher run byte-identical (source-matches.json + report unchanged) → INERT until an exclusion is declared → ZERO regression (the pin layer's "0 pins → inert" proof). Files (uncommitted, held for review): scripts/match_sources.py (attested_pin generalized to {kind: pin|exclusion}; main splits pinned/excluded + EXCLUDED report + excluded json record), scripts/test_tools.py (+test_source_match_exclusion), _curation/graduation-spec.yaml (source_verified.result documented — generative-from-spec). FOR THE JURIST (ratify the pattern, as with hash-locality): (1) attested-absence via a result: verdict on source_verified — right shape? (2) the verdict vocabulary confirmed-wrong / none-on-disk, kept distinct for auditability (the V-SUSPECT/V-NONE-distinctness spirit, condition 6). (3) the auditable excluded json record (honest-degradation: the exclusion is visible in the data layer, not silent) vs report-only. (4) once ratified, is applying it to the 4 real FPs [agentic] (the FIX-list = Region 1.2), or does each attestation need its own beat? HELD: not applied to any real canonical yet — the exclusion attestations for the 4 FPs (with real Instrument-B against evidence) are the FIX-list application (Region 1.2), sequenced AFTER the jurist ratifies the pattern (hash-locality sequencing: ratify pattern → then pin/exclude). Awaiting: jurist ratification of the exclusion pattern (steward relay) → then Region 1.2 (attest + exclude the 4 FPs, regenerate, verify the FPs are gone). Also still open: the 4 needs-locate source hunts (Region 2), the 2 no-frontmatter repairs + stubs (Region 3), works-eliot + the 2 scope calls (steward), full archive reconciliation, item-4 work-identity.

PENDING-47 — EXCLUSION PATH: JURIST RULING RECEIVED 2026-07-05 → RATIFIED-WITH-CORRECTIONS; §1 corrections APPLIED (Phase A). Region 1.2 unblocked.

Jurist disposition: ratified with two required §1 corrections (not as-submitted). §2 vocabulary ratified (closed-but-extensible: a 3rd verdict under the same guard is D-1). §3 emission ratified (the auditable excluded record; report-only rejected — the JSON is the durable record). §4: Region 1.2 = [agentic] batch, no per-instance re-gating, with a diff-before-commit legibility check. Cross-ref: same doctrine as the Studium V0 ruling today (a verdict never claims more than what was attested; the process that produced an error never attests its own correction — conversion-pipeline excluded as attestor ≙ "never the generating model checking itself"). §1 CORRECTIONS APPLIED (Phase A — mechanical / D-1):

Exclusion moved to its OWN top-level key source_excluded: — not a result: verdict inside source_verified: (which asserts the opposite of what an exclusion means). Shared guard _valid_attestation() (defined once, can't drift), two honestly-named keys — the sectionless: precedent followed literally.
result: verified now REQUIRED explicitly on source_verified: (no default-by-absence, even for presence) → the 5 existing pins migrated (one line each: the-odyssey / montaigne / lhomme-T1 / suzuki / berger). PROOF: 37/37 tool self-tests green under the corrected schema (source_excluded block · result:verified required · co-present exclusion-precedence · unrecognized-verdict refused). Matcher run: 5 pins still honored; source-matches.json + report byte-identical → corrections + migration clean, zero regression. Files (uncommitted, held for review): scripts/match_sources.py (_valid_attestation shared guard + two-block attested_pin), scripts/test_tools.py, _curation/graduation-spec.yaml (source_verified.result required + source_excluded block, closed-but-extensible note), + 5 canonical frontmatters (result: verified). REGION 1.2 (now [agentic], diff-before-commit): attest + exclude the 4 FPs — reverie (confirmed-wrong: on-disk Poetics of Reverie is English, canonical needs the French — Instrument-B mismatch evidence) + meditations / ecrits / nietzsche (none-on-disk: inventory-search absence). Regenerate source-matches.json, then surface the diff (4 against strings + before/after json) before commit. One methodological point to settle first: the adequate against for a none-on-disk attestation — there is nothing to fingerprint, so the evidence is a negative inventory search (by: manual + a documented search), vs the confirmed-wrong case (Instrument-B fingerprint mismatch). Awaiting: steward go for Region 1.2 (+ the none-on-disk evidence standard). Still open beyond: Region 2 source hunts, Region 3 repairs + stubs, works-eliot + the 2 scope calls, full archive reconciliation, item-4.

PENDING-47 — REGION 1.2 APPLIED 2026-07-05 (steward approved the diff "reads right"). The 4 FPs excluded. COMMITTED.

All 4 FPs attested source_excluded: confirmed-wrong — verifying against the substrate CORRECTED the map's "3 none-on-disk": each had a concrete wrong on-disk candidate the matcher was picking — reverie → Poétique de l'espace (same-author-wrong-work, suspect=False, the exact blind spot this arc exists to catch); meditations → Bourdieu Pascalian Meditations; ecrits → Écrits radiophoniques; nietzsche → A Nietzsche Reader. Real evidence: Instrument-B 0/5 probe-windows (frac 0.0) for each — the canonical's prose wholly absent from the matched candidate. Regenerated source-matches.json: the 4 → excluded records (conf excluded, no link, routed to needs-locate); every OTHER of the 315 records byte-identical (change provably bounded to the 4). 37/37 tests. Noted: the 4 canonicals lack a source: field — a pre-existing frontmatter gap (feeds the sweep below). COMMITTED the exclusion-path arc (§1 corrections + 5-pin migration + 4 exclusions) — chamber b9a5d05. ⚠ PUSH BLOCKED: chamber's remote is git.skemantix.com (Seb's Gitea, not GitHub); web returns HTTP 200 but git push/ls-remote hang at the git backend even fail-fast (not credentials — osxkeychain configured). Known-flaky remote (cf. the 2026-03 handoff "ask Seb to restart Gitea"). Commit is safe locally; retry git -C ~/_Dev/chamber-library push origin main when the server recovers (or ping Seb). dotfiles committed+pushed to GitHub as usual. Region 1 (the non-Loeb FP loop) is CLOSED for the known cases: 5 pinned, 4 excluded. The correct sources for the 4 remain needs-locate (Region 2). REVIEWED entry still owed. NEW WORKSTREAM (steward-surfaced 2026-07-05): frontmatter sweep at scale. The v2 frontmatter spec (graduation-spec.yaml) was defined recently, well after most works entered the library → ~1,073 lack v2 frontmatter (+ the 4 FP canonicals' missing source:, + Region 3 no-frontmatter/stubs). [needs-authorization] — scope-first: a read-only gap census against the spec + a migration plan surfaced for authorization BEFORE touching files. Honesty constraint (load-bearing): provenance fields (source, converted_with, date_converted, source_verified) cannot be mass-fabricated for works whose provenance isn't known — derive the mechanical ones, mark the unknown honestly, curate the rest. Same anti-default discipline as the exclusion path.

PENDING-48 — Studium Engine V0 (verifier contract) — jurist method-gate

⟶ CLOSED 2026-07-05 — REVIEWED-48 placed by steward (formal close). Date: 2026-07-05 Tag: [PROPOSAL] — routed to the jurist as a method gate. This is the one named exception to the engine's steward-direct D-1 governance (cluster-a-data-model.md §0; rebuild-plan §8.5, steward-ruled 2026-07-04): V0 defines what the engine may assert as verified and when it must abstain, and everything downstream inherits that standard, so the jurist gates the method before V1 (the byte-existence checker) is built against it. Summary: The V0 verifier contract + pre-registration is drafted (studium-engine/docs/spec/v0-verifier-contract.md, DRAFT). It fixes the claim taxonomy (quoted / constructed / synthesized / ungrounded → verdict registers) and — before any validation data is seen — the pre-registered thresholds for the multilingual/archaic validation (V2). Its D-1 companion, the N0 navigation-tree contract (docs/spec/n0-navigation-tree-contract.md), is written together with it (not jurist-gated); N1 may proceed while V0 sits with the jurist. No V1 code written; the executor holds at this boundary. Two decisions surfaced for the jurist's gate (leans given, not decided):

§2 — the definition of "unaltered" (the held literal question; may be doctrine). The quoted-tier check asks "do these exact words exist, unaltered, at this anchor?" but text_original is byte-faithful (long-s, ligatures, original spelling), so byte-for-byte would reject legitimate modernized quotes. Candidate equivalence relations: (A) exact bytes (too strict) · (B) normalizer@1 classes (NFC · ſ→s · 7 ligatures · soft-hyphen · whitespace-collapse — the index transform) · (C) (B)+diacritic-fold (the search transform; wrong for a fidelity assertion — é≠e in French/German/Greek). Executor lean: (B), with three conditions — the relation is versioned and named in the verdict ("the bound names the equivalence relation"), a near-match under any looser relation verdicts altered never guaranteed, and diacritic-folding stays out of the fidelity tier. Jurist ask: (a) ratify (B) or rule otherwise; (b) rule whether setting/evolving normalizer@N for the guaranteed tier is D-1 engineering or doctrine requiring jurist sign-off per version; (c) confirm diacritics stay out; (d) confirm the surfaced boundary case — hard-hyphen line-breaks are a source-cleaning concern, not the checker's to absorb (the checker must not guess dehyphenation).
§5 — the pre-registered V2 thresholds. Per (language, tier): primary safety metric = false-accept rate on adversarial negatives (injected known-bad: meaning-reversal / near-miss / wrong-span / whole-for-part / translation-as-original), graded on the one-sided 90% Clopper-Pearson upper bound (the CI-not-point-estimate rule ratified on PENDING-47), with the underpowered top-up. Pre-committed outcomes: trust (U ≤ 5% AND recall ≥ 0.75) / revise (5% < U ≤ 15%) / gate-to-abstain (U > 15% or no gold → that language's synthesized claims cannot-verify by default — honest degradation, a valid completion). Small-n honesty stated up front: with the current gold (German ~15–20; French Mauss 17 + Weil; English 26/39) several cells may not reach trust even at zero observed false-accepts; the trust lever is more adversarial negatives (pre-registered before generation), and a gate-to-abstain is a pre-committed valid result, not a failure. Tier-1 has no statistical bar (decidable) — validated by the deliberate-mismatch suite + orthography tests. Jurist ask: ratify the thresholds (5%/15%), the CP-upper-bound application, the small-n disposition, and the adversarial-negative taxonomy; rule what (if anything) is doctrine vs method-engineering.

Authority for the routing: rebuild-plan §8.5 (steward-ruled 2026-07-04) — V0 is the one D-1 exception; D-1 stays intact for all other engine decisions (incl. N0, N1). Files affected: studium-engine/docs/spec/v0-verifier-contract.md (V0 DRAFT — revised on the ruling before V1) · docs/spec/n0-navigation-tree-contract.md (N0, D-1, informational) · ~/PENDING.md (this entry). Written, uncommitted — held for steward review + push on the steward's word. Awaiting: jurist method-gate on §2 (the "unaltered" relation + its D-1-vs-doctrine status) and §5 (the pre-registered V2 thresholds), via steward relay. On a clean gate → build V1 to the ratified relation + the deliberate-mismatch suite. On a reshaping ruling → revise V0 before V1. N1 (tree builder) may proceed in parallel under D-1.

PENDING-48 — JURIST GATE CLEARED 2026-07-05 (steward relayed). CLOSED — REVIEWED entry owed.

Disposition: gate clears on both §2 and §5, with conditions. V1 and V2 unblocked. Ruling folded into studium-engine/docs/spec/v0-verifier-contract.md (DRAFT → v1.0 RATIFIED, new "Ruling" section) + the fork landed at source in cluster-a-data-model.md §5.1. §2 — (B) ratified (typographic-convention in, orthography out). Ruled DOCTRINE, not D-1, with a code-level consequence: fork the fidelity relation to fidelity_equivalence@1 — a frozen constant distinct from chunker.normalize(), so a D-1 retrieval-normalizer change can't silently drag the trust floor; every future fidelity_equivalence@N needs jurist ratification, normalizer@N (retrieval) stays D-1. Diacritics-out confirmed; hard-hyphen-linebreak confirmed as a cleaning-gate concern (cost lands as recall/abstention, not false trust). Cross-cutting flag RESOLVED (executor, verify-before-asking): gold pairs verified against modernized editions — checked the actual source files (Mauss, Weil ×2, Handke all works, March Essay-I): zero long-s / fold-ligatures / soft-hyphens; the œ/æ present (72 in Mauss) are orthographic ligatures fidelity_equivalence@1 correctly does not fold. ⇒ flag moot at present gold (fold clauses inert → "verified" and guaranteed can't diverge on glyph grounds). Caveat: reactivates if future gold is drawn from a diplomatic edition. §5 — thresholds ratified as stated (5% / 15% / 0.75; jurist independently confirmed 0/15 → U≈14.2%). Gate-to-abstain ruled doctrine-consistent (refusing the contamination failure mode in advance), not merely tolerated. Added condition: negatives-expansion must preserve the original proportional distribution across the five adversarial classes, or pre-register a new distribution before generating. Doctrine = the threshold values; D-1 = the CP calc / perturbation code / gold-pair selection. Coupling recorded (not resolved): the 5%/15% values are calibrated with the §1 rule-3 evidence-first display guarantee — weakening that display (e.g. a future UI showing a bare scalar) requires re-gating the thresholds. Files touched (recording the ruling): studium-engine/docs/spec/v0-verifier-contract.md (v1.0 + Ruling), docs/spec/cluster-a-data-model.md §5.1 (the fork at source), ~/PENDING.md (this close). Still uncommitted — held for steward review + push. Next (unblocked): V1 (verify-quote) against fidelity_equivalence@1 + the §3 deliberate-mismatch suite; N1 (tree builder) in parallel. Standing conditions carried into the build: the §5 display-coupling, the proportional-expansion rule, the diplomatic-gold caveat. Owed: a REVIEWED-N entry (steward/jurist) recording this ruling — same as the PENDING-46/47 arc.

PENDING-49 — Library-science frontier brief → jurist doctrine pass (constitutional-grade adoptions)

Date: 2026-07-05 Tag: RESEARCH / SCOUT — surfaced for the jurist's doctrine pass (contains NO proposals yet; the PENDING-22 pattern). Each advanced adoption becomes its own [PROPOSAL] → spec amendment via the ratified RFC-supersession process (PENDING-46 gap-7). Steward-flagged 2026-07-05: "this will touch the constitution — the jurist will need to see this and give a ruling." Summary: An adversarially-verified deep-research pass on the 2024–26 library-science frontier (chamber-library/docs/library-science-frontier-brief-2026-07-05.md; 28 sources, 24/25 claims confirmed, 1 refuted). Headline: the field mostly confirms and names what the Chamber already is; the Chamber is at or ahead on its central mechanisms; the frontier is thinnest exactly where the Chamber is most novel. But several adoptions touch the ratified v2.0 constitution and must go through the amendment loop before any spec change. What touches the constitution, by level (the structured question for the jurist):

A — DOCTRINE-level (needs the jurist's doctrine pass):
1. IFLA-LRM Agent + Nomen entities — extends the §III addressing spine / work-identity model (couples to PENDING-47 item-4); a model amendment (voices as first-class entities; name-as-entity disambiguation).
2. Perspectival-classification licence (Berman→Olson) — the epistemic status of the curation/classification scheme (the "unapologetically partial, names-its-viewpoint" stance); a preamble/thesis-level doctrine question.
3. CoreTrustSeal-level self-audit as the trust baseline — the corpus's own trust-attestation posture (the spec's central thesis is trust-by-design); a governance-doctrine adoption + a succession/inheritability instrument.
4. Refuted-claim correction (record it): the warrant for the Chamber's bounded, curated-for-one-steward scope comes from critical classification (A2), NOT from the Santa Barbara "collections as data" statement (that claim was refuted, 1-2). Which pillar justifies the scope is a doctrinal precision the jurist should fix.
B — SPEC-AMENDMENT gap-fill (lighter; FIX/PROPOSAL under the amendment process): machine-readable licence/copyright status as a frontmatter field (graduation-spec.yaml, gap-filling); PREMIS as the borrow-vocabulary name for the preservation-metadata layer; "collections as data" as the framing term (near-zero spec change).
C — already in a governance loop (don't re-route): tamper-evident text provenance ([GREENFIELD]) is the studium engine's V0/fidelity_equivalence@1 frontier (already jurist-ruled, REVIEWED-48); the VIAF/ISNI reconciliation discipline couples to item-4 (PENDING-47, its own routed [PROPOSAL]). Honest coverage gaps (from the brief, not to be smoothed): the AI-cataloging data point (LC ~99% structured / <50% subject) is indicative, not adversarially verified; TEI/CTS scholarly-edition tradition came back under-surveyed (the "TEI as later tier" plan neither validated nor challenged); Ranganathan faceted classification returned no surviving claim. Files affected (on advancement): chamber-library/docs/chamber-library-specification.md (A1/A2/A3 → amendment via supersession) and/or _curation/graduation-spec.yaml (B, gap-fill); each its own [PROPOSAL] + REVIEWED entry. Awaiting: jurist doctrine pass on the A-items (steward relay); confirmation that the B-items run as ordinary amendments; each advanced adoption re-enters as its own tagged [PROPOSAL]. Nothing amends the spec until then.

PENDING-49 — RULED 2026-07-06 (REVIEWED-49; jurist doctrine pass). Execution sequenced AFTER the MEMORY.md compaction.

Disposition (verbatim capture + executor action-list: chamber-library/docs/library-science-adoptions-RULING-2026-07-06.md; steward places the canonical REVIEWED-49 in ~/REVIEWED.md):

A1 — advance as an ADDITIVE registry (Agent/Nomen joined by appellation to author-name strings; no per-work field) → the frontmatter sweep is UNBLOCKED on the current schema (FIX; no double-touch). agent_id-required deferred as emergent via an A3 registry-linkage metric, not scheduled.
A2 — advance as preamble/rationale (FIX). Citation-correction: Berman for the narrow claim only; the personal-scheme licence is Olson's stronger move → verify Olson's primary source (The Power to Name, 2002) before drafting; default (b) (Chamber's own synthesis, attributed to neither) until verified.
A3 — advance as PROPOSAL (a self-audit conditioning OPERATIVE status is a status-gate = doctrine-class). 3 dims: provenance-completeness (annual) · registry-linkage-completeness (annual, double-duty for A1) · legibility-to-successor (every 2–3 cycles); fixity stays automated/continuous, out of the manual audit.
A4 — record the scope-warrant redirect to A2's preamble (FIX, after A2 lands). B — ordinary amendments (word (iii) computational-only). C — reconciliation targets the Agent/Nomen registry specifically. Executor-owed (verify-don't-assert): the engine hot-path read (retrieve.py) for A1's field-timing; verify Olson's primary source before A2's preamble. Steward-sequenced 2026-07-06: next session = MEMORY.md compaction FIRST, THEN execute this ruling. REVIEWED-49 = steward to place in ~/REVIEWED.md (as with 44–48).

PENDING-50 — A2: perspectival-classification licence (spec preamble)

Date: 2026-07-06 Tag: [FIX] change-class — a spec amendment, so it runs the §Governance & Amendment editor-gate (executor drafts → jurist editor-gates format + doctrinal soundness → steward ratifies). Filed for that gate, NOT for direct implementation. The spec is never edited in place; this lands by supersession/errata lane after ratification. Advances REVIEWED-49 A2. Summary: Drafted preamble grounding the corpus's owned/partial arrangement, per REVIEWED-49 A2.

Reading settled — (b), earned from the primary source (not the scout). Read Olson The Power to Name ch. 6 "Toward Eccentric Techniques" closely against the scan image (the proposal chapter — where the licence would live if anywhere). Olson does not license constructing a declared self-standing personal partial scheme; her first principle expressly cautions against it: 'make breaches in the limit — make it permeable rather than redefining it or constructing a new limit' (book pp. 227/238, scan-verified). Every concrete alternative keeps the universal in play (the Luiseño Culture Bank runs alongside augmented LCSH — 'two cultural perspectives'; local policies are precedence tweaks within DDC). Attributing the self-standing-scheme move to Olson would repeat A4's error. (a) rejected; (b) adopted: Berman for the narrow 'bias is real, own it' claim; Olson for the eccentric/perspectival move as she makes it; the self-standing scheme = the Chamber's own synthesis, attributed to neither.

Scan cross-check (A4-error guard): all load-bearing quotes verified against the scan image (PDF pp. 236–252 = book pp. 224–240; offset +12). No meaning-shift OCR-vs-text; the only glyph-shift is the Greek — OCR EKKEVTPOS = scan ἔκκεντρος (immaterial; not quoted in the preamble).

Proposed placement: a new subsection under §I (The trust thesis) — the foundational "why," where the boundedness=trust thesis already lives; tag [NEW — A2 · REVIEWED-49].

Proposed amendment lane (jurist's call): substantive-but-non-normative (no gate change) — either the Held-for-Update errata lane or a v2.0.1 patch supersession. Adds a doctrinal subsection (not a typo), so executor leans patch-supersession; defer to jurist per §Governance & Amendment.

Drafted preamble text (house voice; (b); single-quotes; Canadian spelling — a draft for the jurist's editor-gate and the steward's voice):

On the partiality of the arrangement [NEW — A2 · REVIEWED-49]

This library does not pretend to a neutral or universal order. Its division of texts into traditions is an owned arrangement — partial, situated, answerable to the hand that built it — not an approximation of a view from nowhere. This is stated, not concealed, because a classification that hides its own standpoint is the more dangerous kind: it lends the borrowed authority of neutrality to what is in fact a set of choices.

That no classification is neutral is not this library's discovery. Sanford Berman showed a generation ago that the standard subject languages carry the prejudices of their makers, and that the honest response is not to chase a corrected 'neutrality' that cannot exist but to own the bias and make it legible (Prejudices and Antipathies, 1971). Hope Olson carried the argument into classification itself: that naming can be eccentric — 'looking/moving toward the limits rather than toward the centre of a system' — and that the cataloguer's situated judgment, informed by a particular collection and its readers, is a legitimate ground for how a thing is placed (The Power to Name, 2002).

This library takes their spirit and makes a move that is its own. Berman and Olson worked to make the public, universal-aspiring catalogue permeable from inside — Olson's first principle is expressly to 'make breaches in the limit … rather than redefining it or constructing a new limit'. This library instead constructs its own limit, openly, because it is a bounded, personal collection: its boundary is not a failure of coverage to be apologized for but the very thing that makes the corpus checkable, and so trustworthy (§I). Where a universal catalogue must not construct a new limit, a bounded one must — and must say so. What is offered here is one reader's owned arrangement of what Olson called 'the found objects of our art' — not a claim about how knowledge itself is shaped.

Files affected (on ratification): chamber-library/docs/chamber-library-specification.md (§I new subsection; version treatment per lane call). No code/gate change. Awaiting: jurist editor-gate (format + doctrinal soundness) + steward ratification, per §Governance & Amendment. A4's scope-citation redirect is sequenced after this lands.

RULED + LANDED 2026-07-07 (REVIEWED-50). Editor-gate PASSED (doctrinal soundness approved; §2 trust-thesis bridging clause ADDED — distinguishes arrangement-honesty from §I's fidelity sense of trust; §3 "must" confirmed conceptual-entailment, FIX-class holds; no A4 leakage). Placement §I CONFIRMED; lane CONFIRMED v2.0.1 patch supersession. LANDED: chamber-library-specification.md bumped v2.0.0→v2.0.1 (§I subsection added, header supersession note); v2.0.0 archived immutable (chamber-library-specification-v2.0.0.md, byte-identical); chamber CLAUDE.md version pointer updated. Steward places REVIEWED-50 in ~/REVIEWED.md. chamber-library committed 34c39f1 (Gitea). NEXT: A4 scope-citation redirect (now that A2 has a ratified home to point to), then the REVIEWED-49 tail; then the verification-architecture [PROPOSAL] (steward-sequenced priority).

PENDING-51 — A4 + B(iii): the corpus-as-data framing term, and the scope-warrant it does not carry (one coupled §I subsection)

Date: 2026-07-07 Tag: [FIX] change-class — a spec amendment, so it runs the §Governance & Amendment editor-gate (executor drafts → jurist editor-gates format + doctrinal soundness → steward ratifies). Filed for that gate, NOT for direct implementation. The spec is never edited in place; this lands by v2.0.1→v2.0.2 patch supersession after ratification. Advances REVIEWED-49 · A4 + B(iii). Sequencing precondition MET: A2's preamble landed (REVIEWED-50, 34c39f1), so A4 now has a ratified home to point to. Summary: One new §I subsection that (B(iii)) introduces 'collections as data' into the spec as a framing term worded computational-tractability sense only, and (A4) records — in the same breath — that this framing does not supply the corpus's bounded/personal scope warrant; that warrant is the A2 partiality preamble, not the Santa Barbara Statement's Principle 4.

Diagnosis (verify-against-the-substrate, not the brief): grep of the live spec (chamber-library-specification.md) for collections?[ -]as[ -]data returns zero hits — the phrase, and the refuted Principle-4 scope-citation, are present only in the research briefs and the RULING, never in the constitution. So A4 is preventive/recording, not a redirect-in-place (there is no bad citation in the spec to move); and B(iii) is the first entry of the term into the spec. They are logically one edit — A4 is the boundary-clause on B(iii)'s introduction — so they land as one subsection, honouring the RULING's flag ("(iii)'s text must use 'collections as data' only in the computational-tractability sense; do not reintroduce the refuted scope-justification through drafting"): the boundary is written into the introduction.

Proposed placement: a new subsection under §I (The trust thesis), immediately after 'On the partiality of the arrangement' (the A2 preamble it points to). Tag [NEW — A4 + B(iii) · REVIEWED-49].

Proposed amendment lane: v2.0.1 → v2.0.2 patch supersession — same shape the jurist confirmed for A2: substantive-but-non-normative (adds a doctrinal subsection, not a typo → not the errata lane; no gate change → not a MAJOR re-verify). Rationale text only; no consumer re-verification. Defer to jurist per §Governance & Amendment.

Drafted subsection text (house voice; single-quotes; Canadian spelling; British punctuation — a draft for the jurist's editor-gate and the steward's voice):

The corpus as data — and the warrant it does not carry [NEW — A4 + B(iii) · REVIEWED-49]

§I grounds the library's trustworthiness in fidelity; the subsection above grounds the arrangement's trustworthiness in owned partiality. This subsection names, in the field's own vocabulary, what the corpus is built to be — and marks one boundary that vocabulary does not cross.

In the language of library science, the Chamber is a collection as data: a corpus shaped so that a reasoner — the Studium Engine — can compute over it directly, not only a shelf for human reading. The Santa Barbara Statement on Collections as Data names, in the field's terms, the posture this spec already enforces by other means — its Principle 8 grounds trust in 'the technical integrity of the data as well as its provenance' (§IV–§V) and requires stewards to 'acknowledge absences and areas of uncertainty' (§IX's coverage-ledger and honest-degradation disciplines). The term is adopted as framing only: it says what the corpus is to the field. It adds no gate and changes nothing any gate accepts.

Its reach is bounded in one respect, recorded here so it cannot later be over-drawn. 'Collections as data' warrants the corpus's computational tractability — its fitness to be read by a machine. It does not warrant the corpus's bounded, personal scope. That warrant is the owned partiality named above (Berman, Olson). The Statement's Principle 4 ('collections as data designed for everyone serve no one') is sometimes enlisted for it, but Principle 4 concerns a different thing — designing a collection for an intended community of use — not the epistemic standing of a bounded, personal curation; a deep-research review (2026-07-05) found the scope-licensing reading refuted by two of three independent verifiers. The scope rests on a declared standpoint, not on a data-posture; the two pillars are kept distinct so that neither borrows the other's authority.

Primary-source verification (2026-07-07 — steward-directed 'verify now', before the gate): fetched the primary Santa Barbara Statement (collectionsasdata.github.io/statement). Principle 8 CONFIRMED verbatim — 'the technical integrity of the data as well as its provenance' + 'acknowledge absences and areas of uncertainty' (draft now anchored to these exact phrases). Principle 4 CORRECTED — verbatim it reads 'Collections as data designed for everyone serve no one. Specific needs inform collections as data development'; it does concern designing for specific communities, but as audience-fit of a data product, not the epistemic warrant for a bounded/personal curation. The brief's flat shorthand ('does not license scoping to one named community') was imprecise against the primary; the draft now states the precise distinction (audience-design ≠ scope-warrant). A4-shaped error avoided on my own draft by reading the source. Relay brief for the editor-gate: chamber-library/docs/library-science-A4-Biii-FOR-JURIST-2026-07-07.md.

Files affected (on ratification): chamber-library/docs/chamber-library-specification.md (§I new subsection + header supersession note, v2.0.1→v2.0.2); freeze chamber-library-specification-v2.0.1.md (byte-identical immutable); chamber CLAUDE.md version pointer. No code/gate change. Awaiting: jurist editor-gate (format + doctrinal soundness) + steward ratification, per §Governance & Amendment. On ratification → land by patch supersession, tag commit REVIEWED-51. This closes the A4 + B(iii) items of the REVIEWED-49 action-list; remaining tail = A1 registry (hot-path read first), A3 PROPOSAL, B(i)/(ii), C reconciliation-target.

JURIST EDITOR-GATE RULING 2026-07-07 — PASSES 1/2/4/5 as drafted; Q3 gated on one fact, now CONFIRMED (verbatim ruling: chamber-library/docs/library-science-A4-Biii-RULING-2026-07-07.md).

Q1 (audience-design ≠ scope-warrant): sound, confirmed as drafted — "different kinds of claim" (Principle 4 instrumental / scope-warrant normative); the primary-source correction is "the right level of precision."
Q2 (no leakage): confirmed, "stronger than a minimal pass" — naming Principle 4 to refute it in the same breath is the safer construction (pre-empts a future reader making the association independently).
Q3 (§IX cross-ref): ruled confirm-don't-default-soften. Executor confirmed by §IX substrate read → Case A: §IX's own Still open text settles census→coverage-ledger, evidence-tier column, and the freshness invariant (honest-degradation named verbatim there); leaves open ONLY silence-as-finding, explicitly separated. Both cited terms independently live, neither entangled → citation stands exactly as drafted, both terms, NO edit (one-word fallback not triggered).
Q4 (placement + lane): confirmed, no redirect — §I-after-A2, v2.0.1→v2.0.2 patch supersession.
Q5 (voice): no changes required — single-quotes / Canadian spelling / British punctuation clean; 2-of-3 hedge appropriately non-unanimous. STATUS: gate fully passed; draft final (no edit). Ratification pending — steward places REVIEWED-51, NOT pending revision. On ratification the executor lands: freeze chamber-library-specification-v2.0.1.md (byte-identical immutable) → bump canonical v2.0.1→v2.0.2 (subsection after the A2 preamble + header supersession note) → chamber CLAUDE.md pointer → commit tagged REVIEWED-51 (Gitea; steward's commit call).

RATIFIED + LANDED 2026-07-07 (steward ratified; REVIEWED-51). Committed 7d1d8d3 (local; not pushed — steward's Gitea call). v2.0.1 frozen byte-identical (cmp-verified, 763 lines) → chamber-library-specification-v2.0.1.md immutable; canonical bumped v2.0.1→v2.0.2 (subsection 'The corpus as data — and the warrant it does not carry' after the A2 preamble + v2.0.2 header supersession note); chamber CLAUDE.md pointer updated. Bounded-diff verified — canonical change = exactly the title tag + header note + the new subsection; CLAUDE.md = only the pointer line. Audit trail committed: library-science-A4-Biii-{FOR-JURIST,RULING}-2026-07-07.md. REVIEWED-51 draft left on steward's Desktop for placement in ~/REVIEWED.md. Closes A4 + B(iii). REVIEWED-49 tail: A1 registry (retrieve.py hot-path read first), A3 PROPOSAL, B(i)/(ii), C reconciliation-target.

PENDING-52 — Wire source-archiving into graduate_to_canonical (enforced graduation step)

Date: 2026-07-09 Tag: [PROPOSAL] Summary: Make source-archiving an enforced part of graduation — graduate_to_canonical.py files the source via archive_sources.py --add, and the graduation gate refuses a candidate whose source is not in Chamber Sources — closing the conversion-runbook.yaml source_provenance.going_forward TODO (steward directive 2026-07-02). Rationale: The 2026-07-02 directive made source-archiving "a step of graduation, not a separate pass," but the enforcement was never built — so it depends on the executor remembering to archive. The 2026-07-09 Handke graduation proved the failure mode exactly: without enforcement, archiving got framed as a "loose end" and nearly deferred, and the source sat in the wrong place (converted_texts/, the .md inbox). An enforced gate makes "every new canonical work arrives WITH its source filed" a structural guarantee, not a discipline — the honest-degradation principle applied to the graduation rail: refuse to call a work graduated until its provenance is filed. Change-class: PROPOSAL — it adds a precondition to what graduation accepts (FIX→PROPOSAL per the amendment process when gate acceptance changes). The building block (archive_sources.py --add, manual-archive shape) is already built (FIX, landed 2026-07-09; test_tools 68/68). Options:

Gate-enforced (recommended): graduate_to_canonical.py archives the source via --add (source path resolved explicitly or from a pending-graduation/ staging area), and the graduation gate asserts a Chamber Sources manifest entry exists for the slug — refuses otherwise.
Tool-coupled, not gate-enforced: graduate_to_canonical archives but the gate does not check — cheaper, re-opens the "remembered, not enforced" gap.
Manual + checklist (status quo): leave --add a manual runbook step. Honest, but relies on discipline (the very gap that bit today). Recommendation: Option 1 — the only one that makes the directive structural. The one real design question: how graduation learns the source's location. The source: frontmatter names the original filename but not its path; a small convention is needed — likely a pending-graduation/ staging area (mirroring the existing Chamber Sources/pending-graduation/) the gate resolves from. Files affected: scripts/graduate_to_canonical.py, the graduation gate (scripts/verify_graduation.py or the graduation-spec.yaml gate list), _curation/graduation-spec.yaml (the new precondition), _curation/conversion-runbook.yaml (currency). No change to the verbatim guarantee or the fidelity relation. Awaiting: Steward authorization + jurist review (it touches the graduation gate — the chamber's governed boundary).

JURIST-RULED + STEWARD-AUTHORIZED + BUILT 2026-07-09 → REVIEWED-52. Design closed through a 4-document jurist exchange (mechanism draft → repo-evidence ruling → final reconciliation); the executor's repo-evidence replaced the original filename-lookup design once the staging area's real shape surfaced (its own pending-manifest.json; the staging slug is author-first while canonical is title-first). Steward authorized; built + tested same session.

Resolution: via pending-manifest.json's canonical_slug field (matched per-candidate, never bulk-copied from the staging slug nor the note's "intended canonical slug" language — jurist's sharpened constraint; the 14 legacy entries untouched until each comes up).
archive_sources.py: resolve_pending_source + manifest_has; --add idempotency — no-op on sha match, ARCHIVE CONFLICT (exit 2) on same-slug/different content (jurist §4).
graduate_to_canonical.py: source_gate() = gate zero — archive-first, verify-the-entry-landed (don't trust the return, §3.3), refuse otherwise; the old NOT-WIRED warning is now the wired confirmation.
graduation-spec.yaml: declarative preconditions: source_archived.
Tests 68→73/73; dry-run clean. Chamber commit 4be2265 (local; Gitea push steward's call).
Parked separately (jurist §3, not folded in): is the graduated corpus uniformly title-first or genuinely mixed? Per-candidate resolution is robust either way.
Full FIX for graduate_to_canonical's follow-on line: body_word_conservation (the 3rd declared gate, still "tracked as follow-on, not yet enforced") is untouched here — out of PENDING-52 scope. Awaiting only: steward placement of REVIEWED-52 (the authorization record).

PENDING-53 — Hash-locality principle omits the engine consumer surface (re-anchor spans both repos)

Date: 2026-07-09 Tag: [PROPOSAL] Summary: Complete the graduation-spec layers hash-locality principle to name the studium-engine binding surface (corpus/manifest.yaml sha · corpus/sidecars/*.source_sha256 · corpus/coverage-ledger.json) that a chamber-canonical re-hash invalidates — the ratified doc currently lists only chamber-internal bindings, and its voice_manifest: engine-side; carries NO source hash line mis-frames the engine as non-binding. Rationale: P1 (2026-07-09, lenracinement source-clean) re-anchored chamber catalogue.yaml but left the engine's manifest sha + sidecar source_sha256 + coverage-ledger bound to the OLD sha. The engine ingest_gate §1.1 hash-binding would have FAILED weil-enracinement, but nothing runs it after a chamber edit and the stale ledger hid it — caught only by chance during P2 diagnosis. Root cause is a governed-doc gap: the ratified hash-locality principle enumerates reading-index + source-match (chamber) and declares the engine voice_manifest hash-free — the exact frame that stopped the re-anchor at the chamber boundary. The engine SOURCE manifest + sidecars DO bind and ARE enforced. Change-class: Documentation-completing in substance (names an existing, enforced binding reality; changes no gate acceptance) — but it touches the RATIFIED graduation-spec, so it runs the loop, not a unilateral edit. Already landed (operational, not the ratified spec): _curation/conversion-runbook.yaml gained a reanchor: block — the full cross-repo binding surface + the completeness check (grep BOTH repos for the old sha; regenerate the engine ledger via ingest_gate; the engine gate is the proof). Born-note cites the Weil incident. Options:

Complete the graduation-spec layers note to enumerate the engine consumer surface + a cross-repo re-anchor pointer to the runbook reanchor: block. (recommended)
Runbook note only — weaker; the mis-framing line stays in the governed doc.
Follow-on tool: a reanchor helper that, given a canonical, greps both repos for the old sha, updates all bindings, and runs both gates (a real class-fix; larger; own PENDING). Recommendation: Option 1 now (correct the governed doc's frame + point to the runbook); Option 3 as a follow-on if re-hash/re-anchor recurs across the ~30-source Making batch. Files affected: _curation/graduation-spec.yaml (layers/hash-locality note). Runbook already updated. No gate-acceptance change. Awaiting: Steward authorization + jurist review (touches the ratified spec).

RULED + LANDED 2026-07-10 (jurist ruling; REVIEWED-53). Disposition: Ratified — draft §5, disambiguation option (b), with one required wording correction. Change-class downgraded [PROPOSAL]→FIX (documents an existing enforcement surface; adds no gate predicate — same test as PENDING-52). Lane: lightweight in-place edit, audit trail sufficient (no freeze/semver).

Required correction applied: "…therefore re-anchors ACROSS BOTH REPOS" (descriptive) → "…therefore REQUIRES re-anchoring across both repos" (prescriptive — the gate catches the failure to do it; nothing does it automatically; that IS the incident).
Landed _curation/graduation-spec.yaml layers: block: voice_manifest annotated (⚠ NOT the source manifest) + new single engine_source_binding key (kept as one entry per the jurist — it names a relationship across three files that must move together; fragmenting recreates the failure) + shared-word # => comment. Dual warning kept (inline ⚠ + block comment — two reading grains). YAML re-parses; bounded diff (6 ins / 1 del). Uncommitted (steward's Gitea call, consistent with the held P1 changes).
Jurist's proposed lane-rule ("lane tracks change-class" for graduation-spec.yaml, floated to generalize to the .md spec) — executor response, surfaced for the jurist, not decided here: ACCEPT for graduation-spec.yaml (machine-convention-data; FIX→in-place, PROPOSAL→freeze+semver — clean). NARROW the .md generalization: A2/A4 (REVIEWED-50/51) are a counterexample — those were FIX-change-class doctrinal additions to the .md spec that correctly took the heavier patch-supersession+freeze lane, because REVIEWED-50's operative axis was "doctrinal content a successor must be able to trace to a dated marker," not change-class. So for the .md spec the distinguishing axis is doctrinal-traceability; it coincides with change-class for machine-data files (no successor-traced doctrine) but diverges for the constitution. Proposed refinement: "lane tracks whether the change adds/alters successor-traced doctrine" — which reduces to change-class only for machine-data files.
PENDING-47 generalized principle: ratification declined this ruling (relayed text truncated, not read in full). Kept [awaiting jurist ratification]. To close it: relay the FULL principle text as its own item / attached to a future brief.

PENDING-54 — EPUB footnote pre-processor (verbatim-safe conversion stage) + mega-EPUB split-convert

Date: 2026-07-10 Tag: [PROPOSAL] Summary: A new verbatim-safe pre-processing stage for EPUB→canonical conversion: recognize footnote structure in the raw XHTML → inject epub:type / relocate cross-file note bodies → let stock pandoc emit native footnotes (pandoc keeps doing the verbatim text conversion). Replaces the family-of-regexes ("whack-a-mole") chasing pandoc's lossy Markdown output. Includes the proven mega-EPUB path (inject → split by whole files → pandoc-per-chunk → concat) that retires the Calibre fallback for "complete works" sources. Full brief (for the jurist): chamber-library/docs/epub-footnote-preprocessor-FOR-JURIST-2026-07-10.md. Evidence (all reproducible, 2026-07-10): census of all 253 Chamber Sources EPUBs (≥5 distinct footnote strategies + note-free + index apparatus); pandoc's 2×2 blind spots (no-epub:type / cross-file, proven on Kafka/Orwell/Quixote/G&G); prototype verbatim-clean on 4 books (G&G 27 · Mauss 628 · Polastron-fr 140 · Jung 1086 — source-level marker-aware guard, 0 prose added/lost); Calibre shown footnote-blind (byte-identical output with/without injection — it flattens notes, which is the state of the legacy Jung .md); split-convert proven on Jung (1579 docs → 20 chunks, 190s, 1086 native footnotes, verbatim-clean vs the ORIGINAL Princeton megavolume). Change-class: [PROPOSAL] — adds a stage to the governed conversion pipeline and bears on the §V verbatim guarantee; changes no gate's acceptance. Runs the loop. Bears on: §V verbatim guarantee + the conversion-record requirement (converted_with declares the stage). Splitting is conversion-internal — source of record stays the whole megavolume + its sha256 (proven content-neutral). Open questions (brief §7): (1) soundness vs §V — lean-on-pandoc-for-text as the more faithful architecture; (2) proof standard — source-level multiset + structural-order argument, or require a sequence diff; (3) markers-as-apparatus under §V; (4) governance placement (fleet tool + graduation-spec.yaml note); (5) coverage sequencing (ship mirror-class w/ honest-refuse vs hold); (6) mega-EPUB provenance representation — one reconstituted file vs per-volume ("extracted from the megavolume", never posing as a standalone Bollingen edition); governs re-converting the legacy Jung .md (0 notes, pre-spec frontmatter) + likely Donne. Scope boundary: covers the bidirectional-mirror class (same + cross file) today; honest-refuses the rest (one-directional / container / epub3-cross-file). Prototype is scratchpad/uncommitted — nothing touches the chamber pipeline. Files affected (on authorization): new scripts/ tool(s) + graduation-spec.yaml note (converted_with declares the stage) + a §V cross-reference. No gate-acceptance change. Awaiting: Steward authorization + jurist review (touches the conversion pipeline + §V).

RULED IN PRINCIPLE 2026-07-10 (jurist; REVIEWED-54). Architecture sound (§1); markers CONFIRMED apparatus under §V (§2 — settles an assumption clean_epub_residue has run on implicitly; second instance this week of practice ahead of doctrine, opposite direction from PENDING-53); change-class PROPOSAL confirmed (§4 — sharpened test: PROPOSAL if it alters a gate's stated criteria or the trusted mechanism a critical gate's meaning depends on; this inserts a new component into §V's production chain). Ship now for the mirror class, CONDITIONED (§5): the existing regex tools (clean_epub_residue A–D, clean_pandoc_html_residue) stay in place, untouched, as the fallback for uncovered classes — addition, not replacement. Governance placement (§6): yes — fleet tool + graduation-spec.yaml converted_with note.

REQUIRED before canon (§3) — DONE + proven: the verbatim guard was a whole-document aggregate (would miss a cross-note swap); now an id-matched PER-PAIR check keyed by (destination-file, id). Re-proven G&G 27 / Mauss 628 / Polastron 140 / Jung 1086 — 0 mismatch, 0 within-file dup; teeth demonstrated (a deliberate two-note id-swap was caught). Surfaced Jung's cross-volume id reuse (81 collisions under a bare-id key) → fixed by the (file,id) key + a further argument for the split.
§5 wording cleaned in the brief (cross-file mechanism is covered/proven — relocation on Mauss/Polastron; the Orwell/Quixote exact shape isn't a separate fixture yet — "mechanism covers it, not isolated"). No self-contradiction.
§7 Jung provenance — fact-check delivered for steward+jurist (open, non-blocking): the corpus does BOTH — per-volume precedent EXISTS (Alexander Nature of Order 4 files · Lacroux Orthotypographie 2 · Habermas vol-1 · Burney vol-1 · Camus Œuvres I) and single-megafile (Xenophon/Muir/Zhuangzi/Rumi/Levi/Blake/Shakespeare complete). Operative distinction ≈ per-volume citation identity; Jung CW (cited by volume) fits the per-volume side, supporting the jurist's lean. Steward+jurist decide; governs re-converting the legacy Jung .md (+ likely Donne).
Not yet done (post-authorization work): recognizer coverage of the remaining census families (one-directional / container-mirror); semantic per-volume boundary detection (if per-volume chosen); build-in under fleet discipline (test_tools fixtures, spec anchoring); re-convert the legacy mega-books. Steward assigns a PENDING-number-consistent build authorization.

PENDING-55 — Re-scope the REVIEWED-54b remaining footnote work on an accurate census (new nested-block family; (c) is a census artifact)

Date: 2026-07-11 Tag: [PROPOSAL] Summary: A new read-only diagnostic (scripts/audit_footnotes.py, recognizer-truth for coverage) replaced the five throwaway probes and produced a census materially more accurate than the one REVIEWED-54b was ruled on. It changes the un-built remainder of that ruling in three ways, so — per steward direction (2026-07-11) — building is held pending a jurist re-scope: (1) (c) "single-letter marker" is a census artifact — no single-[A-Za-z] book exists; nagarjuna = inner-anchor digit → (b), plato = block-id digit → already COVERED, and donne is a whole-word/phrase lemma-marker book (~2150 notes, exact/block, ~60% exact reciprocity) that is broader than the ruling and removes the marker-shape defense-in-depth; (2) a NEW family the prior census never saw — nested-block (~354 notes: les-fleurs / jaccottet / polastron; note-id on an outer <div>, back-link nested in an inner <p>; exact reciprocity, low risk); (3) the honest blind zone (44 REFS-BUT-NO-RECIPROCITY books) names the real one-directional/container notes (arendt / montaigne / doniger / métamorphoses) among genuine TOC/index non-notes. Full brief (for the jurist): chamber-library/docs/footnote-family-census-FOR-JURIST-2026-07-11.md. Evidence artifact: docs/footnote-family-census-2026-07-11.txt. Change-class: [PROPOSAL] — it re-opens what the REVIEWED-54b conversion-pipeline ruling authorizes building, and bears on §V's production chain (same test as PENDING-54). The diagnostic tool itself is read-only (no gate/spec/verbatim change) and is already built + tested (fleet 83→86) under the steward's "build the durable tool" direction. REVIEWED-54b part 1 unaffected: (a) block-id + (d) URL-decode are landed + verbatim-proven (ef0cee0). This item concerns only the un-built (b)/(c) + the newly-surfaced families. Open questions (brief §6): (1) authorize donne's word/phrase-marker widening under strict exact reciprocity + n=3 spot-check, or hold donne to the regex fallback and drop (c)? (2) nested-block = FIX (extend the block-note pass to search block descendants) or PROPOSAL? (3) blind-zone one-directional/container notes = new families or confirmed honest-refuse? (4) confirm (b) inner-anchor proceeds under its existing FIX ruling; (5) proof standard unchanged (per-pair (dest-file,id) guard + _prove.py verbatim on real books); (6) optional analyzer-precision FIX — expose paired-ref positions from process() for exact per-ref attribution. Files affected (on authorization): the recognizer scripts/inject_epub_footnotes.py + test_tools fixtures + graduation-spec.yaml note, per whichever families are authorized. None touched this session (building held). Awaiting: Steward + jurist re-scope ruling. Building resumes only after.

RULED 2026-07-11 (jurist; REVIEWED-55). The ruling CORRECTS the jurist's own prior REVIEWED-54b (c) sub-ruling — reasoned correctly from data that was wrong; the analyzer stress-test surfaced it one layer up, in an issued ruling, before donne was converted on the false premise. Full ruling: docs/footnote-family-census-JURIST-RULING-2026-07-11.md (relayed). Disposition:

(c) letter-marker — WITHDRAWN in full (incl. the n=3 spot-check condition — no subject left). No letter-marker family exists: nagarjuna = digit/inner-anchor → (b); plato = digit/block-id → already covered by (a).
donne (word/phrase-marker) — DECLINED for this arc. Whole-word/phrase markers are the specific failure condition-4 exists to prevent (indistinguishable from prose by shape; round-trip would carry all the safety weight) — a different risk, not a bigger one, so NOT (c)'s natural extension. The measured 60% exact-reciprocity seals it regardless (partial, self-inconsistent conversion vs a uniform working fallback). Hold to the regex-cleaner path; a fresh PROPOSAL if ever pursued (not a rider). The ~40% non-exact = probable source-side id typos → anchor-hygiene note (logged, not ruled), alongside Sennett cra0001002 → _curation/anchor-hygiene-findings.md.
nested-block (~354) — FIX, same arc. Widen the block-note back-link search from immediate children to descendants — widens where the same unchanged match is looked for, doesn't loosen what matches; same verification/risk as (a). Variants: don-quixote <body>-id = genuine false candidate (TOC≠footnote, leave out); obrist native <aside epub:type=footnote> = confirm empirically through stock pandoc before treating as covered OR gap.
blind-zone one-directional (arendt/montaigne/doniger/les-métamorphoses) — confirmed honest-refuse. No round-trip → nothing for the guard to verify → out of scope by architecture, not omission (machine-converting them = PROPOSAL-class, different first principles). Regex-cleaner fallback per REVIEWED-54 §5.
(b) inner-anchor — FIX stands, scope corrected to INCLUDE nagarjuna. of-grammatology (double inner anchor, symbol) noted adjacent, NOT folded in — its own later look.
proof standard — unchanged/confirmed (per-pair (dest-file,id) guard + verbatim-clean real-book proof, +0/−0 — it's what makes these FIX).
analyzer precision fix — AUTHORIZED, FIX (expose process()'s paired-ref positions; pure additive instrumentation; build soon — would have caught the misclassification pre-ruling). Build UN-HELD for: (b) inner-anchor (incl. nagarjuna) · nested-block · analyzer-precision fix — all FIX under the arc's proof standard. Awaiting only: steward placement of REVIEWED-55 (executor can't write REVIEWED.md — Constraint #1; paste-ready draft in the session ledger).

BUILT 2026-07-11 (chamber b65816a, 3831878):

Analyzer precision fix (FIX): inject_epub_footnotes.process() exposes paired_refs; audit_footnotes attributes coverage exactly per-ref. Regression-proven.
(b) inner-anchor (FIX): PROVEN +0/−0 on kuhn/mbembe/nature-of-things (916 notes); i-ching honest-refused (wrapper-div nesting); nagarjuna exposed a PASS-BUT-FALSELY (its index cites the notes → converting them perturbs the index; source-word guard passed while pandoc dropped body words).
⚠ NEW SAFETY MECHANISM — end-to-end verify (steward-directed, 3831878): bears on the §V proof standard → JURIST NOD OWED. After writing, the pre-processor runs stock pandoc on the original + injected EPUB and compares body-word multisets; ANY non-marker change REFUSES + deletes the output. Turns the guarantee from verbatim-safe by construction → by verification; nagarjuna self-refuses; closes the PASS-BUT-FALSELY class; also compensates the unenforced body_word_conservation gate for footnote conversions. Steward authorized the build under REVIEWED-55's FIX proof-standard clause; surfaced here for the jurist to ratify the mechanism's place in the §V chain.
nested-block — jurist FIX-assumption OVERTURNED by proof (⚠ needs a jurist note): built the widen (search block descendants for the back-link); it PAIRS the notes but converts DIRTY (les-fleurs +828/−1110, jaccottet marker-merge, polastron +202/−2756) — pandoc won't cleanly lift a <div class="note">-wrapped same-file def; same PASS-BUT-FALSELY class as i-ching/nagarjuna. The end-to-end verify catches it (vindicates it). "Widen the search = same as (a)" doesn't hold empirically. REVERTED to 3831878 (the recognizer must not pair what it can't convert clean). Recommend nested-block joins the honest-refuse set (regex fallback), like i-ching. Second ruling-assumption this arc overturned by the proof (after (c)).
obrist native-<aside> — empirically a GAP: stock pandoc emits 0 native footnotes from its <aside epub:type="footnote">; 16 notes, low priority → regex fallback (not covered, not a build target now).
DONE this arc: analyzer-precision fix + (b) inner-anchor + end-to-end verify (all 3831878/7bf438a, both remotes). nested-block + obrist → honest-refuse.
JURIST RULED 2026-07-12 (docs/end-to-end-verify-and-nested-block-JURIST-RULING-2026-07-12.md, relayed & archived):
- Q1a — end-to-end verify RATIFIED, FIX-class on a refined test: a new §V-chain component is FIX (not PROPOSAL) when it (i) only ADDS refusals, (ii) never alters text, (iii) falls back to an already-trusted path. This satisfies all three.
- Q1b — MANDATORY at graduation now (--no-verify forbidden at graduation while body_word_conservation is unenforced) and should PERSIST after that gate lands (defense-in-depth: catch at conversion-time, attributed to source). + RETROACTIVE re-verification REQUIRED over everything landed under the per-pair-only standard (mirror/split-anchor/block-id/URL-decode) before treating it settled.
- Q1c — marker-exclusion must be POSITIONAL. ✅ DONE (e8eeea7): was shape-only; now subtracts only the exact converted marker tokens (converted_markers), superscript-normalized; a dropped prose number is caught though digit-shaped; clean books hold, nagarjuna refuses on real corruption only.
- Q2 — nested-block FIX RETRACTED, honest-refuse CONFIRMED. Fresh PROPOSAL required if ever revisited (unwrap-the-div is a different approach). Jurist named its own reasoning gap ("same risk as (a)" was true of matching, silent on rendering) + generalized: no widen ruled FIX-and-final on structural reasoning alone; structural safety = provisional FIX, end-to-end verbatim proof on real books = final.
- Broader flag (jurist): body_word_conservation declared-but-unenforced is the same gap-shape PENDING-52 closed, recurring in a second subsystem → worth renewed attention beyond this arc.
DONE: Q1c positional (e8eeea7); Q1a/Q2 archived.
Q1b RETROACTIVE — MAJOR finding (6c9ca43, evidence docs/retroactive-verify-2026-07-12.txt): 87 covered books · 42 CLEAN · 45 DIRTY (pass per-pair guard, corrupt under real pandoc). Verified real (5 known-clean → CLEAN; _prove.py agrees). 29 catastrophic (montaigne +385457, red-book −7835, pascalian +5910, gadamer/donne/tolkien…; false-pair relocation = nagarjuna at scale) + 16 marker-adjacency (prose intact, markers glued). CORPUS SAFE: 0 canonical files use the pre-processor — NONE graduated; caught pre-graduation; mandatory verify refuses all 45 → fallback. Recognizer's reliable coverage ≈42/87. ⚠ NEW DECISION for steward+jurist: improve the recognizer (tighten over-pairing) vs accept 42-clean + fallback-for-the-rest. Not resolved this session.
OWED (steward, tomorrow): REVIEWED-55 + follow-on placement; wire "mandatory-at-graduation" (graduation flow must not pass --no-verify); weigh the recognizer-maturity decision above.

PENDING-56 — Canonical format decision: adopt Docling + complete MD-canonical + TEI-mirroring structural sidecar

Date: 2026-07-12 Tag: [ESCALATE] architectural — canonical format (seed brief §10.3, deferred as steward-pending). Steward-decided provisionally on the trial evidence; jurist ratification requested (brief relayed). Summary: Adopt Docling as the EPUB/PDF/scan conversion front-end (with our verify gates unchanged on top), and complete the already-chosen Markdown-canonical + .meta.json structural-sidecar architecture — giving the sidecar a TEI-mirroring vocabulary so a future TEI migration stays mechanical. Rationale: A steward-driven reframe established that the substrate (conversion/format/citation) is a solved, adoptable domain (Docling/GROBID/TEI/DTS) while the composition (voice-attributed verbatim consultation = the engine) stays ours — and that ~20 bespoke conversion tools were reimplementing it. A four-tier Docling trial (steward-run, M4+M1) confirmed: value scales with layout richness — cleans EPUB (0 cruft, was 888 calibre_link/364 fn-ids), rich structure+provenance on PDF (2 798 page-provenanced items), and crosses the A3 OCR frontier on a scanned French book (104 footnotes, 664 provenanced) that ocrmac cannot. Docling is a converter, not a verifier — the trust gates (verify_body_conservation, normalize_ocr verbatim-guard) stay, converter-agnostic. Options: A — MD-canonical + TEI-mirroring .meta.json sidecar (tractable now; completes the chosen half-built direction; human-inspectable; keeps TEI open). B — TEI now (native to apparatus A5 / anchors B2 / DTS, but a full TEI toolchain before any corpus work resumes). C — split (TEI for Loeb, MD+sidecar for the rest; two consumers, cuts against uniformity). Full analysis: chamber-library/docs/canonical-format-decision-FOR-JURIST-2026-07-12.md. Recommendation & steward decision: Option A + Adopt Docling — selected by the steward on the evidence (2026-07-12, via AskUserQuestion). Reasoning: unblocks execution now, covers the v1 telos (verbatim/provenance/structure/anchors), preserves inspectability, keeps TEI migration mechanical. The one flip-condition (for the jurist to test): if the v1 engine needs structured critical apparatus (A5) as data or DTS-interoperable citation, revisit toward Option B/TEI. Read: both are later/scholarly needs, not v1 blockers. Files affected (on execution): conversion runbook + graduation-spec (Docling front-end; sidecar as graduated structural layer) — a v2.x amendment, change-class PROPOSAL; new .meta.json sidecar extractor; ocrmac_pdf/EPUB cruft-strippers retired; reprocess track B reshaped to Docling→sidecar-extract→verify→graduate. Awaiting: ~~Jurist ratification~~ JURIST RATIFIED 2026-07-12 — Option A + D1, on independently-verified reasoning (flip-condition tested directly, NOT triggered for v1: voice-manifest = interpretive-persona not manuscript-variant; the corpus's strongest TEI case, Loeb, needs anchors [B2, which A provides] not apparatus [A5]). Two schema-gating questions CLOSED with substrate evidence (brief §8): Q1 — Docling emits flat reference-links not native footnotes (0 [^N], 48 [*](#…), epub_backend ignores epub:type) → the footnote-recognizer arc is REPOSITIONED as the sidecar's note-extraction layer, not retired; Q2 — the Loeb DSL is typed ([c dimgray]/[c darkmagenta]/[sup], 2.15M+ spans) and the current extractor flattens it → CARDINAL PRINCIPLE set before schema lock: the extractor PRESERVES source typing into typed sidecar fields, never flattens a source-structured distinction to prose (makes TEI-migration mechanical-by-construction). REVIEWED-56 can be placed; sidecar schema unblocked to finalize on these two principles. (Parallel governance still owed: REVIEWED-55 placement.)

PENDING-57 — Enforce `body_word_conservation` at graduation (the converter-agnostic verbatim trust gate)

Date: 2026-07-12 Tag: [PROPOSAL] Summary: Wire the built verify_body_conservation.py into the graduation gate so graduation ENFORCES the verbatim guarantee (currently body_word_conservation is listed in graduation-spec.yaml line 136 but verify_graduation.py does not enforce it — general non-footnote graduation has no automatic verbatim backstop). Rationale: The trust foundation the whole reprocess stands on, and converter-agnostic — it certifies verbatim fidelity whether text came from Docling, pandoc, the Loeb DSL extractor, or OCR. Every tier's reconvert (Loeb B2, the EPUB/PDF Docling reprocess) graduates through it; without it "verified" is asserted, not checked. The PENDING-52 follow-on the jurist flagged twice; named in REVIEWED-55 as the gap "now addressed by PENDING-56." Method (per-tier, already RATIFIED by the register's §Tiering&Fence): V-DSL (Loeb) = re-extract deterministically + no-fabrication vs the DSL source; V-TEXT (born-digital) = re-convert + prose-word guard (BUILT — caught jacobs 888 / manguel 2856 / montaigne fn-id residue that audit_cruft missed); V-SCAN = abstain (no ground truth; honest "cannot verify", never a false PASS). Three-tier verdict gates: FLAG blocks · REVIEW holds for curator drop-vs-keep identification · PASS proceeds. Options: (a) enforce all three tiers now; (b) enforce V-TEXT now (built) + wire V-DSL with the Loeb reconvert + V-SCAN abstain. Recommend (b) — lands the built path immediately, wires V-DSL where it's first needed (the Loeb run), no false claims on scans. Full brief (for the jurist editor-gate): chamber-library/docs/verbatim-gate-enforcement-FOR-JURIST-2026-07-12.md. Change-class: PROPOSAL — inserts a new blocking check into the graduation gate. Runs the amendment process (executor drafts → jurist editor-gate → steward ratifies → land by supersession into graduation-spec.yaml + verify_graduation.py). Does NOT change the convention checks, the §V guarantee text, or any tier's evidence-class; V-SCAN gains an honest abstention, not a new claim. Files affected (on ratification): verify_graduation.py (add the per-tier body-conservation gate), graduation-spec.yaml (make the listed gate enforced + declare the per-tier dispatch), verify_body_conservation.py (V-DSL re-extract path — BUILT), plus a retroactive-sweep producing a remediation queue across the already-graduated corpus (§6 below). UPDATE 2026-07-12 (jurist PARTIAL ruling + executor response):

Jurist RATIFIED the architecture (FLAG/REVIEW/PASS mapping, V-TEXT, V-SCAN abstention, change-class PROPOSAL — distinct from the REVIEWED-55 refusal-only-FIX exception because a FLAG/unresolved-REVIEW has no already-trusted fallback route to canon). Withheld final ratification pending a V-DSL DEMONSTRATION (his lesson: simpler-sounding architecture doesn't get trusted a third time on sounding simpler).
V-DSL now DEMONSTRATED (§3.5 of the brief) — the demo vindicated the caution: naive reuse of the V-TEXT k-gram check FALSE-FLAGGED a clean Apollonius (1070 "fabrications", only 6 truly-new = the MD subtitle; the rest = coverage misses from the DSL→MD REFLOW). Corrected → reflow-tolerant word-multiset on source-content body: Apollonius (verse) fab=0 PASS · Plato Gorgias (prose) fab=0 PASS · injected fabrication → FLAG with teeth. Fleet fixture added (test_tools 105→109). Honest residual: fabrication half gate-ready; content-vs-boilerplate DROP side delegates to extract_loeb_dsl's integrity report.
Provenance verified (jurist flagged the "already RATIFIES" claim): spec v2.0.0 §Tiering & Fence IS ratified (RATIFIED-SHAPE · OPERATION-BLOCKED) — this PROPOSAL is the un-blocking; the dispatch is confirmed, not originated.
§6 RETROACTIVE clause FOLDED IN (steward-directed, rule together): on ratification the gate runs BACKWARD across graduated canon (V-DSL 952 · V-TEXT 239), diagnostic-first → a remediation queue (FLAG=re-verify→reconvert; REVIEW=curator; PASS=re-attest), NOT silent de-graduation. Motivated by the jurist's 3-for-3 (jacobs/manguel/montaigne all graduated-clean, all failed the new check). Companion efficiency noted (not a condition): the LOCKED sidecar's placement:back+role resolves the REVIEW-tier endnotes-keep/index-drop ambiguity declaratively for any book carrying a sidecar. UPDATE 2026-07-12 (jurist FINAL ruling — RATIFIED on 2 conditions; both now addressed):
Jurist RATIFIED the whole PROPOSAL — architecture, V-TEXT, V-SCAN, V-DSL's fabrication half (now genuinely demonstrated), and the §6 retroactive sweep (well-precedented by REVIEWED-55's own sweep). Two conditions + one flag:
Condition 1 (V-DSL loss half) — ADDRESSED: the jurist noted loss delegated to extract_loeb_dsl's self-report without the fabrication half's independent injection proof → route loss to REVIEW until a loss-injection test closes the asymmetry. Built the independent loss teeth + demonstrated: boilerplate-vocab classifier → clean Apollonius lost_content=0 PASS; drop a content word (banquet) → FLAG naming it. Fleet fixtures both sides (test_tools 105→111). Honest bound stated: blind to a dropped occurrence of a boilerplate-vocab word (count masked) — the narrow edge the jurist's REVIEW-routing guards; his call whether demonstrated-teeth suffices for auto-PASS or REVIEW-routing is kept for that edge.
Condition 2 (43-book census gap) — CONFIRMED: census = V-DSL 952 · V-TEXT 239 · V-SCAN 50 · V-SUSPECT 29 · V-NONE 14 = 1,284; the 43 = V-SUSPECT+V-NONE = the fenced-out tier (no confirmed source) → correctly EXCLUDED from the conservation sweep (can't re-verify a book with no source). Not a gap; the fence working.
Brief updated (§3.5 loss teeth + §6 census). Change-class PROPOSAL confirmed (distinct from REVIEWED-55's refusal-only-FIX: a FLAG/unresolved-REVIEW has no already-trusted fallback to canon). Awaiting: jurist confirmation the two conditions are closed (+ his call on loss auto-PASS vs REVIEW-routing for the masked-vocab edge) → steward ratification (REVIEWED-57) → land by supersession into graduation-spec.yaml + verify_graduation.py.

CLOSED 2026-07-13 (REVIEWED-57 AUTHORIZED — fully ratified across three jurist rounds). Gate WIRED into graduation as its own source-in-hand step body_conservation_gate() (cdb3454). §6 retroactive sweep RUN over all 952 Loeb → the corpus-health map (d9f6880/9afb0cf). Follow-on same day: the 18 body-deficit cause-analysed by reading the missing spans → three remedy tracks (re-match 8 / re-extract 4 / re-verify-and-reconvert 12); a wrong-match-by-fabrication classifier rule + the 2 REORDER? books resolved (both wrong/partial-key, CLEAN on re-match) → REORDER? dissolved to 0 (eb21eca/836b665/c54edbb). Nothing further awaited on PENDING-57. The reprocess itself (matcher fix → the 2b sidecar-wiring amendment gated on the steward's Loeb-first-vs-full-corpus call → B2 ②+③) is downstream work tracked in the session files + chamber-library/docs/chamber-program-open-work.md, not here.

PENDING-58 — 2b: Wire the Loeb structural sidecar into graduation (V-DSL tier) on its OWN merits (`notes[]` · `anchors[]` · structural typing) — the reconciliation corollary REFUTED and struck

Date: 2026-07-13 (original filing) · REWRITTEN 2026-07-14 (corollary refuted on the record; steward-directed rewrite-not-withdraw). Tag: [PROPOSAL] — change-class PROPOSAL (changes what graduation PRODUCES; per chamber CLAUDE.md "FIX→PROPOSAL when it changes what a gate accepts"). Jurist editor-gate → steward ratification (REVIEWED-58), FRESH — the prior editor-gate ruled on the struck corollary's shape and does NOT carry.

WHY THIS IS A REWRITE, NOT THE ORIGINAL: The original PENDING-58 hung on a reconciliation corollary — multiset(DSL-full) == multiset(candidate_body) ⊎ multiset(app[]) — which would have turned the corpus-health map's magnitude-diagnosis ("apparatus-shaped") into a mechanical fact (reconciles→apparatus / doesn't→body, no eyeballing). That corollary is REFUTED and struck — not renamed, not quietly dropped (steward + jurist explicit: a filing that drops its central justification and keeps the conclusion is what this process exists to prevent). The sidecar wiring never depended on the corollary; the corollary was a bonus hung on it. This rewrite argues the remaining, untouched case on its own merits.

THE REFUTATION, on the record (evidence: 2026-07-13/14 session ledger; the demonstration scratchpad/proto_reconcile.py + decompose_v2.py; jurist rulings docs/2b-sidecar-wiring-jurist-*-2026-07-13.md): · The proof condition (demonstrate on real books before crediting) did its job — on 3 real books the literal reconciliation does not hold: app[] covers only 5–40% of the m_lost deficit, and new_body is token-identical to old_body (the B2 builder recovers the deficit into neither body nor app[] — the DSL's "missing" tokens are in neither channel). · Decomposition (contiguity via _uncovered_runs + a reorder-immune multiset-ratio guard + reading the tail; validated on Oeconomica's proven 202-token Book-II drop and Catullus's 14,840-token translation block) shows the m_lost deficit is not flattened apparatus — it is running-header/reflow count-drift on common words + editorial paratext (introductions) + small real loss, none of which a structural sidecar captures or was meant to. · THE DEEPER FINDING (steward-named as the primary carry-forward, bigger than this amendment): the corpus-health map's buckets are magnitude-shaped groupings that cut across the actual causes, not clean causal partitions. loeb-aeschylus-persians is labeled BODY-DEFICIT yet its loss is dramatic apparatus (speaker labels ειδωλον 22→1, ξερξης 43→1, χορος 70→21 — verified real loss, ratio 1.03, not displacement); apparatus-shaped books are 74–90% benign drift with small real-loss tails. Because a "body-deficit" book can be losing apparatus and an "apparatus-shaped" book can be mostly drift, no mechanical app[]-reconciliation could ever have discriminated apparatus from body — the entanglement is in the buckets themselves. The decomposition survives only as an evidence-backed, human-judged diagnostic, never a mechanical gate. (This finding likely warrants a note on the map's own interpretation — open sub-question below.)

Summary (the remaining proposal): For the V-DSL (Loeb) tier only, make graduation produce + validate the .meta.json structural sidecar via build_loeb_sidecar.py, earning its keep on the fields that stand on their own — notes[] (footnote ref↔body pairing), anchors[] (the Loeb citation system: line-anchors, Bekker/Stephanus refs, page markers), and structural typing (sections, editorial-insertions, tables/glyphs, the unrecognized safety-net) — under per-field trust gating (below). The reconciliation instrument is struck; no corpus-health map gets "verified" by this amendment.

WHY THE REMAINING CASE STANDS (argued fresh, not inherited): · notes[] — already-proven footnote work (PENDING-54/REVIEWED-54 pre-processor + B2 pairing; genre-heterogeneous, honest-flagged). Independently valuable to the engine's apparatus layer. · anchors[] — the Loeb citation system, load-bearing for the engine's addressing whether or not any map is ever verified. The field with real downstream risk (see condition 1). · structural typing — the preserve-never-flatten value (REVIEWED-56): typed structure the engine wants regardless of the map. These merits are untouched by the corollary's failure — which is exactly why the steward ruled rewrite, not withdraw.

TWO CONDITIONS THE REWRITE MUST CARRY (they would otherwise vanish with the corollary): 1. anchors[] spot-check — a LIVE pre-condition (steward-flagged). Before anchors[] is trusted as the engine's citation layer, spot-check a sample against the source: does anchor N (line / Bekker / Stephanus) point to the passage it claims? A wrong number is the engine citing the wrong passage with confidence — the highest-consequence failure in the whole sidecar. anchors[] is PRODUCED at graduation but NOT trusted-for-citation until this clears.

RUN 2026-07-14 — FAILED as-built (evidence: docs/2b-sidecar-wiring-FOR-JURIST-2026-07-14.md §4; scratchpad/anchor_spotcheck.py). On Aristotle NE the anchors capture Loeb section-subnumbers (3305/3333 are ≤40, resetting per chapter) and drop the Bekker citation axis — which IS in the source (dimgray '1094 a' cues), rejected by the extraction's digit filter. Ground-truth: Bekker 1094a opening → anchor ref=3. anchors[] needs a per-scheme numbering parser (Bekker/Stephanus/line, distinctly typed) before it bears the citation claim. Per the steward's logic (sample not clean → blocker), this condition is a BLOCKER; the amendment's shape is now open for ruling (brief §6). The rewrite's framing of anchors[] as a standing merit is accordingly downgraded to potential, pending the parser — the amendment's live merits are notes[] (proven) + structural typing. 2. Per-field gating — with the corollary struck, app[] has NO proof condition at all. Each field earns its own trust; app[] does not inherit trust from notes[]/anchors[] merely by sharing the file. Trust states: notes[] = trusted (proven) · anchors[] = trusted-after-spot-check · sections[]/provenance = produced (low-risk) · app[] = PRODUCED-BUT-UNCREDITED (verbatim + typed + unrecognized-safety-net, but no proof condition met — never credited into any gate; a future amendment adds one if a use needs it). This preserves the PENDING-57 posture (body_conservation_gate gets NO apparatus credit) — now for the honest reason: not "pending the reconciliation," but "app[] has no proof condition, full stop."

Options (current — the reconciliation options are moot): (a) wire the sidecar to PRODUCE the fields under per-field gating; anchors[] trusted-for-citation only after the spot-check; app[] produced-but-uncredited; no reconciliation instrument (RECOMMEND). (b) withdraw the amendment entirely (REJECT — steward-ruled: the notes[]/anchors[] merits stand untouched by the corollary's failure; withdrawal would discard proven, independently-valuable work).

Change-class boundary — what this does NOT change: LOCKED sidecar schema (additive-only); the verbatim guarantee; any tier's evidence-class; V-DSL/V-TEXT/V-SCAN dispatch; the general-tier path (Loeb-only). It ADDS: a V-DSL sidecar produce+validate step at graduation under per-field trust gating, and the anchors[] spot-check as a pre-condition on citation-trust. It REMOVES from the prior filing: the reconciliation instrument, the app[]-credit-into-body_conservation_gate path, the 128-demonstration-as-gate.

Files affected (on ratification): _curation/graduation-spec.yaml (name the sidecar as the graduated structural layer for V-DSL; declare the produce/validate step + per-field trust states); scripts/graduate_to_canonical.py (produce+validate the sidecar beside body_conservation_gate, NO apparatus credit); scripts/build_loeb_sidecar.py (the graduation entry point — a 1-commit, self-stamped v0 prototype carrying one substantive fleet test incl. the unrecognized fail-loud check; wired, not modified); a NEW anchors[] spot-check instrument + its sample result; _curation/conversion-runbook.yaml. No reconciliation instrument.

History (superseded, preserved — not archived away): the original corollary filing + its jurist editor-gate + rationale-correction live at docs/2b-sidecar-wiring-jurist-editor-gate-ruling-2026-07-13.md + docs/2b-sidecar-wiring-jurist-rationale-correction-2026-07-13.md + git history + the 2026-07-13/14 ledger. The refutation is recorded above, in the open.

Awaiting: jurist editor-gate + steward ratification (REVIEWED-58), fresh. Open sub-questions for the ruling: (i) is "produce-but-uncredited app[]" the right posture, or should app[] not be produced at all until it has a use + a proof? (ii) is the anchors[] spot-check a ratification pre-condition (block until it clears) or a fast-follow after wiring? (iii) does the entanglement finding warrant a standing note on the corpus-health map's interpretation (its buckets are magnitude-shaped, not causal)?

277 KiB Raw Blame History Unescape Escape