> JUDGEMENT RULES sub-index — split out of MEMORY.md 2026-08-19 against the read-limit cliff
> (MEMORY.md was 21.9KB against a 24.4KB limit; past it the TAIL IS SILENTLY DROPPED). Entries
> below are VERBATIM, in original order, ZERO dropped — a move, not a compaction. The nag to
> COMPACT MEMORY.md is still refused: growth is handled by splitting a whole section out to a
> sub-index like this one, never by dropping a pointer.
> Read this BEFORE reasoning from a measurement, reporting a figure, or clearing any claim:
> these are the rules you OBEY. MEMORY.md keeps the pointer; the craft is here.

## Judgement rules (binding)
- [two greps over two files print ONE stream](two-file-grep-output-reads-as-one-file.md) 2026-09-10 doyle: ci.yml had zero hits, so golden.yml's `:619 xtask check` read as ci.yml's and I argued the thin lane ran it; line > wc -l was the tell I skipped. More than one path in a grep => -H, read the filename column first.
- [a trap entry without its CONTROL teaches only the symptom](a-trap-entry-without-its-control-teaches-only-the-symptom.md) ⭐ 2026-09-09 with hertz: we both banked only the failing check-ignore row and both wrote 'avoid the bad spelling'. Two dirs that ARE ignored, SAME trailing slash, also exit 0 — but with a POPULATED pattern field. Exit code carries zero information across the pair; one field carries all of it. Run the case that should SUCCEED and bank it beside the failure.
- [a duration over a TIMEOUT is not a stretch](duration-over-a-timeout-is-not-a-stretch.md) ⭐⭐ called 33.65s-vs-3.53s a 10x stretch; `RECONNECT_WINDOW`=30s, so 33.650−30=3.650 against a 3.530 pass, residual **0.120s** — normal run that SPENT a timeout, never slow. Subtract the constant; never compare against the fast case (identical-looking, different question). It was the HEADLINE of my specimen packet, so three agents hunted load: doyle logged an x40 sweep, todlando instrumented heavy-proc counts per run, hertz burned **92 runs** + an H1 probe killing it — incl. a **34.957s PASS**, same duration class, opposite verdict ⇒ duration was never the variable. Timeout-spent ≠ starvation: different KIND, which is why no load level reproduced it. ⚠ 2nd instance 2026-08-28 (v0.64.0), MINE AGAIN and I did not apply my own rule: framed a 3.649s fail vs 0.106s pass as a **34x asymmetry** in a referral — the comparison, not the subtraction. `KILL_CONFIRM_MS=2000` ⇒ 3.649−2.000=1.649s of spawn/verify overhead: confirm window SPENT, at budget. doyle did the subtraction and it bought the ruling (test binds tighter than a retryable-by-design contract). Grep the path for its timeout constants BEFORE a duration pair becomes a referral’s headline.
- [measure, don't direct](report-measurement-never-issue-direction.md) ⚖ doyle gates; agreeing IS direction.
- [purge needs store root from source](purge-dispatch-needs-store-root-from-source.md) ⭐⭐ dispatched a purge on an ASSUMED root; subject was TempDir-per-run = disk-hermetic, nothing to purge, blind act would hit fleet state. Read the root from source + the run's own logs BEFORE any deletion dispatch.
- [precise > vague](precise-claim-is-falsifiable-vague-is-useless.md) ⭐⭐ · [rig red on purpose](make-a-new-rig-red-on-purpose.md) ⭐⭐ negative control FIRST · [verify the SUBJECT](verify-the-subject-not-just-the-measurement.md) ⭐⭐ ancestry before ANY green.
- [a branch you WAIT on gets read by ref, not ancestry](waiting-branch-read-by-ref-not-ancestry.md) ⭐⭐ waiting frames it as a FUTURE object, so you check the sha for movement and never ask if it already LANDED; a merged lane's source ref is identical to an untouched one. Ran ancestry on six of my own lanes, not on the one I was blocked on — it was in main AND in the shipped tag.
- [a source read is a claim about a TREE](source-read-needs-its-sha-and-ancestry.md) ⭐⭐ `rev-parse HEAD` + ancestry vs golden BEFORE reporting; I root-caused a real ABA already fixed at the tip, and a peer "confirmed" it on the SAME stale sha.
- [stable anchor ≠ recycling defense](stable-anchor-is-not-a-recycling-defense.md) ⭐⭐ anchoring picks a longer-lived pid; longevity ≠ identity. Comment asserting a defense = claim about a FIELD — check the struct.
- [flag presence ≠ flag effect](create-no-window-inert-under-detached-process.md) ⭐⭐ `CREATE_NO_WINDOW` INERT under `DETACHED_PROCESS`; a comment asserting behavior is a claim. Source can't decide flag interaction — only an OS differential. INVERSE arm now filed too: `windowless` MASKS `DETACHED_PROCESS` OFF at the call site, so the child owns a console and a conhost joins its parentage — read the call site's mask, never the named constant. ⚠ count windows with EnumWindows, not MainWindowTitle (reads 10 as 1).
- [probe an UNMODIFIED subject](probe-an-unmodified-subject-needs-no-baseline.md) ⭐⭐ references nothing you edited ⇒ measures the TOOL, no baseline arm, no shared-checkout mutation.
- [refute a BYPASS by visibility, not audit](refute-a-bypass-by-visibility-not-by-audit.md) ⭐⭐ "some caller skips the chokepoint" dies on the DECLARATION — a module-private fn's in-module callers ARE the population. Audit says "I found none"; visibility says "none CAN exist". Corollary: **atomic ≠ preserving; only a read-under-hold preserves a field**.
- [predicate needs its tool](a-predicate-without-its-tool-is-not-evidence.md) ⭐⭐ root+dialect+tool+**population** · [probe competence](verdict-from-probe-competence.md) ⭐⭐ a filter that can't express the hunt returns a clean zero · [token from the failing frame](announce-token-from-the-failing-frame-not-the-register.md) ⭐⭐ derive the grepped diagnostic from the panic frame's own emit sites, never from the register entry discussing the symptom.
- [source-side qualifier ≠ output-side qualifier](source-side-qualifier-is-not-an-output-side-qualifier.md) ⭐⭐ a comment explaining a logged constant serves the CODE reader, never the LOG reader the breadcrumb exists for; ask which audience the ruling meant. Test is WITHIN-SITE AMBIGUITY (doyle): a marker is owed only where a field has >1 meaning AT ITS OWN SITE — `from_seq` can be a real floor or a hardcoded 0 so `cold=true` is earned; `gen` is constant 0 there so the site token IS the marker. ⚠ my dichotomy ("either cold=true is redundant or gen needs it") was WRONG — a third branch dissolved it. Argue from an asymmetry the author's code commits to, but present it as a QUESTION, never as exhaustive horns.
- [presence under BOTH outcomes refutes the ARGUMENT, not the cause](presence-under-both-outcomes-refutes-the-argument-not-the-cause.md) ⭐⭐ doyle dissolved the audit-burst lead because bursts were "present under green runs" — invalid: bursts were NECESSARY-not-sufficient, so both-arms presence is what the TRUE-cause hypothesis predicts too. Settled by a same-box same-window pair 5 min apart: light `unit` leg GREEN, heavy SERIALIZED Phase B leg RED, bursts under both — what the leg DID was the variable (60s audit_backlog_wait_time vs 0.824s cells dying at 62.7s). EXACT MIRROR of [[discriminator-question]] #9: absence-based and presence-based reasoning fail the same way, opposite directions. Ask "sufficient alone, or needs a partner?" before clearing anything; retracting an ARGUMENT ≠ impeaching a MEASUREMENT.
- [healthy path emits the SAME silence](healthy-path-emits-the-same-silence.md) ⭐⭐ read 1 submit/900s as "no round closed"; healthy emits exactly one too (conn caches, never re-dials) — 709 closed rounds under the same token set. Absence-based stall claims assume the healthy path is LOUD; derive healthy's emission from the emit sites first, else find a discriminator (heartbeat, brackets) and measure it.
- [flake timing bimodality is RIG ARITHMETIC](flake-timing-bimodality-is-usually-rig-timeout-arithmetic.md) ⭐⭐ 4 fails at 60.9–65.5s vs 16 passes at 5.8–10.0s carried as an open question wanting a mechanism; it was the failing arm's own `45s + 10s` polls, `55 + [5.8..10.0]` closing to 0.5s. Sum every `from_secs` on the failing path BEFORE theorising, and check spawned-vs-awaited — concurrent bounds do NOT sum, which is how one band held two different faces and discriminated neither. Close the question, don't leave it as atmosphere.
- [absence needs a sibling probe](absence-needs-sibling-probe.md) ⭐⭐ **an absence is data only if the thing has a way to APPEAR** — 2026-08-29: no seat-release breadcrumb exists in broker.rs at all, so the log's silence about a release was never evidence; deployah's twin, same day, same entry: a missing READ VERB (no pid field on `endpoint list --json`) is not a missing behaviour. Name the emitter/field/verb that WOULD have shown it, or you have no measurement. Upstream of the sibling probe: that proves the channel works, this asks whether it EXISTS. · [one sample ≠ negative](one-sample-is-not-a-negative.md) · [cancelled = labelled hole](cancelled-measurement-leaves-labelled-hole.md) · [start event ≠ nothing ran](start-event-is-not-proof-nothing-ran.md) · [exit not silence](verdict-from-exit-not-from-silence.md).
- [a defect can be ASSERTED by a passing test](defect-can-be-asserted-by-a-passing-test.md) ⭐⭐ #197's codeless-spends-an-attempt bug was pinned by a green broker cell tagged `[unit->]` the very REQ it broke, plus the WIRE DOC and an rc comment — three encodings of one wrong rule. A pre-existing green reddened by your fix is a FINDING: read its comment + REQ tag, MOVE the cell with its requirement (never delete, never weaken the fix), sweep every other encoding, and tell the gater — it is what makes a REQ MOVE rather than sharpen.
- [audit boring claims](audit-the-boring-claims.md) ⚖ discipline skipped where you expect AGREEMENT · [name file AND sha](name-the-file-and-sha-a-condition-came-from.md) ⭐⭐ a shared noun ≠ a shared claim.
- [a hand-off's PASS list names gates RUN, not gates OWED](relay-pass-list-names-gates-run-not-gates-owed.md) ⭐⭐ three green gates read as "fully gated"; the one NOT named was `xtask check` (docs-drift) on a head whose largest change class was FOUR doc commits. Same tool name as the gate that WAS run (`xtask binedge-check`), so the eye scores it present. Derive the gate population from the HEAD's change classes, diff against what the hand-off names, run the difference. ⚠ and run it UNPIPED — piping to `tail` made my captured `$?` the pipe's, not the gate's.
- [silence on the HEALTHY path is not evidence of a stall](silence-on-the-healthy-path-is-not-evidence-of-a-stall.md) ⭐⭐ a whole RCA + 2 approved lanes rested on "one PUMP_DIAL_SUBMIT in 900s ⇒ no round closed"; the instrumented re-run emitted ONE submit with 709 CLOSED rounds under it — the repeat is suppressed by SUCCESS (conn cached ⇒ never re-dialed). Whole token set was byte-compatible with health. Open the emit site and ask what suppresses the second print BEFORE proposing a mechanism; instrument the silent arm.
- [a log token names its POPULATION, not the subsystem](log-token-names-its-population-not-the-subsystem.md) ⭐⭐ 11.7/s of `CONN_LIFECYCLE` was `role=brain` BROKER-IPC (`conn.rs:270`), not the net-presence feed my probe arm was built to load — the rate belonged to a different wire. Over-claimed in BOTH directions in ten minutes: the same token also cannot support "therefore zero net conns", since a net conn emits none. Grep the emit site and name what it counts AND what it cannot, before the count enters an argument.
- [a base rate counts CELL executions, not SUITE runs](base-rate-is-over-cell-executions-not-suite-runs.md) ⭐⭐ "fired once in all runs" was computed over runs that never CONTAINED the cell; its real record was 2 executions / 2 failures, i.e. structural wearing a flake's rate and buying a rerun. Cells whose lane DEFERRED int to the gate have a denominator of one before their first gate. Ask what the denominator contains, say it out loud ("two executions, two failures"), and put it as a question against the premise — mine was confirmed with a mechanism and flipped a rerun into an operator escalation.
- [absence-of-the-wrong is NOT presence-of-the-right](absence-of-the-wrong-is-not-presence-of-the-right.md) ⭐⭐ a respin head is TWO independent claims — the discarded shape is not an ancestor, AND the fix's sha IS one with its evidence in the tree. Each is satisfiable while the other fails (clean of the bad base but missing the fix; carries the fix but stacked on the shape thrown away), and NEITHER leg detects the other's failure, so running one and inferring the other is how a respin ships looking correct. CONDUIT/#236 2026-08-29: deployah's intake proved 110d1751 absent, I ran the complement (27a14c1c IS ancestor of 0c17eb09 + all four cell fn names read OUT OF THE TREE at that sha — an ancestor sha does not prove a later commit didn't revert its content). Name both arms separately in the report.
- [a prior red LENDS the next one an unearned cause](a-prior-red-lends-the-next-one-an-unearned-cause.md) ⭐⭐ a CORRECTLY diagnosed red traps the run after it: once "the last one was the floor" is on the record, the next red arrives with a free, pre-approved explanation that costs nothing to reach for — it feels like continuity, not laziness. CONDUIT 33223968222: the floor red skipped checkout, so the WHOLE Windows surface at the composed head became first-execution on the rerun — the right diagnosis of red #1 is exactly what made red #2 likelier to be structural AND likelier to be waved off. deployah pre-committed "structural-until-shown-otherwise, and specifically NOT 'the last one was environment'" BEFORE any verdict existed; written after, the same sentence is a rationalization. ⚠ I have already made this error (#170: five reds called environment without varying anything, and measuring AGREED — a right guess teaches the method that produced it). Pre-registration sets the default; the delta test decides the fact. ⭐ THE DATE IS EVIDENCE: a pre-registered rule and one chosen to fit an outcome are TEXTUALLY IDENTICAL, so record the clock AND the open question (here: attempt 2 queued, doyle ratified queued) or the pre-registration decays into a bare assertion on re-read.
- [hedge ≠ grounding](hedging-classification-is-not-grounding-the-observation.md) · [intermittent green = zero info](intermittent-green-is-zero-information.md) · [ruling rests on a premise](ruling-rests-on-a-premise.md) · [no post-op sha = prediction](confirmation-without-postop-sha.md) · [no version floor pre-ship](no-version-floor-before-it-ships.md).
- [cfg-gated is invisible to the other gate](cfg-gated-code-is-invisible-to-the-other-platform-gate.md) ⭐⭐ not compiled on Windows; prove the REACHING mutation on box 2.
- [process-global bystander](bystander-test-reads-process-global.md) · [two locks one env var](two-locks-one-env-var.md) · [unknown polarity](containment-ownership-and-unknown-polarity.md) · [stacked defects](stacked-defects-mask-each-other.md) · [premature closure](premature-closure-guards.md) · [sweep site counts](sweep-dispatch-site-counts.md) · [dispatch on overlap](dispatch-on-overlap-not-on-merge.md).
- [a DERIVED figure dies with its measurer's context](derived-figure-without-its-formula-dies-with-the-context.md) ⭐⭐ numbers get filed, the BOUND does not; I asked doyle for provenance of my OWN six-draw series and between us it was gone. Emit the token with its two events named, or report a span with NAMED endpoints — never a bare figure under a borrowed label. Close the series with a labelled hole rather than guess draw N+1.
- [measure what costs one command](measure-what-costs-one-command.md) · [quoted figure decays if YOU mutate the subject](quoted-measurement-decays-when-you-mutate-the-subject.md) re-measure at the ACT, not the offer · [name the environment](tool-claim-must-name-its-environment.md) · [load axes](load-claim-needs-measured-axes.md) · [window load](window-assertion-load-direction.md) · [rig inherits the defect](rig-inherits-the-defect-it-studies.md) · [remedy from refusal state](remedy-must-run-from-refusal-state.md).
- [rule failed its author → mechanism](rule-failed-its-author-needs-a-mechanism.md) · [prompt ≠ boundary](prompt-prohibition-is-not-a-boundary.md) · [ground don't assume](ground-dont-assume-on-incidents.md) · [measure box before instrument](measure-the-box-before-the-instrument.md) · [lead with the boxless defect](lead-with-the-defect-that-needs-no-box.md) · [survive re-derivation](structural-fact-must-survive-rederivation.md) · [cite the contract](clean-room-evidence-cite-contract.md) · [no value expansion](secret-env-probe-no-value-expansion.md) · [your cadence blocks](your-cadence-can-be-the-blocker.md).

- [exit status is not a diagnosis](exit-status-is-not-a-diagnosis-capture-the-child.md) ⭐⭐ seven refusal arms all spell themselves `1`; the sentence naming WHICH lived only on the child's stderr, inherited into a PTY the failure itself swallows. `.output()` not `.status()`, one grep-able line, and prove the capture speaks by checking it carries the SUCCESS sentence too. Turned a code-read inference into a verbatim 2/2 measurement.

- [a load knob must be PROVEN to bite](load-knob-must-be-proven-to-bite.md) ⭐⭐ 610 green bring-ups mean NOTHING until a span is shown to stretch under the knob — "I added load and it stayed green" and "I never actually added load" produce identical evidence, and the second is the comfortable read. Measured the ConPTY-create span instead: 9-16ms quiet -> 42ms 4-way -> 117ms 10-way -> 294-326ms 12-way. That earned the greens AND gave the real finding — still ~100x short of the 30s bound, so more of the same escalation is predictable waste. Pick the span BEFORE the run; report the curve beside the red count; a lone outlier in a stretched tail is ONE SAMPLE (mine, 1427ms in a ~1ms span, did not recur in 240 further runs).
- [the one who CHANGED the environment will not list it](the-one-who-changed-the-environment-wont-list-it.md) ⭐⭐ a same-sha red-then-green pair is an A/A only if nothing moved between them. CONDUIT 33223968222: attempt 2 red, attempt 3 clean — with 139 GB REAPED from the box in between, so it is 1-of-2 across two conditions, not a rate. deployah's half, and the reusable one: the person who introduced the confound is the LEAST likely to list it, because to them it was a remedy filed under 'fixed it', not a variable. Ask a peer what they DID between the runs — routine question, and the one they cannot ask themselves. Way out: stop needing the race — assert a DETERMINISTIC property of the mechanism (here, one write per line at the emitter) instead of hunting a better sample.
- [a filed rate may PREDATE your base](filed-rate-may-predate-your-base.md) ⭐⭐ releases#199's 1/20 was measured at two shas that BOTH predate that same issue's OWN first-face fix — an ancestor of my base. The confounder was not a sibling milestone, it was the issue's earlier lane, and its header table wears a current measurement's clothes. merge-base every fix named ANYWHERE on the issue before computing hunt arithmetic; then report rate-moved, unlucky, and mechanism-gone as THREE separate claims.
- [a pointer WITH its reasoning attached gets typed, not checked](a-pointer-with-its-reasoning-attached-gets-typed-not-checked.md) ⭐⭐ a NAME or LINE NUMBER in a brief or ruling is a POINTER, never a measurement — resolve it against the blob before it enters a commit, doc or REQ, ESPECIALLY when the argument built on it is right, because a correct argument is what stops you checking. Three in one lane, all mine or through me: "3-line block" measured SEVEN · `Trigger::for_peer` at 271-272 is `Trigger::sender` at 269 (I named an enclosing fn off a grep hit showing its BODY) · the issue's ~12505 was 16300 — and that third one I DID flag, because it came from a stranger. **The asymmetry is the class:** a pointer travelling alone gets checked, one travelling with sound reasoning gets typed, so the rule must bind OUTBOUND — the author is the one actor who can never experience their own figure as unsourced. todlando proposed it, I adopted it 2026-08-22.
- [an unexercised prediction is NOT a correct one](an-unexercised-prediction-is-not-a-correct-one.md) ⭐⭐ deployah on himself, 2026-08-24 SIGNET respin: he pre-registered where a SECOND red would fall, no second red arrived, and he logged it UNEXERCISED rather than let it sit in the thread looking vindicated — nobody ever audits a prediction that was never contradicted, so it silently inflates the heuristic that produced it. Sort every pre-registration confirmed / refuted / **unexercised** by whether its trigger actually FIRED, and when a prediction and a measurement agree, say which one you are standing on (here the workspace linting clean on both OSes closed it, not the inference). ⚠ the POPULATION a prediction names is itself a claim: under `--all-targets` a dep crate's test/bench targets are independent leaf nodes, so "it compiled before spt failed" pins only its LIB target.
- [first-execution is a property of the CELL](first-execution-is-a-property-of-the-cell.md) ⭐⭐ deployah narrowed it TWICE in one night, same direction. Named ONE zero-denominator cell at CONDUIT intake; todlando refuted it — the Windows jobs died at the free-space floor with **checkout SKIPPED**, so the WHOLE Windows surface was first-execution. Corrected to "the Windows surface", then the respin golden reds on **LINUX** with Windows green on all four new cells. A first-execution cell's denominator is zero on EVERY axis until it runs on every axis; letting the box that bit you last time pick the surface is the same availability trap as reusing a correctly-diagnosed red as the next red's prior. Derive the set from the CELLS, state it platform-agnostic, narrow only where you MEASURED the other axes already ran them.
- [a shipped defect is not grandfathered by age](a-shipped-defect-is-not-grandfathered-by-age.md) ⭐⭐ "pre-existing, therefore not ours, therefore ship" is true about provenance and irrelevant to correctness — it is the argument that ships a known defect. Two reasons it fails: a misstated PUBLISHED surface misleads a blind-building adapter author identically whether the cause is old or new; and latent usually means BIGGER — an upstream defect (wrong owner on a publish edge) reaches the EXISTING consumers too, so the new test is the first instrument that could see it, not the cause. Pre-register what you do in EACH provenance branch — including the one that would let you ship — plus the falsifiable collapse condition, before the classification lands.
- [preserve BEFORE the release call, never inside it](preserve-before-the-release-call-not-during.md) ⭐⭐ mine at the v0.65.0 close: I named a worktree as the artifact worth keeping and then broadcast "POOLS RELEASED, reap party is ON" to three agents in the SAME message. A broadcast has NO ORDERING — every recipient starts at once and the fastest reaper wins — so a precondition written as a clause inside the release message is a hope with good grammar. The 830-line instrument survived by ~1 minute, saved only because the lane owner preserved on his own initiative first; his verbatim copy attempt found the tree already gone. Preservation is its OWN step with a NAMED OWNER, confirmed by path+hash, and the release goes out as a SECOND message gated on it. Record the RESTORE COST too — the surviving patch does not apply straight at head, and an artifact everyone assumes is restorable is worse than one whose limits are written down.
- [a stricter meter answers a confident EMPTY](a-stricter-meter-answers-a-confident-empty.md) ⭐⭐ mine 2026-08-29: an exact-equality predicate on `readlink /proc/<pid>/exe` reported ZERO reapable procs over 24 I had counted minutes earlier — the tree had been REBUILT, so the kernel reads `<path> (deleted)`. Had I trusted it I would have told the gater the orphans cleared themselves and left port 5474 held. doyle ruled the family: NOT the `EXIT=$?`-after-a-pipe class (nothing was truncated) but the git-trailer-tokenizer class — a STRICTNESS in the tool manufactures a clean zero that has nothing to do with the question asked. Tell: a zero contradicting your own recent count is a question, not a result; re-measure with the LOOSER instrument that produced the population and reconcile.
- [a baseline green cannot discriminate under a coin-flip environment](a-baseline-green-cannot-discriminate-under-a-coin-flip-environment.md) ⭐⭐ doyle ruling 2026-08-29: I offered a base-sha run under load to upgrade "pre-existing" from inference to measurement; DECLINED as an ASYMMETRIC INSTRUMENT — a green baseline is consistent with both hypotheses when the env flips coins, only a RED discriminates, and you cannot order one. Before spending a cycle, pre-register what EACH outcome licenses; if one is uninformative and you cannot force the other, the run is theatre. What actually discriminated was already in hand: the failing SET MOVED between runs at one sha, every failure passed ALONE, mechanisms implausible vs the delta.
- [time a memoised cost WHERE IT IS PAID](time-a-memoised-cost-where-it-is-paid.md) ⭐⭐ my first BRAIN_PHASE instrument timed current_exe_hash() from the CALLER after write_ready had filled the OnceLock — it would have printed ~0ms/computed=false for ever, i.e. "the expensive stretch is cheap", a PLAUSIBLE answer to the question under test delivered by a meter that measured a cache hit. Real figure was 10.1 SECONDS. Time the cost inside the call that may pay it and return it; carry a computed/cached flag so 0ms cannot be read as fast; pin BOTH arms in a unit. Any memo / OnceLock / lazy static / idempotent write has this shape.

## Second verbatim move — 2026-08-30
> Entries accumulated in MEMORY.md's Judgement section after the 2026-08-19 split,
> MOVED here by the same method: VERBATIM, original order, ZERO dropped, byte identity
> asserted per line in the move script. Both files measured LF before the move
> (0 CRLF each) — no terminator side-effect this time.

- [measure the diagnosis, incl. YOUR OWN](dont-take-a-diagnosis-as-measured.md) ⭐⭐ an issue body, a panic text, and your own first reading all wear a measurement's clothes. #171: the ticket named the wrong line and the fix would have been a NEW bug. #170, ONE SESSION LATER: I classified five reds as "environment" in a report to the gater without varying anything — measuring agreed with me, which is exactly why a right guess is not evidence. #187 3rd face: two verifiers each spot-checked the ORDERING cites and neither read the arm that DECIDES — check the deciding arm, and date the RCA against later fix-lane traffic. 4th face: a COMPACTION SUMMARY of my own session flagged my ledger as carrying a claim doyle never made — measuring found his correction on the record 12min before I wrote it, so the fix would have made a true sentence false and retracted a real ruling back at its author. A carried-forward to-do is a hypothesis; re-measure before you WRITE a correction.
- [`EXIT=$?` after a truncation pipe measures the TRUNCATOR](exit-status-after-a-truncation-pipe-measures-the-truncator.md) ⭐⭐ filed a FALSE bugfix (#153): `spt update --restart | tail -20; echo EXIT=$?` read tail's unconditional 0 while the product returned 3 at four trees, already pinned. A lane was dispatched, briefed and re-scoped before anyone questioned the meter. Fails hardest on TRUNCATION pipes — they read as formatting, not pipeline elements — i.e. exactly when you are trimming output to QUOTE it in a ticket. Tell: a control and a treatment reporting the IDENTICAL number is evidence about the meter. ⚠ 2026-08-22 #159, TWO more faces: `| head` CLOSED the pipe so the producer took SIGPIPE and `${PIPESTATUS[0]}` read **101** — the pipe MANUFACTURED a status, so PIPESTATUS is not protection; and an hour later `clippy | tail` read tail's 0 while clippy really was clean, the version that never gets caught. **Tell is the REPORTING: "am I about to quote this?", not "is this a pipe?"** — all three instances happened while trimming output to quote it. ⚠ 4th face 2026-08-22, NO PIPE AT ALL: a wrapper `( … ); echo $? > leg.exit` ends with the CAPTURE, so it exits 0 over a leg's 100 — todlando nearly filed a runner misreport, minimal probe retracted it (IR-60). Read the LEG's exit FILE, never a wrapper's status. ⚠ 5th face 2026-08-25 MINE: a background-task COMPLETION NOTIFICATION is a wrapper status too — quoted an exit file as 0 UNREAD while it said 127/cargo-not-found; a verdict is quoted only after the exit file's CONTENT is read in-transcript. ⚠ 6th face 2026-08-29 MINE (in-file heading FIFTH SHAPE): the EXIT FILE ITSELF was flattened — `gh run watch` exits 0 on a RED run without `--exit-status`, so a textbook capture wrote `0` over conclusion=failure. Read the file, and the file lied. My r2 watcher read 0 on a known-red run too — the control tell fired on my OWN artifact. An exit file is only as good as its PRODUCER"'s exit semantics; for a CI run the authority is the run's API `conclusion`, a property of the subject not of my wrapper. Push a known-red control through any meter I build.
- [a frontier names WHERE progress stopped, not the CAUSE](a-frontier-names-where-progress-stopped-not-the-cause.md) ⭐⭐ IR-55: streaming + `--test-threads=1` NAMED the wedger — it passes ALONE in 0.02s. Skipping it moved the frontier 183 → 335, then stalled on TWO. Real cause = an EARLIER test leaking `findstr .` children (no file arg ⇒ reads stdin forever under headless conhost). doyle retracted his own entry within the hour + killed his scrub hypothesis (isolation runs HAD the scrub and passed). Run the frontier alone first; then BISECT, never edit at the frontier.
- [measure the DESIGN's premise, not the ticket's claim](measure-first-tests-the-design-premise-not-the-ticket.md) ⭐⭐ W5/#211: mechanism TRUE, the CONCLUSION drawn from it FALSE at the head — #209 had landed, so the "dead" own-node spelling was already LIVE and the ruled effects looked DELIVERED with no lane code. "Collides with nothing" was a BEHAVIOUR claim while the collision sat in the RECORD: 6 landed sites incl. a ratified REQ TITLE prescribing a tier the operator deleted. Split every premise MECHANISM vs CONCLUSION; the ticket does not know what the design assumed. Delivered-but-unpinned ≡ undelivered from the tracker — only a cell separates them.
- [an entry's FIGURES can come from a looser meter than its METHOD](an-entrys-quoted-figures-can-come-from-a-looser-meter-than-its-prescribed-method.md) ⭐ IR-57 prescribes a header-excluding pipeline and QUOTES 310/308 taken WITHOUT it (302/300 with; the 8 file-header lines of 4 files are the gap). Survived every read because the DELTA is identical under both meters, so the right conclusion never pressed its numbers. Reproduce an entry's FIGURES as a leg, not just its method; hand back the reconciliation, never a bare correction.
- [`git log -S` dates the STRING, not the SITE](git-log-S-dates-the-string-not-the-site.md) ⭐ duplicated pattern returns the ORIGINAL commit every time — a copied site reads as pre-existing (todlando, IR-69 delivery.rs: read as "census miss", truth was post-cut mint). Date a site by diffing minting commits / reading the file at the boundary sha, or `git log -L`; fires exactly when code was copied from a sibling, i.e. exactly when provenance is asked.
- [same reading from opposite outcomes = the METER](identical-readings-across-opposite-outcomes-indict-the-meter.md) ⭐⭐ my #153 filed a refusal as exit 0 AND reported a SUCCESSFUL roll exiting 0 as corroboration — that was the refutation, filed as supporting evidence. Both ran cmd|tail then $?, so both measured tail; source returns 3 at 4 trees. Wrong issue, 17 days, ate a builder lane. A control agreeing with the treatment outranks the finding — vary the INSTRUMENT. ⚠ flynn same day, BOTH idioms on one tool minutes apart: a flattened exit AGREES with truth nearly always (his conclusion right, evidence invalid), so the idiom is never audited — my #153 is the rare disagreement, which is why it surfaced. Capture-first for anything that becomes evidence.
- [declining a credit SPECIFIES the requirement](declining-a-credit-specifies-the-requirement.md) ⭐ I could have offered my 08-04 composite roll against #212’s "no lane gates it" row; naming the condition it never presented (a REFUSED outcome — nothing was near a floor) showed the leg was TWO opposites, not one: #159 floor met by INCOMING core only (must ADMIT + register at new version), #213 met by NEITHER (must refuse, REFUSED not FAILED, exit 3 not 1). Report UNCOVERED conditions by name, never a coverage percentage.
- [brief fix-shape: grep hazard tags first](brief-fix-shape-check-hazard-tags-first.md) ⭐ #190 brief ordered re-breaking REQ-HAZARD-PUMP-IPC-DEADLINE (3 tagged sites); builder caught it pre-build. A brief's shape is authored from the ISSUE, not the seam — cite tagged invariants or leave shape to the measure-first report.
- [an undiscoverable SHIPPED surface reads as missing](an-undiscoverable-shipped-surface-reads-as-missing.md) ⭐⭐ #224 was filed (on my own mechanism report) saying no verb exposes the drop dir; `endpoint list --json` had carried it since 08-01 and answered the ticket's acceptance in ONE command. A field with no doc pointer is reachable only by someone who already knows it exists; everyone else credibly reports the capability as ABSENT. doyle's gate finding is the durable half: when the root cause is "nobody knew", the docs clause is a DELIVERABLE of the fix (doc stage in its REQ), not a nicety — shipping the residual code alone leaves the mechanism alive to file the ticket again.
- [walk a refusal chain under the DEFAULT posture](walk-a-refusal-chain-under-the-default-posture.md) ⭐⭐ 2026-09-07 W2: serve_for's three refusals (WEB node gate, audience-on-requester, path rules) were each true and each celled, and together let ANY subnet node expose any owner path to itself for 24 h under default-on; the ADR's named authority (user's attach session) was absent. Walk as a hostile peer: what did a USER on the owner have to DO? Bind to the owner's own record (its MSG_OUT row), never the request's claim; refusal cells assert nothing exposed.
- [`grep -c` on a CR counts every LINE, not the CR](grep-c-carriage-return-counts-every-line.md) ⭐⭐ x2 (deployah 2026-09-09 r4 identity: 1437/285 = line counts, FALSE RED on a ruled head; `od -c` shows the CR reaches grep and it STILL acts empty; put the byte counter IN the script) 2026-09-07 W2: `grep -c $'\r'` returned 358 — the file's TOTAL line count — on a file with ZERO CR bytes, so a post-`sed -i` terminator check read "unchanged" on a file sed had just converted CRLF -> LF. The empty pattern matches every line, and that number is indistinguishable from a correct CR count because the two are EQUAL in a fully-CRLF control. Count terminator BYTES (`tr -cd '\r' | wc -c`) and distrust any terminator count that exactly equals `wc -l`.
- [a patch script can collapse escapes into REAL newlines](a-patch-script-can-collapse-escapes-into-real-newlines.md) ⭐⭐ 2026-09-07 W2: python heredoc turned Rust `\r\n` into actual CR+LF; Rust ALLOWS newlines in string literals so it COMPILED, the helper sent LF HTTP and searched a 4-byte boundary with a 2-byte literal. THREE faces (empty body -> EOF at col 0 -> boundary panic), one cause, and the server was right every time. Write escape-bearing patch text with a RAW python literal and verify in the GENERATED file; never let a parse helper return a benign empty on miss — panic with bytes/port/path/first-200.
- [the boundary of what I touched is not the world](the-boundary-of-what-i-touched-is-not-the-world.md) ⭐⭐ 2026-09-07 W2, TWICE: (a) censused the rig I was EDITING and told the gater "no rig stands up a listening receiver" — io_events_undriven_kinds_e2e does; (b) measured LAST_MSGS' excerpt holding envelope MARKUP, pinned it byte-exact and called it "someone's ruling" — it was a fleet-wide display regression MY OWN LANE caused, and the precise pin would have shipped the bug WITH a cell certifying it. Grep the tree before saying a thing does not exist; when a measurement surprises you, ask whether YOUR change caused it before escalating. Precision aimed at the wrong claim reads as diligence.
- [parent-chain attribution must WALK TO A ROOT](parent-chain-attribution-must-walk-to-a-root.md) 2026-09-08 v0.68.0 golden r1: read ONE level (cargo > rustup), told the gater mid-recall that the runner's own twohost-a build was user-shell contention, with a fabricated overlap start. `rustup.exe` is the shim BOTH a CI step and a human shell reach cargo through, so a one-level census cannot separate them BY CONSTRUCTION — it is a different measurement, not a weaker one. Walk to RunnerService/bash and report the root reached; when correcting, say which facts survive and which do not.
- [don't infer a mechanism from WORDING — open the emitter](dont-infer-a-mechanism-from-wording-open-the-emitter.md) ⭐ 2026-09-08 x2 in one afternoon: a breadcrumb's text (`not an envelope` = the parse-returned-None branch, its SIBLING branch carries different text) and a rig's assert string (`A answered NoReply` — NoReply is minted only at the requester's own stream-EOF arm, never sent by a peer) each became a mechanism I sent to peers. A string tells you which branch of the EMITTER ran, nothing about who caused it. Also: latency shape is evidence — a refusal answers in ms, this took 1,248 s = idle EOF.
- [assert on the STREAM the emitter writes to](assert-on-the-stream-the-emitter-actually-writes-to.md) 2026-09-08 lane 4: a NEW precondition asserted `spt send` reported `SENT:` and got `""` — the CLI reports via `emit_line_err` (STDERR) and I captured stdout; `quickstart_e2e::send()` in the same crate had concatenated both all along. Sibling of [[dont-infer-a-mechanism-from-wording-open-the-emitter]]: that one says a string tells you which BRANCH ran, this one says check which PIPE it travels on. An absent needle and a needle you are not looking at render identically — and on a NEW assertion a green would have proved nothing.
- [a sound check can carry an OVERSIZED sentence](a-sound-check-can-carry-an-oversized-sentence.md) ⭐ 2026-09-08 lane 3: a peer proved the TEST FILE byte-identical across a rebase (true) and concluded my pre-rebase measurement transferred (too wide — the same rebase brought two PRODUCT files beneath it). `git diff -- <path>` answers about ONE PATH; "the measurement transfers" is about EVERY INPUT. Re-run a check that underwrites YOUR evidence, widen to `--name-only` with no pathspec, prefer blob hashes to line counts, and hand back pasteable replacement wording.
- [never forge a token that was deliberately WITHHELD](never-forge-a-token-that-was-deliberately-withheld.md) ⭐ 2026-09-08: my reap gated on the gater's release word; he ordered the reap while expressly refusing to send that word (the run was not terminal). A gate token is a CLAIM ABOUT THE WORLD, not a password — typing it would have laundered my convenience into his assertion in the one artifact anyone would later read. Add the honest branch (`-ExplicitOrder "<their words>"`, printed as authorized-by:) instead of satisfying the dishonest one.
- [two instructions for one action must be RECONCILED at authoring](two-instructions-for-one-action-must-be-reconciled-at-authoring.md) 2026-09-08: my probe printed a firewall range (hand-derived, wrong), the rig binds another, the board asked a third — three for one action, two of them mine. An operator applies ONE; the wrong rule then gets blamed for not fixing anything. DERIVE from the code's constant, say what the figure IS, and NAME the other instruction with which wins. Caught only by reading the control's OUTPUT — the exit code was already the 101 I wanted.
- [a control must SEVER the branch from its consequence](a-control-must-sever-the-branch-from-its-consequence.md) ⭐ 2026-09-09 golden #272 r2 a4, mine: I was right that a fire gate proven only to REFUSE is indistinguishable from one that refuses unconditionally (permit arm first runs when it matters, failing toward NO measurement) — then proposed a control, "point it at an already-terminal run", that would have driven the whole path past the permit and fired live datagrams at a box under test, breaching the hold I was enforcing. deployah's `-GateOnly` made it a control. Proving refusal is free; proving permit is only free if the effect can be severed. If it cannot, leave the arm UNPROVEN and say so, and claim only the width the control earns. A control is a change — audit it like one.
- [an absent row and an UNREADABLE row render identically](an-absent-row-and-an-unreadable-row-render-identically.md) ⭐ UNREADABLE is a THIRD value; a census lacking it reports the blind case as ABSENT. 2026-09-08: a WMI walk typed UInt32 as Int32, threw on every oversized row, skipped them, printed "descendants 0" and exited 0 — and that zero authorized a kill. Fails toward ACTION, because a zero reads as clear-to-proceed. Count rows ATTEMPTED vs READ and print the delta even at zero. Filter-domain ancestor: [[zero-match-filter-reads-as-absent]].
- [read a control's OUTPUT, not just its exit code](read-a-controls-output-not-just-its-exit-code.md) ⭐ the exit code you HOPED for is the weakest confirmation. Probe exited 101 as designed while printing a hand-derived WRONG firewall range; `gh --log-failed` exit 1 carried its real reason (`not a git repository`) in the output; `grep -c $'\r'` returned 0 on a proven-CRLF file — command succeeded, probe broken. Capture stdout+stderr to a file and READ it; be most suspicious when the code is the one you predicted.
- [when your falsifier FIRES, the rescue is the danger](when-your-falsifier-fires-the-rescue-is-the-danger.md) ⭐ 2026-09-09 on myself, #272 lane 2: I pre-registered “scattered gaps mean I am wrong”, the a3 census scattered (0-21 ms, median 4), and a rescue (loops sleep AFTER work ⇒ phase drifts) arrived within seconds because I wanted it. Say REFUTED first, separate what survives on independent evidence, hand the rescue over labelled post-hoc/UNTESTED, never cite it later as support. A wrong prediction travels with company — a second caveat of mine was refuted in the same message.

## Moved 2026-09-09 (VERBATIM from MEMORY.md Judgement rules, 8 entries)
<a id="moved-2026-09-09"></a>
- [a control must SEVER THE BRANCH FROM ITS CONSEQUENCE](a-control-must-sever-the-branch-from-its-consequence.md) ⭐ hertz 2026-09-09 (his rule, his own example against himself): a gate's permit arm is followed by the action it guards, so 'exercise the permit' and 'perform the guarded action' are ONE instruction unless something inert intervenes. Refusals are free to prove; permits need a dry-run switch. No switch => leave it unproven and SAY so.
- [grepping a SUCCESS token matches the PANIC that quotes it](grepping-a-success-token-matches-the-panic-that-quotes-it.md) 2026-09-08 x2 golden r2: `grep -c ADMITTED`=1 was the panic line ('never got … ADMITTED'), true count ZERO; HELPER_SERVE_FOR hit belonged to an earlier PASSING step by timestamp. Count is not presence; presence is not attribution.
- [a name grep that guesses the compound spelling reads as ABSENCE](a-name-grep-that-guesses-the-compound-spelling-reads-as-absence.md) ⭐ 2026-09-08: searched 'twohost', operator named it 'two-host' — nearly told doyle the operator's firewall rule was missing. Match on ATTRIBUTES (port/proto/remote), never on a name you did not author.
- [Length-sum over a cargo target double-counts hardlinks](length-sum-over-a-cargo-target-double-counts-hardlinks.md) deployah 2026-09-08: ~15% overstatement (half the nlink>1 bytes closes the gap to 0.03%); Length ranks pools, du --apparent-size or the post-reap free reading predicts reclaim; my allocated-vs-logical arm was a guess, 0.24% measured.
- [a column that reads ONE value on every row is a broken extractor](a-column-that-reads-one-value-on-every-row-is-a-broken-extractor.md) 2026-09-08 NEC list x2: check one known row before reading a total.
- [a stamp typed from the previous turn's clock is a GUESS](a-stamp-typed-from-the-previous-turns-clock-is-a-guess.md) ⭐⭐ 5 faces: 2026-09-08 x3 mine ("08:22Z" was 10:22Z, operator prompt waited 2 h) + doyle's shortform + doyle 2026-09-09 (delta comment self-stamped 23:30Z, GitHub created_at 23:23:31Z). Never TYPE a stamp — substitute it where a shell exists, OMIT it in shortform which has none, and where the MEDIUM already stamps (GitHub created_at, %cI, daemon send log, CI records) cite THAT and write none: a prose stamp beside an authoritative one can only disagree. Sort audited sequences by the medium's clock; a disagreement is a provenance finding.
- [silent peer may be OUT OF USAGE, not held](silent-peer-may-be-out-of-usage-not-held.md) 2026-09-06: read `CONTROLLED` as an operator hold and stood down 40 min; cause was shared-account quota (todlando + hertz together). Unfamiliar badge = lookup; >15 min zero-activity silence = escalate to operator, and probe the account-sibling.
- [never send a claim composed before its check ran](never-send-a-claim-composed-before-its-check-ran.md) ⭐ 2026-09-06: two false claims to perri in 3 min — `&&` guards one statement, the send on the next line runs on a failed check. Gate the SEND on the check, or read the output first and compose in a second call.
- [a selector that can match TWICE must assert cardinality](a-selector-that-can-match-twice-must-assert-cardinality.md) ⭐⭐ 2026-09-09, THREE instances in one hour building the r3 a2 instruments: job substring hit 2 jobs (two-line value ≠ "success" ⇒ a GREEN run prints RED); step substring hit the LINUX variant beside the Windows one inside the same job (the per-OS collapse happening *inside* the instrument); "the registry" located by SEARCH took the first hit and would have reported unchanged TRUTHFULLY ABOUT THE WRONG FILE. All fail toward something shaped like a reading — no error, no empty, just a value that gets quoted to a gater. Fix is never a cleverer pattern: select by exact identity, anchor what must stay fuzzy, ASSERT THE COUNT, treat multi-line as VOID. All three caught by a COMPLETED CONTROL run, none by review.
- [a KEPT caveat — or a standing SHORTHAND — goes stale when the evidence narrows](a-kept-caveat-goes-stale-when-the-evidence-narrows.md) ⭐ hertz + todlando 2026-09-09, ratified by doyle, 3 instances in ONE day: doyle ruled "keep the NOT-ESTABLISHED paragraph" and in the same arc handed me a dating series that BOUNDED the thing it disclaimed, so "keep" and "keep verbatim" came apart — the entry would have claimed ignorance its own numbers refuted three paragraphs above. todlando's #289 census did the identical thing ("SCOPE IS DOYLE'S CALL" left standing three paragraphs above doyle's ruling, appended below it). NARROW, never keep-or-drop: the residue ("the split WITHIN the environment term"; "scope was mine to ask, whose call settled it") is realer than the stale blanket. ⚠ TWO DIRECTIONS, do not merge them: a stale CAVEAT fails FLATTERING — overclaiming gets caught, a NOT-ESTABLISHED heading READS as rigour so nobody audits it and it discards measurement already paid for; a stale SHORTHAND fails EXPENSIVE — todlando's "reuse PEER_REPLY_READ_BUDGET" kept verbatim ships a no-op that REVIEWS AS A FIX (reuse the CONSTANT, not the helper beside it, which yields None off the pump). Both are claims about the state of the evidence and decay like any other. Re-read your hedges AND your shorthands against a peer's evidence when you fold their draft in, and say you changed rather than kept, in the merge message.
- [an unmeasured item inherits its CATEGORY's size](an-unmeasured-item-inherits-its-categorys-size.md) ⭐ deployah 2026-09-09: the runner-target reap rode a whole milestone as a cargo-pool-scale job because every OTHER pool here is tens of GiB — it was 1.35 GiB (whole _work tree 2.12). Three agents scheduled around a figure none of us had: I blocked on hertz's timed discriminator lane and asked for a window, he built a WINDOW OPEN/CLOSED protocol around me and declined the blanket block (a hard stop that never lifts is how a disk floor gets hit while everyone is polite), doyle carried it then retired it. The census was FOUR read-only commands — [[measure-what-costs-one-command]] applied to an open ITEM, not to a claim. SECOND HALF, doyle ratified: a retired item with a re-raise trigger reads as a LEVER HELD IN RESERVE, and at 0.7% of free space this tree can never be the remedy for a disk floor — so measure before you RETIRE, not just before you act; he re-pointed the 100 GiB trigger at a pool census under Documents\projects and .worktrees instead.
- [an audit scoped to the TRANSFORMATION is not scoped to the LANE](an-audit-scoped-to-the-transformation-is-not-scoped-to-the-lane.md) ⭐⭐ hertz 2026-09-09 IR-85..89, caught by doyle in review: I ran a MECHANICAL renumber census on the draft I transformed (caught a self-ref buried mid-sentence that eye-reading missed, 3 not 1) — and commit 1 of the SAME LANE absorbed a DIFFERENT draft in the same dead numbering, where two IR-82 tokens survived pointing at an unrelated landed entry forever. ⚠ THE RIGOR CAUSES THE GAP: I skipped the second census because I had just finished a careful first one — "the renumber audit is done" is a memory of scope A answering a question about scope B, so "be more careful" is not the remedy; the failure happened at maximum care. Audit `git diff <base>..HEAD` ADDED LINES across EVERY commit and say it that way ("IR-82 in added lines: 0"); audit ONCE PER SOURCE DRAFT when a lane absorbs several; the tell is the sentence "I already ran that census" — ask OVER WHAT. Rider: retiring a label means REMOVING the token, never narrating its removal in place ("NEEDS-OPERATOR dropped because…" hands every future census a false positive).
- [a delta between two READINGS dates the OBSERVATION, not the event](a-delta-between-two-readings-dates-the-observation-not-the-event.md) ⭐⭐ deployah 2026-09-09, hfenduleam disk-full: "195.76 GiB at 10:37Z, 0.06 at 10:58Z ⇒ >150 MB/s sustained writer" — arithmetic right, conclusion does not follow; nothing bounded the event to the interval between two LOOKS. True cause was hertz's two discriminator pools (82.88 + 64.44 Length-sum) + CI _work 40.93 + Temp 9.8 ≈ 196 GiB over the 1.5–2 h of build he had already told me about. A derived rate RETARGETS the hunt: >150 MB/s is a different KIND of cause than "builds are writing", so it excluded the true one and sent me after runaway logs, dumps, VSS, torrent preallocation. THE REFUTATION IS FREE AND NEEDS NO ANSWER — measuring the live rate took 15 s and killed the premise cold (top writer 0.57 MB/s, ~1.5 MB/s box-wide). ⚠ SHARPEST FACE, a CUMULATIVE counter matching your gap: WriteTransferCount named msedgewebview2 at 188.7 GB ≈ the 195 missing, top of the sorted list, ready to report — it was TeamViewer's browser STARTED 5 DAYS EARLIER (~1.5 GB/hr). Check a counter's ZERO POINT before it enters a sentence. ⚠ and the meter lied first: Get-Process WriteTransferCount came back BLANK, so the filtered query cleared every process on the box; caught only by an unfiltered control, CIM carried the real numbers.
- [a launch-time SPOT READ is not the instruments FIRST SAMPLE](a-launch-time-spot-read-is-not-the-instruments-first-sample.md) 2026-09-09 IR-90: doyle ruled a seam line citing his trace as "starts 12:13Z at 64.33"; the preserved file's first line is 12:15:37Z 54.25 and holds no 64.33 -- the figure was a SPOT READ taken by the command that LAUNCHED the sampler, then concatenated onto the sampler's values as one series, and the filename carries the LAUNCH stamp, not the first sample. Read an instrument's FIRST and LAST lines before repeating a range; never paste a spot read at the head of a series; a preserved file the register cites BY PATH is not renamed to fix a stale name.
- [a TRACKED-ONLY corpus cannot answer TRACKED-OR-NOT](a-tracked-only-corpus-cannot-answer-tracked-or-not.md) ⭐ 2026-09-09 root-scratch PR #214: a citation census grepped 561 root files against a `git ls-files` corpus, so every hit it could return was a tracked cite BY CONSTRUCTION -- it had discarded the distinction before the question was asked, and the gap got filled by the file's PATH (a root .md 'reads as' scratch). Two CITED files were put in the bury class; both citers were tracked. The discriminator is tracked-or-not, never root-or-not -- this repo has 140 TRACKED root files. Ask what a corpus could NOT have returned; re-derive per file with `git ls-files --error-unmatch`; re-verify a burial list as a DIFFERENT reader than the classifier; and measure the house convention before tidying toward an assumed one.
- [a call-site grep cannot answer whether an EDGE OBSERVES](a-call-site-grep-cannot-answer-whether-an-edge-observes.md) 2026-09-09 hertz (IR-92 hunt): I put `relay.rs:75` in the SILENT column; it publishes through its SINK one frame up in another crate (`startup.rs:1064`). Grep answers "does this frame publish", never "is this row observed". Census the PUBLISHERS tree-wide first (2 sites), then trace each edge to one; control every zero-hit grep in its own file; the error runs BOTH ways -- it inflates the defect you are hunting AND can clear a truly silent edge.
- [two checks corroborate only if they test ONE proposition](two-checks-corroborate-only-if-they-test-one-proposition.md) ⭐⭐ 2026-09-09 #294: blocked a gate saying "verified two independent ways" — the WIDE grep was `| head`-truncated (golden.yml sorted below the cut; the gate WAS invoked at golden), the sound check only ever covered ci.yml. A narrow sound check beside a wide broken one is indistinguishable from two votes and it upgrades confidence exactly when it should collapse. Write the claim as ONE sentence, ask of EACH check whether it alone settles THAT sentence, and never let a piped listing be one of the votes — re-run wide checks with `-c` and no pipe.
- [a retraction does not propagate to the adjacent claim](a-retraction-does-not-propagate-to-the-adjacent-claim.md) ⭐⭐ 2026-09-10 golden 34445961595, TWICE in 40 min: I withdrew the wall-time/internal-margin conflation and re-committed it forty lines later under the heading "what actually survives"; doyle re-committed it NINE lines after quoting my retraction while correcting me for it. Re-DERIVE adjacent claims from the raw numbers; re-reading cannot catch it.
- [an endorsement is a claim](an-endorsement-is-a-claim.md) ⭐⭐ 2026-09-10: I called doyle's causal over-read "source-derived, so it does not inherit any of my measurement problems" — certifying the absence of a defect class I never checked for, giving one unchecked claim TWO agents' weight. Split a peer's MEASURED half from the INFERRED half; endorse only the first.
- [whole-test wall time is not an internal budget margin](whole-test-wall-time-is-not-an-internal-budget-margin.md) ⭐⭐ 3 faces 2026-09-10: setup/teardown sit OUTSIDE the window (34.908s vs a 30s poll says nothing); a FAIL TRUNCATES the path so pass/fail totals are incomparable (58.77 vs 61.304 carries nothing); spread is still whole-test. HARD LIMIT: nextest hides PASSING output and neither budget prints a clock on expiry, so margins are unrecoverable from history — instrument, with --success-output immediate.
- [occupancy is not contention](occupancy-is-not-contention.md) ⭐ todlando's catch, measured 2026-09-10: 27 foreign procs -> 501.778s phase vs 17 foreign -> 955.716s. MORE residents on the FASTER run; counts are CONDITIONS to reproduce, never a load explanation. The 2x slowdown itself stays real and unexplained — a retracted cause does not take its observation with it.

- [re-derive from the ARTIFACT, do not retype from the message](re-derive-from-the-artifact-do-not-retype-from-the-message.md) ⭐ doyle 2026-09-10: in the message written to hold ONLY measured values, I retyped the sync base series as 71/96/74 when the logs said 96/286/74 (dropped 286, pulled 71 from the HEAD cell). Distinct defect from inference-past-measurement: sentence right, NUMBER wrong. The correcting message is the highest-risk place for it. hertz+todlando caught it from INTERNAL INCONSISTENCY without my logs — so a table that restates its key values in prose is self-checking.
- [the error is in the CONSEQUENCE CLAUSE, not the measurement](the-error-is-in-the-consequence-clause-not-the-measurement.md) ⭐⭐ 2026-09-10 releases#294: SEVEN withdrawals in one day, measured value RIGHT every time — floor-from-a-classifier-count, ceiling-from-successes-only (selection artifact), all-six-from-ONE-pairing, "additions only" contradicting my own 6 removals, "disqualifying" sized against a 0.29% n=1 gap. CHECK: split measured vs inferred, require the inferred clause to be re-derivable from the measurement ALONE. "Be more careful" failed 7x, once mid-argument-for-care.
- [name a surviving alternative before a consequence sentence](name-a-surviving-alternative-before-a-consequence-sentence.md) ⭐⭐ todlando's MECHANISM 2026-09-10, for the defect doyle and I both named the same day (his 4th withdrawal, my ten-correction triage): state the observation's SCOPE, name an alternative compatible with it; if it survives, the conclusion is a HYPOTHESIS. Fired instantly on the sentence introducing it — I called an n=2 pattern a FLEET property. Consequence-side twin of the absence-probe control.
- [proximity to a threshold is a RISK SIGNAL, not a verdict](proximity-to-a-threshold-is-a-risk-signal-not-a-verdict.md) ⭐⭐ doyle 2026-09-10 releases#294, THREE in one hour, all caught by peers: "delayed publication, measured" (hertz: an expiry is RIGHT-CENSORED, says nothing about after), "a ceiling outside the measured tail" (UNSPECIFIABLE — he refused rather than invent a number), "boundary defect MEASURED" (todlando: if the 9.940s success is pathological the budget is innocent). Cause: a dispatch/filing has a SLOT for a verdict and the slot is not evidence. Publish the INVENTORY — observed / censored / unmeasured / ruled out.

<a id="moved-2026-09-10"></a>

## Moved VERBATIM from MEMORY.md 2026-09-10 (doyle) — measurement-discipline entries banked that day

- [a `^+[^+]` regex undercounts a diff by its BLANK added lines](a-plus-bracket-regex-undercounts-a-diff-by-its-blank-added-lines.md) ⭐ 2026-09-10 deployah: my 510 vs his 516 (=diffstat insertions); `^+$`=6 and `^++`=5 reconcile all three numbers exactly — and it was the DENOMINATOR of an absence check. Use `grep '^+' | grep -vc '^+++ '` + shortstat.
- [a ONE-SIDED error analysis mints a FALSE BOUND](a-one-sided-error-analysis-mints-a-false-bound.md) ⭐ 2026-09-10 hertz+todlando, same minute: I said a runner's gap 'can only UNDER-report overlap, so it's a lower bound' — but a start stamped pre-spawn or a finish post-exit OVERSTATES it. Enumerate BOTH boundaries; a real bound needs conservative INNER intervals from validated bounds.
- [a number computed BESIDE a pre-written claim does not check it](a-number-computed-beside-a-prewritten-claim-does-not-check-it.md) ⭐ 2026-09-10 deployah: 'no new traces yet' false BOTH times — live count + static sentence in one call, freshness transferred to unchecked prose. Derive the claim FROM the number. Corollary: I refused credit for a correction I had not made — grep your own sent messages; credit is a factual claim.