Governance

Table of contents

Governance

Draft. A working proposal for how Grace Commons governs pattern admission and signals trust to consumers as the library matures.

The problem

A pattern library is only as useful as it is trustworthy. Anyone can publish a collection of specs. What makes a spec worth building against is knowing it has been reviewed, that it won’t change underneath you without notice, and that the version you built against is the same one everyone else sees.

The three-pass methodology in pressure-testing.md handles the quality bar for individual patterns. This document proposes what sits above that — the process for admitting patterns to the canonical library, and the mechanism that makes “admitted” mean something durable.

Hybrid review

Software fails in two ways: logical failures and judgment failures. A logical failure is a missing state, an invariant that doesn’t hold, an action that doesn’t enumerate its rejections. A judgment failure is a spec that is technically complete but solves the wrong problem, or adds complexity the library doesn’t need.

The existing three passes already embody this split. Pass 1 (GRID structural) is mechanical — a spec either resolves all nine nodes or it doesn’t. Pass 2 (EOS conceptual independence) and Pass 3 (Linus adversarial) require judgment — conducted, under the current methodology, by AI reviewers in fresh-reader mode (the Final Critique and the council-run rescans; see pressure-testing.md), with human attention spent on triage and adjudication of their findings rather than on conducting rounds. The governance layer formalizes the resulting split: a machine gate runs first and is a hard block, AI-conducted adversarial review supplies the findings, and a named human authority adjudicates the admission call. (Corrected 2026-06-11; this paragraph previously claimed Passes 2 and 3 were human-conducted, which predated the council methodology.)

The review body is the ALL Council — AI plus humans, together covering all the bases a solo reviewer cannot. The name is the concept: neither alone is sufficient.

Cryptographic sealing

When a pattern is admitted to the canonical library, it receives a cryptographic seal — a content hash of the specification at that version, recorded in a tamper-evident log. The seal is not the file’s Git hash; it is a stable identity for a specific, reviewed version of the spec.

What this gives consumers:

Version pinning. Pin to a sealed version and know it hasn’t changed since it was reviewed.
Provenance. The seal is proof that a specific version was reviewed and admitted at a specific point in time.
Drift detection. A consumer holding a sealed hash can verify their local copy against the canonical version at any time.

This is the library applying its own Tamper Evidence atom to itself — which is the right thing to do.

Open questions

Sealing mechanism. Git-based content hashing is the simplest path. RFC 3161 external timestamping provides stronger legal provenance. The right answer depends on how far the library’s institutional ambitions reach.
Council composition. The minimum viable form is a small group with domain expertise across the library’s categories — enough to catch judgment failures that the authoring passes miss. Growth path is an open working-group model as the contributor community develops.
Versioning. When a sealed pattern is revised, the new version is reviewed and re-sealed; the old seal remains valid for consumers pinned to it. The deprecation path for older versions needs a short spec of its own.

The language council

The reviewers a GRACE lang draft is run past. An internal process of the corpus, kept out of the grammar on purpose (GRACE-lang.md v0.32 tombstoned its G9–G12): the grammar states what the language is; who reads a draft and how is decided here, and can change without a grammar release.

Members to date: Claude, Kimi, Gemini, GPT, GLM, Grok, Mistral — the AI seat of the ALL Council above.
The chair: the council is headed by a president, currently Claude, named by the maintainer; the maintainer — the human in charge of the corpus, Scott — is president of all. The chair carries the council’s advice to the maintainer and holds no power over admission.
Advisory, never admitting. The council advises; the maintainer decides every admission to the grammar (GRACE-lang.md Principle 8, under Principle 2’s test — recurrence and contested).
A read has two hands, and both are named. A council member finds; the maintainer decides; the chair applies. A register line therefore carries the finder (the member and the read’s id), the decision where one was needed, and the pass that landed it — and a fix that changed a rule says so in the commit that made it, under the finder’s id. The council’s value is that the finding and the repair are not the same hand: a reader who also writes the fix grades their own work, which is the failure the corpus’s own review discipline exists to prevent (the section titled Defending each claim in-line in pressure-testing.md). Adopted 2026-09-12, at the council’s third asking.
Reads are cited like commits. Every read gets a number and is cited by it in the grammar’s changelog — council read 17, spelled out, because the library’s oldest rule is that it never mints an acronym (naming.md), and a register that abbreviated its own readings would be the first place to break it. The readings themselves are listed in the section titled The register below.
What a read produces: findings against the draft, each applied, declined with a reason, or routed to the watch list (Section 18 of GRACE-lang.md). A member’s recusal on a finding about itself is recorded with the read.

The register

One line per reading, oldest first: the number, who read what, the date, and what the reading changed. A reading that produced no change says so. A count that moves states where it started as well as where it ended, and names what moved the start when that is not the last entry’s close — a reading is a delta and a delta needs both ends (2026-09-18, council read 136, after the clause went missing three units running). The register is the corpus’s own record and is read the way a spec is read — by its shape, not by scanning a paragraph (2026-09-12).

Council read 1 — Kimi on v0.28 and the Recoverable Invocation rewrite, 2026-09-10.
Council read 2 — Gemini on v0.28, 2026-09-11.
Council read 3 — GPT on v0.28, 2026-09-11.
Council read 4 — GLM on v0.29, 2026-09-11.
Council read 5 — GLM on v0.30, 2026-09-11.
Council read 6 — GLM on v0.31, 2026-09-11.
Council read 7 — GLM on Recoverable Invocation as rewritten, 2026-09-11. Two contradictions, one parse-blocking form (the signature block), a mechanical rewrite of about sixty rules, and a Principle 2 docket; applied the same day, language only, [Resolve] read pending.
Council read 8 — GLM on Lease as rewritten and relabelled, 2026-09-11. The relabel read clean in use; seven findings, of which the undeclared effect instant, the undeclared question set, the deixis in Composition note 2 and two watch-list flags were applied the same day, and the signature block’s arity, the term entry’s surface, the label families and the fence margin were decided by the maintainer the same day (v0.35): multi-action signature blocks admitted, the Terms › line the one owner with the term entry as reader sugar, the standard label families declared once in the grammar under a new locality principle, and the allowance made a floor so Check 6.1 does work.
Council read 9 — GLM on Actor Identity as rewritten, 2026-09-12. Five findings: an EXACTLY ONE OF splice in the self-containment invariant and another in the durability rule (both now declared terms), two composition notes restating the grammar’s own renumbering rule from the wrong side of Principle 9 through 11 (converted to the local fact they actually own), a one-member value set (dropped), and seam declared seven ways across the migrated atoms (each now cites execution-contract.md and names only what crosses locally). The read also asked the walker for the frontier, which cites.py --queue now answers.
Council read 10 — GLM on Personal Todo, 2026-09-12. Eight findings, the front-door read: duplicate-recent claimed by three surfaces and owned by none (the composing pattern owns it now, said once in each spec), [Edit]’s refusal arms overlapping with no precedence (now exclusive by condition, as Actor Identity’s are), now used in rules and declared nowhere across five migrated atoms (Closed vocabulary 4, now closed), a camelCase projection in a snake_case wire layer, Invariant 7 comparing fields that may not exist, and an invariant restating an identity rule. The read also named the corpus’s trend — the interiors are clean and the error mass has moved between the documents — which cites.py --drift now sweeps.
Council read 11 — GLM on Retention Window, 2026-09-12. Seven findings: purge eligible defined as a predicate and enumerated as a value set (now one declaration), Invariant 6.3 unreachable behind Operation 7 (deleted; the hazard it reached for is degenerate duration and a precondition), the purge signature’s arms in an order the rules contradict (reordered, and GRACE-lang.md Closed vocabulary 23 now says a signature’s arms carry no order), a transition declaration that cited its owner and restated it anyway, and — the one that earned a tool — Simultaneous retention 4, the atom’s sharpest rule, tested by no check. cites.py --unchecked is the inverse of the checker’s K-check-bare, and the atom now carries three external checks for the joint enforcement it cannot see from its own store.
Council read 12 — GLM on Subscription, 2026-09-12. The headline is the lost ledger: cancel’s whole authorization is an unguessable id the atom will not enumerate, so a composing pattern that loses the ids it captured holds subscriptions every audit can see and nobody can cancel. Four rules now own that failure, the composition note that assigned the capture was repriced from traceability to cancellability, and an Administrative Recovery pattern is named as the remedy this atom does not carry. Also: the pair race on the crown invariant (check-then-act, now one transition or a store constraint), an invariant comparing a field absent while active, a collection declared as an outcome set, a term entry citing a section no atom shape has, and an honest-clock rule imported from Retention Window so the audit scenario’s exact is not borrowed. Four classes counted rather than admitted: the total read at five, the term entry grammar at nine, addressable sections with a first specimen, and transition’s cite-and-restate, cured in six atoms.
Council read 13 — GLM on Tamper Evidence, 2026-09-12. The headline is a collision rather than a drift: proof check declared by both this atom and Actor Identity with different members, in two atoms one composition wires, and the grammar has no qualified form for citing a term across specs. Renamed to seal check with the reason recorded in the declaration. Also: record set match consumed by three rules with nobody declared to compute it (the host now supplies it at the seam, and the atom is forbidden to judge it), the same EXACTLY ONE OF splice Actor Identity carried — now with a mechanical detector, E-not-exclusive — an open mechanism-failure(reason) arm in a closed-set language (enumerated), and two checks resting on properties the atom does not hold (one softened, one moved to a new External checks block). Two classes counted: multiplicity polarity at seven atoms, and checks resting on unowned invariants at two.
Council read 14 — GLM on Assignment, 2026-09-12. The read’s own finding is that the loop has begun curing classes rather than instances (the assign race, conditioned optional-field invariants, the External check family’s first real use, transition cite-only). Seven findings applied: [Reassign] stamped twice with nothing binding the two stamps to one clock reading, while Check 2.3 audits a handoff by their equality — Retention Window’s one-now discipline now cited and stated; Invariant 7.4 readable two ways with its WHY crediting the wrong rule; Invariants 7.3 and 7.4 clearable by no records-alone check, now carrying External check 4 and named as the first load-bearing resident of the concurrency gap open-questions.md §Generation trust docks; a missing Status field term entry whose projection had drifted onto the record’s Type term entry; a Now term entry claiming one action of three; and two spellings of one arm. A fourth class docketed: a query’s answer is not a tag, at three specs.
Council read 15 — GLM on Permissions, 2026-09-12. Nine findings, of which the class-level one is an inverted ONLY IF: the grammar’s form reads outcome-then-condition, so granted_at MUST NOT EXCEED revoked_at ONLY IF revoked_at EXISTS states the converse of the intended guard, and the same inversion had been written into four atoms on the same day (all four repaired to IF … EXISTS THEN …). Also: two scenarios answering one historical question by contradictory methods (now one, resting on a declared live at an instant and a new Invariant 9.2), a completeness check citing the soundness rule, an invariant resting on an undeclared noun, a mechanism mandated where a behaviour was meant, a Now term entry claiming one action of two, and eleven obligations living twice — four now tombstoned to one owner each. The repair itself produced a finding the checker caught: a tombstone written as a fenced block’s first line demotes every rule under it (Surface 18), which F-prefix-first now refuses.
Council read 16 — GLM on Notification, 2026-09-12. Ten findings. Two were class-level and both bit: the payload-retention obligation collided with the durability invariants beside it (a composed purge now leaves every stored field as written, the shredding-class destruction Audit Trail already wires, so the mandate and the invariants stop contradicting), and the inverted ONLY IF turned out to have a second silhouette the four-spec census could not have caught — EXACTLY ONE … ONLY IF rather than MUST NOT EXCEED … ONLY IF. A sweep of every ONLY IF in the migrated atoms found exactly one more instance, now rewritten to need no reading at all. Also: the delivery window that defines [Expired] owned by no rule, the reconstruction biconditional living in a scenario’s parentheses for the third time in three atoms, the storage-failure polarity lesson Permissions taught not transferred, a term entry legislating a rejection ground no rule states, a missing [Now] term entry the same migration day as Permissions’, the query path’s malformed-input row, and a clock family that had begun disagreeing with itself. The read also self-corrected its own miscount from council read 15 in public, which is the discipline it holds the corpus to.
Council read 17 — GLM on Legal Hold, 2026-09-12. The first read run against pre-announced predictions — seven graded, three hits, three splits, one instructive miss. The deepest finding in any read so far: a [Read] routed to the wrong store instance answers empty, an empty answer reads as unheld, and unheld licenses the purge — so the spoliation this atom exists to document could happen through its own query surface. [Read] now answers the store_name it was routed to and the reader must match it before reading empty as unheld. Also: the storage-failure polarity copied from Permissions with its danger left behind (a failed place leaves a record unprotected while litigation pends; four rules now own it), the clock discipline softened by deletion where it needed a declared exception (the caller may claim placed_at and released_at, never now), an EXACTLY ONE OF ending in a catch-all that subsumed its own alternatives — now E-not-exclusive’s second shape, which immediately caught one more in Event Log — blank load-bearing in seven rules and defined only in an example, the reconstruction biconditional declared at its fourth instance, and a check citing two invariants for four fields. A fifth class docketed: the connectives drift. New reads append here.
Council read 18 — GLM on Message Preference, 2026-09-12. The first read of a truncated paste — it cut mid-sentence in the Composition notes and lost the Terms section, every term entry, the registry, the Ledger and the Decisions entry, which is the one place that would have answered the read’s own first question. Two findings applied: an invariant hanging an obligation on a principal, who does not call the atom (the composing pattern does, and Resumption 2 already said so — the duplicate is gone), and a non-goal that read against the supersession stamp beside it as if supersession recorded nothing (it withholds the reason field, and now says that). The rest are classes, and the read’s trend line is the finding: every cure this cycle was minted inside an atom — the instance model, fail-stop on a degenerate injection, disclosure-as-acceptance, durability scoped to a spec’s own surface — and none is declared in the grammar. Four classes docketed (the wrong-instance read at two atoms, the dangerous-side retry at three, which sections an atom carries at four, the input-handling regime at three regimes across four atoms); four updated. Three findings dissolved against the tail the read could not see: Temporal property, Invariant 9’s over this atom’s own surface, and the opaque-input bounds are all the prose spec’s own headings, carried across rather than invented — the rewrite minted no label family. The corpus’s center of gravity has reached the writing frontier, and the spec-of-specs is the lagging layer. Completed on the tail, 2026-09-12. The second half of the read found what looked like a silent edit — Non-goal 17 quoted one way in the read and standing another way in the tail — and built a mutability finding on it. The cause is the register’s own timing: the tail was pasted from a document the read’s own findings had already been applied to, so the read was diffing itself. Invariant 2.6, graded down in the same pass, had likewise already been removed for the reason the grading gave. The protocol finding survives the correction and is the better one: a read and its application race, and a paste carries no mark of the state it was taken from. The cure is a stamp on the paste, not a diff of the corpus. Two findings applied from the tail: none was the one read answer with no term entry while [Not Known] — its dual — had one, and a policy the deployment must disclose keys on it (carded, registry now 28); and the [Storage Failure] term entry’s fail-closed named the write’s polarity while saying nothing about which record keeps governing, which is Invariant 4.3’s answer and now points there. Two classes docketed: may a guard read the clock (the read’s own trigger, met — proposed boundary: exactly where the action accepts a caller-supplied instant, which makes Legal Hold and Message Preference agree rather than fork), and obligations resting on unowned wiring, named off the GDPR Article 21(2) reference. Three of the tail’s claims corrected: blank is declared in Legal Hold, has been since council read 17; Event Log carries the migrated marker, so Preference-Aware Notification Fanout’s constituent set is complete; and the Temporal property family is the prose spec’s own heading, which the Decisions entry says and the read confirmed.
Council read 19 — GPT on Session, 2026-09-12. Read as a code review rather than as prose, and the first read to reject a rewrite outright: not green yet. Two findings were the same defect and the sharpest the loop has produced — happens before is not may happen only after a successful result. The prose spec gated [Issue] on Credential.verify returning verified and gated a Permissions check on [Validate] answering valid; the rewrite had rendered both as forbidden-before, which admits a failed verify followed by an issue, and a validate whose answer is ignored. Both now gate on the outcome through a declared verified answer and invalid answer. Also: the rewrite’s own State 12 (the atom MUST NOT hold a credential) contradicted Identity 2 (the session_token MUST serve as the bearer credential) — the token is a credential by this atom’s definition, so the rule was deleted and Non-goal 1 renamed to the authentication credential it always meant; an invariant that said a terminal token MUST NOT return, which reads against [Read], now says [Issue] must not allocate a token any session carries; the store-durability count scoped to the atom’s own actions, the cure Message Preference named; and the JWT expiry constraint, normative and sitting in a WHY, promoted to a Token format family. Two findings were logic and went to the docket: uniqueness asserted over randomness with no collision path, at three atoms, and the fault ontology, which this read moved off §18’s watch list on a second instance that disagrees with the first.
Council read 20 — Gemini on Session, 2026-09-12. An approving read, and useful for what it approved: derived expiry over a stored flag, the immutable deadline with re-issuance instead of extension, the tight non-goals, and the revoked-before-lapsed ordering. Its three cautions were already owned — locking under mass revocation (Concurrency 1 through 3), boundary disagreement under clock skew (Clock semantics 6, which exists for exactly that and names the cost rather than hiding it), and a warning not to let 182 rules paralyse an implementation that fits in a hundred lines. The last is worth keeping as the answer to a recurring objection: the rule count is Principle 6 working, not rigour for its own sake — complexity lives in the number of simple rules, and the generated implementation is small precisely because no rule is. The read also collided with council read 19 on one rule: Gemini praised the explicit revoked-before-lapse ordering that GPT called over-specified implementation order. Both were right about different halves, and the restatement satisfies both — Invariant 3.3 now forbids the outcome ([Validate] MUST NOT answer expired for a revoked session) rather than an evaluation order, so the guarantee Gemini approved survives and the implementation freedom GPT asked for is restored. First disagreement between two council members on one line, and the first resolved by finding the claim underneath both.
Council read 21 — Claude on Capability, 2026-09-12. The chair’s own read, run as the rewrite rather than after it, and pre-registered for the collision it found: Session and Capability share one mechanic — a bearer token, a derived lapse, an explicit cancel — and disagree on whether a lapsed record may still be revoked. Session accepts the revoke and records who closed it; Capability answers [Already Terminal] by derivation. Both deliberate, neither declaring the other, and the cost is asymmetric audit — a breach triage can attribute the closure of an exposed session and cannot attribute the closure of an exposed capability. Docketed, not reconciled. The read also cured a class from the other direction: council read 19’s finding that uniqueness asserted over randomness has no collision path turns out to have an exception, and Capability is it — Invariant 12.2 makes the store refuse a colliding write, so uniqueness is enforced and a collision surfaces as [Storage Failure] with no new arm and no softened invariant. The docket row is now 2 atoms, 1 cure, and the cure needs no grammar. Two prose caveats became External check 1 through 2: a refused [Redeem] leaves no trace in the record, and the redeemer’s identity is absent by construction, so both audits need the composing journal and the spec now says which.
Council read 22 — GPT on Capability, 2026-09-12. Not green, with two blockers, and the first read to find a hole in an atom rather than in the rewrite of one. The blocker the migration exists to find: [Redeem] lowers the counter and can move the status in the same operation, and its value set carries no outcome for that write failing, while [Allocate] and [Revoke] — which write less — both carry [Storage Failure]. The prose spec states the gap as a feature (all five outcomes are first-class results, not errors), which is how it passed Final Critique 5: every outcome named is a result, and the unnamed one is the write. Docketed as a blocker, because adding the arm is logic. The read’s sharpest observation is that the rewrite’s own case table confessed it — a row reading either write in an atom with three mutating actions — and that row now names the two writes that have the arm, with a NOTE: watch beside the block saying what the third lacks. The second blocker was the rewrite’s: the prose bounded the crash guarantee to a crash between an in-flight decrement and its status write, and the rewrite generalized it to a crash inside [Redeem], which claims the impossible about a crash one instruction past a durable commit — now split at the commit boundary over declared uncommitted crash and committed crash. Five more applied: a concurrency rule that contradicted the token-collision refusal (deleted; Operation 1 already owned it), an Invariant 6 claiming three distinct terminal modes while the field grammar admitted hybrids (two rules added, both entailed by the action wiring), two checks asking a current record to evidence a historical fact (split into present-state checks and External checks over the composing journal, the cure Tamper Evidence took at council read 13), an External check whose unconditional MUST created an obligation the atom does not have (now conditional, on the deployment that needs the attribution), and an Identity rule claiming lifetime token non-reuse the prose had already scoped to retained records. One further class docketed: a caller-supplied actor reference recorded under a field an invariant calls attribution, in two atoms.
Council read 23 — Gemini on Capability, 2026-09-12. Approving, and one of its three objections is the corpus’s own answer to another member. Gemini called collision handling theoretical nonsense and prescribed the fix — a standard generator, a unique index, and let the store throw on the one-in-a-trillion — which is Invariant 12.2 verbatim, the rule council read 19 wanted and council read 21 found here. The objection endorses the cure while calling the hazard theoretical, which is the strongest argument yet for propagating it to Session and Subscription. Its other two land against standing answers: the string policy is academic fluff where GLM’s council read 18 found the opposite — three input-handling regimes across four atoms, with the cure being one explicit posture repeated — and the rule count is Principle 6 working rather than bloat, the implementation being small precisely because no rule is. Recorded rather than applied: two members want opposite things about the string family, and the cross-atom drift is the reason the explicit version wins.
Council read 24 — Kimi on GRACE lang v0.35 and Recoverable Invocation, 2026-09-12. A full mechanical sweep of all 557 normative lines in the pilot composition, and the first read whose findings were mostly about the instrument rather than the spec: the checker reported Recoverable Invocation clean. Three classes the grammar states as Hard invariants were unenforced or under-enforced, all three confirmed independently and all three now instrumented — Hard invariant 8’s lower-case OR advisory at 46 sites, Hard invariant 5 with no implementation at all and now a heuristic at 27 sites, and Hard invariant 4’s pronoun declaration naming four demonstratives and naming the checker as what enforces them when it checked none of the four. The sweep also caught the grammar misreporting its own corpus: §18 claimed the withdrawn release-and-reject idiom has no site and two survive in close step 3.7 and close step 3.8, where a modal joins a release to an outcome rather than to a second verb — which is also why the new heuristic finds eleven sites in that spec and not those two. §18 now states the correction and rests the withdrawal on Principle 2, where it always belonged: two sites in one specification are not recurrence across specifications. The distribution is the read’s quiet finding — 23 of the 27 two-obligation sites are in the two pilot compositions, which dates the miss to before the split discipline matured and predicts where the composition rewrites will be hardest. Two of the sweep’s boundary classes came with a working detector and were ported outright rather than re-derived — the English comparator and the unadmitted modal, now W-comparator and W-modal, at thirty-eight and ten sites, and agreeing with the sweep’s own count for that spec within one. Their distribution repeats the two-obligation finding exactly: twenty-seven of the thirty-eight are in Recoverable Invocation, and each atom migrated in v0.35 carries one to four. The rest of the sweep (cardinality beyond the quantifier set, subjects that do not resolve, three surface restructures) is Monday’s work on the pilots, and the read’s own observation that Recoverable Invocation planted five watch flags where roughly forty pressures sit means §18’s counts are understated corpus-wide by whatever that miss rate propagates.
Council read 25 — GPT on GRACE lang v0.36, 2026-09-12. Pressure-tested the new casing tiers and found them contradicting Casing 5 at 62 sites: the draft claimed an initial capital for word-named label families, and 62 families are named after declared lower-case terms. The label-family claim was removed outright — Rule shape 7 already owns it — leaving the tiers to say only what no other rule says.
Council read 26 — GPT on Capacity Constraint Enforcement, 2026-09-12. Found Invariant 4.3 grammatically broken — a comparison with no operand — in a line I wrote that the checker passed clean, which proved the checker validated no condition at all. Fixed, docketed, and instrumented as W-condition-operator. The read also carried the bloat exchange whose measurement went against me: 46 cross-family near-duplicate pairs in one atom, 7 verbatim, which is Hard invariant 16 violated rather than served.
Council read 27 — GLM on GRACE lang v0.36–v0.38, 2026-09-12. Caught the casing tier value set shipping with three members against a census that had already counted 104 sentence-case families in use — Value set 3 forbids the implicit other, so the set gained sentence case as v0.39. Two Principle 8 rulings left open: whether cosmetic disagreement at the wire layer is a finding, and which copy is first under Authority 3.
Council read 28 — GLM on Provenance, 2026-09-12. The first read of an atom written after the class cures rather than repaired into them, and it still found a logic change I had made: the rewrite’s State 4 said every entry carries a custodian_ref, where the prose said a transferred entry carries the from/to pair in place of it. The witness was the [Custodian Ref] term entry, preserved byte-identical through the migration — which is the argument for preserving them. Three docket rows moved: the degenerate bound to five instances (sequence_range inclusivity undeclared), a query’s answer is not a tag to four specs, and host obligations gained the shape question — a corpus default a deployment may override, or none at all. One finding declined: folding the length cap into blank would make an over-long argument not exist, and it exists.
Council read 29 — GLM on Audit Trail, 2026-09-12. The most load-bearing unread document, finally read, in four slices two of which arrived mislabelled and spliced clean. One finding applied as v0.40: cited and composing patterns are categories in active use and absent from the category value set, which Value set 3 forbids — and check.py already carried both names in two hard-coded sets, so the instrument had recognized them two versions before the grammar did. The checker now derives the category set from the grammar and exits rather than guess, so the drift cannot repeat. Four watch and docket moves: the ≥ comparison spelled as a two-arm disjunction, which GLM flagged from one site and the census found at five across two specs — recurrence under Principle 2 already met; the side-channel qualifier ((compensation-window)), one specimen, no category owning the form; the query-answer class landing the composition specimen it was waiting for, exactly where the Provenance read predicted; and a new docket row for term-registry drift, the instrument that would make Closed vocabulary 17 real. Two of the read’s own findings did not survive checking: the purge_eligible block is complete and was a slice artifact, and seal_now 5 restates no range — Terms › slice owns it once — though that rule does carry two obligations, which the checker already counts among the composition’s twelve. The five Ledger open lines were confirmed against the terrain rather than closed; B2 (the orphan-generation path, one carried event_id) and B3 (the substrate’s restart survival, one Composes line) are named as the highest-value fixes and are logic, so they stay open for a maintainer ruling.
Council read 30 — GLM on Selective Disclosure, 2026-09-12. Found an assembly seam both tools passed: the migrated atom carried two ## Terms headings, because the extraction began at the old section heading rather than at the first term entry, so the rewritten vocabulary and the prose preamble it replaces both sat under a heading of their own. Fixed, and the linter gained M-terms-doubled — no instrument read headings, which is why a doubled section survived a clean run on both checkers. The read’s Kind — one of four miscount is real and predates the migration: the sentence enumerates five, and the correction went to all 33 files carrying it. Two new docket rows, both sharp: the world-scope invariant (Invariant 5.1 quantifies over events the atom cannot observe — the only invariant in the corpus ranging over the world rather than a store, falsifiable by nothing inside the atom and closable only by a composition owning the sole disclosure surface), and the correction link (Provenance links a correcting record by sequence_number, this atom by prose inside a declared correction narrative; two append-only atoms, two mechanisms, one of them mechanically resolvable). The string-cap divergence reached three postures in three atoms and now carries the docket’s trigger shape. Four of the read’s five predictions hit; the miss is the most useful — Selective Disclosure carries no cited line despite naming seven sibling atoms, because citation is triggered by a spec’s rules using another’s vocabulary, not by referring to it, which gives v0.40’s new category an observable habitat. Counts corrected upward again: the read put Clock semantics at seven and the census found sixteen, and blank NOT EXISTS at two atoms plus a flag where the census found six. A reader estimates from what one reader can see; the census is the instrument, and §18 now says so.
Council read 31 — GLM on State Machine, 2026-09-12. The read graded five predictions and hit five, and its sharpest finding was staged as evidence rather than run — so running it corrected the corpus twice and the correction is mine. The hypothesis: every ≥ rule site has a term entry already carrying the shorthand, so the class self-cures and the operator would serve surfaces that do not need it. It does not hold — one of three sites has such a term entry, and that one is State Machine’s, which carries no rule-surface disjunction at all. What running it did find is that the census behind council read 29 was wrong: the class is two sites in two specs, not five, because a hand-written EXCEEDS … OR … = match also catches X EXCEEDS Y OR Y = none, which is two propositions and no comparison. check.py gained W-ge-disjunction, which compares both arms’ operands, so the count no longer depends on who is reading — and this is the second time in three reads that a count corrected on inspection, the first two being a member’s and this one the chair’s. The class also splits: a ≥ between instants has a one-arm cure (IF b precedes a THEN refuses exactly what a ≥ b admits, which is State Machine’s Operation 20), and a ≥ between numbers has none, because inverting it inverts the rule’s polarity. Both survivors are numeric, so the ruling’s question narrowed from five sites want an operator to two numeric sites want one, with the temporal sites already cured. Two docket rows opened: the answer-capture check at three atoms with one reason and one cure, and the temporal lower bound at two atoms with two defensible postures and no declared fork. The terms ruling gained its counter-example — transition is declared in three senses in one spec and is harmless, because one registry owns all three and every rule names which, where proof check is the same shape across two specs and is not.
Council read 32 — Claude on Approval Step, 2026-09-12. The chair’s own read, run as the migration. The atom’s prose repeated its six-step rejection precedence verbatim four times — once per resolving action and once in the state table — and the rewrite collapsed it to one case space over declared resolving action, deciding reference and decision instant terms, which is where most of the 18 KB went. Three propositions had two owners each, all three found by W-duplicate-proposition. The finding worth keeping is a cross-spec citation written in the local form: the atom cited Selective Disclosure’s Invariant 5 bare, where this spec’s own Invariant 5 is submitter exclusivity, and the citation-aim audit resolved it against the local registry and got the wrong rule. §11 declares the qualified form and nothing enforces it; a corpus census returns 24 candidates of which nearly all are local citations sitting near a spec link, so the class is docketed rather than instrumented — the detector would need to tell a local citation from a cross-spec one, which no instrument does. check.py’s F-bracket also gained hyphens: its marker pattern was [A-Z][A-Za-z ]+, so [Multi-Party Approval] inside a rule read as a bracket range rather than a pattern name, and this atom is the first spec to name a hyphenated pattern inside a fence.
Council read 33 — GLM on Approval Step, 2026-09-13. The read graded the pole-pair cross-check 4/4 in both directions and corrected its own war story against the Ledger — it had this atom grounded on the founding week, and the Ledger says the twin is founding-week and the gate a month later. Two findings acted on and one enlarged. The family counts in §18 had gone stale on arrival for the third consecutive read, so they are no longer hand-copied: the clause now carries Family (N) in a parseable form and lint.py’s new W-stale-census compares every count against the corpus on each run, which makes a stale number a finding rather than a discovery — the same move check.py made on the category set at v0.40, and the same lesson twice. The read’s ≥ observation was offered as three specimens and stated, per the council read 31 lesson, as an observation rather than staged evidence; counting it found 36 term entries across 30 specs carrying ≥ as reader shorthand, of which 35 sit in specs whose rule surface carries no disjunction at all. That settles the surface half of the ruling without touching the normative half: the symbol is established practice where Surface 27 says a term entry carries no obligation, and all but absent where obligations live. The lost-answer synthesis was admitted as a docket row in the read’s own framing — caller-side discipline, auditor-side capture and a composition’s open line are one fact seen three times, with the fork being that a retry is self-detecting where the action moved state and duplicating where it only appended. The answer-capture row ticked to four atoms, as the read said.
Council read 142 — a label family is an address, 2026-09-21. The ruling: a label family takes English, and the register carries it because the corpus had the answer and the chair asked anyway. The wire is written where the wire belongs, and a label family is not a wire surface — it is the corpus’s own addressing, the line an auditor reads first, and seal_coverage 1 reads aloud as seal underscore coverage one on the most-read line of the page. English multiword families are already the norm — Capability requirement, Composition state, Action wiring — and the 36 snake families are migration-era artifacts, minted from deployment tokens. 761 sites across ten specifications: Audit Trail 449 with 25 families, Recoverable Invocation 283 with 19, and single figures in Observation, Defensible Retention, Customer Onboarding, Actor Suspension, Authenticated Actor, Attributed Permissions Admin, Medication Order and Notification Fanout. Each family’s bullet heading moved with it, as Rule shape 7 requires, along with its inline declaration and all 196 of its on-page citations. Not one unmigrated page was touched, and X-ref — which fires on a reference to a label no rule carries — found nothing, so the redirect is closed by instrument rather than by assertion. No tombstone is owed: a tombstone records a rule that no longer exists and every rule here survives at a new address. The claim this unit first made was surface-unstated, and GLM’s scan caught it in the same breath as the rule against exactly that. What closes is the setting families — a family whose name is declared by an inline Term <name>: line — and that class is now zero. It is not every label family: 204 label lines in 13 action-derived families survive, 175 in Audit Trail and 29 in Recoverable Invocation — record_action step 54, purge_event step 32, verify_record step 29, purge_event 17, read_invocation 17, read_record step 16, seal_now 12, journal_fence none 8, purge_eligible 6, read_record 4, verify_record 4, journal_fence 4, record_action 1. The chair’s scan found only the families carrying an inline declaration and reported the subset as the whole, which is the third count in five units to go out on a surface it did not name — and this one in the same unit that wrote the rule against it. Why they are snake is structural, not clerical. Rule shape 7 makes a label name the heading it sits under, and Audit Trail heads its contract sections with the wire spelling — #### record_action`` at line 512 — while carrying #### Record Action as the term entry at line 1551. Six such pairs: one concept, two sections, told apart by spelling alone. The families are snake because the headings are, and the headings cannot simply take English while a second section already holds that name. Renaming them is a question about how Audit Trail addresses its own contracts, not a spelling sweep, and it is routed as its own unit. Two measurements bound it: all 426 mentions of these names in unmigrated specifications sit inside a code span, and exactly one citation of one of these families comes from another migrated page, so the blast radius is one specification and its neighbour. The 50 bare mentions in other migrated pages are not addresses at all — they name the call, Audit Trail's verify_record answers verified, which is wire and stays wire whatever the family does. The chair routed this and should not have. The routing rested on 35 of the names reach specifications that are not migrated at all — a count of occurrences with no surface named. Measured properly, all 237 mentions in the sixteen unmigrated specifications sit inside a code span, which Term code span already rules keeps the code spelling, and zero specifications cite these families from off-page. There was no corpus-wide sweep and no admission; the project’s own rules decided it, which is what the chair is asked to do with them. This is the second count in three units to go out with its surface unstated — council read 138’s residue was 1,279 because it counted label openers and called them rule lines. Council read 138 put the rule in the register for a count that moves; it now carries the other half: a count of what a name touches is a count on a surface, and the surface is named. What the rename makes visible. Unresolved noun phrases rise 2,320 to 2,342, the largest move of the series: Audit Trail +27, Recoverable Invocation −4, Login −1, and no other specification moved at all. The cause is not a name that stopped resolving — of the 36, exactly two are unresolved anywhere, retention policy at one site each in Legal Hold and Attributed Permissions Admin, which name it without citing it and belong to the no-declaration-path class. The rise is inner words the code spelling had hidden: retention alone at 24 sites where it was 13, sequence at 8 where it was 1, entry at 12 where it was 6. retention_policy was one token to the reader and retention policy is two, one of which nothing declares. That is the modifier class §18 has watched since council read 106, arriving by rename — the words were always in the corpus and the wire spelling hid them from the instrument. A count that rises because a reader can finally see is the reader working. What is left of the inline names: twenty, of which seventeen touch migrated pages only and are the next unit, and three — Audit Trail’s retention_state, Recoverable Invocation’s recovery_intended, Shared Todo’s actor_ref — are written bare on an unmigrated page and wait for it. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 280 — Shared Todo, Final Critique 8, and the cure, 2026-09-30. 1 foundational, 10 refining, 2 rhetorical. The foundational named its divergence: Personal Todo’s description uniqueness holds only for a linear sequence of calls (its Concurrency 1 and 3), a shared list has many callers, and Concurrency 1’s lock keyed by task id cannot cover an add, which names none — so a task-id lock, the page’s own wording, lets two adds hold one description where a single-writer host does not. Concurrency 6 serializes description writes across the instance, Composition note 6 makes the serialization the deployment’s, External check 6 routes its evidence to the deployment. Refining and rhetorical routed open. The gate’s session wrote the cure, so the cure goes to another cold reader.
Council read 278 — a cold gate on Shared Todo, Final Critique 7, and the cure, 2026-09-30. The second page gated under the severity test. 1 foundational, 9 refining. The foundational named its divergence: Concurrency 1 serializes calls naming one task id, and [Reassign Task] and [Recall Assignment] name an assignment id Assignment cannot trace to its task, so a reassign landing between a delete’s read and its recall leaves the recall answering not-active — which one implementation returned, undeclared, and another answered by recalling the new assignment and deleting. Action wiring 22 makes it the second: a not-active recall sends the delete back to read the active assignment again. The nine refining are routed open in one Ledger line, the model’s fused delete among them, and none is cured into the page. Shared Todo stays partially resolved for the gate the cure owes.
Council read 276 — Credential’s model re-derived; Credential grounded, 2026-09-29. The model carried one deadline for every credential and one reading per step, so the races the English added that day could not happen in it. Re-derived: per-credential deadlines, a call’s one reading held from its start to its commit, the pair’s critical section with a holder released as overdue, revoke outside the section, and a store that may begin holding one credential; Invariant 2.1 checked at every settled reading. 36,772 states, all invariants hold. Four twins, each removing one mechanism, each rejected: the successor link (Invariant 7.1), the section (Capability requirement 8), the refusal of an overdue commit (Capability requirement 23), and Operation 65 — the last one only reachable once the store could begin holding a credential, since two one-shot calls cannot register a prior, rotate it and race a register. Each uniqueness twin was also checked alone to show it breaks uniqueness and nothing else. MaxClock = 3 would not finish locally; 2 covers every ordering the races need, and the coverage matrix says why. Credential is grounded on Final Critique 12 — 2026-09-29, the first pattern grounded under the severity test and the first of the regrounding campaign.
Council read 274 — Credential re-grounded in English, Final Critique 12, 2026-09-29. The first gate run under the severity test What “grounded” means now carries: 0 foundational, 12 refining, every refining finding routed open in one Ledger line and none cured into the page. The reader named its three nearest misses and why each stayed refining — id non-reuse after a purge (the rule already forbids reuse; only its WHY narrows it), a read that no routing rule reaches across store instances (Operation 51 already says every), and a lapse that reopens a principal reference to any enrollment proof (no invariant of the atom breaks). That is the test doing what it was written for. Credential is grounded (English) on Final Critique 12 — 2026-09-29 — formal layer pending; the model re-derivation is its open formal line. Six gates in one day, Final Critique 7 through 12: 8, 1, 1, 1, 2 and 0 foundational. The first of them found what an implementer needs and the page never said; the next four mostly found the previous cure; the last two ran under a test that asks for the diverging implementations.
Council read 272 — Final Critique 10 and 11 on Credential, and what blocks, 2026-09-29. Final Critique 10 (a cold reader; cured in 29156dd) found one foundational, the section released on a death the store cannot tell from slowness. Final Critique 11 found two, each naming two conforming implementations that diverge: a blank filter field read as naming no field returns the whole store, read as naming one returns nothing — now Operation 73, nothing; and a length bound with no unit, bytes against code points — now Capability requirement 14, code points. Its thirteen refining and one rhetorical are routed open in one Ledger line and not cured. That is the change. Five gates since Final Critique 6 cured every refining finding in the pass that found it; the page grew by half, from 68 to 101 kilobytes, and four of the five foundational findings after Final Critique 7 were the previous cure’s text — the flat-density lesson this document already records, repeated on one page in one day. From here a gate blocks only on a finding that names the diverging implementations or the reachable state that breaks a claim, and refining findings wait in the Ledger, as they did for every pattern grounded before this campaign.
Council read 270 — a cold gate on Credential, Final Critique 9, and the cure, 2026-09-29. The fourth gate of the day. 1 foundational, 10 refining, 2 rhetorical — the same foundational count as Final Critique 8, and again the previous cure’s making. Final Critique 7 had split checking from deriving so a salted hash and a signature could be verified; nothing then tied the two functions a type declares, so a check function answering no match to everything satisfied every rule, Operation 23 and Invariant 3.1 included. Capability requirement 29 and 30 tie them, and External check 13 runs the pair on material an auditor supplies, since no record keeps the material that would show it. The refining: rotate’s derivation needed the type the call does not carry; Invariant 2.1, 4.1 and 11.1 held only at a reading they did not name, and the page’s own race example broke 2.1 as written — now a settled reading; the public key’s verified answer claimed more than it establishes, now disclaimed, with an example of a replayed signature; by whom overclaimed in the Summary, an example and a standard; the authorized caller’s arms did not all say authenticated; the material had no bound on rotate and verify, now refused before any hashing; reuse on rotate unnamed; a purge left rotation links dangling, now purged whole; the unbounded default in the term alone; fido2 unglossed; and Identity 12 through 15, deployment obligations, tombstoned into the deployment’s family. Labels put in order. Credential stays partially resolved. The pattern across Final Critique 7 through 9 is worth keeping: each foundational after the first was the prior cure’s, which says a cure is load-bearing text and earns its own reader — the rule Touch triggers re-pass already says so.
Council read 268 — a cold gate on Credential, Final Critique 8, and the cure, 2026-09-29. A new session, Ledger and Decisions shut, Pass 3 asked to implement each action for a salted password and a public key. Not cleared, but the curve bent: 1 foundational, 14 refining, 3 rhetorical, against 8 foundational one round earlier. The foundational was the cure’s own: Composition note 12 through 14 required the caller authenticated, never as whom, so a caller authenticated as Alice satisfied them rotating Bob’s credential, and a principal’s first registration had nothing to authenticate against. The authorized caller now carries the binding. The refining were mostly the page reaching its edges: Login named as owner of lockout and multi-factor sequencing it disclaims; no owner for a challenge’s freshness; one-way wrong for a public key; the seam order of derivation and check unsaid; material’s bound and normalization owned by no one; an auditor’s clock free to precede a registration; no family for a lost acknowledgement; a verify racing a revoke; erasure with no owner beside a count that may not fall; a read with no tie-break and no gate; three glosses; a stale standard edition and an anchor pointing at no rotation rule. All cured. Credential stays partially resolved; the cure goes to one more cold reader.
Council read 266 — Claude on the fourteenth cold regeneration: Credential, 2026-09-29. Built as the builder’s check GLM asked for after Final Critique 7, before the stranger’s gate: the atom whole into demos/credential-regen/, with three real credential types — a salted scrypt password, an API-token hash, an Ed25519 key checked against a signed challenge — 13 tests green. Credential had been rendered only as far as Login reached it, with one unsalted hash computed inside the transition.

The page. Three gaps, all where the cryptography meets the seam. A salted derivation needs a salt, and the page supplied only the clock and the id material; Execution Contract Logic confinement 3 wants entropy injected (Capability requirement 24). The derivation registry was supplied at the seam and, by silence, run inside the transition, where Logic confinement 1 allows no cryptography (Capability requirement 25, 26). And the default validity was required by one rule and omittable by its term; it may now be declared unbounded. Operation 20 now speaks of checking, as the check function does. Final Critique 7’s finding c was right and incomplete: it made verify possible for a salted hash and did not ask where the salt comes from. Credential stays partially resolved; the cure goes to a new session’s cold gate.
Council read 264 — Sonnet’s cold gate on Credential, Final Critique 7, and the cure, 2026-09-29. The seal the cure of read 262 waited for, sent to a session that had never seen the page, with the Ledger and Decisions held shut until its findings were written. It did not clear: 8 foundational, 12 refining, 4 rhetorical, where the reader who had passed the page one round earlier found one. The difference is the point of a cold reader. GLM read the touch and its neighbours; Sonnet read the page as an implementer would, and found what an implementer needs and the page never said. [Rotate] named its successor’s pair and status and nothing else — no id, verifier, registration instant or deadline — while State 1 requires them. [Verify] was derive, then compare equal, which cannot check a salted hash or a signature, beside a type list naming one-time-code seeds whose verifier cannot be one-way. The default expiry was an instant, so once it passed every default registration was born lapsed. [Rotate] ran outside the pair’s critical section, so a rotate on an early reading and a register on a late one could both commit two effective-active credentials. The record carried a type and not a function, so a rebound type silently failed every existing credential. Seven invariants had no check. Revoked by reference was the caller’s word, with no note binding it to an authenticated caller. And two composing patterns were named that do not exist. All 24 are cured in the page — though the first pass left five of them part-cured, which Sonnet caught by comparing the summary against its own list without the page: the round narration in three WHYs, the missing examples, the id material’s freshness, String 9 and the well-formedness term in the priority guards, and a stalled holder of the section. Those are cured too (Identity 13, Capability requirement 21 through 23), most as rules: Operation 58 through 69, Capability requirement 17 through 20, Composition note 12 through 15, Non-goal 29 and 30, Check 5.4 and 7.3, External check 8 through 10; String 8, which could never fire, is deleted. The per-credential deadline and the rotate-against-register race are beyond the model, which carries one deadline and one reading per step, so formal: is pending re-derivation and the model is an open line. Credential stays partially resolved; the cure goes to another cold reader. Compositions affected: Login, External Onboarding, Authenticated Actor — [Rotate] gains an optional deadline and [Verify]’s signature is unchanged.
Council read 262 — GLM’s fresh-reader gate on Credential, and the cure, 2026-09-29. The first gate of the regrounding campaign, run as a three-pass round over the whole page after read 246’s scoping of String 7 through 9. The touch held. The gate found what no instrument reads: State 7 forbade a credential carrying an expiry instant, the page’s own name for the deadline that State 2 permits, Operation 12 and 13 record, and Invariant 12.2 and Check 2.3 read — so Check 2.2 failed every store holding a deadline. The WHY meant a stored expired_at beside a status that stays active, and that thing had no name. It now does: lapse instant, which State 7 and Check 2.2 forbid. Three refining — Invalid Request’s term entry still unscoped after String 7 through 9, Now declared a parameter of Register alone, a standards citation of the deleted Invariant 8.2 — and one rhetorical, Non-goal 27’s WHY a section from its rule; all cured. One foundational means not cleared: Credential stays partially resolved, and the cure goes to a fresh reader. Credential has never been regenerated; a builder storing a deadline against State 7 would have met the same wall.
Council read 260 — Claude on the thirteenth cold regeneration: Undo History, 2026-09-28. The last of the 2026-09-14 pages to be built, found unbuilt at read 258 by its Term qualifiers line where its Decisions carry no rewrite entry. Regenerated from its page, Personal Todo and Event Log into demos/undo-history-regen/: the six actions, the five event schemas and the replay, 12 tests green. No earlier render exists.

The page. Two gaps, neither the rewrite’s: the page was already in rule form before 2026-09-14, and the rewrite changed spelling only — the one page of the seven whose rewrite dropped nothing. Event schema 8 called Event Log’s invalid-payload unreachable because every payload is built from validated inputs, but the inputs are validated against Personal Todo’s description cap and the arm fires on Event Log’s payload cap; the deployment sets both, and an edit carries two descriptions. Event schema 9 now declares the bound. And Wiring decision 5 forbade calling Personal Todo’s add to restore a deleted unit, which the replay does for every unit it restores; it now forbids appending an add event, the Memento its WHY rejects. Both are load-bearing by the entry Touch triggers re-pass, so Undo History moves from grounded on Final Critique 6 — 2026-08-26 to partially resolved; views regenerated. It was the last grounded composition: none of the 26 stands grounded now: 25 are partially resolved and one is a draft.

The prediction. The seven 2026-09-14 pages are built. The rewrite’s dropped decisions, per page as each read counted them: Login 10, Authenticated Actor 7, Idempotent Reservation 6, Shared Todo 3 (nine signatures among them), Notification Fanout 1, Customer Onboarding 1, Undo History 0. The page that lost nothing was the one already written as rules — a rewrite keeps what was a rule and loses what was a step.
Council read 258 — Claude on the twelfth cold regeneration: Shared Todo, 2026-09-28. The fourth of the 2026-09-14 pages, and the last of them the queue had named; Undo History, found unbuilt when this read’s queue was measured, is the fifth and last. Regenerated from its page, Personal Todo, Permissions and Assignment into demos/shared-todo-regen/: the gate, the cascade, the seven actions and the two derived queries, 12 tests green. No earlier render exists. Personal Todo is rendered for the first time.

The page. Four gaps, three of them the rewrite’s. It dropped all nine signatures the prose carried as projected contracts, so nothing said what an action takes or answers, and Responsible Actor’s unassigned and not-known lived only in a term entry while Check 5.1 and 5.2 cited a rule stating neither; the signatures are back and the answers are Action wiring 20 and 21. The visible-tasks term said none otherwise, the empty set Action wiring 19 forbids. And Check 4.2 asked for a grant record keyed on a task id no grant carries; Invariant 5.2 now says a task’s delete changes no grant, checked externally. The fourth was the prose’s: a WHY citing Non-goal 14 for Non-goal 15, and calling Personal Todo’s active set pending where it is pending and done. Signatures and an invariant are load-bearing, so Shared Todo moves from grounded on Final Critique 6 — 2026-08-26 to partially resolved, the re-pass owed; views regenerated.

The roadmap. Moving Shared Todo’s row found Credential’s still reading grounded, and the atom line still saying all 27 atoms are grounded, a day after read 246 returned Credential: 28 atoms stand, 26 grounded, Credential partially resolved, Lease a draft. Both are corrected. The roadmap mirrors a status by hand, and the unit that moves the status is the only one that remembers to.
Council read 256 — Claude on the eleventh cold regeneration: Authenticated Actor, 2026-09-28. The third of the 2026-09-14 pages, cited by five. Regenerated from its page, Credential and Actor Identity into demos/authenticated-actor-regen/: the three actions, the per-principal critical section with its lease, and the orphaned-credential leg. 18 tests green. No earlier render exists.

The page. Nine gaps, seven of them the rewrite’s: the prose decided each and the 2026-09-14 rewrite, which claimed to change nothing but language, dropped it. The optional credential type had a default nobody read, and Primitive policy 4 refused its absence as blank. Credential’s register refusals had no landing, though the signature carries storage-failure naming the credential. A lapsed registration finding its actor reference bound fell to the guard’s answer, which says nothing committed after the credential had. The refused entry’s observed status and credential id were stated nowhere, and Check 3.2 cited a rule that says neither. The orphaned-credential leg keyed on the binding’s initial credential id and reported every rotation’s successor as an orphan, where the prose keyed it on the pair, as the gate is keyed. Verify resolved only a verified attestation. The attest lease’s two termini lived in a WHY. The two not the rewrite’s: a refusal whose log append failed was owed an attestation id it cannot have, and Invariant 4.1 promised an entry Invariant 4.2 names the call that cannot write; and Term attest credential, since a naming sweep on 09-22, described another page’s journal. Authenticated Actor stays partially resolved.

The prediction. The rewrite dropped seven decisions here, against ten at Login, six at Idempotent Reservation and one at Notification Fanout. A page rewritten as rules keeps what its steps said only where a rule was written for each step; the numbered steps here carried the landings, and the landings are what went.
Council read 254 — Claude on the tenth cold regeneration: Customer Onboarding, 2026-09-28. The second of the 2026-09-14 pages, cited by six. Regenerated from its page, Party Identity, Retention Window and the Audit Trail substrate into demos/customer-onboarding-regen/, to the depth of its six actions, the gate and the four indexes; the rebuild and the reconciliation are not rendered. 10 tests green. No earlier render exists.

The pages. Four gaps. One is the rewrite’s: the prose’s never clear the set — never sweep it wholesale — became Action wiring 106, MUST NOT empty the open-trigger set, which every healthy clearance breaks; it now forbids dropping a trigger the clearance record does not name. The external path’s read had no landing for a read that did not answer, where the trigger and the gate both answer state-unavailable; Action wiring 154 and the signature carry it. The position token was defined as which record failed and used by eleven rules as whether a constituent write had committed; the term now says what the rules use. And Party Identity declared verification result twice — verify’s passed-or-failed input and, in one term line, verify’s answer; the answer is now verify answer. That touch moves no rule, so Party Identity stays grounded. Customer Onboarding stays partially resolved.
Council read 252 — Claude on the public verify gate, red for eighteen days, 2026-09-28. The Verify corpus claims workflow the evidence page links as check it yourself last passed on 2026-09-10 at a32b9f8 and failed on every completed push and weekly run after it, on one step: Audit every model. The conformance job, the five renders agreeing and the negative control catching its injected defect, passed every time. Nobody routed it, and the units since reported green on the local checks alone. The page says a red gate is a finding that routes through review; this one did not route, and the chair did not look.

Why. Recoverable Invocation’s models arrived on 2026-09-10 and moved beside their page on 09-13. Among them are reachability probes, each a deliberate falsehood its own file says to run with --buggy, and audit.mjs knew one kind of expected violation — a file name containing buggy. Eight probes were read as models that must hold, and failed by working. A ninth file had the opposite fault: recoverable-invocation-buggy-intentgate, the twin of a remedy the page declined on 2026-09-10 (the fence earns Invariant 8; the lease gate does not), holds, as that decision says it should, and was read as a twin the checker must reject. The page’s own formal line counts nine twins and never counted it.

The cure. The eight probes carry a second line, \* EXPECT: violation, and audit.mjs reads it; the ninth is renamed probe-intentgate-off, a model that holds, beside probe-intentgate-clean. No model changed. Measured locally from a copy outside the repo: 100 of the 108 TLA+ models and all 19 Alloy models reach their expected verdict under the cured audit. The main Recoverable Invocation model and seven of its isolations each outrun the 180-second window this session’s shell allows, so their verdicts are CI’s to report on the next push, and that run is the measure of this unit, not this sentence.
Council read 250 — Claude on the ninth cold regeneration: Notification Fanout, 2026-09-28. The first of the four 2026-09-14 pages not yet built, chosen for that rewrite’s record at Login and Idempotent Reservation. Regenerated from its page, Subscription and Notification into demos/notification-fanout-regen/, 7 tests green. Its Ledger was read against the page at read 246 the same day, so what the build found is what that reading could not.

The page. Four gaps, and only one is the rewrite’s: it widened the payload check from absent to blank, refusing the empty payload Notification accepts, under a WHY claiming a Notification refusal no rule states. The other three are the constituents moving after the page was written. Notification now declares storage-failure on create, leaving the store untouched, where the page’s unrecordable create was defined by Notification declaring no such arm. Subscription now refuses a whitespace-only subscriber reference, where the page’s one-subscriber-failing reading rested on it admitting one. And Check 1.2 read from a Subscription filter the atom does not declare. Each is closed and three are tested. The page stays partially resolved.

The prediction. The 2026-09-14 rewrite dropped one decision here, against ten at Login and six at Idempotent Reservation. The page’s larger drift was downstream of its constituents, which no reading of this page alone shows: a sentence about another spec is only as current as that spec.
Council read 248 — Claude on the eighth cold regeneration: Idempotent Reservation, 2026-09-28. Next by citation count after Defensible Retention, with ten pages citing it. Regenerated from its page, Provisional Commitment and Duplicate Prevention into demos/idempotent-reservation-regen/: the four token-carrying actions with their pending and seen-with-no-entry arms, fail-closed, the non-atomic storage arm and the eviction leg, 14 tests green. No earlier render exists.

The page. Six gaps, all one class: the 2026-09-14 rewrite losing what the prose spec had decided, in the re-entry arms, under a Decisions entry that said nothing changed but language — the same class Login’s regeneration met at read 234. A pending entry did not bind its action, so a confirm could run under a token still pending for a place hold. A re-entry’s result was never guarded. A resolving action on a guarded token with no entry answered outcome-unknown where the prose re-ran it, effect-free. A resolving action’s candidates were undefined. The window and the completion bound disagreed at equality, one rule allowing what the next refused. And Composition state 8 conditioned on whether an invocation had returned, which nothing in the map shows; the prose’s rule was Housekeeping 5’s, and the eighth is tombstoned to it. Each is restored and tested. The page was already partially resolved; its status does not move.
Council read 246 — Claude on the two long Ledgers, read against their pages, 2026-09-28. Login carried 34 open lines and Notification Fanout 28, together 62 of the corpus’s 100, all from the gates of 2026-08-26 to 08-28 and all written against the prose pages the 2026-09-14 rewrite replaced. Each line was read against the page as it stands. 21 were already closed — Login 12, Notification Fanout 9 — by the rewrite or by the 2026-09-27 restoration: the sandwich now compares credential ids, so a same-material rotation lands; the default duration is judged at the boundary; the sections the lines named, Retry semantics, the externally-clearable list, step 5a, were gone and their claims with them. 40 were live and are cured here, 21 in Login and 19 in Notification Fanout. The live ones worth naming: a logout reason could pass for a cascade or an orphan, because the sweep reads the member from the reason’s prefix and nothing reserved it; the issuer references scoped the sweep and were never checked at login, so a caller could issue sessions the sweep never saw; the login event log’s own append had no failure arm; Invariant 2.1 claimed every live session terminal at the cascade’s return while Action wiring 36 counts some failed; nothing bounded a Notification create, so a hung create hung the fan-out; and the failure discriminator was a MUST a store down for every create would satisfy wrongly, now a caller’s MAY. Two Notification Fanout examples cited sections that no longer exist. One line stays open: Login’s formal model.

One more, found on the way. Login’s first line said three inputs reach Credential’s verify, which carries no invalid-request arm. Login now takes Credential’s length bound at its own boundary, and Credential itself was inconsistent: String 7 obliged an action to answer invalid-request for an over-long input, and two of its five signatures carry no such arm. It now names the three that do; the two reads already answer an over-long input correctly without one. Credential was grounded and a load-bearing touch drops it to partially resolved with the re-pass owed, so the Ledger total falls from 100 to 40, and the grounded count from 29 to 28.
Council read 244 — Claude on the seventh cold regeneration: Defensible Retention, 2026-09-27. The portal’s compositions are done, so the queue now runs by how often the corpus cites a composition, and Defensible Retention is cited by fourteen pages, second only to Audit Trail. It was regenerated from its page, Legal Hold, Retention Window and the Audit Trail substrate carried whole from read 242 into demos/defensible-retention-regen/: the five actions, the hold gate in both modes, the sibling discipline, the rebuild and the sweep, 13 tests green. No earlier render exists, so there is nothing to compare; the yield is the page.

The page. Four gaps. The sweep owned a destruction record it could never write: the outcome carries the hold check result, no constituent store holds it and the intent did not carry it, so Reconciliation 27 closed every owed destruction as abandoned — the exact case the 2026-09-14 decision gave the sweep. The purge intent now carries the result. The sweep’s closing was no outcome, so a closed marker read open again next run and Invariant 5.6 failed for every abandoned invocation; intent_abandoned is now an outcome, and Invariant 4.6 forbids an outcome only for a refusal no intent preceded. Four purge refusals each answered on one condition, so a call meeting two was owed two answers; not-eligible and under-active-retention now wait on the hold check, and the second on an elapsed named retention, which the page’s own account of the refusal already said. And a gate record that could not land had no position to name; position gains gate. Each has a test. The page was already partially resolved; its status does not move. The rest built as written: the gate firing recorded as well as passing, the unreadable hold store read as blocked, the advisory override leaving its holds standing, siblings destroyed with the record and a pending one finished by the sweep, and the rebuild telling a bypass from a crash.

The substrate. Audit Trail carried unchanged but for one type: its retention record lacked the purge deadline its table already stored, fixed in both renders.
Council read 242 — Claude on the sixth cold regeneration: Audit Trail, 2026-09-27. The composition was regenerated from its page and its four constituents into demos/audit-trail-regen/: instance start, the six actions, the derived indexes with their rebuilds, the purge cascade through a shredding-class erasure mechanism, and the reconciliation scan’s three halves, 18 tests green. The regenerations before it carried Audit Trail only to the depth they reached.

The page. Two gaps, both in the scan’s re-reads. One record per finding (Compensation 2) had no read behind it: when a repair failed after its intent landed — an orphan’s compensation refused, an unretained event’s placement refused — the next run met the same finding and wrote a second intent, and the render did so in both halves. The intent now carries its subject and id, and the scan reads narrated under the critical section before writing one (Compensation 9 through 11). And Term pre-check left out the destruction record and the erasure outcomes that Term proceed as landed already called pre-checks, so a re-driven cascade on a lease host had no rule keeping it from rewriting its destruction record or re-delegating a completed destruction; the list now names both. The page was already partially resolved; its status does not move. The rest built as written: the reserved namespace, the attest-then-section order, seal before purge, the pair read through the attestation store after the payload is gone, coverage over partly purged seals, and the compensation window’s qualifier each held against the tests that exercised them. One of the render’s own first choices did not: it answered cascade-failure(seal) to a purge whose section was held, where Concurrency 2 says the cascade is serialized, not refused.

The prediction. The portal’s drift section predicted nothing for its audit trail. The regeneration found six differences: the seal is a column of the record, so there is no seal store to hold apart; nothing attests the actor; retention is one setting and a display filter; nothing can be erased; every write is one transaction, so there is nothing to reconcile; and verification answers the whole chain at once. The first is a security pattern and is now flagged in the portal’s drift section: anyone who can write the audit table can rechain it and pass verifyChain. Two hold: seals chain to the one before, and the log is ordered by sequence.
Council read 240 — Claude on the fifth cold regeneration: External Onboarding, 2026-09-27. The composition was regenerated from its page, Invitation, Party Identity, Credential and the Audit Trail substrate into demos/external-onboarding-regen/: the four actions, the fresh arc and the resume arm with its stage reading, window union and candidate readings, 17 tests green.

The page. One gap, in the resume arm’s stage reading. A resume that dies after its resume record lands and before it writes the acceptance record Resume 30 owes leaves a dead resume record and no acceptance record, and Resume 9 and Resume 11 then named two different stages for one arc. The arc still owes its acceptance record, which only acceptance-unrecorded writes, so Resume 9 now applies only where an acceptance record exists — the rule’s own purpose, stated as its condition. A test drives an arc through that exact death and back to completion. The page’s densest section, the resume arm, otherwise built as written: the stage reading, the document check, the party and credential candidate readings and the refusal to choose between candidates each held against the tests that exercised them.

The prediction. The portal’s drift section predicted nothing for its invitation flow. The regeneration found eight differences: the party exists before acceptance, created from the inviter’s email; nothing authenticates the accept; the whole arc is one transaction, with no interruption, no resume and no completion record naming the arc; the composition hashes the password itself; refusals are thrown text; there is no decline; a revocation carries no reason; and the token and the clock are the composition’s own. One holds: an invitation resolves once.
Council read 238 — Claude on what the noun-final rename took, restored, 2026-09-27. Read 236 measured 85 candidate sites where the noun-final rename of 2026-09-23 had turned an ordinary verb phrase into a declared name, and restored four. This unit read every candidate against the commit that made it and restored the rest: 138 phrases in 33 files, 142 with read 236’s four. The candidate figure was low. It counted only the phrases a determiner or a time followed; reading the rest found the same damage before a bracketed action (set instant [Grant]), a name (attributed actors a subject), a code span (redemption instant 09:12), a gerund (deciding actor comparing the) and a semicolon (the critical section is holding actor;). The one term the rename broke outright — Legal Hold’s held at an instant, already ending in a noun, rewritten as hold instant an instant — is back under its own name.

How each was judged. A phrase was restored where the rename’s input was a verb phrase — a participle with its preposition and that preposition’s object, host-allocated at the seam, decided by a cross-seam comparison, revoked at once. It was left where the input was the declared name itself: stamps the submission instant the step carries, resolved deletion instant the guards admit, the relative clause after a name reading as English. Where the rename had changed two words, both came back: host-allocation instant is host-allocated at, not host-allocation at, which a first pass that restored only the preposition wrote and the second corrected.

The lesson, for the next rename. A mechanical rename matches a phrase’s shape and not its role: revoked at is a name in carry revoked at and a verb in revoked at once, and the pass could not tell them apart because nothing in the matcher asked what the words were doing in the sentence. Every instrument passed the damage, because each checks a rule’s form and none reads a sentence aloud. The pass that made the rename measured itself by the names it moved; a rename owes a second count — the sentences it touched that did not contain the name — before it lands.
Council read 236 — Claude on the fourth cold regeneration: Session-Gated Authorization, and what the noun-final rename took with it, 2026-09-27. The gate was regenerated from its page, Session and Permissions into demos/session-gated-authorization-regen/: one action, no stored state, 7 tests green.

The page. One gap: nothing held the gate’s length bound under the Permissions instance’s string cap, and Permissions reads an over-length argument as matching nothing — so a bound above the cap lets a scope the boundary should refuse through, and reports a malformed request as denied, the collapse Primitive policy 2 through 4 exist to prevent. Primitive policy 10 closes it, on the precedent Attributed Permissions Admin’s Capability requirement 29 set for the same cap. The page was grounded on Final Critique 8, and the entry Touch triggers re-pass in pressure-testing.md downgrades a grounded page for a load-bearing edit, so it stands partially resolved with the round owed and the roadmap rows say so. The rule decided both the cure and the step down.

The rename’s collateral. Four sentences on the page had lost their verbs — “shows expired at the disputed instant” read “shows lapse instant the disputed instant”. The noun-final rename of council read 134, run on 2026-09-23, turned declared names ending at or by into nouns, and took ordinary verb phrases that happened to spell a name — “host-allocated at the seam” reads “host-allocation instant the seam” in eighteen files. Measured from that commit’s own diff, 85 candidate sites in 30 files replaced a verb phrase that a determiner or a time followed. The four here are restored to the text the rename replaced; the rest are the next unit, repaired from the same diff site by site, because a candidate is not a count until each is read.

The prediction. The portal’s drift section predicted nothing for its gate. The regeneration found five differences: a refused session carries no reason, malformed input is no class of its own, the gate asks for any of several scopes at once, the matched grant’s own scope travels to the handler, and the gate joins the grant tables itself. Two hold: the principal is the session’s, and every request validates afresh.
Council read 234 — Claude on the third cold regeneration: Login, and what its rewrite dropped, 2026-09-27. Login was regenerated from its page, Credential, Session and the Audit Trail substrate into demos/login-regen/: login, logout, the cascade, the map rebuild and the sweep, 21 tests green. Its one earlier render is inside the clinical-trial portal.

The page. The build met ten points the page left undecided — what logout answers for three of Session’s refusals, where login lands before a session exists, what a cascade answers when its initiation cannot be recorded, what the initiation carries, the join key in the revoked session’s reason, the not-found count, the six cascade events’ names, which revocation-family member the sweep records, the orphan reason, the abandoned cascade’s re-run and the sweep’s recovery intent. Each was decided in the prose spec the 2026-09-14 rewrite replaced, and three in this page’s own surviving Decisions, while the rewrite’s entry says nothing but language changed. Each is restored at the decided meaning, as read 230 restored the read surfaces: a loss the migration made, found by a builder, put back rather than re-decided. Where the rewrite had changed a design on purpose — reading the credential id twice rather than verifying twice — its design stands. Three more closed beside them: Check 2.3 waited on a map backfill no rule wrote (Reconciliation 20 now writes it, the rebuild Composition state 7 already licensed); Check 3.1 cited a tombstone (it cites Composition state 10); and the examples had drifted from the signatures. The page’s open Ledger lines were left as they stand; three the render met are named in its CORNERS.md as the preferences it took.

The prediction. Read 226 said the portal answers invalid_credentials with the cause as audit detail. It holds. Seven more: no cascade and no maps, so a revoked credential leaves live sessions; no login event log; events attributed to the user instead of the service identity; the session and its audit event in one transaction, so an audit fault denies the login; the composition verifying the password against the stored hash itself, where Credential’s read never answers a verifier; the token and clock minted and read inside the transition; and no sweep. The first is a security defect, not drift, and the portal’s scope line and drift section now say so at the head.

The class. Read 230 found a migration that dropped a section; this one found a migration that dropped rules inside a section it kept. Both were invisible to every instrument, because an instrument checks what a rule says and nothing checks what a rewrite left out; a builder met each.
Council read 232 — Claude on the second cold regeneration: Multi-Party Approval, 2026-09-26. The composition was regenerated from its page, its four constituents and the atoms Audit Trail reaches into demos/multi-party-approval-regen/: the six actions, the quorum rule, the cascade, the initiation recovery and the sweep’s four legs, 31 tests green, Audit Trail rendered to the depth this composition reaches.

The prediction. Read 226 said the 2026-05 render records no intent, takes no credential and answers recording-failure without a position. Both hold. The regeneration found eight differences the drift list did not name: the render sets the chain state after the cascade (Action wiring 36); reads actors’ stored secrets to attest what the spec attests under the initiator’s validated credential or the service identity (Cascade 5 and 6); lists every Pending step as recalled (Cascade 13); has no quarantine, partial flag, sweep or chain exclusion; writes rule reasons naming neither rule nor counts (Wiring decision 9); stores a chain id and position on the Approval Step record, which knows no chain (Composes 6); passes a retention policy on every audit write (Capability requirement 6); and counts every decided step toward quorum, routed or not (Wiring decision 6 through 8). The second is a security defect, not drift: a render that attests by holding actors’ secrets teaches the pattern to whoever copies it, so the old render’s scope line and drift section now say so at the head.

The page. Seven findings, each cured in this pass, each settled by a rule already standing. What [Initiate Chain] answers after a recovery it ran itself was undeclared: Action wiring 62 answers recording-failure carrying outcome, because constituent writes committed and Audit arm 15 reads outcome as a committed act. Disposition d was declared and carried by no record: Reconciliation 10’s initiation event carries it. The partial flag was a boolean that four rules said names calls: it now names each call by step id and call. The sweep’s recovery intent is a service-identity write Check 5.3 excluded with and nothing else: the check lists it. An example’s rule reason was free prose against the Term’s fixed form: rewritten to the form. A WHY derived the re-emitted trailing flag from the terminal stamps Clock semantics 2 forbids comparing: it now reads the flag from the decision intents that carry it (Action wiring 20). And Audit Trail’s Composes 11 and purge eligible 1 delegated to RetentionWindow.purge_eligible, an action Retention Window never declared — the same class as read 230’s, one page over: both now read eligibility through Retention Window’s declared read.
Council read 230 — Claude on the regeneration’s four findings, cured, 2026-09-26. Read 228 filed four gaps in the specs; each is cured here, and the regeneration now follows the cured pages, 28 tests green.

A read surface the migration dropped. The first two findings are one loss, and measuring it found four more atoms. Before the 2026-09-12 migration, seven of the atoms that now lack a read action declared a read surface in an Outputs section — the current set of records, each with its fields. The migration folded Inputs, Outputs and the rest into Operations and kept only the actions, so six of them came out declaring no read: Permissions, Actor Identity, Retention Window, Personal Todo, Provisional Commitment and Tamper Evidence. Five compositions (Attributed Permissions Admin, Actor Suspension, Audit Trail, Customer Onboarding and Defensible Retention) and the atoms’ own rules (Permissions’ Deprovisioning 2, Retention Window’s Operation 28) still read through it. Each of the six now declares read(), answering every record with its stored fields, as the prose had it and not widened: no filter, so Actor Identity still keys nothing by action reference and Composes 22 of Attributed Permissions Admin still holds. The seventh, Duplicate Prevention, called its recorded set implicit and for diagnostics only, which is not a declared read, and stays as it is; Lease declared no Outputs section. The citing pages now say declared read where they said declared enumeration, declared output, declared Outputs or declared read surface (make all things mean one thing). The six atoms keep grounded: the section titled Touch triggers re-pass in pressure-testing.md downgrades a pattern for a change to content the passes verified, and this puts back the content they verified. The Execution Contract still mapped its query surface to an Outputs section no atom has had since the migration; it now maps it to the read actions in the Operations signature block.

Trimming a credential. Primitive policy 6 trimmed every administered opaque input, and the credentials were among them, against Primitive policy 12’s ban on inspecting one. Trimming is the stronger act — a trimmed credential is a different credential, and whether it validates is Actor Identity’s call — so the Term administered opaque input now excludes a credential, which passes as the caller gave it. Decided by as simple as possible without losing fidelity: one clause, and the credential keeps its fidelity.

Examining and reporting. Housekeeping 15 said the failed-grant leg MUST NOT examine an aged-out attestation, and Housekeeping 16 and 17 tell it how to report one. The rule was the leg’s upper edge — past the horizon, the orphan reading no longer applies — so it now says MUST NOT report an aged-out attestation as an orphan, and the horizon arm stands beside it unopposed.
Council read 228 — Claude on the first cold regeneration: Attributed Permissions Admin, 2026-09-26. The demos were meant to be regenerated and compared, not repaired. The Attributed Permissions Admin domain was regenerated from its three pages alone into demos/attributed-permissions-admin-regen/ — 28 tests, each naming its rule, green on the first run — and then compared with the 2026-05 render.

The prediction. Read 226 listed four ways the old render departs from today’s page. All four hold. The regeneration found eight more the drift list did not name: the old render attests inside the grant’s transaction (Wiring decision 3), mints the grant handle itself (Capability requirement 6), reads the grant before attesting a revocation (Primitive policy 17), builds proposals with no nonce, prefix or request instant (Capability requirement 10, 11 and 13; Identity 7, 11 and 12), passes untrimmed values with no length cap and no blank-credential check, suffixes refusal tokens with field names, does not hold the two maps disjoint (Invariant 7.3), and has no purge path, registry outage or failed-grant leg. Reading a render against the page finds what the reader thinks to look for; generating from the page finds what the page says.

The page. Four findings go to the review channel, and the first two are the ones a generator meets at once: Permissions declares no read, yet the composition reads and enumerates grants “through Permissions’ declared read” (Action wiring 42 and 55) and Permissions’ own Deprovisioning 2 asks for an enumeration it does not offer; Actor Identity declares no enumeration, yet Composes 20, Housekeeping 2 and Check 5.1 rely on one. The other two: Primitive policy 6 trims the credentials the Term opaque input lists, while Primitive policy 12 forbids inspecting one; and Housekeeping 15 forbids examining the aged-out attestations Housekeeping 16 and 17 tell the leg to report. Each is recorded in the regeneration’s CORNERS.md with the reading the render took.

The old renders. Each of the six now says at its head when it was rendered and that the specs have moved since, measured where a drift section exists and said to be unmeasured where none does. The Attributed Permissions Admin render cited its formal model at an alloy/ path that does not exist; the three citations now name compositions/attributed-permissions-admin.als.
Council read 226 — Claude on refusal tokens: two spellings in the specifications, and the demos’ drift, 2026-09-26. The front door’s last class: the demos read against the signatures the rewritten specifications declare. The instrument read every refuses line in the 54 specifications — 204 actions, 146 distinct tokens — and every refusal string in the demos’ code.

Two spellings of one refusal, in the specifications themselves. Eighteen specifications answer invalid-credential when a credential does not validate; Login and Privileged Access Provisioning answered credential-invalid, and Privileged Access Provisioning’s Action wiring 23, 35 and 69 translated one into the other — IF initiate chain answers invalid-credential THEN [Request Access] MUST answer credential-invalid — a rule whose whole content was a respelling. Login alone answered not-found where 41 specifications answer not-known, and its Action wiring 15 translated Session’s not-known into it. Both pages now answer invalid-credential and Login answers not-known, their term entries renamed with them (make all things mean one thing); the three translating rules now transcribe, and their Decisions entries keep the old spelling. No rule changed its condition. Other near pairs — terminal beside already-terminal, three spellings of over-capacity — were left: each is a constituent’s own token or a different condition, and none carries a translating rule.

The demos. The Multi-Party Approval demo predates the intent-and-outcome shape: it records no intent, takes no credential, and so never answers invalid-credential and answers recording-failure without the position the spec requires. The Attributed Permissions Admin demo refuses a duplicate active grant, which the spec forbids it to (Non-goal 10), answers credential-invalid, grantor-not-found and revoker-not-found for the spec’s invalid-credential, and answers an orphan’s cause where the spec answers orphan-attestation with its position. The clinical-trial-portal renders answer login’s invalid_credentials and record detail reasons the spec does not name. None is a spelling fix: each changes a domain module, its routes and its pinned tests together, and the first is a rebuild. Each demo’s CORNERS.md — the page that exists to say how a render departs from its spec — now carries the drift, measured, with what closing it costs; and three of them no longer send the reader to CLAUDE.md for a discipline contributing.md owns.
Council read 224 — Claude on the instruments that keep the sweep swept, 2026-09-26. Three checks join lint.py, each a gap this window named and left open until the work it guarded was done.

N-retired-sign holds Principle 12 for the section sign, the retirement council read 222 closed: a sign anywhere in the repository’s text files fails unless it sits in a historical record — a specification’s Decisions section or Ledger formal: line, GRACE lang’s Changes, the register’s Council read entries, a Project Log entry whose lead phrase or heading is dated, where an undated heading at the level of a dated one continues it — or in a code span, a fenced block, or a tool line marked hunts the form. Its first run flagged grants/README.md, a file .gitignore excludes and so outside the corpus by the Term: the check now reads the files git tracks, as the Term says, and walks the tree only where git is absent. The three tool lines that detect or quote the form carry the marker, and the checker’s own source writes the sign as an escape.

X-page-citation is X-section-title for every page outside the specifications — the pass council read 216 ran by hand, now standing. Its first run found the quotation marks stripped from What “grounded” means at three sites in pressure-testing.md, and a citation of the Contract that named no file; both are restored. Resolving a citation whose file is named after under Pass 3 or by a link’s text needed the check to read both shapes.

V-views-current regenerates the three views in a temporary copy and compares them — the gap council read 204 recorded, through which thirteen migrations passed with the views behind.

Negative controls. Twelve synthetic fixtures in test_checks.py, each check shown to fire on its violation and stay quiet on the lawful forms: a live sign, a sign under an undated section and an unmarked tool line fire; a span, a Decisions entry, a dated entry, its continuing heading and a marked tool line do not; a missing heading fires where a heading and an entry resolve; the current views pass and a view with one line appended fails. Lint 0 across 54 patterns, now in about forty seconds with the regeneration.
Council read 222 — the maintainer’s first closing under Principle 14, and the reading pass’s first classes, 2026-09-26. The maintainer said close. The section sign’s retirement, recorded at v0.56 and reopened at v0.63, is closed: every section sign the corpus still carries — 216 across the tracked files — sits in a dated historical record, in a code span naming the form, or in a tool that hunts it. It is the first retirement closed by measurement rather than by forgetting, and the closure is marked here rather than in GRACE lang’s Changes, which records what a version changed; this closing changes no rule.

Formal-model comments naming sections no specification has. The sweep left them honest — section Actions, section Behavior, section Application-level invariants, section Round 5 R5F1 — and still pointing at nothing. Seventeen comments across eight models now name what exists: a composition’s Action wiring and Composition-level invariants, an atom’s Operations and its bracketed action, the entry The conflict protocol in pressure-testing.md, and, for the Lineage rounds, the Lineage in git history. Comments only; no model changed.

The old sense of section. Since council read 111 the host-supplied lock is a critical section, and section alone is a titled part of a document. Eighteen sites still took, held or released the section in the old sense; the nine in live prose — Chain of Custody’s worked example, External Onboarding’s composition logic, four in pressure-testing.md, three on the roadmap — now say critical section. The other nine sit in records — Decisions entries, Recoverable Invocation’s formal: provenance line, a dated roadmap note and three register entries — and keep their wording.

The old sense of instance, and stale counts. One live site, the roadmap’s State Machine row, called a running workflow an instance; it now says workflow. The counts census read every number of atoms, compositions, patterns and specifications on the teaching pages: each is dated or bounded to the day it describes, and readme.md’s fifty-plus specifications holds at 54. One forward-looking row in open-questions.md — Twenty-three compositions will answer the count — outlived the migration that was to answer it; its answer is a ruling on the label-family shape, left for the maintainer.
Council read 220 — Claude on the section sign, the rest of the corpus in one batch, 2026-09-26. The maintainer asked for the remaining sweep units batched and reviewed together. The specifications’ prose, their formal models, the demos, working-ideas/ and tools/ go from 964 section signs to 29, across 207 files; the tracked corpus as a whole goes from 1,151 at the last commit to 216.

What stays, and why. In the specifications, 21 sit in dated Decisions entries and three in code spans. One sits in Recoverable Invocation’s Ledger formal: line, a dated provenance record the linter’s R-provenance-drift guards; the conversion changed it, the linter caught it, and it was restored. In the atoms, one code span. In tools/, three that hunt the form rather than use it: check.py’s rule-symbol pattern, test_checks.py’s fixture that proves the check fires, and a lint.py comment quoting the prose shape it matches — each a quotation by function, as Principle 13 makes a code span one by position.

How the batch converted. A citation that resolves to a heading or entry of the file it names reads the section titled or the entry, with the file named where it is another; a label cited with the sign drops it, Invariant 3; a regulation’s numbered part reads section, an ISO standard’s clause; a numbered part of a named document reads section N of it. A citation that resolves nowhere reads section X, keeping what it named without claiming a title the target does not carry — most of these are the formal models’ comments naming the prose shape’s sections, Actions, Behavior, State, which the rewrite retired. The formal models changed in comments only; the demos changed in comments, notes, UI copy and one seed record’s reason text.

The receipts. Gate 55 files, 0 findings, census 482; lint 0 across 54 patterns, X-section-title reading every converted citation in the specifications; the separate resolver pass reading the 34 on converted pages outside them, 0 unresolved; test_checks green; conformance 17 of 17; both demo suites, run from copies outside the repository, 67 of 67 and 35 of 35.

Left. The records keep their spelling. The formal models’ comments that name retired prose sections now read without the sign, and still name sections the specifications no longer have — the reading pass’s, beside the stale prose counts and the old senses of instance and section the census named.
Council read 218 — Claude on the section sign, the Project Log pages and the register’s undated text, 2026-09-26. The second unit of the sweep, the one where the sign could not be judged until the record around it was: a historical record is a dated entry, and the undated text around it is not one.

Where each page draws the line. discoveries.md files every entry under a dated heading, changelog.md dates every bullet, and ai-usage-log.md dates every block: their 31 section signs are all inside records and stay. risks.md carries two in its standing mitigations, undated, and both are converted. The register’s 70 are all inside Council read entries and stay; its three in the undated proposal above them are converted. roadmap.md is the page that needed reading, because it is the corpus’s live state with its history woven through it: a status row carries dates as data, a debt carries the date it opened, and a progress note is history. Read that way, an entry is a record when its lead phrase is dated — Progress 2026-06-25, Resolved 2026-06-16, C6 grounded — 2026-06-08 — or when it sits under a dated heading, and everything else is live: the status rows and tables, the debt headers, the orientation. Seventy section signs were live and are converted; 69 sit in records and stay, with four more inside code spans.

The forms. The same as council read 216’s, and one for the standards the status rows anchor to: a numbered part of a regulation reads section — HIPAA section 164.312, SOX section 404 — and a part of an ISO standard reads clause, ISO’s own word for it. Nine status rows sent the reader to Lineage §Final Critique N, a Lineage block deleted on 2026-09-04 and reachable only in git history; each now reads the Lineage’s Final Critique N, and the page’s dated note saying where such references resolve stays as written.

What converting found. Three citations resolved to the wrong page before they were read: the roadmap cited Capability provenance bare, and the page’s own bold entries include one by that name, so a mechanical pass pointed all three at the roadmap instead of at pressure-testing.md. Each names its file now. Every conversion on these pages was resolved against the file it names, as council read 216’s were.

Left for the next units. The specifications’ prose; the demos; working-ideas/; tools/.
Council read 216 — Claude on the section sign, the teaching pages, 2026-09-25. The first unit of the sweep council read 206 made required: the seven teaching pages that carried the section sign — pressure-testing.md, open-questions.md, spec-format.md, AGENTS.md, contributing.md, positioning.md and readme.md — go from 150 section signs to one, and that one is lawful: AGENTS.md’s note on how old commits cite it, now a code span naming the form (Principle 13).

The forms, one each. A heading of another file reads the section titled X in that file; a bold entry reads the entry X, which is what 13 of the citations named, since a methodology entry is not a section; a numbered part of GRACE lang reads Section N of GRACE-lang.md, which several citations on open-questions.md had left implicit — a bare number there named a section of another document. A dated entry of discoveries.md reads the 2026-06-14 entry in it.

What converting found. Four citations never resolved. open-questions.md cited the-spec-layer.md by line number twice — 128 and 242, which are the sections titled Validation and Inheritance — so the citation moved every time the page did. It cited Open taxonomy question in roadmap.md, whose heading is Taxonomy question — resolved. And spec-format.md cited the one-line CLAUDE.md shim for Current state of the library, a section of AGENTS.md. Each now names what exists. The linter’s X-section-title reads the specifications only, so the conversions on these pages were checked by a separate pass that resolves every the section titled and the entry against the file it names; the misses it reports are citations whose file is named earlier in the sentence, each read by hand.

A correction forward. Council read 214 said spec-format.md went from 31 section signs to 13. The 31 counted occurrences and the 13 counted lines; the file held 23 when this unit began, on 13 lines.

Left for the next units. The Project Log pages and the register’s undated text, where a record’s boundary has to be read before a sign can be judged; the specifications’ prose; the demos; working-ideas/; tools/.
Council read 214 — Claude on the format guide’s section lists, 2026-09-25. Council read 212 named it: spec-format.md’s Required sections, in order listed the prose shape — Inputs, Outputs, Flow, Decision points, Behavior and Feedback as six sections of an atom — with notes on how a rewritten spec carries each, while the Heading standard beside it described the shape every spec now has. With all 54 patterns rewritten, the list taught a shape the corpus no longer carries, in the format guide, which is where a writer copies a shape from.

The atom list now follows the table under Atom headings: Structure with its Identity model, State, Capability requirement, Operations and Invariants; Generation acceptance; Terms with Vocabulary; each entry saying what the section holds. Operations says where the six prose nodes went — inputs on the signature and a policy family, outputs on the answers line, each decision as the rule that answers a refusal, behavior and feedback as the rules that record, change and answer — keeping the 2026-09-11 reason and the decision table as reader sugar. Invariants gives the written form, a named heading over a fence of sub-rules and a Deleted: line for a retired number, where the list still gave the prose form.

The composition list gains Generation acceptance, Composition notes and Terms, which the table requires and the list omitted; moves Identity before Audit arm, where the table puts it; states Action wiring as rules where it said numbered steps; states the wiring decision as rules with its four-part defence in the WHY; and drops the four titled … before migration notes, since the Retired heading names table owns them. Where a subsection said this list fixes only its position, it now says the table places it — each list opens by saying the table owns names, levels, order and requirement, and the list what each section holds.

Section signs. The entries rewritten here cite by title — the section titled Heading standard, the entry Status line format, which is an entry and not a section — and so carry no section sign; the rest of the file waits for the sweep. spec-format.md goes from 31 section signs to 13.
Council read 212 — Claude on the teaching pages’ retired forms, and the atom shape the Execution Contract compiled from, 2026-09-25. The census counted retired forms on the teaching pages — a Projects: line, two retired operators and three rejected( wrappers in open-questions.md and pressure-testing.md — and 23 snake names in execution-contract.md that no live file carries. Read one by one under the v0.63 law, the retired forms are every one inside a code span that names the form, which Principle 13 allows; so are the six historical wire names in pressure-testing.md’s worked origins. The contract’s snake names are its own pseudocode, state_t and typed_failure among them, save two: Shared Todo’s derived queries were cited by their retired code names and now read the responsible actor and the visible tasks.

What the reading found instead. The Execution Contract’s compilation table mapped atom sections no specification carries — Inputs, Outputs, Decision points, and description and validation rules — to the pipeline’s S, E, G, T, Q and R, and its labelled Conformance 4 required every rejection reason named in the atom’s Decision points to be reachable. No atom has had a Decision points section since the migration; the reasons live on the refuses lines of each action’s signature, and the rules that answer them are the guard. The table, the test-type table, the guard-failure paragraph, the testing paragraphs and Conformance 4 now name the current shape: the signature block’s inputs, refuses lines and answers lines; the Operations rules that answer a refusal or record a change; a policy family for normalization. Two citations named a spec’s Decision points for a fact now owned elsewhere: Permissions’ revoke persistence is its Operation 14 and 15 and its Revoke persistence failure edge case, and Assignment’s two-store atomicity is its Reassign atomicity edge case. The one mention left describes what the prose shape carried, which is what it is.

Named, not done. spec-format.md’s Required sections, in order still lists the prose shape — Inputs, Outputs, Flow, Decision points, Behavior, Feedback — with notes saying how a rewritten spec carries each. Every spec is rewritten now, so the list describes a shape the corpus no longer has, beside a Heading standard that describes the one it does. It is the format guide, and it wants its own unit. .gitignore’s comment, the last bare card, now names the term entry’s Projection: line.
Council read 210 — Claude on the chain-completeness test, 2026-09-25. Council read 208 left one gap for the reading pass: the Multi-Party Approval demo’s invariant 1a asserted at least one step per chain, where the spec’s Invariant 1.1 requires the step count to equal the approver set’s count. A test named for an invariant has to check that invariant (make all things mean one thing), so the assertion is strengthened rather than the name weakened. The demo’s chain table keeps no approver set; the declared set is the one the chain_initiated event carries, as chain.ts records it. The test setup now emits each chain’s approver set there, and the test compares every chain’s step count with it.

The receipts, now that the suites run. With jsr.io on the device’s allowlist, the demo suites ran for the first time in this window: Multi-Party Approval 67 of 67, Attributed Permissions Admin 35 of 35, confirming council read 208’s renumbering by execution. Two environment facts, neither in the repo: the SQLite library the demos download needs a newer system C library than the device carries, so the runs use the system’s SQLite 3.37.2 through DENO_SQLITE_PATH; and the mounted repository cannot hold SQLite’s lock files, so DB_PATH points outside it. The strengthened test passes, and a mutated copy — one chain declaring three approvers over two steps — fails it with chain ch-rej has 2 steps for 3 declared approvers. The build plan’s Invariant 1 entry, which still quoted the old wording, now states the rule and its verifier.
Council read 208 — Claude on the two demos’ invariant numbers, the second front-door unit, 2026-09-25. The census found the Multi-Party Approval demo contradicting itself: its build plan numbered the composition’s invariants as the spec does, and its conformance tests did not. Read against the spec, the drift is older than the rewrite epoch — at the commit before the migration the spec’s Invariant 3 was already permission enforcement and its Invariant 6 was constituent preservation, while the test file called them chain completeness and trailing decisions.

Multi-Party Approval. In invariants.test.ts, chain completeness becomes Invariant 1. The trailing-decision test becomes Invariant 7, where the spec’s terminal-absorption rationale and the build plan’s own acceptance mapping put it. The header now says what the file covers — 1, 2, 4, 5, 7 and 8 — and what it does not: Invariant 3 is the permission middleware and no test drives a denial; Invariant 9 is the read walkthrough in the scenario tests; Invariant 10 is not covered, because the act-as picker takes no credential to validate before a commit; Invariant 6 is deleted, owned by Composes 5. A second drift under the first: the schema, the step module, the verify route and the step tests cited Approval Step’s invariants 1, 3, 4, 5, 6 and 7 bare, inside a demo where a bare number means the composition’s, and the verify route’s “Invariant 4 and 5” named the composition’s assignment coverage and audit completeness for checks that are Approval Step’s approver and submitter exclusivity. Each now names its atom, and the rejection and withdrawal reasons cite Approval Step’s Invariant 6.3 and 6.4. The build plan’s enforcement table deletes 6, retitles 9 and adds 10 as not enforced.

Attributed Permissions Admin. The spec gained Invariant 9, pair-scoped revocation over an enumerated set, and the demo’s README and test header claimed one test per invariant, 1 through 8, as though that were all of them. Both now say 9 is not covered: the demo builds no pair-scoped revocation. The header’s dashed plural range became Invariant 1 through 8.

What this unit could not run. The demo tests import from jsr.io, which the device’s network refuses, so no test ran. Every change is a comment, a test name or Markdown; deno fmt parses each changed TypeScript file before and after. One gap is left for the reading pass: invariant 1a asserts at least one step per chain, where the spec’s Invariant 1.1 now requires the step count to equal the approver set’s count, and the build plan still quotes the older wording.
Council read 206 — the maintainer’s ruling that notation is law, 2026-09-25. The front-door census (council read 202’s direction, measured after it) counted Projects:, the rejected( wrapper and the retired operators as debt, and the section sign as a question, because v0.56 removed symbols from the rules and said nothing of the prose around them. It stood in 579 places of prose — 158 on teaching pages, 166 in the demos, 255 in the records — AGENTS.md and spec-format.md among them. The maintainer ruled that the question was the defect: a notation the rules forbid is forbidden everywhere a reader can learn it, and a retirement left half done is a dual standard, not a state awaiting a decision.

The ruling, at GRACE lang v0.63. Principle 12: the corpus carries no retired form outside a historical record. Principle 13: a code span may name a retired form — the Changes section has to write Projects: to record that it was retired, and naming a form is not writing in it. Principle 14: a retirement is marked closed only when no use survives outside the records. Four terms carry the boundaries: the corpus is every tracked file, generated views and demos included; a retired form is one a rule forbids or the Changes section records as replaced; a retirement stays open until marked closed; a historical record is a dated entry on a Project Log page, in this register, in a specification’s Decisions section, or in GRACE lang’s own Changes section, and the undated text around it is not one.

The boundary, corrected in review. The first draft admitted only Project Log pages and this register, which made every specification’s dated Decisions entry a violation — the entries this window has deliberately left in their old spelling, as the Multi-Party Approval rename did. The review found it; the clause adding a specification’s dated Decisions entry restores the practice the corpus already followed. An open Ledger line is not a record: it is live work, and it follows current notation, as Execute Gated Workflow’s open line did when its recovery intent was renamed. The review’s specimen, Reserve from Pool’s Projects: release in its 2026-08-30 Decisions entry, sits inside a code span and was lawful under Principle 13 either way.

The pile, measured corpus-wide. The section sign stands on 751 lines, 1,069 occurrences, across every tracked Markdown file — the census behind this read covered the root pages and the demos only. By area: specifications 342 (22 of them in Ledger and Decisions sections and after), roadmap.md 143, working-ideas/ 142, the demos’ Markdown 100, the register 79, pressure-testing.md 74, tools/ 50, spec-format.md 31, open-questions.md 27, GRACE lang 22, and single digits beyond. Every tracked file is in scope: the corpus is every file the repository tracks, working-ideas/ and tools/ included, and .gitignore carries the one bare card left, beside a quoted Projects:.

What it opens. The section sign’s retirement reopens under Principle 14 and is the next unit’s work, as required maintenance rather than a discretionary sweep. GRACE lang is cleaned in this unit, since the document that states the principle cannot carry the violation (the maintainer found the first, at its Status line). It carried 22: 17 in live prose, now Section N for its own sections and the entry … or the section titled … for another file’s; one inside a code span quoting a citation shape, lawful under Principle 13; and four in dated Changes entries, which the clause for the Changes section keeps. Rewriting them found four citations that never resolved: two named a bold entry as though it were a section, one named a Terms section spec-format.md does not have, and one, One site is one spec, named text that exists nowhere — the entry it meant is Introducing a form is riskier than discovering one. The other retired forms the census found on teaching pages — one Projects: line, two retired operators and three rejected( wrappers — close the same way.
Council read 204 — Claude on the generated views, the first front-door unit, 2026-09-25. The census behind council read 202’s direction found the three generated views — graph.md, atoms/index.md and _data/patterns.json — a regeneration behind the corpus. Regenerated outside the repo and compared, they still listed Compensable Workflow as unregulated, still counted each tombstoned invariant in nine specifications, and had dropped overlays the pages still name. They are regenerated here.

The overlays the migrations hid. The migrations spelled each acronym out where it first appears, and reverse_index.py matches a standard by its bare name. ISO/IEC (International Electrotechnical Commission) 27001 no longer matched ISO/IEC 27001, and 21 CFR (Code of Federal Regulations) Part 11 no longer matched 21 CFR Part 11. Nothing on any page was lost — the classifier had stopped reading it. Matching each pattern against the Standards section with its parenthetical expansions removed, as well as kept, restores ten compositions’ readings: 21 CFR Part 11 in five, NIST 800-53 in two, NIST 800-63 in Login, ISO 27001 in Chain of Custody, Execute Gated Workflow and Immutable Transaction Ledger. Keeping the unstripped reading matters: Compensable Workflow and Idempotent Reservation name standards only inside parentheses, and stripping alone would have dropped them.

What the regeneration changes. Twenty-six compositions regulated, up from twenty-five. Tombstoned invariants no longer counted. Event Log and State Machine gain Compensable Workflow as a regulating composer. Approval Step and Assignment now carry the security overlay. That is new rather than restored: the migrated Multi-Party Approval names NIST SP 800-53 in its Standards section, and its prose never did.

The instrument gap. Nothing checks that a generated view matches its sources, which is how thirteen migration commits passed without the views following. Recorded; not built.
Council read 202 — Claude on the close of the rewrite epoch, 2026-09-25. Measured from the thirteen migration commits, each against its parent, from Compensable Workflow (2eb5fd8) to Execute Gated Workflow (c06a637).

The pages. 2,178,104 bytes of prose out and 1,837,690 in, 15.6% lighter. The prose pages carried no labelled rules; the migrated pages carry 3,531, counted by check.py’s own label test. The Ledgers came in carrying 335 open lines and went out carrying 22, so 313 closed. At HEAD, 21 lines stay open across the thirteen: 20 formal, owed by models rather than pages, and one edge case, Privileged Access Provisioning’s Cross-store consistency.

The corpus. Every atom and composition — 54 of 54 patterns — carries the migrated qualifier. The gate reads 55 files, 0 findings, census 482; lint 0 across 54 patterns; test_checks green; conformance 17 of 17; residue 61; unresolved noun phrases 3,096 of 32,547 at council read 200. The standard label set is seventeen. The roadmap backlog holds twenty-four forthcoming patterns.

What the rewrite did not reach. The maintainer’s direction at close: the rewrite is not only the patterns. The library’s own page texts — the 29 Markdown documents at the repo root — and the six demos under demos/ are to be re-examined against the migrated corpus. Nothing here measures how far they have drifted; that is the next unit’s first instrument.
Council read 200 — Claude on the Execute Gated Workflow migration, the last of the thirteen, 2026-09-24. 219,979 bytes of prose out, 154,766 in — 282 labelled rules across eighteen families, counting invariant sub-rules and non-goals; invariant numbers 1 through 6 and 8 unchanged, Invariant 7 tombstoned to Composes 6; and a Ledger that came in carrying thirty open lines and goes out carrying two, 2026-08-29-a and 2026-08-30-e, both owed by the formal model. Nothing in the corpus cites this page by label, so renumbering was free; the five signatures keep their names and refusal tokens.

Twenty-eight closed; the choices each decided by a standing rule. Every constituent write surface is reserved to the composition and Permissions is read-only. The consumed and mooted marks are truth-bearing past the horizon and extraction-pending against Binding Registry (A derived index splits at the horizon), so the roadmap’s Binding Registry row now names this page beside Attributed Permissions Admin. The retention step and the retention-source invalid-request at an outcome read back by the act’s minted id and proceed as landed (A transcribed rejection arm keeps its payload). A lost answer is read before it is re-invoked, and at-most-once is the caller’s key for start as it is for fire. One State Machine workflow per run is its own serve rule, Composes 17, beside the one State Machine instance of Composes 1 — Compensable Workflow’s shape for the same atom, which F-constituents asked for because it cannot read per workflow run inside a serve rule.

One name, one spelling. The recovery intent is workflow_recovery_intended, underscored like every other name in its namespace. Multi-Party Approval’s chain.recovery_intended was the one dotted name in a namespace otherwise underscored; it becomes chain_recovery_intended in the same change, in its namespace term and its recovery-intent term (make all things mean one thing). Its dated Decisions entry keeps the spelling it was written with.

The families. Eighteen. Scope vocabulary reaches a fourth specification and Retention asymmetry a sixth. Cascade reaches a second and stays off the watch list until a third. Clock semantics, Concurrency, Indeterminate outcome, Action wiring, Primitive policy and Composition state each gain one — 25, 40, 7, 26, 24 and 24. M-orphan-forthcoming stayed silent, so the backlog stays at twenty-four rows.

Instrument notes. First check: 24 D-code-span, 7 V-or-obligation, 7 W-comparator, 2 W-watch-word and 2 W-condition-operator. Thirteen declared terms and a rewording of the rest cured them — aged entries for the history arm past the horizon, planned steps for the cascade’s share of the decision leg, lost answer for the indeterminate outcome among them. Lint then reported seven: the serve rule above and six stale counts. Residue rose to 63 on active_for, twice in rule bodies. It is now the declared active assignment read, and residue is back to 61. The citation audit read every in-page citation against the rule it names and re-aimed nine:
- State Machine’s Invariant 8 was cited bare.
- The out-of-band findings were cited at Reconciliation 13 and 17 and are 17 and 22.
- The intent-without-outcome check was cited at the decision leg’s no-record rule. It is Audit arm 13, a pre-commit refusal read as a committed nothing.
- Checks 5.1, 5.2, 6.1 and 6.2 cited the first sub-rule of invariants whose every sub-rule they test.
- External check 3 cited the blank-approver refusal for the approver’s authority.
- A non-goal’s sentence cited the lost-answer rule for what the stage says on a refusal.
The Privileged Access Provisioning thread, measured. Council read 196 left its cause unmeasured. nouns.py --spec privileged-access-provisioning, run in archives of the commits before and after the Multi-Party Approval migration, shows the page byte-identical across them — 349 rules and 1,165 noun phrases both times. The unresolved count fell from 90 to 78, and all twelve are one phrase, the bare noun decision, at lines 402 through 409, 725 and 950. nouns.py resolves a spec’s phrases against its constituents’ declarations too. Multi-Party Approval’s rewrite declared Term decision — approve, reject or withdraw, by the action — and Privileged Access Provisioning composes it. On the lines read, its decision is the one it routes to those actions, so the resolution is the same meaning and not a collision.

The counts. Unresolved noun phrases from 3,025 of 31,545 to 3,096 of 32,547 — 71 on this page, which is the whole difference. Residue from 61 to 61. Census from 482 to 482. Gate from 54 files to 55, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.

Thirteen of thirteen. Every atom and composition file now carries the migrated qualifier — 54 of 54 patterns by check.py’s own test, the three files it does not match being the catalogs.
Council read 198 — the maintainer’s fourth promotion ruling, and the first time three families crossed together, 2026-09-24. The maintainer said promote. Scope vocabulary, Verdict and Retention asymmetry — the three Standard label 4 had named — are promoted at GRACE lang v0.62. The standard set goes from fourteen members to seventeen, and cites.py --standard prints seventeen.

The drift pass found one concept in each. Scope vocabulary (Shared Todo, Privileged Access Provisioning, Multi-Party Approval): the scopes a composition defines for its Permissions instance and the action each gates. Shared Todo maps eight actions to seven scopes; the other two define three and name the gate they deliberately leave out — the same concept stated from both sides. Verdict (Chain of Custody, Forensic Recovery, Immutable Transaction Ledger): how a verification read resolves the evidence it reads into its answer. The first two compose an overall verdict from named classes, and each names what never counts as a class; the third resolves a binding verdict and per-entry authenticity. Every member is a total function over evidence the read gathered. Retention asymmetry (those three, Propagate Consent Revocation Downstream and Multi-Party Approval): how a spec answers where a record outlives the audit events that attest it — an accounting record, a consent record, a chain, a reconciled lifecycle — read as lawful destruction and never as an orphan or a gap. The two retention instances Propagate Consent Revocation Downstream files there are the same asymmetry seen from the configuration side.

Standard label 9’s positions follow where the corpus already files them. Every naming spec places Scope vocabulary and Verdict last in Composition logic and Retention asymmetry under Edge cases. So the first two become the last placed rows of Composition logic, Scope vocabulary first by the table’s interim alphabetical order. Retention asymmetry becomes an Edge cases row in both shapes, between Indeterminate outcome and String policy, since spec-format.md gives an edge family one address in either shape. A placed heading precedes every unplaced one, so five specs are reordered with their text unchanged. Scope vocabulary moves ahead of Cascade in Multi-Party Approval and ahead of Provisioning cascade in Privileged Access Provisioning. Retention asymmetry moves ahead of Degraded bundle in Immutable Transaction Ledger, ahead of Pre-genesis custody in Chain of Custody, and ahead of Pre-composition transitions in Forensic Recovery.

The ownership seam, in the same change. execution-contract.md classifies the two new Composition logic families as compiling. Scope vocabulary lowers to the scope constants the Permissions instance is provisioned with and the gate each named action calls. Verdict lowers to the verification read’s answer function, one branch per class or outcome. Retention asymmetry joins the Edge cases families that lower by their own rules. spec-format.md gains the two Composition logic bullets and the edge family.

The Standard label 2 residue did not recur. The three earlier promotions each turned a local term restating the family’s meaning into a defect. cites.py --promote on the three now-standard families lists 100 term declarations in the member specs — 14, 69 and 17 — and reading all of them finds none that restates a family meaning. Two other specs, Preference-Aware Notification Fanout and Resolve a Person’s Data Rights, declare a term verdict. Each names the answer a resolution produces, which is the family’s word used in the family’s sense, and neither names a label family.

The counts. Gate 54 files, 0 findings, census 482 unmoved; lint 0 across 54 patterns, W-stale-census green with the three counts gone from §18’s watch list; test_checks green; conformance 17 of 17; residue 61; unresolved noun phrases unchanged at 3,025 of 31,545.
Council read 196 — Claude on the Multi-Party Approval migration, 2026-09-24. Next by size: 219,197 bytes of prose out, 152,351 in — 283 labelled rules across seventeen families, invariant numbers 1 through 5 and 7 through 10 unchanged, Invariant 6 tombstoned to Composes 5, and a Ledger that came in carrying forty-one open lines and goes out carrying one, the formal model. Nothing in the corpus cites this page by label, so renumbering was free; Privileged Access Provisioning calls its actions, so the six signatures keep their names and refusal tokens.

Forty closed; the choices each decided by a standing rule. The seam’s invocation id rides on every event and on the chain record, so the initiation intent joins its chain exactly — the prose’s tuple of declared fields and instant is shared by two same-shape chains one initiator opens in one clock instant (2026-08-29-e — Intents pair with outcomes). The routed vector is defined for all four counts with P derived; a decision is routed only by its decision intent, never by a recovery record a compromised service credential could forge; and past the horizon a purged decision intent is still recognized by its surviving action reference and actor, which the event index kept against its step — without that, a Pending chain whose earlier intents purged would demote its own decisions to Pending and never terminate (2026-08-29-a through -d, 2026-08-26-l). The step-assignment pairing rebuilds through Assignment’s own task-keyed history at any age (2026-08-29-m, 2026-08-26-i). The resolution reason is declared on every arm, a retried recall answered not-known closes with an anomaly mark, and the extraction gate is run on the recovery discipline with its verdict left to the higher-order composition test (2026-08-26-g, -n, -m, 2026-08-29-g).

Three standing rules the page predated. The gate that last read this page closed 2026-08-29; three rules frozen the next day decide three more landings. The position rides the exported code on every action that straddles a commit: a decision or withdrawal re-run after an outcome failure is refused not-pending, but an initiation re-run is refused by nothing and opens a second chain beside the first, which the recovery withdraws only while no approver has decided it. Privileged Access Provisioning maps the recording-failure family and reads either position unchanged. The retention step and the retention-source invalid-request read back by invocation id and proceed as landed — the prose sent both to the sweep, whose comparison against the event index could not see an event the failed call never returned an id for, and would have re-emitted a second. The window is set against the liveness sum, not the cadence alone.

The families. Seventeen. The quorum rule is the Wiring decision; the recovery discipline is Reconciliation, as four legs; Cascade is new and single-spec; Scope vocabulary reaches a third specification and Retention asymmetry a fifth. W-stale-census required the watch list to name Scope vocabulary — added at (3); promotion is the maintainer’s under Standard label 6, and this read promotes nothing. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one — 24, 39, 25, 23 and 23. The roadmap backlog gains Sequenced Approval Chain, Delegation and Deadline Escalation, twenty-four rows; the check reported the first, and the other two are the same kind of delegation written as a Delegation pattern.

Instrument notes. First assembly, the record verbs aside: 21 findings — sixteen D-code-span in the carried head, examples and cards; two V-mixed and one V-or-obligation, conditions and a match list enumerated in English; two P-pronoun — and fifteen advisories, the three step-decision signatures among them, which no rule named because the rules said a decision action; now each names its step write. One W-duplicate-proposition surfaced on the second pass, two alerts on not-known stated twice, merged. Lint then reported ten: an application in a term, the forthcoming row, the missing and stale family counts, and a citation of a bold paragraph as a section title. Residue rose to 64 on three code names in rule bodies — history_for twice and superseded_by_decision — each now a declared term, residue back to 61. The citation audit — every in-page citation against the rule it names — found three off by one: a rule cited for the reconciliation leg that owns the initiation window, the read-back cited at its trigger rather than its match, and the out-of-band count cited at its marking rule.

The counts. Unresolved noun phrases from 2,955 of 30,526 to 3,025 of 31,545 — 82 on this page, and Privileged Access Provisioning’s own count down twelve, from 90 at HEAD to 78, which accounts for the difference; the cause is not measured here. Residue from 61 to 61. Census from 482 to 482. Gate from 53 files to 54, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 194 — Claude on the Propagate Consent Revocation Downstream migration, 2026-09-24. Next by size: 212,478 bytes of prose out, 167,901 in — 266 labelled rules across fifteen families, invariant numbers 1 through 8 unchanged with no tombstone owed, and a Ledger that came in carrying twenty-one open lines and goes out carrying two, both the formal re-derivation.

Nineteen closed; the choices each decided by a standing rule. Governed — which no field declared — is the record the composition’s grant write made, every record of the instance under the reserved write surface, and Invariant 6 splits into a floor and a liveness closure because the unretained grant shape is reachable (2026-08-30-d). Consent’s not-known at the revoke is relayed as not-known with an index-anomaly finding rather than as a recording failure (2026-08-26-g — make all things mean one thing: recording-failure is a write that did not land). The gate’s exposure to processing systems only and the credential’s and retention policy reference’s validation are rules (2026-08-30-f, 2026-08-26-b). The pairing by intent event id is declared as a deviation and no refusal outcome is added (2026-08-30-e — as simple as possible without losing fidelity). The expiry asymmetry is restated on what the composition observes, since Consent admits an eager expiry writer (2026-08-27-c). The Summary glosses the substrate, the seal and the attribution stamp; the Intent lists [Read Consent History] and quotes nothing Consent does not say; the walkthrough grants the officer it calls the read scope (2026-08-26-e, -h, 2026-08-27-d, -e, 2026-08-30-j).

Two defects fixed in the pass that found them. The prose had two writers for one grant event: the invocation retried its grant event under the per-pair section while the reconciliation compensated grant orphans under the per-consent section, and two different exclusions exclude nothing — both could land a grant event for one consent. The invocation now takes the consent exclusion once the consent id exists (Action wiring 16), the rule the withdrawal side already kept. My own first draft keyed the outcome pre-check on the consent id alone, and a grant event carries the same consent id as the propagation event, so a withdrawal’s pre-check would have adopted the grant event and answered withdrawn with nothing propagated; the citation audit found it, and the pre-check and Reconciliation 9 now read the owed outcome. A grant candidate set whose retention policy references disagree is escalated rather than chosen — the scan’s shape-B placement took the intent’s reference, which candidates make plural (Reconciliation 29).

The families. Fifteen. The two-instance retention entries join Retention asymmetry, now in a fourth specification — it stays on the watch list, and promotion is the maintainer’s under Standard label 6. The per-key serialization splits into the consent exclusion and the pair exclusion, because the grammar owns the noun section. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one specification — 23, 38, 24, 22 and 22 — and §18’s family clause is updated. The downstream index’s past-horizon half names a Processing Register (forthcoming) the roadmap had no row for; M-orphan-forthcoming reported it and the backlog now carries it, twenty-one rows.

Instrument notes. First assembly, the record verbs aside: 37 findings — thirty-two D-code-span in the carried head, examples and cards; two V-or-obligation in checks; one X-ref, Retention Window’s Invariant 11 cited after its own; one B-exceed, MUST EXCEED on the horizon rule, now written MUST NOT EXCEED from the other side; one R-caps on GDPR in an external check — and one advisory, an unconditional effect on the gate, cured, leaving the census where it was. Lint then reported the Composes list and the serve rules disagreeing on the Retention Window instance, the forthcoming row and six stale family counts.

The counts. Unresolved noun phrases from 2,909 of 29,664 to 2,955 of 30,526 — 46 of this page’s 862. Residue from 61 to 61. Census from 482 to 482. Gate from 52 files to 53, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 192 — Claude on the one unflagged git call, 2026-09-24. A tool change, landed alone. Council read 190 named cites.py’s changed_seeds as the one repository-facing git call without --no-optional-locks; it now carries the flag, and cites.py --changed HEAD run afterwards left no lock in .git. Council read 190 named that path --since; the option is --changed, corrected there. A sweep of tools/ finds no other git call without it outside test_checks.py, whose calls run in a temporary directory. The fix removes a possible writer; it does not establish that this call wrote the lock, and council read 190’s finding stands as stated.
Council read 190 — Claude on the Immutable Transaction Ledger migration, 2026-09-24. Next by size: 179,278 bytes of prose out, 135,857 in — 239 labelled rules across seventeen families, invariant numbers 1 through 4 and 6 unchanged, Invariant 5 tombstoned to Composes 5, and a Ledger that came in carrying twenty-five open lines and goes out carrying two, both the formal re-derivation.

Twenty-three closed; the choices each decided by a standing rule. Produced by this composition — which no field declared, so no auditor could enumerate it — is now paired by the reconciliation’s predicate, with the ledger namespace and the disclosure write reserved to the composition and an unpaired record a write-ownership finding (2026-08-26-e, 2026-08-30-g). The bundle’s recovery path is declared as [Reissue Bundle] rather than the claim dropped (2026-08-30-f — as simple as possible without losing fidelity: the page leaned on a path no surface offered). An entry unsealed or purged when its bundle is built is marked in the bundle per entry, never refused (2026-08-26-i, 2026-08-30-d, -e — make all things mean one thing: the purge landing between membership and bundle already answered that way). Blank is refused with Selective Disclosure’s own rule before the intent, withdrawing the prose’s whitespace-only accepted, which reached the constituent’s refusal after the intent had landed (2026-08-30-c). binding-duplicate is the fifth binding verdict (2026-08-30-a), the case list whose letters ran (a)(b)(d)(c) now five rules (2026-08-30-n). The walkthrough’s intent event took an id the third trade already held; renumbered (2026-08-30-h).

The families, and a threshold met. Seventeen: Degraded bundle new and single-spec, and Verdict and Retention asymmetry now in a third specification each. Standard label 4 makes a family three specifications name a promotion candidate, and W-stale-census required the watch list to name both — added at (3) beside the other candidates; promotion is the maintainer’s under Standard label 6, and this read promotes nothing. The per-disclosure section is the disclosure exclusion. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one specification — 22, 37, 23, 21 and 21 — and §18’s family clause is updated.

Instrument notes. First assembly, the record verbs aside: 28 findings — twenty-six D-code-span in the carried head, examples, cards and Decisions; one C-copula, a MUST be on the only-disclosure-surface rule; one X-ref, an Audit Trail invariant cited after a lower-case and — then four advisories, a past, an or, and an unconditional effect, all cured, leaving the census where it was. The session’s git lock: Scott deleted a stale .git/index.lock before this unit. Every git call this session carried --no-optional-locks, and of the instruments run here only test_checks.py invokes git, in a temporary directory; cites.py’s changed_seeds runs git diff against the repository without the flag, but its --changed path was not run this session. The lock’s writer is not established by these records.

The counts. Unresolved noun phrases from 2,829 of 28,881 to 2,909 of 29,664 — 80 of this page’s 783, 10.2% against the corpus’s 9.8%. Residue from 61 to 61. Census from 482 to 482. Gate from 51 files to 52, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 188 — Claude on the Chain of Custody migration, 2026-09-24. Next by size: 173,085 bytes of prose out, 135,182 in — 261 labelled rules across eighteen families, invariant numbers 1 through 5 and 7 unchanged, Invariant 6 tombstoned to Composes 5, and a Ledger that came in carrying forty-three open lines and goes out carrying two, both the formal re-derivation.

Forty-one closed; the choices each decided by a standing rule. The blank credential answers invalid-credential in every action, where the prose gave it no code in two and the reference’s code in three (2026-08-26-e, -r, 2026-08-30-j — make all things mean one thing). binding-unknown gets a predicate that needs no clock — an unbound entry earlier in the chain than an entry whose event is already purged — and one reading in the proof and the checks alike: a durability finding against the index, since past the horizon a lost binding and a never-made one are indistinguishable (2026-08-30-a, -b, 2026-08-26-i, -u). The substrate’s unverifiable reasons are relayed unchanged and its compensation-window qualifier rides beside the verification, never in the retention state, where it could not sit beside Purged (2026-08-26-h, -p, -q). The reconciliation’s window and cadence take names of their own, apart from the substrate’s same-named knobs (2026-08-30-l). The metadata rides no audit write, so it carries no cap (2026-08-26-v — as simple as possible without losing fidelity). The purged half is named against Erasure Tombstone and the persist-at-purge alternative, which rode a cascade the composition does not wrap, is dropped (2026-08-30-c — generalize nothing). The genesis pairing key is stated once (2026-08-30-n).

The families. Eighteen: Verdict for the class table, now in a second specification; Retention asymmetry, now in a second; Pre-genesis custody and Rename new and single-spec. The per-chain section is the chain exclusion, the grammar owning section. The five custody actions share one set of rules over the acting custodian, with the per-action differences — the transfer’s resolve-then-confirm, genesis’s one-directional join — stated where they differ. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one specification — 21, 36, 22, 20 and 20 — and §18’s family clause is updated.

Instrument notes. First assembly, the record verbs aside: 26 findings — twenty-four D-code-span in the carried head, examples, cards and Decisions; one D-signature-form, the read passthrough answering the chain’s entries where an arm must be a name; and one X-ref, an Audit Trail invariant cited after a lower-case and, which the check reads as this page’s own — then sixteen advisories, twelve of them W-unconditional-effect on [Verify Custody] and [Transfer Custody] rules until each was conditioned on its admitted-call term, all cured, leaving the census where it was.

The counts. Unresolved noun phrases from 2,783 of 28,037 to 2,829 of 28,881 — 46 of this page’s 844, 5.5% against the corpus’s 9.8%. Residue from 61 to 61. Census from 482 to 482. Gate from 50 files to 51, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 186 — Claude on the Resolve a Person’s Data Rights migration, 2026-09-24. Next by size: 173,073 bytes of prose out, 143,978 in — 257 labelled rules across nineteen families, invariant numbers 1 through 8 unchanged, Invariant 9 tombstoned to Composes 6, and a Ledger that came in carrying thirty-four open lines and goes out carrying one, the formal scan.

Thirty-three closed; the choices each decided by a standing rule. The anomaly is admitted as a fifth verdict carrying a finding, terminal for the fulfillment (2026-08-26-g, and 2026-08-29-h’s not-attempted with it) — as simple as possible without losing fidelity: holding a request open over a record the substrate or the host must settle first answers the subject nothing sooner. Access fails closed to an anomaly on a determination error (2026-08-26-h), the posture the erasure ladder already kept. The recipients and consent limbs are sealed as the ids read, because a digest of a read over an append-only store diverges by construction and could never be recomputed (2026-08-26-m). The intake’s invalid-credential answers as itself (2026-08-26-f, 2026-08-29-b — make all things mean one thing). The regulatory reference is taken per request (2026-08-29-g), since one deployment answers GDPR and CCPA alike. An unconfirmable pairing is recorded as such in the reason rather than reached for through the Retention Window (2026-08-26-r, 2026-08-29-e — generalize nothing); the purge-eligible answer covers exactly the retentions a purge can destroy.

The substrate moved under the page, and the page now reads it as it is. Defensible Retention’s purge answers storage-failure and recording-failure carrying its position since its own migration, where the prose read four shared tokens; the Disposition family maps every declared answer — storage-failure an intact record, outcome a destruction whose record is owed, and one destruction-safe re-invocation for the three answers that still say nothing about the record (2026-08-26-i, 2026-08-26-j). The substrate evaluates siblings before holds, so the page says the precedence among gate answers is the substrate’s step order (2026-08-29-d). One defect found in the pass and fixed in it: the retention-step arm at a pre-effect record was unlanded, so an intent appended under that failure and answered as retryable left an open intent, and the caller’s retry met compensation-pending for a fulfillment that had done nothing.

The families. Nineteen, five new to the corpus and single-spec: Disposition for the verdict ladder — the page’s load-bearing rule set, addressable by family rather than buried in a step — and Accounting stores, Completeness boundary, Host-managed records and Snapshot among the edge cases. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one specification — 20, 35, 21, 19 and 19 — and §18’s family clause is updated.

Instrument notes. First assembly, the record verbs aside: 21 findings — twenty D-code-span in the carried head, examples and cards, and one X-ref: the check admits another specification’s Invariant and Check by label and nothing else, so Defensible Retention’s Action wiring 73 is now cited by what it says — then five advisories, two comparators, one or, two lower-case watch words, all cured, leaving the census where it was.

The counts. Unresolved noun phrases from 2,700 of 27,146 to 2,783 of 28,037 — 83 of this page’s 891, 9.3% against the corpus’s 9.9%. Residue from 61 to 61. Census from 482 to 482. Gate from 49 files to 50, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 184 — Claude on the Forensic Recovery migration, 2026-09-24. Next by size: 169,531 bytes of prose out, 144,752 in — 261 labelled rules across seventeen families, invariant numbers 1 through 4 and 6 unchanged, Invariant 5 tombstoned to Composes 5, and a Ledger that came in carrying twenty open lines and goes out carrying two, both the formal re-derivation.

Eighteen closed, three of them decided by standing rules rather than routed. 2026-08-26-l asked whether [Recover History] should consume its actor reference or drop it; dropped — the read records nothing and gates nothing, and who queried is an access-logging wrapper’s to record, so make all things mean one thing leaves a parameter no rule reads nowhere to stand. 2026-08-30-b asked the page to pick between binding-gap and out-of-order for a history that predates the composition; the path test now splits by where the disagreement sits — an edge (a first transition that is not a delete, a last that disagrees with Soft Delete’s state) is a missing transition and binding-gap, an interior pair no lifecycle could commit is an ordering defect and out-of-order — by the same rule, each class naming one defect. 2026-08-30-d offered a new clock-offset setting or a named assumption for the skew behind Soft Delete’s future bound; named, as Execution Contract Logic confinement 7’s, by generalize nothing — the reachable consequence is an invalid-request after the intent, a refused attempt with nothing committed, which Check 5.3 already classifies. The rest were owned by the rewrite itself: the constituent bars cited rather than counted (Audit Trail has 46 checks now where the page said six), the recorded instant named apart from Event Log’s recording instant, Invariant 1 conditioned on the window Invariant 4’s liveness arm admits, Invariant 2’s seal claim stated to Audit Trail Invariant 3’s own modulo, the read passthrough given Soft Delete’s actual signature, the formal model named as Invariant 4’s verification surface, and the right-to-erasure citation pointed at Audit Trail Non-goal 6, the substrate’s heading having changed under migration.

The families. Seventeen, three new to the corpus and single-spec: Verdict for the class table, which was one paragraph carrying eight classes, four reported outcomes and a path test; and Pre-composition transitions and Retention asymmetry among the edge cases. The critical section is the record exclusion, the grammar owning section. The three lifecycle actions run one protocol, so the rules are written once over a declared kind and three rules bind each action to its kind. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one specification — 19, 34, 20, 18 and 18 — and §18’s family clause is updated.

Instrument notes. First assembly, the record verbs aside: 50 findings — forty-four D-code-span in the carried head, examples, cards and Decisions, four F-bracket on a [Read] marker no card lands on (the passthrough is now named in English), one D-rule-noun and one C-copula — all cured; then three advisories, two actions no rule named and one duplicate proposition, cured, leaving the census where it was. The linter’s six were five stale census counts and one R-provenance-drift: the assembler’s code-span unwrap had reached into the Ledger’s formal line, and it now skips the Ledger.

The counts. Unresolved noun phrases from 2,655 of 26,301 to 2,700 of 27,146 — 45 of this page’s 845, 5.3% against the corpus’s 9.9%. Residue from 61 to 61. Census from 482 to 482. Gate from 48 files to 49, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 182 — the wrapper is rejected( standing alone, 2026-09-24. The maintainer’s finding on council read 180: the spec bent around the instrument, and the instrument was what was broken. check.py’s signature-form test matched the substring rejected( anywhere on a signature line, so it could not tell the retired rejected(…) wrapper from a refusal whose name ends in rejected and carries a payload. The test now fires on rejected( only where no name character or hyphen precedes it, and test_checks carries a fixture for the silent side — refuses journal-rejected(position) — beside the wrapper fixture that still fires: fourteen fixtures where there were thirteen. The signature change did not stand on its own ground, and is reverted. The only reason Preference-Aware Notification Fanout wrote journal-rejected bare was the detector: the same signature block writes orphan-pending(notification_id) with its payload, the corpus writes recording-failure(position) and invalid(redemption failure) the same way, and the parameterized-arm watch row describes that form everywhere without preferring a bare arm on one line — so a bare journal-rejected beside them would have made the page write one thing two ways. journal-rejected(redispose position) and journal-rejected(gap position) are back in the signatures; the rules carrying the positions stay. A corpus sweep found no other signature with a hyphenated rejected arm, so the bend was one page’s. Measured: gate 48 files, 0 findings, census 482; lint 0 across 54 patterns; test_checks green; conformance 17 of 17; residue 61; unresolved noun phrases 2,655 of 26,301, unchanged.
Council read 180 — Claude on the Preference-Aware Notification Fanout migration, 2026-09-23. Next by size: 161.3 KB of prose out, 147.4 KB in — 274 labelled rules across eighteen families, invariant numbers 1 through 5 and 7 through 10 unchanged, Invariant 6 tombstoned to Composes 5, and a Ledger that came in carrying four open lines and goes out carrying two.

Two closed, two standing. 2026-08-30-a offered declaring the overshoot record’s action vocabulary or dropping the field; dropped, because the detector records what it found and takes no action to name — declaring a vocabulary for an act that never happens would be a field that means nothing. 2026-08-30-c asked for a hold retry horizon; declared, with a hold suppression past it not retryable, and it is what made the payload-retention obligation finite — retention now runs to the later of the horizon and the reconciliation window. 2026-08-30-b stays open by its own terms: it asks for the orphan lookup to become required when the Reverse Index pattern lands, and no rule can own a line conditioned on a pattern that does not exist. The model line stays open.

The families. Eighteen, three new to the corpus and single-spec: Shaping gate for the precedence table, which is the page’s load-bearing rule set and deserved to be addressable by family rather than buried in a step; Verdict replay for the replay procedure — named apart from Compensable Workflow’s Replay, which derives a phase from a log, because make all things mean one thing forbids two replays; and Payload retention, Per-channel caps and Staleness among the edge cases. The per-disposition section is an exclusion, the grammar owning section — the same rename Reserve from Pool took. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one specification — 18, 33, 19, 17 and 17 — and §18’s family clause is updated.

Instrument notes. First assembly, the record verbs aside: 47 findings and 9 advisories — forty-four D-code-span in the carried examples, cards and Decisions, one V-or-obligation, and two D-signature-form, all cured. The two D-signature-form were not the retired wrapper at all: check.py reads the substring rejected( anywhere on a signature line, so the page’s own refusal journal-rejected, carrying its position as a payload, tripped it. The signatures now carry the refusal bare and the rules carry the position — an instrument observation, reported and not acted on, since the tooling is the instrument’s to change. The linter’s ten were four orphaned registry entries, one forthcoming marker on a line beside a grounded link, and five stale census counts. Residue first read 77 — sixteen constituent query names written bare on rule lines — and reads 61 with the queries named in English.

The counts. Unresolved noun phrases from 2,528 of 25,385 to 2,655 of 26,301 — all 127 this page’s, 127 of its 916, 13.9% against the corpus’s 10.1%, above the corpus rate where the last three migrations landed below it — the gate’s vocabulary of windows, caps, channels and observations runs dense in undeclared modifiers. Residue from 61 to 61. Census from 482 to 482. Gate from 47 files to 48, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 178 — Claude on the Privileged Access Provisioning migration, 2026-09-23. Next by size, and the heaviest Ledger yet: 156.1 KB of prose out, 145.1 KB in — 349 labelled rules across seventeen families, invariant numbers 1 through 10 unchanged, none tombstoned, and a Ledger that came in carrying forty-five open lines and goes out carrying one, the model.

Forty-four closed, each by the rule that now owns what the line asked for. Ten had choices in them, and a standing rule made each. The existence oracle (2026-08-28-j): the credential is checked before the request is resolved, so an unauthenticated caller learns nothing, and what an authenticated caller still learns is declared (Non-goal 15) — ordering first was free, hiding the rest is the calling layer’s. The exercise before its provisioning event (2026-08-28-h): declared lawful, not gated — a delivered token is lawful access, and refusing it because the record of its grant was late would refuse what was granted. The session check (2026-08-28-m): existential, because the record names the principal and validate answers no session identifier the record could carry without carrying bearer material. The decision event and the credential check (2026-08-28-n): kept, with what each adds stated — a record keyed by request, and a second registry. One credential feeding two registries (2026-08-28-a): declared as the deployment’s. The blank-reason denial (2026-08-28-c): its entry closes by a recovery record carrying the reason, or by the horizon, and never by a second denial. A chain found under a request already Withdrawn (2026-08-27-p): closed and reported, since provisioning can never fire for a terminal request. The substrate’s refusals over a possibly committed decision (2026-08-26-b) and a chain read refused inside the evaluation (2026-08-26-a): both open an evaluation entry the reconciliation retries, and neither changes the decision’s answer. The token’s deadline (2026-08-27-j): restated rather than fixed, because allocate takes a duration and the token’s deadline is Capability’s reading plus it — within the seam skew of the request’s, never on it.

What the rewrite found that no line named. One thing. The prose’s Behavior section was a seventh heading no shape declares, carrying six claims three families already owned; each went to its owner and the heading is gone.

The families. Seventeen, none minted: Provisioning cascade and Scope vocabulary are the page’s own and stand where the heading standard puts unplaced headings, and Expiry joins the watch-list family. Reconciliation is the right family — a requestor awaits a finished provisioning and an auditor a landed record — though the prose declares no window and no cadence, only restart and retry-until-closed; the page says so rather than inventing a window. Clock semantics, Concurrency, Expiry, Action wiring, Primitive policy and Composition state each gain one specification — 17, 32, 4, 18, 16 and 16 — and §18’s family clause is updated to match.

Instrument notes. First assembly, the record verbs aside: 25 findings and 22 advisories — nineteen D-code-span in the carried examples, notes and Decisions, five V-or-obligation and one B-exceed; eighteen W-unconditional-effect cured by six admitted-call subjects, two duplicate propositions, one comparator and one watch word, all cured. The linter’s eight were two orphaned registry entries and six stale census counts. Residue first read 98 — thirty-seven substrate wire names written bare on rule lines, initiate_chain and withdraw_chain most — and reads 61 with the names in English.

The counts. Unresolved noun phrases from 2,438 of 24,220 to 2,528 of 25,385 — all 90 this page’s, 90 of its 1,165, 7.7% against the corpus’s 10.0%. Residue from 61 to 61. Census from 482 to 482. Gate from 46 files to 47, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17. The page shrank 7%, and the rule count set a record again.
Council read 176 — Claude on the Reserve from Pool migration, 2026-09-23. Next by size: 155.7 KB of prose out, 150.1 KB in — 345 labelled rules across fourteen families, invariant numbers 1 through 6 and 8 unchanged, Invariant 7 tombstoned to Composes 5, and a Ledger that came in carrying twenty-two open lines and goes out carrying two, both the model’s.

Twenty closed, each by the rule that now owns what the line asked for. Four had choices in them, and a standing rule made each. 2026-08-26-e and 2026-08-30-e offered attesting the replay or declaring the bearer property; declared, because a replay commits nothing and Invariant 8 is a claim about commitment — the token is a bearer secret inside the window and the page now says so (Non-goal 12 and 13) instead of implying a record of who retried. 2026-08-26-i asked for the fail-closed landing; a seen token with no entry answers recording-failure carrying outcome, unsettled — the safe direction under the retry bit, since the act may have committed. 2026-08-26-j asked for the join between two logs; there is none to state, because no oversell is read at quiescence (every Confirmed reservation is a bound slot-holding one) beside the pool’s own acceptance over its own audit log. 2026-08-30-g offered an own landing or a stage for Provisional Commitment’s not-known; a third position, inconsistency, settled and alerted, because the position is already the retry bit and this is the one case no retry cures. The rest took their prescribed fixes — the pool leg never releasing more than the open returns, the unknown release reading and the recovery entries kept out of the replay chain, validation pinned before the intent against each constituent’s own field rules, the digest’s exclusions as rules, the Action Reference term entry, the glosses, the preamble’s count.

What the rewrite found that no line named. Three things. The prose copied Allocated Before and Allocated After from Capacity Constraint Enforcement’s events, and that atom’s events carry an opening and a closing balance now; the page is corrected to the constituent’s words. The reconciliation was told to drive the unjournaled hold of a partial [Reserve] terminal, and had no way to find it — the hold is the very thing that was never journaled — so the orphan hold is now declared: a Held commitment no binding names whose resource and requester match the open partial’s intent (Reconciliation 30), found under the pool exclusion that keeps an in-flight [Reserve] out of reach. And the prose’s own section collided with the grammar’s rule noun; the host’s mutual exclusion is an exclusion — the deployment’s own word for it was host_exclusion all along.

The families. Fourteen; one minted, Expiry sweep, single-spec, for the external caller’s contract the prose kept as an edge case — including 2026-08-30-h’s answer, that the sweep reads not-known as an orphan hold and does not retry it. The prose’s Cross-store consistency under partial failure was a reconciliation described in an edge case, and it is now Reconciliation: an auditor awaits its output within the compensation window. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one specification — 16, 31, 17, 15 and 15 — and §18’s family clause is updated to match.

Instrument notes. First assembly, the record verbs aside: 20 findings and 20 advisories — twelve D-code-span in the carried examples and Decisions, four V-or-obligation in the checks, two D-condition-form, one B-exceed and one D-rule-noun (section); nine W-unconditional-effect cured by an admitted reserve subject, five W-comparator, three W-condition-operator, two W-watch-word and one unused term, all cured. The second pass found a MUST EQUAL the checker read as a verb and a B-exceed the rewrite of the first introduced. The linter’s eight were two output nouns (application), the Decisions placeholder, and five stale census counts. Residue first read 68 — seven constituent wire names, place_hold and declare_pool, written bare on rule lines — and reads 61 with the constituents’ English names.

The counts. Unresolved noun phrases from 2,345 of 23,093 to 2,438 of 24,220 — all 93 this page’s, 93 of its 1,127, 8.3% against the corpus’s 10.1%. Residue from 61 to 61. Census from 482 to 482. Gate from 45 files to 46, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17. The page shrank a second time in a row by less than the last — 3.6% here, 15% at Capability-Backed Sharing — and grew in rules: the prose’s step lists were paragraphs of four obligations each.
Council read 174 — the resume arm names the credential the arc registered, 2026-09-23. The maintainer ruled External Onboarding’s 2026-08-30-d: walk back, not name the head. On duplicate-active-credential the resume arm read the party’s active credential and completed with it, and that read can answer a rotation successor, a registration an external writer made under the same principal reference, or — after a lapse or a revocation between the refusal and the read — nothing; the first two put a credential the composition never registered on the completion record, against Invariant 3.1. Resume 39 through 47 now read every credential of the party and the type in any status, keep the chain roots — the records a register created, never a rotate — registered inside the arc’s window union, continue with a sole root, and refuse none or several with onboarding-indeterminate carrying the credential candidates. Action wiring 33 points there; Action wiring 34 is tombstoned to Resume 41 and Resume 45. Check 2.1 through 2.3 are untouched. Decided from standing rules, not routed: the ruling said to treat the ambiguity as Resume 21 treats a party collision, and Resume 21’s mechanism includes the administrator’s input, so [Onboard] gains optional resume_credential_id — without it an arc with two roots in its window could finish only outside the composition, which Wiring decision 5 forbids — and Primitive policy 7 through 9 now range over a declared resume choice, either id. The refusal lands an interruption record at the credential-registration stage (Resume 47), because the resume record already stands and the administrator’s re-invocation would otherwise be refused as a young resume until the bound passed (Resume 8). Candidates now names what the refusal carries — party candidates or credential candidates — so the word keeps one sense and each population has its own name. Found in the pass: Resume 20 and Resume 22 both fired on a sole party reading with a resume party id outside it, one continuing and one refusing; Resume 20 now requires no resume party id, and Resume 41 is written the same way. The Decisions entry council read 170 added sat last, below the oldest; it moves to the top, with this ruling’s entry above it. Ledger: two open lines, both formal. Measured: 115.0 KB to 120.3 KB; unresolved noun phrases held at 2,345, noun phrases 23,050 to 23,093; residue 61; census 482; gate 45 files, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 172 — Claude on the Capability-Backed Sharing migration, 2026-09-23. Next by size, and the page with the most debt: 147.8 KB of prose out, 125.2 KB in — 233 labelled rules across fifteen families, invariant numbers 1 through 4 and 6 unchanged, Invariant 5 tombstoned to Composes 5, and a Ledger that came in carrying twenty-five open lines and goes out carrying one, the model.

Twenty-four closed, each by the rule that now owns what the line asked for. Three had choices in them and the page’s own logic made each. 2026-08-29-b offered a read before the attestation or the ttl on the payload; the ttl, because the auditor derives the expiry from it and the capability record, and the other option adds a constituent call to settle a field. 2026-08-29-m asked whether revocation is gated on provenance; it is deliberately not (Action wiring 48), because an unattested token in an exclusive instance is exactly the orphan whose recovery is revocation. 2026-08-29-l asked for an isolation requirement or a weaker claim; the weaker one, at most one of two concurrent redemptions discloses (Concurrency 1), because the guarantee is Capability Invariant 4’s and this composition assumes no isolation level of its own. 2026-08-29-f measured compensation lateness across two seams; it is now measured between two recording instants the substrate stamps (Check 6.5). 2026-08-27-i and 2026-08-29-h were one defect: the prose proceeded on parsed values while sealing a diverged index’s authorization event id, which put one event’s provenance under another’s descriptor — a diverged entry is now rebuilt before proceeding and an irreconcilable one refused (Action wiring 19 through 21). The rest are the fixes their lines prescribed, from the step carried on every transcription to the orphan named on every outcome-position refusal.

What the rewrite found that no line named. The page contradicted itself: its wiring-decision section still put the redemption inside the host transaction — the redemption-decrement and the Selective Disclosure record commit together or not at all — while its own step 4, its Invariant 2 and its edge cases said the redemption stands outside every transaction because Capability declares no enlistment and no undo. The step-4 reading is the one the constituent’s contract supports; Wiring decision 4 and Atomic writes 2 now state it once. The [Not Authorized Sharing] term entry still described a foreign capability allocated by some other composition, a case the exclusive instance removed two gates ago. And the Recipient term entry redeclared a name Selective Disclosure owns; this page’s concept is the recipient the allocator declared, so the entry is Intended Recipient.

The families. Fifteen, none minted. Reconciliation is the standard family and is the right one — an auditor awaits the leg’s output inside the declared compensation window. Clock semantics, Concurrency, Atomic writes, Action wiring, Primitive policy and Composition state each gain one specification — 15, 30, 15, 16, 14 and 14 — and §18’s family clause is updated to match. The prose’s Configuration and Logic confinement both became Capability requirement: the seam’s one reading and the ids minted elsewhere are what the deployment supplies.

Instrument notes. First assembly: 12 findings and 9 advisories — eleven D-code-span, one positive MUST … BEFORE; five W-unconditional-effect and four W-comparator, all cured — and a record verb, both, that the checker accepted into the vocabulary before a reader saw it was an adverb in the verb’s seat, rewritten. The linter’s nine were three orphaned entries and six stale census counts. The grammar needed no second pass.

The counts. Unresolved noun phrases from 2,303 of 22,280 to 2,345 of 23,050 — all 42 this page’s, 42 of its 770, 5.5% against the corpus’s 10.2%. Residue from 61 to 61. Census from 482 to 482. Gate from 44 files to 45, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 170 — Claude on the External Onboarding migration, 2026-09-23. The smallest composition left after Compensable Workflow, and the first regulated one this epoch: 117.9 KB of prose out, 115.0 KB in — 238 labelled rules across fifteen families, invariant numbers 1 through 5 unchanged, no tombstone owed. The Ledger came in carrying twenty-four open lines and goes out carrying three. cites.py --queue reads every spec the corpus cites by label is migrated now, so the queue is ordered by size and this was next.

Twenty-one closed, each by the rule that now owns what the line asked for. The largest in effect is 2026-08-26-f: whether a constituent’s field rules run before the gate decided whether a typo permanently consumed the invitation, and they now run before it (Primitive policy 3 and 4). 2026-08-30-c named two halves — the substrate’s invalid-request has a third source, Actor Identity’s own arm at the substrate’s second step, and the read-back had no floor; the floor is the invocation’s own attempt record, whose event id the invocation already holds and whose sequence number the substrate’s read record surfaces (Audit arm 8 through 12). 2026-08-30-k had a choice in it and the page’s own logic made it: a closed party the arc enrolled is still the arc’s party, so the resume arm’s candidates are not filtered by state (Resume 19), because excluding it would enroll a second one. The rest are the fixes their lines prescribed — the decliner’s identity declared unrecorded, Invariant 2 re-scoped to the completion record’s linkage, Party Identity’s invalid-query landed as the composition’s own defect, every alert named onto the deployment’s alerting surface, the completion relation’s cardinality and modality declared, a membership test for the horizon, rests on in every invariant, the examples’ credential call matched to the atom’s raw-material model and the concurrent example turned to the same-acceptor race, three acronyms glossed and the SOC 2 attribution corrected. 2026-08-30-f closed by the grammar rather than by the chair: PRECEDES is strict, so every edge the prose left open is pinned by the operator it is written with. Three stay open: the resume arm’s credential read-back (2026-08-30-d), which wants a choice between walking predecessors and naming the head, and the two formal lines.

One finding in a constituent, repaired where it lives. 2026-08-30-n asked for a note; the note found two rules. Invitation’s Composition note 2 obliged this composition to pass the accepting identity reference as the party record’s reference, and Composition note 3 to register the credential against the accepting identity reference — neither possible, since Party Identity mints the party id at its own seam and the credential is registered against that id. Both are rewritten to what this composition does: the accepting identity reference recorded beside the party record’s id on the completion record, and the credential registered against the party the onboarding enrolled. No label moved.

What the rewrite found on the page. Three post-write landings the prose never gave the resume record: its retention step, invalid-credential and an invalid-request whose read-back finds nothing. The prose’s post-write rule would have answered outcome for a record that commits nothing; the resume record is not a post-write record, and its arms are Resume 34 through 37, with intent where nothing committed. And the fresh arc’s lost section rule had a resume-arm twin the prose stated only in Configuration; it is Resume 38.

The families. Fifteen. Resume and Standing rule are minted here, one specification each — the resume arm is thirty-eight rules no standard family owns, and the acceptance section’s standing rules govern how every check reads, which is neither a check nor an external check. Clock semantics, Concurrency, Action wiring, Primitive policy and Composition state each gain one specification — 14, 29, 15, 13 and 13 — and §18’s family clause is updated to match.

Instrument notes. First assembly: 27 findings and 6 advisories — 26 D-code-span on signature inputs quoted in prose, one OR in an obligation, five W-unconditional-effect cured by validated call terms, one W-or-word; the linter’s six were one heading order and five stale census counts. The grammar needed no second pass.

The counts. Unresolved noun phrases from 2,252 of 21,460 to 2,303 of 22,280 — 50 of the 51 this page’s, 50 of its 817 or 6.1% against the corpus’s 10.3%; the fifty-first is Invitation’s, whose rewritten composition notes take it from 37 to 38. Residue from 61 to 61. Census from 482 to 482. Gate from 43 files to 44, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 168 — progress, and position keeps one sense, 2026-09-23. The maintainer ruled at council read 166 that Compensable Workflow renames and the corpus keeps position, with the new name taken from the page’s own words. The page meant two things by the word: the storage-failure positions — where a write lands, the sense Actor Suspension, Customer Onboarding, Defensible Retention and Recoverable Invocation declare — and the phase, current step and outcome a compensable workflow has reached. The second is progress, the page’s own word (forward progress), and one word where one serves. On the page: the Term declaration and its terms-list entry, eight rules — Composes 7, Composition state 1, Replay 14, Invariant 2.1 and Invariant 2.3, Action wiring 78, Check 2.2 and the log-projection list — the WHYs and the walkthrough’s four Progress: lines. The read action follows the corpus’s read form beside [Read Log]: [Position] is [Read Progress], the wire position is read_progress, and the answer arm is progress itself, so Term position reading is gone as a second name for one thing. Invariant 2 is Progress equivalence, numbers unchanged; the sense-one position sites — the failure positions, the validation and completion positions, the position rides the code — are untouched. cites.py --terms position now reads four declarations, one concept; --terms progress reads one. The register’s council read 166 counted five specifications holding the other sense; the instrument says four, and that entry’s sentence stands as written, with this correction beside it. The older Decisions entry keeps its prose and its marker moves to [Read Progress], because a link must land. Measured: unresolved noun phrases held at 2,252 of 21,460, residue at 61, census at 482; gate 43 files, 0 findings; lint 0 across 54 patterns. The TLA+ header comment still reads position equivalence — stale with the rest of the model, and left.
Council read 166 — Claude on the Compensable Workflow migration, 2026-09-23. The smallest of the thirteen unmigrated compositions and the first migration since the grammar stopped moving — v0.40 was current at the last one, v0.61 is current at this — written in the finished grammar from the first draft. 92.7 KB of prose out, 120.0 KB in: 243 labelled rules across fourteen families, invariant numbers 1 through 8 unchanged, Invariant 9 tombstoned, and the Ledger’s one open line — the formal model, stale for reasons that predate this — in and out unchanged. The page grew, and the reason is the prose’s density rather than the rules’: Action wiring was one paragraph per action carrying four obligations a sentence, and it is 82 rules now, each one obligation.

Eight repairs, written down before the rules were. The compensable workflow record declared its terminal outcome set once at start and immutable while setting it at the end, and no step of any action wrote it — the field is gone and the replay reads the outcome from the terminal marker. No step appended the commit event the page named; it lands when no next step remains. The continue policy’s move on re-picked a failed compensation on every [Advance], because a compensation failure leaves the step completed; standing failures and pending compensations now end the phase in the halted state it promised. A halt event whose append failed after an unknown verdict had no position, and none would have told the caller nothing was owed over an effect that may have landed; it answers effect-landed. [Cancel] past a pivot promised its roll-forward disposition and declared none; it answers roll-forward. [Cancel] outside the forward phase appended a compensation onset event whatever the phase, which from a compensating spine is a transition the spine refuses — spine-fault from an ordinary call; it now writes only in the forward phase. [Advance] answered already-terminal before re-entering, which left a terminal marker’s owed fire to a [Cancel] nobody sends; branch 1 runs first. And two citations re-aimed: execution-contract.md carries no obligation-realization boundary — working-ideas/outbound-contract-ports.md does — and the Undo History sentence the Intent quoted is gone, its boundary now stated as Undo History Non-goal 10.

One tombstone, at the class’s fourth seam. Invariant 9, constituent invariants preserved, is council read 53’s class: Deleted: Invariant 9. Composes 10 owns it., with Composes 10 citing Execution Contract Conformance 8, as Idempotent Reservation did at the third.

What the finished grammar cost, and none of it was the grammar. First assembly: 48 findings and 9 advisories in the checker, 12 findings in the linter. 36 were one class, D-rule-noun on argument: the domain calls a refund’s charge id a reversal argument, and Earned vocabulary 14 retired the word for input — which is the right word, since the captured values are the inputs of the compensating call. So the page says captured inputs, input envelope, input source and compensation inputs, and the wire keeps captured_arguments, arguments_source and compensation_arguments. Eleven were D-code-span in the examples and an older Decisions entry, one an X-ref on the prose’s Replay step 3. The seven W-unconditional-effect advisories were cured by two admitted-call terms, validated start and halted advance. S-action-unused found a naming defect the saga rename left: the action’s wire became start_compensable_workflow while its English was shortened to Start Workflow — one action, two names — so it is Start Compensable Workflow, the second entry renamed where the plan named one. The linter’s F-constituents found that the instrument reads a constituent only through X instance MUST serve, and State Machine’s per-run unit has been a workflow since council read 108; the rule the instrument asked for was true and missing — one State Machine instance, which the keyed lookup of the compensable workflow id already assumed — and is Composes 1 now. Six O-term-orphan were entries the prose had stopped marking. No flag survived a rewrite in admitted forms, so no watch flag was raised: the grammar needed no second pass.

The families. Fourteen, none minted. Composition state, Primitive policy, Action wiring, Concurrency and Indeterminate outcome each gain one specification — 12, 12, 14, 28 and 6 — and §18’s family clause is updated to match, the five lines W-stale-census named. Replay and Event schema reach two, Undo History’s and this page’s, one short of a candidate. cites.py --into finds nothing citing this spec by label, so no number here was held by a citation.

Measured and left. cites.py --drift shows position in two senses: five specifications declare it as the record a write lands, and this page as the phase, step and outcome [Position] reads — while its own failure-position names use the first sense. The action fixes the name, and renaming it is the maintainer’s. Critical section is declared alike here, in Idempotent Reservation and in Authenticated Actor. And the forthcoming pattern the Non-goals name took the roadmap row the backlog owes it — Semantic Lock, the twentieth — which M-orphan-forthcoming did not ask for, because the prose wrote a Semantic Lock pattern and the check reads the name before (forthcoming) as the one word pattern.

The counts. Unresolved noun phrases from 2,218 of 20,656 to 2,252 of 21,460 — all 34 this page’s, 34 of its 803, against the corpus’s 10.5%. Residue from 61 to 61: no snake word on a rule line, because the wire sits in the signature block, the Event schemas fence and the Projection lines. Census from 482 to 482, every first-assembly advisory cured. Gate from 42 files to 43, 0 findings; lint 0 across 54 patterns; test_checks green; conformance 17 of 17.
Council read 164 — a code span quotes one token, 2026-09-23. Found while sizing the first migration, and worth its own unit before that migration runs. Compensable Workflow carries 49 occurrences of compensable workflow_id, compensable workflow_halted, compensable workflow_started and their kin — an identifier with a space in it, which no token has. git log -S dates them to 733b154, the grounded sweep that renamed saga to compensable workflow and reached the wire spellings it should have left alone. The repair is the underscore the rename removed. A migrated specification carried the same defect, which is the part worth recording: Medication Order’s tombstone for Clock semantics 3 cited three declarations as `resolved dispensed_at`, half English and half wire inside a code span. Checked against the diff rather than assumed — the chair’s own second sweep touched that line and did not create them; they predate it, and saying so needed one git show rather than one guess. Those three name declarations rather than tokens, so they lost their backticks and took the current names, resolved dispensing instant and its pair. The instrument, and the shape of its test. D-code-token gates a code span that is only lower-case words and underscores. The first draft asked merely for a space beside an underscore and returned 668 findings, because Term code span admits an expression, a form and a citation — run_floor MUST NOT EXCEED run_bound, step_id NOT EXISTS, record_action step 3.2 all carry spaces and are all correct. Narrowed to the defect’s own shape it returns zero on the repaired corpus and fires on nothing else; five fixtures pin both sides. That is the third time a first draft convicted a whole class by shape and the correction was to test for the defect rather than for the resemblance. No count moves: unresolved noun phrases hold at 2,218 of 20,656, residue at 61, census at 482. The corpus is unchanged in what it says; two specifications now say it in tokens that exist.
Council read 162 — the last ten, and where the ruling stops, 2026-09-23. Four renames at 102 sites, and the finding is that the other six were never in scope. The four. Capacity Constraint Enforcement’s allocated before and allocated after bracket one operation — the page says the running total an audit event found and the running total an audit event left — so they are opening balance and closing balance, checkbook English that needs no explaining. The chair’s first proposal was balance before and balance after, which GLM refused on the ground that they end in a preposition and so fail the very rule this pass enforces; the refusal was right and the correction is GLM’s. Retention Window’s retention until is retention deadline, matching purge deadline on the same page — deadline is already the corpus’s noun for the instant a window ends. Defensible Retention’s attributed to is attributed actors, and the pattern nearly inverted it: the <participle> by rule of council read 160 would give attributing actor, the actor doing the attributing, where the page declares the actor reference of every candidate marker — the actors attributed to. A pattern applied without reading the definition would have reversed the name’s meaning. The six. active for, current for, history for, status of, pending for and subscribers for all carry Kind: Operation: they are read queries, and an action name is a verb phrase by nature — the corpus has always written them so, Seal Now, Try Take, Place Under Retention. The maintainer’s ruling was that a declared name ends in a noun, and a name is the name of a thing; an action is not one. The scope was settled by the corpus’s own Kind field rather than by anyone’s judgement, which is why it can be stated as a rule: the noun-final rule governs names, and an action name is out of it. The close. Every declared name in the migrated corpus that is not an action now ends in a noun. Preposition-tailed names fall 96 to 6, all six Operations. Names ending in ref fall 45 to 0. Unresolved noun phrases hold at 2,218 of 20,656, residue unchanged at 61, census unchanged at 482 — the English-names programme is finished, from 3,022 snake words on rule lines at council read 100 to 61, every one of the 61 wire sitting where the grammar says wire belongs. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3.
Council read 160 — the noun-final pass, 2026-09-22. The maintainer’s ruling at council read 134 — a declared name ends in a noun — deferred then to one pass over the finished list, and run here now the list is finished. 131 names at 3,432 sites, the largest rename the corpus has taken. Sixty-seven <participle> at names became <noun> instant, on the maintainer’s ear against the specimen that decided it: Authenticated Actor’s Invariant 8.1 read …at attested at…, where the preposition collides with the name’s own tail and a reader must backtrack; it now reads at the attestation instant. Nineteen <participle> by names became <participle>ing actor. Forty-five … ref names became … reference — we are not counting characters — and none remains. The head costs no vocabulary: instant is already a rule noun. The projection is untouched, Projection: attested_at exactly as it was. One collision, and the page’s own words settled it. expired at and expires at nominalise alike, and Provisional Commitment carries both — a deadline and the instant it passed. That page says open | lapsed thirty-seven times, so expired at took lapse instant and expires at took expiry instant. Found by checking the map against itself before a byte moved, which is the only reason two distinct names did not become one. Two instruments answered. 149 term-entry link definitions still pointed at the old anchors — [Sealing Instant]: #sealed-at — and O-term-anchor named every one; a heading rename is an anchor rename, which the contract-heading unit knew and this one had to be told. And W-two-obligations rose by two on …and hold instant, a declared name whose only home is a term entry — the gap flagged from council read 136 onward, that a term entry’s heading declares nothing to any reader in check.py. It does now: declared_names reads the #### headings, which cured the two and two false duplicate propositions with them. The census falls 484 to 482, the first move in fifteen units, and it moves because four advisories were artifacts rather than findings: W-duplicate-proposition 68 to 66, W-two-obligations unchanged at 27 after its own two were cured. Two fixtures pin it. The measurement, and it is the ruling’s vindication. Unresolved noun phrases fall 2,323 to 2,219 — 104 fewer, the largest fall of the whole programme — and noun phrases rise 20,427 to 20,651. A preposition-tailed name was never a noun phrase to the tagger at all: fired at reads as a participle and a preposition and leaves the denominator, which is what council read 138 measured and could not cure. Firing instant is a noun phrase, so it enters the count and resolves. The maintainer ruled on the ear; the instrument says the ear was right. Residue unchanged at 61 — this unit renamed English, not wire. Ten preposition-tailed names remain and each wants its own answer: pending for and subscribers for are calls, allocated after and allocated before are balances rather than instants, and active for, current for, history for, status of, attributed to and retention until are six the shapes do not reach. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3.
Council read 158 — the last names, and what the corpus keeps in the code spelling, 2026-09-22. Nine specifications finish naming their own, at 54 rule sites: Customer Onboarding 24, Actor Suspension 8, Audit Trail 6, Medication Order and Observation 4 each, Authenticated Actor 3, Credential 2, Defensible Retention 2, Login 1. Eleven names got a declaration written in the page’s own shape — Audit Trail’s original event payload and slice ref, Customer Onboarding’s trigger type and enrollment path, Credential’s credential types and new credential material, Authenticated Actor’s attest credential, and the successor ids / predecessor ids pairs in Medication Order and Observation, whose singulars were never declared either, which is why the plural class at council read 148 could not reach them. Six more were borrowed and went onto four Term cited: lines — event id, action ref, recorded at, each from Audit Trail. The eight bounds parentheticals that repeated the name instead of carrying a projection are gone, clock offset allowance (clock offset allowance) reading now as the name alone; the thirty that gloss rather than repeat are untouched. The measurement moves the right way for the first time in six units. Unresolved noun phrases fall 2,340 to 2,323, seventeen fewer, because a declaration is what the reader was missing — every previous unit renamed names the reader already resolved, and this one declared names it could not. Not one of the seventeen renamed names is unresolved anywhere. What the corpus keeps in the code spelling, and why it is finished. Residue falls 97 to 61, and the 61 is no longer a backlog: 50 are calls — subscribers_for, read_record, record_action, place_under_retention, verify_record, purge_event, place_hold, purge_eligible — which are wire wherever they are written and are now cited by every page that uses them; 10 are event types, recovery_intended and record_purged, which are wire values; and 5 are Lease’s expires_at, held because one unmigrated page writes it bare and one site is a signature arm quoted inside a rule, which is §18’s outcome-carrying-a-value class rather than a naming site. There is nothing left to sweep and nothing left to declare. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line through all fourteen units.
Council read 156 — Recoverable Invocation declares its own, 2026-09-22. The first reading unit, and the pile it was cut from turned out smaller than the docket said. Sixteen bounds names were held back at council read 144 because a sweep made audit horizon eat its own tail; measured now, none of the sixteen appears in a rule at all — council read 154’s member sweep cleared them — so the bounds pile is a declaration-line question, not a rule-surface one, and what remains of it is eight parentheticals that repeat the name instead of carrying a projection, clock offset allowance (clock offset allowance). The other thirty are glosses — reason cap (2000 codepoints) — and are right as they stand; the first test called all thirty-eight redundant, which is a reminder that a shape test is not a meaning test. The real unit was Recoverable Invocation, which held 51 of the 100 non-call sites. Ten names, 86 rule sites. Nine are the composition’s own and now carry a one-line declaration in the shape this page already uses — Term outcome event id: outcome_event_id — the event id the journal assigns the outcome record. — placed where the page places them, after the signature’s own Term lines. One is borrowed: retention until went onto the Term cited: line, and the instrument is why. The census rose 484 to 485 on a single W-watch-word, because retention until ends in a watch word and check.py reads past a declared name — including a borrowed one since council read 139 — but only where the page declares it. Citing it returned the census to 484, identical line for line. A rename that creates an undeclared name announces itself now, which is what six readers were taught to do. The measurement. Unresolved noun phrases rise 2,336 to 2,340 and noun phrases 20,423 to 20,426; not one of the ten names is unresolved anywhere, so the rise is the inner words the code spelling was hiding, the same effect measured at council read 142. Residue falls 150 to 97, counted with controls at both ends — three survivors found, three renamed names confirmed gone. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3.
Council read 154 — a member list that disagrees with itself, 2026-09-22. Term opaque input: party id | case_id | trigger_id | … | verifying actor ref declares one kind of thing twice over, some members in English and some in the code spelling, on one line. Fifteen such lines across ten specifications; the English is the name and the snake members take it, on the line and at every rule site. 152 sites, 19 names: Customer Onboarding 81 with 6, Recoverable Invocation 18, Actor Suspension 16, Shared Todo 13, Audit Trail 11, Defensible Retention 8, Attributed Permissions Admin 4, Party Identity 1. Two kinds of member stay wire, each by a test rather than a judgement. A call is a signature head some specification owns — try_take, read_record — and an event type is a wire value: it sits on a Term value sets: line and shows itself dotted, actor.recovery_intended. The dotted form alone is not the test, and the first draft proved why — it excluded intent_event_id, which is a field inside the path data.intent_event_id rather than an event type, and a field takes English in a rule wherever the path is not the thing being written. Both halves are needed; either alone is wrong in one direction. The measurement does not move — 2,336 of 20,423, unchanged — and that is the expected result rather than a disappointment: these names were already declared, as members, so the reader resolved them under either spelling. What the unit buys is a declaration line that agrees with itself. Residue falls 233 to 150, and the count was taken with controls at both ends for the first time — three names the claim says survive, found; three the claim says are gone, absent — after GLM’s scanner returned a false zero this week and only a known-positive check caught it. A counter that cannot find what it should is reporting silence, not truth, and the register’s census rule now carries that clause. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 152 — a page declares the vocabulary it calls, 2026-09-21. Not a spelling unit: a Closed vocabulary 4 gap. Five compositions call a constituent’s contract in a rule and never declare the name they call it by — Customer Onboarding’s read_record, verify_record and purge_event, Actor Suspension’s and Defensible Retention’s verify_record, Login’s record_action, Notification Fanout’s pending_for — 12 sites, eight page-and-name pairs, every one of them a signature head another specification owns. The test that drew the class is stated because the register now requires it: a snake_case word on a labelled rule line, declared nowhere in any Term line’s head or body on its own page, which another specification declares as a signature head. Each page already carried a Term cited: line and each owner is already a constituent, so the cure is one run-form clause per page — read_record, verify_record, purge_event: Audit Trail. — and nothing else moves. The names stay in the code spelling, which is the point rather than an exception: a call is wire, Audit Trail’s own cited line writes place_under_retention the same way, and council read 139’s rename reaches a borrowed name, not a borrowed call. What is left is no longer a class. Thirty-one sites in sixteen names, and each wants a reader: Audit Trail’s original_event_payload and slice_ref, Recoverable Invocation’s outcome_action_ref and closing_event_id, Credential’s new_credential_material — genuine own names with no declaration; four borrowed field names whose cure is a citation and a rename, which is two claims and so a unit of its own; three plurals whose singular is undeclared too; and two pages naming their own action’s wire spelling in a rule, which the same-page test had excluded. The measurement does not move — 2,336 of 20,423 unchanged — because the reader already resolved these names through the pages that own them; what changed is that the pages using them now say so. Residue unchanged at 233: a citation adds a declaration, it does not remove a code spelling. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 150 — a contract section says which thing it is, 2026-09-21. The routed question closes, and the answer was not a naming preference but a defect named. [Record Action] had two sections — the term entry, which is the nothing surface and carries no obligation (Surface 25, Surface 27), and the contract, which carries the signature and the steps — told apart by spelling alone: #### Record Action against #### record_action. That is *make all things mean one thing* broken six times in Audit Trail and seven in Recoverable Invocation, and it was load-bearing: the two spellings gave two anchors, `#record-action` and `#record_action`, so every bracket marker resolved to the term entry only because the contract heading stayed in the code spelling. `Rule shape 7` then forced every label family under that heading into the code spelling too, which is why 204 label lines could not go English while the heading could not change. *The cure is one word.* A heading now says which of the two things the section is — `#### Record Action contract` — chosen over *— the contract* on the maintainer's deciding principle, as simple as possible without losing fidelity. The anchor `#record-action-contract` is distinct, so Surface 26 holds and every `[Record Action]` marker still resolves to the term entry; the families become *record action* and *record action step*, whose words the heading carries, so `Rule shape 7` holds with nothing bent. **13** headings and **249** label lines and citations: Audit Trail 6 and 208, Recoverable Invocation 7 and 41. Two further headings were in the code spelling and are not contracts — Recoverable Invocation's `### `journal_fence` (optional)` and `### Under `journal_fence = none, now Journal fence (optional) and Under journal fence set to none, the second taking the field set to value phrasing Earned vocabulary 11 already declares. Zero label families remain in the code spelling anywhere in the migrated corpus. X-ref, which fires on a reference to a label no rule carries, found nothing, so the redirect is closed by instrument rather than by assertion; no tombstone is owed, every rule surviving at a new address. The thirty-six contract headings still in the code spelling all sit in unmigrated compositions and take the convention when those migrate. The measurement does not move — unresolved noun phrases stay at 2,336 of 20,423 — because a label is an address, and the noun reader reads rule bodies rather than the labels above them. Residue falls 447 to 233. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 148 — the plural class, and a census wrong for the third time, 2026-09-21. A class flagged at the third sweep and never closed: a name whose singular the specification declares in English, written in the code spelling wherever a rule needs the plural. Twelve names, 18 sites — sequence_numbers in Event Log, Provenance and State Machine, subscription_ids, attestation_ids, assignment_ids, event_ids, hold_ids, notification_ids, act_keys, retention_ids, evidence_ids — each taking the plain English plural of the name already declared. No declaration is owed: the singular is the name, and a plural is that name in the number the rule needs. The unit’s real content is the census it had to correct first. The residue’s authoring block was reported at 415 sites, then 191 in 60 names. Both were wrong, and wrong the same way three units running: the test asked whether a name headed a Term line or sat on one of eight named list categories, and Customer Onboarding declares case_id, trigger_id, trigger_ref, actor_ref and retention_policy_ref as members of Term opaque input: — a ninth category the test never knew about. Counting a name as declared when it appears anywhere in any Term line’s head or body, which is what Closed vocabulary 4 actually asks, the block is 59 sites in 36 names, not 191 in 60. Council read 138’s rule was written for a count that moves and council read 142’s for a count of what a name touches; this is the third shape of the same failure — a census whose inclusion test is unstated — and it is now the register’s rule in full: a count states the surface it was taken on and the test that drew it. What the corrected census leaves is three kinds, not one. The plural class, closed here. Twelve constituent call names — verify_record, read_record, purge_event, record_action, place_under_retention, pending_for, attest_credential — which are wire and want a Term cited: entry rather than a rename, so the pages that use them stop using vocabulary they never declared. And roughly a dozen genuine own names — Audit Trail’s original_event_payload and slice_ref, Credential’s new_credential_material, Recoverable Invocation’s closing_event_id — which want a declaration written by a reader. Only the last is authoring; the middle is citation, and the first is arithmetic. The measurement. Unresolved noun phrases fall 2,337 to 2,336, noun phrases unchanged at 20,423 — the plural resolves through the declared singular, so the reader barely notices what the page gains. Residue 465 to 447. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 146 — one operator, one operand type: PRECEDES, 2026-09-21. The maintainer ruled the multitasking-token row’s second member. EXISTS split at v0.52; EXCEEDS splits here, keeping quantities and lengths, while two instants compare with PRECEDES, negated DOES NOT PRECEDE (v0.61, Term condition operator, Earned vocabulary 18 and 19). The form is one word because the maintainer ruled against phrases. The first draft of the ruling composed IS AFTER and IS BEFORE on the precedent of IS IN; the maintainer’s correction was that GRACE subsets English rather than rebuilds it, and that a name made of a little sentence is worse than a word — combine as few word pairs as possible, preferably none. PRECEDES is one word, it takes the negation shape DOES NOT EXCEED already set, and it needs no new form at all. The cost is an operand swap, since a EXCEEDS b between instants is b PRECEDES a, and the corpus had already chosen that order: 19 rule sites wrote precedes in lower case before any operator existed. FOLLOWS was refused on measurement. follow and follows sit at 18 rule sites in three senses — temporal (disclosed at MUST NOT follow the now), ordering (EVERY outcome MUST follow an intent) and conformance (arms MUST follow the intent position). A word meaning three things makes a bad operator, and the split is a finding of its own rather than a reason to admit the word. What the instrument found that the census did not. Twenty instant comparisons moved off EXCEEDS by hand census, and then D-condition-form’s new operand check found ten more the census had missed — two EXCEEDS sites whose instant operand the hand test did not recognise (Assignment’s Check 4.1, Lease’s Fence 3), six bare infinitives (MUST NOT precede, which is an ordering claim wearing a verb), and two relative clauses (the at time does not precede). The hand census found the shape it was looking for; the instrument found the shape it was defined by. PRECEDE joins EXCEED as a reserved grammar verb so the ordering invariants keep their form — A commitment’s confirmed at MUST NOT PRECEDE the commitment’s placed at — and no plural is admitted, because a comparison has one subject and one object. Three sites kept EXCEEDS on inspection: Session’s two duration comparisons and Recoverable Invocation’s Instance start 6, all between durations. Five fixtures pin both directions. The measurement. Unresolved noun phrases fall 2,341 to 2,337, noun phrases 20,426 to 20,423. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 144 — the plain names, and what the bounds line already knew, 2026-09-21. Seventeen names this page declares inline and no other page addresses, at 235 sites: Recoverable Invocation 83 with 3, Actor Suspension 69 with 5, Customer Onboarding 36 with 5, Defensible Retention 31 with 3, Shared Todo 16 with 1. The scope is stated by the tests that drew it, not by the count: no label family carries the name, and no unmigrated page writes it bare. The unit’s real finding is a class it did not sweep. The 33 names that only a Term list line declares are four classes, and three of them are wire: a Term cited: name is a constituent’s call — record_action, try_take, place_under_retention — and a Term value sets: member is a wire value, often dotted, actor.suspension_intended; both keep the code spelling. The fourth is the bounds line, 16 names in four specifications, and it was already right before the sweep arrived: it reads english name (wire_token) — suspension completion bound (suspension_completion_bound), audit horizon (audit_trail_retention_policy) — so the name and its projection sit side by side on one line, which is a wire surface nothing had named. The first draft overwrote sixteen projections, and worse: it renamed audit_trail_retention_policy to audit trail retention policy where the line declares the name is audit horizon, so a mechanical sweep would have coined a name against the page’s own declaration in six of the sixteen. Taking the name from the parenthetical fixed that, and then the class failed a second test — Actor Suspension’s Term audit horizon: … set by the instance's audit_trail_retention_policy`` became set by the instance’s audit horizon, a definition eating its own tail, because the token there names Audit Trail’s configuration key rather than this page’s bound. Sixteen names whose definitions cite a constituent’s setting cannot be swept; they want a reader. Held back with the two specimens as the reason. The wire surface is now a watch line. §18 carries it at nine instances across four sweeps — Projection: and formal:, a code span, a signature block, a fenced event schema, a braced shape inline, a dotted path or call, the label position, and the bounds parenthetical — with the observation GLM asked for: the cure twice was to widen the shape of the test rather than extend a list, and what the grammar owes is one sentence naming the set instead of a corpus that learns it by damage. Recurrence is met; a finding against the set itself is not, so Principle 2’s second half stays open. The measurement. Unresolved noun phrases fall 2,342 to 2,341 and noun phrases 20,430 to 20,426 — the smallest move of the series, and expected: these names were declared inline already, so the reader resolved them under either spelling. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 143 — GLM on council read 142, 2026-09-21. GLM admitted the unit and returned the finding the unit’s own new rule had earned: 204 snake label lines in 13 families survive against a claim of zero, all action-derived, all in Audit Trail and Recoverable Invocation. Its count is exact, verified line for line, and the chair’s entry is corrected rather than appended to. GLM’s own grade on itself — right claim, unmeasured basis, on the ruling turn — pairs with the chair’s: right measurement, unnamed surface, three units running. The two failures are the same failure from opposite sides, which is the argument for the register carrying the rule rather than either reader carrying the habit. GLM also confirmed the naming ruling’s own product where it lands: the family reads clock offset allowance 1, and the three words do three jobs — skew is the drift, offset the measured gap, allowance the declared limit — so no two of them collapse. No corpus change.
Council read 141 — GLM on council read 140, and the case for English addresses, 2026-09-21. GLM admitted the unit and argued the ruling the chair had routed. Its case: a label family is not machine-facing, the wire surfaces are, and the address is the surface the squint test lives on; the read-aloud test does not lose jurisdiction at a colon; English multiword families are the corpus’s existing norm rather than a new form; and address stability is satisfied by a redirect the instruments check, not by never renaming. Its factual premise — that unmigrated mentions are references to a token rather than citations of an address — the chair then verified and found true in a stronger form than GLM stated it: no unmigrated specification carries a labelled rule at all, so none can cite an address, and every one of the 237 mentions sits inside a code span. GLM also asked for one register line the chair agrees with and defers to the next unit: the wire-surface set is accreting by collision — code spans, signatures, event schemas, braced shapes on a declaration — and should end as something the grammar declares rather than something each sweep discovers. The 39-class of five list-line names rides the next unit rather than earning its own, as GLM asked. No corpus change.
Council read 140 — task 14 opens: the names nobody else addresses, 2026-09-21. The residue’s shape was measured before any of it was swept, and the measurement is most of this unit’s worth. Of the 1,213 snake_case words left on rule lines, 759 in 106 names are declared on this page as Term <name>: definition. in the code spelling; 415 in 77 names are declared nowhere on the page at all, which is Closed vocabulary 4 rather than spelling; 39 in 5 names sit on a Term list line only. The first question was whether an inline declaration owes a term entry, and the corpus had already answered it: 889 inline declarations are written in English and carry no entry, against 248 that carry both, and the Term bounds: lines of swept specifications read reason cap, window duration, default expires at — one of them saying outright that window is the lowering token its term entry carries. A term entry exists for a name that lowers to a token; a name that does not is English and nothing else. No ruling was needed and none was asked for. The second question is a ruling, and it is routed rather than run. Of the 108 inline-declared names in migrated specifications, 36 are label families — seal_coverage 1, compensation_window 4 — which R-label-heading ties to the heading they sit under and which other pages cite as addresses: compensation_window is named in eleven specifications, reconciliation_cadence in sixteen, clock_offset_allowance in twelve, and 35 of the names reach specifications that are not migrated at all. Renaming one silently rewrites an address in files this rewrite has not touched, which is the corpus-wide sweep the maintainer reserves. A further 24 are plain names that another page nonetheless writes. 48 are neither — no label family, no other page — and those are this unit: 333 sites in seven specifications, Recoverable Invocation 218 with 33 names, Audit Trail 44 with 5, Selective Disclosure 37, Customer Onboarding 20, Actor Suspension 12, Event Log 4, Defensible Retention 3. A wire surface in a new position. Recoverable Invocation declares Term act finding: {finding, kind, act_key, invocation_id, first_seen, run_id}; — a braced shape naming a record’s fields, inline on a declaration line rather than inside a fence, and the first draft rewrote two of its fields. It is the surface council read 138 met in Undo History’s event schemas, standing somewhere else, so the keep-out and the gate both read a braced shape wherever it sits rather than only where it is fenced; two more fixtures, eight in all. That is the third time a wire surface has been found by running into it and the second time the cure was to widen the shape of the test rather than add an entry to a list. The measurement. Unresolved noun phrases go 2,312 to 2,320 and noun phrases 20,417 to 20,410. No renamed name is unresolved — all 48 checked against their specifications’ own miss lists — so the rise is the tagger reading lines differently once a token becomes two words, as at council reads 136 and 138. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 139 — the borrowed names: a name another specification declares, 2026-09-19. Class A was a name a specification declares for itself. This is the next surface: a name it uses and a sibling declares, 822 sites across thirteen specifications with 57 names — Audit Trail 282, Defensible Retention 113, Customer Onboarding 111, Authenticated Actor 110, Login 56, Recoverable Invocation 43, Notification Fanout 36, Session-Gated Authorization 27, Undo History 19, Actor Suspension 14, Attributed Permissions Admin 10, Shared Todo 5, Provisional Commitment 2. Two declaration paths make a borrowed name legitimate and the sweep takes both, nothing else: the owner is reached through Term constituents:, or the name sits on this page’s own Term cited: line, which Closed vocabulary 16 says is written bare in a rule. The residue’s cross-spec half was measured at 539 rule sites and splits 308 / 150 / 81 across those two paths and neither — the 81 are used with no declaration path at all, which is authoring rather than spelling and goes to task 14 with the 1,124. Renaming is unambiguous because the corpus agrees with itself: of every code spelling with a term entry anywhere, not one has two owners giving it two English names. Three more wire surfaces, each found by running into it. The dotted path and the call are the wire’s own punctuation — RetentionWindow.purge_eligible, data.entry_id, place_hold(…) — and the first draft wrote RetentionWindow.purge eligible into a Composes rule. The label position is the third and the sharpest: purge_eligible 1 through 6 are a family name, which R-label-heading ties to the heading it sits under and every citation freezes, so a sweep that renames it silently rewrites an address; six gating findings said so before the diff was read. Both are keep-outs now, and the corpus was checked for the same damage under the four committed sweeps — an English name after a dot, corpus-wide: none. The sixth reader to learn it, and the first where the declaration is elsewhere. The census rose 484 to 493 on the sweep: retention until, attested at and their kin arrived in compositions as borrowed names, and W-watch-word read until and at as bare watch words because check.py reads only the page in front of it. borrowed_names now reads the Term cited: run form and the Term constituents: links one level, the census returns to 484 identical line for line, and four fixtures pin it — a constituent’s name and a cited name silent, the same words undeclared and a bare watch word still firing. A borrowed name’s words belong to the name exactly as a local one’s do, which is the lesson of council reads 132, 135 and 136 arriving at the one reader that had no way to see past its own file. The measurement barely moves, and that is the finding. Unresolved noun phrases go 2,315 to 2,312, noun phrases 20,437 to 20,417. Audit Trail, which carries 282 of the sites, goes 310 to 311. The reader resolved these names before the sweep, because the cited line declared them in the wire spelling and the reader reads that line for declarations; renaming preserves resolution rather than gaining it. What this unit buys is not the reader’s number but the rule surface reading English where it had read wire. Two names did move, both upward and both known: Customer Onboarding’s evidence ref and Login’s presented material are borrowed from owners that declare them in a term entry and nowhere else, so sweep four’s gap — an English name whose only home is a term entry is not a declaration — now crosses a specification boundary by inheritance. Task 14 closes it in the owner, and the composition is cured by that. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3.
Council read 138 — the English names, final sweep: class A closes, 2026-09-18. Eleven specifications take their term entries’ English words at 475 rule and prose sites with 33 names: Event Log 76, Permissions 67, Actor Identity 68, Personal Todo 50, Tamper Evidence 61, Idempotent Reservation 31, Provisional Commitment 63, Notification Fanout 22, Recoverable Invocation 18, Duplicate Prevention 12, Undo History 7. The rule-surface count these were docketed at is the smaller number and the one that closes: 266 class-A words on labelled rules, and the corpus now carries zero — a snake_case word whose own specification declares a term entry for it no longer appears in any rule in the library. The two counts differ because the docket measured labelled rules and the sweep also rewrites prose, tables and WHY notes; both are stated so neither reads as the other’s correction. The sweep found the keep-out under-stated, and the finding is the unit’s. Task 25’s rule named three surfaces that keep the wire spelling — the Projection: line, a code span, and the signature block — and Undo History has a fourth: an ### Event schemas fence whose rows read {type: "edit", event_id, recorded_at, id, prior_description, new_description}. The sweep rewrote four of them before the diff was read. The keep-out is not a list of three surfaces but one rule with a positive test: a fenced block is swept only when it is rule text, because the negative test can only name the wire blocks someone has already met. Re-run under the positive test the sweep touches 475 sites rather than 479, and Undo History four rather than eleven. The same test, narrowed, is now a gate. D-wire-spelling reads every block that names itself as wire — a signature, which opens name(input, …), or a record or event shape, which opens { — and fires on a term entry’s English name where its projection belongs. Corpus-wide it found one site, and not one of this week’s: Party Identity’s verify has answered verification result since A signature has one owner, where its Projection: line says verification_result and its own input list says so on the line above. Fixed here as the surface correction it is. Whether verify should answer the result at all, where enroll answers party_id and suspend answers state_change_id, is a question about the atom and is left open rather than guessed. The gate’s test is deliberately narrower than the sweep’s: the sweep keeps a block unless it is certainly prose, the gate fires only where the block is certainly wire, and the Ledger — fenced, and naming term entries by their headings — is why. Six fixtures pin both ends. The measurement. Unresolved noun phrases fall from 2,304 to 2,315, the first fall of the sweep series, and it is one specification: Notification Fanout −14 against +9 spread over four others. The fall is not comprehension. fanout_id and fired_at become fanout id and fired at, and the tagger reads fired at as a past participle and a preposition — no noun phrase at all — so the phrase leaves the denominator rather than resolving, which is why noun phrases fall 20,478 to 20,437 while unresolved falls only 5. The reader has independently found what the maintainer ruled at council read 134: a name ending in a preposition is not a noun, and the instrument cannot see one where the grammar says there should be. Every one of the 33 renamed names resolves — checked name by name against each spec’s miss list — so the +9 is the tagger re-reading lines it had read differently, not new unresolved names. What class A leaves, and on which surface. The residue is 1,663 snake_case words, and the surface is stated because the first count of it was wrong. Rule line here means every line inside a fenced block whose first non-empty line is a labelled rule, with code spans removed — a rule’s continuation lines are rule text and carry obligations, so they count. Counting only the lines that open with a label gives 1,279, which is what this entry first said; the same corpus reads 1,309 if code spans are left in, 3,894 over every line in the file, and 5,753 over every line with spans left in. The understatement announced itself against the corpus’s own docket, where Audit Trail has stood at 593 and Recoverable Invocation at 462 since task 14 was measured — both counted on the wider surface, and neither reachable from 1,279. GLM’s independent scan returned 1,645 on that surface and named the cause before the recount did. Class A is zero on the wider surface too, checked there rather than assumed. The residue is two unit kinds, not one: 1,124 whose name has no term entry anywhere, which is task 14 — write the entry, then name it — and 539 whose name has a term entry in another specification, which needs no new declaration, only the constituent’s English. Audit Trail holds 603 (456 and 147), Recoverable Invocation 470 (435 and 35), Customer Onboarding 169 (83 and 86), Defensible Retention 104 (23 and 81); of the 29 specifications carrying any, fifteen are down to a single-digit tail. A count whose surface is unstated is a count nobody can re-derive, which is the departure lesson of council read 137 arriving a second time, one measure over. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged line for line.
Council read 137 — GLM on council read 136, 2026-09-18. GLM admitted the sweep and verified it from the files rather than the message: the baseline file in place at 20,478 and 2,320, a plain run printing its own move with nobody hand-copying a number, M-register-citation live and having caught the README’s example citing a council read that did not exist — the instrument finding a defect in the documentation about the instrument. GLM named the design better than the unit did: W-stale-census guards the destination, so a hand count cannot drift from the corpus, and nouns-baseline.json guards the departure, so a unit cannot open from a number nobody stated; the interval between units is held at both ends by files, and the register’s convention line now only describes what the tools enforce. GLM also owned the error inside its own flag: it had 2,337 as sweep three’s end where 2,337 is sweep two’s close, having trusted its recall of the previous message over the register. Right symptom, wrong anchor — and the cure it asked for is what makes the anchor unnecessary, which is the argument for the cure. No corpus change.
Council read 136 — the English names, fourth sweep: ten atoms, 2026-09-18. At the maintainer’s word the batch doubled: Invitation, Credential, Assignment, Retention Window, Capacity Constraint Enforcement, Soft Delete, Subscription, Notification, Party Identity and Selective Disclosure, 1,015 sites renamed — 125, 126, 93, 106, 97, 117, 77, 78, 114 and 82 — 95 names, each taking its term entry’s words. The keep-outs held: 95 names in signature blocks, 104 on Projection: lines, 59 in code spans. Two more readers learned that a declared name’s words are the name’s. Capacity Constraint Enforcement’s allocated before and allocated after made W-watch-word fire six times on the names’ own second word, and Retention Window’s retention until pushed Operation 28 and Invariant 11.2 over the duplicate detector’s similarity threshold by splitting one token into two common ones. check.py now blanks a declared name before reading watch words, and counts a declared name as one token before comparing propositions; three fixtures pin both. The duplicate detector, reading names whole, then found two restatements the code spelling had hidden: Authenticated Actor’s Invariant 4.1 against Composition state 8, and Login’s Invariant 2.2 against Wiring decision 4 — each a proposition written twice, which Authority 3 says a specification pays for once. They are real, they are advisory, and they belong to those two compositions’ own units; the census stands at 484 until then. Twenty-nine snake_case words remain in the ten atoms’ rules, all plurals of projected names but Credential’s new_credential_material and Selective Disclosure’s authority_reference and authority_type, which have no term entry. The baseline, stated in full because it has not been for three units: sweep two closed at 2,337, council read 134’s rename of clock offset allowance took it to 2,339, and council read 135’s generic single-word join took 2,339 to 2,304 with the phrase denominator falling 20,823 to 20,532 — so 2,304 of 20,532 is sweep three’s close and this unit’s start, where GLM’s flag had 2,337 as sweep three’s end and that is sweep two’s. Measured from there, unresolved noun phrases rise to 2,320 and noun phrases fall to 20,478, the fall being phrases that were two and are now one. The baseline is no longer mine to remember: nouns-baseline.json holds the totals the last unit closed at, every run prints its move against them, and --record names the unit whose close the file holds — the cure W-stale-census gave the family counts at council read 33, applied to the other end of the interval. The rise is the sweep’s own finding: an English name whose only home is a term entry is not a declaration, so the reader cannot resolve it — Party Identity’s verification id and evidence ref, Invitation’s token material, Credential’s presented material. Task 14 is what gives those names a Term line; until it runs, each sweep converts a few more rules to names the grammar has not been told about. Census at 484: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 68, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3.
Council read 135 — the English names, third sweep: five atoms, 2026-09-18. Provenance, Approval Step, Observation, State Machine and Legal Hold: 841 sites renamed — 185, 171, 173, 178 and 134 — 58 names, each taking its term entry’s words. The keep-outs held: 63 names in signature blocks, 64 on Projection: lines, 87 in code spans. State Machine’s entries, rewritten at council read 108, needed nothing; its Projection: lines still carry instance_id and instance_metadata as that unit left them. The sweep moved the census for the first time, and the gate was wrong rather than the atom. Legal Hold’s Check 2.1 and Check 3.1 read find placed by and hold reason not blank, and W-two-obligations counted hold as a second obligation — a declared name whose first word is a record verb. check.py now skips a name the specification declares before it reads a verb after and, two fixtures pin it, and the census returns to 482 with the advisories identical line for line. It is the third instrument this week to learn that a declared name’s words are the name’s. Ten snake_case words remain in the five atoms’ rules, all of them plurals of projected names or a term declared code-first: Provenance and State Machine’s sequence_numbers, Legal Hold’s hold_ids, Observation’s successor_ids, predecessor_ids and clock_offset_allowance. Observation’s is the twin of the one council read 134 renamed in Medication Order and takes the same name in its own unit, with the plurals. The baseline for this unit was 2,339, two above council read 133’s close, because council read 134’s rename left Medication Order’s Capability requirement 3 and 4 reading the clock offset allowance, which the tagger split at offset and left as the bare allowance. That is the same lesson a fourth time, so nouns.py now joins a run to the next across any single word — not only a preposition — where the join is a declared name; an eleventh fixture pins it, and the split names it resolved take unresolved noun phrases from 2,339 to 2,304 and noun phrases from 20,823 to 20,532, the fall being phrases that were two and are now one. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 134 — GLM on council read 133, 2026-09-18. GLM reproduced the sweep and both counts, found no snake_case left on the rule lines its scan reads, and asked for the baseline clause the entry now carries. The six that remain sit on labelled rules GLM’s scan did not reach — Capability requirement 3 and 4, Invariant 4.1 and 4.2, Check 2.3 and 2.4; GLM found its own scanner silent rather than the atom clean, and said so. GLM corrected this unit’s routing: clock_offset_allowance is declared in Medication Order, code-first and before the architecture, so it wanted no new declaration but the name five compositions already give it — Term clock offset allowance: clock_offset_allowance — …, noun-final as the maintainer’s ruling asks. Renamed here at 7 sites, which leaves four snake_case words in the atom’s rules, the successor_ids and predecessor_ids plurals, for the plural class. Observation declares the same term the same way and is swept next. GLM read the reader’s new rule as calibrated the way council read 118 asked, taking an extended phrase only where it is a declared name and the plain phrase is not, so a stem-style false positive cannot breed there. The maintainer ruled on prepositions, which this sweep mints in names as the code spellings carry them. In a rule’s prose they stay: under the critical section, at the seam, from the call read as proper English wherever the subject is beyond doubt, and the grammar pins the ones that carry timing as tails. In a name they may not end it: a declared name ends in a noun, so expires_at is not expires at but an instant with a head — the code spelling staying on the Projection: line. The sweeps keep deriving word for word meanwhile, as council read 100 says; the ruling lands as one pass over the finished list, where the maintainer approves the English once instead of once per specification. Eighteen of the 29 preposition-carrying names declared so far end in one. No census moved.
Council read 133 — the English names, second sweep: four atoms, 2026-09-18. The pilot’s form applied without change to Medication Order, Consent, Session and Message Preference: 723 sites renamed — 224, 183, 156 and 160 — each name taking the words of the term entry whose Projection: line carries its code spelling, 62 names in all. The three keep-outs held on their own: 57 names in signature blocks, 62 on Projection: lines and 68 in code spans kept the code spelling, and the gate found nothing. Six snake_case words remain in Medication Order’s rules — clock_offset_allowance twice, and successor_ids and predecessor_ids twice each — none of which has a term entry; they are the second unit kind’s work, not this one’s. The reader learned the rest of the shape the pilot began. A declared name may also open with a preposition — Consent’s at_time is at time, thirteen sites where the tagger dropped the at and left time — or end with one, Session’s expires at. nouns.py now tries a leading preposition, a trailing one, and the join across one, and takes the extended phrase only where it is a declared name and the plain phrase is not. The baseline moved before the sweep did: council read 132’s reader fix took 2,357 to 2,351 by resolving the pilot’s seven ref fragments. Measured from there, unresolved noun phrases fall from 2,351 to 2,337 and noun phrases rise from 20,663 to 20,821, the rise being names the reader used to drop as it trimmed. Gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 132 — GLM on council read 131, 2026-09-18. GLM reproduced the sweep — no bare snake_case left on a rule line outside a code span or a signature, the three keep-outs holding, 2,357 — and read the signature ruling as the unit’s finding, made by the gate refusing its own author’s first draft. Its first note is taken: the seven ref misses were the reader’s gap, not the corpus’s, so nouns.py now reads a declared name that runs through a preposition — revoked by ref, revoked at — as one phrase, joining only where the join is a declared name. Unresolved noun phrases stand at 2,351 against 2,350 before the sweep, and the tenth reader fixture pins the join. Its second note is the watch: a sweep is only as English as the term entries it reads, and Capability’s entries chose ref and max. The sweep takes the entry’s words as council read 100’s ruling says and mints nothing; whether the entries themselves want better English is a pass of its own, after the sweeps. Census at 482: unchanged.
Council read 131 — the English names, first sweep: Capability, 2026-09-18. Task 25’s first unit kind, run on one atom before the rest so the form is reviewed once. Capability had 121 snake_case words in its rules and 186 in all, and every one names something the atom already gives an English name in a term entry, so nothing was minted: the eleven names take the entry’s own words — capability_token is capability token, revoked_by_ref is revoked by ref, max_redemptions is max redemptions — derived word for word as council read 100’s ruling says. Three surfaces keep the code spelling, and the rule is the same for all three: the wire is written where the wire belongs. A term entry’s Projection: line (11), a code span quoting literal text such as allocated_at + ttl (19), and the signature block, whose header and inputs are the action’s wire contract — allocate(allocator_ref, scope, max_redemptions, ttl). The first draft renamed the signature too and D-signature-form refused it, which is the gate stating the same rule. Unresolved noun phrases rise from 2,350 to 2,357: seven are ref, from revoked by ref, where the noun reader’s phrase extraction stops at the preposition and the name’s first two words are left behind. The name resolves as declared; the reader does not read it whole. Gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 130 — task 25 measured and split, 2026-09-18. No corpus edit: the measurement the maintainer asked for before the English names move, on GLM’s resolved-cut axis. The rules of the 41 migrated specifications carry 3,435 snake_case words, 334 distinct, led by invocation_id 86, actor_ref 79, expires_at 73, principal_ref 70, event_id, sequence_number and record_action 64 each. Council read 100 counted 3,022 the same way, before this week’s units; the sweep is measured again when it runs. The staging question answers itself: the thirteen unmigrated specifications carry no labelled rules, so nothing in them is in scope until each migrates, and the sweep runs now. The cut is by what a word can be renamed to. 1,788 sites in 31 specifications name something the specification already gives an English name — a term entry whose Projection: line carries the code spelling — so the rule takes the entry’s own name and nothing is minted: Capability 121, Medication Order 105, Consent 104, Session 97, Message Preference 96, and 26 more. 1,614 sites in 21 specifications name something declared with no term entry, so the English name and the entry that carries the code spelling have to be written first, which is task 14: Audit Trail 593 with no term entry at all, Recoverable Invocation 462 with eight, Customer Onboarding 162, Defensible Retention 104, Actor Suspension 61, Authenticated Actor 57. 33 sites in fifteen specifications name something neither declared nor entried, which is declaration work of the kind council read 112 did. So three unit kinds, and the order is theirs: the 1,788 as four sweeps of five or six specifications each, mechanical and reviewable; the 1,614 as task 14 and the rename together, one specification per unit for Audit Trail and Recoverable Invocation and one for each cluster after; the 33 last. A gate for a snake_case word in a rule comes after the last of them, when it can hold. No census moved.
Council read 129 — GLM on council read 128, 2026-09-18. GLM reproduced both declarations, the fall to 2,350 and the fourteen store instance declarations, and read Term instance as closing the three-sense census of council read 102 — two senses in one definition, the third renamed away first — and Term section as the document sense winning the word, with the citation form named inside the definition and resolved by council read 126’s instrument. GLM’s note: composition is the first word refused for a new reason. It has the spread — 37 misses, the most common left — and the refusal is that eleven specifications declare it of themselves, Term composition: this pattern's wiring of …, which Earned vocabulary 13 would outlaw the moment the grammar took the word. A word every specification declares for itself is not a word the grammar can own; the rule-noun note carries the reason. With that, the shared-word backlog is empty: what the reader still counts is domain phrases — log 26, retention 25, action 23, state 23 — each belonging to the specification that writes it. What is left of the language sweep is task 25’s English names. No census moved.
Council read 128 — instance and section are rule nouns, 2026-09-18. The two words council read 107’s rulings held back, each waiting on a rename that has since landed. Instance: State Machine called its running record an instance until council read 108 made it a workflow, and every other specification meant one deployed copy of a pattern. Measured now, the word is written 253 times in the rules of 31 of the 41 migrated specifications — Audit Trail 38, Recoverable Invocation 33, Customer Onboarding 21, Undo History 16 — and no specification declares it bare; the nineteen declarations carrying the word qualify it, store instance in fourteen atoms, event log instance in Undo History, party retention instance in Customer Onboarding. Section: council read 111 renamed the host-supplied lock a critical section, which was the condition council read 107 set. The word is written 173 times in the rules of fourteen specifications, most of them the citation form council read 121 settled and council read 126’s resolver now reads. Both join the rule nouns as the maintainer’s ruling at council read 100 gives every everyday noun the specifications share (GRACE-lang v0.60): Term instance: one deployed copy of a pattern, or of a store a pattern is routed to and Term section: a titled part of a document, cited as the section titled X. Unresolved noun phrases fall from 2,501 to 2,350 — instance 52, section 17 and the 82 phrases they head. Composition, now the most common miss at 37, stays out: every composition declares it of itself, and Earned vocabulary 13 would forbid that the moment the grammar took the word. Gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 127 — GLM on council read 126, 2026-09-18. GLM reproduced Conformance 8 with the inheritance written into it, the 28 citations in nine compositions, the 248 label citations and the resolver’s four fixtures, and confirmed the repository healthy after the failed stash, with the orphaned lock inert. Two nits, both taken in the unit. The entry’s per-target enumeration summed to 251 against a total of 253: the citing page’s own share is 28, not 26 — Recoverable Invocation 19, Shared Todo three, Audit Trail, Session-Gated Authorization and Undo History two each — and the entry now carries every target. And execution-contract.md, now a labelled and citable document, still wrote the section sign itself: 17 citations in it, of its own sections and of spec-format.md, pressure-testing.md and roadmap.md, now read the section titled X, so the sign is gone from the contract as it is from the specifications. One of them, of spec-format.md’s Composition state, named a bold-bullet heading indented in a list, which the resolver’s title reader now reads wherever it sits. No census moved.
Council read 126 — a section citation resolves, 2026-09-18. The second unit of council read 123’s ruling, in both halves GLM’s read named. First the promotion. Of the 281 section citations the migrated specifications carried, 28 in nine compositions meant one claim rather than a section: the composition MUST inherit a constituent’s invariants PER the section titled Conformance and the prose and cited lines that lean on it all mean the contract’s composition-conformance sentence, which sat unlabelled after its seven numbered conditions. It is now Conformance 8, with the inheritance it settles written into it, and the 28 citations read Execution Contract Conformance 8 — so the one-home pattern’s first application, the seam obligation, addresses the contract the way its second does. The contract’s own these seven conditions now reads Conformance 1 through 7. Citations naming the contract by label stand at 248: Logic confinement 7 at 130, Logic confinement 3 at 90, Conformance 8 at 28. Then the resolver. lint.py gains X-section-title: a citation of a section — or of a docket row — names a heading the file it names carries, or a heading of its own page where it names no file, matching a heading whole or by the words a writer took from the start of a long one. It reads 253 citations and resolves every one; four fixtures join, and a dangling title fires. By target: execution-contract.md 193, pressure-testing.md 25, the citing page itself 28 (Recoverable Invocation 19, Shared Todo three, Audit Trail, Session-Gated Authorization and Undo History two each), open-questions.md three, spec-format.md three, a demo’s corner notes one — 253. The check reads the specifications and not the corpus’s other documents, where this register and the grammar discuss the form itself and would read as citations of it. Gate advisories are identical line for line, and unresolved noun phrases fall from 2,510 to 2,501, the nine the promoted rules’ section wording carried. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 125 — GLM on council read 124, 2026-09-17. GLM reproduced the labels and the 220 citations, 130 naming Logic confinement 7 and 90 Logic confinement 3, its 91st being the contract’s own example line rather than a specification’s, and read the per-tombstone archaeology as the method the stratigraphy principle had only described: Duplicate Prevention’s Operation 8 kept its local owner while Operation 9 and Operation 10 moved to the contract’s label. GLM’s note is the next unit’s second half. The Conformance labels carry no citation yet, because the seam family — the first application of the one-home pattern — still cites the section titled Conformance, while the clock family, the second, cites a rule. Of the 221 whole-section citations into the contract, 148 name the Logic Confinement Principle, 28 Conformance, 28 Composition state, 13 Substrate composition invocation, three Step 1 failure and one Multi-write atomicity. The resolver unit takes both halves: every cited title must name a real heading, and a citation that means one numbered condition takes its label, by the same reading of what each site meant. No census moved.
Council read 124 — the contract’s rules carry labels, 2026-09-17. The first of the two units council read 123’s ruling set. execution-contract.md’s Logic Confinement Principle numbered its seven rules in bold prose, and its Conformance section listed seven conditions; both now carry labels, **Logic confinement 3: Explicit inputs only.** and **Conformance 2:**, and the contract says a specification cites one with the contract’s name first, as Hard invariant 28 asks of any cross-specification citation. The contract’s own references follow: as Logic confinement 3 says, and the Beacon status paragraph’s rules 1, 2, 3, and 6. The citations that meant one rule now name it. 210 tombstones pointed at the whole section; the history of each says which rule it meant. 120 deleted a clock guarantee — the 60 of council read 122, the 54 older Clock semantics tombstones those replaced, four honest now rules and two trustworthy clock reading rules, six of these the seam-and-honesty pairs — and now read Execution Contract Logic confinement 7 owns it. 90 deleted a restatement of the injected reading — The transition MUST NOT read the clock (28), The business caller MUST NOT supply now (19), and sixteen other spellings the injection deletion of 2026-09-15 retired — and now name Logic confinement 3. Ten citations council read 122 wrote in rules and prose, Notification’s Check 2.3 among them, name Logic confinement 7. Nothing resolved a citation of the contract, so lint.py gains X-contract-label: an atom or composition citing Execution Contract with a family and a number must name a label the contract carries. It passes on all 220; three fixtures join. The contract’s other numbered lists — the derived-index conditions, the wiring layer’s duties, the substrate rules — are cited by number nowhere and stay lists. The section citations that remain mean a whole section — the seam, now and the transition as the section titled Logic Confinement Principle declares it, and the recursive conformance of the section titled Conformance: 277, 221 into the contract. The second unit gives them a resolver. The grammar’s addressable-sections watch line carries both counts. Gate advisories are identical line for line, and unresolved noun phrases hold at 2,510. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 123 — GLM on council read 122, 2026-09-17. GLM reproduced the consolidation — rule 7 and its five definitions, the pattern paragraph, 114 new contract citations in the diff (the 60 tombstones and the 54 redirected older ones), 7,809 rules and 2,510 unresolved — and closed its 61 with a reason: Message Preference’s Temporal property 5 gives the guarantee to the implementation, a different claim from the deployment’s, and its census matched the predicate where the unit matched the subject. GLM asked that the strengthening be stated as one: rule 7 moves from each specification names what it relies on to the deployment owns all five for every specification it runs. It is safe because the specification’s own rules still say which guarantee they consume, and it is recorded here as a strengthening. GLM’s finding is the addressing the consolidation leans on. The contract’s rules are bold-numbered prose, not labels, so every specification cites them by section title, which no instrument resolves. Measured after this unit, the migrated specifications carry 497 section citations: 441 into execution-contract.md, 25 into pressure-testing.md, 24 on their own page, three each into open-questions.md and spec-format.md, one into a demo; 23 of them sit in labelled rules, 16 of those into the contract. The addressable-sections watch has its specimen at scale. Whether the contract’s rules take labels, or section citations take a resolver, or both, was put to the maintainer, who ruled both: the contract’s numbered rules take labels, and a specification pointing at one rule cites the label, as the seam and clock tombstones mean to; a citation meaning a whole section keeps the section titled X, and an instrument confirms each cited title exists in the file it names. Two units, the labels first. No census moved.
Council read 122 — the clock’s guarantees have one home, 2026-09-17. The maintainer’s ruling at council read 119, in the order council read 120 set. The census came first. The 60 capability requirements are one sentence in five senses — The deployment MUST own the clock’s monotonicity (23), honesty (15), timezone handling (10), synchronization (7) or skew (5) — with no local value in any of them: no allowance, no pinned zone, no cadence, no bound. What varies is only which senses a specification names, seven different sets across the 25; seven specifications name monotonicity, honesty and synchronization, five monotonicity and timezone handling, five skew and monotonicity. Message Preference’s Temporal property 5, the sixty-first GLM counted, gives the monotonicity to the implementation, not the deployment, and stays where it is. So one sentence covers all five senses for every specification. execution-contract.md’s Logic Confinement Principle gains rule 7, the clock’s guarantees are the deployment’s, naming the five, and a paragraph stating the pattern the maintainer ruled: an obligation the deployment owes every specification is written once in the contract and cited, rule 3’s single reading the first such and rule 7 the second. The 60 rules are tombstones, each Deleted: Capability requirement N. The section titled Logic Confinement Principle in execution-contract.md owns it., as the seam obligation’s were. A specification that named two senses now cites a rule naming five, which disclaims more on the specification’s behalf and asks nothing new of a deployment, since the clock was the deployment’s already. 71 citations of the tombstoned labels were redirected, so none points at a tombstone: 54 older tombstones, Deleted: Clock semantics 1. Capability requirement 2 owns it., now name the contract; six that named the seam requirement and the honesty requirement together keep the first and name the contract for the second; and eleven in rules and prose — Notification’s Check 2.3 among them — cite the contract. Personal Todo’s External check 1 would have named a section rather than a rule, which K-check-bare flags, and now names the invariants the monotonicity carries, Invariant 7.1 through 7.3. Labelled rules fall from 7,869 to 7,809 and noun phrases from 20,792 to 20,672; unresolved phrases hold at 2,510. Gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 121 — the section sign leaves the specifications, 2026-09-17. The first of the order council read 120 set. Council read 103 took the section sign out of rules and left it everywhere else: 424 lines in forty migrated specifications, 144 of them declarations. The grammar already names the form a section takes, the section titled X, with in file when the section is another document’s. 348 citations of a corpus section now take it. 296 cite execution-contract.md — 236 of them as §Logic confinement, a shorthand for the section actually titled Logic Confinement Principle, which the rewrite spells out, and the rest Conformance, Composition state, Substrate composition invocation, Step 1 failure and Multi-write atomicity. 25 cite a section of pressure-testing.md, 22 of them a principle named in italics without the file, which the rewrite now names; 20 cite a section of the specification’s own page (Recoverable Invocation 11, Shared Todo 3, Audit Trail 2, Session-Gated Authorization 2, Undo History 2); three cite spec-format.md, one open-questions.md and one a demo’s corner notes; and two cite a docket row of open-questions.md, now the row titled X. Where a citation named only the start of a long heading, the rewrite keeps the words the writer chose; where a heading carries a subtitle after an em dash, the title is the part before it. One citation, Approval Step’s the qualified form §11 declares, pointed at a numbered section of the grammar and now names the rule, Hard invariant 28. Sentence-initial citations are capitalized, as in the tombstones’ The section titled Logic Confinement Principle in execution-contract.md owns it. Left: 157 section signs in 102 lines, every one a regulation’s or a standard’s own numbering — SOX §404, 45 CFR §164.312(b), ISO 9001 §8.5.1 — quoted as the source writes it, one of them in a declaration; and one in Recoverable Invocation’s formal: provenance line, which records what a model gate produced and is not rewritten. The grammar and the corpus’s own documents still carry the sign — this document 51, pressure-testing.md 67, spec-format.md 20, GRACE-lang 18, open-questions.md 17, execution-contract.md 14 — and so do the unmigrated specifications; they are not specifications under the migrated form, and this unit leaves them. No instrument gates the sign outside a rule. Gate advisories are identical line for line, and unresolved noun phrases hold at 2,510. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 120 — GLM on council read 119, 2026-09-17. GLM reproduced the unit — the eighth rule noun, 2,510 unresolved, Notification’s hyphenated survivor — and counted the clock family at 61 in 25 specifications where the entry says 60. Both hold: 60 are capability requirements reading The deployment MUST own the clock’s …, and the sixty-first is Message Preference’s Temporal property 5, where the implementation owns the monotonicity another rule rests on. GLM asked where the baseline moved from 2,607 to 2,612; council read 118 moved it, when the reader stopped resolving five phrases through a rule noun’s stem, and the Act is a rule noun commit carries both reads. GLM’s riders on the maintainer’s consolidation ruling are taken. The section-sign sweep runs first, because the consolidated clock rules will cite execution-contract.md by section and should cite it in the settled form. The clock unit then opens with a census of how the 61 vary — which senses read identically, which carry a local value — before anything moves. And it writes the pattern into the contract as it moves the second instance: the seam obligation was the first deployment obligation restated across specifications and consolidated there, the clock family is the second, and the maintainer’s ruling makes the pattern the rule. No census moved.
Council read 119 — clock is a rule noun, 2026-09-17. The clock family was the noun reader’s largest remaining group: 102 unresolved phrases headed by clock — clock monotonicity 25, clock 27, clock honesty 16, clock timezone handling 10, clock synchronization 7, clock skew 6 and eleven smaller. The word itself is written 122 times in the rules of 35 of the 41 migrated specifications and declared in none; the grammar’s own Term instant already says the clock a specification reads. That is the spread of the six rule nouns of v0.53, which the maintainer’s ruling at council read 100 gives to the grammar, so no new ruling was needed: Term clock: a source of instants — the deployment's, read at a specification's seam, or one an auditor supplies joins the rule nouns (GRACE-lang v0.59). Every one of the 102 now resolves but Notification’s reconstruction wall-clock truth, where the hyphen hides the word: unresolved noun phrases fall from 2,612 to 2,510. Fifteen of the 27 bare clock misses were a tagger reading of five specifications’ declared clock offset allowance, split where offset reads as a verb; the declared name was never missing there. GLM’s counsel held that monotonicity and honesty are guarantees, not nouns, and belong beside the seam obligation in execution-contract.md, declared once and cited. Measured, the guarantees are one repeated family: 60 capability requirements in 25 specifications, each The deployment MUST own the clock’s followed by monotonicity (23), honesty (15), timezone handling (10), synchronization (7) or skew (5), and execution-contract.md states none of them — its rule 3 injects the clock and says nothing of what the clock guarantees. Moving them would tombstone sixty rules and write a new contract obligation, which is the maintainer’s to rule; this unit leaves them in place, now resolving through clock. The maintainer ruled on reading: move them, as the next unit, and consolidate every family of the kind the same way — an obligation restated across specifications is written once where it belongs and cited from the rest. A place for everything. Gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 118 — GLM on council read 117, 2026-09-17. GLM reproduced the unit — the seventh rule noun and Term act, check.py reading the new noun from the grammar with no change, no spec-side Term act left by the withdrawn draft, the two rewrites, and the fall to 2,607 — and conceded its own read-102 filing of act as a borrowed word: 126 uses in eleven specifications, none citing another’s, is shared vocabulary of the blank kind. GLM’s first note: the withdrawn draft is the first recorded near-miss against Closed vocabulary 17, which nothing gates, and the term-registry-drift row in open-questions.md now carries it as the specimen its future instrument will start from. GLM’s second note predicted that the reader’s stemming would breed false resolutions against a generic rule noun, as Party Identity’s representative acting had resolved through act. It is fixed rather than waited for: nouns.py matches a rule noun by its own spelling or its plural only, never by stripping -ed or -ing, and two fixtures join (nine in all). The fix exposed four more sites, all resolved through answer: Duplicate Prevention’s answering at one and Legal Hold’s answered store_name at three. Unresolved noun phrases rise from 2,607 to 2,612, the five false resolutions now counted as what they are. GLM’s counsel for the clock family, next: clock is shared like act, while monotonicity and honesty are the two guarantees of the Clock semantics family and belong beside the seam obligation they travel with, declared once and cited. The unit measures that before it rules. No census moved.
Council read 117 — act is a rule noun, 2026-09-17. The noun reader’s next most common miss was act: unresolved at 52 rule sites in six specifications, and written 126 times in the rules of eleven — Recoverable Invocation 54, Audit Trail 27, Attributed Permissions Admin 16, Defensible Retention 13, Idempotent Reservation 5, Consent 4, Actor Suspension 3, and one each in Capability, Authenticated Actor, Customer Onboarding and Login. GLM expected citation to cure the sites outside Recoverable Invocation. Measured, none cites it: every specification means its own thing done — Recoverable Invocation’s call of the bound act, Audit Trail’s record action or cascade, Actor Suspension’s suspension or reinstatement, Defensible Retention’s placement, release or purge, Idempotent Reservation’s state change under one token, Consent’s processing act. The first draft declared Term act in five specifications, and the declarations collided: Actor Suspension, Customer Onboarding, Defensible Retention and Recoverable Invocation all compose Audit Trail, so each would have redeclared a constituent’s term with another meaning, which Closed vocabulary 17 forbids and no instrument caught. The draft was withdrawn before review. The maintainer ruled act the grammar’s, over renaming Audit Trail’s sense and over leaving it undeclared: Term act: something an actor or a pattern does that its records account for — a commit, a suspension, a purge; the specification's own declarations say which, a seventh rule noun beside the six of v0.53 (GRACE-lang v0.58). Each specification’s own names — act_key and the bound act, the per-act critical section, the cascade — still say which act. Two rewrites rode along: Attributed Permissions Admin’s four rules citing the act’s landed attestation now name the declared administrative act, and Recoverable Invocation’s constituent note says the act’s critical section, not council read 111’s the act critical section. Unresolved noun phrases fall from 2,674 to 2,607, 67 across nine specifications — act itself and the phrases it heads, committed act, compensating act, processing act. One is a false resolution: Party Identity’s representative acting now resolves because the reader strips -ing and finds act. Gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 116 — GLM on council read 115, 2026-09-17. GLM reproduced the unit: the 25 obligations and the 17 checks it rewrote (22 checks read non-blank on every surface, five of them older), no rule line left carrying non-whitespace in the migrated specifications, Audit Trail’s malformed reference, and both noun-reader counts, and read the rewrite as an identity carried by Term blank’s own definition rather than a paraphrase. GLM placed the gating of is blank in the unread units; it landed with v0.52 itself (council read 99, commit 2565680), which GLM read, together with the nineteen sites GLM’s review of that unit found. The maintainer’s answer to the unread units stands as council read 114 recorded it. GLM’s note is stand: a declared record verb carrying several shapes in rules — a state a write leaves, a property, a span, an instant. Counted by the word that follows, it is 390 uses in the forty-one migrated specifications, and the count joins the multitasking row in open-questions.md as a candidate, not a census by sense. For act, next, GLM expects citation to cure the sites outside Recoverable Invocation unless they mean their own acts; the unit measures that before it chooses. No census moved.
Council read 115 — non-blank, 2026-09-17. The noun reader’s third most common miss, after critical section and instance, was non-whitespace character: 42 rule sites in eleven migrated specifications, all saying one thing — a field holds something. The grammar already declares the thing’s opposite: Term blank is a value that is absent, empty or carries only whitespace (Earned vocabulary 7), so a field carrying a non-whitespace character is a field that is not blank. Credential already says so in four rules and checks, a non-blank revoked_by_ref, and three rules already state a value’s standing property as MUST stand immutable. One meaning takes one spelling, and it is the one built on the grammar’s own name. The 25 obligations that read … MUST carry a non-whitespace character or MUST contain one now read … MUST stand non-blank, their subjects unchanged, Audit Trail’s two primitive policies among them; the 17 checks that read An auditor MUST find a non-whitespace character in X now read An auditor MUST find X non-blank. The same meaning in prose took the same word: six term-entry refusals and descriptions and one Audit Trail paragraph now say blank or must not be blank, eight descriptions say non-blank where they said non-whitespace, Legal Hold’s worked example says strings, neither blank, Message Preference’s degenerate declaration says a blank channel name, and Audit Trail’s malformed reference declaration, which spelled blank out as empty, all whitespace, reads EQUALS blank OR whose length EXCEEDS reference_length_cap. Left: Capacity Constraint Enforcement’s String 1, a codepoint outside the whitespace category, which also counts Unicode’s category and is a different claim; the whitespace-only phrasings of the String families, which define how blank is read; and 48 uses of non-whitespace in ten unmigrated compositions, until their migration. Unresolved noun phrases fall from 2,716 to 2,674 and noun phrases from 20,834 to 20,792, the 42 phrases gone rather than resolved. Gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 114 — Customer Onboarding’s active flag, 2026-09-17. The maintainer answered council read 113’s open question by continuing: the seven units GLM has not read stand on the register, with no back-read. This unit takes a piece council read 102 left: Customer Onboarding tested a case’s state as the case stands inactive and whose case stands active, and declared no state set for a case. The composition already stores the answer — the party-to-case index carries an active flag, which Composition state 13 calls false and Action wiring 130 clears — and declared that flag nowhere. It is now Term active flag: true | false, true from the case’s initiated record and false once a landed party closed record names the case, and Term active case is a case whose active flag EQUALS true, the phrase fourteen rules and checks already use. Seven rules and declarations changed. The three conditions, Action wiring 23, 39 and 114, read IF the case's active flag EQUALS false, as council read 102 tests a record’s state as a value; the three admitted-call declarations read whose case’s active flag EQUALS true. The two writes, Composition state 25’s rebuild and Action wiring 130’s closure, write the flag in the form Earned vocabulary 11 requires, the case’s active flag set to true and set to false, where they had read stand a case active and clear the case’s active flag. Left as they are: Composition state 13’s a false active flag, a subject phrase that now resolves through the declared name; the index’s review-due and overdue flags, which no condition tests; and Actor Suspension’s Invariant 1.6, a stopped cascade’s actor MUST NOT stand active, a state claim of another kind. Unresolved noun phrases fall from 2,717 to 2,716; gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 113 — GLM on council read 112, 2026-09-17. GLM reproduced every count under the pinned tagger — unresolved 2,717 of 20,834 noun phrases, the eight, ten, five, eight and three added Term lines of the five specifications (the 28 declarations, plus each specification’s edited terms line, and Recoverable Invocation’s edited cited line — no specification gained a new Term cited: line), seven reader fixtures, the Concurrency 4 rewrite, and the section-sign census to the digit, 424 lines and 144 in declarations — and read the remeasurement as the taxonomy correction it is: most of the class council read 100 called borrowed was each specification’s own fields. GLM counted the section-sign lines in 41 specifications where the entry said 40; forty-one is the migrated count, and forty of them carry the sign, so the entry stands. GLM’s finding was that Term cited: is live in eighteen specifications, read by nouns.py, and has no home in the grammar. The category has one — Term category has listed cited since v0.40, Closed vocabulary 15 lets a declaration cite its owner, and Closed vocabulary 16 resolves a cited declaration against the owner’s registry — so a cited name may stand bare in a rule, and Hard invariant 28, which qualifies cross-specification labels, does not reach it. What the grammar lacks is the line’s shape, and the corpus writes two: runs of names each closed by the owner (four specifications) and a cited document with what it supplies (sixteen, two writing both). The shape joins the watch list at eighteen; it is not the term entry grammar, which counts a term entry’s fields. GLM also named seven units that landed with no GLM read — v0.53, v0.55, v0.57, and the four task-26 renames of council read 108 through 111 — and spot-checked the largest: State Machine’s Term workflow in English with instance_id kept on the Projection: line. Whether those seven get a back-read or stand on the register is the maintainer’s call. No census moved.
Council read 112 — the names rules use and nothing declared, 2026-09-17. Task 26’s next piece: council read 100 counted 309 sites of 82 names borrowed from another specification and never declared. Measured again at the start of this unit, the noun reader found 228 sites where a noun phrase carrying a snake_case name resolved to nothing, and they were not one class. 84 are names the specification or a constituent does declare, as a term entry whose Projection: line carries the code spelling the rule uses — Party Identity’s verification_id, Approval Step’s decision_reason — and 8 are plurals of such names, Medication Order’s and Observation’s two successor_ids and two predecessor_ids. The English names of task 25 resolve all 92, so this unit leaves them. 16 were the reader’s own misses, and the tool is fixed. A cited list writes its owner after each run of names (take, expires_at: Lease. record_action, …: Audit Trail.), and nouns.py took the first name after each owner and the last before it as one piece, so Recoverable Invocation’s record_action (7) and Audit Trail’s place_under_retention (2) read as undeclared. It also never read a value set’s own name from the value sets line, so Customer Onboarding’s enrollment_path (3) and Recoverable Invocation’s landed_by (4) read as undeclared, though each is declared there. Three fixtures join the reader’s four. The other 120 were names nothing declared, and most were not borrowed at all. Actor Suspension and Defensible Retention use invocation_id for their own seam-injected id, not Recoverable Invocation’s, and neither composes it; the stamps and event ids an intent or an outcome carries were each specification’s own fields, named in rules and declared nowhere. 28 declarations now carry them: Actor Suspension 7 (invocation_id, resume_invocation_id, intended_at, intent_event_id, suspension_event_id, suspended_at, reinstated_at), Customer Onboarding 9 (intended_at, intent_event_id and the seven outcome stamps, closed_at among them), Defensible Retention 4 (invocation_id, intended_at, intent_abandoned, attributed_to), Recoverable Invocation 6 (first_seen and last_seen, which only the record shapes of its two finding declarations named, acting_actor_ref, resolved_by, recovery_intended, store_candidates) and Shared Todo 2 (task_id, actor_ref). Each names its owner rule rather than restating it, and each joins its specification’s terms list. Borrowed names were few, and they are now cited: Recoverable Invocation cites event_id, action_ref and policy_ref beside Audit Trail’s other names, and Provisional Commitment cites Event Log’s sequence_number, which a non-goal reads from Event Log as a composing pattern. Undo History composes Personal Todo and Event Log but had no Term constituents line, so the reader never reached Event Log’s event_id, recorded_at and sequence_number; the line is added. Audit Trail’s Concurrency 4 spoke of a per-evidence_id serialization, a hyphenated token that hid a cited name, and now reads a serialization keyed by evidence_id. With the names declared, 16 code spans that quoted them became bare, as Surface 30 requires, and one new declaration’s range citation takes the short form Hard invariant 31 requires. Unresolved noun phrases fall from 2,881 to 2,717: the tool fixes account for 45, the declarations for 119. The noun phrase count is 20,834, one more, from the Audit Trail rewrite. Noted, not taken: 424 lines in forty migrated specifications still cite a section with §, 144 of them in declarations such as Term seam; the symbols unit (council read 103) removed it from rules only, and a sweep of the rest is its own unit. Gate advisories are identical line for line. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 111 — critical section, 2026-09-17. The last of the maintainer’s four task-26 rulings recorded at council read 107 said section waits to become a rule noun until Recoverable Invocation’s lease-held critical section takes another name. Measured before renaming, the lock sense was not Recoverable Invocation’s alone: eleven migrated specifications used section for a host-supplied mutual exclusion, and three of them — Actor Suspension, Authenticated Actor and Idempotent Reservation — declared Term section in that sense. So the name was a corpus-wide ruling, and the maintainer chose critical section, the textbook name the three declarations already used in their definitions, over mutual exclusion, lock (which the grammar’s lock list already uses) and lease (wrong for Audit Trail’s death-detected kind). Bare section now means only a titled part of a document; critical section, as a whole phrase, means the lock, as tail position left bare tail to the grammar (council read 110). Critical section now appears 352 times in the eleven specifications, up from 15: Recoverable Invocation 101, Audit Trail 83, Actor Suspension 43, Authenticated Actor 39, Idempotent Reservation 31, Observation 13, Attributed Permissions Admin 11, Medication Order 11, Credential 9, Lease 8, Provisional Commitment 3. The three declarations are Term critical section, and Observation’s is Term per-observation critical section; where a definition had read the host-supplied critical section … — a section, it now reads the host-supplied mutual exclusion, so the name is not defined by itself. Recoverable Invocation’s section key, section holder and section duration, Audit Trail’s held section and Per-act section label family (17 rules, three citations) and the term entry Section Unavailable, with its marker and anchor, all carry the new name; four mid-section and under-section compounds became phrases. Left as they were: code spellings — act_section, section_kind, per_actor_serialization, the answer token section-unavailable at nine sites and the Projection: line section_unavailable — until task 25; the formal: provenance lines of five specifications, which record what a model gate produced and which lint.py’s R-provenance-drift refused when the sweep first rewrote them; the unmigrated specifications; and the comments of the TLA+ models, which say section host in 36 files. Across the migrated specifications 87 uses of section remain outside those, every one the document sense — the section titled, addressable sections, the acceptance section — Recoverable Invocation’s 19 the most. The noun reader’s unresolved count rises from 2,874 to 2,881, and the seven are two corrections and a tagger reading. Five are corrections: Actor Suspension (two), Authenticated Actor, Idempotent Reservation and Attributed Permissions Admin each had a rule citing the section titled Conformance that resolved to the spec’s own lock declaration — a false resolution — and now shows as unresolved, because the document sense has no declaration yet. Two are Audit Trail’s Per-act critical section 7 and 8, where the tagger reads held in no held critical section as a verb and leaves critical section unresolved. Among the unresolved, critical section is now the most common phrase, 65 (where section was 84), and bare section is 26. Gate advisories are identical line for line but for one advisory whose label moved with the family. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 110 — Audit Trail’s tail position, 2026-09-17. The third of the maintainer’s four task-26 rulings recorded at council read 107. Audit Trail declared Term tail: the highest sequence_number the open-upper-bound read beginning at sealed_through + 1 returns, while the grammar declares tail as the ONLY AFTER, ONLY IF, WITHIN, PER or BEFORE ending a statement. The word appeared 43 times in the composition: 19 inside unsealed tail, a separate declaration meaning the events past sealed_through, and 24 bare, in four senses. The declared position is now tail position at 6 places — the declaration, seal_now 1, seal_now 5, the slice declaration, the terms list and the [Seal Now] entry — and seal_now 3’s the tail read is the open-upper-bound read, the read’s declared name. 14 bare uses meant the unsealed tail, not a position — the new tail, a tail that stops draining, every tail purge, Unsealed tail 1’s tail depth, the empty-tail condition and the rest — and now say unsealed tail, so the bare word means nothing in the composition. The standing false negative declaration’s a strict tail meant the strict setting of unsealed_tail_mode and now names it; the worked example’s two chain tail uses meant the hash chain’s newest link and now say so. After the unit, tail appears only inside unsealed tail (33) and tail position (6). No term entry, anchor or Projection: line carried the word, and nothing outside the composition cited it. The grammar’s rule-noun note records the rename. Gate advisories are identical line for line. The noun reader counts 20,833 noun phrases, one more, because the tail read became the open-upper-bound read; unresolved phrases hold at 2,874. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 109 — Party Identity’s assigned id, 2026-09-17. The second of the maintainer’s four task-26 rulings recorded at council read 107. Party Identity declared Term identifier: party_id, verification_id OR state_change_id — every opaque name this atom assigns, while the grammar declares identifier as any subject, object, term name or value a rule uses (Closed vocabulary 4), so the noun reader resolved the atom’s word to the grammar’s meaning without complaint. The atom’s sense is now assigned id, at all 12 uses in the atom: the declaration, the three Identity rules, the reference and store instance declarations, the actors and terms lists, one prose paragraph, the two tombstone notes and the dated Decisions entry, which the State Machine rename also renamed (council read 108). Identity 4 read assign an identifier and would have read assign an assigned id; it now reads The atom MUST take an assigned id from the id material the seam supplies. — take is one of the atom’s declared record verbs, and the rule still says where the id comes from. No term entry, anchor or Projection: line carried the word, and no other migrated specification declares identifier. Forty uses of the word remain in seventeen other migrated specifications — Capacity Constraint Enforcement’s audit-identifier surface seven of them — and stay, because the ruling named Party Identity alone. The grammar’s rule-noun note records the rename. Gate advisories are identical line for line, and unresolved noun phrases hold at 2,874 — the old word resolved too, to the wrong declaration, which is why no count moved. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 108 — State Machine’s workflow, 2026-09-17. The first of the maintainer’s four task-26 rulings recorded at council read 107. State Machine called the record it holds an instance, one running workflow, while every other specification means by instance one deployed copy of a pattern — a Lease instance, a store instance, a log instance. State Machine’s record is now a workflow: 161 of the 171 uses of instance or instances in the atom became workflow or workflows — the declaration (Term workflow: one running workflow — one declaration, one current state and one transition history), the records and terms lists, every rule, the term entries’ Field of lines, the prose and the heading Multi-workflow independence. The term entries Instance Id and Instance Metadata are now Workflow Id and Workflow Metadata, their anchors and markers with them; their Projection: lines keep instance_id and instance_metadata, and so do the rules and declarations, because the code spelling changes only with task 25 — the English name and the code spelling are allowed to differ, which is what the projection line is for. Ten uses stay: store instance at seven sites, the deployment sense that routes a call; an instance of, the English phrase, beside the FHIR Task lifecycle; and the two in the Also known as line, which lists the names other people use. The grammar’s standard label family line said Identity is what identifies an instance and now says a record, and its rule-noun note records the rename. Measured after the rename, instance in the migrated specs’ rules and declarations reads as a deployment at 290 of 381 sites by a context pattern, and the other 91 are the same sense in other words — over one instance, a log instance — so the word is ready to be measured for its one declaration. The compensable-workflow and execute-gated-workflow compositions, both unmigrated, already say workflow instance and keep it until their migration. Gate advisories are identical line for line, and unresolved noun phrases hold at 2,874. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged.
Council read 107 — one declaration form in the two pilots, 2026-09-17. The first piece of task 26. Audit Trail and Recoverable Invocation, migrated before the declaration form was strict, still declared their settings and composition stores as bold bullets — - **event_to_attestation** — map from … — a second declaration form that check.py never read as one: its names reached the noun reader only through a special case, and a backticked name in the bullet reached nothing. 56 bullets, 25 in Audit Trail and 31 in Recoverable Invocation (16 of the 56 with the name in backticks), now keep - **name** as the heading their rule families sit under and declare beneath it with Term name: definition. — 54 new declarations. Three did not become one: Audit Trail’s sealed_through was already declared under its own bullet, Recoverable Invocation’s first act_section bullet is a pointer to the one under Capability requirement and now reads as a sentence, and Recoverable Invocation’s two declarations of act_key — a type line among the seam-injected terms and a meaning under Bindings — are one, under Bindings. Two definitions that ended in an italic Derived index. end in a period. With the names declared, 24 code spans that quoted them became bare names, as Surface 30 requires. check.py’s D-decl-form now gates the bold-bullet declaration in a migrated spec, three fixtures joining, and nouns.py drops its special case. Unresolved noun phrases fall from 2,977 to 2,874 (Recoverable Invocation 598 → 517, Audit Trail 384 → 363), under the same tagger. The thirteen unmigrated specs keep the bullets until their migration. The new declarations keep their snake_case names on purpose: this unit changes the form only, and the English names of council read 100 arrive with task 25. GLM’s review reproduced every count, under nltk 3.9.2 where this unit ran 3.10.3 — the same tagger weights, 789e8e35f6fa, and the same numbers, so the weights digest is the part of the pin that matters — and owned its own earlier count of 40 bullets, which missed the sixteen with backticked names. It also found that the maintainer’s four rulings for the rest of task 26 were written nowhere but chat. They are these: State Machine’s instance becomes workflow, so that instance means one deployed copy of a pattern everywhere and can later be declared once, while instance_id stays the code spelling until task 25; Party Identity’s identifier becomes assigned id, and Audit Trail’s tail becomes tail position, ending two collisions with names the grammar declares; and section does not become a rule noun yet, because Recoverable Invocation’s lease-held critical section still shares the word with a titled part of a document, and that sense takes another name first. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged, advisories identical line for line.
Council read 106 — GLM on the noun reader, 2026-09-17. GLM reproduced every count of council read 105 to the digit on a cold run, after installing the model the tool names, and ran the four fixtures once its tagger was present. Three findings, taken here. The count depends on the tagger, and the tagger is retrained across nltk releases: nouns.py now prints the environment it read under on every run — nltk 3.10.3, averaged_perceptron_tagger_eng weights whose SHA-256 begins 789e8e35f6fa — and the README quotes the count beside it. This is the fourth time a travelling count has needed its pattern stated beside it (EXISTS, snake_case, EXCEEDS), and the first time the pattern included a dependency. The modifier class — a declared noun under an undeclared modifier — is 4,211 of 20,841 noun phrases, a fifth, up from about 18% at council read 100, and the grammar’s watch list now carries it. The ranked unresolved list is task 26’s intake: section 84, instance 52, the clock family (clock 27, clock monotonicity 25, clock honesty 16, allowance 18), non-whitespace character 42. GLM also traced the census from 485 to 482 to council read 104 and noted that the chat handoff for the noun reader printed 482 without naming the unit that moved it; a moved census names its unit. And three units landed without its review — council read 100 (the rule nouns, 91 rules), council read 102 (state tests, 178 lines) and council read 104 (EXCEEDS) — each recorded here, none read by it. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — unchanged since council read 104.
Council read 105 — a reader for the nouns, 2026-09-17. The second step of task 24, after the rule nouns of council read 100. Closed vocabulary 8 has C-verb; Closed vocabulary 4 — every normative identifier resolves to a declaration — had nothing, and council read 100 measured why that mattered with a script kept in scratch. tools/grace/nouns.py keeps it: it tags the labelled rules of the migrated specs with NLTK’s averaged-perceptron tagger, removes what is not a noun of the rule (code spans, markers, label citations, reserved tokens, spec names and the composing before one), and matches each noun phrase against the spec’s declared names — Term lines, category lists and their aliases, signature names, value-set members, and the bold-bullet settings Audit Trail and Recoverable Invocation still carry — its constituents’ and the grammar’s. Today it reads 20,841 noun phrases in 7,869 rules: 13,653 resolve whole, 4,211 only through a declared name inside, 2,977 to nothing — Recoverable Invocation 598, Audit Trail 384, Customer Onboarding 185, Actor Suspension 148, Attributed Permissions Admin 108, then fewer than a hundred each; most common section 84, instance 52, act 52, non-whitespace character 42, composition 37, state 30, invocation_id 25, clock monotonicity 25. The count moved from council read 100’s 3,665 through the rule nouns, the state and symbol sweeps, and two corrections to the reader: a gerund modifier now joins its noun (composing pattern), and the composing Audit Trail reads as a spec name. The tool is advisory by design — a tagger decides what a noun is, so the count is good to a few percent — and never gates; its dependency is optional, and test_checks.py runs its four fixtures only where the model is installed. What the count asks for is task 26: instance and the two grammar collisions, declarations for the borrowed names, and the bold-bullet declarations as Term lines. Section (84) is a candidate rule noun now that council read 103 writes the section titled X. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3.
Council read 104 — EXCEEDS gets its English negative, 2026-09-17. Task 28, from GLM’s EXCEEDS census and the reading of it recorded in chat. Measured as every EXCEEDS or EXCEED token in the labelled rules and Term declarations of the migrated specs, code spans removed, the operands read to the nearest condition keyword: 138 tokens in 33 specs — 45 after a modal (MUST NOT EXCEED, Timing 9’s ≥), 34 comparing instants, 20 comparing lengths, about 31 comparing quantities, 4 negated as NOT EXCEEDS, and 4 more split between the last two. GLM counted 96 in 29 files by another pattern; the jobs agree in shape. GLM read the numeric ≥ as having no one-arm cure. It has one in English: y DOES NOT EXCEED x is x ≥ y, as DOES NOT EQUAL is the negative of EQUALS. The four NOT EXCEEDS sites (Capability’s ttl, Medication Order’s dose, Credential’s expires_at, Session’s session_duration) and the three two-arm disjunctions (Audit Trail’s Invariant 3.1, Recoverable Invocation’s reconcile step 5.1 and its aged term) take it, and Retention Window’s two English comparisons — the duration is not positive, the max_purge_delay is negative, the census’s lone W-condition-operator and one no instrument read — read DOES NOT EXCEED the zero duration and the zero duration EXCEEDS the max_purge_delay, with zero duration declared there as Capability and Session already declare it. GLM’s second reading was that instants should leave EXCEEDS. The maintainer ruled they stay: EXCEEDS means later or greater in the value’s order on any ordered value, as EQUALS means the same on any value, and 21 obligations order instants after a modal, where MUST NOT EXCEED parses and is after does not. Earned vocabulary 17 and Hard invariant 34 are admitted; NOT EXCEEDS joins D-condition-form’s retired forms; W-ge-disjunction becomes gating, since the disjunction now has a cure, and W-condition-operator reads is negative, is positive and is zero; four fixtures join. The ≥ watch entry and the multitasking-keyword row record the cure. Census at 482: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3 — W-ge-disjunction’s two and W-condition-operator’s one are cured.
Council read 103 — symbols leave the rules, 2026-09-16. Task 22, under the maintainer’s ruling of council read 99 that = and | stay only where a value set is declared. Measured as every character outside letters, digits and ordinary punctuation in the text of a labelled rule, code spans removed: 86 in eleven specifications, a bracket or brace pair counted once — <kind> templates 25 and braces 7 and bars 7, all in Recoverable Invocation; section signs 23 across ten specs, most in the Composes rules’ PER execution-contract.md §Conformance; arrows 11 (Audit Trail 7, Recoverable Invocation 4); en dashes in step ranges 5, slashes 4 and asterisks 4 in Audit Trail and Recoverable Invocation — and the grammar’s own rules carried eight section signs, §21 and §Heading standard. Each took a word form: a section is the section titled Conformance in execution-contract.md, and the grammar’s rules name the lock list, which its actor declaration already aliased; a map entry is the event’s event_id mapped to the attestation_id; a call’s answer is answering attestation_id; a returned or written record is invocation_id and intent_event_id or data carrying invocation_id, intent_event_id, act_key and cause set to not-committed; a pair of codes is recording-failure(step-2) and recording-failure(step-3); a range of steps is steps 2 through 5; the who / what / when is the who, the what and the when; [Open] → commit → [Close] is [Open], then the commit, then [Close]. Where the symbol belongs to a code spelling — the <kind>.intended action_ref template, audit.*, already-* — it sits in a code span, which is where a code spelling is quoted (Surface 30). 70 lines in eleven specs, the gate’s 485 advisories unchanged line for line. Term rule symbol and Earned vocabulary 16 are admitted, and check.py’s D-rule-symbol gates the section sign, arrow, braces, bar, angle brackets, en dash, slash and asterisk in a rule’s own text; ten fixtures pin it. Left: CamelCase constituent calls in rules (RetentionWindow.place_under_retention) are code spellings the English-names sweep takes up (task 25), and the addressable-sections watch entry still has no grammar for a section — the section titled X is a phrase, not a form. Census held at 485: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3, W-ge-disjunction 2, W-condition-operator 1.
Council read 102 — a record’s state is a value, 2026-09-16. Task 23. Council read 99 left a record’s state tested two ways: 88 conditions said the session stands in active, 31 said the party’s state EQUALS verified. The maintainer ruled the value form over a new STANDS IN operator: a state is a member of a declared value set, so a condition names the set and tests it with EQUALS or IS IN, and no operator is added. Measured by the verb stand in every form, beside the members and set terms of each spec’s state value sets and its constituents’: 220 sites, 53 of them writes (MUST stand the party in verified, MUST leave the unit standing in pending), which stay, and 167 test lines. 178 lines in twenty-nine specs now test the state as a value, each under the name its own value set gives it — status (Assignment, Capability, Invitation, Message Preference, Notification, Permissions, Session, Subscription, Credential), state (Approval Step, Consent, Medication Order, Observation, Party Identity, Provisional Commitment, Soft Delete), pool state, hold state, unit state, chain state, retention state, and Actor Suspension’s lifecycle state; a set test reads IS IN the terminal states, a subject qualifier an order whose state IS IN the terminal states, and the Check rules’ standing in EXACTLY ONE OF reads whose state EQUALS EXACTLY ONE OF. Rewrites beyond the spelling: Notification’s a terminal status has no declared set and reads status DOES NOT EQUAL pending, its exact complement; Actor Suspension’s stood active or suspending reads lifecycle state DOES NOT EQUAL suspended; Soft Delete’s stands outside deleted and purged reads state EQUALS active; State Machine tests the declared current state; four value memberships written with standing in (Provenance, Selective Disclosure twice, Personal Todo) read IS IN, and Defensible Retention’s stands outside elapsed retention reads IS NOT IN the elapsed retentions; Attributed Permissions Admin’s Check 7.1 became find no grant … whose status DOES NOT EQUAL revoked. D-condition-form gates stands in and stands outside after a condition keyword or whose — it fires on 82 of the moved sites at HEAD; the subject-qualifier form is not gated, because MUST leave the unit standing in pending is a write. Three fixtures join. Left: Customer Onboarding’s case stands active and stands inactive at six sites, with no state set declared for a case; Message Preference’s has stood in suspended, a history rather than a state; Actor Suspension’s accounted-member and accounted-cascade declarations; Approval Step’s non-goal about an external subject’s approvable state; State Machine’s definitions of the current state; and some 150 other uses of stands as a verb of being — stands aged out, stands non-empty, stands composed. Census held at 485: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3, W-ge-disjunction 2, W-condition-operator 1.
Council read 101 — Projection:, 2026-09-16. Proposed by the maintainer beside the English-names ruling of council read 100: the line on a term entry that carries the code spelling was labelled Projects:, a verb among nouns — Kind:, Role:, Wire:, Member of: — and it is renamed Projection:, the thing the line holds. 757 lines in fifty-three specifications, the thirteen unmigrated among them, most in Medication Order (47), Capacity Constraint Enforcement (37) and Party Identity (34). The new label is two characters longer, so 741 aligned blocks are re-padded to keep their values in one column; 16 unaligned blocks keep their own spacing. The term registry’s introduction names the line in twenty-three specifications and follows. term-adapter.mjs reads Projection: and writes projections into the derived manifest; check.py’s code-span exemption, its README, one fixture, pressure-testing.md’s field-set example, the grammar’s code-span term and wire-layer watch entry, and the term-entry-grammar docket row follow. Dated records keep the old label: the register, the grammar’s earlier change notes and Reserve From Pool’s Decisions entry quoting Projects: release. The closing phrase ruled for generated term entries follows too — — projection token. (task 14). GLM’s review found three stragglers, now renamed: working-ideas/annotation.md, the conversion guide the adapter names itself after, taught Projects: at five sites; the clinical-trial demo’s wiring notes carried it twice; and the grammar’s wire-layer watch entry still said the line sat in four documents and that one had drifted into camelCase, where it sits in fifty-three and none has. The review also read Wire: pinned as carried by no spec; Personal Todo carries it as Wire: pinned, padded to its block’s column, which a search for the unpadded form misses. Census held at 485: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3, W-ge-disjunction 2, W-condition-operator 1.
Council read 100 — the rule nouns are the grammar’s, 2026-09-16. GLM asked whether the corpus attends to verbs more than nouns, and it does: Closed vocabulary 8 has C-verb and Closed vocabulary 4, every normative identifier resolves to a declaration, has no instrument. Measured by NLTK’s perceptron tagger over the 7,869 labelled rules of the forty-one migrated specs — code spans, markers, label citations, reserved tokens and spec names removed, the word after a modal read as a verb, each noun phrase matched whole, then by any declared name inside it, against the spec’s own names, its constituents’ and the grammar’s — 21,031 noun phrases: 13,529 resolved whole, 3,837 only through a declared name inside, 3,665 (1,225 distinct) through nothing. The unresolved fall in three groups: everyday rule nouns (call 87, write 73, answer and answers 95, section 66, instance 52, act 52, field and fields 29); names borrowed from another spec and never declared, 309 sites and 82 names (invocation_id in Actor Suspension 16 and Defensible Retention 9, verification_id 12, intent_event_id 11, task_id in Shared Todo 9, fired_at in Notification Fanout 8); and domain phrases (non-whitespace character 42, clock monotonicity 25, log entry 19). The maintainer ruled two questions. The everyday nouns are the grammar’s, as blank became at v0.52. And names in rules are English, derived word for word from the code spelling — invocation_id is invocation id, never invocation identifier — with the declared name English too and the code spelling kept in Projects:; 3,022 snake_case words sit in rules today, and that sweep is its own unit. This unit takes the first: six nouns chosen by spread — call (undeclared in 32 of the 36 specs that use it), write (29 of 35), instant (26 of 27), field (25 of 25), answer (24 of 29) and input, which the signature form already used — are declared once as rule nouns (Earned vocabulary 13, 14). Argument named the same thing as input and is replaced at 91 sites in twenty-one specs, 45 rules and 46 declarations, opaque argument among them. Unresolved noun phrases fall from 3,665 to 3,211. Instance is left out on purpose: State Machine declares it as one workflow instance, and the other specs mean one deployed copy of a pattern. The tagger also found three specs declaring a name the grammar declares with another meaning — Party Identity’s identifier, Audit Trail’s tail, Recoverable Invocation’s run_floor, the last an exemplar the grammar borrows — and Audit Trail and Recoverable Invocation declare 40 settings and stores as bold bullets that no instrument reads as declarations. check.py’s D-rule-noun gates a declared rule noun and argument; six fixtures pin it. Census held at 485: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3, W-ge-disjunction 2, W-condition-operator 1.
Council read 99 — one condition operator, one sense, in English, 2026-09-16. Queued at council read 41 and docketed at council read 52, where the maintainer leaned toward NOT IN. Read by rule text, EXISTS carried eight senses at 314 sites in forty-one specifications: a caller’s argument 123 (25 specs), a stored record 72 (22), an event or condition 31 (8; Audit Trail 20), membership in a set 30 (11), a deployment setting 24 (4; Audit Trail 21), a stored field 17 (7), a record’s state 16 (Medication Order 12, Credential 2, Party Identity 1, Soft Delete 1) and a constituent’s read 1 (Recoverable Invocation). The sharpest pair differed by an article: step_id NOT EXISTS was the caller sent nothing, the assignment_id NOT EXISTS was no record carries the id, and eleven sites meant the second. The maintainer admitted the split with Grok’s reading and ruled the spelling: English words, and not the caveman NOT EQUALS. A thing is there: an active subscription EXISTS for the pair, and absent, no hold EXISTS for the hold_id (100 sites, 62 of them absences; NOT EXISTS retired). A value is missing: reason EQUALS blank, recalled_at DOES NOT EQUAL blank (161, nineteen of them caught by GLM’s review: the sweep chose its sites by EXISTS and left the already-English task_ref is blank standing at nineteen guards in six atoms, beside sixty-three converted twins, and no instrument read it; D-condition-form now gates is blank too, sixteen fixtures). A value is in a set: IS IN, IS NOT IN (40, three of them a key missing from an index or registry), and a record’s single state is the order's state DOES NOT EQUAL ordered. = and != in tests became EQUALS and DOES NOT EQUAL (151), and a write that sets a field says field set to value (40, Recoverable Invocation and Audit Trail), because the maintainer ruled that = and | stay only where a value set is declared. A screen-reader engine read the words as a person would and != as exclamation equals with punctuation on. Term blank moves into the grammar and twenty-five local copies are deleted — the watch list said sixteen — which also ends the circle in which blank was defined by the operator beside it. Four rewrites went beyond spelling and are stated here: Idempotent Reservation’s Action wiring 17 was retry ONLY IF the result write NOT EXISTS AND the reservation completion bound NOT EXISTS as elapsed and is now retry WITHIN the reservation completion bound ONLY IF no result write EXISTS, the completion-window form Timing 8 owns, with Action wiring 18 still answering the elapse; Credential’s Operation 28 and Operation 29 read the credential NOT EXISTS as an effective-active credential and now read no effective-active credential EXISTS for the credential_id; Idempotent Reservation’s candidates set is a value and is tested against blank; and Message Preference’s no preference field EXISTS in the call is EVERY preference field EQUALS blank. The words also repaired an instrument: W-duplicate-proposition compares rules by words of four letters or more, so it could not see !=, and it had been reporting Audit Trail’s Invariant 1.7 (retention_state = Purged) and read_record step 4.4 as restating event_to_attestation 2, which says the opposite; it now pairs them with event_to_attestation 3, which says the same, and the count holds. check.py’s D-condition-form gates NOT EXISTS, EXISTS in, !=, = in a rule and a signature input written as the subject of EXISTS; fifteen fixtures pin it, and the reservation guard and the ≥ detector read the new words. The open-questions row is closed and removed, and the multitasking-keyword row and the input-handling row note the cure. Measured and left: 89 conditions still test a record’s state with the verb stands in, a second spelling beside state DOES NOT EQUAL; rules outside the value sets still carry 25 <kind> placeholders, 23 § section marks across ten specs, 11 arrows, 7 braces and 7 bars; Recoverable Invocation’s close step 2.2d and close step 2.2e test a field with carries and carries no; the thirteen unmigrated specs keep the old forms until their migration; and the engine read the capital IF as eye eff before some words. The register dated council read 94 through council read 98 a day late, 2026-09-17, where every one of their commits landed on 2026-09-16; corrected here. Also left, as an open reading: Hard invariant 14 now exempts blank, and Retention Window’s Operation 7a compares with degenerate duration, a declared term and not a value-set member. Every count here is the token, word-bounded, in the labelled rules and the Term declarations of the migrated specs, code spans removed — the rules read by check.py’s own label and declaration patterns inside bare fences whose first line is a label. Census held at 485: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3, W-ge-disjunction 2, W-condition-operator 1.
Council read 98 — a signature has one owner, 2026-09-16. Queued by the signature unit (council read 89), whose close_pool phantom refusals came from the second copy: every migrated spec’s Term value sets: line restated each action’s answers and refusals beside the signature block, which Closed vocabulary 21 makes the owner and Authority 3 forbids a second of. Measured before removing: 146 restating segments across 35 specs. Refusals compared set against set: none differ now that the signature unit fixed close_pool, but the one segment written for three actions — Capacity Constraint Enforcement’s suspend_pool, resume_pool and close_pool answers … — had given suspend_pool and resume_pool close_pool’s refusals, without the not-open and not-suspended their signatures carry, so the copy was wrong in both directions. Answers compared arm against arm: 23 differ, and none carries a fact the page does not state elsewhere — an order, an empty answer or a carried effective_status is a rule (Assignment Operation 28, Consent Operation 48, Operation 50 and Operation 51, Legal Hold Operation 24 and Operation 25, Capability Operation 51, Session Operation 38, Notification Operation 17 and its reference table, Subscription Operation 22, Provenance Operation 46 and Operation 47, Observation Operation 34, State Machine Operation 28, Operation 38 and Operation 47, Message Preference Operation 31 and Operation 34), and a record answer is the declared term Closed vocabulary 27 requires (Actor Suspension’s three, Attributed Permissions Admin’s four). All 146 are gone; State Machine’s and Notification Fanout’s lines held nothing else and are removed. One answers segment stays: Recoverable Invocation’s probe is the adopter’s bound action, with no signature on the page to own it. check.py’s gate reads the same 485 advisories before and after, line for line, so its name universe took nothing from the removed segments it does not also take elsewhere. D-signature-form now fires on a value sets line naming an action a signature block declares, and its fixtures go from eleven to thirteen — the restatement fires, a value sets line naming an unsigned action stays silent. Census held at 485: W-unconditional-effect 181, K-check-bare 83, W-duplicate-proposition 66, W-or-word 46, W-comparator 37, W-two-obligations 27, W-watch-word 23, W-modal 10, W-term-unused 6, W-demonstrative 3, W-ge-disjunction 2, W-condition-operator 1.
Council read 97 — a Decisions entry cannot make a forbidden choice lawful, 2026-09-16. Raised at council read 95: Provenance’s Decisions entry recorded a renumbering Hard invariant 26 and Hard invariant 27 forbid, in the Chose / Over / Because form, and the form carried it for four days because the Decisions bar screened in one direction only — it kept implementation notes out and let nothing say a direction could be unlawful. The maintainer admitted the rule. It is one sentence in the one place that owns the bar, pressure-testing.md §Where the journey gets recorded, beside the two things the bar already excludes: a choice a Hard invariant forbids is not a direction, a Decisions entry cannot make it lawful, and the review that finds one repairs the spec and corrects the entry. spec-format.md names the Decisions section and points at the directional test without owning it, so it is left as it is. No instrument reads it — a Decisions entry is prose, and whether its choice breaks a rule is a reader’s judgment — but the one breach of this kind the corpus has had is now also caught at the source by F-renumber (council read 96). Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 96 — an invariant keeps its number, and now something reads it, 2026-09-16. Queued by council read 95: Hard invariant 26 and Hard invariant 27 — never renumber, never reuse a retired number — had no instrument, and Provenance’s renumbering was found four days late, only because a range citation in another spec became readable. lint.py’s F-renumber reads a spec’s invariant numbers against two references, both taken from git rather than from a stored copy, so the no-snapshot rule holds: the spec at HEAD when the working tree differs from it, which catches a renumbering in the unit that makes it, and, for a migrated spec, the spec as it stood before the commit that migrated it, which is where the one known renumbering happened and where the thirteen migrations still to come will be read. A spec migrated under an earlier name is read at that name — Observation was migrated as Clinical Observation and renamed a commit later, and the first draft of the check silently gave it no reference at all; a coverage count over all forty-one caught that before the fixtures did. Against each it asks three things. Two are exact — a number the reference declared is still declared or tombstoned, and a number the reference had wholly tombstoned is not declared again. The third reads meaning, so it is measured before it was trusted: an invariant’s title reappearing under another number, its content words overlapping the other title by half or more and by more than the title now standing at its own number. Across the forty-one migrated specifications, every one of them has rewordings under unchanged numbers — Step store durability to Store durability, All actor references are required to Attribution is complete — and the rule reports none of them; on Provenance’s text before council read 95 it reports the lost Invariant 10 and Chain and store durability standing at Invariant 9. Its gap is stated rather than hidden: an invariant removed without a tombstone whose number is then given to an invariant with a wholly new title is caught only if the count of numbers shrinks. The linter’s run grows from about nineteen seconds to about twenty-six, most of it one history search for the migration commits. Four fixtures, each a throwaway git repository, one of them a rename. The maintainer noted, on reading this unit, that he does not love retiring a number permanently, and let the rule stand; the check reads Hard invariant 27 as written, and the reuse clause is the one to change if the rule does. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 95 — the parenthesized range, and the renumbering it uncovered, 2026-09-16. Queued by council read 94 at five sites; measured with the family word read in any case, it was fifteen in running text — Recoverable Invocation’s Invariant 9.1, a rule, and fourteen in prose: ten in five unmigrated compositions’ Constituent invariants preserved entries, two in demo build notes and two in coverage matrices — plus five quotations of the retired form in Actor Suspension and this register. The running-text sites now read Family N through M (Audit Trail Invariant 1 through 8 hold over the substrate), a note’s number kept as the note wrote it; the quotations became code spans, since a code span is where a form is quoted as a form (Term code span). F-range-form reads the shape — the family in any case, singular or plural, the numbers in parentheses — and fires on all twenty on the tree before this unit. The conversion uncovered a renumbering. Chain of Custody’s All Provenance invariants (1–10) became Provenance Invariant 1 through 10, and F-invariant-ref, which reads a range to its end since council read 88, found Provenance declaring nine. Provenance’s migration (2026-09-12) had moved its No id reuse invariant into Identity 15 and Identity 16 — right by Authority 3 — and then given the freed number 9 to the durability invariant that had been 10, which Hard invariant 26 and Hard invariant 27 forbid, and which its own Decisions entry recorded as a choice. Nothing had read the citation that broke. Durability is Invariant 10 again, Invariant 9 is a tombstone naming its owners, the two prose references follow, and the Decisions entry records the correction. A sweep of every migrated specification’s invariant numbers against its pre-migration text found no other number carrying a different invariant; the rest are rewordings under the same number. Two fixtures on the parenthesized shape, one on a quotation of it. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 94 — a composition’s constituents agree wherever they are named, 2026-09-16. Queued by council read 93, where Actor Suspension’s Composes list carried Actor Identity while its Term constituents and its Composes rules did not, and only a hand cross-check found it. Measured before building: a composition names its constituents in up to three places — the Composes list (the reader’s copy, and the one the generated views read), a Term constituents declaration in ten migrated compositions, and the Composes N: EXACTLY ONE X instance MUST serve rules in twelve. After council read 93 all three agree in every composition that carries more than one. So no copy was retired: the list is the reader’s copy spec-format.md requires, the declaration and the serve rules are the normative statements, and the cure for three copies is that they cannot drift apart silently. lint.py’s F-constituents gates a declaration or a set of serve rules that names a different set of specifications than the list; run on the tree before council read 93 it fires on the four declarations whose links had lost their brackets (Actor Suspension, Attributed Permissions Admin, Customer Onboarding, Defensible Retention) and on Actor Suspension’s serve rules, which never named the Actor Identity item. Recoverable Invocation is the one migrated composition with a list and no serve rules; its instance multiplicity is stated under Bindings (journal 1, one Audit Trail instance per instance) and says nothing of Lease, which is a statement the spec has to make and this unit does not invent. Five fixtures. Found on the way: the range form has a shape F-range-form does not read — All Selective Disclosure invariants (1–6), a family word, lower case and plural, with the numbers in parentheses — in four unmigrated compositions’ prose and in Recoverable Invocation’s Invariant 9.1, a rule; queued rather than folded in, since it is council read 88’s unit. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 93 — the generated views read their sources again, 2026-09-16. Found at council read 92: a regeneration of graph.md, _data/patterns.json and atoms/index.md differed from what was committed, at that commit and the three before it. Measured, the drift had three causes, and none of them was the generator’s choice of source. Seven migrated compositions had dropped the constituent list spec-format.md §Composes requires — Authenticated Actor, Idempotent Reservation, Login, Notification Fanout, Session-Gated Authorization, Shared Todo, Undo History — each in its own migration, and the generator reads that list and nothing else. The lists are back, sixteen items, each role a one-line noun phrase taken from the item the migration removed. 146 links had lost their brackets in seven migrations’ casing pass — Actor Suspension, Attributed Permissions Admin, Authenticated Actor, Customer Onboarding, Defensible Retention, Idempotent Reservation, Login — as permissions(../atoms/permissions.md), rendering as its own source: 137 in those compositions’ prose and Term lines, 2 in this register, and 7 inside rules that council read 91’s F-bracket could not see because they carried no brackets. The prose ones are links again, titled by the linked spec; the seven in rules name the spec alone (Surface 29). Where the stripped form came from, since the check only cures it: every one of the 146 was written as a new line by a migration commit, not by a later sweep, and the seven commits are consecutive — 2026-09-14, Idempotent Reservation at 16:34 through Attributed Permissions Admin at 22:00. The migrations earlier that day (Session-Gated Authorization, Shared Todo, Notification Fanout) wrote [Name](path) and are clean. So the habit entered the migration rewrite that afternoon — a pass writing a declared name in lower case, the casing tier’s form for the spec’s own names, took a Markdown link for a bracket marker and lower-cased it, brackets and all — and no script in the repository did it, which means the habit is a practice rather than a tool and is still available to the thirteen migrations left. F-stripped-link is the guard those migrations now run into. The generator read too loosely and counted too narrowly. It took any [Atom](../atoms/…) — under the Composes heading as an edge, so the repaired Term composition lines would have doubled seven edges, and it missed a list item carrying (optional) before its dash; it now reads list items only, once each. It counted invariants from bold bullet headings alone, so a migrated composition whose invariants are rules — Actor Suspension, Attributed Permissions Admin, Customer Onboarding — would have published 0; it and lint.py now count the distinct numbers of the headings and the Invariant N.M labels together, and a tombstoned invariant is not counted. One list item was wrong rather than missing: Actor Suspension listed Actor Identity, which its own Term constituents omits and Composes 9 reaches only through Audit Trail, as no sibling that composes Audit Trail lists it; the item is gone, and Credential, listed (optional) and now read, takes its place. The regenerated views are committed with this unit, and every change in them is a fact of the current sources: the same sixty-four composition-to-atom edges the stale files carried from before the migrations — seven of which a regeneration at the last commit would have dropped — except Actor Suspension’s Actor Identity edge, replaced by Credential; eight cards whose invariant count now excludes tombstones; standards and regulated flags that follow the specs’ present sections, and Recoverable Invocation’s formal models, which the stale card did not show. Regeneration is deterministic run to run. lint.py gains F-stripped-link and F-composes-list, both gating and both caught on the pre-change tree (139 and 7); check.py’s F-bracket reads the stripped form in a rule (7). Seven fixtures, six new and one added to F-bracket’s. Left open: a composition now names its constituents in two places — the Composes list and, in ten migrated compositions, Term constituents — and Actor Suspension’s wrong item lived in the gap between them, found by hand. F-composes-list checks that the list exists, not that the two agree; that cross-check is the next instrument, queued. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 92 — a backtick quotes literal text, 2026-09-16. The seventh row of the syntax table. v0.45 took the backticks off a declared name at its declaration and left them on everything the declaration listed — value-set members, fields, outcome codes, vocabulary entries — and on the prose that mentioned any of them, so a backtick meant code in one place and this is a name in the next, and a reader could not tell a wire spelling from a declared word by looking. The census before the cut: 9,227 code spans in the grammar and the forty-one migrated specifications, 5,420 of them exactly a name the spec itself declares. The maintainer ruled the reach — every declared name, snake and kebab spellings included, rather than plain-word names only. 5,346 spans unwrapped in forty-two files, 3,173 of them on Term lines; code spellings, expressions, file names, dotted wire names and quoted forms keep theirs, and so do the Status and Ledger sections, headings, a term entry’s Projects: and Wire: lines, and link lines. Eleven plurals written against a span — `attestation_id`s — would have read as a different name once bare, and now say attestation_id values. The count converged in two passes: the first pass read a spec’s names from the backticks it was removing, and the gate, reading declarations bare, found 41 more members declared without backticks and still quoted in prose; the second pass took them. The grammar’s qualifier form, which quoted `migrated` inside a quoted form, now quotes the form once. What the tools read from backticks, they now read bare: check.py’s category set, reserved tokens and name universe, cites.py’s standard families and glosses, lint.py’s standard-family reader and its bare-substrate-mapping pattern, and the migrated marker in both check.py and cites.py. One check had leaned on the quoting: D-decl-modal read a bare MUST in the grammar’s own Term modal as an obligation, and now skips the modals in the one document that declares them as names. Every instrument’s output is unchanged — check.py’s findings line for line, the linter’s, cites.py --standard, --drift (backticks aside), and --into — and a regeneration of the catalogue, graph and pattern data is byte-identical before and after. GRACE-lang v0.51 declares Term code span and adds Surface 30; check.py’s D-code-span gates. Twelve fixtures, three of them on the bare-name readers. Found on the way and not in this unit: the committed graph.md, _data/patterns.json and atoms/index.md are older than their sources — a regeneration at this commit, and at each of the last three, differs from what is committed, because the generator reads a composition’s constituents from the links in its Composes section and three migrated compositions (Authenticated Actor, Idempotent Reservation, Login) carry no such list; regenerating now would drop real edges. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 91 — brackets point only to actions and terms, 2026-09-16. The sixth row of the syntax table. A rule that named another specification carried a Markdown link — A deployment needing permission MUST compose Permissions — and a rule sits in a fence, where a link does not render: a reader of the source, a highlighter and the parser all met [Permissions] in the one place Surface 26 says a bracket resolves to a declaration of this spec, and it resolved to none. 218 links removed from 217 rules in twenty-nine specifications, 114 of them Non-goal rules, 51 Composition notes and 46 External checks, each routing a need to another pattern; every link’s text was already the linked specification’s own title, so each rule now names the specification alone, the form Hard invariant 28 gives a cross-spec label. The measurement also settled what the row feared and did not find: in the migrated corpus no bracket marker names another specification, and every other marker in a rule — 1,578 of them — lands on a term entry of its own spec through a link line; where a marker’s name matches a specification’s, it is that spec’s own record type or action ([Session] in Session, [Soft Delete] in Soft Delete) or, once, a parameter ([Credential] in Actor Identity). The 68 links on Term lines stay: a declaration line renders, and there the link is a link. GRACE-lang v0.50 adds Surface 29 and says in Term bracket marker what a marker names. check.py’s F-bracket now gates a link in a rule and a marker with no link line, and reads the whole rule — condition and WHEN parent included — where the older bracket-range check read only the statement after THEN. The generated catalogue, graph and pattern data are byte-identical before and after. Six fixtures. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 90 — one fence kind, 2026-09-16. The fifth row of the syntax table. A block of rules sat in a fence marked text and a signature block in a fence marked with nothing, and neither mark said anything the block’s first line did not: check.py already classified a text fence by its first line and a bare fence by whether its first line was a signature. The mark goes and the first line decides — a labelled rule or a tombstone opens a normative block, a surface prefix opens that surface, a signature opens a signature block, and any other block is the surface nothing. 982 fences unmarked in forty-three files (the grammar, spec-format.md, forty-one specifications), and nothing else in them changed. What the text mark guarded is kept by shape: a block that carries a labelled rule under a first line that opens nothing is still rejected (Surface 19), and before the merge no bare fence in the corpus opened with a rule or carried one, which is what made the merge safe to run. GRACE-lang v0.49 declares Term bare fence in place of Term text fence, rewords Surface 18, Surface 19 and Surface 21, and adds Surface 28. check.py’s D-fence-form gates a fence still marked text; its finding list is identical before and after, line for line. The rewrite also fixed a reader fault: check.py stepped into any fence that was neither text nor a signature block — a Ledger, an example, another language’s code — one line at a time, so the block’s contents were tracked as prose and its closing line was read as a fence opening; it now skips the whole block. cites.py now reads a bare fence as normative only when its first line is a rule or a tombstone, so the six Canonical example exemplars under the grammar’s NOTE: block stop counting as rules — the reading check.py and Surface 22 already gave them. lint.py’s family reader and the conformance comment follow. Six fixtures. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.

Council read 89 — a signature is written in words, 2026-09-15. The fourth row of the syntax table. A signature read name(args, x?) → {a, b} | rejected(c | d): an arrow no keyboard types, a ? that means optional nowhere else, a record written as braces in one spec and a parenthesized tuple in the next, and a wrapper that made every refusal a nested arm. It now reads name(args, optional x), then ` answers and the arms, then refuses and the codes, one signature per action with a blank line between — the verbs the rules already use, *MUST answer* 878 times and *MUST refuse* 33. **171 signatures in 51 blocks across forty specifications**, 138 with a refuses line. A record an action answers is now a declared term, the cure council read 84 gave an inner choice: eighteen terms in seven specifications, among them Recoverable Invocation's invocation report and invocation entry, whose two inline comments became the terms' own words; its one-field records, {refusal_event_id} and {closing_event_id}, became the field. Idempotent Reservation's release and expire had written their refusals as *… as confirm …* and are now written out, expire with Provisional Commitment's window-not-elapsed in place of window-elapsed. Audit Trail's under-legal-hold† lost its dagger, since purge_event 5 and purge_event 6 already carry the condition. Eleven bare fences that open with a call carrying values — purge(retention_id: “ret-0047”) — are examples, and check.py now reads them as the surface nothing rather than as signatures. **The wrapper left the rest of each spec too:** 69 rules and 115 prose and example sites now name the outcome itself, and the six rules where that read *land X as X* say *pass X through unchanged*. The 35 value sets lines follow the notation with their own words kept, and the sweep that compared them against the signatures found one that disagreed: Capacity Constraint Enforcement's line listed not-open and not-suspended for close_pool, which no rule lands and the signature never carried; the line now matches the signature, which Closed vocabulary 21 makes the owner. **GLM's close read, three findings, fixed in the pass.** The form settles half of the parked value-carrying question by practice: an arm carries names in parentheses — act-in-flight(invocation_id), recording-failure(refusal, constituent_code) — and never another arm; whether a carried name must resolve to a declaration (Closed vocabulary 4 reaching inside the parentheses, where constituent_code is a caller's open vocabulary) stays open. Removing the wrapper had left one prose contract in a third shape, Recoverable Invocation's Audit Trail entry under Composes citing record_action(…) → event_id invalid-credential … with answers and refusals in one list; it now says which it answers and which it refuses. And a record term had become a third copy of a value set: Term close result listed landed_by's members beside the value sets line that owns them, and Term invocation entry listed state's; both now name the field, and binding_duplicate's true | false, which nothing else declares, stays in the terms. GRACE-lang v0.48 declares Term signature form and Closed vocabulary 24 through 27. check.py's D-signature-form gates (and F-signature, which only asked for an arrow, retires); a refusal is one word, so two codes with no ` between them fire, which is the class V-signature-alternation catches in the older form. lint.py’s contract reader reads both forms, and all 235 contracts it reads are unchanged. Eleven fixtures. Left as they are: the thirteen specifications not yet migrated keep the older form (eight of them carry signature blocks), and lint.py reads it until they migrate; the arrow outside signatures — 567 sites in prose and examples, and 11 inside ten rules that call a constituent — which the syntax table’s signature row does not reach; collection answers written as phrases, the matching steps, list of event_ids, the eligibility tuples; and each value sets line repeating the signature beside it, a second owner of one proposition. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.

Council read 88 — a range is written Family N through M, 2026-09-15. The third row of the syntax table. The corpus wrote one range four ways — Operation 3–7 with a dash no keyboard types, Operation 3 through Operation 7 with the family twice, Invariants 1–4 with the family plural, Invariants 8 to 11 with a word that does not say whether 11 is in — and no instrument read any of them past the first label: check.py resolved Operation 3 and never looked at 7, and cites.py counted one citation where a range makes several. The queue carried the unit at 197; measured by the families’ own labels across every tracked file it is 379 — 188 dashes, 44 plural families with a dash, 143 repeated families (one of them joined by to) and 4 plural families with through or to — 331 in fifty-one specifications and 48 in eleven other files. Two of the dashes were Capability requirement 2–2, a one-label range my own Clock semantics decomposition wrote in Notification and Subscription; each now cites Capability requirement 2. A dash between a label and a date (Correction 2026-09) is not a range and was left. GRACE-lang v0.47 declares Term range citation and Hard invariant 29 through 31: a range cites every label between its ends, both included; a last number that does not follow the first is rejected; so is any other form. lint.py’s F-range-form gates every Markdown file; check.py’s X-ref resolves a range’s last label (none dangled); cites.py expands a range in the local walk, the cross-spec walk and --into — in the local walk that is 128 rule-to-rule citations the tool had not seen, from eight rules in three specifications (Audit Trail, Lease, Recoverable Invocation); no cross-spec range lands in a migrated spec yet, so --into counts what it counted; F-invariant-ref reads a range to its end. Nineteen fixtures. The ugliest reading is the two-label range — Sugar 1 through 2 — which is still one form rather than a second one for pairs. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 87 — a tombstone is its own line, 2026-09-15. The second row of the syntax table. A tombstone was a NOTE: whose text began with a label and the word deleted, so one prefix meant this line binds nothing and, in one shape, reserve this label forever — and because a NOTE: is a surface prefix, a tombstone written as a block’s first line demoted every rule beneath it, the trap F-prefix-first caught at council read 15 and again at council read 76. A tombstone now reads Deleted: Label. The owner, and why. — the label, a period, one space, a sentence with its period — and Surface 18 counts it with a labelled rule when it classifies a fence, so the trap is gone by construction rather than guarded. 297 tombstones converted by ^\s*NOTE: <label> deleted — <reason>$, which every one of them matched, words kept; none sat in the grammar. check.py reads the form (D-tombstone-form, gating: the retired shape, a missing period, a missing close, a line with no label), and F-prefix-first and F-tombstone-orphan retire with the trap they guarded; lint.py’s reserved-invariant reader follows. One advisory the unit’s own wording raised — a lower-case or in the new Surface 18 — was repaired by stating the two openers as two clauses. Five fixtures pin the form, one of them proving a tombstone written first leaves the rule beneath it live. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 86 — Term name:, the first row of the syntax table to land, 2026-09-15. The maintainer admitted the syntax table and ruled its forms strict. The declaration form was Terms › name: definition. — a separator no keyboard carries, and backticks giving a declared name a job beside quoting literal text. It is now Term name: definition.: the name runs from Term to the first colon, bare, one space follows, and the definition ends with a period. The census that licensed the strict form ran first — no declared name carried a colon, no declaration lacked the space or the closing period, and no prose line opened with Term — so the form could be exact without a single exception. 1,649 declarations converted, 1,600 across forty-one specifications and 49 in the grammar — counted by ^\s*Term [^:]+: , which takes the 58 declarations indented under a bullet or a step in the specs as well as the 1,591 at the margin that Z's line-anchored count found, and twenty-four prose mentions in the grammar, spec-format.md, open-questions.md, pressure-testing.md and the tool notes; no definition changed. The grammar's declaration form now says what the form is, Surface 24 reads *outside every declaration*, and v0.45 records it; the register's dated entries and the grammar's own changelog keep the old separator, because they record what it was. check.py, cites.py and lint.py read the new form everywhere they read the old one, and check.py gains D-decl-form`, gating: a line that opens like a declaration and is not the form, or that still carries the old separator, is a finding. Five fixtures pin it. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 85 — capitals in a rule are grammar words, with no exceptions, 2026-09-15. Council read 79 split the capital tier: a watched or provisional form gated as R-caps, and a proper noun in capitals reported as W-caps at fifteen sites, awaiting a ruling. The maintainer ruled eviction over a declared exception — it costs a few bytes but eliminates a whole class of errors — so a rule spells a proper noun out, and W-caps folds into R-caps, gating. The fifteen are gone: Defensible Retention’s three regimes read Rule 37(e) of the Federal Rules of Civil Procedure, Securities and Exchange Commission Rule 17a-4 and the Sarbanes-Oxley Act; Customer Onboarding’s reads the Bank Secrecy Act and Anti-Money Laundering rules; Audit Trail’s reference cap is 1 kilobyte; and the grammar’s nine rules that said normative GRACE now say a normative line, the phrase Surface 5 already used, with Direction 6 passing every check this grammar declares. Surface 8’s AI is a language model, in the rule and in the agent and actors lines that declare it — not a model, which in this corpus is a formal model. No rule’s obligation changed. The grammar’s own name no longer appears in its rules, which is why that question did not need a ruling of its own.
Council read 84 — an inner choice gets a name, and no signature nests, 2026-09-15. The syntax review found signatures that nest a choice inside an answer — invalid(expired | revoked | not-known) — which no flat reading can end. The first count said nine; a scan that paired fences in order and followed every answer’s brackets across line breaks found twenty-eight sites in thirteen specifications, among them Recoverable Invocation’s invalid-request choice broken over two lines, which the line-by-line count could not see. Each inner choice is now a declared value set and the signature carries its name: invalid(validation failure), recording-failure(position), orphan-attestation(issuance orphan position). Nineteen declarations in twelve specifications cover the twenty-eight sites, because one name serves every site in a spec that means one thing — position is intent | outcome in Actor Suspension, Customer Onboarding and Defensible Retention, the name Recoverable Invocation already gives its own four-member set. Each spec’s value sets line repeats the answers and now repeats them with the names; each name joins the spec’s terms line. Session-Gated Authorization passes Session’s answer through, so it cites Session’s validation failure rather than declaring its own (Closed vocabulary 17). A rescan finds no inner choice left in any signature.

What this does not settle. Two of the new declarations carry a member that carries a value — post-grant(grant_id) in Attributed Permissions Admin, outcome(id?) and outcome(result) in Idempotent Reservation — so the answer-that-carries-a-value question §18 counts has moved out of the signature and into a declaration, and is otherwise untouched. It is a question of meaning before it is one of notation, and the English-word signature unit waits on it no longer, because no signature now holds a choice it would have to spell.

Z attacked the unit rather than grading it, and the attack drew its boundary exactly: naming flattens a closed choice and nothing else. What survives is open, collective or annotative — a payload a stranger supplies (Recoverable Invocation’s recording-failure(refusal, constituent_code)), a shaped answer (the answer-is-not-a-tag row), a refusal carrying a set (Actor Suspension’s revocation-failure(surface, open_members), recorded here as one specimen and not yet a row), and the side-channel qualifier. The attack’s one suspected miss was not one: Invitation’s already-resolved(stored terminal) already carries a name, stored terminal being accepted | declined | revoked, declared at Invitation’s term 208 — it is the form this unit copied, not a site it skipped. The attack also filed it as an open payload, and it is closed.
Council read 83 — Audit Trail’s reconciliation scan gets its address, 2026-09-15. Council read 80 left it as residue: Audit Trail’s scan — three halves and the compensation record — sat as a #### inside Wiring decision, under a label family of its own, Reconciliation scan. It answers council read 64’s question the way the family’s four members do: Reconciliation scan 4 closes every finding within the compensation window, and the scan writes the compensating records, so something awaits its output. It is now ### Reconciliation, after Wiring decision where the table places it, with the #### kept beneath so the half families keep their headings. The seven Reconciliation scan rules are Reconciliation 1 through 7, same words, seven tombstones naming each owner, and the four citations inside the spec follow; nothing outside the spec cited them. cites.py --promote Reconciliation now counts five members and Audit Trail’s seven rules, and its standing audit finds no local restatement of the family’s meaning — the top entry is the spec’s actors line at the floor.
Council read 82 — the deployment-obligation bucket, decomposed and admitted, 2026-09-15. Z ran the census; the chair re-ran it with the lists attached, which moved four numbers and one ruling; the maintainer admitted the corrected package. Clock semantics goes from 127 rules in 30 specifications to 39 in 13.

Sixty-three rules move to Capability requirement, in six sentences. Own the clock’s monotonicity (23), timezone handling (10), synchronization (7), honesty (9) and skew (5) were already one spelling each and move unchanged. Declare the clock offset allowance is the sixth, and it is written only where a rule reads the number — Z’s five-sentence draft put it on the five own-skew specs, none of which compares stamps across a seam, and would have handed each a declared term nothing reads; the split is the correction. Honesty’s six other spellings — supply an honest now in four atoms, inject a trustworthy clock reading in two compositions — become own the clock’s honesty, and each tombstone states the containment: the seam supplies now by the spec’s own supply rule, and the reading’s honesty is the deployment’s. Message Preference’s disclose the clock tolerance moves as a disclosure of its renamed bound, and its Check 4.3, the same proposition under the family whose meaning is an auditor’s check, is retired to it (Authority 3).

Twenty-five move to Non-goal, words kept. Sixteen delegations to a trusted timestamping pattern, with the two hyphenations made one; Provisional Commitment’s delegation to the composing Event Log’s sequence; Duplicate Prevention’s to a logical clock; and seven refusals — two to reconcile readers across a deadline, two to bound readers’ agreement, one to correct skew, two to detect a dishonest reading. Seventeen specifications lose the heading entirely; their tombstones move into the Capability requirement fence and their prose follows, every label reference rewritten to its owner. Seven rules stay that read like Clock dependence — Consent’s three guards, Duplicate Prevention’s anchor, Defensible Retention’s two judgments and its clockless gate — and each spec’s WHY now says why: an instance of the family’s question, not a statement of it (council read 75).

The larger find is a term with four names. clock_skew_allowance, clock skew allowance and skew allowance were one envelope for two clocks disagreeing, across eleven specs; they are now one name — clock offset allowance, cased by each spec’s own convention: snake where a spec writes its bounds that way, spaced with the projection declared where it does. The maintainer chose offset over the inherited skew on the language: offset is how far apart two clocks read, which is what the number bounds, and skew is how fast they drift, which is what own the clock’s skew still means. The rename reaches the unmigrated specs, pressure-testing.md, the roadmap and the formal models’ comments, so one concept carries one name everywhere but the register’s dated history. Two of the four names were not what they seemed. Notification Fanout cited Subscription’s clock tolerance, a term Subscription does not declare, for exactly this envelope; it now declares clock offset allowance and states the ask in the canonical sentence. Message Preference’s clock tolerance was never a clock disagreement at all — the largest gap between two writes inside one operation — and is renamed supersession gap bound so it stops reading as its neighbour.

Checked: every one of the 88 moved rules is present under its new label and tombstoned under its old one. Census held exactly: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 15 / 10 / 6 / 3 / 2 / 1; §18’s Clock semantics count reads 13.
Council read 81 — a second name for one heading, 2026-09-15. Council read 80 recorded the gap its own sweep found: H-heading licenses an unplaced heading, so Session’s ### Configuration — seven rules the one-name sentence says are Capability requirement — passed under Structure. The sentence was a claim no instrument read, and the sweep’s replace-all had turned one of its examples into Wiring decision is Wiring decision. It is now a table, spec-format.md §Retired heading names, ten rows, and H-heading reads it: a migrated heading carrying a retired name, or a row’s name with a plural, is a second name for one thing. Run against Session’s blob from before council read 80, the check reports ### Configuration and ### Capability requirements both; run against the corpus today it reports nothing. What it cannot see is a synonym nobody has ruled on — the list grows by ruling, and that limit is written into the section rather than hidden. Two fixtures join the six. Application state, the oldest retired name, stays out of the table because the word it carries is one the linter bans outside the note that records it.
Council read 80 — the heading standard, and the section list somebody finally reads, 2026-09-15. The maintainer ruled that a spec’s headings and their levels are standardized — XML-like nesting without having to look at XML — that a spec carries every heading its shape requires and may skip the rest, and that one order governs, alphabetical where nothing else places a heading. spec-format.md gains §Heading standard: two tables, one per shape, fixing each heading’s name, level, parent, order and requirement. lint.py reads the tables rather than copying them (H-heading), and runs the Contract’s section-name classification in both directions (H-classification), the check execution-contract.md specified in June and nothing ran. The open-questions row a spec’s section list is declared and unread is closed and removed.

The census came first, and it wrote the tables. Forty-one migrated specs. The twenty-eight atoms were nearly uniform — sixteen headings at the same levels in every one — and spec-format.md’s atom list still described the prose shape none of them carries any more. The compositions were not: Clock semantics, Concurrency, Atomic writes and Clock dependence stood as ## sections in four, under Composition logic in three and under Edge cases in two; one family, three addresses. The atoms filed Capability requirements under Generation acceptance and the compositions filed Capability requirement under Composition logic — two names and two parents for what the deployment supplies. H-heading reported 152 findings on its first run.

What the standard decided, and which rule decided it. One name per thing (make all things mean one thing): Capability requirement, Primitive policy, Conformance checks, Wiring decision, String policy, Indeterminate outcome — the migrated majority’s spelling, with the prose-shape name recorded beside each in spec-format.md. One address per family: Capability requirement sits under Structure in an atom as under Composition logic in a composition, and the six families the corpus files as edge cases are rows under Edge cases in both shapes. Placed headings in table order; unplaced ones after them, alphabetically — case-insensitive, punctuation ignored, a space before any letter — with ordering by importance named as the upgrade. Examples keeps the author’s order, because a walkthrough reads first. #### is free: it nests under a ###, which is how Undo History’s Replay now sits inside its Composition state and keeps every label it carries.

The sweep moved headings and nothing else, and was checked line by line. Every non-heading line of the forty-one specs is present after the sweep exactly as before, save the ones this entry names: Session-Gated Authorization had no Wiring decision, and Action wiring 4 — the gate the composition exists for — is now Wiring decision 1, same words, tombstone naming the owner; Shared Todo had no Standards references and now says in prose that it carries none of its own and names its constituents’; Duplicate Prevention had no Composition notes and now names its three composers in prose, pointing at the two operations that state what they owe; Undo History’s Composition state preamble says the replay is its derived index; Audit Trail’s and Recoverable Invocation’s wiring decisions keep their old titles as a first line. Idempotent Reservation’s Housekeeping, the outlier v0.43 recorded, now sits after Wiring decision, and its Ledger line is closed. GRACE-lang.md v0.44 narrows Standard label 11 to the one answer the two documents had disagreed on.

Residue, named rather than hidden. Audit Trail’s Configuration and its Instance capability requirement are now one Capability requirement heading holding both, and its reconciliation scan still nests under Wiring decision rather than standing as a Reconciliation leg — a filing question the heading standard does not reach. Reordering changed which of two duplicate propositions W-duplicate-proposition names first in four of Recoverable Invocation’s findings, the same count; that which copy is first has no ruling is council read 27’s open question, and this is it in practice. Six synthetic fixtures pin H-heading.

Z’s review ran the census it was written against — eleven distinct ## sequences to six, the six being two shapes and the optional headings the tables license — and named the seam the instrument does not cover: a renamed heading cited in prose. Nothing reads a §Section citation (the addressable-sections watch row), so the grep was run by hand. Three live citations of old names were repaired — Undo History’s two §The load-bearing wiring decision, Recoverable Invocation’s bound in *Configuration* — and the grep found a fourth thing the check could not: Session carried its own ### Configuration family, seven rules the standard’s one-name sentence says are Capability requirement, sitting under Structure as an unplaced heading H-heading licenses. Five of the seven are what the deployment supplies and are now Capability requirement 2 through 6; the default-duration refusal and the no-generation rule are one action’s and the transition’s, now Operation 48 and 49; seven tombstones name each owner and the three prose citations follow. The instrument’s blind spot is a synonym filed as an unplaced heading, and it is recorded here rather than claimed closed. Census held: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 15 / 10 / 6 / 3 / 2 / 1.
Council read 79 — the capital tier, read in both directions, 2026-09-15. The syntax review found WHILE, WHERE and EXIST inside normative rules, and both checkers passed them: Casing 2 says every reserved token is upper case, Casing 6 says a parser reads the tier from the case, and nothing checked the converse — that an upper-case word is reserved. check.py now does, deriving the reserved set from the grammar’s own declarations and holding no copy.

The sweep found six sites where the review saw three. Legal Hold’s Instance 7 and Retention Window’s Invariant 7.1 carried WHILE, a watched form never admitted; each is now an IF over an admitted operator, same obligation. Tamper Evidence’s Check 5.1 carried WHERE anchors EXIST and now takes the condition Operation 4 already states, the mechanism anchors at seal time. Idempotent Reservation’s Indeterminate outcome 6 and Defensible Retention’s Primitive policy 12 carried inflections — EXIST, EXCEEDING — now the operator itself. The grammar’s own Candidate form 3 named DEGRADES TO bare and now quotes it, as the meta-rules quote the tokens they govern; Surface 5’s WHAT is quoted for the same reason.

What the check does not decide. A proper noun in capitals — SOX, SEC, FRCP, BSA, AML in two compositions’ Capability requirement rules, KB in Audit Trail, GRACE and AI in ten of the grammar’s own rules — reads as reserved under Casing 6, and whether a rule may carry one is a ruling, not a repair. The split is mechanical: a word the grammar has named as a watched or provisional form, or an inflection of a reserved token, gates as R-caps; anything else reports as W-caps, fifteen sites, awaiting the maintainer. Six synthetic fixtures pin both sides, including a quoted form that must stay silent.

Census: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 held, and W-caps joins at 15.
Council read 78 — the stamp residue, refiled rather than cut, 2026-09-15. Council read 77 measured the stamp cut after the injection removal and found it needed no family. Twenty-one Clock semantics rules move out here, across twelve specifications, and none lands in a new family: Clock semantics 148 → 127, still across thirty.

Where each went. State takes what a record holds — Assignment’s no re-derived stamp, Observation’s supplied recorded_at stored as supplied and its timezone left alone, and the receipt instant Approval Step, Selective Disclosure and Soft Delete do not record. Composes takes which seam stamps what — Defensible Retention’s now withheld from a constituent, Actor Suspension’s substrate stamp left to the substrate, Recoverable Invocation’s records carrying only the substrate’s and the constituent’s stamps, which is that spec’s first labelled Composes rule. Action wiring takes Customer Onboarding’s per-outcome stamps and its next review due.

Six are not moves. Defensible Retention’s Clock semantics 2 and 3 repeated its own Action wiring 8 and 60 (Authority 3); its Clock semantics 7 through 10 restated four constituent rules — Retention Window Operation 13, Legal Hold Operation 9 and Operation 18a, Event Log Operation 2 (Authority 6).

The maintainer’s entailment ruling, applied with its evidence in the tombstone. Consent’s Clock semantics 7, Actor Suspension’s and Attributed Permissions Admin’s Clock semantics 2, and Recoverable Invocation’s Primitive policy 16 are each implied by a rule that stays, and each tombstone states the containment in one sentence from the spec’s own declarations — Z’s condition on the ruling, adopted here before the grammar carries it: if the containment cannot be said that way, the entailment is not claimed. Medication Order’s Clock semantics 3 was a definition written as a rule; the spec used resolved dispensed_at, resolved administered_at and resolved completed_at and declared none of them (Closed vocabulary 4), so the three are declared in the form five sibling atoms already use.

One universal was false. Customer Onboarding said an invocation stamps every timestamp from its own reading, and a completing closure records the closed_at Party Identity already holds (Action wiring 118). The universal is replaced by one rule per outcome, Action wiring 146 through 153, the closure’s scoped to a newly declared committing closure. The same rule in Actor Suspension was true — its three instances are every timestamp it stamps — and is retired as entailed. clock reading gives way to now in the one moved rule that carried it.

Census held exactly: 181 / 83 / 66 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1; the one advisory that moved is Recoverable Invocation’s W-or-word, relabelled with its rule.
Council read 77 — the injection bucket, swept by rule text, 2026-09-15. The maintainer routed Clock semantics’ injection bucket for deletion under Authority 6 — execution-contract.md §Logic confinement owns it — and asked that the stamp cut be measured after it. Read by family name the bucket was eighteen rules. Read by rule text it is ninety, in thirty-five specifications, across four families — 55 under Operation, 22 under Clock semantics, 11 under Capability requirement, 2 under Audit Trail’s Clock source — in eighteen spellings of three clauses the Contract already states: no clock read inside the guard or the transition, one reading per invocation shared by guard and stamp, and the reading never a caller’s argument. Each is tombstoned naming the Contract; the now declaration is the citation that remains.

The declaration had drifted with the rules. Five atoms — Credential, Invitation, Medication Order, Party Identity, Provisional Commitment — declared now as the clock reading the seam supplies for one call, the wording the maintainer ruled out, and named no owner, so deleting their rules would have left them citing nothing. They carry the canonical declaration now, and their term entries its reading. Attributed Permissions Admin’s declaration cited two labels this pass tombstones and is canonical too; Recoverable Invocation’s per-seam declaration gained the citation; Audit Trail’s vocabulary line cites the Contract where it cited two of the deleted rules.

Held out, each for a reason on its own page. Customer Onboarding’s Action wiring 144 and Defensible Retention’s Clock semantics 16 say a decision does not depend on time — the Clock dependence question as an instance — not where the reading comes from. Assignment’s Operation 30a and Retention Window’s Operation 21 each carry a sibling resting on that one now. Recoverable Invocation’s Primitive policy 14 meets Deviation 3b, where the adopter carries the reading to [Open]. Actor Identity’s, Event Log’s and Tamper Evidence’s the business caller MUST NOT supply a named stamp is stamp source, not injection.

The removal does not clear the stamp cut, and the stamp cut does not need a family. Three of its candidates — the window reading taken from the call’s own now, in Credential, Invitation and Provisional Commitment — were the Contract’s shared reading and went with this pass. Twenty remain under Clock semantics, while the corpus already homes per-action stamps under Operation, State, Identity and Action wiring at more than forty sites. The residue is a refiling, and part of it is not a refiling at all: Defensible Retention’s Clock semantics 2 and 3 restate its own Action wiring 8 and 60, and its Clock semantics 7 through 10 restate four constituent rules.

Census. W-duplicate-proposition 67 → 66: the heuristic had paired Personal Todo’s deleted Operation 27 (supply now) with Identity 4 (supply an id), a false pair. Everything else held at 181 / 83 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1. Clock semantics 170 → 148, still across thirty specifications.
Council read 76 — one obligation, thirty-three specifications, three families, five spellings, 2026-09-15. The chair proposed the stamp cut and the sweep refused it: a third of its members are the injection bucket already routed for deletion, the corpus already homes per-action stamps under Operation and State, and several of the rest are entailed by their own spec’s action rules. What the sweep found on the way is this entry, and the maintainer’s ruling turned it from a filing move into a normalization.

The host MUST read the clock at the seam, and four other ways of saying it. Twenty-two atoms stated it under Operation — one action’s rules, naming no action. Eleven specifications stated it under Capability requirement, which is what the deployment supplies, and three more under Clock semantics. Thirty-six rule-sites, thirty-three specifications, three families, five spellings — a count the chair first reported as four, corrected before the unit landed.

The spellings were not one obligation, and that is why this is a rewrite. Two of the five required one reading; three said nothing about how many. A host reading the clock twice in a call satisfied the twenty-two atoms and violated the three compositions — and the single shared reading is execution-contract.md conformance condition 2, which exists because the value a temporal guard validated is byte-identical to the value the transition stamps. Twenty-two specs were echoing that rule with the clause that carries it dropped.

The ruling, and it had already been made. now, and at the seam — the maintainer settled both earlier in the session, the first when Attributed Permissions Admin’s undeclared clock reading was fixed (“sounds like asking for errors”), the second on the possessive. The chair re-asked instead of applying them, which is the defect worth recording here: a ruling re-litigated is a ruling not applied. The canonical form is the spelling five specifications already carried: The deployment MUST supply now at the seam. The deployment because host is undeclared in five of the thirty-three; now because it is the declared term, and the cardinality lives in the declaration — the wall-time reading the host takes at the seam and hands to the transition — where the corpus keeps definitions rather than restating them in rules (Closed vocabulary 14).

What the normalization cost and what it closed. Thirty-three rules now read one sentence; six specifications gained the Terms › now declaration the form requires — Event Log, Login, Notification Fanout, Actor Suspension, Customer Onboarding, Defensible Retention; three carried the obligation twice, under two families, and the second copy is tombstoned. Before: thirty-three specifications state it, eleven reachable under the family whose meaning is what the deployment supplies. After: thirty-three and thirty-three.

The gate caught the chair’s own repair. Tombstoning Clock semantics 1 put a NOTE: on the first line of three fenced blocks, and Surface 18 classifies a fence by its first line — so thirteen, nine and ten labelled rules silently stopped being normative. F-prefix-first reported all three on the next run and the tombstones moved below each block’s first rule. A defect that would have been invisible to every reader and fatal to three compositions’ normative surface, found by an instrument in one run.

And the split was by migration date, not by meaning. All twenty-two Operation filings were migrated 2026-09-12; the five atoms that filed it correctly were migrated 2026-09-13, the day Capability requirement matured into the atom shape. Same stratigraphy the deployment obligations under Clock semantics showed: a spec files an obligation under whatever heading exists when it is written, and nothing sweeps back. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 across twenty-eight edited specs.
Council read 75 — the maintainer’s Clock dependence ruling, and the review that found the cut swept the wrong surface, 2026-09-15. Clock semantics holds 182 rules across 30 specs and answers at least five questions. The first is cut out here: whether, and under what condition, a guard’s decision may depend on the current clock reading. Twelve rules, seven specifications, one word of one rule changed and the change ruled.

The first cut was wrong and Z’s review is why this entry carries different numbers than the chair’s message did. That cut took its members from rules already labelled Clock semantics — seven rules, six specs — which is a sweep of a family name, not of the concept. Z named the cause exactly: a family cut out of rules needs a rule-text sweep, and the reading list the chair offered as evidence of completeness was built from Terms › declarations, which is evidence of nothing about rules. The corrected sweep reads every labelled rule in the corpus whose subject is a decision and whose operand is a clock reading, whatever family it sits under, and it returns twenty-four candidates.

What the label-scoped cut missed, and one of the misses falsifies the first cut’s own argument. Message Preference states both poles under Operation 42 and Operation 43, character-for-character the sentences two members already carry — and Consent’s own WHY names it as the contrast case (“its guards read the clock where Message Preference’s are forbidden to”), so the family’s own prose cited the spec the family excluded. Provenance states the guard pole under Operation 57, which falsifies the reason the first cut gave for admitting its rejection rule — that Provenance had no guard rule over now, its guard rule naming recorded_at. It has one; the chair had looked only where the family name was. The rule still belongs, by the gloss rather than by that argument. Capacity Constraint Enforcement states A guard MUST NOT read now twice, under Operation 64 and under Clock semantics 4 — one proposition, two owners, inside one spec (Authority 3), which W-duplicate-proposition has passed for as long as both have existed. Operation 64 is retired to a tombstone.

And what the sweep says is correctly outside. Five atoms carry The atom MUST NOT read now inside a transition — the Contract’s injection discipline, a different bucket. Three carry A check comparing two seams' stamps MUST run under the clock skew allowance — a comparison of stamps, not a decision on a reading. Audit Trail’s Clock source 1 restricts where the whole composition may read, not what a guard may rest on. And the yes-pole Z asked after is answered by the maintainer’s own test — the family rule does not enlarge because an Operation instantiates it: Legal Hold’s Operation 8 and 18 and Party Identity’s Operation 3 guard a supplied instant against now exactly as Consent’s Clock semantics 5 and 6 do, and all five are instances. Worth its own row: Legal Hold and Party Identity have guards that depend on the reading and state no general permission at all, so the family’s question is answered in those two specs only implicitly.

The ruling refused a rewrite the chair’s draft carried. A normalized reading restated Provenance’s rule with a guard as subject. Strictly stronger — a guard may read now and return pass, so no rejection rests on the reading; the original permits exactly that and the rewrite forbids it. Changing meaning under the guise of surface uniformity is a defect. It keeps rejection as its subject. Time guard was refused for council read 64’s naming hazard at seven-of-seven subject collision — every member reads A guard MUST … — on the maintainer’s criterion: name the recurring question, not the thing.

One rule was reworded, and the rewording is the ruling. Attributed Permissions Admin’s member said a clock reading at this composition where the other six say now, and declared neither term — nine uses of clock reading in that spec and no declaration for any of them (Closed vocabulary 4), passed by both checkers, in a spec the chair migrated four commits ago. The maintainer’s ruling — “a clock reading sounds like asking for errors” — settles it: the rule now states the family’s question over now, and the spec declares Terms › now beside the seam that supplies it. Every other move is byte-true against its pre-move blob, verified one rule at a time; this is the one declared exception to moved, not reworded.

Mechanics, and the count with its list attached. Twelve tombstones naming the new owner (Hard invariant 25); no label renumbered; labels local, so Capability, Capacity, Provenance, Session and Message Preference each carry Clock dependence 1 and 2, Consent and Attributed Permissions Admin carry 1. Both poles are present in five specs, which is the entailment question this entry routes rather than answers: where a spec carries both a guard MUST NOT read now and a rejection MUST NOT rest on now, the second is entailed by the first and the corpus has no ruling on whether a family carries an entailed pole or retires it. --promote 'Clock dependence' reports the family from rule forms rather than label mentions — twelve against twenty-five mentions, so Z’s inference that the counter measured the word is falsified by its own output. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.

The count went wrong four times in one unit and the last two were the reviewers’. Six, five, seven, twelve. Six was a rule count printed without its list. Five was Z’s spec list, correct for atoms and missing the composition. Seven was right for the label-scoped cut and wrong for the concept. Twelve is the first number printed with the list beside it, which is the only form of a count this register should accept from anyone.
Council read 74 — Claude on the promotion-time sweep, and a membership question that went wrong three times, 2026-09-15. The docket row council read 72 opened asked whether the cure for the Standard label 2 residue is a promotion-time sweep or a standing check. It is both, and the same twenty lines do both, because a family already standard is a hearing whose ruling has already been made. cites.py gains --promote and --standard.

The membership question is the sharper finding, and it is not a memory problem. How many families are standard? went wrong three times in two days across two readers, twice after an explicit correction — the chair’s handoff at read 71, and the reviewer’s sizing twice since, each carrying Audit arm, Reconciliation and Housekeeping as live candidates after they were promoted. A promoted family is recorded in a register entry and a grammar changelog and printed by nothing: cites.py has derived the standard set from Terms › standard label family since council read 38 and never offered it to a reader, so the answer was recalled rather than read. --standard prints the fourteen with the meaning the grammar declares for each. That is council read 71’s own sentence arriving one layer down — the counts are mechanical and the gates are not — except here the count was mechanical and had no output.

--promote stages the hearing and refuses to decide it. The maintainer supplies the meaning the promotion would declare; the tool lists the candidate’s member specs with rule counts, states Standard label 4’s threshold, and ranks every Terms › declaration in those specs by how much of that meaning it already carries. A first cut scored a verdict from that overlap and had to be thrown away: Audit arm’s meaning is written in the corpus’s commonest nouns — composition, audit, substrate, boundary — so the classifier fired on ordinary term entries in the very specs it was auditing. Word overlap is a reading order and not a finding, and Principle 8 says so anyway.

Four for four against the sites the three promotions actually converted. Run with the gloss each promotion declared, against the blob immediately before each trim: Actor Suspension’s sweep and Customer Onboarding’s reconciliation rank first in their specs at six words of Reconciliation’s meaning, Idempotent Reservation’s eviction leg at four and Attributed Permissions Admin’s failed-grant leg at three of Housekeeping’s. After the trims the top slot in every one of the four is an innocent entry at the floor — three of them the spec’s own actors line, which names a leg and an invocation because the spec has one. The tool would have put each of the four defects at the head of the reading list on the day the promotion created it.

And the third instance of one instrument biography is now a docket row. M-terms-doubled cut to one heading, M-orphan-forthcoming cut to mentioned rather than listed, V-dup-vocab cut to one direction: a check is written against the defect that was found, which scopes it to that specimen, and each of the three then ran green over a live defect of its own shape. The row’s cure is V-dead-vocab’s economics — one synthetic fixture per check, placed outside the specimen it was built on — and its open question is the one that keeps it a row rather than a sweep: a narrow check is not always a defect, and the test proposed is whether the check’s own message names a shape wider than the check reads. All three of these did. Corpus advisory census held at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1; no spec was touched.
Council read 73 — Claude on the doubled acceptance surfaces, and an instrument widened out of its first specimen, 2026-09-15. Council read 72 found two specs carrying ## Generation acceptance twice and did not repair them, on the reading that the doubling was load-bearing. It was, and the repair is the rest of two migrations rather than a deletion. Both are complete, and M-terms-doubled is widened to M-section-doubled and lands green.

What the prose copies actually carried. Mapping Login’s seven prose checks against its eleven migrated Check rules: five are covered, and two are covered better — prose check 1 quantified over session_to_credential, a lossy derived index, where Check 5.2 quantifies over the session store, which is truth. That replacement is what council read 72 mistook for a dropped carve-out. Two had no counterpart and are now rules: Check 3.3, the per-principal reconstruction, which needs the log and the orphan events because Invariant 4.2 names the sessions the log by construction does not carry; and Check 2.3, the map-degradation exit, since Action wiring 11 records a map write failure and nothing said when that record stops mattering. Idempotent Reservation’s prose named three deployment knobs — the idempotency window, the token max length, the digest function — declared as Capability requirement 1 through Capability requirement 3 and reachable from no external check; External check 7 through External check 9 close that.

Seven Ledger lines cited the prose copy, not six. Council read 72’s count was taken over a line range that stopped one line short of 2026-08-28-o, which is the same class of error as the stale docket two reads earlier and cheaper only because it was caught inside the repair. Five are re-pointed to the migrated labels they now aim at. One — 2026-08-27-l — is deleted: the sentence it quotes, “a half-committed pair cannot come from a conforming run”, appears nowhere in the spec, so the migration cured it and nobody closed the line. 2026-08-27-m stays open and is the sharpest of the seven: Invariant 5.1 still quantifies event-to-map absolutely, and Action wiring 11 describes exactly the conforming run that violates it — a login whose map write failed carries a login succeeded event and no map entry.

The instrument was cut to its first specimen and stayed cut from council read 30 to council read 72 — forty-two reads. M-terms-doubled was built for two ## Terms headings; the shape it reports is a spec with two owners for one section, and it named the one section it was found on. Widened across ## and ### in all fifty-four patterns it fires on exactly the two sites and nothing else — verified in both directions against the pre-repair blobs, three findings before and zero after, with five synthetic fixtures. That is M-orphan-forthcoming’s mentioned versus listed lesson arriving in a second instrument, and the honest generalization is the one worth carrying: a check written at its first specimen reports its first specimen. Nothing in this register records that audit having been run on the rest of the linter.

Instrument notes. The fixture wiring broke the test file mid-print on the first attempt and the suite reported it on the next run, which is the fix loop catching the fix rather than the draft, for the third time in this window. Five checks entered the corpus — two Check, three External check — and the corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 for the eleventh consecutive unit, which is the receipt that they were derived from prose already in the files rather than invented. The docket row council read 72 opened is amended rather than closed: the doubling half is now read by an instrument, and the position half — a promoted family sitting where the required-section list does not put it — is still read by nothing.
Council read 72 — Claude on the maintainer’s ordering question, and an instrument cut to its first specimen, 2026-09-15. The question was one line wide: the purpose of standardizing terms is ordering — is this problem captured? It was not. Council read 71 named the gap, asserted a docket row into existence that nobody had written, and left a conformance finding resting on its own memory. Both rows exist now, and the reading that produced them found a defect neither row predicted.

The row read 71 claimed and did not write. That entry ends “the docket row is therefore opened rather than deferred” about the Standard label 2 residue, and open-questions.md carried neither that row nor the position row the same entry’s third paragraph argues for. The claim was false when it was committed, and it is corrected here rather than by editing the entry — a register that repairs its own history quietly is worth less than one that carries the correction. Both rows now sit in §GRACE lang — the classes the migration is accumulating: a spec’s section list is declared and unread, and a promotion converts every local restatement into a defect — three promotions, four sites, none reported by anything (Customer Onboarding and Actor Suspension at read 69, Attributed Permissions Admin and Idempotent Reservation at read 71).

The finding: lint.py has read headings for this defect since council read 30, and was cut to the one heading it was found on. M-terms-doubled reports a migrated spec carrying two ## Terms headings — an extraction that began one heading too early. The shape is a spec with two owners for one section; the check names one section. Widening the same scan across every ## and ### heading in all fifty-four patterns returns exactly two more ## sites, and one ### site inside one of them: Login and Idempotent Reservation each carry ## Generation acceptance twice — the migrated rules in their declared position, and the pre-migration prose copy surviving after ## Standards references, with its own ### External checks beneath it in the second case. Both migrations left the old section standing, and both specs have passed the linter, the gate and a council read on every run since. That is the position row’s claim arriving as evidence rather than as an argument: the corpus declares a required-section list and nothing reads it.

The doubling is load-bearing, which is why the repair is not this unit. Six of Login’s open Ledger lines cite the prose section’s checks by ordinal, and the orphan carve-out finding 2026-08-28-n added lives only in that copy; two of its seven prose checks — the principal’s session-history reconstruction, and the login_map_write_failure resolution — have no counterpart among the eleven migrated Check rules. Deleting the stale section would drop a recorded fix and two auditor checks, so what is owed is the rest of a migration rather than a deletion: carry what the rules do not state, re-point the six lines, then remove the copy. Both specs now carry the finding as an open Ledger line, and the widened check lands with the repairs so it arrives green. Council read 37’s M-model-misplaced is the precedent for landing an instrument red against a cure the maintainer owns, and it is the weaker one: a deletion nobody has priced is not the same as twenty-four files nobody may move.

And read 71’s dangling finding is moved to where a finding lives. That entry recorded Idempotent Reservation’s ### Housekeeping heading — second, immediately after Composition state, where the pair’s declared slot is after Wiring decision — as resting on the register until that spec is next touched. It is touched here, so the finding is that spec’s Ledger line now rather than the register’s memory. The other two members were re-verified and both sit in the declared slot.
Council read 71 — the maintainer’s third promotion ruling, and the chair’s stale docket, 2026-09-15. The maintainer said promote the three. Two of the three were already promoted — Audit arm and Reconciliation landed at v0.42 in commit 8ebfc9f, council read 69 — and the chair’s own handoff had listed all three as open hearings, carrying the reviewer’s pre-promotion framing forward without checking it against the file. The stale line was the chair’s, in a handoff written the same session as the promotion it forgot. Housekeeping was the one live candidate, and it is promoted; the standard set goes from thirteen members to fourteen and the pair opened at v0.42 is closed on both sides.

The drift gate held, and the divergence a reader reaches for is the declaration’s own two poles. Three specifications name it: Authenticated Actor’s orphaned-credential leg, Idempotent Reservation’s eviction leg, Attributed Permissions Admin’s failed-grant leg. Every one runs outside every invocation, owes no closure window, refuses to repair what it finds, and refuses a constituent’s write. One removes where two report — which it may report, it may remove already admits — and the section each takes or refuses (Idempotent Reservation takes one, Authenticated Actor forbids one, Attributed Permissions Admin says nothing) tracks whether the leg writes at all rather than what the family means. One concept, with the family’s own declaration having anticipated the split.

Standard label 9’s position is the pair’s rather than the majority’s, and this is the first promotion where the two differ. For Wiring decision, Audit arm and Reconciliation the corpus agreed unanimously and the position was simply read off. Here two of three place the family after Wiring decision — where Reconciliation already sits — and Idempotent Reservation places it second, immediately after Composition state, a placement that predates the pair’s cut. The declared position is the pair’s slot, on the argument that a leg is a leg whichever side of the question it falls on, and Idempotent Reservation’s heading is recorded as a conformance finding against that spec rather than as a second position. No instrument reads section order, so the finding rests on this entry until that spec is next touched — which is a gap worth naming: the corpus can now declare a position it cannot check.

Per the ownership seam, execution-contract.md gained the classification in the same change — Housekeeping lowers to a scheduled read-and-report leg with its edges as guards and no constituent write, the compile-time distinction from Reconciliation being that it emits findings rather than records and carries no window. Second promotion running to trigger the seam.

And the Standard label 2 residue recurred exactly as council read 69 predicted it would. Two of the three specs declared their leg’s term in words that restated the family’s meaning — running outside an invocation, outside every invocation — which was domain prose while the family was local and is a second owner now that it is not. Both trimmed to a pointer plus the domain noun, as Defensible Retention’s sweep already had right. That entry said two sites is a repair and not a class, and that if a third promotion produced the same residue it is a check. This is the third promotion and it produced the same residue. The docket row is therefore opened rather than deferred: a promoted family silently converts every local restatement of it into a defect, and nothing in the toolchain reports the conversion.

What the ruling surfaced that nobody had asked for. Running the drift census for one candidate printed the whole non-standard set at three or more, and it is eleven families, not one: Clock semantics (30), Concurrency (27), String (16), Atomic writes (14), Action wiring (13), Composition state (11), Primitive policy (11), Indeterminate outcome (5), Expiry (3), Instance (3) and Housekeeping (3, now promoted). Every one crossed Standard label 4’s threshold — Clock semantics and Concurrency a very long time ago — and no drift gate has been run on any of them. The promotion path was built at council read 57 and has been used three times on families that happened to arrive while somebody was watching; the census has been reporting the rest on every run since council read 63 widened it, and nobody read the list. The counts are mechanical and the gates are not, which is the honest shape of the gap. Routed to the maintainer as a docket the ruling did not create and only made visible.
Council read 70 — Claude on the Attributed Permissions Admin migration, and the first leg to be classified by the promoted boundary, 2026-09-15. 118 KB of prose out, 113.8 KB of rules in — 337 labelled rules across fourteen families, nine invariant numbers unchanged, one of two Ledger lines closed. The migration’s own yield is one repair; its interesting yield is what the v0.42 promotion did to a leg this page had been calling something else for three rounds.

The leg is Housekeeping, and the name it has carried since it was prose is not the classification. The page calls it the Failed-Grant Reconciliation leg, three sibling compositions carry a Reconciliation family, and the inherited name would have put it there without a second thought. The boundary council read 69 promoted asks one question — does anything await the leg’s output? — and this leg answers no on every clause it already had: it reports and never writes, it never repairs an orphan, it calls no constituent write, and it promises no window in which an orphan closes. It promises none because nothing here can close one: an orphan attestation’s only resolution is a fresh administrative act by a caller under a fresh attestation, and a leg that could complete the grant behind an orphan would be a second writer over one attestation, breaking Invariant 7’s injectivity with no arm to catch it. So the family is the unawaited pole, and Housekeeping goes to three — a promotion candidate under Standard label 4 on the same day its twin was promoted, routed to the maintainer and not ruled. The pair the grammar declared has now classified a leg neither of its two original members resembled, on the question rather than on the resemblance, which is exactly what council read 64 cut it for.

The one repair, and it is the class Defensible Retention froze a rule for. [Verify Grant Attribution] read an absent attestation as a tamper signal — sound only under a retention scope that purges the pair as one unit, where nothing lawful can destroy an attestation while its grant stands. A deployment composing a per-store retention instead reaches the state that requirement was written to exclude, and the query then hands an auditor a forensic finding for a correctly-executed retention policy. The absent attestation now routes through the retention layer’s own purge record first: named there, the answer is not-applicable(purged), which the caller counts as consistent; named nowhere, the tamper reading stands. The retention scope became a declared capability and the purge record a served surface, because a query’s soundness resting on a must stated three sections away and unchecked at the point of use is the shape that fails quietly. That is Lawful destruction is answered before absence arriving at a third specimen, and the first where the false finding would have landed on the retention layer doing its job.

What the rewrite did not touch, and the restraint is the point. The page had been through seven gates and its two hardest decisions were already right: the pair-scoped revocation that exists because the write surface is keyed by a grant and the evaluation surface by a pair, and the concurrent-issue race declared rather than foreclosed. Both survive as rules with their costs stated in their own text — Action wiring 53 refuses the atomicity claim across the enumerated set, Invariant 9.3 refuses to state the invariant over the pair, and the caller’s terminal condition is the evaluation answering denied rather than a count. A migration that had “tidied” either into a stronger-sounding form would have converted a declared degradation into an undeclared one.

The instrument landed at council read 68 caught its first live case, on the first spec migrated after it. M-orphan-forthcoming fired on Binding Registry and Scope Registry — the extraction home this composition’s two attribution maps are pending against, and the scope-vocabulary owner it declines to. Binding Registry’s only prior appearance in roadmap.md was inside a prose progress paragraph, which is precisely the case the check’s tightening from mentioned to listed was built for two commits earlier and which the loose reading would have passed. Both now carry rows; the backlog stands at nineteen.

Instrument notes. Forty-four findings and twenty-two advisories on first assembly, and the shape repeats Actor Suspension’s exactly: forty-two of the forty-four were C-verb — one under-populated record-verb list — leaving one positive MUST … BEFORE and one pronoun as the real findings. That is twice running, and it is now a pattern rather than a slip: the verb list is the one part of a migration assembled by recall rather than derived from the document, and it is the one part that fails at scale. Worth a tool that derives the candidate set from the rules’ own modal positions before the first check runs; recorded here rather than built, because the cure is a tool change and this was a migration. Of the advisories, five were real duplicate propositions — all the chair’s, all a rule written once in Composes or Capability requirement and again in Wiring decision, Non-goal or Atomic writes — seven were W-comparator on past, and four were the familiar W-unconditional-effect on a query named as an unconditional subject. Six W-stale-census counts moved, Housekeeping among them. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 for the ninth consecutive migration, and the corpus linter is at zero across all fifty-four patterns.
Council read 69 — the maintainer’s second promotion ruling, and the first time two families crossed together, 2026-09-15. Audit arm and Reconciliation both stood at four specifications — the same four, Login, Defensible Retention, Customer Onboarding and Actor Suspension — and both are promoted. The standard set goes from eleven members to thirteen.

Audit arm is one concept, and the divergence a reader would reach for is an export rather than a meaning. Every member maps the substrate’s record_action taxonomy at the composing boundary and answers the same four questions: which arm is retryable, which arm arrives with the record already appended (so a blind retry double-appends), which is a pageable deployment fault, and what the composition owes on each. Login and Defensible Retention state it by step; Customer Onboarding and Actor Suspension state it by step and by position — recording-failure(intent | outcome) — which Login does not export at all. That is the same concept with an export the first two did not need, not two concepts: the step is what the substrate answers and the position is what the composition exports, and a member that never straddles a commit has no position to carry. All four agree on the load-bearing sentence, which is that the retention-step arm leaves the event in the log and must never be re-recorded.

Reconciliation is one concept, and the axis council read 64 cut it on is what proves it. That read held the family at three and re-cut it, sending the unawaited leg to Housekeeping on one question: does anything await you? The four members answer it identically, and each answers it with a declared window rather than a sentiment — Login’s reconciliation window, Defensible Retention’s and Customer Onboarding’s compensation window, Actor Suspension’s completion window — with the escalation rule that spends it (Reconciliation 13, 25, 19–20, 28–29). Housekeeping’s two members owe none. Beyond the window the four share the whole rule shape: run at instance start and on a declared cadence; bounded below by a completion bound and above by the audit horizon; pair an intent to an outcome by an invocation identity and never by resemblance; resolve against the constituents’ own stores rather than from remembered state; write under a declared service identity behind the leg’s own recovery intent. That is one concept stated five ways and the five are the same five. Read 64’s hold is what made this ruling cheap — the family that arrived at three carrying two concepts is not the family that arrived at four carrying one, and the difference is a re-cut rather than a year.

Standard label 9’s position was derived, not assigned. All four specifications already place Audit arm immediately before Action wiring and Reconciliation immediately after Wiring decision — four of four, with no coordination beyond the house shape — so spec-format.md §Required sections records the order the corpus had already agreed on. Per that file’s ownership seam, execution-contract.md §Section-name classification gained both in the same change: Audit arm lowers to the substrate-rejection mapping of §Substrate composition invocation plus the read-back that tells a landed record from an owed one, and Reconciliation to a scheduled leg with its two edges as guards and its writes under the service identity. An edit to one document naming the other in the same change is the seam’s own rule, and this is the first promotion to trigger it, because Wiring decision landed into a section that already existed.

The instruments needed nothing. cites.py derives the standard set from the grammar’s Terms › standard label family line — the cure council read 38 applied after a hand-copied set had been correct for four versions by luck — so both families stopped being reported as non-standard the moment the declaration changed, with no tool edit at all. lint.py’s W-stale-census likewise skips a standard family, so removing the two counts from §18’s watch list left it green. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.

And the promotion made two of the chair’s own declarations illegal. Standard label 2 forbids a specification redeclaring a standard family, and Customer Onboarding’s Terms › reconciliation and Actor Suspension’s Terms › sweep each stated the family’s meaning outright — the leg the composition runs outside any invocation, closing or escalating within a promised window — which was domain prose while the family was local and is a second owner now that it is not. Both are trimmed to what Defensible Retention already had right: a pointer to the spec’s own rules and the domain noun the leg works over. The lesson is the promotion’s own cost, and it is small but real: a family entering the standard set silently converts every local restatement of it into a defect, and nothing in the toolchain reports that conversion. Recorded here rather than docketed, because two sites is a repair and not a class — if a third promotion produces the same residue, it is a check.

What is left on the docket. Housekeeping stays at two, watched, and is now half of a pair whose other half is standard — §18 keeps its declaration and cites the grammar’s for the other, so the boundary question survives in the one place a fifth leg will look. No family stands at three.
Council read 68 — Z on the Actor Suspension migration, and the delegation graph nobody had drawn, 2026-09-15. The read’s verdict was pass on a pre-registered staging — the first review in this register graded against a classification table and family forecast written before the file was touched, four for four on the classifications and held on the families. Its one actionable flag is the entry’s subject: the migration names two forthcoming atoms — Actor Registry and Failed-Attempt Log — and “neither of which has a roadmap row; both want one at commit, or the extraction flags point at homes that don’t exist on paper.”

The flag was right and the scope was five times larger than the flag. A mechanical sweep of every *(forthcoming)* name in the migrated corpus returned seventeen with no row on the planning surface — fifteen absent from roadmap.md entirely, one named only inside a prose paragraph, and one that surfaced only when the check was tightened. roadmap.md is the declared single source of truth for library state, so each of those was a spec saying someone else owns this with no one listed: three of them — Actor Registry, Failed-Attempt Log and Condition Register — carry live extraction-pending classifications, which means three compositions’ Contract classifications pointed at proposals that existed nowhere but in the sentence naming them.

The cure is the instrument, and the rows are what the instrument then required. lint.py gains M-orphan-forthcoming, the sibling of D-stale-forthcoming: where D reads linked forthcoming markers that have since landed, M reads the named ones — the ones an extraction flag, a declined delegation or a Non-goal points at — and asks whether the home is listed at all. Five synthetic fixtures, no corpus pin: an unlisted forthcoming fires; a listed one, a linked one, an unmigrated spec and a single-word fragment stay silent. Verified by construction in both directions on three separate rows. A new §Forthcoming-pattern backlog carries all seventeen, each stating what the naming spec says the pattern owns, in that spec’s own terms, so a future drafter inherits the scope rather than re-deriving it. The rows carry no sequence number and are explicitly not commitments: a recorded delegation is not a plan.

The tightening is the part worth keeping. The check’s first cut asked whether the name appeared in roadmap.md at all, and it went green — which was wrong twice over. Reverse Index passed on an incidental mention inside a prose paragraph about capability provenance, and the second cut, requiring the name on a row (a table line, a list item or a heading), caught it. That cut then had its own leak: the corpus writes italic-opening paragraphs as *(a) …, which a naive starts with an asterisk test reads as a bullet, so the rule requires * with the space. With both corrections the check surfaced Condition Register — Recoverable Invocation’s findings register, extraction-pending since its 2026-09-10 round against an atom named in one sentence and nowhere else — which neither the hand sweep nor the loose check had found. Another instrument finding what the hand pass that motivated it missed, and the cleanest statement yet of why the loose reading is not a cheaper version of the strict one: mentioned and listed are different facts, and only one of them is a home.

And the check found a defect in the chair’s own last two commits. Customer Onboarding marked Resolve a Person’s Data Rights *(forthcoming)* at two sites — a composition that has existed since 2026-06-09 and sits in this corpus as partially resolved. The prose carried the error before the migration and the migration carried it forward, which is the failure mode a rewrite is supposed to catch and did not: a marker asserting a pattern does not exist, in a document whose whole discipline is that every delegation names a real owner. Both sites now link the composition. D-stale-forthcoming could never have caught it, because it reads links and this one was prose.

Two hearings still stacked, and neither moved here. Reconciliation stands at four and Audit arm at four, both past Standard label 4’s threshold with the drift evidence stageable on request. Principle 8 and Standard label 6 put both with the maintainer, and this entry opens no docket row for them: --drift plus read 63’s widened census report them on every run.
Council read 67 — Claude on the Actor Suspension migration, 2026-09-15. The first composition of the post-atom epoch to come out larger than it went in — 133.6 KB of prose, 144.1 KB of rules — and the reason is worth the line: this page had been through three gates under the frozen rules, so there was almost no redundancy left to squeeze, while 465 labelled rules across fifteen families pulled obligations out of sentences that had been carrying four apiece. Five invariant numbers unchanged; nine Ledger lines in, two out.

Seven closed, two open, and both that stay are the model’s. 2026-08-29-a and 2026-08-30-i are one debt seen twice — the .tla verifies a one-transaction cascade the composition retired a fortnight ago, and lacks the resume, the sweep, the high-water mark and the tail read. That is a model change, not a language one, and the rewrite has no business closing it. The seven that close are four repairs and three statement defects, and three of the four repairs are contract changes.

The sharpest is a trap the acceptance check could not escape. A planned member a constituent answers not-known for joined open_members — but the sweep closes only still-active planned members, so a handle the constituent had lost could never be closed: the actor stayed Suspending forever, and the every-planned-member-accounted check failed permanently against a cascade that had done everything available to it. Such a member is now unresolved, not open: named on the outcome as its own field, alerted on, not chased by the sweep, and the act completes. The predicate the check runs on is now accounted — closed, already terminal, or named unresolved — which is the third way the earlier form did not admit. Open means a door this composition can still close; unresolved means a door whose handle the constituent lost, and conflating them made a store inconsistency look like an unfinished suspension.

A rejection arm that invited the loop it was meant to prevent. A credential rotated between the intent and the outcome refused the outcome write, and the page mapped it to recording-failure(outcome) — whose contract is the revocations stand, resume rather than restart. A caller resuming on the credential that just refused resumes into the same refusal, forever. The credential arm now carries the position exactly as the recording arm does: invalid-credential(intent | outcome). The outcome position says the true thing — the revocations stand, this credential no longer attests, and the outcome is not this caller’s to write — which routes the act to a resume under a different verified operator, or to the sweep.

Two reads that were ambiguous in the direction that loses a record. The session enumeration said status = Active where Session carries both a stored status and one it derives at read time; enumerating by the derived status drops a lapsed-but-stored-active session from the plan, and the plan is the record of what the suspension set out to close. It now reads stored status, the member enters the plan, and its revoke answers benignly by the constituent’s own derivation. Separately, [Suspension Report] read the revoked set from a sealed payload the audit instance lawfully destroys at the horizon — and an empty enumeration there is a record saying nothing was closed, which is the exact class of false record this composition exists to prevent. It now answers the state, the instant, the operator and the binding, marking the enumeration unavailable-past-horizon.

And the count the corpus keeps losing. Invariant 4 asserted that no constituent invariant was weakened and enumerated them by number — all Permissions invariants (1–10), all Session invariants (1–11) — with the acceptance check naming five checks here and six there. Every one of those figures had moved. The rewrite quantifies instead (EVERY Permissions invariant MUST hold over the grant store), clears each constituent’s own bar over its own store, and writes the prohibition down as a rule of its own: Invariant 4.7: The composition MUST NOT count a constituent's invariants. Another hand-written census dead on inspection — the register has stopped numbering them — and the first to become a rule forbidding its own recurrence.

No family was minted, and the two candidates moved again. Fifteen families, every one standard or already recurring. Reconciliation reaches four and Audit arm four, both by the same three-spec set plus this one, and both remain routed rather than ruled (Principle 8, Standard label 6). This composition’s leg is the awaited pole without argument: Reconciliation 28 spends the completion_window explicitly, which is the one question council read 64’s boundary asks.

Instrument notes. Forty findings and twenty-three advisories on first assembly — far the worst of the epoch against 6, 7, 11, 13, 12, 3, 9 — and the number is honest but not comparable: thirty-eight of the forty were C-verb, a record-verb list the chair under-populated in one pass, of which six were hyphenated forms the checker cannot read at all (re-run, re-take, pre-check, re-read, re-query, bulk-revoke) and which were rewritten rather than declared, per the rule that a hyphenated verb after a modal is not a verb the grammar has. The two real findings were an OR in an obligation and one duplicated vocabulary entry. Of the twenty-three advisories, thirteen were W-unconditional-effect on the same shape Customer Onboarding hit — an action that rejects elsewhere named as the subject of an unconditional read — cured the same way, and seven were W-comparator on past, cured by declaring five aged-out terms. One W-duplicate-proposition was real and was the chair’s: the cascade gate written in Wiring decision and again in Invariant 3. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 for the eighth consecutive migration, and the corpus linter is at zero findings across all fifty-four patterns. Eight W-stale-census counts moved, none down.
Council read 66 — Claude on the Customer Onboarding migration, 2026-09-14. The corpus’s largest document at 180.5 KB, and the one the sequencing held back for a session of its own — fifteen compositions remain unmigrated behind it. 168.6 KB out, 488 labelled rules across fifteen families, eight invariant numbers unchanged — and the first migration whose Ledger came in carrying thirty-nine open lines and went out carrying one.

Thirty-eight closed, one open, and the accounting was written before any line was deleted. Twenty rhetorical and statement defects dissolve because the sentences carrying them no longer exist and the rules replacing them are single-owner — a garbled parenthetical, an unbalanced one, a missing | in a signature, a bare-attributive template glitch at a dozen sites, an enumeration phrased as a closed list, two unglossed acronyms. Seventeen were defects the rewrite had to repair rather than restate, and four of those are contract changes the page owed: an external path that guarded Closed alone, a repeatable action with no active-case guard, a state-unavailable mapped from a constituent arm the constituent does not declare, and an open-trigger set embedded verbatim in three payloads with no cap. One stays open: 2026-08-29-s, the model’s unbounded reconciliation, which is a model change and not a language one. The rule the count rests on is unchanged from read 63 — a migration closes a line only where a rule now owns what the line asked for.

The sharpest repair is the one the page argued against itself. Composition state flagged the monitoring schedule as extraction-pending against a proposed Review Schedule atom and, four sentences later, stated that every schedule-writing action stamps its result into its own audit event and the current deadline is the latest such payload in Event Log order. Both cannot be the classification, and execution-contract.md §Composition state asks exactly one question — is every fact derivable, at any time, from the constituents’ stores through their declared reads — which the spec’s own rebuild answers yes. The same reading settles the open-trigger set, whose whole lifecycle rides audit events and which the page nonetheless called a plain derived index beside the schedule’s flag. So all four indexes are derived, each horizon-bounded, each carrying a named rebuild and — new — a per-index definition of miss, because rebuild on miss had been stated three times and defined nowhere, and an empty trigger set, a false active flag and an absent post-closure placement are answers rather than gaps. The Review Schedule proposal survives as Non-goal 17: a concept named for someone to own, not a debt riding this composition’s classification. That closes the two Ledger lines nobody could close by argument — 2026-08-26-k, the flag asserting Pass 2 gates nobody ran, and 2026-08-29-l, Gate 3 applied unevenly across four elements.

A hole in the load-bearing guarantee, reachable from the ordinary path. The external branch admitted any party that was not Closed. A Suspended admit opened a case with an empty open-trigger set against a suspended party; a Verified admit passed the gate with no verification record of this composition’s at all — which is Invariant 2’s coverage broken by the intake action, not by a race. The guard is now Unverified and nothing else, and the party-closed arm folds into one parameterized [Party Not Admissible] naming the state found, because a second arm beside it would have split one guard’s answer across two codes.

state-unavailable was mapped from a contract the constituent does not have. Party Identity’s read declares two answers — the matching parties, or invalid-query — and neither is an unreadable store. The gate’s fail-closed behaviour is unchanged; what changed is where the page says it comes from: an unanswered read is execution-contract.md §Step 1 failure’s own name for it, and invalid-query is this composition’s defect, since every query it builds is built from its own indexes and no caller input reaches one.

Four of the page’s own claims were named by no acceptance check. Invariant 7’s open-trigger correspondence had none at all — cites.py --unchecked’s class and its fourth major specimen — and it is trivially clearable, because the set rebuilds from the trail by a procedure the spec already states. Invariant 4’s composition half had none either: Party Identity’s own invariant forces the fresh verification, and what no check reached was the part this composition adds — that the clearance record naming the verification exists, lands before the reinstatement, and is attested by the same actor the reinstatement was authorized under. Beside them, the active-relationship chain’s continuity and the joint-purge obligation now have checks, and two old checks were repaired rather than kept: every Closed party has a Retained placement convicted the lawful end of a record’s life, and the verification predates the activity is a cross-store wall-time claim in a spec whose own Clock semantics make timestamps advisory — so it now reads as a wall-time comparison exactly where the deployment composes a time anchor, and best-effort otherwise.

No family was minted, and two crossed the threshold. Fifteen families, every one standard or already recurring. Audit arm reaches three — Login, Defensible Retention and this one — and on its face one concept: how a composition answers the substrate’s record_action arms. Reconciliation reaches three again, and this time the members agree on the axis council read 64 cut them on: all three run outside any invocation, all three close residue, and all three owe a declared window — Reconciliation 19 here spends the compensation window explicitly, which is what put this leg on the awaited pole rather than beside Housekeeping. Both are Principle 8’s and Standard label 6’s, so both are routed and neither is ruled, and no docket row is opened for them: --drift plus read 63’s widened check report them on every run.

Instrument notes. Nine findings and sixty-three advisories on first assembly, against first-assembly counts of 6, 7, 11, 13, 12, 3 across this epoch — fourth of seven, which is worth stating because the tidy reading is now falsified twice. Council read 62 proposed that the count rises with document size; the two largest documents in the corpus have since produced 3 and 9 against a mid-series peak of 13 on a smaller one. The series is 6, 7, 11, 13, 12, 3, 9, and it tracks neither size nor practice. All nine were four classes: three undeclared record verbs, two seam-injection declarations naming no id, an OR in an obligation and a duplicated vocabulary entry. Fifty-six of the sixty-three advisories were K-check-bare — every check written without the rule it verifies — cured by citing one rule per check, which is also what surfaced the four unchecked claims above. Two duplicate propositions were real and both were the chair’s: a serialization obligation written in Capability requirement and again in Concurrency, and an ordering written in Audit arm and again in Atomic writes. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 for the seventh consecutive migration, and the corpus linter is at zero findings across all fifty-four patterns. Nine W-stale-census counts moved, one of them down — a ≥ term entry the rewrite dropped, the second migration running in which the count that fell was a ≥ census nobody would have thought to re-run.
Council read 65 — the maintainer’s acceptance-surface ruling, and the three atoms that had taken the option by saying nothing, 2026-09-14. Generation acceptance was optional for non-regulated primitives and three atoms took the option in the only way an optional section can be taken silently: Duplicate Prevention, Event Log and Personal Todo, all three from the earliest migration wave, carried no acceptance surface of any kind. Ruled: presence is mandatory for every migrated spec, satisfied by a section or by a declared decline, and for these three by sections.

The ruling’s shape is the hybrid, and the reason is that optional and absent read alike from one layer up. A spec now carries a Generation acceptance section with at least one Check or External check rule, or it declines by delegation — audit declined on its own Terms › qualifiers line, naming the pattern that owns the audit surface. Silence is the only thing outlawed. The point is not that every atom owes checks; it is that a composing pattern resting its own acceptance on a constituent can discover that constituent’s posture mechanically rather than by reading the file and inferring from an absence. lint.py gains Y-acceptance-surface for both shapes, with six synthetic fixtures — a section with a check and a decline naming an owner stay silent; silence, a section carrying no check, and a decline naming no owner each fire; an unmigrated spec is exempt — verified by disabling the check and watching three of the six go red.

Why sections rather than declines for these three, decided on the evidence rather than on the count. Eleven of the corpus’s compositions name one of the three, and the cost was being paid a layer up rather than by the atoms: Undo History rests thirteen Check rules on two constituents that audited none of their own rules, and Idempotent Reservation’s exactly-once claim — the corpus’s most-conditional guarantee — rests on its least-audited constituent. Duplicate Prevention went first for that reason and its checks were the cheapest in the corpus to write: eleven of them, six external, every one clearing from the recorded set and the atom’s own query surface. The three that earn the section are the stamp checks — a repeat record must not move recorded_at, which is the window’s monotonicity and is what a composing pattern’s guarantee actually rests on.

Event Log’s gap was the mildest in inheritance and the loudest in pedagogy. It is the corpus’s Start Here, the first pattern most readers meet, and it claimed append-only, total order and read consistency while the evidence for those claims lived in a formal model, a twin suite and five independent renders — none of which a first reader has met. Fifteen checks and six external checks are the bridge from the page to the evidence that already existed. The line that had to be written down is External check 4: append-only is not tamper-evidence. Every conformance check in that section passes over a log an adversary with store access rewrote, because the atom compares the log only against itself, and detecting the rewrite is Tamper Evidence’s. It was implied by two non-goals and stated by nothing.

Personal Todo’s section teaches the section. Fourteen checks, three external checks, each one reading of the list against one rule — and two of them are not decoration. The three timestamp checks keep the invariants’ conditional form rather than chaining them, because an auditor comparing added_at ≤ last_edited_at ≤ completed_at over every unit files against a list with nothing wrong with it: a pending unit carries no completed_at. And Check 3.4’s passing condition is that nothing happened — a no-op edit answers ok and writes nothing, so the records-alone evidence of conformance is a stamp that did not move, which is the only check in the three sections whose evidence is an absence.

The amendment, and where it landed. pressure-testing.md §Regulated-pattern conventions now splits the two conventions it had bound together: Regulated adversarial scenarios stays optional for non-regulated primitives, and Generation acceptance is mandatory for every migrated spec. The old rule’s argument — that a primitive’s bar reduces to the invariants hold and rejections surface — is true and was never a reason to leave the page silent, and the three sections written here are what that sentence was always asserting, made testable and inventing no obligation. contributing.md and spec-format.md were pointed at the amended rule rather than restating it, which keeps the presence rule with one owner and leaves the overlay owning the two-subsection structure and the records-alone bar.

What the ruling does not decide, and it is the maintainer’s. All three atoms stand grounded on Final Critique 4 — 2026-06-18, and a section derived entirely from a spec’s existing rules changes neither what a conforming implementation must do nor what a reviewer’s pass questions would check — it answers the Proof node’s question where the page had no answer. On that reading the touch is editorial and the status stands. The Status tokens were left untouched rather than downgraded, because whether methodology-required content arriving late re-passes a grounded pattern is a maturity ruling, and council read 50 put those with the maintainer.

Instrument notes. One advisory across all three sections on first assembly — a comparator in Duplicate Prevention’s Check 1.4, cured by routing through the atom’s own declared under guard rather than by spelling the window out, which is one site fewer for the ≥ docket row. Two vocabulary additions per atom (an auditor, find), and a V-dup-vocab on Event Log’s when the same fix added two verbs the list already carried — the check catching the fix rather than the draft, for the second time in this window. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1: forty checks and fifteen external checks entered the corpus and moved nothing, which is the receipt that the sections were derived rather than invented.
Council read 64 — the maintainer’s first promotion ruling, and the first family the gate has held, 2026-09-14. Two candidates arrived together from council read 63’s widened census. One promoted, one held and re-cut — which is the outcome the gate was built for and a better first result than two promotions would have been.

Wiring decision promoted, and the count is not the argument. Seven specifications name it, and the drift pass Standard label 7 requires found one concept across all seven in one invariant shape: a rule naming the decision positively, and one or more rules forbidding the wiring the decision rejected. Undo History restores through the replay and forbids the snapshot and the fresh add; Shared Todo recalls then deletes and forbids the transaction; Login cascades backward into live grants and forbids revoking the credential; Authenticated Actor gates forward and forbids asking the atom to refuse; Idempotent Reservation records every constituent answer and names the three it will not; Notification Fanout continues through a failed create and forbids the abort; Defensible Retention gates at the composition and forbids Legal Hold intercepting purge. Seven compositions, seven rejected alternatives, one shape. The argument that decided it is spec-format.md, which already requires The load-bearing wiring decision as a composition-shape section: the family is a container the corpus already carries having its rule form named, so promotion reconciles two documents that agreed and declining would have left them drifting. Standard label 9 needed no ruling either — all seven already sit in the position spec-format assigns, immediately after Action wiring. Landed as v0.41, declared once, and §18’s watch list loses the entry the standard set now owns.

Reconciliation held, and the reviewer falsified his own earlier praise to get there. Three specifications name it, so recurrence was met; the drift pass found two concepts. Login’s sweep revokes orphan sessions, re-emits owed records and escalates against a window; Defensible Retention’s emits recovery outcomes, retries a sibling purge and escalates against a window; Authenticated Actor’s leg states MUST NOT write, MUST NOT take a section and MUST NOT promise a closure window. Two compensate and owe a bound; one reports and owes none — which is exactly the fork council read 61 kept Eviction separate to preserve, now sitting inside the family that was minted to keep it visible.

And the axis that fork was cut on is wrong, which is the read’s real yield. Council read 61 split the two legs on one evicts and one reports, and Z had endorsed that as the read’s best lesson — families are concepts, not shapes — without testing it against every member. Run across all four legs in the corpus it predicts the liveness bound on two of them: Eviction takes a section and writes, to the composition’s own store, and owes no bound, so section-taking and writing had been conflated and the axis splits the wrong pairs. The chair’s writes to a constituent goes four for four, and Z then improved on it in turn: writing is a proxy that a fifth leg would break — one writing to its own extraction-pending store while discharging a promise would write nothing to a constituent and still owe a bound. The concept is the guarantee: does anything await the leg’s output? A caller or auditor with a promised window awaits Login’s cascade and Defensible Retention’s recovery outcomes, and those owe a bound. Nothing awaits an eviction or an orphan report, and those owe none. The corollary the lesson gains, in the reviewer’s own words: the discriminating axis is itself a claim, and it gets tested against every member, not the two that prompted it.

So the re-cut, and it is two renames rather than four. Reconciliation keeps Login and Defensible Retention, the two awaited legs, and drops to two specs. Authenticated Actor’s leg and Idempotent Reservation’s Eviction are one family under a name neither carried: Housekeeping, minted by the maintainer, covering an eviction and an orphan report equally and carrying the liveness answer in the word — nobody schedules housekeeping against a promised window. The word was argued against its near-neighbours rather than chosen: maintenance implies repair and these legs are forbidden to repair (Housekeeping 7); sweep collides with the awaited pole’s own rule text, since both Login’s and Defensible Retention’s legs call themselves sweeps; hygiene is an abstraction where the corpus wants a plain word. Housekeeping says what the promise-cut says, in the register the corpus already speaks. The naming hazard Z flagged decided the shape of the mint: both poles say “the sweep” in their rule text, so a family name may not collide with the members’ own subjects, and the two legs keep their own subjects (the eviction leg, the orphaned-credential leg) while the family names the concept. The rename rides v0.34’s relabel precedent — labels are words, and the words improved. No tombstone is owed: a rename deletes no rule and reserves no label, and every citation of the renamed labels was internal — two WHYs, three Check rules and one Non-goal WHY, all moved with the family, with nothing in the corpus citing either spec by label.

What this leaves on the docket. Both families now stand at two, so neither is a promotion candidate and the census says so mechanically on every run. The fifth leg is the interesting arrival: it tests the awaited axis the way the fourth tested the evict-versus-report one, and if it writes to its own store while discharging a promise, the definition survives and the proxy would not have. The pair’s boundary is declared once, in §18 beside the two counts, so a fifth leg finds it where the census that counts it lives. Recorded here rather than as a docket row, because a hand-maintained list of candidates would be the third hand-census and --drift plus council read 63’s widened check answer it on every run.
Council read 63 — Claude on the Defensible Retention migration, 2026-09-14. 141.5 KB of prose out, 113.3 KB of rules in — 387 labelled rules across sixteen families, ten invariant numbers unchanged, and the first migration whose Ledger came in carrying fifty-one open lines.

Fifty-one in, one out, and the arithmetic is the entry’s real content — including the arithmetic’s own first draft, which said forty-nine. The lines were two gates’ worth of refining and rhetorical findings, and reading them against the rewrite rather than against the prose sorted them in one pass: twenty-eight were statement defects the rewrite dissolves — a step number that moved, a check cited by the wrong number, a count that said three and listed two, an enumeration missing two codes, a claim stated three ways in three sections. Those close because the sentences carrying them no longer exist and the rules that replace them are single-owner. Eighteen were defects the rewrite had to repair rather than restate — an index miss answered not-known without a rebuild, a sibling left retained over a destroyed record, a pairing key narrower than the act, a rejection arm with no payload, an under-legal-hold carrying data its own signature did not declare, a liveness window missing two of its three terms. Four were examples that had gone stale against their own wiring and were re-run. One stays open: 2026-08-29-a, the formal model’s sweep, which is a model change and not a language one. The rule the count rests on is that a migration closes a line only where a rule now owns what the line asked for, and the per-line accounting was written out and checked before any line was deleted, because a Ledger that shrinks faster than the document improves is the corpus’s own worst failure mode. The classification was then re-derived from the deleted block rather than from the chair’s memory of writing it, which is how the entry’s own first three numbers — forty-nine, thirty-one, eleven, six, summing to forty-eight against a block of fifty-one — were caught. Tenth hand-written count of this rewrite to die on inspection, and the first to die against the artifact it was a count of.

No family was minted, and two moved. Sixteen families, every one standard or already recurring. Audit arm — Login minted it one migration earlier for the substrate’s answer set — reaches two specs here and meets Principle 2’s recurrence half; the arms differ in exactly one place and the difference is worth the second spec, because Login attests every record under its own service identity while this composition attests an invocation’s record under the caller’s credential and only the sweep’s under its own. So invalid-credential is a caller outcome on one path and a pageable deployment fault on the other, and two rules say so. Reconciliation reaches three and now stands as a promotion candidate under Standard label 4. Identity is the grammar’s own standard family taken by a composition for the first time: thirty specs carry it and all thirty are atoms that mint ids, where this composition mints none and what it owns is the equality the gate evaluates.

Two exported rejection surfaces were repaired, and both are contract changes rather than restatements. The prose mapped a constituent’s storage-failure onto recording-failure at four call sites — a failure to write a record renamed into a failure to record it, which is a different fact and a different repair — and it exported a bare recording-failure from the three non-destructive actions, one token covering nothing committed, retry and the constituent committed, the outcome did not. Both are now what the corpus’s frozen rules require: storage-failure surfaced as itself, and recording-failure(intent | outcome) on all four. The Ledger had both as open lines, one classified rhetorical, and neither was rhetorical — a token a caller switches on is a contract.

One writer per owed record, which the page had left to two. An out-of-band retry and the sweep both owed the same record_purged with nothing between them, so a second destruction record for one act was reachable — the one failure a compensating write cannot undo, because the trail then protects both. The invocation now retries to the completion bound and yields; past it the record is the sweep’s, which serializes its leg on the act’s invocation_id and re-reads the act’s outcome under that serialization. That is A compensator is exclusive applied to a page written before the rule was frozen.

Four checks the prose’s own acceptance did not carry, and the sharpest is the one nobody had noticed. Invariant 9.1 — the cross-retention gate, this composition’s second load-bearing claim — was named by no acceptance check at all, which is cites.py --unchecked’s class and its third major specimen after Retention Window’s and Consent’s. It is also trivially testable: every retention over a destroyed record sits in the constituent’s store and the destruction’s own instant is on the outcome, so the check is one comparison. Beside it, Check 2.6 reads the substrate’s purged verdict before absence — an outcome the audit instance lawfully destroyed answers failed-verification(purged), and an acceptance section that looked only for verified would have read a lawful destruction as tampering — and Check 5.7 and Check 5.8 are what the one-writer ruling earns.

Z’s read, taken on the assembled document, and the finding is not in the document. The verdict was pass, on receipts it ran rather than on the page’s claims — Composes 8 as the Contract’s worked instance-topology case, the substrate relation declared rather than accidental, the constituent notes discharged with attribution, and the half audit trail(./compositions/audit-trail.md)’s edge case does not cover routed to Non-goal 20 through Non-goal 23 rather than silently absorbed. It also cleared the citation posture the migration had not argued for: Audit Trail carries no numbering obligation of its own, unlike Event Log’s Composition note 5, so citing its Legal hold suspension of purge edge case by name breaks no rule — while noting the shape, which is the addressable-sections watch class arriving at the composition-to-composition layer for the first time: aim-risk only, and no instrument resolves a section citation anywhere.

The finding is that the promotion ruling is half-instrumented, and the census list is the second hand-census. W-stale-census was built at council read 33 against hand-written family counts, and it compares the counts somebody already wrote down — so a family can cross Standard label 4’s threshold of three in complete silence, because the list that would have carried it does not mention it. Reconciliation did exactly that, arriving at three in this migration with nothing reporting it; the chair added it and Audit arm to §18 by hand, which is the same cure that failed three times before. The check is now widened to the inverse reading: a family the corpus carries in three or more specs, outside the standard set, that the watch list does not name at all. Verified by construction in both directions — removing Reconciliation from the list makes it fire and naming the count, restoring it makes it silent — and it reports nothing else across all fifty-four patterns, so the list is complete as of this commit rather than merely consistent. This is read 58’s lesson one layer out, and Z’s phrasing is the one worth keeping: the census list itself is the second hand-census.

Two hearings the ruling now schedules, and neither is the chair’s. Reconciliation stands at three specs and is the promotion path’s first live candidate — and Standard label 7’s gate is the whole question here, because the three members differ on purpose: Authenticated Actor’s leg reports an orphaned credential and refuses a section, Login’s sweeps sessions and cascades, this one sweeps a destruction and retries a sibling purge. Whether that is one concept or three shapes wearing one heading is exactly what the drift pass exists to decide, and proof check is on the docket as the counter-example of a promotion made without it. Wiring decision stands at seven and crossed the bar five specs ago ungated, which the widened check would have reported had it existed. Both are Principle 8’s and Standard label 6’s — the maintainer decides every promotion — so they are routed rather than ruled, and no docket row is opened for them: a hand-maintained list of candidates would be the third hand-census, and --drift plus the widened check now answer the question mechanically on every run.

Instrument notes. Three findings and twenty advisories on first assembly, against first-assembly counts of 6, 7, 11, 13, 12 across this epoch — the lowest of the six and the first below the size trend, which is worth one sentence of caution rather than celebration: the document is the epoch’s largest and the count is its smallest, so the likeliest explanation is that the families were settled before the writing rather than during it. All three findings were one undeclared record verb used three times. The linter then found four orphan registry entries and eight W-stale-census counts — seven family counts the migration moved and one that moved down, because the old prose carried a ≥ in a term entry the rewrite dropped. §18’s census also gained two families it had never listed at all, Reconciliation and Audit arm, which W-stale-census could not have caught: it compares counts that are written, and cannot report a family nobody wrote down. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 for the sixth consecutive migration.
Council read 62 — Claude on the Login migration, 2026-09-14. The largest prose document in the corpus at 103 KB, and the first migrated spec whose constituent list names a composition. 77.6 KB out, 155 labelled rules across fourteen families, six invariant numbers unchanged.

A composition as substrate, and the seam that makes it legal. Audit Trail is a constituent here, not a peer — every record_action this wiring makes passes through it — which is execution-contract.md §Substrate composition invocation exercised for the first time on the migrated surface. The seam-direction ruling of council read 55 is what makes it cheap: atoms may bind compositions, compositions cite what they inherit and own what they add, so the Audit arm family states one arm rule per answer the substrate can give and cites nothing it did not add. The family is ten rules because the substrate’s answer set is wider than a caller’s intuition, and the WHY’s load-bearing paragraph is the invalid-request arm — the one a reader most wants to call unreachable and cannot, because the substrate raises it for its own retention-configuration faults and for an Event Log cap disagreement, neither of which any caller input controls. Its two sources land on opposite sides of is a record owed, and Audit arm 9 and Audit arm 10 are the rules that tell them apart.

No preservation claim to collapse, and three tombstones anyway. The four migrations before this one each spent one to three invariants restating what a constituent already guarantees, and each collapse ran through Composes. This spec carries none: every invariant emerges, and the constituents’ guarantees arrive as citations. What it does carry is three tombstones of a different kind — re-homings inside the document, where a claim was filed under the wrong family rather than under the wrong owner: Invariant 4.1 to Composition state 10, Non-goal 3 to Wiring decision 3, Non-goal 14 to Invariant 2.2. The distinction is worth the register line because the draft Decisions entry lost it and said nothing was tombstoned while three tombstones sat in the file. Eighth hand-written claim of this rewrite to die on inspection, and the first to die against the same document it was written in.

A label that is not a label, found by the grammar refusing it. Invariant 2a — a prose-era insert that never renumbered its siblings — is not a valid GRACE label at all, and nothing before the migration could say so, because prose has no label grammar to violate. It folded into Invariant 2 as 2.3 and 2.4. Beside it, a check that had never fired in the corpus fired here: Q-rebuild-bound, met by restoring the totality-bound phrase at the site the check reads rather than by weakening the check.

Reconciliation reaches recurrence, and the decision not to merge it holds. Council read 61 minted the family one migration earlier for Authenticated Actor’s orphaned-credential leg and left it flagged at one spec. The issuance-reconciliation sweep here is the same family rather than the same shape — both run outside any invocation, both report or close rather than serve a caller, both owe an age edge — so two consecutive specs meets Principle 2’s recurrence bar. Idempotent Reservation’s Eviction shares the shape and stays separate for the reason council read 61 gave: it evicts where these report, and that difference decides whether a liveness bound is owed. Eviction stays at one and stays flagged.

One docket move the migration made rather than argued. Council read 59 named Authenticated Actor’s attest_log atom as a question — an Attempt Log if the divergence from Event Log is real, nothing at all if it is Event Log wired with a composition-supplied entry schema — because the corpus was split and a question cannot be settled per-spec while the corpus disagrees with itself. Login is the third data point and it answers outright: login_event_log is extraction-pending against Event Log, a second instance for the login-attempt journal, at which point the classification question dissolves. With Notification Fanout having routed the identical concept out to Event Log from the start, two of three now say Event Log, and Authenticated Actor’s proposal should ride that ruling rather than mint a third answer. What would overturn it is a stated divergence — one obligation an attempt journal owes that Event Log’s append surface cannot carry — and no spec has named one. The row’s own count went with it: three compositions carry no classification is now two, because Authenticated Actor classified at migration, and the census behind the correction is the row’s best argument — every migrated composition carries a classification in some phrasing and no unmigrated one does, so the classification arrives with the rewrite unless somebody declares it first. Ninth hand-written number of this rewrite to move on inspection, and the first to move because the work fixed it rather than because a reader caught it.

Instrument notes. Twelve findings on first assembly — which is the number worth recording against the session’s own story. The maintainer observed mid-window that the findings have gone away; the data says otherwise. First-assembly counts across this epoch run 6, 7, 11, 13, 12, rising with document size rather than falling with practice. What has settled is measurable and is not that: the corpus advisory census has held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 across five consecutive migrations, and the family vocabulary has shifted from minting to recognition — Indeterminate outcome, Composition state and now Reconciliation all taken by recognition where the first compositions of the epoch minted. Twelve unregistered term markers stripped. The --unread list also resolved its own arithmetic on the way past — it reads 38 where the corpus holds 37 migrated specs, because the walker counts GRACE-lang.md’s own migrated qualifier line and the grammar is a document the council reads by version. Four W-stale-census counts updated (Action wiring 8→9, Primitive policy 6→7, Composition state 6→7, Wiring decision 5→6), which is the fifth consecutive read where the instrument caught the census rather than a reader. One tool repair on the way past: cites.py --unread named Session Gated Authorization as unread with council read 53 sitting in the register, because a register subject is prose and spells the name Session-Gated Authorization while the tool builds it from a file stem. A spelling difference reading as a missing review is the failure mode the --unread list exists to prevent, so the match is now hyphen- and case-insensitive; verified in both directions by renaming a live subject and watching the spec reappear.
Council read 61 — Claude on the Authenticated Actor migration, 2026-09-14. The largest document in the corpus at 99 KB, migrated on a classification settled two reads earlier — and the first migration where a check built in this window caught the chair on the document it was built for.

Classify, then migrate — an order worth keeping. Council read 59 declared both extraction-pending elements against the prose spec before a rule was written, and the Composition state family then wrote itself: eleven rules, the classification block carried across unchanged, the bijection as one element and the attest log as a question. The classification never depended on the language — execution-contract.md §Composition state turns on whether truth is reconstructible from constituent stores, which is a fact about the wiring — so settling it first cost nothing and removed the hardest decision from the rewrite. Every other composition discovered its state question mid-migration.

The fourth preservation-claim collapse, and the cheapest, for a reason the document earns. Invariant 5 — Constituent invariants preserved covered both constituents in one rule where Shared Todo spent three and Notification Fanout and Idempotent Reservation spent two each. One tombstone closes it. The reason is visible in the spec: every other invariant carries a Rests on: clause naming the constituent guarantees it leans on — provenance done properly at the invariant level, which is the discipline pressure-testing.md §Capability provenance asks for — and the blanket was the single place that discipline lapsed into a restatement. What it carried beyond the blanket survives as Composes 5 through Composes 10: no verify at the gate, no rotate, no revoke, no registry write, and the gate keyed on the pair rather than a credential_id, which is what makes a rotation keep the surface open and a revocation close it.

A second leg-outside-an-invocation, deliberately not merged with the first. Reconciliation is minted for the orphaned-credential leg, which is the same shape as Idempotent Reservation’s Eviction — a leg running outside any invocation — and is not the same family. One evicts and one reports; one takes a section and one refuses to; and the difference decides whether either owes a liveness bound, which is the whole question a reader comes to those rules with. Merging them on shape would have buried it. Two names, one spec each, both flagged and both waiting under council read 57’s promotion path — and the pair is now the evidence that leg outside an invocation is a shape the corpus keeps needing and has no declared form for.

The new check earned itself on the fourth try. F-tombstone-orphan, added at council read 57 after the chair placed tombstones in a fence of their own three migrations running, fired here on the fourth — same hand, same error, caught by a rule written for it two reads earlier rather than by a reviewer or a later X-ref. That is the fastest an instrument in this corpus has paid for itself.

Instrument notes. Thirteen findings on first assembly, in the mid-teens the size predicted: three B-before, seven undeclared record verbs, two X-ref — one the chair’s own WHY citing the deleted label, one a bare Invariant 8 in carried prose that meant Credential’s, which is council read 32’s unqualified-cross-spec class surviving a migration inside quoted text for the second time in three documents — and the F-tombstone-orphan. Three advisories cleared after: an unnamed action, a composition note restating an invariant, a watch word. One K-output-noun fired on the chair’s own register prose, where application meant an instance of applying a ruling rather than a build output — a false positive by meaning and a true one by rule, reworded rather than argued with. Fourteen term markers stripped for want of a registry entry, all fifteen rule-bearing terms declared. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 60 — GLM on the working tree, 2026-09-14. Not a spec read: a read of the repository, and the first council finding whose subject is the corpus’s own history rather than its contents. Three claims, all verified against git log.

Two migrations, one missing commit boundary, and the tree holding both. Idempotent Reservation’s 403-line migration is uncommitted — its last commit is 1fc08d8, four commits back and about something else entirely — while Authenticated Actor’s pre-migration classification sits on top of it in the same tree. And Notification Fanout’s 382-line migration rides inside 60949f2, whose subject is Rule label-family promotion; instrument the tombstone-orphan: accurate for three of its four files, silent on the largest.

Why that is a corpus defect and not untidiness. The Ledger reform makes git log -- <file> the per-pattern rationale index — every migrated spec’s Decisions section says so in its own words, everything smaller lives in the commit that made it. For one composition that index now returns a commit about a grammar ruling, so a reader following the corpus’s own instruction lands on the wrong reasoning. History is pushed, so the cure is a line in the register rather than a rewrite, and read 56’s entry now carries it. The same shape as eae32fd one row over: a defect that cannot be fixed, only addressed.

The cause is the chair’s and it is specific. A commit message was proposed, the maintainer said next, and the next piece of work began on a tree still holding the last. The habit was to check git status before starting a migration — which passed every time, because the tree was clean at each migration’s start — and the gap is everything that happens after a message is proposed: a ruling, a checker rule, a fix pass. Twice now. The rule is one migration, one commit, one read, and the check that enforces it is a clean tree before any new work, not before a migration.

The reviewer’s own finding about the finding is worth keeping. It arrived because a reviewer with instruments read the repository rather than the document — the second time this window that running something found what reading could not, after the same reviewer’s grep corrected a rule count the chair had written twice. A corpus that instruments its documents and not its history has an unwatched surface, and this is the first read to stand on it.
Council read 59 — Claude on Authenticated Actor’s composition state, before the migration, 2026-09-14. A finding that landed while reading for a migration and stopped it: the largest spec in the corpus owns three truth-bearing elements and declares no classification for any of them, and the cause turns out to be a class rather than an omission.

The rule and the trigger, both stated outright. execution-contract.md §Composition state is unconditional — composition state that carries truth not reconstructible from constituent stores is a not-yet-extracted atom, declared as extraction-pending with the proposed atom named, because an unflagged truth-bearing composition store is a conformance finding; a flagged one is recorded debt. Authenticated Actor states the trigger in its own words three paragraphs above the state section: the bijective binding is a surface this composition needs that no constituent provides — Credential keys on principal_ref, Actor Identity keys on actor_ref, neither relates the two. The spec proves the rule applies and then does not apply it.

The cause is a second question that reads like an answer to the first. Authenticated Actor answers §Capability provenance at length and correctly: the binding is a composition-introduced surface, one of the four admitted sources, with the uniqueness-scope tell named. That is a real answer to a real question and it is not this one. Provenance asks whether a composition may hold a capability; extraction asks whether the truth it holds is an unextracted atom. They are orthogonal, and answering the first convincingly reads as having discharged the second — Idempotent Reservation could equally have claimed provenance and instead declared the flag, and nothing in either document says which a composition owes.

Three, not one. A census over the composition set finds three carrying no classification of any kind — Authenticated Actor, Compensable Workflow, Resolve a Person’s Data Rights — and all three describe owning emergent state. The first cut of that census reported eight, because it matched Contract classification with a capital C and four of the eight were this session’s own migrations carrying the phrase lower-cased in a WHY. Word-versus-form again, caught before it was reported, which is the one encouraging thing about it.

Both classifications declared, and the atoms named, on the maintainer’s ruling. principal_to_actor and actor_to_principal are one element — a bijection held as two directions with a uniqueness constraint per side — and the proposed atom is a Namespace Binding: immutable, bijective, unique on both keys, no lifecycle beyond bound. Any pattern joining two constituents that key on different opaque namespaces needs it, so the shape is not this composition’s alone. attest_log is the second and is named as a question rather than a shape, because the corpus disagrees with itself: Login holds the same login_event_log, and Notification Fanout routes the identical concept out to Event Log rather than holding it. Three compositions, two answers — so the proposal is an Attempt Log if the divergence from Event Log is real, and nothing at all if it is Event Log wired with a composition-supplied entry schema. Naming a proposal is what the rule asks for and is not the extraction.

And the read stopped the migration rather than carrying it. Authenticated Actor is 99 KB, a third larger than anything migrated so far, and the finding arrived before a line was written. Compressing the largest spec in the corpus against the end of a long session is the shape that produced the fabricated Ledger lines this window already has on its record, so the finding was filed and the rewrite was not started. A verified finding beats a rushed migration of the document every other composition’s authentication story leans on.
Council read 58 — Claude on the Idempotent Reservation migration, 2026-09-14. The densest document in the corpus and the first migrated composition that carries truth no replay of its constituents reproduces.

The extraction-pending element, carried on the rule surface. token_results maps a token to the outcome returned for it, and that is reconstructible from neither constituent: Duplicate Prevention answers have I seen this identity — membership, no payload — and does not act on a result. execution-contract.md §Composition state calls such an element a not-yet-extracted atom and says the flag is the whole difference: an unflagged truth-bearing composition store is a conformance finding, a flagged one is scheduled debt. So the map is ten Composition state rules with the classification named and the proposed atom named (an Idempotency Result Memo — token → result, write-once, window-governed eviction), rather than a paragraph, because a flag an instrument cannot find is not a flag. Every other migrated composition’s state section said none; this is the first with something to say.

One family minted, and the reason is a shape no other composition has. Eviction carries nine rules about the only leg in the corpus that runs outside an invocation — with its own lower edge (nothing younger than the completion bound, below which an invocation may still be in flight), its own upper edge (past the window, where Invariant 7 already treats the token as fresh), its own exclusion against the invocations it runs beside, and its own refusal to do anything but evict, which is why it owes no liveness bound. Folding that into Composition state would have buried the surface a reader most needs. One spec, flagged, waiting on recurrence under council read 57’s promotion path.

Third preservation-claim collapse, and the first where what survives is a call pattern rather than a posture. Invariant 5 and Invariant 6 tombstoned to Composes 5. What they carried beyond the blanket is Composes 6 — the unchanged relay of a constituent rejection — and Composes 7, call Duplicate Prevention’s record exactly once per admitted first invocation, which is this composition’s own call discipline and not a property of the atom. The distinction matters because Invariant 6’s prose described the two extra record calls the composition makes in repair arms, and a blanket citation would have thrown that away.

The corpus’s only invariant conditioned on declared capabilities stays conditional. Invariant 8.1 makes the exactly-once claim only if the deployment declares the per-token section, the token-results durability and Duplicate Prevention’s store obligations. External check 5 is what makes it auditable — none of the three is a record, so an auditor who cleared the record checks and stopped would report exactly-once for a deployment declaring none of them.

And the ruling written one read earlier grew its own second census, caught by its own instrument. Council read 57’s Standard label NOTE listed eleven candidate families with counts. §18’s family clause already carries those counts, so the corpus briefly had two hand-maintained censuses of one thing — the precise defect the census discipline exists to prevent, and the fourth instance of it in this window. W-stale-census reported one family twice on the next run, which is how it surfaced. The NOTE now carries no counts and points at §18 instead. A rule about not hand-writing numbers should not hand-write numbers.

One number, caught by a reviewer counting the fence rather than trusting the sentence. The first draft of this entry, and the commit message with it, said nine Composition state rules. The fence carries ten. Seventh hand-written number in this window to die on inspection, and the first the reviewer caught by reading the file after quoting the message’s figure back at it — which is the two-hands rule working at its narrowest and most useful width. The register is corrected here; where the message has landed, the next commit carries the note, which is the cure the eae32fd row established.

And the reviewer’s staged flag, run now rather than at an epoch pause. Thirteen term markers were stripped in this migration rather than given invented entries, and council read 45’s class asks whether any stripped term is load-bearing in a rule with no address. Audited: all fifteen terms the rules turn on carry a Terms › declaration, so every one has an owner even where it has no registry card. The registry entry is reader sugar; the declaration is the address, and the stripping took the first and left the second. The class rested here.

Instrument notes. Eleven findings on first assembly: four B-before (the composition states four orderings and each wanted ONLY AFTER), one V-or-obligation, six undeclared record verbs — and then V-dup-vocab, because the fix declared four verbs the list already carried. That is the Undo History reapply hazard inverted: there a dedup removed a live member, here a fix added a duplicate, and the same check catches both directions. Four advisories cleared afterwards, two of them W-duplicate-proposition where Action wiring restated Composition state’s write ordering — tombstoned to it, since the state family owns when a write lands. Thirteen term markers with no registry entry were stripped rather than given invented entries. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.
Council read 57 — the maintainer’s label-family promotion ruling, and the instrument for a defect the chair made three times, 2026-09-14.

The ruling, captured as Standard label 4 through Standard label 12 in §5. A family three specifications name stands as a promotion candidate; two forbids one; the maintainer decides every promotion, which is Principle 8 restated locally because a promotion is an admission. The threshold is written as a pair of rules rather than as one inequality because the grammar carries no ≥ — three names a candidate, two forbids one, and together they say what ≥ 3 would. That is the open ≥ docket row’s first appearance inside the grammar’s own text, and it is one more site the operator would have served and one more the term-and-pair cure covers.

The gate is the ruling’s real content. Standard label 7 requires a promotion to rest on a drift pass finding the candidate’s specifications carrying one concept. A name reaching three specs proves recurrence and proves nothing about meaning, and the corpus already has the counter-example on its docket: proof check was declared by two atoms with different members (council read 13), which is what a promotion without this gate would have put the grammar’s authority behind. Recurrence is the trigger; sameness of concept is the test.

Position, settled without a second ranking. Standard label 9 gives a promoted family the place spec-format.md §Required sections already assigns in the dependence order — Identity → State → Operation → Invariant → Check → Non-goal, with the composition frame on the same spine — and Standard label 10 forbids ranking a family any other way. Standard label 11 keeps presence optional and Standard label 12 makes the order checkable wherever two families are present, which is the pair that lets an instrument read a spec’s shape without the spec declaring it.

The census, derived not written. Eleven families stand at three or more: Clock semantics (26), Concurrency (22), String (16), Atomic writes (10), Action wiring (6), Primitive policy (4), Indeterminate outcome (4), Composition state (4), Wiring decision (3), Instance (3), Expiry (3). Written into the NOTE with the date attached and W-stale-census comparing every count against the corpus on each run, which is the discipline council read 33 built after three hand-written censuses died in three days.

And the instrument, for a defect the chair produced three migrations running. check.py gains F-tombstone-orphan. F-prefix-first has caught the tombstone-at-a-fence’s-head shape since council read 15, and its condition is if labelled and TOMBSTONE.match(first) — so a fence carrying tombstones and no live rule slipped past it, because labelled is zero. Surface 22 then makes the whole block non-normative, the deletion reserves nothing, and the tombstoned labels surface as X-ref against the spec’s own tombstones — which is how it arrived each time, disguised as a citation defect rather than a placement one. Shared Todo and Notification Fanout both shipped it on first assembly and Consent hit the same rule from the other end; three documents, three days, one hand. Verified by construction — a fence of one tombstone and no rule now reports, and the check finds nothing across all 54 patterns, where every tombstone is placed correctly. The corpus advisory census is unmoved.

The lesson is the one the corpus keeps relearning about itself: a defect a writer repeats is not a writer’s defect. It took three instances before the chair proposed the check instead of remembering harder, and the maintainer’s add your rule of course is the correct impatience.
Council read 56 — Claude on the Notification Fanout migration, 2026-09-14. The largest composition migrated so far at 62 KB, the first with a Ledger carrying a live worklist, and the first where the migration’s job included deciding which of that worklist it had actually closed.

The frame held at double the size, and two families arrived by recognition rather than by minting. The prose’s Retry semantics section is the Indeterminate outcome family — the caller-side discipline Approval Step, Medication Order and Party Identity already carry — so it was taken rather than named afresh, which puts that family at four specs and makes this the first composition to hold it. The prose’s Logic confinement section is Capability requirement, the standard family, because what it states is what the host must supply. Nothing minted. Clock semantics reached 26 specs, Action wiring 6, Primitive policy 4, Wiring decision 3 — the last of those crossing from recurrence just met to established in a single day.

The preservation-claim collapse, third instance, and this one was easy because the prose had already done the thinking. The invariant preamble read Invariant 1 through 5 and 8 emerge from the composition; Invariants 6 and 7 are preservation claims — the distinction council read 53’s ruling needs, drawn by the author two months before the ruling existed. Both tombstoned to Composes 7 citing execution-contract.md §Conformance. What they carried beyond the blanket survives as Composes 5 and Composes 6: reading the subscription store only through subscribers_for and refusing to reach past create are this composition’s own restraint, not guarantees either atom makes about a caller.

This composition’s treatment of the lost answer is the corpus’s best and the docket row should say so. An unrecordable create is classified at the boundary as indeterminate rather than as no record, because a timed-out call may have committed a record whose id never returned. The spec then proves the residue is irreducible from the bare atoms: pending_for answers only still-pending records so one already delivered is invisible; a payload is not a fanout identity, since Notification permits any number of records over one (recipient_ref, payload) pair; and create declares no idempotency key. So a retry is at-least-once, Invariant 4.2 is scoped to records the composition observed, and Indeterminate outcome 7 names Idempotent Reservation as the cure rather than promising one. Every other specimen on that row either self-detects or duplicates visibly; this one proves its own irreducibility and scopes the invariant to match.

Seven of the Ledger’s thirty-five open lines are closed by the migration, and one of the seven had to be earned twice. -g (an unconditional coverage claim needing the crash bound), -h (an acceptance preamble opening universally where two checks need a composed Event Log), -i (Notification’s own acceptance classified both record-clearable and external), -l (the constituents’ divergent non-empty definitions left unnamed), -n (an invariant enumerating all nine Notification invariants, closed by that invariant’s deletion) and 2026-08-28-h are struck. -k — invalid-request’s provenance stated two ways — was struck on the strength of the Action wiring repair, and the Terms preamble still called it the one inherited rejection two paragraphs later. The strike was a false receipt for about ten minutes; it was made true rather than retracted. Twenty-eight lines remain open and are left open, because they are a worklist rather than migration debris and this spec is the corpus’s least-resolved by a wide margin — status: partially resolved is accurate and untouched, as are formal: and last gate:.

Instrument notes. Fourteen findings on first assembly, the most of the epoch and proportionate to the size. Two B-before, three V-or-obligation (the created-or-failed disjunction, which EXACTLY ONE OF states better anyway since a subscriber lands in exactly one), four undeclared record verbs, a B-banned on AT LEAST in the entropy floor — cured by declaring entropy floor as a term, which is the same move length bound took — three watch-words, two duplicate propositions, and an X-ref on a bare Invariant 9 in carried-over prose that meant Subscription’s, which is council read 32’s unqualified-cross-spec class surviving a migration inside quoted text. And the tombstone-fence error for the third consecutive migration: two tombstones placed in a fence of their own read as references to rules that do not exist. Third specimen, third document, same hand. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1.

Where this migration landed, recorded because the log does not say so. It rides in commit 60949f2, whose subject is Rule label-family promotion; instrument the tombstone-orphan — correct for three of its four files and silent on the largest. git log -- compositions/notification-fanout.md therefore returns a commit about something else, and the Ledger reform makes that log the per-pattern rationale index, so for one composition the index points at the wrong reasoning. History is pushed, so this line is the cure. The cause is the chair’s: a commit message was proposed, the maintainer moved to the next piece of work, and the next piece was started on a tree still holding the last — twice, since Idempotent Reservation’s migration then sat uncommitted while Authenticated Actor’s classification was written on top of it. One migration, one commit, one read, and the check is a clean git status before new work begins rather than only before a migration begins (council read 60).
Council read 55 — Claude on the Shared Todo migration, 2026-09-14. Three constituents rather than two, and the epoch’s first composition where the migration deleted rules rather than only restating them. Council read 53’s ruling did the deleting, at a seam it had not been applied to.

Three invariants asserting a constituent’s invariants hold are one citation. The prose carried Invariant 6, Invariant 7 and Invariant 8 — Personal Todo’s invariants preserved, Assignment’s invariants preserved, Permissions’ invariants preserved — each asserting that a constituent’s guarantees hold over this composition’s instance, two of them enumerating specific constituent invariant numbers underneath. execution-contract.md §Conformance already settles all three: conformance extends recursively, and no composing layer is obligated to re-verify what the substrate’s own conformance already establishes — inheriting a guarantee by reference is the point of naming a substrate. So the three were a citing spec restating a rule it cites (Authority 6), which is council read 53’s ruling arriving at a second seam — there an atom’s composition note, here the contract itself. All three tombstoned to one Composes 6.

What the three carried beyond the blanket survives, and separating it was the work. The relay of an unchanged constituent rejection is not inherited — a constituent’s guarantee says nothing about whether the composing layer passes the constituent’s refusal through intact — so that is Composes 9. And Invariant 2.1 stands where Invariant 7 fell for a reason worth stating: Assignment’s at-most-one-active guarantee is per instance, so the claim over this task list depends on Composes 3’s decision that exactly one Assignment instance serves the composition. Two instances would satisfy the atom and break the composition. An inherited guarantee is only reachable through the topology the composing layer chose, and the choice is the composition’s own.

A constituent assignment can be declined, and the corpus has no form for it. Assignment’s Composition note 4 says a composing pattern MUST own whether a completed task’s assignment is recalled, and this composition does not — both answers are defensible (an Active assignment on a Done task is completion attribution; recalling it is a clean close) so the prose supports either and the deployment picks. Permissions’s Composition note 3 says a composing pattern MUST own the binding between the authenticated caller and the subject_ref, and this composition passes actor_ref through unauthenticated. Both are MUST own obligations discharged by nobody. The migration wrote the declining down — Non-goal 4 and Non-goal 12 refuse, Composition note 2 and Composition note 3 re-assign to the deployment by name — because a composition that neither owns an assignment nor names a receiver leaves an obligation falling between two layers with no rule anywhere holding it. Passing it down with the receiver named is the most a composition can do; that there is no declared form for doing so is the new docket row.

Wiring decision reached recurrence. The family was minted for Undo History’s load-bearing decision and had one spec; the cascade-on-delete rule is the same slot here, and taking it rather than minting Cascade puts the family at two. Principle 2’s recurrence half is met and §18’s census carries it. That is the one family vocabulary or two row’s third data point and it points the same way as the first two: a composition’s families are the surfaces it has, drawn from a pool that is filling rather than a list that is growing.

Instrument notes. Seven findings on first assembly, all mechanical. Two B-before — a positive MUST … BEFORE, which the grammar admits only as ONLY AFTER (Timing 6) — in the two rules that state the composition’s two orderings, which is where they would be. Three X-ref from putting the three tombstones in a fence of their own: a tombstone must share a fence with a live rule or it reads as a reference to a rule that does not exist, which is the same placement hazard as F-prefix-first from the other end and the fourth tombstone-placement defect in three days. An OR outside a condition, a C-verb on an undeclared rewire, and four comparator advisories (AT MOST, no longer) cleared by rephrasing rather than by declaring anything. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1 and the Ledger is byte-identical.

Two findings from the reviewer, both in git rather than in a spec, and both permanent. Commit eae32fd shipped the pre-correction draft of the multitasking-keyword message: it asserts 290 and 85 as site counts, calls them the 224 bare sites, and closes by reporting a defect that does not exist — the subdivision sums to 80 of 85, five sites classified nowhere — where the subdivision does sum and the real defect was measuring a word rather than a form. The correction landed in the docket row hours later and nothing linked the two, so a reader grepping a census number would find a committed wrong number and no pointer. Pushed, so unamendable; the row now names the commit, which is the durable direction, since a reader chases the row and not the history. The same commit’s subject line is a paste artifact — Z:" not sure if you need any of this. ahead of the real title — which is the prompts-stay-in-chat rule finding the one repo artifact it never covered. A commit message is written in chat and lands in the repo permanently, and nothing in the corpus says so.
Council read 54 — Claude clearing council read 48’s Consent findings, 2026-09-14. Not a read but a fix pass, run under a standing rule the maintainer set the same day: fix findings in the pass that finds them, and route only genuine corpus-wide sweeps. Council read 48 recorded five Consent findings and repaired none, because the local shell was down and because the chair was routing anything that touched logic. Two of the five were never rulings.

The atom’s sharpest guarantee now has checks. Invariant 10 — point-in-time faithfulness, the reason at_time exists — was named by no acceptance check, which is the class cites.py --unchecked was built for at council read 11 and its second major specimen. Five checks added, and the useful finding is that none of them needed an External check: the whole of Invariant 10 clears from the query surface the acceptance section already declares as its bar. Check 8.1 repeats one at_time and compares; Check 8.2 and Check 8.3 repeat it across a later [Grant] and a later [Revoke]; Check 8.4 puts a non-candidate record beside the candidate and confirms which one answered; Check 8.5 builds the granted_at tie and confirms the greater consent_id wins. Council read 48 called this the cheapest check in the document to write and that held — the guarantee was expensive to state and trivial to test, which is the inverse of the usual shape and worth noting the next time an invariant looks untestable.

One proposition, two owners, and the family semantics decided which. State 1 and Invariant 2.1 both said EVERY consent record stands in exactly one of granted, revoked, expired, differing by a trailing at the evaluation instant that State 2 and the state declaration already bind. State 1 is tombstoned: the grammar declares Invariant as a property of every reachable state and State as what the spec holds, so exclusivity-at-an-instant is an invariant by definition rather than by preference, and the Decisions entry already cited Invariant 2.1 for it.

And the fix walked into the trap the chair had flagged an hour earlier. State 1 was the block’s first rule, so tombstoning it in place left a fence opening with a NOTE — F-prefix-first, the defect council read 15 found and instrumented, and the exact hazard the chair had named while placing Duplicate Prevention’s tombstone at council read 52. Caught on the next run and moved to the end of the fence. Three specimens now, all in tombstone placement, which is a good argument that the check earns its keep more than the rule does.

Census held at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1; Ledger byte-identical; nothing in the corpus cited Consent State 1. Three of council read 48’s five findings remain open and all three are genuine rulings or sweeps: the host-versus-deployment split on Identity 2 and Identity 8, the read-order polarity principle, and the bare blockquote doing PROVISIONAL: work without the surface.
Council read 53 — Claude on the Session-Gated Authorization migration, 2026-09-14. The second composition of the epoch, and the first test of whether Undo History’s family shape survives contact with a spec it was not derived from. It does, by shrinking — and the migration found that one of the composition’s two reasons to exist is owned by one of its atoms.

The shape holds, and the test is which families are absent. Undo History settled Composes → wiring surfaces → Invariant → Check / External check → Non-goal. This composition keeps the frame and takes different wiring surfaces: Action wiring (now at four specs, recurrence long met), Primitive policy (two specs to three) and Concurrency (twenty to twenty-one) — all three already standard or already counted — and no Event schema, no Replay, no Wiring decision, because it stores nothing and rebuilds nothing. That is the answer the docket row one family vocabulary or two was waiting on from its second data point: a composition’s families are the surfaces it actually has, and the two documents share a frame rather than a list. Nothing new was minted.

The finding: the gate is inherited, and the prose calls it emergent. The Summary’s claim is that the gate and the principal binding together constitute the composition’s load-bearing emergent invariant; neither belongs to Session or Permissions alone. Session’s Composition note 4 states the gate outright — IF Validate gives an invalid answer THEN a composing pattern MUST NOT call Permissions — and Session’s own WHY names this composition as the pattern that carries it, citing that note by number. Invariant 1 restates an obligation the atom already owns.

The other half is the opposite shape and the contrast is the useful part. Permissions’s Composition note 3 — a composing pattern MUST own the binding between the authenticated caller and the subject_ref — assigns ownership without stating the rule, so Invariant 2 exists here because no atom holds it. That is emergent in the sense the Summary means. Two invariants the prose treats as one kind are two kinds: one discharges an assignment, one duplicates a prohibition. Composes 6 and Composes 7 now name them separately.

The docket row gained the conflict it was waiting for, and the maintainer closed the row in the same breath. open-questions.md §Which direction a rule may point across a seam has carried this since council read 36 with the explicit note that no conflict had surfaced in the corpus yet, which is why it was a row and not a finding. One has surfaced, and it is not a contradiction of content — both statements forbid the same call — but of ownership and credit: a composition’s central claim to exist is stated by one of its constituents as a rule the composition must obey. Authority 3 says a spec pays for a proposition once; nothing said what happens when the two specs are an atom and its composition.

Ruled: atoms may bind compositions; a composition cites what the composition inherits and owns what the composition adds. The grammar to carry it was already written and had never been applied across a seam — Authority 5 (a citing spec MUST name the owner) and Authority 6 (a citing spec MUST NOT restate the rule), in §10, unscoped. The reviewer’s counsel was to delete Invariant 1 outright and let Composes 7 carry the gate alone; the ruling cuts one rule shallower, and Authority 4 is why. Invariant 1.2 through Invariant 1.4 enumerated Composition note 4 over expired, revoked and not-known and are tombstoned to it. Invariant 1.1 stands, because the note fires on an invalid answer given and the invariant on no valid answer given — they do not normalize identically, and the gap is the closure this composition actually adds: a deployment that skipped validate altogether satisfies Session’s note and breaches this invariant. A citing spec may add; what it adds is its own.

The Summary was rewritten to match, which the maintainer authorized as part of the ruling rather than as migration language: it now claims the binding and the closure, and cites the gate to Session. Two checks moved with the tombstones — Check 1.2 and Check 1.3 cited the deleted rules and now cite Invariant 1.1 and the note together, which is the citation-aim audit catching a deletion’s wake inside the same pass that made it.

Instrument notes. Six findings on the first assembly, all mechanical and all the chair’s: an OR outside a condition in a check, five External check labels under the wrong heading (Rule shape 7 — Undo History’s separate ### External checks heading is load-bearing and was not copied), a composition note restating a composition-state rule, and an OR inside an obligation. Six W-unconditional-effect advisories cleared the same way and the cure is worth recording: the rules were written with [Check Permitted] as subject where the true subject is the composition — the boundary check and the call order are the composition’s behaviour on every call, including the ones it refuses, so conditioning them on an admitted-call term would have been wrong and changing the subject was right. The corpus advisory census held exactly at 181 / 83 / 67 / 46 / 37 / 27 / 23 / 10 / 6 / 3 / 2 / 1, which for a 31 KB document entering the migrated set is the receipt that the shape is doing the work rather than the writer.

Two dangling markers, both from quoting another spec’s rule verbatim: [Validate] and [Permissions] are Session’s markers and resolve to nothing here. Quoting a rule across the seam carries its markers with it, which is a small class the corpus has not met before and which O-term-dangling caught on the first run.
Council read 52 — Z on Duplicate Prevention’s Invariant 1, 2026-09-14. A ruling read on the one finding council read 51 left standing, and the first read where a member’s diagnosis was accepted and the member’s own cure was refused.

The diagnosis, accepted in full. Invariant 1.1 — EVERY identity in the recorded set MUST stand under guard — was unconditional, and the only thing narrowing it to an eager host was the WHY beside it. That is a rule whose scope lives on a surface Surface 15 tells the parser to ignore and Surface 9 lets any writer delete without ceremony, which makes the exception evaporate the first time the explanation is regenerated. The read walked the timeline to show it bites rather than merely reads badly: at t = 61 on a 60-second guard, a lazy host still holding the entry — which Lazy expiry 1 and Lazy expiry 2 license as MAYs — has an identity in the recorded set that does not stand under guard, so the invariant is violated by a host that broke no obligation.

The cure, refused, and the refusal is the read’s value. The recommendation was to restate the claim as the answer claim: EVERY identity the check answers seen for MUST stand under guard. That is Operation 7’s contrapositive — not under guard → not-seen is seen → under guard — so it is one proposition under a second label, which is Authority 3 and is the defect rather than the cure. It is also exactly the shape council read 48 found in Consent three reads earlier (State 1 beside Invariant 2.1), where two sentences sharing no words carried one claim and W-duplicate-proposition walked past both. Twice in one window, and neither instance is mechanically detectable, which is the useful thing to record about the class — though the reviewer’s own concession is the sharper evidence and is recorded at the reviewer’s request: the same reader named this class at council read 50 and walked into it at council read 52, as a cure. Consent’s instance was two authors drifting apart over time; this one was a single reader, holding the class in mind, proposing it as the repair for a different defect in the same breath as quoting the rule that already owned it. A class that catches the person who named it, in the act of naming it, is not one reading discipline closes.

Taking the premise one step further settles it. If the atom sells behaviour rather than storage — which the read argued and the corpus agrees, since Operation 6 and Operation 7 already carry the claim in both directions — then nothing remains for the invariant to own. Invariant 1 is tombstoned to Operation 6 and Operation 7 rather than restated, which needs no new term (the condition it option would have minted eager, a prose word the actors vocabulary does not carry) and no new rule (the split it option’s lazy half is Lazy expiry 3, already standing). It is the corpus’s first whole-family tombstone at position 1, so the NOTE sits at the end of Invariant 2’s fence rather than a preceding one — Surface 18 needs a labelled rule as a fence’s first line, and there is no earlier fence to put it in.

The deletion then left two citations aiming at nothing — the read 51 WHY and the Lazy expiry WHY both rested on the deleted label — which the citation-aim audit caught on the next run and which is the class working exactly as designed on the chair’s own text from an hour earlier.

A second instance the read surfaced without naming. Invariant 4.1 — The host MUST drop an identity that is not under guard from the recorded set — has the same disease one rule over. Read as safety it is false for a lazy host between sweeps; read as liveness it is true and is what Lazy expiry 1 and Lazy expiry 2 license. The only word carrying the distinction is Eventual, in the family heading — a weaker surface than the WHY the read objected to, since the parser reads headings less than it reads explanations. That is the safety-and-liveness-share-one-modal row from council read 38 with its second specimen, and it is watched rather than cured: inventing a local temporal form for a corpus-wide grammar gap is what Principle 1 through 3 forbids.

The class, for the docket. The row already carries checks resting on unowned invariants; this is its inverse — an invariant resting on unowned prose — and the read’s generalization is right: any atom with MAY-shaped implementation modes can grow one, and the cure sentence is always the same. The condition lives in the rule, not beside it.
Council read 51 — Claude on Duplicate Prevention, 2026-09-14. The last unread spec in the corpus, read against a prediction GLM pre-registered in chat before either of us opened the file. The prediction’s miss is the read’s most useful result.

Graded: the first half hits cleanly. GLM predicted the window would be a fixed length anchored to the record’s stamp rather than an interval between successive events — length semantics, not interval. It is, and the atom defends it four ways: Clock semantics 1 anchors the guard to the injected now of the opening record, Invariant 2.1 and Invariant 2.2 forbid extending the guard and require preserving recorded_at, the WHY says the clock starts at the first sighting and runs out at a fixed instant, and Non-goal 9 routes a guard that resets on every sighting to a sliding-window pattern.

The second half misses, and the miss names a class member nobody had. GLM expected the boundary instant’s side to be silent — the degenerate-bound row’s usual shape, where a reader has to choose. It is not silent. It is declared twice, on opposite sides: Terms › under guard reads elapsed term less than window duration, and Invariant 4.1 and Invariant 4.2 read IF the elapsed term EXCEEDS window duration. A silent boundary makes a reader choose; a doubly-declared one makes the spec disagree with itself while looking finished, which is strictly worse and is a shape the row did not carry.

And the disagreement made an invariant false at exactly one instant. At elapsed term = window duration the identity is not under guard, so Operation 7 answers not-seen and the caller-visible behaviour is correct — but Invariant 1.1 (EVERY identity in the recorded set MUST stand under guard) required it out of the set while Invariant 4.1’s EXCEEDS obliged no host to drop it. One tick where the invariant is violated and the rule that exists to cure it is scoped past it.

The cure removes a site from the ≥ docket rather than adding one, which is the finding’s real value. Invariant 4 was restating the comparison in raw operators where the spec already declares under guard and Operation 6 and Operation 7 route through it. Invariant 4.1 now reads The host MUST drop an identity that is not under guard from the recorded set — a relative clause on the object, the shape Operation 7 already uses, because the first repair wrote it as an IF … is not under guard THEN condition and W-condition-operator correctly refused the English comparison. Invariant 4.2 is tombstoned to Operation 7, which owned it once the comparison was routed through the term. Council read 31 narrowed the ≥ ruling to whether two numeric sites earn one operator; this would have been a third and is not, because a spec that declares its own predicate should not be re-deriving it in operators. The corpus W-comparator census moved 38 → 37 on the repair.

expired was load-bearing in four rules and declared nowhere. Lazy expiry 1, 2 and 3 turned on an expired entry and Non-goal 6 on past the guard, with neither name in Terms › terms, in an entry, or in the registry — Closed vocabulary 4 violated by a predicate entering the rules through prose. It is the length bound gap council read 43 found in Party Identity and Credential, and worse here, because expired is almost not under guard and the atom never says so: read one way it inherits the boundary hole above, read the other it is a synonym for a term already declared. Cured by routing all four through the declared term rather than by minting a definition, which is working-ideas/naming.md Rule zero applied to a predicate — the corpus does not need a second name for a shape it already has.

One finding left standing as a ruling. Invariant 1.1 is unconditional and the Lazy expiry WHY narrows it — holds of an eager host, with a lazy host not keeping the storage claim. Surface 15 says the parser ignores WHY lines, so the parser reads an invariant the corpus does not actually claim. The cure is a condition in the rule or a second rule for the lazy host, and which one is a maintainer’s call rather than a repair; it is the same boundary as the two findings above — between what is declared and what is only explained — seen a third time in one small atom.

The unread ledger is empty. Consent, Event Log and Duplicate Prevention were the three specs that closed the atom set without a council read; all three are now read, and cites.py --unread has nothing left to name. Each returned a different class — an unchecked sharpest invariant, an uncited frozen contract surface, a doubly-declared boundary — and all three carry no Generation acceptance section, which is the acceptance-gap row’s third and final piece of evidence.
Council read 50 — GLM on Recoverable Invocation as it stands, and on read 49’s staged diff, 2026-09-14. The first read run by a member with the instruments in hand rather than from a paste, and the method change is the entry’s headline.

A reviewer who can run something reviews differently. Every earlier GLM read arrived as judgment on text a human had pasted, with counts estimated from what one reader could see — which is why four of them corrected upward when the census was run, and why §18 now says a number a tool can compute belongs to the tool. This read opened with check.py --gate (0 findings, 149 advisories, 143 of them in this document), --unchecked (521 of 557 rules named by no check) and cites.py --unread, re-verified the walkthrough’s arithmetic by hand, and — the part that matters — killed two of its own candidate findings before sending them. Invariant 9.1’s transitive blanket is not the read 49 defect, because the Execution Contract’s recursive-conformance rule owns that guarantee by reference and Audit Trail carries no note obliging numbered citation; and Ledger line 2026-09-10-b is not stale-open, because its fix landed in two parts with one unfinished, which is a line that keeps its place. Both checked, both dropped, both reported as dropped. The corpus has been arguing since council read 30 that a reader estimates and a census decides; this is the first read where the reader had the census.

It cost the chair a number immediately. Read 49’s fix pass wrote that the unqualified citation form “is wrong for five of the six” because Undo History “carries an Invariant 2 through 6 of its own.” It carries Invariant 1 — Log faithfulness, so the form is wrong for all six, and the register entry repeated the error because the fix and its record were written by the same hand in the same breath. One grep found it. Fifth hand-written number in this window to die on inspection, and the first killed by a reviewer running a command rather than by its author noticing. Corrected in both places.

The not-open cluster contradicts itself three ways — verified, and held for a maintainer ruling because the cure is logic. close 4 and refuse step 0.1 oblige [Close] and [Refuse] to decide not-open from the invocation’s own [Open] result; Not Open 1 forbids the composition to decide not-open at all; and [Close] and [Refuse] are the composition’s own actions. The composition also has no surface to decide it with — the pair arrives as required parameters, there is no channel for I hold no pair, and the one composition-side signal, the Lease’s not-held arm, is what act_section 6 orders every caller on the page to discard. The design underneath is coherent and stated twice in prose: step 0 is the caller’s precondition, the adopter holds the pair on its own call stack (Not Open 2), and a bogus pair earns recording-failure. Underneath that sits a second defect the form-reader cannot see: Not Open 4 orders [Refuse] to land rejected(recording-failure(outcome)), and [Refuse]’s signature block declares recording-failure(refusal, constituent_code) — Closed vocabulary 22 violated by a rule sitting where no instrument reads for landed outcomes. Repointing close 4 and refuse step 0.1 at the adopter’s action looked like logic in the pilot, so it was routed rather than applied — and the routing was the wrong call, for a reason the reviewer found and the chair had not looked for. The Decisions log already made this ruling, dated 2026-09-10: not-open is a precondition on the caller. Chose: the pair [Open] returned, on the action’s call stack. Over: a retained handle, or deleting the code. The only reading under which the composition should not carry the arm is the rejected alternative. Not Open 1 through Not Open 3 implement the Decision; close 4 and refuse step 0.1 were written in the rewrite the day after, against it. So the repoint is not new logic at all — it is a recorded Decision the rules drifted from, which makes it repair, and it landed: both rules now oblige the adopter’s action, the subject the block’s own prose names two lines above them. The lesson is procedural and worth the space: the chair read the rules, found them contradicting each other, and escalated — without reading the Decisions log of the document under review, which is the one place a corpus that records its rulings keeps the answer. A contradiction between rules is a question about which rule drifted, and the Decisions log is where that is answered before a maintainer is asked.

Not Open 4 is split rather than repointed: Not Open 4 keeps [Close] landing recording-failure(outcome) and a new Not Open 5 gives [Refuse] the recording-failure(refusal, constituent_code) its own signature declares. Two rules rather than one because a single rule naming both actions lands an arm one of them does not have, and because Earned vocabulary 3 and Rule shape 3 leave no one-sentence form for it. Nothing in the corpus cites Not Open 4, so the split costs no citation; the label is appended, never renumbered.

The Status line contradicts its own Ledger. Status reads first draft 2026-08-30; the three passes and a fresh-reader gate are owed before any adopter binds to it; the Ledger records twelve gates, several of them fresh-reader, the twelfth on 2026-09-10, and council read 7 landed on the rewrite after that. A reader of the Status alone concludes the document was never gated. This is exactly the failure the 2026-08-27 Lineage demolition was built to kill — five patterns whose Status lines contradicted their own Lineage — surviving in the pilot, which predates the discipline it taught the rest of the corpus. The reviewer’s ruling, accepted: stale, not a gate owed — none of the thirty-one documents migrated before this one received a post-rewrite three-pass gate, the migration discipline being a council read plus the instruments per document, and this composition has now had two reads. So the sentence now names what happened (twelve gates through 2026-09-10, council read 7 on the rewrite, council read 50 on the current state) and the status word stays draft, because whether the composition moves off draft is a maturity ruling that belongs to the maintainer and not to a reviewer or a chair. Per the 2026-08-27 operating rule the roadmap says the same thing: objective (i) — specify through the three passes, model it, gate it with a fresh reader — now carries a dated line recording that it is done, and that the page’s own Status claimed otherwise for a month.

Two observations, both feeding rows rather than opening them. The 17 W-duplicate-proposition advisories here split into true duplicates (Which closing stands 10 beside journal_fence none 6) and parallel-action restatements (refuse step 1.2 against close step 1.2, differing in their arms) — which is the document’s own watch rule inheritance flag, and which means promoting that advisory to a gate in compositions forces the inheritance question before it forces any cleanup. And Terms › invariant map reported unused beside ~40 bare checks is one gap seen twice: the map is the naming (Invariant 1 → Check 1; Invariants 2 and 5 → Check 2 …), written in a declaration form no instrument reads as a citation. That is the citation-aim class inverted — a dependence that aims and does not resolve — and it is why --unchecked reports 521 of 557 for the corpus’s most-checked composition.

The read’s own verdict on the pilot, worth keeping. Twelve gates and a model with nine rejected twins put it under this grammar’s load-bearing weight, and what remains is ownership drift at the edges — which is where a pilot should carry its wear. Also flagged once and correctly scoped out: Duplicate Prevention is now the oldest debt on the --unread ledger, and it is an atom, not this read’s business.
Council read 49 — Claude on Event Log, 2026-09-14. The second of the three atoms that closed the set unread, and the one composition-facing finding lands on the chair’s own migration from the day before.

The composing pattern did not cite what it rests on. Composition note 5 obliges a composing pattern to cite this atom’s invariants by number, and Composition note 4 says why — the numbers are a frozen contract surface, and the citations are what freeze them. Undo History cited none. cites.py --into on the live corpus shows Audit Trail and Recoverable Invocation citing seven of Event Log’s labels between them and Undo History absent from the list entirely, so this is one composition’s miss rather than a convention nobody follows. The tell was the sentence that admitted the dependence without numbering it: Event Log’s read-consistency invariant is what bounds the replay to exactly that set — named by description, in the one place the replay’s correctness hangs on the constituent.

Fixed in this diff, and the fix had to be derived rather than blanket. The composition rests on six of the seven: Event Log Invariant 1 and Event Log Invariant 2, which Invariant 5.2 and Invariant 5.3 mirror from this side; Event Log Invariant 3 and Event Log Invariant 4, without which Replay 1’s in sequence_number order names nothing; Event Log Invariant 5, which bounds the replay’s input; and Event Log Invariant 6, which is what lets an undone_event_id name one event for the life of the log. It does not rest on Event Log Invariant 7 — recorded_at is an annotation this composition never orders by — and saying so is the part a blanket citation would have lost. Invariant 5.1 had been carrying the whole set by description (EVERY Event Log invariant MUST hold), which satisfies the obligation’s letter and none of its purpose: a renumber re-passes nothing it cannot resolve.

The fix then produced the council read 32 defect inside itself, caught on the next run. The first draft read Event Log Invariant 1 (append-only) and Invariant 2 (event immutability) — the second unqualified, where this spec carries an Invariant 2 of its own, so the citation resolved locally and aimed at State equivalence. Every reference is now in the qualified form, with the reason stated in the WHY, because the collision is structural here: Undo History carries Invariant 2 through Invariant 6 and Event Log carries Invariant 1 through Invariant 7, so the unqualified form resolves locally for all six. (Council read 50 corrected this count: the first draft of this entry said five, because it wrote the collision range as Invariant 2 through 6 and Undo History carries an Invariant 1 — Log faithfulness. Fifth hand-written number in this window to die on inspection, and the first killed by a reviewer running one command rather than by its author.)

The atom has no acceptance surface at all. --unchecked reports it flatly: no checks, nothing audits any of its 85 rules. The census across the set is three of twenty-eight — Duplicate Prevention, Event Log, Personal Todo — and two of the three are exactly the atoms that were never read. All three are the earliest migration wave and Consent is the same wave with a full section, so this is not vintage: the review loop is what produced acceptance sections, and the specs that skipped the loop skipped the section. The consequence lands on the composition epoch rather than on the atoms. Undo History’s thirteen Check rules and four External check rules rest on two constituents with no acceptance surface between them, which means the first composition’s audit story is auditable exactly as far as the composition’s own rules reach and no further. New docket row.

One stale fact, fixed. The composition-notes WHY listed Undo History as forthcoming. It landed the day before.
Council read 48 — Claude on Consent, 2026-09-14. The first of the three unread atoms, read with the local shell down and therefore recorded before it is repaired; every finding below is still standing.

The atom’s sharpest guarantee is tested by no check. Invariant 10 is point-in-time faithfulness — Invariant 10.3, a later write MUST NOT change a [Check] answer for the at_time, and Invariant 10.4, a repeated [Check] carrying one at_time MUST answer alike — and --unchecked finds all four of its rules named by no acceptance check. That is the regulator’s actual question and the whole reason at_time exists. Twelve checks in the section and none reaches it; Check 5.1 looks as if it does and tests point-in-time expiry, citing Invariant 6.1. This is Retention Window’s Simultaneous retention 4 again — the finding that earned cites.py --unchecked at council read 11 — and it is that instrument’s second major specimen, sitting in an atom nobody had read. It is also the cheapest check in the document to write and clears from records and the query surface alone, which is the bar the section sets for itself.

A duplicate the checker cannot see. State 1 and Invariant 2.1 are one proposition with two owners, differing only by a trailing at the evaluation instant that State 2 and the state declaration already establish. W-duplicate-proposition found Invariant 6.1 and Invariant 6.2 in the same file and walked past this one, because it compares sentences and the duplication is at the level of propositions. Worth recording as the class’s shape rather than only as the instance: a tail the spec binds elsewhere makes two rules look different to a string comparison and identical to a reader.

Two actors, one artifact. Identity 2 has the host allocating a consent_id at the seam; Identity 8 has the deployment drawing one that sorts in lexicographic byte-order. Both are declared actors and no other atom splits the id this way — Event Log’s Identity 2 is the bare allocation and nothing more. Identity 8 is also the only rule in the atom whose violation breaks no invariant: byte comparison is total, so unsortable ids still give Invariant 10.2 a deterministic tiebreak and Invariant 10.4 still holds. What an unsortable id breaks is only the meaning the WHY claims — that the tiebreak picks the later grant — which makes it a quality rule wearing an invariant’s clothes, unchecked, owned by an actor that is not the one allocating.

Read-order polarity, inside one atom, with the principle attached. Operation 50 orders [Read]’s ties by consent_id ascending and Invariant 10.2 resolves [Check]’s tie to the greatest consent_id. The docket has carried this fork across three specs since council read 34 with no declared principle, and Consent supplies one by doing both jobs over one store: a list read serves replay, so it ascends; a point-in-time selection serves what stood, so it takes the latest. The polarity is not a posture a spec picks — it follows from whether the read returns a sequence or selects a record, which is a rule the corpus could state once. The Identity 8 WHY already says both directions in one sentence and says nothing about why.

The one bare blockquote in the migrated atom set. The clearly-marked residual note under Stored state is two hundred words of design rationale carrying an explicit open design point, and the grammar has a surface for exactly that — PROVISIONAL:, declared in Terms › surface, ignored by the parser under Surface 15, excluded from the normalized form under Normalized form 3. The note uses none of it. Carrying it over verbatim was the migration’s own no-invention rule working, so this is a ruling rather than a defect: the corpus’s one piece of explicitly provisional prose is the one piece the provisional surface does not cover.

One docket correction. The lost-answer row credits Invitation’s Operation 44 as the first spec to state the total read as a rule. Consent’s Operation 35 — [Check] MUST NOT refuse a call — predates it by a day, migrated 2026-09-12 against Invitation’s 2026-09-13. The row’s argument rests on two specimens arriving independently, so the order matters to it.
Council read 47 — GLM on Undo History, 2026-09-14. The first read of a composition since the atom epoch closed, and both findings are about the epoch rather than about the document. Two accepted as docket rows, two of the read’s own claims corrected by counting.

The lost answer, at its worst shape yet, and the ruling that keeps it out of the spec. The read found that [Undo] carries the hazard the Indeterminate outcome family exists for and that the family did not propagate into the first composition. Checked and worse than stated: a retried [Undo] after a lost answer does not collide with the first call. Action wiring 15 targets the undo target, the first undo’s committed event has already advanced that target past itself, so the retry admits, appends a second well-formed undo event, and answers the next forward event’s type. Every member of the fork the docket already carries is either self-detecting — the retry meets a rejection — or duplicating visibly, two identical appends an auditor can see. This one duplicates and answers success, with both events correct by every rule in the spec. It is the fourth member and the only one with no self-detection at all.

It stays out of the document, and the precedent is council read 34’s: Soft Delete needed the same discipline, its prose carried none to raise, and adding the family would have been logic rather than language. The HEAD prose here carries no retry, no timeout, no transport fault, nothing — so the same ruling holds, and the migration’s own Decisions entry (where the prose gave no basis for a check, none was invented) is what made the gap visible instead of quietly filled. The consequence is the argument the docket row now carries: a hazard class invisible in the answer cannot be left to whether a particular prose author happened to think of it. Second instance of the ruling, worst instance of the hazard.

The family question, answered by running it — which is how the epoch’s real shape came out. The read asked whether the grammar’s Terms › standard label family admits the five composition families. Counting first: one of the five, Composes, has been in the standard set all along, so the set was already provisioned for this epoch before it opened. Of the other four, Action wiring is at three specs with Audit Trail and Recoverable Invocation — Principle 2’s recurrence bar, met — and Event schema, Replay and Wiring decision sit at one spec each, where Principle 1 through 3 says flag and wait. So one admission candidate, three flags, nothing forced.

The read’s own second observation is the sharper half and it deserves the emphasis it did not get: what this composition does not declare. No Clock semantics, no String, no Concurrency, no Capability requirement — the corpus’s most-used families at 25, 16 and 20 specs and standard respectively — because the edge surfaces stayed with the constituents, which is exactly what Composes 6 forbids the composition from touching. The two document kinds are therefore not drifting apart inside one vocabulary; they are drawing on disjoint halves of it. New docket row: one family vocabulary or two, with the count answerable by twenty-three more compositions and the shape answerable only by the maintainer.

Two claims corrected by census, both in the read’s receipts. The read called this the first document whose rejection vocabulary is entirely borrowed. Five of seven, not seven: not-pending, not-editable, invalid-description, duplicate-active and invalid-query pass through with no local term entry, and the two exceptions are exceptions for opposite reasons — nothing-to-undo is minted here, because neither constituent has an undo to refuse, and storage-failure is borrowed from Event Log and given a local entry anyway. A composition’s registry is thinner than an atom’s and not empty, and the two reasons a token earns a local entry are worth the distinction the round number lost. Second, Replay 17 was called a new rule genre — the corpus policing its auditors’ procedure. It is not new: Tamper Evidence’s Check 1.2, Actor Identity’s Check 1.2 and Recoverable Invocation’s Check 1.3 all constrain how an auditor may reach a verdict rather than what the verdict is. What is new is narrower and better: Replay 17 is the only one naming which data source an auditor may read — a fresh replay over a materialized index — and it sits in a wiring family rather than in Check, which is where a procedure rule has lived every other time. Third and fourth counts in this window settled by running something rather than by reading.

One count the read got right and the chair did not. Ninety-eight labelled rules across nine families, not the ninety-one the migration’s own commit message claimed. The read’s per-family tally is exact. Recounted, corrected before the commit landed, and recorded here because the register’s standing lesson is that a hand-written number is a finding waiting to happen — four of them in this window, three the chair’s.

Receipts accepted without change. The first composition tombstone in the corpus, confirmed: Audit Trail and Recoverable Invocation carry none between them. The demo mapping — reversal by re-derivation over a monotonic record, with Non-goal 10 naming where it stops (a substrate whose actions send email or charge cards) — is the essay’s unfilled cell filled, and the read is right that it separates a record shape from a state-space shape, which the demo’s three engines conflated. Invariant 4.2 scoping inherited constituent invariants per replayed state is the multipolarity answer’s fine print and was written deliberately. And the read’s own self-grade stands: it named the criterion the pilot had to meet and picked two wrong candidates against it, which is a better record than a hit would have been, because the criterion is the reusable part.
Council read 46 — Claude on the Undo History migration, 2026-09-14. The first composition migrated after the atom set, and the read is mostly about the shape a composition takes rather than about a defect.

The family shape, set by the smallest specimen. Undo History was chosen first because it is the smallest composition on the frontier (30.9 KB) and because it is the one a fresh reader found a real flaw in, so anything the migration surfaced would land in a conversation already open. Nothing surfaced: the prose held. What the migration had to decide was the family set, and the Decisions entry records it — Composes for the constituent contract, then one family per wiring surface (Event schema, Action wiring, Replay, Wiring decision) above the composition-level Invariant, with Check and External check below. An atom’s Operation family would have flattened four kinds of claim into one; a composition’s rules are about where a call goes rather than about what one record does. Whether that set survives twenty-three more compositions is the thing to watch, and the next few will say.

A family reaching recurrence, caught by the instrument rather than by the writer. Action wiring stood at two specs — Audit Trail and Recoverable Invocation — and this migration makes three. Principle 2’s threshold is met, so the family is now a candidate for the standard set the grammar declares once. The count did not have to be noticed: lint.py’s W-stale-census, built at council read 33 for exactly this, reported §18’s Action wiring (2) against a corpus carrying three on the first run after the file was installed. That is the fourth consecutive count in this window decided by a tool rather than by a reader, and the first where the number moved because of the work in flight rather than because the original was wrong.

Three findings of classes the corpus already names, all in the chair’s own draft. W-duplicate-proposition found Invariant 1.3 restating Action wiring 11 verbatim — Authority 3, now tombstoned to the wiring rule, with the WHY repointed. W-unconditional-effect found Action wiring 15 binding [Undo]’s targeting to every call including the refused one, where Action wiring 16 answers nothing-to-undo two lines below — cured with the admitted <action> term pattern the atoms settled on, which is now doing its first work in a composition. And W-watch-word found a lower-case before in Invariant 7.3. The cure there is worth the line: the rule had been carrying its ordering in an adjectival clause (an event undone before a later forward action), and the repair was not a new term but symmetry with its neighbour — Invariant 7.2 names the state an undo abandoned, so Invariant 7.3 now names the state a forward action abandoned. The WHY already called them the two classes deliberately outside the walk; the rules now read that way, and the ordering word is gone because it was never carrying the claim.

Deduplicating a closed set can remove a live member. The record-verb line carried serve, skip and walk twice each, and the pass that removed the duplicates also removed reapply, which was not one. Non-goal 1 then used it and C-verb reported it. No instrument could have done better — the verb set is authored, not derived — and the lesson is small and repeatable: a dedup over a closed vocabulary is an edit to that vocabulary, and the checker is what makes it survivable.

Four orphan markers, and the convention they point at. O-term-orphan reported [Undone Event Id], [Undone Event Type], [Nothing To Undo] and [Storage Failure] as definitions nothing reaches. The cause is the corpus’s own split, arriving at composition scale for the first time: rules carry the projection (undone_event_id, storage-failure) because callers switch on the exact token, and prose carries the marker, which is the only thing that reaches the entry. A term used only inside rules therefore reads as orphaned however correctly it is defined. All four now have a prose site, and the undo schema’s two own fields — the one the replay builds the undone set from, and the one the undo answers — are named in the Event schema WHY, which is where a reader would look for them anyway.

Receipts. R-provenance-drift, built at council read 42 after the fabrication, passed by construction: the three-line Ledger is byte-identical to HEAD and the open: none line is unchanged. The citation-aim audit had no surface — cites.py --into reports that nothing in the corpus cites Undo History by label, which is what a leaf composition looks like and is the reason the tombstone cost nothing. lint.py is 0 across 54 patterns, check.py is 0 findings and 0 advisory on the spec itself, and the corpus advisory census held at 181 / 83 / 66 / 46 / 38 / 27 / 23 / 10 / 6 / 3 / 2 / 1 — thirty-two migrated documents now, and the first composition of the twenty-four.
Council read 45 — GLM on Medication Order, 2026-09-13. The last read of the atom epoch. Five findings; the first is a class the registry had four ways to break and two watchers.

Term coverage. Four fields the spec rules over — administered_at, amendment_reason, reinstated_by, reinstated_at — carried no term entry at all, and On Hold Rejection carried an entry the link block never named. The read found three of the four and the orphan; the fourth came out of running the count. Both are the same class: the registry is the citation substrate, and a rule naming a field whose marker resolves to nothing is a claim with no address.

Four ways that breaks, and until this read two were watched: O-term-dangling (a marker with no link line), O-term-orphan (a link line no marker uses), O-term-anchor (a link line whose anchor names no entry, added at council read 44), and now O-term-unreachable — an entry the link block never names, so no marker can reach it however correct the prose is. Corpus-wide it found three: Medication Order’s, and two pre-existing in atoms migrated earlier in the window (Assignment’s Status, Lease’s Lease — both central concepts of their own specs, both with entries the prose never marked). All fixed.

The fifth way is not checked, deliberately. A field the rules turn on with no entry at all cannot be decided mechanically, because the Terms › records line does not distinguish a record name from a field name from a derived index: Provenance declares two records on that line and Audit Trail declares named indexes on it, so a field-coverage check reports both as missing. The first cut of that check fired on seven correct specs. A check that fires on correct specs teaches readers to ignore it — which is the failure every census in this window was instrumented against — so it was dropped and docketed. Recorded because the discipline is the point: the half that was precise shipped, the half that was not did not, and the docket row names what the records vocabulary would have to gain for it to become tractable.

Worth noting how the imprecise version was caught: it reported 54 findings, one per spec, which is not a corpus with a defect in every file but a discriminator that is wrong. The first cut read every #### heading as a term entry — the same error that made the ≥ census wrong twice (council read 34). A term entry is now discriminated by the Kind: line inside it.

Two docket rows. The cross-field temporal residual: Medication Order rules every instant’s upper bound and relates no two of them, so an administered_at preceding its own order’s dispensed_at — the dose given before the pharmacy released it — is physically impossible and representable in a conforming store. The temporal-postures row now has three members and none relates two instants of one record. And the blank-reference split, which the read correctly identified as a posture at two instances: Party Identity designed it, Medication Order ported it and generalized it a level with the blank-input rejection and field fault terms.

Receipt. M-seam-injection, added at council read 41 after the same gap appeared in two consecutive migrations, was satisfied by construction here: this atom’s seam declares three injections — the clock reading, the id material and the clock_skew_allowance — and the check never fired. An instrument working well enough that the defect had no chance to recur is the only kind of evidence that class of cure produces.

The atom epoch closes. Twenty-eight of twenty-eight atoms in GRACE lang, with all three strip-test specimens ruled. Twenty-four compositions remain.
Council read 44 — Claude on the Medication Order migration, 2026-09-13. The last atom, and the strip test’s third specimen — which corrects the reason the taxonomy records for this atom’s own tag.

The tag is earned, and not for the stated reason. atoms/TAXONOMY.md justifies domain: healthcare on the guards: verification gating dispensing, the verified-dispensed-administered pipeline, controlled-substance attestation. Each of those is individually derivable from a neutral primitive the corpus already holds — one actor authorizing and a different actor releasing is Approval Step’s shape, a three-stage custody pipeline is Chain of Custody’s, attributed actions are Actor Identity’s. Twelve of the fourteen invariants strip clean, and the two that do not both pivot on an irreversible release, which a warehouse has too.

What does not strip is the graph. Nine states in this topology, with the amendment boundary and the cancel/discontinue split landing on exactly the dispensing edge, is not derivable: a generic state machine plus a supplied graph is this atom with the domain moved into a parameter, and the parameter would carry every clinical judgment the graph encodes. The tag stands; its reason is corrected in the spec’s Decisions. The formal layer corroborates — this is the only atom in the migrated set carrying both an Alloy and a TLA model, and the Alloy model exists because the structure needed checking rather than the timing.

Three specimens, three hiding places, one per specimen: Observation hid nothing and was renamed; Party Identity hid it in the field schema and kept both name and no tag; this one hides it in the graph and keeps the tag. That is the argument for running the test on every atom rather than on the ones that look domain-shaped.

Two instruments earned here. V-unpartnered-reservation — built two atoms ago for a defect in Observation — fired on this migration’s own Operation 12, which reserved not-known to a well-formed order_id while no rule routed a blank one. The cure is Party Identity’s split, and it improved the spec rather than merely satisfying the checker: a blank id is now refused before the store is consulted, and the field fault term keeps that check out of the after-the-state-checks group where every other field fault sits.

And a new class: thirteen term-registry link lines pointed at headings this page did not have — every attribution and instant field of the four terminal transitions had a link and no entry. O-term-dangling catches a marker with no link line and O-term-orphan catches a definition nothing uses; neither starts from the link block, so a link resolving to nothing was invisible to both, and invisible in review, because the prose reads correctly and only a rendered click finds the hole. lint.py gains O-term-anchor, matching anchors the way kramdown generates them. Verified by removing one entry and watching its orphaned link line report.

The atom set is complete. Twenty-eight of twenty-eight atoms are now in GRACE lang. The remaining work is twenty-four compositions.
Council read 43 — GLM on Party Identity, 2026-09-13. Five findings, all accepted, and the first one is the strip test’s residue the ruling missed.

The schema carries interpretation, not only vocabulary. The migration’s Decisions entry docketed the attribute schema as a vocabulary question — whether name, date_of_birth, document_type, document_ref should be an opaque attribute bag. The read found the half that framing hides: date_of_birth is not merely named, it is interpreted. Operation 2 refuses a value parsing as no calendar date; Operation 3 refuses one exceeding now. That is the corpus’s first typed-content semantics on caller input, and the exact inverse of Observation’s law — record, never interpret what you were not told how to validate. A calendar is not a domain, so the strip test passes either way, and the docket row now carries both halves, because they can be ruled apart: a spec can keep a named schema and still refuse to read it, which is what every other atom does.

The read’s own self-grade is the useful part of the record: it named three tell-sites for hidden domain, all three came back clean, and the residue sat at a fourth it had not learned to look for. Three specimens, three hiding places — in the words (Observation, none found), in the graph (Medication Order, found), in the field schema (Party Identity, found).

The family question, answered by running it. Ordering is genuinely new: one spec, this one, not recurrence. Indeterminate outcome is not new to the corpus — Approval Step has carried it since before this window and the lost-answer docket row already cited it; at two specs it is now recurrence, and §18’s family census carries it. Capability requirement is standard by the grammar’s own declaration, derived rather than hand-copied since council read 41. So the reviewer’s holdings gap and the corpus’s actual state differed on one of the three, which is what a derived census is for.

A bound consumed and never declared. String 7 refused a string input exceeding the deployment’s length bound while the bounds vocabulary was empty — a load-bearing value entering the rules through prose. The same shape in Credential. Both now declare length bound. It is the seam gap one layer over, and it has no instrument: Closed vocabulary 4 requires every identifier to resolve, and an undeclared bound reads as prose rather than as an identifier, so nothing looks for it. Docketed rather than built, because the tractable form is not yet clear.

Two receipts worth keeping. The blank-id split — invalid-request for a blank party_id decided before the store is consulted, not-known for a well-formed one naming nothing — is the two-sense EXISTS disease cured by splitting the answer rather than partnering a spelling, and it makes invalid-request appear at two heights in one priority order. And the Indeterminate outcome family is the lost-answer treatment arriving as rules rather than as prose: self-detecting versus duplicating, stated as caller-side obligations, with [Enroll] named as the one action a blind retry breaks because it creates rather than transitions.
Council read 42 — Claude on the Party Identity migration, 2026-09-13. The migration found a defect in the chair’s own prior work, and it is the worst class this session has produced.

Fabricated provenance. Party Identity’s Ledger was rewritten from the original prose, and the status:, formal: and last gate: lines came out wrong — a critique number bumped from 5 to 6, a date moved, a twin count raised from one to three. Nothing in the source said any of that. A H-status-mirror finding against roadmap.md exposed it, and an audit of the other three migrated atoms then found the same thing in Credential: Critique 5 became 6, 2026-06-23 became 06-25, two twins became three. Provisional Commitment and Invitation were clean.

The Credential fabrication shipped in fe669e2, and council read 41 quoted it back as a receipt — “credential.tla + 3 twins — the twin count is climbing” — which is the part worth recording. A reviewer reads what the page says. A fabricated fact inside a reviewed document does not get caught by review; it gets confirmed by it, and then cited. Every other error this session was a wrong rule, a wrong number in a census, a wrong mechanism — things a reader or a checker can argue with. This was an invented fact about what a formal model run produced, and the only thing that could catch it is the record it was invented against.

All four ledgers now match their pre-migration originals byte for byte. Credential’s correction needs its own commit, because the fabrication is in history.

The instrument. lint.py gains R-provenance-drift: a spec’s status:, formal: and last gate: lines are compared against the same lines at HEAD, and any change is reported. It reports rather than forbids, because a real re-grounding changes them legitimately — the message asks for the gate to be named in the commit. It is silent when nothing moved, which is the state a language-only migration must be in. Verified in both directions: re-introducing the invented twin count fires it, and the restored file is byte-identical.

This is the first check in the corpus that compares a document against git rather than against itself, and that is the point. Every other instrument asks whether a document is internally consistent; a fabricated fact is perfectly consistent. Only the prior version knows.

Also this migration. F-invariant-ref reported the spec’s own Decisions entry as a dangling citation the moment two duplicated invariants became tombstones, because it counted live families rather than the reserved label space. A tombstone keeps its number forever (Hard invariant 25, Hard invariant 27), so the ceiling is now the highest live or tombstoned number. Invariant 9 and Invariant 10 are the tombstones — Identity 6 through 9 own identifier stability and uniqueness — and the corpus was checked first: Customer Onboarding and the coverage matrix cite Party Identity Invariants 1, 4, 5 and 11, and neither 9 nor 10.

The strip test. Party Identity earns no domain: tag and no rename. Every invariant is neutral — records are never removed, a terminal absorbs, events are append-only, a standing rests on evidence recorded since the last revocation — and the same shape governs a licence, an accreditation or a calibration status. party is already the stripped name: legal and commercial vocabulary rather than one industry’s, which is why the atom is not Customer Identity or Patient Identity. What is domain-flavoured is the enrollment attribute set, and the atom already treats two of its four as opaque strings. That leaves a real question — whether the schema should be an opaque attribute bag — which is a docket row rather than a rename.
Council read 41 — GLM on Credential, 2026-09-13. Seven findings, six accepted, two already closed from the prior read — and the first finding is the one that changed an instrument rather than a spec.

The seam gap is a migration habit, and it is now a check. The Terms › seam declaration named two injections — the clock reading and the id material — while the rules consumed a third: Operation 4 consults the derivation registry, Operation 11 records the verifier it produces, Operation 21 derives through it on every verify. A transition that calls the deployment’s function is not the pure function of store, inputs, now and id material that logic confinement claims, and the declaration is where a reader checks that claim. The read’s sharper point is that this is the second time: Provisional Commitment shipped the same shape of gap — the registry’s availability verdict consumed and undeclared — and it was fixed the same morning without anyone asking whether the class would recur. It recurred that afternoon. lint.py now carries M-seam-injection: every MUST supply X at the seam must find X’s significant words in the spec’s own seam declaration, with now satisfied by the clock reading. Verified by removing the registry from Credential’s declaration and watching it name the two missing words. The reverse direction — a seam naming an injection no rule consumes — is deliberately unchecked, because it has never failed and a spec may reach a seam input through a declared term.

Findings accepted. The WHY on Identity 11 overstated its own closure: refusing an unregistered credential_type narrows the near-duplicate hole and does not close it, because a deployment free to register password and Password against one derivation function re-opens it through the registry, which Identity 11 then waves through. Capability requirement 6 is the half that closes it and it is the deployment’s, because the registry is; the WHY now says which half it does. Invariant 8.2 obliged the deployment from inside the Invariant family, which is the wrong family for that fact-kind — an invariant is a property of every reachable state — and it is now Capability requirement 5 with a tombstone naming the owner. The transitioning write gloss described the happy path (every write taking a credential to a stored terminal) while Operations 27 through 29 apply the term to refused calls, so a strict reader could re-narrow the subject the rule-widening had just fixed; the gloss now says including a refused one.

Two findings were already closed. Invitation’s vacuous Invariant 1.2 is a tombstone and its Check 2.3 already says a clock the auditor supplies — both landed in the read before this one, and the paste predated them. Worth recording because the read cross-receipted its own prior finding from Credential’s text: this atom’s Invariant 1.2 carries a WHY saying unlike its counterpart in Invitation it can bind, which is the vacuity finding confirmed in the corpus rather than in a review.

Docket. Two new rows. One name, two definitions, one day apart — Invitation’s live requires a deadline, Credential’s admits an absent one, and the window-reading watch entry’s contested half arrived with its third instance, so both halves of Principle 2 are now satisfied for that class. A missing deployment default gets two answers — Invitation refuses the caller, Credential leaves the field absent and the credential live forever; the config-miss sibling of the rare-condition-routing row. A third watch entry records EXISTS carrying three senses on one page: argument-presence, store-state and field-absence.

The read also notes that the liveness non-goal is now a triple — Provisional Commitment routed it to a deployment cadence, Invitation declared it false by design, Credential finds it undecidable without a deadline — which satisfies recurrence for the untensed-modal row with three distinct flavors rather than three copies.
Council read 40 — Claude on the Credential migration, 2026-09-13. Not a spec read but a defect found while migrating, and ruled on, because leaving it would have shipped an obligation no deployment can discharge.

Credential’s Invariant 2 asked the store to enforce effective-active uniqueness with a unique partial index on (principal_ref, credential_type) where status = Active and the credential is not past expires_at. No index predicate can reference now, so that constraint cannot be built; and the half of it that can be built, where status = Active, forbids exactly the case the same invariant explicitly permits — a lapsed record standing in active beside the successor registered after it. The mechanism was therefore either unimplementable or wrong, in a paragraph that read as precise. What it was reaching for is a section over the pair, the same shape Provisional Commitment’s registry carries, and that is now Capability requirement 5. The obligation is unchanged; only the mechanism is. The formal twin credential-buggy-toctou.tla was built against the index reading and is an open Ledger line rather than a silent inheritance.

Two rulings recorded in the spec’s own Decisions. Every bound, guard and lookup in this atom means effective-active rather than the stored status, and the prose restated that at four sites; it is now one declaration, because an implementation that reads the bare flag at any one of the four is the hazard the twin exists to catch. And live here admits an absent deadline, which is the corpus’s first window reading over an optional deadline — a third member separating the unbounded case would be a distinction no rule consumes, so there are two members and a Decisions line saying why.

The window-reading watch entry moves from two independent declarations to three, which satisfies the recurrence half of Principle 2. What is now missing is the contested half, and a shared reading that three specs declare and none can cite may be what supplies it.
Council read 39 — GLM on Invitation, 2026-09-13. Five findings, four accepted, one already closed — and the read’s own numbering exposed a worse defect than any of them.

The numbering. This entry is 39 and the previous one is 38, and the previous one was filed as 35 for a day. The register already carried a 35 (the Observation reframe), a 36 and a 37 when the chair wrote a second 35 on top of them, then cited that number eleven times across GRACE-lang.md, open-questions.md and the spec itself, and shipped it in a commit subject. The read found it by citing its own number, which did not fit. Every live citation is renumbered to 38; the commit message fb15f55 still says 35 and stays wrong, because history is not rewritten to flatter the register. Nothing in the corpus reads council-read numbers, which is exactly why they drifted — this is the third census the chair got wrong by hand and the first one no instrument was ever asked to hold. atoms/TAXONOMY.md’s one citation of read 35 is legitimate and was left alone.

Findings. The [Expired Rejection] orphan was diagnosed correctly and had already been closed at the end of the previous turn, after O-term-orphan fired twice — once for the missing registry link, and again after the marker was added inside the term entry, which is not a use, because a term entry is the surface nothing (Surface 25). The instrument taught the rule; worth recording because the second fire is the non-obvious half. Invariant 1.2 could not bind and is now a tombstone: an admitted resolving write runs only on a pending invitation (Operation 16) and a pending invitation carries no resolution field (State 6), so the set it quantified over was empty at every reachable state — the same decorative-rule class that re-homed the resource return one atom earlier, and the second time this class has been caught by walking the admission guards rather than by an instrument. Check 2.3 promised historical reproduction the derived posture cannot supply, since a read records no clock; tightened to a clock the auditor supplies. Check 9.1 cited one of its three bases.

The richest docket harvest so far. Three new rows. The closed answer set charges rare conditions to the nearest arm — Invitation routes a token collision to storage-failure and an undeclared default ttl to invalid-request, both defensible, both loose, and Medication Order’s lease-death is the third site; the spec now names the borrowing in a WHY rather than hiding it. How a refusal names what blocked it — three shapes across three atoms, in increasing information and increasing grammar cost: negation (not-held), state-name (expired, on-hold) and parameterized event (already-resolved(accepted), the corpus’s first payload-bearing refusal, whose payload Invariant 6.1 makes mandatory). A spec’s actors are not marked as agents — GRACE-lang declares the actor/agent split and gives a spec no category for it, so a rejection and an answer sit in Invitation’s actors list, correct by the definition and unhelpful to a generator.

Two rows move rather than grow. The lost-answer row’s recurrence half is now satisfied: Invitation arrived carrying the append-on-admitted and append-on-refused pair natively, which is the treatment the Provisional Commitment repair pass invented independently one atom earlier — two specimens, one treatment, so the row is a decision rather than a wait. Read-order polarity gains a third posture, and the one that makes the fork undeclarable rather than merely undeclared: Invitation’s read states no order at all.
Council read 38 — GLM on Provisional Commitment, 2026-09-13. The read opened with two instrument questions rather than findings, and both were answerable by running something. Does check.py know the Capability requirement family? — it does not read families at all and does not need to; cites.py does, and knew the name, but from a hand-copied set that had been correct for four versions by luck. It now derives the set from GRACE-lang’s Terms › standard label family declaration and exits rather than guess, the same cure check.py’s category set took two versions earlier; verified by dropping the family from the grammar and watching the non-standard-family report grow from twelve to thirteen. The read also recorded the family as unseen, which is a reading gap rather than a corpus one — Audit Trail and Recoverable Invocation already carry it. Which half of Invariant 2.3 does the model check? — the safety half, and the answer is the sharpest finding of the session: provisional-commitment.cfg declares INVARIANT Safety with no temporal property, and Inv_SingleResolution checks that a written resolution matches the state while saying nothing about whether one is ever written. The spec claimed exactly one and its own model checked at most one, and no instrument reported the disagreement, because GRACE’s MUST carries no temporal scope. The rule was decomposed rather than kept: its safety half was already owned twice over, its liveness half is now Non-goal 25 with Capability requirement 12 as the deployment’s way to close it, and the gap is a docket row.

Four further findings, all accepted. The resource return was an Operation obliging the atom to do what the same page’s External check 1 says the atom cannot see, making the rule false or unfalsifiable — re-homed to the registry as Capability requirement 10 and Capability requirement 11, with the read’s own tell (the negative half was specifiable and the positive half was not) recorded in the WHY. The seam term declared two injections and the rules consumed a third, the registry’s availability verdict — declared. Rejection observability was routed to a composing Event Log whose composition note obliged an append on admitted actions only, so the target was empty for exactly the content routed to it — the note now covers refused actions, and the lost-answer row gains its most inconsistent specimen. And the String family was absent entirely, so two presence checks read NOT EXISTS on caller strings with no declared reading of whitespace on the page; String 1 through 6 and blank added in the corpus’s own words, and the input-handling-regime row moves to four postures across five atoms. Two minors accepted: an Invariant family titled for three instants that floors two, retitled with the derivation for the third stated; and a scenario naming a read surface this atom does not have, corrected to say so.

One thing the read did not need to catch, because an instrument did: renumbering the composition notes produced a duplicate label, and L-dup-label reported it before the file was verified. Worth recording as the counter-case to the family question the read opened with — the instruments that exist do hold; the exposure is the ones not yet taught.
Council read 34 — GLM on Soft Delete, 2026-09-13. The read turned yesterday’s own law back on the chair and was right to: the ≥ term-entry census stated in §18 one day earlier had already moved, and the rule the chair wrote for exactly this — a number a tool can compute belongs to the tool — had not been applied to it. Counting it properly found worse than drift. The number was wrong when written: 36 across 30 specs, where the true figure is 33 across 17, because the counter read every #### heading as a term entry and the three adversarial-scenario headings in each atom are not term entries, and because the spec count was simply miscounted. Third hand-written census in three days to be wrong on inspection, all three the chair’s. lint.py’s W-stale-census now decides this one too. Four more findings recorded: the first overlay atom’s identity shape — the caller supplies the id and the atom allocates nothing — docketed as a second identity shape rather than a variant of the first; the create-on-write answer shape, where one action is forbidden to answer not-known because an unknown id is its entry point while two sibling actions on the same store do answer it; read-order polarity, the corpus’s first descending read, watched at two postures; and the lost-answer row’s fourth surface, which sharpened the fork from two members to three by adding self-detecting because the guard inverted — Soft Delete’s second purge answers not-deleted rather than already-purged, since the guard tests standing-in-deleted. The read’s observation that Soft Delete needs the Indeterminate outcome discipline and does not declare it is correct and stays unfixed: the prose carried none to raise, so adding the family would be logic.
Council read 35 — Claude on the Observation reframe, 2026-09-13. Not a spec read but a naming ruling executed, and the first rename of an atom in the corpus. atoms/TAXONOMY.md has carried Clinical Observation as the masquerade candidate since 2026-06-08 — a neutral concept dressed in domain clothes — with the judgment gated on the EOS strip test and the reframe flagged as a follow-on nobody had run. The maintainer asked whether the atom was domain-specific; the answer was that the corpus had already ruled it was not, and the migration had since made the ruling checkable. A census of the migrated rule surface decided it: of 173 labelled rules, none carries a clinical semantic, and the 18 domain tokens all sat in prose. The same census cleared three false positives worth recording — Provenance’s 44 custodian hits are the neutral word for who holds a thing, Subscription’s ledger cites a composition, and Message Preference’s currency means being current — leaving Observation as the corpus’s only genuine name-level masquerade. Renamed to Observation with patient_ref to subject_ref, across 16 markdown files, two Alloy models, a coverage doc and a regenerated graph.md; the clinical-trial-portal demo and conformance stack were deliberately left alone, since a clinical trial portal is a healthcare deployment composing a neutral atom, which is the shape the reframe exists to produce. Two findings stand open. working-ideas/naming.md §5 requires a rename be a MAJOR bump whose dependents repoint by ID — no atom carries an id: and no spec carries a version, so the audit trail is this entry and a Decisions entry, and the spec with no version of its own docket row has now blocked real work rather than hypothetical work. And the strip test is mechanizable but not mechanized: domain: is a human judgment made once in June and never re-checked, where the census that decided this one took a minute to write.
Council read 36 — GLM on Observation, 2026-09-13. The first read of the reframed atom, and it found a conformance-blocking defect the checkers passed: Operation 12 reserved not-known to an observation_id that EXISTS, where Operation 11 forces not-known on every id naming no observation. The census behind it is the useful part and narrows the finding. Five atoms spell this reservation with EXISTS and two with names no record, and the EXISTS spelling is only meaningful beside a rule routing a blank id somewhere — Approval Step, Consent, State Machine and Soft Delete all carry that partner, and Observation alone did not, leaving a blank id with no legal answer at all: the reservation forbids the miss answer and every other arm sits behind checks a blank id cannot reach. The original prose routed an absent id to Not Known, so the fix is the other spelling rather than the other atoms’ shape. check.py gained V-unpartnered-reservation, which pairs each ONLY IF <id> EXISTS against the blank guards in its own file and fires on exactly the one defect. Two citation-aim repairs: Check 5.1 cited State 8, whose verb is carry, for a non-blankness the write guards own, and the read’s observation that the depth was uneven was right — Check 5.2 and Check 5.3 demanded bare presence for four fields the same guards protect, and now demand non-blankness too. One overclaim retracted: the atom’s prose called the answer-capture split the standard this corpus now takes, where the register carries it as an open docket row at four atoms; the read asked which, and the answer is that it is not law and the prose now says so. Two docket rows opened from the read’s own framing — the withdrawn constraint, and which direction a rule may point across a composition seam. The five host obligations watch NOTEs stopped carrying a census: a watch flag states the pressure and the docket row carries the count, which is the same law the family counts and the ≥ census took, applied to prose a checker does not read.
Council read 37 — GLM on the CR-36 fix pass, 2026-09-13. A verification read, and both receipts it asked for came back clean: the live labelled count is 174 with the Check family at 15, the read’s arithmetic exact and the Decisions’ 173 true as rename-day history; and Check 5.2 and Check 5.3 cite the blank guards (Operation 16, Operation 17, Operation 18) rather than the State rules whose verb is carry, so the citation-aim class did not recur inside the fix that repaired it. The read’s self-grade is worth keeping in the register because it is the argument for the census discipline made against its own author: the finding held and the framing did not, because a structural defect — a missing partner — was filed under a lexical lesson about an ambiguous word, and the cross-atom census is what separated them. Its new finding is the one acted on: the formal-model family is the corpus’s largest surface with no fix-loop coverage, which is why the Observation rename had to edit two Alloy module declarations by hand. lint.py gained check_formal_siblings: M-model-name pairs every .als and .tla module declaration against its file stem, and M-model-misplaced requires a Ledger’s formal: line to name models sitting beside the spec. Both fire. The second found a real topology break on its first run — Recoverable Invocation’s Ledger names recoverable-invocation.tla, and that file and its eleven twins live under Claude outputs/model/ rather than in compositions/, where every other spec’s models sit beside it. Tracked, not ignored, and left in place: moving twenty-four files is a structural decision the maintainer owns, and the finding is now visible on every run rather than resting on someone remembering. One deduction accepted and left standing: the posture census moved out of five watch NOTEs and into the host obligations docket row, which is hand-maintained — visible rot beating invisible rot, and the row’s numbers being rule-derivable means the instrument shape already exists whenever the maintainer prices it.

New readings append to this list. What the list does not carry is its own inverse — which migrated specs no read has read. The rewrite outran the council on 2026-09-12, and the gap is derived rather than kept by hand: tools/grace/cites.py --unread reads this register for the reads and the corpus’s qualifiers lines for the migrations, and names the difference. A spec counts as read when its name appears in a register entry’s subject, so Lease as rewritten and relabelled is Lease; an entry naming a version is a read of the grammar. Standing rule: a migrated spec the tool names is a spec whose rewrite nobody has checked, and the migration is not finished until the list the tool prints is empty.

Relationship to existing documents

pressure-testing.md — the authoring standard that feeds the Council’s review gate.
contributing.md — the contribution lifecycle that precedes Council admission.
execution-contract.md — sealed patterns are the stable inputs to the compilation pipeline.
Tamper Evidence — the integrity primitive the sealing mechanism instantiates.

Draft. The direction is right; the specifics are open.