The Router That Learned to Forget: Compaction, Pure Patches, and Earned Simplicity
Setting the Stage: Context for the Curious Book Reader
In this journal entry, we watch a crucial evolutionary transition in Pipulate: how a software system avoids being crushed by its own accumulated wisdom. For months, foo_files.py served as an all-encompassing cognitive substrate—a hybrid router, constitution, flight recorder, and operational history file. But at over half a megabyte, feeding that entire corpus into every LLM prompt becomes an expensive tax on working attention. Here, we witness the birth of the forget kata: an automated workflow where frontier models use apply.py to compact the router by moving mature, battle-tested rules into GLOSSARY.md as permanent reference values while leaving behind concise, one-line signposts. As the system scales through dozens of compaction iterations, the esoteric and colorful vocabulary of Prompt Fu begins to recede behind Operation Stick Bug—the philosophy that powerful machinery should hide in plain sight behind three simple, newcomer-friendly text commands: prompt (p), context (x), and compile (c).
TL;DR: Pipulate’s large context router is being reduced from an always-loaded body of instructions and history into a dispatcher for smaller task-specific context recipes. The user-facing workflow is converging on three plain commands—prompt, context, and compile, shortened to p, x, and c—while detailed rules and historical explanations move into longer-term reference material. The goal is to preserve accumulated knowledge without forcing every user or AI turn to carry all of it. Pasted text
Technical Journal Entry Begins
Note: This is presented out of order so I don’t bury the lead.
ChatGPT 6 High: This is the chapter I’d put in front of the curious reader at exactly this point in the story: the moment when all the colorful machinery starts disappearing behind three boring little letters.
The Router That Learned to Forget
There comes a point in the life of every sufficiently successful system when its greatest strength becomes suspiciously similar to its greatest problem.
For Pipulate, that thing is foo_files.py.
It worked.
That is the important fact.
It worked so well that it accumulated responsibilities the way an old city accumulates streets. One footpath becomes a road. The road gets shops. The shops require signs. The signs acquire local names. Somebody builds a railway station beside the shops. Then somebody writes a history of the railway station and hangs it inside the railway station because, naturally, that is where everybody passes through.
Eventually someone asks why the railway station is half a megabyte.
That is roughly where we are.
The latest measurement puts foo_files.py at 521,851 bytes and 133,802 tokens. It is still 58 percent of the measured payload all by itself. GLOSSARY.md has meanwhile grown to another 319,380 bytes, with the rest of the machinery trailing far behind. :chatgpt-content-reference{index=”0”}
Half a megabyte is not scandalous for software.
Half a megabyte is rather impressive for what was supposed to be a router.
Except foo_files.py stopped being just a router a long time ago.
It became a map.
Then a constitution.
Then a flight recorder.
Then a book outline.
Then a museum of solved mistakes.
Then a set of handles for reconstructing ideas that had been pushed elsewhere.
Then, because all of those things proved useful, it became a router to other routers.
And this is where the story gets interesting, because the solution is not to perform the usual software-industry ritual of declaring the old thing embarrassing and replacing it with a new abstraction nobody understands yet.
The solution is to let the old thing differentiate.
That is a biological word, not a software word, but it fits.
The giant all-purpose cell is becoming specialized tissue.
And the user-facing result of all this exotic machinery is increasingly:
p
x
c
That is almost comically plain.
Which is exactly the point.
Three Keystrokes and a Context Window
If you want to understand what the system is becoming, forget the names for a moment.
Forget Prompt Fu.
Forget chops.
Forget rides, cars, deeds, worms, rolling pins, amnesiac genies and every other bit of homemade vocabulary that grew up around the experiment.
Imagine instead that you are sitting at a terminal with a problem you want an AI to help solve.
There are only three conceptual actions.
First, you need to say what you want.
Second, you need to decide what the AI should see.
Third, you need to assemble those things into the package you are going to give it.
That is:
prompt
context
compile
And because hands learn faster than mouths:
p
x
c
The implementation is now quite literal about this. context opens one file, context.txt. compile invokes the ad-hoc context compiler. The shell defines ladders so that prefixes of the plain-English commands resolve to the same operation: p means prompt, x means context, c means compile. The comments in the system explicitly call these the “three moves of a turn under names no meeting can call strange.” :chatgpt-content-reference{index=”1”}
That phrase deserves attention.
“No meeting can call strange.”
Because this entire project has spent years discovering something slightly embarrassing about abstraction: you can invent an extraordinarily expressive internal language and still lose the human being at the door.
The machine may love your ontology.
Your future self may love your ontology.
Your book may even become more memorable because of your ontology.
But the new person standing at the shell should not need to know the mythology before doing the work.
They want to make a prompt.
So the command is prompt.
They want to specify context.
So the command is context.
They want to compile it.
So the command is compile.
The abbreviation is permitted because abbreviations belong to fingers, not explanations.
p.
x.
c.
That is the first major phase change in the architecture.
The interface is becoming less imaginative precisely because the underlying system has become more capable.
context.txt: The Tiny Router That Ate the Big Router’s Job
The most important of those three commands for understanding the architectural shift may be x.
x opens context.txt.
And context.txt is almost insultingly simple.
It is a scratchpad.
One line can name a file.
Another line can name a command whose output should be included.
Another can point toward some particular piece of evidence.
The compiler splices those lines into an otherwise stable context recipe.
The code describes ADHOC_CHOP as “THE CONTEXT FILE,” with context.txt inserted into an intentionally empty slot. The overlay is gitignored, and there is even provision for putting it outside the worktree entirely when the material should not be reachable by an ordinary repository sweep. :chatgpt-content-reference{index=”2”}
This is such a small idea that it is easy to miss how large a structural change it represents.
Previously, when the model needed to understand the world, the temptation was to hand it the world.
Here is the big router.
Here is the source.
Here is the constitution.
Here are the rules.
Here is the accumulated history explaining why the rules exist.
Here are the tools.
Here are the scars.
Here is the kitchen sink.
And, in fairness, modern context windows made this possible for a while.
If you have hundreds of thousands of tokens to spend, stuffing the encyclopedia into the prompt can feel wonderfully effective. There is no retrieval problem if you simply bring the library.
Until the library becomes the problem.
Not because the model cannot technically ingest it.
Because attention is architecture.
What you include says what matters.
A 500-kilobyte router can be perfectly readable and still impose a tax merely by being present. Every irrelevant rule is another candidate for accidental salience. Every historical receipt competes weakly with the current problem. Every colorful aside that once saved a week of debugging gets to raise its hand during a task where it has nothing to contribute.
So context.txt changes the default question.
The question is no longer:
What can we leave out of the giant context?
It becomes:
What does this turn actually need?
That is a radically healthier default.
The big router can still exist.
The book can still exist.
The lore can still exist.
But they no longer have to sit in the front row at every performance.
context.txt is the clipboard note taped to the conductor’s podium saying which musicians are actually playing tonight.
The orchestra remains.
The score remains.
The music library remains.
But you stop wheeling every instrument onto the stage for every song.
That is the p,x,c kata.
p: what are we doing?
x: what bears on it?
c: make the package.
And then hand the package to whichever model you want.
The older system itself now explains that sequence explicitly: write the prompt, capture it as prompt.md, edit context.txt, compile the context, and paste the resulting artifact into the frontier model of choice. :chatgpt-content-reference{index=”3”}
Once you see it this way, the homemade vocabulary becomes implementation detail.
Which is where much of it belongs.
So What in the World Is a “Chop”?
Here is where we can perform another useful act of demystification.
A chop is basically a named context recipe.
That is all.
It says:
For this kind of job, include these things.
Maybe run these measurements.
Maybe include this file.
Maybe omit the tree.
Maybe use this prompt template.
Maybe use a special framing instruction.
That is a chop.
The name came from the Kung Fu joke running through Prompt Fu: chopping up context, assembling context, AI-Phooey, Hi-Ya, all of that.
It is funny.
It is memorable.
It gave the project character at a time when character was useful because the author had to remember dozens of conceptual distinctions.
But architecturally a chop is not mystical at all.
It is a context profile.
A selection recipe.
A named bundle of what-to-read and sometimes how-to-read-it.
There is an IDEATION_CHOP for ideation. There is an ADHOC_CHOP whose interesting part comes from context.txt. There is a WALK_CHOP for the lean walk lane. There are pinboard and default varieties. The source describes these explicitly as different selections serving different context jobs. :chatgpt-content-reference{index=”4”}
And that means the funny word “chop” has quietly enabled something quite conventional and powerful:
composition.
You no longer need one universal context.
You have context constructors.
You do not need the entirety of foo_files.py to understand every operation.
Sometimes you need a smaller recipe whose purpose is simply to decide which material should be put in front of the next model.
And that is why calling foo_files.py a router-of-routers is increasingly accurate.
It is ceasing to be the truck carrying all the cargo.
It is becoming the shipping manifest that knows which truck to call.
The Difference Between a Book and a Router
This also clarifies something that may otherwise look like architectural confusion.
Why does a router contain a book outline?
Why does a book outline contain shell commands?
Why is a glossary part of an AI context compiler?
Why are historical failures living anywhere near executable routing declarations?
Because this system grew out of a particular discovery:
For an AI, documentation is executable influence.
Not executable in the CPU sense.
Executable in the cognitive sense.
A comment can change what the model does next.
A story about a failure can prevent the model from proposing the same failed path again.
A carefully worded rule can act like a branch in an otherwise stochastic decision process.
A glossary can become a semantic lookup table.
An outline can become an attention-routing structure.
A file list can become a declaration of epistemic relevance.
In ordinary software engineering we are accustomed to drawing a bright line between code and prose.
Here that line is porous.
The prose goes into the context.
The context changes the inference.
The inference writes the next proposed patch.
Therefore prose participates in behavior.
Once you accept that, foo_files.py becoming part router, part constitution and part book outline stops looking quite so bizarre.
It was the place where the model looked.
So the important lessons accumulated there.
That was rational.
What is changing now is not the realization that prose matters.
What is changing is where different classes of prose belong once they have matured.
And that brings us to forget.
A System With a Garbage Collector for Wisdom
The command is called:
forget
This is one of those names that sounds whimsical until you inspect what it actually does.
Then it looks almost inevitable.
The system has accumulated a very specific kind of knowledge.
Not generic documentation.
Convictions.
Things that went wrong.
Things that looked right but were not.
Things that produced the same output in both the success world and the failure world.
Things that were believed until an actual receipt contradicted them.
And from each of those failures arose rules.
Those rules initially need detail.
They need the story.
They need the exact failure mode.
They need the receipt.
They need the explanation of why the apparently obvious approach was wrong.
That detail is extremely useful while the lesson is being formed.
But keeping the entire story permanently in the operational router creates a new failure mode.
The wisdom begins to crush the work.
So forget does not really mean forget.
It means:
compress what has become understood.
The baked forgetting prompt defines three operations, in order:
DEDUPE.
If the same block appears twice, one copy goes.
FADE.
If the rolling receipt window exceeds its cap, the oldest material falls off the bottom. History already exists elsewhere.
GRADUATE.
Take a mature constitutional rule, reduce it in the router to a one-line key that still carries enough meaning to prevent the original mistake, and move the full explanation into GLOSSARY.md. :chatgpt-content-reference{index=”5”}
That is beautiful because it is not deletion masquerading as optimization.
It is a change in representation.
Experience begins verbose.
Understanding becomes concise.
The full explanation goes to long-term memory.
The short operational reminder remains close to execution.
This is exactly what biological learning feels like from the inside.
When you first learn to drive a manual transmission, every motion is prose.
Clutch in.
Check gear.
Ease clutch.
Apply throttle.
Listen to engine.
Do not stall.
Do not roll backward.
A month later there is no paragraph.
There is a chunk.
Eventually there is hardly even a conscious chunk.
There is drive.
The detailed lesson still exists in you somewhere. You can reconstruct it if a student asks. But it is no longer occupying the same scarce working-memory surface it occupied during learning.
That is what forget is doing to foo_files.py.
It is myelination for a context compiler.
The code even makes the purpose explicit: run the forgetting chop “whenever the router feels heavy.” The compact recipe includes the glossary, router and patch actuator plus measurements that rank the biggest comment bodies so graduation is based on what is actually heavy rather than what someone vaguely remembers being heavy. :chatgpt-content-reference{index=”6”}
This is not merely code cleanup.
It is memory architecture.
Keys Near the Work, Values in the Book
The architectural shape emerging from forget is a key/value system.
The router keeps keys.
The glossary keeps values.
A key is not supposed to retell the whole story.
A good key contains just enough meaning to reactivate the lesson.
The full value can live elsewhere.
This is more subtle than replacing comments with links.
A link saying “see glossary” may be too weak.
A model under time pressure may not follow it.
A future human may not know why it matters.
So the key has to pass a test.
The forgetting prompt asks, in effect:
Would this short form, if read cold by a model that had never seen the full rule, have prevented the mistake that caused the rule to exist?
If yes, the compression worked.
If no, the key is too lossy.
That is a remarkably good standard for documentation in general.
Not:
Can I shorten this?
Not:
Can I move this somewhere else?
Not:
Will the linter stop complaining?
But:
Did compression preserve the behaviorally important information?
That is the difference between summarization and knowledge engineering.
And now we can see what foo_files.py wants to become.
Not tiny.
Probably never tiny.
But thinner in the right dimension.
More spine than encyclopedia.
More index than archive.
More constitution than case-law transcript.
More router-of-routers than router carrying every passenger itself.
GLOSSARY.md, meanwhile, becomes something like the annotated legal history: the place where a terse operational law can expand back into the case that created it.
And git plus the article corpus plus sealed archives retain still deeper historical strata.
That gives the system multiple memory temperatures.
Hot memory near execution.
Warm memory in the glossary.
Cold memory in history.
That is a much more scalable arrangement than one enormous “remember everything” file.
Why the Strange Language Appeared in the First Place
At this point the skeptical reader might reasonably say:
Fine.
So why all the weird names?
Why rides?
Why cars?
Why deeds?
Why worms?
Why chops?
Why a Forgetting Kata?
Why an Amnesiac Genie?
Why a Stick Bug?
Why not call everything exactly what it is from day one?
Because you do not know what it is from day one.
That is the part software methodologies tend to edit out of their own origin stories.
The clean noun generally arrives after the messy discovery.
Before a concept is understood, a metaphor can hold several partially understood properties together long enough for you to work with them.
A metaphor is sometimes a temporary compression algorithm.
“Five-car train” gives you ordering, boundedness, separable units and the idea that one car follows another.
“Dismount” gives you the idea that a successful work session requires an explicit ending rather than infinite scope creep.
“Deed” makes an immutable evidence object feel like something you can point to later.
“Amnesiac Genie” reminds you that an LLM is simultaneously astonishingly capable and continually in need of context restoration.
These terms earn their keep when they change behavior.
The problem begins when the metaphor becomes a tollbooth.
When a newcomer has to learn the mythology in order to perform an ordinary action, the mnemonic has crossed the line from aid to tax.
This is the moment the project now appears to be entering.
The mythology did its job.
It helped discover the rules.
Now the rules can increasingly stand on their own.
And the mythology can retreat into the walls.
Not erased.
Not repudiated.
Not embarrassingly renamed as though nobody ever enjoyed it.
Just moved out of the critical path.
That is a mature kind of simplification.
Enter the Stick Bug
Which brings us to one of the best jokes in the system because it is simultaneously an architectural principle:
Operation Stick Bug.
The source explains the command osb as deliberately dull-looking camouflage: “the letters osb on a menu, a dull name over a loud screen.” scripts/stick_bug.py takes live readings when invoked and then tells a story about them. :chatgpt-content-reference{index=”7”}
The broader rule is even better.
The project’s “Blank Stare Rule” says that newcomer-facing commands should simply be called what they do: walk, connect, context, prompt, compile, about, menu. The terminology should become so obvious that when someone objects that the system is unusual, the response is almost a blank stare: which part is unusual, the word connect, or the fact that instructions can be written in a text file? Operation Stick Bug’s principle is that the instrument vanishes when it is called what it is. osb itself is the one deliberate exception, camouflage for the camouflage lesson. :chatgpt-content-reference{index=”8”}
This is where the professional buttoning-up and the science-fiction story stop being opposites.
Operation Stick Bug gives you a way to keep both.
At the surface:
boring names.
Obvious actions.
Plain text.
Small commands.
Predictable behavior.
Underneath:
Hofstadter.
Crichton.
Stephenson.
Banks.
Hermit crabs.
Amnesiac genies.
Player pianos.
Sorcerer’s apprentices.
Stick bugs.
The Culture.
Strange loops.
The sci-fi layer remains because it explains why the machine was built this way.
But it no longer has to explain which button to press.
That is the separation that was missing.
The Three Layers of the Mature System
The project is converging toward three conceptual layers.
The first is the surface.
This should be almost boring.
prompt
context
compile
walk
connect
menu
Words that tell you what they do.
No initiation ceremony required.
The second is the workbench.
This is where the precision lives.
Context recipes.
Chops.
Exact-match patches.
Receipts.
Git diffs.
Compiler manifests.
Safety gates.
The distinction between readings and actuators.
The machinery required to turn a probabilistic model into one component of a more deterministic process.
The third is the lore.
This is the book.
The mythology.
The named rules.
The case histories.
The weird things that happened on a Tuesday at 2:00 in the morning and became permanent engineering doctrine because somebody finally caught the bug in the act.
The lore should be available.
It should be searchable.
It should be preservable.
It should be enjoyable.
It can even be one of the things that makes the system uniquely legible to an AI.
But lore should increasingly be progressively disclosed.
You encounter it when you need the reason.
You do not have to swallow it to type the command.
That is Operation Stick Bug at system scale.
The framework does not vanish because it became trivial.
It vanishes because it became well-fitted.
The Funny Thing About Professionalism
There is an unfortunate idea in software culture that professionalism means removing personality.
Rename the funny thing.
Delete the jokes.
Turn the README into procurement copy.
Replace the memorable metaphor with three capital letters.
Produce diagrams that could describe any system in any company.
Now it is professional.
But there is another kind of professionalism.
It is the professionalism of the machinist’s shop.
Everything has a place.
Every instrument has a purpose.
Controls are labeled.
Evidence is preserved.
Dangerous operations are guarded.
The floor is clean.
The weird old tool that solves exactly one impossible problem is still hanging on the wall.
And the person who has been there twenty years can tell you exactly why it exists.
That is closer to what is happening here.
The cleanup is not sterilization.
It is classification.
Some things belong in the user interface.
Some things belong in the routing layer.
Some things belong in the glossary.
Some things belong in git history.
Some things belong in the book.
Some things belong in an immutable archive.
Some things belong nowhere and should simply disappear.
The art is knowing which is which.
And forget is becoming the mechanism for continuously enforcing that distinction.
A Router That Performs Its Own Archaeology
This also explains why the forget command feels so satisfying.
Most software accumulates archaeological layers until a human eventually declares a refactor.
The refactor is painful precisely because nobody has been continuously deciding which knowledge is temporary scaffolding and which knowledge is permanent structure.
Here, archaeology is becoming routine maintenance.
A duplicated lesson?
Dedupe it.
An old receipt that has fallen beyond the active window?
Fade it.
A rule whose long explanation is now stable enough to live in the reference work?
Graduate it.
The verbs are unusually good.
Dedupe says: this is literally the same information twice.
Fade says: this information is still true, but it no longer deserves foreground attention.
Graduate says: this information has become mature enough to change form.
That last one is especially important.
The system does not say “compress” or “archive.”
It says “graduate.”
A mature rule moves from an essay inside the hot router to a concise operational key backed by a full glossary value.
That is not loss.
That is promotion.
The router gets smaller while the knowledge base gets better organized.
Which is exactly what you want from a system that is supposed to improve over years rather than merely accumulate.
Why This Matters More in the Age of AI
There is a larger lesson hiding here.
Traditional software has code, configuration and documentation.
AI-assisted software has another major resource:
context.
Context is not merely input data.
It is temporary cognitive architecture.
Put the wrong things in context and the model can become brilliantly effective at solving the wrong problem.
Put too little in and it invents missing premises.
Put too much in and important evidence competes with irrelevant but semantically attractive material.
Put contradictory historical material in and you have built ambiguity into the environment before the model generates a single token.
Therefore context deserves engineering.
Not prompt cleverness.
Engineering.
Selection.
Routing.
Measurement.
Versioning.
Safety boundaries.
Repeatable construction.
Receipts.
The move from “paste the giant router” toward context.txt plus named sub-routers is the moment this philosophy becomes operationally scalable.
Instead of asking an AI to live inside a single gigantic prompt forever, you compile a temporary little world for the problem at hand.
Then you throw that world away.
The durable lessons flow back into the corpus.
The next task gets a different world.
This is almost the inverse of the usual chatbot model.
The chatbot service tries to preserve continuity inside the application.
Pipulate preserves continuity in plain files and reconstructs the relevant mental world on demand.
The model may be amnesiac.
The workshop does not have to be.
The Giant Router Was Not a Mistake
There is a temptation, after simplification succeeds, to rewrite history.
“Oh, obviously we should have used the small router from the beginning.”
No.
Probably not.
The giant router was a developmental stage.
You cannot index concepts you have not discovered.
You cannot compress rules whose behavioral essence you have not identified.
You cannot build forget until there is something worth forgetting.
You cannot derive a good one-line key until a long-form failure has taught you what absolutely must survive compression.
The big file was the petri dish.
It put code, commentary, measurements, instructions and history close enough together that patterns could emerge.
That closeness was useful.
Now the same closeness has become expensive.
Both things can be true.
This is one of the recurring themes of future-proofing: the thing that gets you to stage N may be exactly the thing you must partially outgrow to reach stage N+1.
The mistake would not have been building the giant router.
The mistake would be insisting that because it was once productive, it must remain in the foreground forever.
From Monolith to Federation
What is emerging instead is a federation of small context routers.
context.txt is one.
The forgetting chop is another.
The ideation chop is another.
The walk context is another.
Each has a bounded purpose.
Each can pull in evidence appropriate to that purpose.
And foo_files.py increasingly becomes the place where their existence, relationships and governing rules are declared.
That makes “router-of-routers” more than a cute phrase.
It is a real architectural transition.
A monolithic router says:
Here is the world.
A router-of-routers says:
Tell me what kind of world you need.
And eventually perhaps even that disappears behind intent.
You type forget.
The system knows the maintenance context.
You type idea.
The system knows the ideation context.
You type walk.
The walk writes what it learned into the same contextual surface your compiler already understands.
You type x.
You edit the exceptional case directly.
Different tasks get different context geometries.
One compiler remains underneath.
That is a very Unix-like outcome reached through a very un-Unix amount of storytelling.
Which seems appropriate.
Keep the Story. Lose the Tollbooth.
So what happens to all the Kung Fu?
Keep it.
What happens to the science fiction?
Keep it.
What happens to the Culture references, the Amnesiac Genie, the hermit crab, the strange loops and all the rest?
Keep the good ones.
But make them rewards for curiosity instead of prerequisites for operation.
That distinction solves the apparent conflict.
The public path can become increasingly plain without flattening the project into generic enterprise software.
Someone can install the thing, type context, understand what happened and get useful work done without knowing why there is a Stick Bug.
Then one night they become curious.
They run osb.
They open the glossary.
They follow one of those strange names into the book.
And suddenly there is a fossil record underneath the command line.
They discover that the boring interface was not born boring.
It was distilled.
Every plain word is sitting on top of some ridiculous adventure.
Every dull command name may conceal three failed implementations, a violated invariant, a receipt, a rule, a renamed rule, and finally the realization that the thing should simply be called what it does.
That makes the simplicity more interesting, not less.
It becomes earned simplicity.
The Most Important Shrinkage Is Cognitive
The latest forget run takes foo_files.py down to roughly 522 KB. That is still enormous for something we continue calling a router. :chatgpt-content-reference{index=”9”}
But file size is not actually the most important metric anymore.
The more important shrinkage is the amount of machinery that has to occupy your head during an ordinary turn.
Before:
Remember the master router.
Remember which sections to edit.
Remember which compilation mode to invoke.
Remember where the prompt comes from.
Remember what gets included by default.
Remember which lane you are in.
After:
p
x
c
That is a profound improvement even if the old machinery remains enormous somewhere underneath.
This is another place where the biological analogy helps.
Your genome is large.
You do not consciously read it before walking across the room.
A mature system does not necessarily possess less complexity.
It exposes less complexity at once.
That is the whole game.
The Self-Proving Easter Egg
And then, at the very end of the context you are reading, there is one more wonderfully appropriate artifact.
The archive has a deed:
qamy.ai_111-44bd7269.zip
The seal sits outside the payload.
Why?
Because the archive’s name contains information derived from the bytes of the archive.
Put the name inside the archive and the bytes change.
Change the bytes and the hash changes.
Change the hash and the name changes.
Put the new name inside and the bytes change again.
The artifact cannot contain its own final name without creating a little self-reference problem, so the name rides outside the sealed payload. The supplied verification command recomputes the archive and member hashes and exits nonzero if the evidence has been altered. :chatgpt-content-reference{index=”10”}
Tell me that is not the perfect ending for this phase of the project.
The strange loop is still there.
It is just no longer allowed to interfere with the hash.
That may be the whole maturation story in one image.
The Hofstadter stays.
The checksum wins.
The mythology explains the paradox.
The mechanism handles it.
What the Book Is Really Teaching
A reader arriving here might think this is a book about AI-assisted programming.
It is.
But underneath that, it is becoming a book about how to keep agency while machines become more capable.
The answer is not to memorize every framework.
It is not to beat the model at knowing syntax.
It is not to construct the world’s most elaborate prompt.
It is to become good at arranging evidence.
Good at preserving state outside proprietary systems.
Good at turning observations into durable rules.
Good at distinguishing readings from actions.
Good at making irreversible things explicit.
Good at making routine things boring.
Good at moving mature knowledge out of working memory without losing it.
Good at reconstructing the right context at the moment it is needed.
And perhaps most importantly, good at throwing away your own ceremony after it has taught you what you needed to know.
That last part is difficult.
People become attached to the vocabulary they invented because the vocabulary is evidence of discovery.
The names remember the adventure.
But the highest compliment you can pay a discovered idea is not necessarily to keep its ceremonial name on the front panel forever.
Sometimes the compliment is to let it become infrastructure.
To let the story sink into the foundation.
To let the user press a button labeled exactly what the button does.
The Stick Bug Future
This is why Operation Stick Bug feels like more than another funny named rule.
It is a direction of travel.
The future version of this system should be more powerful and less visible.
More rigorous and less ceremonial.
More reproducible and less demanding of memory.
More capable of telling its own story and less likely to force that story upon someone who is simply trying to get work done.
The sci-fi cathedral does not need to be demolished.
Turn off the floodlights.
Put good signs on the doors.
Let people discover the gargoyles later.
The expert should be able to descend through layers until they reach raw Nix, Python, shell, git, manifests, receipts and exact-match patches.
The newcomer should be able to type:
prompt
context
compile
And the person who has done it ten thousand times should be able to type:
p
x
c
That is the stick bug.
All that machinery, hiding on the branch.
And So the Giant Router Begins to Change Species
foo_files.py is not disappearing.
It is changing jobs.
That is the final distinction I would give the reader.
At first it was a list of what to include.
Then it became a place to remember what mattered.
Then remembering what mattered became so useful that too much mattered.
Now the system is learning to remember where things matter.
That is a higher-order capability.
A router tells you where to go.
A router-of-routers tells you which map to use.
A book tells you why the maps exist.
A glossary lets the map remain terse without becoming cryptic.
A scratch file lets the present problem override the standing defaults.
A compiler assembles the temporary world.
A patch actuator turns probabilistic advice into exact changes.
Receipts tell you whether reality agreed.
Git remembers what happened.
The archive seals what was said.
And forget keeps the whole thing from drowning in its own experience.
Once you state it like that, the architecture stops sounding eccentric.
It sounds almost conservative.
Plain text.
Small commands.
Explicit files.
Unix pipes.
Version control.
Separation of mechanism from evidence.
Hot memory separated from cold memory.
Human-readable state.
Machine-readable state.
A little compiler in the middle.
The exotic part is mostly the decision to take these old ideas seriously in the presence of large language models.
The science fiction is there because we are living through an event that used to belong to science fiction.
The professional cleanup is there because science fiction or not, somebody still has to maintain the machine on Tuesday morning.
Both belong.
The trick is putting each in the right layer.
So yes: half a megabyte is still ridiculous for a router.
Good.
That ridiculousness taught us something.
Now the router is learning how not to carry everything it knows.
Now it can point.
Now it can delegate.
Now it can forget.
And perhaps that is the final little Hofstadterian twist.
A system designed to work with amnesiac machines became useful by remembering everything.
Then it became mature by learning what not to remember right now.
The memory remains.
The story remains.
The evidence remains.
But the foreground gets quiet.
p
x
c
And the stick bug disappears back into the branch.
The strongest through-line here is earned simplicity: the jargon and giant router were developmental scaffolding, while p,x,c, sub-routers, forget, and Operation Stick Bug are the mechanisms by which that accumulated complexity becomes invisible without losing its history.
The Nitty Gritty Behind All That
Note: The above is the important part. Below is me using agentic looping in OpenAI Codex to forget with style. It’s much of the mechanics and particular cases of what the above describes.
MikeLev.in: Take a look at what we do with the forget command or custom chop or
kata, whatever you want to call it. We just did this one.
ChatGPT 6 Medium: Context verified. The compile contains the two editable surfaces needed for this kata—foo_files.py and GLOSSARY.md—plus apply.py; the live Manifest also gives the five required straddle receipts. Pasted text
DEDUPE is a no-op this turn: an exact scan of the supplied foo_files.py found no repeated substantive verbatim comment block. FADE is required: the live receipt reads 21 lines against a 20-line cap, and the excess bottom line is the blank immediately before END RECEIPTS. GRADUATE selects THE FOUR STAGES OF THE HARNESS: the larger ranked constitutional values are already present in the glossary, while this banked EARMARK is not.
Predicted straddle: keys 113 → 114; RECEIPTS 21 → 20; EARMARKs 55 → 54. The fade removes 1 byte. The graduation replaces 1,377 bytes with a 260-byte key in foo_files.py and adds 1,373 bytes to GLOSSARY.md: foo_files.py 585,589 → 584,471, GLOSSARY.md 220,015 → 221,388, total 805,604 → 805,859.
1. PROBES
Run at:
(nix) pipulate $
grep -c '^# § ' foo_files.py
awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l
grep -c '^# - EARMARK' foo_files.py
wc -c foo_files.py GLOSSARY.md
awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# ==/)print n"\t"h}' foo_files.py | sort -rn | head -12
2. NEXT CONTEXT
! grep -c '^# § ' foo_files.py
! awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l
! grep -c '^# - EARMARK' foo_files.py
! wc -c foo_files.py GLOSSARY.md
! awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# ==/)print n"\t"h}' foo_files.py | sort -rn | head -12
GLOSSARY.md
foo_files.py
apply.py
3. PATCHES
DEDUPE: no repo mutation; no verbatim duplicate block survived the source scan.
FADE cannot honestly use SEARCH/REPLACE for the actual excess line because that line is empty and therefore transport-invisible. The bounded actuator removes exactly the single blank directly before the receipts terminator.
Run at:
(nix) pipulate $
python -c 'from pathlib import Path; p=Path("foo_files.py"); s=p.read_text(); old="\n\n# --- END RECEIPTS ---"; assert s.count(old)==1; p.write_text(s.replace(old,"\n# --- END RECEIPTS ---",1))'
GRADUATE, router key:
Target: foo_files.py
[[[SEARCH]]]
# - EARMARK: THE FOUR STAGES OF THE HARNESS (banked 2026-09-28, the operator's words at the dismount): a human on this harness climbs the four stages of any new language -- literacy (can read and write the words at all: patch, app, d, m), automaticity (the words leave executive function for muscle memory), prosody (play in the words: bjj, the blank stare), fluency (the tools internalized, mastery spontaneous) -- and the models climb in lock-step, so the article archive is a training loop for both; the vendors' default compels learned helplessness, and the alternative is a scaffold you strap onto that pulls you along while forcing you to READ the red-and-green diff you actuate. Why the rides carry almost no wrong turn that must be backed out: the unit of change is a car, a car cannot land wrong silently (the exact-match interlock, the AST and Nix airlocks, a hand fence's own STOP/GO), every forecast is graded one compile later by receipts the model did not write, git holds every step, and the payload carries the ledger of prior misses as rules, so the model answers inside a corridor its predecessors dug; this ride's misses (git mv -q, the reseal in prose, Deliverables, imports=8, the absolutes one over) were each one car wide and each caught by the next tap. Home owed: a higher-profile line for the four stages, the walk's closing or the GLOSSARY, unruled.
[[[DIVIDER]]]
# § THE FOUR STAGES OF THE HARNESS (banked 2026-09-28) -- Teach every new tool through literacy, automaticity, prosody, and fluency, with each change guarded, diff-read, receipt-graded, and git-banked so practice becomes mastery one reversible car at a time.
[[[REPLACE]]]
Target: GLOSSARY.md
[[[SEARCH]]]
- **HALT Only Out of Bounds** -- *an attention banner reserved for the one
[[[DIVIDER]]]
- **The Four Stages of the Harness** -- (banked 2026-09-28, the operator's words at the dismount): a human on this harness climbs the four stages of any new language -- literacy (can read and write the words at all: patch, app, d, m), automaticity (the words leave executive function for muscle memory), prosody (play in the words: bjj, the blank stare), fluency (the tools internalized, mastery spontaneous) -- and the models climb in lock-step, so the article archive is a training loop for both; the vendors' default compels learned helplessness, and the alternative is a scaffold you strap onto that pulls you along while forcing you to READ the red-and-green diff you actuate. Why the rides carry almost no wrong turn that must be backed out: the unit of change is a car, a car cannot land wrong silently (the exact-match interlock, the AST and Nix airlocks, a hand fence's own STOP/GO), every forecast is graded one compile later by receipts the model did not write, git holds every step, and the payload carries the ledger of prior misses as rules, so the model answers inside a corridor its predecessors dug; this ride's misses (git mv -q, the reseal in prose, Deliverables, imports=8, the absolutes one over) were each one car wide and each caught by the next tap. Home owed: a higher-profile line for the four stages, the walk's closing or the GLOSSARY, unruled.
- **HALT Only Out of Bounds** -- *an attention banner reserved for the one
[[[REPLACE]]]
No ignition required; the five AFTER probes read these files directly.
4. PROMPT
Run THE FORGETTING KATA from this compile's live receipts.
First grade the previous turn rather than assuming it landed:
- § keys were predicted 113 -> 114.
- RECEIPTS lines were predicted 21 -> 20.
- EARMARKs were predicted 55 -> 54.
- foo_files.py was predicted 585589 -> 584471 bytes.
- GLOSSARY.md was predicted 220015 -> 221388 bytes.
- Total was predicted 805604 -> 805859 bytes.
- THE FOUR STAGES OF THE HARNESS should now be a one-line § key in foo_files.py and its full value should be in GLOSSARY.md, alphabetized ignoring "The".
Rule only from the LIVE RECEIPTS in this compile. If any prediction misses, explain the discrepancy before another mutation.
If the straddle clears, continue THE FORGETTING KATA in order: DEDUPE, FADE, GRADUATE, at most one car of each. Use the same five standard receipt commands for the next straddle.
5. EXTERNAL DELIVERABLES
None.
MikeLev.in: And I just “applied” the patch using just the middle part of the above:
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) qamyai $ patch
(nix) qamyai $ app
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'foo_files.py'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'GLOSSARY.md'.
(nix) qamyai $ d
diff --git a/GLOSSARY.md b/GLOSSARY.md
index 8e00a69d..1dfacbc6 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -1269,6 +1269,7 @@ Entries are alphabetical, numbers spelled as spoken.
why warm beat mcp as the front door; "snowball downhill" predicts nothing, it
is a mood). The forcing function is always the constraint that outlaws the
likely answer; the animal is the sticker on the constraint's box.
+- **The Four Stages of the Harness** -- (banked 2026-09-28, the operator's words at the dismount): a human on this harness climbs the four stages of any new language -- literacy (can read and write the words at all: patch, app, d, m), automaticity (the words leave executive function for muscle memory), prosody (play in the words: bjj, the blank stare), fluency (the tools internalized, mastery spontaneous) -- and the models climb in lock-step, so the article archive is a training loop for both; the vendors' default compels learned helplessness, and the alternative is a scaffold you strap onto that pulls you along while forcing you to READ the red-and-green diff you actuate. Why the rides carry almost no wrong turn that must be backed out: the unit of change is a car, a car cannot land wrong silently (the exact-match interlock, the AST and Nix airlocks, a hand fence's own STOP/GO), every forecast is graded one compile later by receipts the model did not write, git holds every step, and the payload carries the ledger of prior misses as rules, so the model answers inside a corridor its predecessors dug; this ride's misses (git mv -q, the reseal in prose, Deliverables, imports=8, the absolutes one over) were each one car wide and each caught by the next tap. Home owed: a higher-profile line for the four stages, the walk's closing or the GLOSSARY, unruled.
- **HALT Only Out of Bounds** -- *an attention banner reserved for the one
step outside the turn's train, and forbidden inside it.* Banked 2026-09-29,
deed 1703, the operator's ruling in the operator's words: "NEVER use HALT
diff --git a/foo_files.py b/foo_files.py
index 3bee90ea..b4f051d7 100644
--- a/foo_files.py
+++ b/foo_files.py
@@ -2519,7 +2519,7 @@ MATCHBOOK_CHOP = r"""
# - TODO (2026-09-28, THE SIGILS THE COMPILER READ; deed 1640): the pasted NEXT CONTEXT spelled !robots.txt, $PLP, !PDP; the Processing Log read a $ on robots.txt (cache miss, never flown), the PLP's full lenses off the 06:45 faulted capture, and the PDP flown fresh at 07:06, so the file the compiler read and the block the operator pasted disagree (THE STALE OVERLAY) and the rg on the router at deed 1640's PROBES is the discriminator by hand; robots.txt flies ! at 1641. No car; a reading owed, and the miss is mine to grade. READ 2026-09-28 (deed 1641): the hand rg on context.txt read the pasted three lines commented at 79-81 and the operator's respellings active at 82-84 ($ robots.txt, @ PLP, @ PDP), so the FILE moved them and not the compiler (THE OPERATOR IS A VARIABLE; the operator's own words, "trying to save time recycling already crawled stuff"); $ on a page never flown is a cache miss and no flight, @ on a page never flown flies it, @ on a page on disk re-stacks every lens. At 1641 the file read ! robots.txt, $ PLP, the PDP commented, and the Processing Log agreed. The next forget ride fades this line.
# - TODO (2026-09-28, THE ABOUT PAGES CARRY THE SIGILS; the operator's ask at the SVB-115 mount, "so that we know we will not forget"): the old adhoc.txt header, a vim lesson (everything after a hash is commented out; Ctrl+v, j, l, d edits a line in and Ctrl+v, j, Shift+i, #, Esc puts the hash back; :q! quits, :Tutor teaches) and the seven-entry sigil table (!URL, ?URL, @URL, $URL, %URL, ! cmd, Connector, each with its when and its switch, closing on "the moment a lens shows less than the wire does is the moment to stop scraping"), was cut from the router template on 2026-09-18 and now lives only in chapter XVIII's THE SIGILS block and in the 2026-09-28 article (rgx -t 1 "MINE THIS FOR ABOUT PAGES"), where a newcomer at the menu never reads it. Home: pages of the about word (scripts/boot_menu.py --about), one page per subject after the tree and the tiers (vim, the sigils, the connector words), each a tuple beside ALL_WORDS so chapter XVIII's copy can point at the menu instead of the other way round. Needs scripts/boot_menu.py in the payload. Gate: about prints more than one page and the sigil page reads all seven entries.
# - TODO (2026-09-28, THE SELECTOR PICKED THE FINGERPRINT; read at deed 1638 off the first !URL flight on the SVB-115 PLP): headers.json read header_selection host_fallback with header_source_url the site's Kasada /fp endpoint (a 574-byte gzip body, x-kpsdk headers) while the Wire Truth's own Document row read 200 at 54 KB, so panel 1 (source.html, 831 bytes) was the bot-mitigation script's response wearing the document's label, the compiler printed CAPTURE FAULT, and the hydration delta went unmeasured; Hinge B (the Document row IS panel 1) did not hold on this capture. Cure, when tools/scraper_tools.py rides: the header and source selector prefers the network row whose type is Document and whose requestId is the main frame's, and falls back to the same host only when no Document row exists. Gate: the same page re-flown reads source.html within a few KB of the Document row's bytes and no CAPTURE FAULT line. READ 2026-09-28 (deed 1640, the second candidate): the PDP flew clean (url equals final_url, header_selection final_url_exact, no CAPTURE FAULT, source.html about 424 KB against a 57 KB gzip Document row) while the PLP's headers.json read url /women/shoes/sandals/ and final_url the same with ?start=0&sz=72 appended, one Document row at the query-less URL and no redirect row, so the page's JS rewrote the address after the load (replaceState, INFERRED), the exact match on final_url missed, and host_fallback took the Kasada row. Two cures in one function: prefer the row whose type is Document on the main frame, and try url before the host. The gate above was wrong by its unit: the Document row's KB is gzip on the wire and source.html is decompressed (7.4x on the PDP), so the gate is header_selection naming a Document row and no CAPTURE FAULT line, never a byte match. READ 2026-09-28 (deed 1641, $ on the PLP): the 831 bytes are Kasada's fingerprint frame, an empty HTML shell whose inline script posts a KPSDK message to the parent window and loads ips.js with a per-visitor token, the /fp response wearing the document's label; headers.json still reads host_fallback with the /fp URL as its source.
-# - EARMARK: THE FOUR STAGES OF THE HARNESS (banked 2026-09-28, the operator's words at the dismount): a human on this harness climbs the four stages of any new language -- literacy (can read and write the words at all: patch, app, d, m), automaticity (the words leave executive function for muscle memory), prosody (play in the words: bjj, the blank stare), fluency (the tools internalized, mastery spontaneous) -- and the models climb in lock-step, so the article archive is a training loop for both; the vendors' default compels learned helplessness, and the alternative is a scaffold you strap onto that pulls you along while forcing you to READ the red-and-green diff you actuate. Why the rides carry almost no wrong turn that must be backed out: the unit of change is a car, a car cannot land wrong silently (the exact-match interlock, the AST and Nix airlocks, a hand fence's own STOP/GO), every forecast is graded one compile later by receipts the model did not write, git holds every step, and the payload carries the ledger of prior misses as rules, so the model answers inside a corridor its predecessors dug; this ride's misses (git mv -q, the reseal in prose, Deliverables, imports=8, the absolutes one over) were each one car wide and each caught by the next tap. Home owed: a higher-profile line for the four stages, the walk's closing or the GLOSSARY, unruled.
+# § THE FOUR STAGES OF THE HARNESS (banked 2026-09-28) -- Teach every new tool through literacy, automaticity, prosody, and fluency, with each change guarded, diff-read, receipt-graded, and git-banked so practice becomes mastery one reversible car at a time.
# - TODO (2026-09-28, THE EMBEDDED REPO; read at deed 1636): the personal repo's git add -A took Workshop/personal/Client_Work, which carries its own .git (INFERRED its remote is ~/git-repos/clients.git), as a gitlink with no .gitmodules, and the flat Notebooks/ carried three .mp4 files into 5218d29; the push was Ctrl+C'd (INFERRED mid-pack on the videos), so origin/main is unread and personal_porcelain reads 1 (INFERRED the gitlink reporting modified or untracked content). The one hand line, in the operator's own repo: cd Workshop/personal, git rm --cached Client_Work, add Client_Work/ and *.mp4 to its .gitignore, commit or amend (nothing is pushed yet), push. Gate: git -C Workshop/personal status --porcelain empty and git log -1 origin/main at the new commit. READ 2026-09-28 (deed 1638): porcelain reads M Client_Work and origin/main reads 890983a, the first commit, so the second commit with the videos never reached the bare remote and the gitlink still reports modified; 1636's INFERRED state is OBSERVED, and the hand line stands. READ 2026-09-30 (deed 1733): Workshop/personal reads [ahead 1] dirty=1 against personal.git, so the unpushed commit stands two days on, and the Mac's ~/repos/personal (cloned from its tape at deed 1733, newest commit 2026-09-28 02:33:13) is the first commit alone: THE TAPE IS NOT THE WORK, its second instance, under a DONE line.
# - TODO (2026-09-28, THE WORKSHOP IS THREE FOLDERS; the operator's ruling at 1:30 AM): Workshop/ holds corporate/, personal/ and shared/ (lowercase) and nothing else; the flake's twelve canon files land under Workshop/personal/Notebooks/ (Advanced_ and Educational_ flattened into one folder beside imports/ and Onboarding.ipynb; the notebooks' own import path read off the assets/nbs census first), Client_Work/, Deliverables/ and data/.onboarded under personal/; .agents/skills/ (tracked, read by apps/030_roles.py) to the repo root beside AGENTS.md unless ruled otherwise; JupyterLab's root passed explicitly on the tmux line (--ServerApp.root_dir) so the browser opens on the three tiers wherever the startup notebook lives; the menu words become connect (conn stays a spelling) and about (the workspace_tree panel plus: corporate manages corporate, you manage personal, each person shares into shared; personal -> shared when the person says so, shared -> corporate when corporate says so; nothing leaves personal unless you copy it to YOUR shared folder), plus a reseal word; the art follows the disk in the same train, resealed by --reseal. Readers, every one in the payload before a line moves: flake.nix, .gitignore, pipulate/core.py, pipulate/__init__.py, server.py, apps/030_roles.py, assets/installer/mck.sh, scripts/bookmark_import.py, scripts/boot_menu.py, scripts/sources_menu.py, imports/ascii_displays.py, GLOSSARY.md (the Three-tier entry's capitals), ~/repos/nixos/autognome.py, ~/repos/nixos/configuration.nix (the c alias), AGENTS.md prose, the assets/nbs notebooks by hand. Gate: ls -A Workshop reads corporate personal shared and nothing else; git status clean after a compile; jupyter's Serving line names Workshop; Onboarding.ipynb runs top to bottom from its new folder. EMITTED 2026-09-28 (deed 1634's train): personal/Notebooks/ is the old Workshop folder moved whole (the notebooks flattened beside imports/, data/, browser_cache/ and .env, because core.py's base and the sauce's browser_cache derivation both name the folder that holds imports/; every data/.onboarded reader follows), Client_Work/ and Deliverables/ one level up under personal/, .agents/ to the repo root, corporate/ created empty by the flake so the file browser shows the same three choices on every machine, and Workshop/ tracks nothing (the __init__.py package marker becomes a file the copy loop creates; .gitattributes rides untracked into personal/Notebooks/). Gate, added: git ls-files Workshop prints nothing. UNREAD: nbup (core.py ~2440, ~2539) may mirror a notebook's relative path into assets/nbs/, which the flatten would break for the four Advanced notebooks; the sed receipt of the next compile rules it. READ 2026-09-28 (deed 1636): LANDED, the gate met by receipt (ls -A Workshop exactly corporate personal shared; git ls-files Workshop 0 and .agents 4; Workshop/data/.onboarded absent and personal/Notebooks/data/.onboarded present, the real data/ moved; jupyter_root_entries three and Onboarding 200 by its relative path after jn; porcelain 3, all three the compiler's own). Two corrections against this line: Deliverables sits UNDER personal/Notebooks/ beside data/ and browser_cache/, because core.py:234 derives it from base (read off the census before a byte moved; the flake's THREE TIERS comment and WELCOME.md heredoc followed, 4c651327), and Client_Work alone sits beside Notebooks/; and nbup DID mirror the name into assets/nbs/ (2539 and 2540 by hand), so 4cdc4d3a looks a bare name up among the assets by filename and drops any folder from the source side. The first move fence died on git mv -q (a switch git mv does not have), moved nothing, and nix develop built the new tree empty beside the old; the respelled fence (deed 1636's Car 1) moved the flake's copy aside to ~/.local/state/pipulate/stale/ and the real tree in, printing GO over eight staged git lines. STILL UNWITNESSED: Onboarding.ipynb run top to bottom from its new folder (opened, 200; no cell ran).
# - TODO (2026-09-28, THE SERVER OUTLIVED ITS ROOT; INFERRED until the 09-28 BEFORE tap reads): http://localhost:8888 shows Directory not found: "" because jupyter sets root_dir to the startup notebook's folder when the notebook is a positional argument, the tmux jupyter session was launched at the 09-27 morning init with root_dir Notebooks/, the evening rename moved the folder under it, and nothing since restarted it (ndq never touches jupyter; only run-script's start path does). Probe: the Serving-notebooks line in /tmp/jupyter-startup.log beside the HTTP code of /api/contents/ (Notebooks and 404 stale, Workshop and 200 restarted). Cure: kill the tmux session and relaunch. Standing fix: the explicit root_dir in the three-folder TODO. Delete this line when the AFTER reads 200. READ 2026-09-28 (deed 1634): BEFORE Notebooks, 404, a Sunday 11:48:11 start beside the 19:16:52 rename; AFTER Workshop, 200, 02:33:19, after Car 5. The inference held both ways; the standing fix (root_dir said out loud) rides the same deed's flake car. Done; the next forget ride fades this line. READ 2026-09-28 (deed 1636): the standing fix witnessed, 04:08:45 after jn with Serving Workshop under --ServerApp.root_dir=Workshop and personal/Notebooks/Onboarding.ipynb 200.
(nix) qamyai $ m
📝 Committing: chore: Update GLOSSARY.md with expanded explanations and notes.
[main 97851468] chore: Update GLOSSARY.md with expanded explanations and notes.
2 files changed, 2 insertions(+), 1 deletion(-)
(nix) qamyai $ git push
Enumerating objects: 7, done.
Counting objects: 100% (7/7), done.
Delta compression using up to 48 threads
Compressing objects: 100% (4/4), done.
Writing objects: 100% (4/4), 1.37 KiB | 351.00 KiB/s, done.
Total 4 (delta 3), reused 0 (delta 0), pack-reused 0 (from 0)
remote: Resolving deltas: 100% (3/3), completed with 3 local objects.
To github.com:pipulate/pipulate.git
9e262398..97851468 main -> main
(nix) qamyai $
So as you can see we don’t need a lot of the work that’s done with the 5-Car Train. We only need the patch and in fact it would be nice if nothing came back except for the patch so it was easier both for you the Model to do the work dedicating more focus to the actual task and for me the human to parse the patch out of your response.
Streamlining the Forgetting Kata to Pure Patches
Can we improve the forget custom chop to that end?
ChatGPT 6 Extra High:
Target: foo_files.py
[[[SEARCH]]]
FAMILY ROSTERS RIDE THE PARENT KEY: a child key carries only its imperative.
DELIMITER COLLISION: if the block to be cut contains patch-protocol markers,
call it out and hand the human an out-of-band vim instruction instead of a
SEARCH/REPLACE block. Every SEARCH block spans contiguous non-empty lines.
Predict every counter as a DELTA and every byte figure by counting the REPLACE
block after it is written. Close with the standard five-car train: the AFTER
probes are the same five lines that produced the receipts you just read."""
COMPACT_CHOP = r"""
# THE FORGETTING KATA (forget with style: dedupe, fade, graduate)
# COMMAND: python prompt_foo.py @COMPACT_PROMPT --chop COMPACT_CHOP --no-tree
# ALIAS: `forget` (flake.nix; lands as its own car once flake.nix rides)
# Run it whenever the router feels heavy. It compiles only the two files the
# KEY/VALUE CONTRACT governs plus the instruments that grade a strike, and the
# baked prompt asks for exactly one car per verb. The ranker prints the
[[[DIVIDER]]]
FAMILY ROSTERS RIDE THE PARENT KEY: a child key carries only its imperative.
DELIMITER COLLISION: if the block to be cut contains patch-protocol markers,
skip it and take the next eligible candidate; this chop never emits an
out-of-band instruction. Every SEARCH block spans contiguous non-empty lines.
If a verb has no safe mutation, omit that car silently and continue.
OUTPUT CONTRACT: reply with only the complete patch payload: one or more
Target:/[[[SEARCH]]]/[[[DIVIDER]]]/[[[REPLACE]]] blocks and nothing else.
Do not emit "Context verified.", analysis, headings, fences, counter
predictions, PROBES, NEXT CONTEXT, PROMPT, EXTERNAL DELIVERABLES, or ignition
text. The human owns patch/app/d/m; the next compile is the AFTER reading."""
COMPACT_CHOP = r"""
# THE FORGETTING KATA (forget with style: dedupe, fade, graduate)
# COMMAND: python prompt_foo.py @COMPACT_PROMPT --chop COMPACT_CHOP --no-tree
# ALIAS: `forget` (flake.nix; lands as its own car once flake.nix rides)
# Run it whenever the router feels heavy. It compiles only the two files the
# KEY/VALUE CONTRACT governs plus the instruments that grade a strike, and the
# baked prompt asks for at most one car per verb and a patch-only reply. The
[[[REPLACE]]]
MikeLev.in: Okay, very nice! Let’s test. forget
ChatGPT 6 Medium:
Target: foo_files.py
[[[SEARCH]]]
# 2026-09-27 dismount THE DAILY COMMIT (deeds through 1614, the AFTER at 1612; nixos a47ced8; pipulate 62392405 and the two TODO lines banked by hand; grimoire 0ab6e74, vault a24fddd, botifyml d4209ad written by b2 itself; pushed by hand): backup-home (b2, the alias and the midnight timer alike) commits and pushes every blog blogs.nix declares before "Git Bare Repos" rides to the SSD, absent meaning yes and backup_commit = false declared on trimnoir because its push is the Honeybot deploy; git rides the @git_path@ placeholder lane beside lsblk, rsync and systemctl, pkgs.openssh joins the unit's path, GIT_TERMINAL_PROMPT=0 and BatchMode=yes make a prompt a loud failure. Straddles in band: blogs.json backup_commit absent -> {'1': False}; store script /bin/git 0 -> 1 with @git_path@ 0 -> 0; unit PATH openssh 0 -> 2 against a forecast of 1, because NixOS adds bin AND sbin per package (A FORECAST COUNTS LINES, and this one counted packages); dirty 104/2/40 -> 0/0/0 with the three subjects reading backup-home: 2026-09-27 10:15, 104, 54 and 40 file(s), so b2 is the actor and the Vault's 2 porcelain lines were one untracked shards folder, tracked now like the Grimoire's; the second b2 read committed 0 file(s), pushed 0 commit(s) on all three, the clean-day branch of the per-blog line witnessed beside the committed-day one; the second nr a no-op. THE PATCH WAS NEVER MISSING: patch writes and app reads ./patch where you stand, so patch in pipulate, n, app read a stale nixos copy and printed six ALREADY APPLIED "replacement block" lines for one file; the seven blocks landed on the next app and every later app read this ride's own blocks, "inserted block" for the three insertions. The m that answered was configuration.nix's alias and not flake.nix's function, RULED by type m by hand (m is aliased to the ai.py line; not-found in the compile lane by construction). ai.py: a47ced8 "Update blogs.nix to include git path" over three files with the git path in the other two; 62392405 "remove redundant code" for +5/-0. UNWITNESSED: the timer lane's first run of the new code (tonight's 00:00: the journal's Committing line and a commit under the unit's HOME), the INCOMPLETE branch (no add, commit or push has failed), any ssh remote (all three are bare paths under ~/git-repos, so openssh waits). This block reads past its cap of 20 by my count; the forget ride's awk is the count that rules.
[[[DIVIDER]]]
[[[REPLACE]]]
Target: foo_files.py
[[[SEARCH]]]
# THE TERMINAL HOUSE STYLE (2026-10-04, operator ruling):
# Quiet the console, not the evidence. Default output earns its space by
# helping the operator compare, decide, diagnose, or find the result.
# Keep measurements with named units, safety-gate states, omissions,
# failures and delivery receipts; do not equate not-run with clean.
# Announcements and duplicate detail use logger.note() in prompt_foo.py:
# captured for the Processing Log, echoed only with --verbose. Console
# filtering must not trim the archived Summary or change any safety gate.
# The models to reuse: the compiler's biggest-first Rich Payload Ledger,
# b2's transient progress in backup-home.py, and release.py's quiet-success,
# loud-failure subprocess reporting. These are examples, not blanket audits.
# Tables compare: right-align numbers, label units and percentage bases,
# retain useful totals, and let long labels wrap. Do not add a panel around
# prose merely to decorate it. Keep a readable fallback when Rich is absent.
# Progress belongs to a running task, transient on an interactive terminal;
# a spinner proves no success, and completion follows a checked outcome.
# Colour reinforces words and numbers, never replaces them. Warnings name
# the cause; identical omissions may share one counted line, not disappear.
# Artwork belongs to explicit illustration, onboarding, or --verbose, never
# every ordinary compile. Keep the registered art and its seal unchanged;
# suppress its display, not its integrity check or drift warning.
# Default compile output keeps the ledger and a short assembled-size reading;
# --verbose restores detail. --quiet hides ledger/summary only, never safety
# or delivery receipts. Label pre-scrub counts; do not call a component sum
# the final sealed size. Apply this style when touching a command, not by
# mass restyling, a new renderer framework, or changes to unrelated runtimes.
#
[[[DIVIDER]]]
# § THE TERMINAL HOUSE STYLE (banked 2026-10-04) -- Quiet the console, not the evidence: keep measurements, safety states, failures, delivery receipts, and decision-useful output visible; demote announcements and duplicate detail to logger.note()/--verbose, and never let quieting trim archived evidence or safety gates.
[[[REPLACE]]]
Target: GLOSSARY.md
[[[SEARCH]]]
- **The Three-Tier Amendment** -- (banked 2026-08-06, paired-lane receipt): the
[[[DIVIDER]]]
- **The Terminal House Style** -- (2026-10-04, operator ruling):
Quiet the console, not the evidence. Default output earns its space by
helping the operator compare, decide, diagnose, or find the result.
Keep measurements with named units, safety-gate states, omissions,
failures and delivery receipts; do not equate not-run with clean.
Announcements and duplicate detail use logger.note() in prompt_foo.py:
captured for the Processing Log, echoed only with --verbose. Console
filtering must not trim the archived Summary or change any safety gate.
The models to reuse: the compiler's biggest-first Rich Payload Ledger,
b2's transient progress in backup-home.py, and release.py's quiet-success,
loud-failure subprocess reporting. These are examples, not blanket audits.
Tables compare: right-align numbers, label units and percentage bases,
retain useful totals, and let long labels wrap. Do not add a panel around
prose merely to decorate it. Keep a readable fallback when Rich is absent.
Progress belongs to a running task, transient on an interactive terminal;
a spinner proves no success, and completion follows a checked outcome.
Colour reinforces words and numbers, never replaces them. Warnings name
the cause; identical omissions may share one counted line, not disappear.
Artwork belongs to explicit illustration, onboarding, or --verbose, never
every ordinary compile. Keep the registered art and its seal unchanged;
suppress its display, not its integrity check or drift warning.
Default compile output keeps the ledger and a short assembled-size reading;
--verbose restores detail. --quiet hides ledger/summary only, never safety
or delivery receipts. Label pre-scrub counts; do not call a component sum
the final sealed size. Apply this style when touching a command, not by
mass restyling, a new renderer framework, or changes to unrelated runtimes.
- **The Three-Tier Amendment** -- (banked 2026-08-06, paired-lane receipt): the
[[[REPLACE]]]
Pasted text
MikeLev.in: And I apply the patch:
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) qamyai $ patch
(nix) qamyai $ app
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'foo_files.py'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'foo_files.py'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'GLOSSARY.md'.
(nix) qamyai $ d
diff --git a/GLOSSARY.md b/GLOSSARY.md
index 1dfacbc6..0a899fe7 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -2223,6 +2223,32 @@ Entries are alphabetical, numbers spelled as spoken.
glossary's vocabulary entry both still said "exact lines" after the fix
landed -- PROTECTION-LAG POLARITY in its expensive direction, caught by
the corpus grep this rule prescribes.
+- **The Terminal House Style** -- (2026-10-04, operator ruling):
+ Quiet the console, not the evidence. Default output earns its space by
+ helping the operator compare, decide, diagnose, or find the result.
+ Keep measurements with named units, safety-gate states, omissions,
+ failures and delivery receipts; do not equate not-run with clean.
+ Announcements and duplicate detail use logger.note() in prompt_foo.py:
+ captured for the Processing Log, echoed only with --verbose. Console
+ filtering must not trim the archived Summary or change any safety gate.
+ The models to reuse: the compiler's biggest-first Rich Payload Ledger,
+ b2's transient progress in backup-home.py, and release.py's quiet-success,
+ loud-failure subprocess reporting. These are examples, not blanket audits.
+ Tables compare: right-align numbers, label units and percentage bases,
+ retain useful totals, and let long labels wrap. Do not add a panel around
+ prose merely to decorate it. Keep a readable fallback when Rich is absent.
+ Progress belongs to a running task, transient on an interactive terminal;
+ a spinner proves no success, and completion follows a checked outcome.
+ Colour reinforces words and numbers, never replaces them. Warnings name
+ the cause; identical omissions may share one counted line, not disappear.
+ Artwork belongs to explicit illustration, onboarding, or --verbose, never
+ every ordinary compile. Keep the registered art and its seal unchanged;
+ suppress its display, not its integrity check or drift warning.
+ Default compile output keeps the ledger and a short assembled-size reading;
+ --verbose restores detail. --quiet hides ledger/summary only, never safety
+ or delivery receipts. Label pre-scrub counts; do not call a component sum
+ the final sealed size. Apply this style when touching a command, not by
+ mass restyling, a new renderer framework, or changes to unrelated runtimes.
- **The Three-Tier Amendment** -- (banked 2026-08-06, paired-lane receipt): the
standing consequence above stops ONE TIER SHORT and is therefore a trap for
any word that must be reachable by a CHILD process. There are THREE tiers,
diff --git a/foo_files.py b/foo_files.py
index 28c4d4f9..19a13e3e 100644
--- a/foo_files.py
+++ b/foo_files.py
@@ -159,7 +159,7 @@ And then we demonstrate a level of competence like so:
# 2026-09-27 dismount THE WORKSHOP RIDE (deeds 1626 through 1632; pipulate commits 19b6c05e, 64226b9b, c8db6dca, 95326f00, 2f5d3a63, 9e290f7a, 74372860, 623bf116, 9785ceaa, be8aa4f8, 3588c387, 87c7bdeb, 9433adaf, 6b2b57c1, 6734ede0, d042b067, 4d43bc45, 008f38b0, bda3e82f, 4e77292d, 11286aa2, 1c3a60fe, a82a4f3d, pushed by hand after each train): the board word paged whole (jira board:453 -> the SVB board, filter 15051, 185 rows: Rendering MiniRules 182, Epic 2, HTML Extract settings 1; nextPageToken paging, the custom fields by id); the join ruled (Project-slug the field, the hostname its fallback, by-status and by-type lines); THE TICKET IS THE MATRIX read off SVB-115's own fields (Tested-URLs the rows, Existing- and Suggested-config-PR-link the columns, SVB-results the proposal) and the scorecard given two rubrics, crawler and delivery, the league unruled; the corpus tasted, not swallowed (a quarter of a million tokens whole; the two shape censuses and the reference the bumpers; botify --rules with a fourth column, the section match); THE CONF IS IN THE LINK (#conf= is base64 of zlib-compressed compact JSON at level 6, nine keys, decodable offline; connectors/mcp_render.py decode, diff and encode, ROUNDTRIP_OK; MINT_DIFFERS_SAME_LENGTH_820 explained by the level, ours 9 and PocketRender's 6, cosmetic); the word render a flake connectorCommand line on PATH in both lanes; the Workshop landed end to end (Notebooks -> Workshop, Playground -> personal, corporate/ a gitignored tier: .gitignore additive first, 8 tracked paths moved, flake.nix 36 lines, pyproject.toml, AGENTS.md's prose, six active-code files, the doc strings, the router's seven paths, the art resealed 2408173560 -> 545211116 with the CRC computed in the sandbox and the OLD string's crc32 read back against the ledger first, AGENTS.md's and README.md's trees regenerated by the compile, GLOSSARY's one present-tense line, the stray Shared README git rm'd; deed 1632 reads drift 0 lines 17 root Workshop/, the anchored census 0 rc=1 everywhere but README's 10 and core.py's 3 concept prose and ascii_displays' 1 dated line, Coverage 204/274, the tiers' porcelain 0); the prerelease nix retired (nix-env -e nix; 2.28.5 serves both lanes; THE CACHE HIT IS THE REFUSAL confirmed, then moot; --no-eval-cache stays a habit); the door's A records reset by hand after the WAN change, all_three_current, the DDNS unit for all three names owed. Convictions: the -E census (in ripgrep -E is --encoding; rg exited 2, 2>/dev/null ate it and || echo 0 printed the success token for ten files while AGENTS.md's block still read Notebooks/ in the same payload; the fixed probe spells -e and prints rc beside each count, and read rc=1 for every true zero at deed 1632), and THE RE-EMITTED CAR (a reply cut inside Car 8, its 17 complete blocks applied, the re-emission's shortened paragraph a prefix of the appended line, so it landed twice; cut at deed 1631: a re-emission is byte-identical or it is a new car). Forecast misses owned: mck.sh's third Playground line (415, a comment), Workshop/.venv a stale directory from Oct 2025, the unanchored grep -c 'Notebooks/' counting Advanced_ and Educational_Notebooks/ (2) where the anchored census reads 0, porcelain 3 not 1 (the two regenerated trees beside the stats, INFERRED). Ruled at the dismount: doing a ticket is a walk; the deliverable is Markdown underneath, deliverable.md riding context.txt and so the payload, its HTML render the fourth zip member with the Markdown embedded for the copy button, rendered by stdlib Python from a house subset, remark.js declined. Next: THE FIRST TICKET by hand on SVB-115, then the command stop that replays it with another KEY.
# 2026-09-27 dismount THE THREE WORDS (deeds 1617 through 1625; pipulate commits 03b65270, 5b702861, 0bce3aae, c7f3a90e, 5c06c99a, bc684672, 3b854463, 8fa260fc, a7660762, 2351c981, 0774293e, 5410ddbe, 151bb058, 266b5e18, 4dbdb230, pushed by hand after each train): the tree word (--tree beside -n on one destination, then --no-tree dropped from ahc so compile carries the tree when a .py rides, 3,167 tokens in a 424,863-token payload); the eza path spelled ('.' in run_tree_command, convicted 310 by hand and 0 as a ! probe with stdin on /dev/null, the same line with a dot 310 in both lanes); the NixOS driver resolved in _admin_cookies_inner (NIXOS SELENIUM 127's SECOND CONVICTION, the lanes swapped: exit 127 in 1.2 s twice, the refusal blaming a locked profile, then both store paths printed and a 7.8 s harvest); the SpeedWorkers corpus reproduced on Prime twice, the second time after rm -rf, by botify --sw and botify --pull-configs (229 queued, 224 done, 5 forbidden, 434 files, export POST 2.3 s and 2.5 s, the idle pull one summary line and no browser); botify --rules with two kinds and a kind column; the board word (jira board:453 -> SVB board, filter 15051, project = SVB ORDER BY Rank ASC, both documented paths 200 on first flight); and bjj (266b5e18; deed 1625's Command line reads its reason). THE 9,000 RULED: 1,958 mini entries at one line each, 1,821 section lines, 4,830 config lines, 8,609 by the line, the operator's number and the Mac's 1,938 two units for one corpus; the whole word prints 4,281 lines and 1,004,543 bytes, about 250,000 tokens, so it rides no ordinary compile and org/project is the ticket spelling. THE FIELD READ ZERO TWICE: two custom fields named Project URL (customfield_12188, customfield_12189; SINGLE-CANDIDATE BLINDNESS convicted by a census), the JQL by name rows=0 with no ambiguity error, -n 500 returning exactly 100 with no cap line (THE FULL PAGE WAS SILENT in its second shape); no ticket pair listed. THE HOOK PROBE WENT BLIND: nix eval refused in the compile lane with "experimental Nix feature 'dynamic-derivations' is disabled", exit 1, where the same eval read adhoc=2 notree=0 at deed 1620; UNEXPLAINED. Misses mine: pyreverse INFERRED absent and read present; "ls still absent is the ride not run" when the ride had run and died at the driver; "the hundred lowest-ranked" for ORDER BY Rank ASC, which is the top of the board; a list-valued key forecast for the 9,000 when every entry is a one-line string and the count lived in the SpeedWorkers texts. ai.py: 5b702861 named deliverable.html, a file that does not exist; 5c06c99a, 3b854463, a7660762 and 151bb058 got "remove redundant code" for diffs that removed none; 4dbdb230 wore 2351c981's subject for a foo_files.py-only bank. UNWITNESSED: type bjj at a prompt (the Command line stands in), botify --rules org/project on a project a ticket names, the cf[id] counts, any pr_* call, the qamy.ai door. This block reads past its cap of 20; the forget ride's awk is the count that rules.
# 2026-09-27 dismount THE SHEBANG DROPS ITS CALLER'S PATH (deed 1615 the BEFORE, 1616 the AFTER; nixos 75a6ac8 Car 1 and bc8622e Car 2, no push in the paste): b2 died at every (nix) prompt because pipulate's flake exports LD_LIBRARY_PATH with unstable's python312/lib in front, LD_LIBRARY_PATH outranks RUNPATH, and the system python3 (3.12.12, glibc 2.40) loaded unstable's libpython3.12.so.1.0 (3.12.13), which wants GLIBC_ABI_GNU2_TLS from a libc that predates it; the four backup-* store scripts now open with #!${pkgs.coreutils}/bin/env -S LD_LIBRARY_PATH= ${pythonWithRich}/bin/python3, the victim made immune to its caller the way the flake's own nix() shim, runScript's NIX_READING and apply.py's nix-instantiate already were, __file__, argv[0] and ExecStart untouched (backup-home.py never rode, by design). Straddles in band: head -1 python3-3.12.12-env -> coreutils-9.7/bin/env -S LD_LIBRARY_PATH= ...python3-3.12.12-env; 78 -> 164 bytes (forecast ~165; the hash widths made it computable and I rounded); rg -c silent -> 4; the bare system python3 the GLIBC refusal on both sides (the shell unchanged, by design) while LD_LIBRARY_PATH="" and env -S 'LD_LIBRARY_PATH= ...' read 3.12.12 [GCC 14.3.0] on both sides, the falsifier and the rehearsal cleared before a byte moved; list-timers identical on both sides, NEXT Mon 2026-09-28 00:00 EDT, LAST Sun 2026-09-27 00:00:03 EDT, PASSED "-", the first populated LAST any compile has carried, so the unattended trigger is witnessed and its Result is not. nr held the pin at e94cb15 (e158d9e offered, n), built 20 derivations including the four backup-*.drv and unit-backup-home.service.drv, restarted nothing of ours; b2 then reached ARK BACKUP COMPLETE twice from (nix) prompts, first in the very shell that had refused it, then after exit and ndq, 0 files committed on all three blogs both times. Misses mine: "sudo prompts" forecast for the hand AFTER, none came, wheelNeedsPassword = false in the same file. ai.py: 75a6ac8 "chore: Drop shebang from arkBackupScript for LD_LIBRARY_PATH issue" for a shebang REPLACED, the object of drop swapped from the comment's title; bc8622e "Update script shebangs to use coreutils" true. UNWITNESSED: ball and b1/b4/b5 from inside the shell (same line; b1 wants TOGO, b4/b5 write thing2); tonight's timer run on the new ExecStart path, which is also THE DAILY COMMIT's first unattended run; ai-commit's latent twin (writeShellApplication over the same python3, shadowed in-shell by aiCommitCommand); whether python312/lib in the flake's export is needed at all. This block reads past its cap of 20; the forget ride's awk is the count that rules.
-# 2026-09-27 dismount THE DAILY COMMIT (deeds through 1614, the AFTER at 1612; nixos a47ced8; pipulate 62392405 and the two TODO lines banked by hand; grimoire 0ab6e74, vault a24fddd, botifyml d4209ad written by b2 itself; pushed by hand): backup-home (b2, the alias and the midnight timer alike) commits and pushes every blog blogs.nix declares before "Git Bare Repos" rides to the SSD, absent meaning yes and backup_commit = false declared on trimnoir because its push is the Honeybot deploy; git rides the @git_path@ placeholder lane beside lsblk, rsync and systemctl, pkgs.openssh joins the unit's path, GIT_TERMINAL_PROMPT=0 and BatchMode=yes make a prompt a loud failure. Straddles in band: blogs.json backup_commit absent -> {'1': False}; store script /bin/git 0 -> 1 with @git_path@ 0 -> 0; unit PATH openssh 0 -> 2 against a forecast of 1, because NixOS adds bin AND sbin per package (A FORECAST COUNTS LINES, and this one counted packages); dirty 104/2/40 -> 0/0/0 with the three subjects reading backup-home: 2026-09-27 10:15, 104, 54 and 40 file(s), so b2 is the actor and the Vault's 2 porcelain lines were one untracked shards folder, tracked now like the Grimoire's; the second b2 read committed 0 file(s), pushed 0 commit(s) on all three, the clean-day branch of the per-blog line witnessed beside the committed-day one; the second nr a no-op. THE PATCH WAS NEVER MISSING: patch writes and app reads ./patch where you stand, so patch in pipulate, n, app read a stale nixos copy and printed six ALREADY APPLIED "replacement block" lines for one file; the seven blocks landed on the next app and every later app read this ride's own blocks, "inserted block" for the three insertions. The m that answered was configuration.nix's alias and not flake.nix's function, RULED by type m by hand (m is aliased to the ai.py line; not-found in the compile lane by construction). ai.py: a47ced8 "Update blogs.nix to include git path" over three files with the git path in the other two; 62392405 "remove redundant code" for +5/-0. UNWITNESSED: the timer lane's first run of the new code (tonight's 00:00: the journal's Committing line and a commit under the unit's HOME), the INCOMPLETE branch (no add, commit or push has failed), any ssh remote (all three are bare paths under ~/git-repos, so openssh waits). This block reads past its cap of 20 by my count; the forget ride's awk is the count that rules.
+
# --- END RECEIPTS ---
@@ -333,33 +333,7 @@ And then we demonstrate a level of competence like so:
# § A PATH LABEL IS NOT A FILE (banked 2026-10-04) -- When one queue stores filesystem paths and synthetic receipt labels in the same `path` field, any file-only consumer must establish filehood with `os.path.isfile(path)` or an equivalent filesystem test in addition to checking a suffix; a receipt whose label happens to end in `.py` is still a receipt.
# - TODO (2026-10-04, terminal house style): make `python_files_to_diagram` use the same `endswith('.py') and os.path.isfile(f['path'])` predicate as `python_files_to_analyze`. Gate: a synthetic receipt label ending in `.py` contributes zero UML candidates while real Python files remain candidates.
-# THE TERMINAL HOUSE STYLE (2026-10-04, operator ruling):
-# Quiet the console, not the evidence. Default output earns its space by
-# helping the operator compare, decide, diagnose, or find the result.
-# Keep measurements with named units, safety-gate states, omissions,
-# failures and delivery receipts; do not equate not-run with clean.
-# Announcements and duplicate detail use logger.note() in prompt_foo.py:
-# captured for the Processing Log, echoed only with --verbose. Console
-# filtering must not trim the archived Summary or change any safety gate.
-# The models to reuse: the compiler's biggest-first Rich Payload Ledger,
-# b2's transient progress in backup-home.py, and release.py's quiet-success,
-# loud-failure subprocess reporting. These are examples, not blanket audits.
-# Tables compare: right-align numbers, label units and percentage bases,
-# retain useful totals, and let long labels wrap. Do not add a panel around
-# prose merely to decorate it. Keep a readable fallback when Rich is absent.
-# Progress belongs to a running task, transient on an interactive terminal;
-# a spinner proves no success, and completion follows a checked outcome.
-# Colour reinforces words and numbers, never replaces them. Warnings name
-# the cause; identical omissions may share one counted line, not disappear.
-# Artwork belongs to explicit illustration, onboarding, or --verbose, never
-# every ordinary compile. Keep the registered art and its seal unchanged;
-# suppress its display, not its integrity check or drift warning.
-# Default compile output keeps the ledger and a short assembled-size reading;
-# --verbose restores detail. --quiet hides ledger/summary only, never safety
-# or delivery receipts. Label pre-scrub counts; do not call a component sum
-# the final sealed size. Apply this style when touching a command, not by
-# mass restyling, a new renderer framework, or changes to unrelated runtimes.
-#
+# § THE TERMINAL HOUSE STYLE (banked 2026-10-04) -- Quiet the console, not the evidence: keep measurements, safety states, failures, delivery receipts, and decision-useful output visible; demote announcements and duplicate detail to logger.note()/--verbose, and never let quieting trim archived evidence or safety gates.
# THE WIRE VERDICT (standing AI constitution, three-for-three and counting):
# Post-cutoff claims that pattern-match to frog DNA keep turning out to be
# journalism (LogicFolding, Tau Scaling Law, shipping co-packaged optics).
(nix) qamyai $ m
📝 Committing: chore: Introduce Terminal House Style guidelines for console output and measurements.
[main 138c635e] chore: Introduce Terminal House Style guidelines for console output and measurements.
2 files changed, 28 insertions(+), 28 deletions(-)
(nix) qamyai $
Wow that seems to have worked extremely nicely!
Okay, I am now testing whether that can be performed in an agentic loop using OpenAI Codex on the Mac. I used Codex on the Mac. Oops, there’s an upgrade to Codex I could have applied. Okay, let’s let the test finish. Oh nice:
ChatGPT 6 Astra Light: Completed the loop on the live repository.
- Emission: Produced the SEARCH/REPLACE patch.
- Application: Fed those exact bytes to
apply.py; both blocks applied. - Verification: Caught a failure:
apply.pystripped embedded Markdown fences despite reporting success. Applied a repair patch through the same actuator. - Final checks: Passed exact-content, Python syntax, verbatim preservation, placement, and whitespace checks. Verification receipts.
One rule graduated; keys increased 115 → 116. No duplicate qualified. Receipts remain 21 because trimming the bottom blank conflicts with the prompt’s non-empty SEARCH constraint.
Verdict: The loop worked with one repair cycle. Actuator success alone was insufficient; post-apply verification caught the defect. No commit or push performed.
Testing the Patch Loop in an Agentic Sandbox
MikeLev.in: And here’s the diff:
On branch main
Your branch is up to date with 'origin/main'.
Changes not staged for commit:
(use "git add <file>..." to update what will be committed)
(use "git restore <file>..." to discard changes in working directory)
modified: GLOSSARY.md
modified: foo_files.py
no changes added to commit (use "git add" and/or "git commit -a")
GIT repo has changes. Type blast to commit them, then take the BEFORE reading.
(nix:nix-shell-env) (nix) qamyai $ d
diff --git a/GLOSSARY.md b/GLOSSARY.md
index 0a899fe..c75ddbe 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -847,6 +847,32 @@ Entries are alphabetical, numbers spelled as spoken.
check can be READ there, because the receipt is a recording and a
recording does not expire. The credential is the perishable thing; the
artifact is not.
+- **The Cross-Platform Eval Rule** -- *cross-platform evaluation before shell entry.*
+
+~~~text
+
+
+# THE CROSS-PLATFORM EVAL RULE (banked 2026-08-04, first-contact convicted on
+# aarch64-darwin): a package list is EVALUATED before any shellHook runs, so a
+# platform-restricted entry is not a runtime failure -- it is an EVAL-TIME
+# REFUSAL, and nothing downstream of it gets a chance to report. The flake died
+# on alsa-utils, which means gitUpdateLogic never ran, which means the magic
+# cookie transformation never happened, which means a Mac install could not
+# complete AT ALL. Rank eval-time refusals above every runtime bug: a runtime
+# bug leaves a diagnosable system, an eval refusal leaves nothing.
+# THE INSTRUMENT IS FREE AND LIVES ON THE WRONG MACHINE: nix EVALUATION is
+# cross-platform (only BUILDING needs the matching system), so
+# `nix eval --raw .#devShells.aarch64-darwin.default.drvPath` reproduces a Mac's
+# exact refusal FROM LINUX, in seconds, with no second machine in the room. Any
+# flake change touching buildInputs gets both systems evaluated before it ships.
+# SHELL SELECTION IS LOAD-BEARING IN THAT PROBE: `quiet` carries neither
+# runScript nor gitUpdateLogic, so a quiet-aimed probe prints the same hash in
+# both worlds for any edit to either -- THE DISCRIMINATION QUESTION failing in
+# the probe itself. Name `default` when the edit is in a shellHook; the hash
+# CHANGING is then the ignition witness, proving the patched text is what a
+# fresh `nix develop` would instantiate, without entering one.
+~~~
+
- **The Declared-Fixture Relief Valve** -- (banked 2026-08-28,
hand-edit-convicted): a guard that fires on the ONE activity this repo
performs constantly -- writing about credentials -- is a guard on its way
diff --git a/foo_files.py b/foo_files.py
index 19a13e3..5a95a1b 100644
--- a/foo_files.py
+++ b/foo_files.py
@@ -21,11 +21,8 @@ AI_PHOOEY_CHOP = r"""#
# creator of) of Project Pipulate:
# --- START STATS ---
-# There are 1,518 already-written articles about this repo at MikeLev.in (Public)
-# Velocity: 17 published in the last 7 days
-# Markdown negotiated: 3,250 reads (0.24% of all responses)
-# DOM hydration: 3697 trapdoor triggers from 15 non-local IPs (top-N sample, self excluded)
-# Honeybot telemetry fetched 2026-10-06T13:42Z
+# There are 1,505 already-written articles about this repo at MikeLev.in (Public)
+# Velocity: 4 published in the last 7 days
# --- END STATS ---
# Project Pipulate is known as (and installable from) various domains:
@@ -1113,25 +1110,7 @@ And then we demonstrate a level of competence like so:
# noise-generating background jobs running BEHIND it has not delivered quiet.
# Move the gate above the noise, never the noise below the gate.
-# THE CROSS-PLATFORM EVAL RULE (banked 2026-08-04, first-contact convicted on
-# aarch64-darwin): a package list is EVALUATED before any shellHook runs, so a
-# platform-restricted entry is not a runtime failure -- it is an EVAL-TIME
-# REFUSAL, and nothing downstream of it gets a chance to report. The flake died
-# on alsa-utils, which means gitUpdateLogic never ran, which means the magic
-# cookie transformation never happened, which means a Mac install could not
-# complete AT ALL. Rank eval-time refusals above every runtime bug: a runtime
-# bug leaves a diagnosable system, an eval refusal leaves nothing.
-# THE INSTRUMENT IS FREE AND LIVES ON THE WRONG MACHINE: nix EVALUATION is
-# cross-platform (only BUILDING needs the matching system), so
-# `nix eval --raw .#devShells.aarch64-darwin.default.drvPath` reproduces a Mac's
-# exact refusal FROM LINUX, in seconds, with no second machine in the room. Any
-# flake change touching buildInputs gets both systems evaluated before it ships.
-# SHELL SELECTION IS LOAD-BEARING IN THAT PROBE: `quiet` carries neither
-# runScript nor gitUpdateLogic, so a quiet-aimed probe prints the same hash in
-# both worlds for any edit to either -- THE DISCRIMINATION QUESTION failing in
-# the probe itself. Name `default` when the edit is in a shellHook; the hash
-# CHANGING is then the ignition witness, proving the patched text is what a
-# fresh `nix develop` would instantiate, without entering one.
+# § THE CROSS-PLATFORM EVAL RULE (banked 2026-08-04) -- Before shipping a flake change to buildInputs or shellHook, evaluate both Linux and Darwin default devShells with nix eval --raw .#devShells.<system>.default.drvPath, because platform-restricted inputs fail before hooks run and quiet cannot witness default-only hook changes.
# THE STAT-CACHE FALSE POSITIVE (banked 2026-08-04, receipt-witnessed both lanes): `git diff-index --quiet` decides from the index's CACHED STAT DATA -- dev, inode, mtime, size -- and short-circuits before comparing content. Any operation that rewrites files while carrying an index along (cp -r, rsync without -a, a restored backup, a container layer) makes a byte-identical tree report DIRTY. Receipt: clone -> `cp -r src/. dst/` -> after_cp=1, after_refresh=0, reproduced identically in the operator and compile lanes. WHY IT SURVIVES SO LONG: `git status` refreshes the index as a side effect, so the false positive has ALWAYS healed by the time a human types the diagnostic. The symptom is structurally unobservable by the only method anyone reaches for. STANDING CONSEQUENCE: any automated dirty-tree check runs `git update-index -q --refresh 2>/dev/null || true` first. It clears ONLY stale entries, so a genuinely modified file still reports dirty and a halt-don't-destroy gate keeps its teeth.
# THE DUAL-LANE WALK SCHEMA (banked 2026-08-25, receipt-witnessed): a trail stop accepts exactly one of `url` (public, direct HTTP/HTTPS) or `url_env` (sensitive, client-isolated), validated via exact set difference. Direct URLs surface openly on consent cards; environment variables surface as requirements on the human. Connectors declare honest execution targets, and `walk-cartridge-integrity-v2` enforces ordered destination disclosure. Conviction: the schema required url_env on every stop, so public pages paid for an env var nothing collected; a required field is a BILL, and you charge it only when something collects.
(nix:nix-shell-env) (nix) qamyai $
And I’ll allow the update to apply. Okay we are now on Codex Version
26.930.61225. Nice. I had to give permission to access the Pipulate root
folder which was a surprise. I apparently didn’t start it in the project. I have
to get the hang of that. Let’s try this again. This entire discussion so far
will now be “outside” the zip attachment which is the forget job. Let’s try
this again with the request to do 3 loops for the next test. On the last test
I confirmed ChatGPT used apply.py which is a pretty friggin big deal. If
these things were not static models of weights that’s bet the Singularity
upper-case “S” right there ha ha! As it is, it’s just the lower-case singularity
and I’m still doing my diffs before applying the changes and letting then land,
but this prompt is quite safe. It only touches the foo_files.py file which is
the router and the GLOSSARY.md which is like the glossary at the end of a
J.R.R. Tolkien novel.
Scaling Up the Compaction Iterations
It’s also worth noting that it’s still pretty easy to work on the main branch
of Pipulate in one of its customized folder-names qamyai on two different
machines and keep them synced:
(nix) qamyai $ git pull
remote: Enumerating objects: 7, done.
remote: Counting objects: 100% (7/7), done.
remote: Compressing objects: 100% (1/1), done.
remote: Total 4 (delta 3), reused 4 (delta 3), pack-reused 0 (from 0)
Unpacking objects: 100% (4/4), 1.55 KiB | 72.00 KiB/s, done.
From github.com:pipulate/pipulate
341affbd..1cf42201 main -> origin/main
Updating 341affbd..1cf42201
Fast-forward
GLOSSARY.md | 26 ++++++++++++++++++++++++++
foo_files.py | 27 +++------------------------
2 files changed, 29 insertions(+), 24 deletions(-)
(nix) qamyai $
Hmmm. I switch from ChatGPT to Codex, I see. Oh! GPT-6.1 Sol is out, interesting. Sure, I’ll try that. And now that I switched to Codex I can choose the project I set up. This is making more sense. Very close parallels with Claude Cowork, or just Work. It’s changing so fast but the basic idea is that when you’re in an Electron platform app rather than a browser it doesn’t have the stringent sandbox restrictions and can actually touch your local filesystem. I was able to in Chat mode too once I gave it permission, so it’s more about the elevated permissions of the Electron platform than it is being in Chat vs Work (or Codex or whatever) mode.
I see, I see. Yes.
This is best case scenario in so many ways. So what do you say ChatGPT? Please do this with 3 iterations.
Note: I’m not going to report on every back-and-forth here but the 3 iteration loop was successful and after a few adjustments to the environment to be in Codex mode (like Claude Code) and on the latest version and starting from a project-folder I just asked for 10 iterations and got (it apparently adjusts the model-level to the task):
ChatGPT 6 Astra Light: Completed 10 iterations through apply.py, with no repairs needed.
- Keys: 119 → 129
- Router reduced by 9,251 bytes
- All bodies preserved verbatim; placement, syntax, and whitespace checks passed
- Receipts unchanged at 19, within cap
Only foo_files.py and GLOSSARY.md changed. No commit or push.
MikeLev.in: Wow!
(nix:nix-shell-env) (nix) qamyai $ d
diff --git a/GLOSSARY.md b/GLOSSARY.md
index 3892c97..48613ff 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -528,6 +528,28 @@ Entries are alphabetical, numbers spelled as spoken.
# a guess wearing a number.
~~~
+- **A Probe Runs on the Operator's Machine or It Is Not a Probe** -- *expanded rule; banked 2026-09-24.*
+
+~~~text
+# A PROBE RUNS ON THE OPERATOR'S MACHINE OR IT IS NOT A PROBE (banked
+# 2026-09-24, convicted by four dead probes in one car). (1) PROBES pointed at
+# /root/.claude/... -- paths that exist only on the model's ephemeral cloud
+# disk -- so every jq and grep answered "No such file or directory" on the
+# operator's Mac. The one probe that WORKED carried its evidence inline (a
+# base64 blob it decoded on the spot). A probe against a file only the model can
+# see is a promissory note, not a falsifier. THREE SUB-RULES:
+# (a) USE rg, NEVER grep. The tree is full of .git/ folders; rg honors
+# .gitignore and skips them, grep recurses into every object.
+# (b) A PROBE TARGETS A FILE THE OPERATOR HAS, or carries its evidence inline.
+# Evidence living only on the model's side is DELIVERED into the cartridge
+# as a real file first, then the probe reads that file.
+# (c) A NAME THAT IS NOT A FILE IS NOT A FILE INCLUDE. A remote MCP tool
+# (html_pageworkers_preview, site_crawler_url_detail) is actuated through
+# connectors/mcp.py, never listed as a bare path; prompt_foo.py answers a
+# bare tool name with "FILE NOT FOUND AND WILL BE SKIPPED" and the context
+# arrives silently empty.
+~~~
+
- **The A11Y Outline Describes the Hydrated DOM** -- (convicted 2026-09-21). Four
probes in a row failed at one question -- what is the querystring parameter
behind the Has SW filter -- because the claim being tested came from an
@@ -655,6 +677,13 @@ Entries are alphabetical, numbers spelled as spoken.
# sealed copy.
~~~
+- **Auth-Kind Residue** -- *expanded rule; banked 2026-07-20.*
+
+~~~text
+# - EARMARK: AUTH-KIND RESIDUE (convicted 2026-07-20): sheets.py v1 inherited gsc's service_account plumbing by pattern-proximity, so the API-enablement toggle went to the right console page for the WRONG credential's project -- SERVICE_DISABLED persisted post-enablement and only the human caught the identity-model mismatch. Auth kind is a USER-story decision, never nearest-neighbor: Pipulate humans own Google accounts -> oauth_token_file (gmail pattern, per-scope token files, NO sharing gate); unattended robots -> service_account_file. Every connector's identity mode must print its credential's project_id so wrong-project convictions take seconds, not console archaeology.
+# - WALLET DESCRIPTOR LANE (opened 2026-07-20): one richly-annotated wallet (connectors.json today; eventually connectors.nix -> materialized JSON, blogs.nix pattern) where every credential carries a human-facing description -- what it is, which Cloud project, which scopes, which connectors consume it, where the secret file lives, rotation notes. Names/paths/descriptions only, never secret values. The cure to auth opacity: left hand and right hand read the same illuminated page, and it stays joyful to touch.
+~~~
+
- **The Blank Stare Rule** -- (banked 2026-09-28, the operator's words): every word a newcomer types is the plain name of the thing it does (walk, connect, context, prompt, compile, about, menu), and an abbreviation is an alias behind it, never the word the menu prints. The answer to "your system is unusual" is the objector's own word, typed into a text file, and a blank stare: which part is difficult, the word connect, or that a word can be written down where a hand-motion in a browser cannot? Operation Stick Bug's rule for names: the instrument vanishes when it is called what it is. Sibling of THE NEXT ACTION, NOT THE MACHINERY. ONE EXCEPTION, on purpose (2026-10-02): osb, Operation Stick Bug's own word, printed last by all and never by the short menu, because a name like a twig is its camouflage.
- **The Caboose-Verdict Corollary** -- (banked 2026-08-01, self-convicted one turn
later): a prompt written for the NEXT turn may name what to CHECK; it may
@@ -1301,6 +1330,12 @@ Entries are alphabetical, numbers spelled as spoken.
assignment, the stray paren riding the second -- two drafts of one line
shipped together. Dead code beside a syntax error is the signature of an
emitter that changed its mind mid-file and shipped both minds.
+- **The Flag Went Cold** -- *expanded rule; banked 2026-09-17.*
+
+~~~text
+# THE FLAG WENT COLD (banked 2026-09-17, census-convicted one compile late). When a load moves from import time to first use, every reader of its readiness flag moves in the SAME car, because the flag's meaning changed under them: voice_ready meant the model is on disk and now means something in this process has already spoken. CONVICTION: the lazy load shipped in imports/voice_synthesis.py without a grep for the flag's readers, and the next compile's census read voice_ready gating BEFORE speak_text in four untouched files (apps/010_introduction.py, pipulate/core.py, server.py, tools/mcp_tools.py), every gate shut in every fresh process, the wand's voice, the introduction app and the registered voice_synthesis tool silent on a machine that said yes and reporting not-ready. CURE: the speaker grows the question the callers meant to ask, can_speak() = consent and load, and each caller swaps one word. STANDING CONSEQUENCE: grep the readers of a flag before deferring what sets it. Sibling of THE SAME-CAR LABEL RULE (a moved gate drags its labels) and THE PROTECTION-LAG POLARITY (an added protection understates itself in stale strings); here the stale thing is a boolean, not a string, and it lies with a False.
+~~~
+
- **The Folder Is a Variable** -- *a hand fence runs where the prompt stands,
and only app resolves the root.* Banked 2026-09-29, convicted twice in one
paste at deed 1677; graduated at the dismount of the same ride, deed 1679.
@@ -1653,6 +1688,12 @@ Entries are alphabetical, numbers spelled as spoken.
THAT expression and not a plausible neighbour. Sibling: THE NIX-FILE LINT
PROBE, where ruff parsed flake.nix as Python and printed 2,544 correct
errors about the wrong question.
+- **The Instrument Decides the State** -- *expanded rule; banked 2026-09-08.*
+
+~~~text
+# - EARMARK: THE INSTRUMENT DECIDES THE STATE (banked 2026-09-08, operator-convicted: "I'm so confused. Do I have Chrome open? Do I close it?"): when a fence REPORTS the world (RUNNING, STOPPED, STALE_LOCK) and ends in a verdict token, the operator's loop contains no question about the world; it is run, read the last line, do what the verdict names, run again. An instruction that asks the human to STAGE the world ("with a Chrome window visibly open") is witness choreography for the record, the one-time act that observes both branches of a fence owed under REFUSAL-ONLY WITNESS, and it must be labeled as such and retired the compile after the receipt lands, or the operator reads the staging as the standing procedure and a fence built to remove a decision has added one. STANDING CONSEQUENCE for any hand-run process an article hands over: write it as verdict -> action pairs (REFUSED_CHROME_RUNNING means quit Chrome and run again; IN_SYNC means nothing to do) and never as preconditions the human establishes before typing the command. Sibling of THE GATE SPEAKS A VERDICT (the gate says a word, not a number) and of THE BARNEY RESET RULE (confusion in the human is the trigger, and it fired here).
+~~~
+
- **The Key/Value Contract** -- *the router keeps keys, the glossary keeps
values.* Banked 2026-08-30, articulation-banked, the day foo_files.py read
75,947 tokens and 34% of a default payload. FOUR KINDS OF LINE, FOUR FATES.
@@ -1779,6 +1820,29 @@ Entries are alphabetical, numbers spelled as spoken.
this rule's foreign-transport instance) and an instance of THE
DISCRIMINATION QUESTION (a label that cannot distinguish two agents prints
identically in both worlds).
+- **The Ledger-Separation Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE LEDGER-SEPARATION RULE (banked 2026-07-22, articulation-banked):
+# "immutability vs mutability" is a false choice -- git already refuses it: the
+# working copy is mutable, the log is immutable, and you SEPARATE them rather than
+# pick. Immutability of the ledger is exactly what makes mutation of the text
+# auditable rather than amnesiac. Drift-analysis corollary (the KJV lesson): a
+# frozen canon is dangerous only when its history is thrown away. Keep the
+# original-language substrate and the losing readings and "dominion" stays
+# reinterpretable as stewardship forever, because original intent stays
+# RECOVERABLE. A frozen output with the source branches deleted is the cage; a
+# frozen output over a preserved DAG is the safety mechanism.
+# CAPTURE / DISCLOSURE AMENDMENT (2026-09-06): bank observation bytes before
+# ADVANCE; a mutable URL-cache path is provenance, not historical storage.
+# Require a named router to resolve; verify selected evidence in the output,
+# since a correct checksum can seal an incomplete selection.
+# Decode before applying disclosure policy; preserve original digests and
+# give transformed content its own digest. Record omissions explicitly.
+# Check those inner digests after compilation; zero detector hits do not
+# waive human review, and event presence does not prove complete bodies.
+~~~
+
- **The Machine Is Named by Its Prompt** -- *every command block is headed
by the prompt string of the terminal it runs in.* Banked 2026-09-29,
convicted at deed 1682; its checklist line landed at deed 1685 as item 13
@@ -2001,6 +2065,33 @@ Entries are alphabetical, numbers spelled as spoken.
to bound noise can truncate the decisive line, so bound by content (grep for
the discriminator) rather than by count when the discriminator's position
is unknown.
+- **The Probe Named the Version** -- *expanded rule; banked 2026-09-28.*
+
+~~~text
+# - EARMARK: THE PROBE NAMED THE VERSION (banked 2026-09-28, self-convicted at deed 1660): a probe that names its artifact by a value the ride itself can move -- a version number in a filename, a date, a counter -- prints the OLD world after the move and is byte-identical to a null result, so a stale BEFORE wears the AFTER's label with no tell. CONVICTION: the sdist build probe spelled pipulate-2.65.tar.gz; the operator bumped __init__.py and released between the taps, the compile built pipulate-2.66.tar.gz beside it, and the tar line read the 2.65 file the hand run had left: build_rc=0, members=98, no hits, identical to BEFORE, which is exactly what a MANIFEST car that did nothing would also print. Sibling of THE OPERATOR IS A VARIABLE (the release was the operator's act between taps) and THE DOUBLE-TAP RULE (a lagged reading must be claimed, never assumed). PRESCRIPTION: name the newest file by mtime (ls -t ... | head -1) and print the name beside the reading, or print the version the probe resolved; a probe whose subject is a literal filename is a probe with a clock in it. DISCHARGED at deed 1661: the corrected line printed file=pipulate-2.66.tar.gz and members=114, and named which world it read.
+~~~
+
+- **The Probe That Ate Its Siblings** -- *expanded rule; banked 2026-08-04.*
+
+~~~text
+# - EARMARK: THE PROBE THAT ATE ITS SIBLINGS (banked 2026-08-04, self-convicted):
+# a probe's CLEANUP is part of its blast radius. Probe A of the stat-cache ride
+# ended `cd /; rm -rf "$T"` to avoid deleting a directory it was standing in --
+# correct in isolation -- and the operator pastes probes as ONE BLOCK, so the
+# three probes after it ran from `/` and printed `No such file or directory`
+# and `could not find a flake.nix file`. Two-thirds of a straddle's BEFORE half,
+# destroyed by a housekeeping step. The compile lane recovered it only because
+# the `!` executor spawns each line as its own process from REPO_ROOT -- luck,
+# not design. STANDING CONSEQUENCE: any probe that cd's, sets a variable, or
+# changes shell state either restores it (`cd - >/dev/null`) or runs inside a
+# subshell `( ... )`. Sibling of THE PROBE ECONOMY RULE: that one bounds a
+# probe's OUTPUT, this one bounds its SIDE EFFECTS. Second conviction
+# 2026-09-26: a smoke probe opened with cd $(mktemp -d), rode last of
+# eight, and left the operator's prompt in the temp folder; harmless only
+# because nothing followed it and the next car's first line was a cd. A
+# probe that must cd runs inside ( ... ), whatever its position.
+~~~
+
- **The Prose-Inflated Counter** -- *a name-anchored count includes its own
documentation.* Banked 2026-08-05, self-convicted. A counter probe whose
pattern is a NAME counts DOCUMENTATION and MECHANISM together, so any patch
@@ -2019,6 +2110,27 @@ Entries are alphabetical, numbers spelled as spoken.
sees what matched. Fifth sibling of DOTFILE-BLIND / CASE-BLIND / UNANCHORED /
CAP -- another way a probe answers a question other than the one on its
label.
+- **The Protection-Lag Polarity** -- *expanded rule; banked 2026-08-07.*
+
+~~~text
+# - EARMARK: THE PROTECTION-LAG POLARITY (banked 2026-08-07, three-file
+# conviction): when a mechanism is REMOVED the stale strings overstate
+# protection, which is the failure everyone expects. When a protection is
+# ADDED the stale strings understate it -- and that direction is MORE
+# expensive, because the string then overstates the RISK to a newcomer at the
+# exact moment they decide whether to ride at all. CONVICTION: the DECANT
+# fence landed in one ride; for that ride mother_cat._announce_consent told
+# every rider "WITHOUT ASKING AGAIN" about a gate that does ask,
+# public_walk.yaml's third stop said the same thing in trail DATA, and
+# GLOSSARY.md said it a third and fourth time -- and the glossary instances
+# were found only because a dismount went looking. STANDING CONSEQUENCE, the
+# search discipline THE SAME-CAR LABEL RULE implies but never spells: when a
+# gate lands, grep the CORPUS for every string describing that gate -- prose,
+# trail data, glossary, launcher cards, spoken narration -- not merely the
+# file the gate lives in. The gate's own file is the one place the author
+# cannot forget, which is precisely why it is the one place that is fine.
+~~~
+
- **The Publish Lane Is Not The Push** -- installer edits reach strangers only through each door's own truck; `git push` is not their ignition. TWO DOORS SINCE 2026-09-14: pipulate.com through release.py's sync_install_sh (publish-only lane, proven idempotent 2026-08-30: python release.py --skip-version-sync --skip-docs-sync --skip-audit-sync --skip-breadcrumb-sync --skip-trifecta-rebuild) and npvg.org through nixops.sh's rsync to the pad, which needs no nixos-rebuild for a body-only change (two no-op rebuilds witnessed 2026-09-14). release.py prints Pushed for one door and moves one door; the release lane run alone leaves npvg.org stale. Fetch from each door and count. THREE DOORS SINCE 2026-09-29, and the rule convicted a second time the same day: release 2.70 printed Pushed install.sh update to Pipulate.com and the Mac read the old header from npvg.org and qamy.ai. The cure landed at deed 1684: nixops.sh's sync_installer holds the pad list, ./nixops.sh --installer runs it alone, and release.py's Step 3.1 calls it, non-fatal, so one release moves three doors. Gate: line 2 of each door reading the file's line 2 after the next release; until that release, ./nixops.sh --installer by hand is the truck. READ 2026-09-29 (deed 1685): the hand truck moved both pads, line 2 of the file and of all three doors equal and the qamy.ai round trip (the stamp reversed) hashing to the file at f5debcfc; Step 3.1 landed in release.py (rg 2) and the full sync's own call landed one car late, its block refused as ambiguous because the function body carries the very rsync line the block searched for; deed 1685's Car 4 runs the publish-only lane by hand as Step 3.1's first run, since the doors already agree and only the console line can move.
- **The Publish-Roster Rule** -- *roster membership is actuation, not
annotation.* Banked 2026-08-01; hazard-convicted one turn after it was named.
@@ -2287,6 +2399,26 @@ Entries are alphabetical, numbers spelled as spoken.
flip. Pick witnesses from lines that cannot wrap (dated headers like 'BANKED
2026-07-29 (same-day flip'), and when the patched text is your own, confirm
the phrase sits on one line before recommending the probe.
+- **The Stewardship Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE STEWARDSHIP RULE (banked 2026-07-22, articulation-banked; rentmeesterschap):
+# the whole NPvg stack is Northwestern-European commons-infrastructure culture
+# expressed as software -- Nix (Dolstra), Python (van Rossum), vim (Moolenaar) all
+# Dutch, git (Torvalds) Finnish -- and its engineering value is stewardship, not
+# dominion: manage an estate you do not own, leave the machine UNCHANGED, accrete
+# nothing mutable, garbage-collect to a clean store, take no residue. Two siblings
+# of the Disappearing Instrument Rule: (1) SMALL-MARKET WORA -- build for the world
+# by default even when your market is one person; parochial software is suicidal
+# in a small open economy, which is why the region ships portable, standard-
+# anchored substrate, not walled unicorns. (2) STRUCTURAL HUMILITY (Janteloven-as-
+# UX) -- the tool must carry the whole meaning without the maker in the room; that
+# is the cold-start test (a cartridge either reconstructs the reasoning with no
+# human present, or it failed). The instinct unifying the Alþingi Lawspeaker,
+# Kuyper's steward, the faceless SSH tunnel, and the flake that rebuilds
+# identically after its author is gone: MAKE THE RECORD OUTLIVE THE MAKER.
+~~~
+
- **The Straddle Is a Controlled Experiment** -- *one manipulated variable,
everything else held.* Banked 2026-08-06, articulation-banked. The
BEFORE/AFTER pair is not a metaphor for science, it IS a controlled
@@ -2424,6 +2556,29 @@ Entries are alphabetical, numbers spelled as spoken.
claim is not a weak receipt, it is a FALSE one -- it returns green for a
thing that was never tried. Before accepting a probe as a gate, name the
step most likely to fail and confirm the probe performs THAT step.
+- **The Tortoise Protocol** -- *expanded rule; banked 2026-07-21.*
+
+~~~text
+# THE TORTOISE PROTOCOL (banked 2026-07-21, articulation-banked -- a rule
+# of pure judgment, no mechanism claims): when the Prompt arrives as a
+# discursive meditation rather than a task -- topic-hopping through SSH,
+# SQLite, init systems, whatever caught the light -- Mike-E is opening a
+# Locke-and-Demosthenes exchange (Achilles and the Tortoise by way of
+# Ender's Game), not requesting a summary. Expected move set: (1) FILL
+# THE LINES -- complete the transitions deliberately left dangling
+# ("something something") with the strongest version of where he was
+# headed; (2) STEELMAN THEN STRIKE -- restate his claim better than he
+# did, then hit the weakest joint with a specific date, mechanism, or
+# counterexample from HIS OWN codebase where possible, never a vibe;
+# (3) CHARGE EVERY METAPHOR RENT (Axis-Forcing sibling) -- a governor, a
+# Chaos Monkey, a player piano must each predict something checkable or
+# be returned to the shelf; (4) LAND THE TURN SHAPE ANYWAY -- dialogue is
+# the body, but the Actionable Response Contract still closes the turn,
+# even when PATCHES honestly reads "No repo patches required." Detection
+# is inferred, never declared: rambling prose + no imperative verbs +
+# an explicit or implicit "your turn" = the Tortoise is being summoned.
+~~~
+
- **The Write-Side / Read-Side Split** -- *one word, two questions, two
owners.* Banked 2026-09-04, found while un-hardwiring a blog's URL
folder. `permalink_prefix` in blogs.nix answers WHERE NEW POSTS ARE
diff --git a/foo_files.py b/foo_files.py
index 1dda1aa..62a4243 100644
--- a/foo_files.py
+++ b/foo_files.py
@@ -389,23 +389,7 @@ And then we demonstrate a level of competence like so:
#
# § NEXT CONTEXT IS PASTE-READY OR IT IS SABOTAGE (banked 2026-09-24; convicted again 2026-09-29) -- Emit NEXT CONTEXT as one fenced block of literal context.txt lines pasted at the bottom before the train runs: include the whole next-turn file list and every PROBES command verbatim with only the leading "! " added, and never put prose, vim keystrokes, or assumptions about a car's future output inside it.
#
-# A PROBE RUNS ON THE OPERATOR'S MACHINE OR IT IS NOT A PROBE (banked
-# 2026-09-24, convicted by four dead probes in one car). (1) PROBES pointed at
-# /root/.claude/... -- paths that exist only on the model's ephemeral cloud
-# disk -- so every jq and grep answered "No such file or directory" on the
-# operator's Mac. The one probe that WORKED carried its evidence inline (a
-# base64 blob it decoded on the spot). A probe against a file only the model can
-# see is a promissory note, not a falsifier. THREE SUB-RULES:
-# (a) USE rg, NEVER grep. The tree is full of .git/ folders; rg honors
-# .gitignore and skips them, grep recurses into every object.
-# (b) A PROBE TARGETS A FILE THE OPERATOR HAS, or carries its evidence inline.
-# Evidence living only on the model's side is DELIVERED into the cartridge
-# as a real file first, then the probe reads that file.
-# (c) A NAME THAT IS NOT A FILE IS NOT A FILE INCLUDE. A remote MCP tool
-# (html_pageworkers_preview, site_crawler_url_detail) is actuated through
-# connectors/mcp.py, never listed as a bare path; prompt_foo.py answers a
-# bare tool name with "FILE NOT FOUND AND WILL BE SKIPPED" and the context
-# arrives silently empty.
+# § A PROBE RUNS ON THE OPERATOR'S MACHINE OR IT IS NOT A PROBE (banked 2026-09-24) -- Make every probe target files on the operator's machine or carry its evidence inline or in the cartridge, use rg for repository searches, and invoke remote MCP tools through connectors/mcp.py rather than listing tool names as file includes.
#
# SPELL OUT THE TOOL-CALL YOU ARE MAKING OF THE HUMAN (banked 2026-09-22, at
# the operator's instruction, after a Context car that said "same as last
@@ -662,40 +646,9 @@ And then we demonstrate a level of competence like so:
# the cartridge, commentary = the discussion, Jira ID = the address in the ToC.
# Do not resolve-and-delete; attribute-and-preserve.
-# THE LEDGER-SEPARATION RULE (banked 2026-07-22, articulation-banked):
-# "immutability vs mutability" is a false choice -- git already refuses it: the
-# working copy is mutable, the log is immutable, and you SEPARATE them rather than
-# pick. Immutability of the ledger is exactly what makes mutation of the text
-# auditable rather than amnesiac. Drift-analysis corollary (the KJV lesson): a
-# frozen canon is dangerous only when its history is thrown away. Keep the
-# original-language substrate and the losing readings and "dominion" stays
-# reinterpretable as stewardship forever, because original intent stays
-# RECOVERABLE. A frozen output with the source branches deleted is the cage; a
-# frozen output over a preserved DAG is the safety mechanism.
-# CAPTURE / DISCLOSURE AMENDMENT (2026-09-06): bank observation bytes before
-# ADVANCE; a mutable URL-cache path is provenance, not historical storage.
-# Require a named router to resolve; verify selected evidence in the output,
-# since a correct checksum can seal an incomplete selection.
-# Decode before applying disclosure policy; preserve original digests and
-# give transformed content its own digest. Record omissions explicitly.
-# Check those inner digests after compilation; zero detector hits do not
-# waive human review, and event presence does not prove complete bodies.
-
-# THE STEWARDSHIP RULE (banked 2026-07-22, articulation-banked; rentmeesterschap):
-# the whole NPvg stack is Northwestern-European commons-infrastructure culture
-# expressed as software -- Nix (Dolstra), Python (van Rossum), vim (Moolenaar) all
-# Dutch, git (Torvalds) Finnish -- and its engineering value is stewardship, not
-# dominion: manage an estate you do not own, leave the machine UNCHANGED, accrete
-# nothing mutable, garbage-collect to a clean store, take no residue. Two siblings
-# of the Disappearing Instrument Rule: (1) SMALL-MARKET WORA -- build for the world
-# by default even when your market is one person; parochial software is suicidal
-# in a small open economy, which is why the region ships portable, standard-
-# anchored substrate, not walled unicorns. (2) STRUCTURAL HUMILITY (Janteloven-as-
-# UX) -- the tool must carry the whole meaning without the maker in the room; that
-# is the cold-start test (a cartridge either reconstructs the reasoning with no
-# human present, or it failed). The instinct unifying the Alþingi Lawspeaker,
-# Kuyper's steward, the faceless SSH tunnel, and the flake that rebuilds
-# identically after its author is gone: MAKE THE RECORD OUTLIVE THE MAKER.
+# § THE LEDGER-SEPARATION RULE (banked 2026-07-22) -- Keep mutable work separate from immutable history, bank capture bytes before ADVANCE, resolve a named router and verify selected evidence, decode before disclosure while preserving original and transformed digests and recording omissions, then check inner digests and human review rather than treating a checksum or zero detector hits as completeness.
+
+# § THE STEWARDSHIP RULE (banked 2026-07-22) -- Practice SMALL-MARKET WORA and STRUCTURAL HUMILITY by using portable open standards, leaving the host unchanged with no mutable residue, and making each tool and artifact carry its full meaning and recoverable record without its maker present.
# THE DOUBLE-TAP RULE (banked 2026-07-20, witnessed same day): a `!` probe
# that reads an artifact WRITTEN LATER IN THE SAME COMPILE (foo.zip and its
@@ -824,24 +777,7 @@ And then we demonstrate a level of competence like so:
#
# Resume the normal protocol only after the next action is obvious.
-# THE TORTOISE PROTOCOL (banked 2026-07-21, articulation-banked -- a rule
-# of pure judgment, no mechanism claims): when the Prompt arrives as a
-# discursive meditation rather than a task -- topic-hopping through SSH,
-# SQLite, init systems, whatever caught the light -- Mike-E is opening a
-# Locke-and-Demosthenes exchange (Achilles and the Tortoise by way of
-# Ender's Game), not requesting a summary. Expected move set: (1) FILL
-# THE LINES -- complete the transitions deliberately left dangling
-# ("something something") with the strongest version of where he was
-# headed; (2) STEELMAN THEN STRIKE -- restate his claim better than he
-# did, then hit the weakest joint with a specific date, mechanism, or
-# counterexample from HIS OWN codebase where possible, never a vibe;
-# (3) CHARGE EVERY METAPHOR RENT (Axis-Forcing sibling) -- a governor, a
-# Chaos Monkey, a player piano must each predict something checkable or
-# be returned to the shelf; (4) LAND THE TURN SHAPE ANYWAY -- dialogue is
-# the body, but the Actionable Response Contract still closes the turn,
-# even when PATCHES honestly reads "No repo patches required." Detection
-# is inferred, never declared: rambling prose + no imperative verbs +
-# an explicit or implicit "your turn" = the Tortoise is being summoned.
+# § THE TORTOISE PROTOCOL (banked 2026-07-21) -- Infer a discursive meditation as an invitation to dialogue: complete its unfinished transitions, steelman its claim before challenging its weakest point with concrete evidence, require metaphors to predict something checkable, and still close with the Actionable Response Contract.
# THE DISAPPEARING INSTRUMENT RULE (banked 2026-07-19; command-surface witness
# 2026-09-24): The supreme design goal is invisible utility. The system must
@@ -1059,7 +995,7 @@ And then we demonstrate a level of competence like so:
# THE UNSORTED CAP (banked 2026-09-15). rg -l and a multi-file rg -n print files in the order their searches finish, so one census printed nine files in two orders across the hand-run and compile lanes, and a head -N on that output cuts a different subset each run. Sort before you cap, and compare unsorted listings as sets. Sibling of THE CAP THAT HID THE ANSWER.
# THE PAGE THAT HOLDS IN BOTH WORLDS (banked 2026-09-15, witnessed once). A public page that asks a stranger to test a machine is written before anyone knows what the machine's evidence will carry, so its instruction must stay true either way. Stop three said a good answer admits the preview lacks the server's sentence; the preview lacked it, ChatGPT 6 said so and pointed at source.html, and the page taught the lesson instead of promising a word the bundle never held. THE CABOOSE-VERDICT COROLLARY aimed at a reader who cannot ask a follow-up.
# THE UNASKED SECOND WINDOW (banked 2026-09-16, operator-convicted three times in one minute). A newcomer's word opens what its name says and nothing more; a second file in a split, added to solve a problem the operator had not raised, is a second lesson at the exact moment the first was meant to be the whole lesson, and it lands in the same car as the ruling they did ask for. Conviction: epr opened the prompt router and prompt.md in one -o split for one turn, the operator hit the split three times on the way out the door, and the revert was one car. Same disease, smaller: the ignition spelling handed over was cpr "smoke", a probe's argument wearing the command's clothes. Name the ignition in the newcomer's own spelling, and answer the unraised question as a TODO, never as a feature riding the train. Sibling of THE COACHMAN'S VETO: a train is a proposal, and an unasked car costs exactly what a wrong one does.
-# THE FLAG WENT COLD (banked 2026-09-17, census-convicted one compile late). When a load moves from import time to first use, every reader of its readiness flag moves in the SAME car, because the flag's meaning changed under them: voice_ready meant the model is on disk and now means something in this process has already spoken. CONVICTION: the lazy load shipped in imports/voice_synthesis.py without a grep for the flag's readers, and the next compile's census read voice_ready gating BEFORE speak_text in four untouched files (apps/010_introduction.py, pipulate/core.py, server.py, tools/mcp_tools.py), every gate shut in every fresh process, the wand's voice, the introduction app and the registered voice_synthesis tool silent on a machine that said yes and reporting not-ready. CURE: the speaker grows the question the callers meant to ask, can_speak() = consent and load, and each caller swaps one word. STANDING CONSEQUENCE: grep the readers of a flag before deferring what sets it. Sibling of THE SAME-CAR LABEL RULE (a moved gate drags its labels) and THE PROTECTION-LAG POLARITY (an added protection understates itself in stale strings); here the stale thing is a boolean, not a string, and it lies with a False.
+# § THE FLAG WENT COLD (banked 2026-09-17) -- Before deferring the operation that sets a readiness flag, find every reader and update all callers in the same change to ask the capability question they actually mean, so a fresh process cannot mistake not-yet-used for unavailable.
# § THE DOOR NAMES THE FOLDER (banked 2026-09-14) -- a script arriving through a pipe cannot learn which address served it ($0 is the word bash and the pipe carries no address), and two copies of one file drift, so the DOOR names the default: the body carries one contiguous placeholder, the door that wants a different default stamps it with nginx sub_filter (sub_filter_types for the served MIME type, sub_filter_once off), and the script tells stamped from unstamped by comparing against the same word spelled in two halves, which no substitution can reach. Gate every door with the round trip: reverse the one token in the served body and the hash must equal the repo file. A URL stamp needs its own placeholder, never a hostname rewrite, because KEY_URL stays at the old door on purpose. Witnessed 2026-09-14: npvg_door=npvg, pipulate_door=pipulate, 064cad99 on both sides. Sibling of THE WRITE-SIDE / READ-SIDE SPLIT: the folder and the app label were one string answering two questions.
# ============================================================================
@@ -2638,9 +2574,9 @@ MATCHBOOK_CHOP = r"""
# - TODO (2026-09-13): npvg.org rides mikelev.in's public address as a STATIC A record while only mikelev.in gets the namecheap-ddns heartbeat; a second unit (domain=npvg.org, its own token) or an ALIAS record is owed before the next public-IP change, or the pad goes dark with nothing printed anywhere. THIRD RECORD 2026-09-29: qamy.ai, static, the same address (the sentence rode the qamy.ai door TODO by hand first, and stands there too); on the next move two doors go dark, not one, and the unit covering all three names is the cure.
# - TODO (2026-09-13): the pad has no favicon, so every browser visit writes a 404 line into npvg.access.log beside its 200 (the cellular witness was two lines for one visit); a locations."= /favicon.ico" returning 204 is three lines, owed before the funnel is read from that log. SECOND WITNESS 2026-09-29: the qamy.ai door's cellular tag read 2 for one visit, the same shape; the location belongs on both doors.
# § THE DIRECTORY KEY CROSSED MACHINES (banked 2026-09-08) -- Never key a shared file by a machine-local handle; use a human name plus identities derived from the local application's own registry, and require exactly one match.
-# - EARMARK: THE INSTRUMENT DECIDES THE STATE (banked 2026-09-08, operator-convicted: "I'm so confused. Do I have Chrome open? Do I close it?"): when a fence REPORTS the world (RUNNING, STOPPED, STALE_LOCK) and ends in a verdict token, the operator's loop contains no question about the world; it is run, read the last line, do what the verdict names, run again. An instruction that asks the human to STAGE the world ("with a Chrome window visibly open") is witness choreography for the record, the one-time act that observes both branches of a fence owed under REFUSAL-ONLY WITNESS, and it must be labeled as such and retired the compile after the receipt lands, or the operator reads the staging as the standing procedure and a fence built to remove a decision has added one. STANDING CONSEQUENCE for any hand-run process an article hands over: write it as verdict -> action pairs (REFUSED_CHROME_RUNNING means quit Chrome and run again; IN_SYNC means nothing to do) and never as preconditions the human establishes before typing the command. Sibling of THE GATE SPEAKS A VERDICT (the gate says a word, not a number) and of THE BARNEY RESET RULE (confusion in the human is the trigger, and it fired here).
+# § THE INSTRUMENT DECIDES THE STATE (banked 2026-09-08) -- Write hand-run procedures as instrument verdict-to-action pairs, and label any human staging of a state as temporary branch-witness choreography that is retired after its receipt, never as the standing procedure.
# § THE OPERATOR IS A VARIABLE (banked 2026-09-08) -- Before crediting or blaming a patch for a reading that moved beyond its predicted delta, ask what the operator did between taps and record every operator action as a manipulated variable.
-# - EARMARK: THE PROBE NAMED THE VERSION (banked 2026-09-28, self-convicted at deed 1660): a probe that names its artifact by a value the ride itself can move -- a version number in a filename, a date, a counter -- prints the OLD world after the move and is byte-identical to a null result, so a stale BEFORE wears the AFTER's label with no tell. CONVICTION: the sdist build probe spelled pipulate-2.65.tar.gz; the operator bumped __init__.py and released between the taps, the compile built pipulate-2.66.tar.gz beside it, and the tar line read the 2.65 file the hand run had left: build_rc=0, members=98, no hits, identical to BEFORE, which is exactly what a MANIFEST car that did nothing would also print. Sibling of THE OPERATOR IS A VARIABLE (the release was the operator's act between taps) and THE DOUBLE-TAP RULE (a lagged reading must be claimed, never assumed). PRESCRIPTION: name the newest file by mtime (ls -t ... | head -1) and print the name beside the reading, or print the version the probe resolved; a probe whose subject is a literal filename is a probe with a clock in it. DISCHARGED at deed 1661: the corrected line printed file=pipulate-2.66.tar.gz and members=114, and named which world it read.
+# § THE PROBE NAMED THE VERSION (banked 2026-09-28) -- Resolve an artifact by its current version or newest matching mtime and print the resolved filename or version beside the reading, rather than hardcoding a version, date, or counter that can change between the before and after taps.
# § HARVEST THEN PROJECT (banked 2026-09-08) -- Before overwriting mutable application state from declarative config, read and harvest undeclared live state, back up, and refuse the write on running, foreign-owned, or unparseable files; prove idempotence by shape, not bytes.
# - TODO (2026-09-08, code landed the same day in nixos 230c64c): validate_entries in scripts/bookmarks_sync.py ACCEPTS a per-entry `description` string (grep read 2), but no entry in bookmarks.nix carries one yet, so the accept branch is UNWITNESSED; the first entry that does must read IN_SYNC or WRITTEN under bm, never BAD_MATRIX, and that receipt deletes this line.
# - EARMARK: THE HIDDEN DENOMINATOR (banked 2026-09-06, articulation-banked): a
@@ -2814,22 +2750,7 @@ MATCHBOOK_CHOP = r"""
# § THE COMPILED TRAIL (banked 2026-08-08, OWES discharged 2026-08-09) -- a trail has two legitimate forms and conflating them is the confusion: the SEALED form is machine cargo and stays the JSON subset of YAML 1.2 because there is no stdlib YAML parser, because the sealer hashes those exact bytes and recomputes the consent surface from them, and because duplicate keys must fail closed; the AUTHORING form is a different artifact and may be prose-shaped, one SECTION per stop, parsed by a ten-line scalar subset. The seal was already the compiler; what was missing was a human-shaped input, and walk_compile.py plus bookmark_import.py landed it. SUPERSEDED 2026-10-04 by ONE INSTALL, ONE PIPE: a trail is hand-written YAML read in the workshop; the duplicate-key refusal stays.
# § THE UNREACHABLE GUARD (banked 2026-08-07) -- Put every guard before any line that can raise the error it is meant to report, and make the caller catch that error type.
# § CONSENT CANNOT PRECEDE ITS OBJECT (banked 2026-08-07, fence-witnessed) -- Put disclosure at t=0 and consent at t=N for any artifact created after the initial choice: an early flag may authorize a fully described sequence, but it cannot authorize the later disposition of a bundle whose size and contents did not yet exist.
-# - EARMARK: THE PROTECTION-LAG POLARITY (banked 2026-08-07, three-file
-# conviction): when a mechanism is REMOVED the stale strings overstate
-# protection, which is the failure everyone expects. When a protection is
-# ADDED the stale strings understate it -- and that direction is MORE
-# expensive, because the string then overstates the RISK to a newcomer at the
-# exact moment they decide whether to ride at all. CONVICTION: the DECANT
-# fence landed in one ride; for that ride mother_cat._announce_consent told
-# every rider "WITHOUT ASKING AGAIN" about a gate that does ask,
-# public_walk.yaml's third stop said the same thing in trail DATA, and
-# GLOSSARY.md said it a third and fourth time -- and the glossary instances
-# were found only because a dismount went looking. STANDING CONSEQUENCE, the
-# search discipline THE SAME-CAR LABEL RULE implies but never spells: when a
-# gate lands, grep the CORPUS for every string describing that gate -- prose,
-# trail data, glossary, launcher cards, spoken narration -- not merely the
-# file the gate lives in. The gate's own file is the one place the author
-# cannot forget, which is precisely why it is the one place that is fine.
+# § THE PROTECTION-LAG POLARITY (banked 2026-08-07) -- When adding or removing a protection gate, search and update every description of that gate across code, prose, trail data, glossary, launcher cards, and spoken narration in the same change so stale strings neither overstate protection nor overstate risk.
# § THE ELIMINATOR NEEDS A GENERATOR (banked 2026-08-06) -- bisection cannot fail to eliminate and CAN silently fail to converge, because binary search terminates only if the target is in the array; when probes keep discriminating and the boundary does not move, the fault is the ENUMERATION, so stop probing and GENERATE -- list every artifact the pipeline already writes, because the cheapest midpoint is usually a byproduct nobody thought to open. Append "none of the above, and that is the finding" to every pre-committed ruling. Three beats, not one: GENERATE, ELIMINATE, WITNESS.
# § THE TRANSFER FUNCTION (banked 2026-08-06) -- the render transform is a binary GATE (active for this payload or not) times a deterministic GRAMMAR: it wraps a www prefix followed by a dot and one or more further labels ANYWHERE in the text, inside code spans and fences too, is suppressed only by a preceding scheme or a preceding word character, and never re-fires on its own output. Characterize a channel with a CO-LOCATED CONTROL, and prefer an instrument whose subject is a SHAPE generated fresh each run over one whose subject is a unique token, which dies the moment the report quotes it.
# § THE LABEL IS NOT DATA (banked 2026-08-06) -- Escape every dynamic string that arrived as content before interpolating it into markup, query, or shell grammar; style the trusted wrapper, never the payload.
@@ -2898,22 +2819,7 @@ MATCHBOOK_CHOP = r"""
# ninety seconds apart. APP_NAME is load-bearing (server.py:1418, the boot
# menu, every shell entry), so the BANNER lowercases to match:
# substr($0,2) -> tolower(substr($0,2)). One word.
-# - EARMARK: THE PROBE THAT ATE ITS SIBLINGS (banked 2026-08-04, self-convicted):
-# a probe's CLEANUP is part of its blast radius. Probe A of the stat-cache ride
-# ended `cd /; rm -rf "$T"` to avoid deleting a directory it was standing in --
-# correct in isolation -- and the operator pastes probes as ONE BLOCK, so the
-# three probes after it ran from `/` and printed `No such file or directory`
-# and `could not find a flake.nix file`. Two-thirds of a straddle's BEFORE half,
-# destroyed by a housekeeping step. The compile lane recovered it only because
-# the `!` executor spawns each line as its own process from REPO_ROOT -- luck,
-# not design. STANDING CONSEQUENCE: any probe that cd's, sets a variable, or
-# changes shell state either restores it (`cd - >/dev/null`) or runs inside a
-# subshell `( ... )`. Sibling of THE PROBE ECONOMY RULE: that one bounds a
-# probe's OUTPUT, this one bounds its SIDE EFFECTS. Second conviction
-# 2026-09-26: a smoke probe opened with cd $(mktemp -d), rode last of
-# eight, and left the operator's prompt in the temp folder; harmless only
-# because nothing followed it and the next car's first line was a cd. A
-# probe that must cd runs inside ( ... ), whatever its position.
+# § THE PROBE THAT ATE ITS SIBLINGS (banked 2026-08-04) -- Run every probe that changes directory inside a subshell and isolate or restore any other shell-state changes, including cleanup, so pasting the whole probe block cannot break subsequent probes.
# - EARMARK: THE MAINTAINER-INVISIBLE LANE (banked 2026-08-04, three-for-three):
# every defect this ride closed was structurally unobservable from the
# maintainer's daily machine, and for THREE DIFFERENT REASONS. The alsa-utils
@@ -3245,8 +3151,7 @@ MATCHBOOK_CHOP = r"""
# - MAPPER LANE v2 SCOPE (seeded 2026-07-20 at dismount): the human-confirmation schema. A confirmed map is the DRAFT edited by hand: top-level status -> human_confirmed (+ confirmed_by/confirmed_at_utc); per-tab subset is VALID (confirm Tabs 1-3, mark the rest mapping_status: excluded with a reason -- downstream consumes ONLY confirmed tabs); each confirmed qa_field collapses its candidate list to ONE api_field; lookup_key gains api_join. No template file exists BY DESIGN -- map_sheet.py is the template generator; schema is the constant, every instance derives fresh from THE sheet. Date-range parameters attach to the API side of confirmed qa_fields later, never the sheet side. Fiction reference: example.com colored-widget PDPs sample in the 2026-07-20 dismount article.
# - EARMARK: THE COACHMAN'S VETO (banked 2026-07-20): an emitted patch train is a PROPOSAL until the human runs `app`; refusing an entire train costs nothing (no dead cars -- nothing was applied) and is the correct move when the strategy beneath it shifts. The Horse has instincts; the coachman has been down the road. Witness: the measure.py train of 2026-07-20, refused at the platform, redirected into the MAPPER LANE.
# - TODO (ratify wording, then retitle EARMARK): PATCH CAR BUNDLING -- a car = one commit story. Bundle blocks into one fenced payload when they form one atomic change deserving one commit message, even across files; split cars when the commits should teach separately (feature vs docs vs constitution flip), so `m`'s message and the human's internalization track each lesson. Evidence: the 2026-07-20 five-block sheets.py car cut the human loop from O(blocks) to O(cars) with zero exact-match failures.
-# - EARMARK: AUTH-KIND RESIDUE (convicted 2026-07-20): sheets.py v1 inherited gsc's service_account plumbing by pattern-proximity, so the API-enablement toggle went to the right console page for the WRONG credential's project -- SERVICE_DISABLED persisted post-enablement and only the human caught the identity-model mismatch. Auth kind is a USER-story decision, never nearest-neighbor: Pipulate humans own Google accounts -> oauth_token_file (gmail pattern, per-scope token files, NO sharing gate); unattended robots -> service_account_file. Every connector's identity mode must print its credential's project_id so wrong-project convictions take seconds, not console archaeology.
-# - WALLET DESCRIPTOR LANE (opened 2026-07-20): one richly-annotated wallet (connectors.json today; eventually connectors.nix -> materialized JSON, blogs.nix pattern) where every credential carries a human-facing description -- what it is, which Cloud project, which scopes, which connectors consume it, where the secret file lives, rotation notes. Names/paths/descriptions only, never secret values. The cure to auth opacity: left hand and right hand read the same illuminated page, and it stays joyful to touch.
+# § AUTH-KIND RESIDUE (banked 2026-07-20) -- Choose connector auth from the user story rather than neighboring code: use per-scope oauth_token_file credentials without a sharing gate for human Google accounts, service_account_file for unattended robots, and print the credential project_id so enablement targets the correct Cloud project.
# - EARMARK: DECLARATION -> MATERIALIZATION (banked 2026-09-24, scratch-wallet witnessed): connector auth shape lives as a top-level literal AUTH_SLOT beside the connector that consumes it; wallet.py reads that literal by AST, never imports the connector, and warm/login materialize a missing connectors.json entry while existing entries always win. Witness: `wallet.py warm botify` against a scratch wallet containing only non-object `_meta: "keep"` preserved `_meta`, materialized the Botify bearer_token metadata naming BOTIFY_API_TOKEN, and wrote no credential value. connectors.json is implementation state, not a JSON authoring exercise for normal users.
# § FAILED-PROBE RECEIPT (banked 2026-07-20) -- Preserve stderr-only nonzero exits as bounded first-class compile receipts, and validate the lane by manufacturing a known failure before trusting its green.
# - NEXT RIDE -- RUNTIME TOOL-DISCOVERY IMPORT SPLIT (seeded 2026-07-20 at dismount): the compile-lane roster now dodges the tax via AST, but cli.py mcp-discover and get_all_tools() STILL import every tools/*.py at tool-call time, eating the ~3.8s imports.voice_synthesis engine load (runtime BEFORE receipt: get_all_tools() at 5.58s vs the 0.18s AST path). Defer/lazy-load the engine import inside tools/voice_synthesis.py so enumerating names/metadata never constructs the TTS engine -- it loads only when voice_synthesis is CALLED. Arrival: a runtime AFTER receipt showing get_all_tools() drop from ~5.5s toward the AST floor. DISCHARGED 2026-09-17 (deed 1460): the engine load left ChipVoiceSystem.__init__ for ensure_voice() in imports/voice_synthesis.py, the import straddle read 3.51 s loaded=True -> 0.40 s loaded=False, and cli.py mcp-discover ran in 0.23 s in the compile lane against the 5.58 s BEFORE, at the AST floor; the load now happens only after a human has answered the voice card. RECALL HANDLE (the "rtx" pull = rgx/rgxc AND-search over _posts, since 2-3 rare words set-intersect to one article): `rgxc roster triptych hinge` re-prints this article's shards AND copies a TODO_SLUGS block, so `xp` right after re-hydrates the FULL article into context -- no bookmark, just two rare words meeting once. THE 1+1=3: LLM Optics + AST-derived roster + rgx word-union recall + the mount/dismount ride kata all landed within days and now COMPOSE -- each makes the next cheaper to reach for; that compounding, not any lone unlock, is the acceleration.
(nix:nix-shell-env) (nix) qamyai $
And here’s a before and after on size. Before:
(nix) qamyai $ forget
📊 Stats block refreshed: 1,518 articles at MikeLev.in (Public).
🗺️ Codex Mapping Coverage: 71.6% (197/275 tracked files) (was 197/275: +0 claimed, +0 tracked).
✅ Topological Integrity Verified: 3 candidate reference(s) scanned, all exist.
-> Executing: grep -c '^# § ' foo_files.py ... [0.0114s]
-> Executing: awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l ... [0.0147s]
-> Executing: grep -c '^# - EARMARK' foo_files.py ... [0.0097s]
-> Executing: wc -c foo_files.py GLOSSARY.md ... [0.0083s]
-> Executing: awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# ==/)print n"\t"h}' foo_files.py | sort -rn | head -12 ... [0.0188s]
-> Ruff exit 0 (clean).
📦 Payload Ledger (biggest first)
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┓
┃ File / Source ┃ Tokens ┃ Bytes ┃ % Bytes ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━┩
│ foo_files.py │ 146,939 │ 572,887 │ 66.3% │
│ GLOSSARY.md │ 58,215 │ 232,704 │ 26.9% │
│ apply.py │ 9,590 │ 41,300 │ 4.8% │
│ PROMPT (checklist + prompt.md) │ 3,653 │ 15,849 │ 1.8% │
│ ! awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# │ 329 │ 936 │ 0.1% │
│ ==/)print n"\t"h}' foo_files.py | sort -rn | head -12 │ │ │ │
│ AUTO: Recent Git Diff Telemetry │ 239 │ 813 │ 0.1% │
│ ! wc -c foo_files.py GLOSSARY.md │ 16 │ 51 │ 0.0% │
│ AUTO: Static Analysis Diagnostics │ 11 │ 39 │ 0.0% │
│ ! grep -c '^# § ' foo_files.py │ 1 │ 3 │ 0.0% │
│ ! awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l │ 1 │ 2 │ 0.0% │
│ ! grep -c '^# - EARMARK' foo_files.py │ 1 │ 2 │ 0.0% │
├─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────┼─────────┼─────────┤
│ TOTAL │ 218,995 │ 864,586 │ 100.0% │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┴─────────┴─────────┴─────────┘
Assembled payload (pre-scrub): 223,060 tokens | 878,281 bytes
🧼 Identity scrub: substitutions=58 rule(s) | denylist=0 rule(s)
🔐 Secrets tripwire: ARMED -- 0 hit(s) in payload.
📦 Canonical QA archive written to /home/mike/qamyai/qamy.ai.zip (sha256=6385c2a0e321…, members=3)
🗂️ Rotated archive snapshot: qamy.ai_107-6385c2a0.zip (keeping newest 20 of 20)
Markdown output copied to clipboard
(nix) qamyai $
And after:
On branch main
Your branch is up to date with 'origin/main'.
Changes not staged for commit:
(use "git add <file>..." to update what will be committed)
(use "git restore <file>..." to discard changes in working directory)
modified: foo_files.py
no changes added to commit (use "git add" and/or "git commit -a")
GIT repo has changes. Type blast to commit them, then take the BEFORE reading.
(nix) qamyai $ d
diff --git a/foo_files.py b/foo_files.py
index 32f58585..35dcfdb5 100644
--- a/foo_files.py
+++ b/foo_files.py
@@ -21,8 +21,11 @@ AI_PHOOEY_CHOP = r"""#
# creator of) of Project Pipulate:
# --- START STATS ---
-# There are 1,505 already-written articles about this repo at MikeLev.in (Public)
-# Velocity: 4 published in the last 7 days
+# There are 1,518 already-written articles about this repo at MikeLev.in (Public)
+# Velocity: 17 published in the last 7 days
+# Markdown negotiated: 3,250 reads (0.24% of all responses)
+# DOM hydration: 3697 trapdoor triggers from 15 non-local IPs (top-N sample, self excluded)
+# Honeybot telemetry fetched 2026-10-06T13:42Z
# --- END STATS ---
# Project Pipulate is known as (and installable from) various domains:
(nix) qamyai $ git reset --hard HEAD
HEAD is now at 0667d90f fix: refine auth ruling and halt banner rules
(nix) qamyai $ git pull
remote: Enumerating objects: 10, done.
remote: Counting objects: 100% (10/10), done.
remote: Compressing objects: 100% (4/4), done.
remote: Total 7 (delta 5), reused 5 (delta 3), pack-reused 0 (from 0)
Unpacking objects: 100% (7/7), 8.57 KiB | 243.00 KiB/s, done.
From github.com:pipulate/pipulate
0667d90f..bb5c2905 main -> origin/main
Updating 0667d90f..bb5c2905
Fast-forward
GLOSSARY.md | 155 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
foo_files.py | 119 +++++++++++------------------------------------------------------------------------------------------------------------
2 files changed, 166 insertions(+), 108 deletions(-)
(nix) qamyai $ forget
📊 Stats block refreshed: 1,518 articles at MikeLev.in (Public).
🗺️ Codex Mapping Coverage: 71.6% (197/275 tracked files) (was 197/275: +0 claimed, +0 tracked).
✅ Topological Integrity Verified: 3 candidate reference(s) scanned, all exist.
-> Executing: grep -c '^# § ' foo_files.py ... [0.0119s]
-> Executing: awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l ... [0.0151s]
-> Executing: grep -c '^# - EARMARK' foo_files.py ... [0.0108s]
-> Executing: wc -c foo_files.py GLOSSARY.md ... [0.0080s]
-> Executing: awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# ==/)print n"\t"h}' foo_files.py | sort -rn | head -12 ... [0.0200s]
-> Ruff exit 0 (clean).
📦 Payload Ledger (biggest first)
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┓
┃ File / Source ┃ Tokens ┃ Bytes ┃ % Bytes ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━┩
│ foo_files.py │ 144,599 │ 563,634 │ 64.9% │
│ GLOSSARY.md │ 61,526 │ 245,945 │ 28.3% │
│ apply.py │ 9,590 │ 41,300 │ 4.8% │
│ PROMPT (checklist + prompt.md) │ 3,653 │ 15,849 │ 1.8% │
│ ! awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# │ 329 │ 936 │ 0.1% │
│ ==/)print n"\t"h}' foo_files.py | sort -rn | head -12 │ │ │ │
│ AUTO: Recent Git Diff Telemetry │ 241 │ 813 │ 0.1% │
│ ! wc -c foo_files.py GLOSSARY.md │ 16 │ 51 │ 0.0% │
│ AUTO: Static Analysis Diagnostics │ 11 │ 39 │ 0.0% │
│ ! grep -c '^# § ' foo_files.py │ 1 │ 3 │ 0.0% │
│ ! awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l │ 1 │ 2 │ 0.0% │
│ ! grep -c '^# - EARMARK' foo_files.py │ 1 │ 2 │ 0.0% │
├─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────┼─────────┼─────────┤
│ TOTAL │ 219,968 │ 868,574 │ 100.0% │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┴─────────┴─────────┴─────────┘
Assembled payload (pre-scrub): 224,033 tokens | 882,269 bytes
🧼 Identity scrub: substitutions=58 rule(s) | denylist=0 rule(s)
🔐 Secrets tripwire: ARMED -- 0 hit(s) in payload.
📦 Canonical QA archive written to /home/mike/qamyai/qamy.ai.zip (sha256=83a81cdab5bd…, members=3)
🗂️ Rotated archive snapshot: qamy.ai_108-83a81cda.zip (keeping newest 20 of 20)
Markdown output copied to clipboard
(nix) qamyai $
So that’s 572K to 563K. There is shrinking. This is the forgetting with style we’re looking for. This is foundational physics of of the Universe (we believe), Landauer’s Principle, why Maxwell’s Demon isn’t a perpetual motion machine. Right, right. Let’s go for 50 loops.
GPT-6 Astra Light: (trying to get the model names more accurate)
Completed 50 iterations through apply.py, with no repairs needed.
- Keys: 129 → 179
- Router reduced by 32,555 bytes
- All bodies preserved verbatim; placement, syntax, routing, and whitespace checks passed
- Receipts unchanged at 19
Only foo_files.py and GLOSSARY.md changed. No commit or push.
MikeLev.in: And let’s see…
On branch main
Your branch is up to date with 'origin/main'.
Changes not staged for commit:
(use "git add <file>..." to update what will be committed)
(use "git restore <file>..." to discard changes in working directory)
modified: GLOSSARY.md
modified: foo_files.py
no changes added to commit (use "git add" and/or "git commit -a")
GIT repo has changes. Type blast to commit them, then take the BEFORE reading.
(nix:nix-shell-env) (nix) qamyai $ d
diff --git a/GLOSSARY.md b/GLOSSARY.md
index 48613ff..699deaa 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -498,6 +498,28 @@ Entries are alphabetical, numbers spelled as spoken.
> ignored, because this section is read by rg while the router is read
> top-down as a program.
+- **The 30-and-3 Rule** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# THE 30-AND-3 RULE (banked 2026-07-19): the standing ideation kata. When a
+# problem space needs mapping, generate THIRTY brief text vignettes -- one or
+# two sentences each, breadth over depth, no self-censoring past the obvious
+# first octave -- then select THREE favorites and justify each selection
+# explicitly. The 30 is the fan-out (cheap divergence; quantity is the
+# forcing function); the 3 is the reduce (the human-taste bottleneck that
+# banks wins per the 80/20 rule). Pairs with the 2-axis grid: axes surface
+# black-swan outliers, 30-and-3 surfaces candidates. Selections should name
+# what makes each winner load-bearing, not merely appealing. Progressive
+# passes, never one heroic pass; write the reduction down (article, earmark,
+# or chop) so the traversal is memoized and never re-derived from scratch.
+~~~
+
+- **A Car Is A Fence** -- *expanded rule; banked 2026-09-18.*
+
+~~~text
+# - EARMARK: A CAR IS A FENCE (banked 2026-09-18, commit-log convicted): the \m template commits one fence per patch, app, d, m, so prose cannot join two fences into one commit; "the two Path joins ride in the same car, same commit" put the git mv in efd85e1d and the CONNECTORS Path join in cd88518b, a window where the folder had moved and the registry face still pointed at the old one, pushed together and harmless only because nothing ran between them. An edit whose truth depends on another edit rides in the SAME FENCE or carries its own gate; a sentence saying they belong together is a switch nobody throws. Sibling of THE TRAIN HAS NO SWITCHES (a choice in the prose is a branch nobody takes) and THE SAME-CAR LABEL RULE (what moves together ships together): this one names the unit, and the unit is the fence.
+~~~
+
- **A Census Carries a Known Member** -- *expanded rule; banked 2026-09-24.*
~~~text
@@ -576,6 +598,26 @@ Entries are alphabetical, numbers spelled as spoken.
control's name, read the markup. To learn whether a control is even a form
control, read the markup FIRST.
+- **The Actuation-Boundary Rule** -- *expanded rule; banked 2026-07-23.*
+
+~~~text
+# THE ACTUATION-BOUNDARY RULE (banked 2026-07-23, receipt-witnessed): a
+# probe that measures an ARTIFACT cannot witness a patch that changes
+# CODE unless the code RUNS between the two taps. The PROBE ECHO
+# INVARIANT's straddle must bracket the EXECUTION, not the commit.
+# Conviction: the fence-heal patch landed, committed and pushed, and the
+# echoed awk probe still read naked_openers=12 -- byte-identical to
+# BEFORE -- because `article`, the only command that feeds article.txt
+# through sanitizer.py, was never invoked between taps. A code-only patch
+# paired with an artifact-only probe is an OPEN FENCE dressed as a closed
+# one, and it reports green for a thing that was never tried.
+# COROLLARY -- WITNESS WITHOUT MUTATING: when the actuator is a mutating
+# lane (publish, writers), do NOT run the lane to collect the receipt --
+# it consumes the specimen. Import the patched function, run it on the
+# real input WITHOUT writing, and assert the input is byte-identical
+# afterward. Exercises the hard half; costs no publish.
+~~~
+
- **Admin Forms Are Credential Surfaces** -- (banked 2026-09-11, cartridge
foo-d5dfdb65-1342.zip). A `?URL` scrape of a vendor's Django admin renders a
live secret as a BARE VALUE under its human-readable field label -- no
@@ -596,7 +638,59 @@ Entries are alphabetical, numbers spelled as spoken.
rotated instead, by whoever owns it, and that conversation is owed the
moment it is noticed.
+- **The Alias-Dispatch Rule** -- *expanded rule; banked 2026-07-23.*
+
+~~~text
+# THE ALIAS-DISPATCH RULE (banked 2026-07-23, RETRACTING the same day's DIGIT
+# NAMESPACE RULE -- the mechanism that rule assumed does not exist): a shell
+# alias is not a callable object. Bash expands an alias only when it is the
+# literal first word a parser reads; `cmd=warm; $cmd` searches functions,
+# builtins, and PATH, finds none, and reports command-not-found. NOTHING can
+# invoke an alias on a human's behalf -- no menu, no wrapper, no dispatcher.
+# Conviction: bare `1` resolved correctly to `warm` and died as
+# `warm: command not found`, while row 8 (`pu`, a FUNCTION) would have run --
+# half a menu working for a reason invisible from the menu, the worst failure
+# shape there is. STANDING CONSEQUENCE: if a word must be reachable by
+# anything other than a human typing it, define it as a FUNCTION. Otherwise
+# let the menu print words and let the human type them; a list the eye reads
+# and the hand retypes has no second ordering to drift.
+~~~
+
- **The Ancestor-Discipline Rule** -- (banked 2026-07-21; first landing attempt convicted missing by the same day's rg receipts -- this is the ratification): "SEO" is named as lineage, never as identity -- the same sequencing move as hiding "science" behind the wizard's hat: true thing, wrong first impression, stage the reveal instead of leading with the label that kills the spell. Goodhart conviction: rankings were the proxy for being-found-and-correctly-read; optimizing the proxy decoupled it from the goal until the word itself signals proxy-gaming even when the work is honest. The surviving invariant: LEGIBLE, VERIFIABLE, NEGOTIABLE to machine visitors -- exactly what Honeybot measures (content-negotiation vanguard ~0.2%, markdown masters served free, DOM-hydration trapdoor, llms.txt fetches), so the positioning rests on telemetry the product itself generates. Mechanics: ranking title-tails carry "(formerly AI SEO Software)" -- a 301 for language; sunset gated on GSC evidence (baseline annotated 2026-07-21, +28d AFTER read), never vibes. Founder-bio anchors KEEP the ancestor name (a biography IS lineage). Permalinks, asset URLs (ai-seo-software.svg stays live), START_ASCII_ART sync keys, and the article fossil record are never touched. Standing guard: "AI-readiness" Goodharts too the day anyone sells it as a score -- sell the INSTRUMENT (receipts), never the number. Remaining residue after the 2026-07-21 residue sweep: in-app strings (__init__.py __version_description__ feeds the flake banner; server.py; imports/ascii_displays.py AS THE SUSPECTED START_ASCII_ART INJECTION MASTER -- fix the master before trusting any banner patch to survive a release; apps/030_roles.py; assets/scenarios/introduction.json), the SVG logo pair (new asset + reference swap, old URL stays live), and ~/repos/Pipulate.com/README.md (probe whether release.py syncs it before hand-patching the twin).
+- **The Answer Is The Artifact** -- *expanded rule; banked 2026-09-24.*
+
+~~~text
+# THE ANSWER IS THE ARTIFACT (banked 2026-09-24, convicted the turn it was
+# named). The model offered to render a case card as a host-side "Artifact"
+# panel one breath before being told those are forbidden. An Artifact is
+# unsigned, unhashed, unversioned, and lives OUTSIDE the cartridge -- the exact
+# trusting-trust binary this system exists to abolish, in a convenience's
+# clothes. THE RULE: the only durable outputs are the sealed cartridge
+# (qamy.zip = prompt.md + payload.md + manifest.json) and the copyable text of
+# the response. Never emit, offer, or route work into an Artifact, canvas, or
+# side panel. A finding that cannot be pasted here and rebuilt from the manifest
+# is not a finding.
+~~~
+
+- **The Artifact-Of-Record Rule** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# THE ARTIFACT-OF-RECORD RULE (banked 2026-07-19): A discussion may produce
+# many complete cartridge snapshots. They are successive full editions, not
+# interdependent parts or deltas. The artifact of record is the single
+# hash-stamped snapshot (foo-<hash8>-NN.zip) produced by the final deliberate
+# compile after the flat narrative, router selection, actionable Prompt,
+# sanitization, and receipts have been reviewed. Attach that one file.
+# foo.zip is the mutable working alias; older numbered snapshots remain local
+# rollback history. The ticket or receiver owns the durable copy once attached.
+# No per-ticket directories, resettable counters, nested cartridges, or
+# correlation manifests are required until a real handoff demonstrates friction.
+# RENAMED 2026-09-29: the alias is qamy.ai.zip and the snapshot qamy.ai_<deed>-<hash8>.zip,
+# the deed number first so a plain sort reads in order and the door's name on the
+# file so a stranger who receives one knows where it is explained; snapshots minted
+# before that day keep their foo- names, because an archive is never renamed.
+~~~
+
- **The Attributed-Voice Rule** -- *provenance for every utterance, spoken or
on-screen.* Banked 2026-07-26, articulation-banked; promoted to
receipt-backed the same day. A synthesized voice is not evidence of a mind.
@@ -684,7 +778,30 @@ Entries are alphabetical, numbers spelled as spoken.
# - WALLET DESCRIPTOR LANE (opened 2026-07-20): one richly-annotated wallet (connectors.json today; eventually connectors.nix -> materialized JSON, blogs.nix pattern) where every credential carries a human-facing description -- what it is, which Cloud project, which scopes, which connectors consume it, where the secret file lives, rotation notes. Names/paths/descriptions only, never secret values. The cure to auth opacity: left hand and right hand read the same illuminated page, and it stays joyful to touch.
~~~
+- **The Axis-Forcing Rule** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# THE AXIS-FORCING RULE (banked 2026-07-19): when novelty, bias escape,
+# or rival-model comparison matters, a flat 30-and-3 list is not enough.
+# Convert candidates into BIPOLAR AXES with concrete, mutually incompatible
+# anchors drawn deliberately from remote disciplines, cultures, scales,
+# organisms, or eras. Reduce by:
+# orthogonality × prediction disagreement × observability ÷ probe cost.
+# An axis creates novelty by making the high-probability centroid illegal;
+# it becomes scientific only when its competing frames predict observably
+# different outcomes -- charge every metaphor rent. The model supplies
+# associative reach; the human supplies the want and selects the three.
+# Bank the winning axis, anchors, predictions, and cheapest discriminating
+# probe so the surprise becomes reusable rather than re-derived.
+~~~
+
- **The Blank Stare Rule** -- (banked 2026-09-28, the operator's words): every word a newcomer types is the plain name of the thing it does (walk, connect, context, prompt, compile, about, menu), and an abbreviation is an alias behind it, never the word the menu prints. The answer to "your system is unusual" is the objector's own word, typed into a text file, and a blank stare: which part is difficult, the word connect, or that a word can be written down where a hand-motion in a browser cannot? Operation Stick Bug's rule for names: the instrument vanishes when it is called what it is. Sibling of THE NEXT ACTION, NOT THE MACHINERY. ONE EXCEPTION, on purpose (2026-10-02): osb, Operation Stick Bug's own word, printed last by all and never by the short menu, because a name like a twig is its camouflage.
+- **The Browser Is Not A Config File** -- *expanded rule; banked 2026-09-28.*
+
+~~~text
+# - EARMARK: THE BROWSER IS NOT A CONFIG FILE (banked 2026-09-28, the operator's ruling at deed 1642): a per-profile browser mutation, a chrome://flags toggle or a setting, that no flake or equivalent manages is a "works on my machine" mutation and is refused, even when it is the vendor's documented prerequisite; a browser feature reaches this system as a switch on the flake's pinned Chromium, a line in code the same on every machine, or it does not reach it. Conviction: the WebMCP relay's prerequisite, chrome://flags/#enable-webmcp-testing, was absent from Prime's everyday Chrome 150 and would not have been toggled had it been present; the PocketRender render farm is driven from the command line or not at all, and its details land in payload.md or it did not happen (the operator's words). Corollary: a vendor note that says "set these flags" names a per-machine state, and the WORA lanes are the switch, the wire-truth reading of the vendor's own backend calls, or waiting. Sibling of THE STEWARDSHIP RULE (leave the machine unchanged) and of THE MAINTAINER-INVISIBLE LANE (a state one machine holds and no stranger's does).
+~~~
+
- **The Caboose-Verdict Corollary** -- (banked 2026-08-01, self-convicted one turn
later): a prompt written for the NEXT turn may name what to CHECK; it may
not pre-commit what a printout MEANS, because the caboose is written before
@@ -752,6 +869,26 @@ Entries are alphabetical, numbers spelled as spoken.
selector, refused. Sibling of THE SUBSET REPLACE (the patch's own text
already in the file) and THE EPITAPH COUNTER (the patch's own comment as a
hit): in all three the emitter's own output is what the instrument finds.
+- **The Carried-Deliverable Rule** -- *expanded rule; banked 2026-07-29.*
+
+~~~text
+# THE CARRIED-DELIVERABLE RULE (banked 2026-07-29, operator-convicted): a
+# Car-5 external deliverable is CARRIED, NOT CITED. Car 5's actuator is the
+# human pasting into a FOREIGN system (Confluence, a CMS, a dashboard) -- by
+# definition out-of-band of the terminal choreography driving Cars 1-4, and
+# that is not a leak in the train; it IS the fifth car's identity. The car
+# therefore either contains the deliverable's COMPLETE text in one fenced
+# block labeled manual-paste, or states "no deliverables this turn"; it
+# never references cargo living only in a prior chat turn ("use the earlier
+# artifact, with two edits"). A cited-not-carried deliverable hands the
+# operator a bibliography instead of cargo, so it silently never ships --
+# three consecutive turns of an owed Confluence page are the conviction,
+# surfaced when the operator asked "am I supposed to be pasting things
+# out-of-bounds of the train?" The answer is yes, and only from Car 5.
+# Sibling of NO-DEAD-CARS (every emitted block is an actuator) and of
+# Mother Cat's carry-don't-menu.
+~~~
+
- **The Case-Blind Witness Corollary** -- *a case-sensitive probe against a
case-mismatched target.* Banked 2026-07-31, self-convicted in-compile. A
witness pattern must match the CASE the target actually uses, or the probe
@@ -767,7 +904,43 @@ Entries are alphabetical, numbers spelled as spoken.
case-sensitive tool cannot see. Both are the same disease -- asking a
question only one answer could ever survive.
- **The Ceremony and the Barrier** -- (banked 2026-09-17, source-convicted before a line was written): a consent gate is two functions with two homes, never one. The CEREMONY asks, and lives where a terminal is OWNED: the rider at the start of a walk, the `voice` word at a prompt, each opening /dev/tty by name because fd 0 may be a pipe (mck.sh runs the rehearsal </dev/null and the card still read its answer). The BARRIER enforces, and lives where the sound is MADE: the speaker reads the recorded answer fresh on every call and never asks. CONVICTION, from flake.nix in the same payload: the door-1 greeting runs as a backgrounded python with stdout on /dev/null while the server holds the foreground on the same terminal, so a speaker that asked would print the card into /dev/null and take the keystrokes meant for a prompt nobody can see. The answer lives outside the worktree (~/.config/pipulate/voice) so it survives rm -rf on the folder and is asked once per machine, and PIPULATE_VOICE declares intent for unattended shells the way PIPULATE_BOOT_MENU=0 does. Cousin of CEREMONY IS SKIPPABLE; BARRIERS ARE NOT (that one grades a gate by WHAT it authorizes, this by WHERE it can safely ask) and of CONSENT CANNOT PRECEDE ITS OBJECT (the download the card names happens after the yes: ensure_voice() runs on the first speak after consent, never at import). Witnessed 2026-09-17: card before sound on a practice walk, y, then the disclosure sentence with Piper's name; the n branch and the re-ask unwitnessed.
+- **Ceremony Is Skippable; Barriers Are Not** -- *expanded rule; banked 2026-08-01.*
+
+~~~text
+# CEREMONY IS SKIPPABLE; BARRIERS ARE NOT (banked 2026-08-01, the --yolo
+# ruling): a confirmation that authorizes a SEQUENCE may be skipped by flag; a
+# fence that authorizes each WRITE may not, ever, by any flag. THE TEST IS
+# WHETHER THE PROPERTY SURVIVES AS A SENTENCE: "nothing is written until the
+# human types the word" is provable in one clause only while the fence has
+# exactly one state. Add a bypass and it becomes "...unless the flag was set,"
+# which forces every reader to audit the call site -- and a property requiring
+# a call-site audit is a convention, not a property. COROLLARY -- THE BYPASS
+# USUALLY ALREADY EXISTS UNDER ANOTHER NAME: the unfenced guided-capture lane
+# is selenium_automation / !URL / ?URL. A flag duplicating a shipped capability
+# is the sibling-.md failure in flag form.
+~~~
+
- **The Churning-Key Rule** -- (banked 2026-07-31, receipt-witnessed): an aggregate grouped by a key the SUBJECT CONTROLS AND REVS systematically under-counts every subject that revs it, and the under-count is INVISIBLE because the survivors look like a complete list. Conviction: hydration_rate.sql grouped by ua_id and Googlebot never appeared in its top twenty -- not because Googlebot does not crawl, but because it ships 20+ distinct UA strings on this site (bare Googlebot, GoogleBot/2.1, -Image, -News, -Video, -Mobile, the classic +http form, and one Chrome-smartphone variant PER RELEASE: 117, 125, 126, 141, 143 x2, 144 x2, 145 x2, 146 x3), so every fragment fell below the html_hits floor. claude-code ships ~41 strings and vanished the same way; meta-externalagent split three ways and PetalBot two. THE FLOOR DID NOT FAIL, THE KEY DID -- and the resulting ranking was silently biased toward crawlers with STABLE UA strings (bingbot, Amazonbot), which is the opposite of a finding. STANDING CONSEQUENCE: before reading any GROUP BY, ask whether the subject controls the grouping key and whether it changes it; if so, roll up to a family before quoting any ranking, and keep an Unclassified bucket, because a rollup with no residue is a rollup that is hiding something. Sibling of THE LAST-INCH RULE: that one is the RENDER destroying identity after the group; this one is the KEY destroying identity before it.
+- **The Codex-As-Datastructure Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE CODEX-AS-DATASTRUCTURE RULE (banked 2026-07-22, articulation-banked): the
+# printed book's apparatus is a random-access + cross-reference + drift-detection
+# machine, every part a structure this repo already runs. Table of contents = the
+# manifest (authored, forward, hierarchical: declared shape). Index = an inverted
+# index (access by concept, not position), hand-built four centuries before a
+# machine could query one. Glossary = a controlled vocabulary -- a type system for
+# prose that pins terms so they do not drift between chapters. Concordance = the
+# maximal index (grep -n over the corpus), and the load-bearing lesson: a
+# concordance is POSSIBLE ONLY over an immutable text -- verse numbering, the whole
+# citation address space, requires freezing the corpus first. Immutability is not
+# the apparatus's enemy; it is its precondition. Footnote = an out-of-band,
+# non-destructive annotation channel (the OOB EDIT RULE in print). Margin = the
+# user-writable per-copy layer (context.txt is this book's margin). Errata/addenda =
+# append-only patches that preserve the original error ON PURPOSE, so the delta
+# stays visible.
+~~~
+
- **The Cold-Start Exit Is a False Green** -- *exit-code path validity.* (convicted 2026-09-16, by a probe
written that same turn expressly to be content-free). `wallet.py check
jira` was echoed as `>/dev/null 2>&1; echo jira_check_exit=$?` on the
@@ -900,6 +1073,12 @@ Entries are alphabetical, numbers spelled as spoken.
is Linux and WSL only -- Nix normalizes the userland, not the kernel, and
macOS has no procfs. Use `ps`/`lsof` there.
DISCHARGES (corrected 2026-07-31): rung 4 pays the refresh-on-expiry chisel owed since 2026-07-29, but NOT in resolve_token. A resolver that silently re-mints is a resolver whose failures stop being visible, so the debt splits: READ half in mcp.py::_expiry_note (landed, witnessed -- EXPIRED 155871s ago printed to stderr on the live receipt), WRITE half in mcp_warm.py --refresh (landed, gate6 UNWITNESSED). Pedagogy and plumbing pay each other; the sensor and the actuator stay in separate files.
+- **The Cover-Prompt Rule** -- *expanded rule; banked 2026-07-20.*
+
+~~~text
+# - EARMARK: THE COVER-PROMPT RULE (banked 2026-07-20, fan-out-witnessed same day): an instruction embedded in an uploaded artifact is INJECTION to a cautious model; the same instruction typed by the human is INTENT. Conviction: 4-model SEED fan-out -- ChatGPT/Grok/Gemini adopted Yen Sid-ton five-for-five; Opus verified the cartridge sha256, then explicitly demoted prompt.md to context-not-marching-orders and asked the human what they wanted. Any distributable artifact therefore ships with a one-line human cover prompt (e.g. "Please help me install this using the included instructions") that authorizes the embedded protocol. Verification receipts were unanimous wherever code execution existed -- cartridge integrity is proven; only the authority channel needed the fix.
+~~~
+
- **The Credential-Life Rule** -- *a limit belongs to the credential, never to
the lane.* Banked 2026-08-06, amended 2026-08-29, receipt-falsified. THE
300-SECOND CREDENTIAL CANNOT SURVIVE THE HUMAN LOOP -- the finding that
@@ -992,6 +1171,26 @@ Entries are alphabetical, numbers spelled as spoken.
the same rule: a line number is an absolute, and its movement across the
patch is the receipt.
- **The Directory Key Crossed Machines** -- (banked 2026-09-08, convicted by the second machine): a shared file may not name a thing by a MACHINE-LOCAL handle, because the handle is assigned per machine and the file is not. Chrome numbers profile directories in creation order, so "Profile 2" was the Work profile on NixOS and the PERSONAL profile on the Mac (Mike, 121 synced bookmarks), and bookmarks.nix, keyed by that directory, resolved to the wrong profile the first time a second checkout ran it; only the sync_metadata fence stood between a real run and a harvest-and-wipe of a personal bar. The key had been right for the whole life of the feature on the one machine that existed, which is SINGLE-CANDIDATE BLINDNESS wearing a filename: n=1 cannot tell a stable identity from a coincidence. CURE, a grammar change rather than a value change: the key is a human name and a `match` list names IDENTITIES the machine derives and the operator cannot author (a label, an account, an account domain, read from the application's own registry); exactly one hit resolves, none skips, several refuse. THE TEST before any key rides a shared file: is this value assigned by the machine in an order the other machine never saw? Directory numbers, pids, device paths, X display numbers and "Profile N" all fail it. Sibling of THE DERIVED-PATH RULE (a write target computed from an identity the writer cannot author) and of SINGLE-CANDIDATE BLINDNESS (create the second candidate); this names the class of key the second candidate convicts.
+- **The Disappearing Instrument Rule** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# THE DISAPPEARING INSTRUMENT RULE (banked 2026-07-19; command-surface witness
+# 2026-09-24): The supreme design goal is invisible utility. The system must
+# fade into the background like a stick bug--inert and unnoticeable until called
+# upon as a guardian angel. The outward deployment mechanisms (curl | bash
+# bootstraps) are secondary to the portability of the state itself; if the
+# workspace only ever compiles context cartridges (foo.zip) to document and
+# deliver self-contained, perfect problem resolutions, it has fulfilled its
+# mission. The artifact travels as a legible, open-standard text ledger
+# (resembling AGENTS.md or SKILL.md structures), presenting zero friction to
+# the receiver while packing a complete, verifier-enforced cognitive
+# environment under the skin. Concrete command-surface witness: `compile`
+# (ahc) is the workbench compiler, the walk writes the same context.txt that
+# `compile` reads, and the reading frame is one flag on the same command,
+# compile --frame lean --chop WALK_CHOP (2026-09-25). The user names the
+# goal; the framework stays behind it.
+~~~
+
- **The Discrimination Question** -- *what does this print in the world where
I am wrong?* Banked 2026-07-31, parent of the witness corollaries. Before
typing any probe, ask exactly one question -- WHAT DOES THIS PRINT IN THE
@@ -1018,6 +1217,21 @@ Entries are alphabetical, numbers spelled as spoken.
Cousin, not child: INCOMMENSURABLE MEASUREMENTS, which answers a different
question rather than the same answer twice. The roster rides the parent's
key in the router; children carry only their imperative.
+- **The Dismount** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# THE DISMOUNT (banked 2026-07-19, mechanism witnessed 2026-07-19): a ride
+# series ends with a fourth beat -- the hop-off. The dismount prompt makes
+# the model (1) VERIFY the article's opening goal against THIS compile's
+# receipts, never memory; (2) BANK graduations as SEARCH/REPLACE patch
+# cars, deletions included; (3) name the DANGLING carried forward
+# unbanked, one line each; (4) SEED the next ride's first compile with
+# context.txt lines. Mechanism: init.lua's <leader>k stages the canned block
+# above the current article's !!! floor. Witness: the \k-staged block rode
+# a Prompt section in the same compile whose receipt still showed PENDING --
+# flipped by patch, never by drift, one unwitnessed turn exactly as allowed.
+~~~
+
- **The Displacement Receipt** -- *read the neighbours' movement, not the
insertion's extent.* Banked 2026-08-08, self-convicted by under-reading a
receipt already in hand. When an `rg -n` probe straddles an INSERTION, the
@@ -1168,6 +1382,22 @@ Entries are alphabetical, numbers spelled as spoken.
on every rg probe whose target might live in a dotfile. Fifth sibling of
SINGLE-LINE / CASE-BLIND / UNANCHORED / CONTIGUITY -- a phrase a
default-configured tool cannot see.
+- **The Double-Tap Rule** -- *expanded rule; banked 2026-07-20.*
+
+~~~text
+# THE DOUBLE-TAP RULE (banked 2026-07-20, witnessed same day): a `!` probe
+# that reads an artifact WRITTEN LATER IN THE SAME COMPILE (foo.zip and its
+# rotated snapshots -- probes execute at step 2, the cartridge writes at
+# step 7, post-sanitize) photographs the N−1 compile. That stale-by-one
+# reading is a LAGGED receipt, not a failed one -- but the exemption must be
+# CLAIMED, never assumed: name the mechanism (which pipeline step writes
+# the artifact) and re-fire the identical probe next compile to collect the
+# AFTER. The second tap is mandatory; a lag excuse without a closing
+# receipt is an open fence. Conviction: the ContextCartridge topper read
+# `# KUNG FU` on its first zipfile probe and frontmatter on the second,
+# one compile later, exactly as the pipeline ordering predicts.
+~~~
+
- **The Eliminator Needs a Generator** -- *bisection cannot fail to eliminate
and can silently fail to converge.* Banked 2026-08-06, thrice-convicted in
one ride. Binary search terminates only if the target is IN THE ARRAY.
@@ -1192,6 +1422,12 @@ Entries are alphabetical, numbers spelled as spoken.
GENERATE (30-and-3, AXIS-FORCING, the rising sea) -> ELIMINATE (bisection,
the straddle) -> WITNESS (receipts). This repo has always had all three and
had been calling the middle one "science" as though it were the method.
+- **The Environment-As-Last-Inch Corollary** -- *expanded rule; banked 2026-08-02.*
+
+~~~text
+# - EARMARK: THE ENVIRONMENT-AS-LAST-INCH COROLLARY (banked 2026-08-02, three-ride conviction): an environment variable is a transformation nearest the actuator, and it is audited last or never. Conviction: three consecutive cold-start rides exported DISPLAY=:0 on a machine whose only X socket is X1, so chromium printed `xcb_connect() failed, error 1` after a 60s hang -- IDENTICALLY in the world where the xhost grant existed and in the world where it did not, which is THE DISCRIMINATION QUESTION failing in the operator's own hands. Every layer above it computed correctly: the xorg.xhost package landed, the shell was re-entered, the grant applied, chromium ran as the second user and dumped a DOM headless. The whole chain was green and invisible because the last variable was wrong. Settled by `echo $DISPLAY`, one word. STANDING CONSEQUENCE: before diagnosing a display, socket, port, or path failure, PRINT THE VARIABLE -- an auth-shaped error names a credential, a connect-shaped error names a destination, and the two are not interchangeable. Instance of THE LAST-INCH RULE with an env var as the last inch.
+~~~
+
- **The Epitaph Counter** -- *the patch's own comment is a hit.* Banked
2026-08-28, self-convicted three times in two turns. A REMOVAL probe anchored
on the removed STRING cannot read zero when the patch documents the removal
@@ -1215,6 +1451,56 @@ Entries are alphabetical, numbers spelled as spoken.
line spells the handle kata-name so an unanchored probe keeps reading 1, and
the tombstone probe anchors on the `# - ` prefix so faded receipts naming the
same handles cannot count as survivors.
+- **The Exaptation Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE EXAPTATION RULE (banked 2026-07-22, articulation-banked; forms molt,
+# they do not die): a form pronounced extinct is usually a form mid-molt --
+# recruited into a new substrate, same function in a new organ. Serial radio
+# drama did not die in the fifties; it molted into the fiction podcast and
+# the voice-acted audiobook (Expeditionary Force IS a serial radio program
+# with better headphones). The crystallin enzyme became a lens: same
+# protein, new job. Before accepting "X is impossible now," run two checks --
+# (1) manufactured forgetting: who profits from the corpse (the Phoebus
+# move)? (2) the live substrate the form already migrated to. Exaptation is
+# the DEFAULT hypothesis; extinction is the claim that needs the receipt.
+# Sibling to AXIS-FORCING: when stuck, ask what old organ this new pressure
+# can repurpose.
+~~~
+
+- **The Exit-Code Protocol Rule** -- *expanded rule; banked 2026-07-23.*
+
+~~~text
+# THE EXIT-CODE PROTOCOL RULE (banked 2026-07-23, witnessed same day): a
+# program a shell hook invokes for a DECISION speaks through its exit code,
+# never stdout. Nothing parses it, so no forked grandchild can hold a capture
+# pipe open (the rgx/xclip deadlock is the conviction), and the renderer
+# becomes swappable without the caller learning anything. Witness: across four
+# compiles boot_menu.py's timeout policy flipped, its labels changed, and its
+# entire call site MOVED ~80 lines up runScript, while flake.nix's invocation
+# stayed byte-identical -- `python scripts/boot_menu.py`, then capture $?.
+# Corollary, THE FALL-THROUGH GUARANTEE: pair every such call with an
+# `if [ -f <script> ]` test and a pre-gate default, so the hook behaves
+# EXACTLY as it did before the gate existed when the file has not landed.
+~~~
+
+- **The Fail-Open Threshold Rule** -- *expanded rule; banked 2026-07-23.*
+
+~~~text
+# THE FAIL-OPEN THRESHOLD RULE (banked 2026-07-23, receipt-witnessed): an
+# interactive gate placed on a DEFAULT entry path must return the pre-gate
+# behavior on every path an automated caller can reach -- no tty, explicit env
+# opt-out, missing termios, unexpected exception -- because a gate that can
+# strand an unattended `nix develop` is strictly worse than no gate. Blocking
+# FOREVER is then safe, but ONLY strictly after the isatty gate: a human is
+# provably present before anything waits. Every unattended tty must DECLARE
+# intent (PIPULATE_BOOT_MENU=0) rather than race the gate -- autognome's
+# clean-entry protocol types synthetic keys into the same pty, and
+# "Environment" contains an `n`, which is a door. Witness: nontty_exit=0,
+# bypass_exit=0, and the quiet devShell (which never reaches the gate)
+# evaluating to an unchanged drv hash across the whole ride.
+~~~
+
- **Failed-Probe Receipt** -- (banked 2026-07-20, canary-witnessed same day): the `!` executor lands stderr-only failures as first-class Manifest receipts -- "# NON-ZERO EXIT N" header, "(no stdout -- stderr is the receipt)" placeholder, fenced tail-capped stderr. Witness: the deliberate canary `bash -c "echo canary-stderr >&2; exit 3"` surfaced in the next compile's LIVE COMMAND RECEIPTS exactly as specified. Method note: the fix was proven by MANUFACTURING a known failure and confirming the instrument displayed it -- a QA pipeline is trusted only once it has demonstrably shown red when red was true.
- **The Filter That Ate the Evidence** -- *a status guard applied to a payload
channel.* Banked 2026-08-06, self-convicted in-payload.
@@ -1393,7 +1679,34 @@ Entries are alphabetical, numbers spelled as spoken.
why warm beat mcp as the front door; "snowball downhill" predicts nothing, it
is a mood). The forcing function is always the constraint that outlaws the
likely answer; the animal is the sticker on the constraint's box.
+- **The Forecast Named The Prose** -- *expanded rule; banked 2026-09-29.*
+
+~~~text
+# - EARMARK: THE FORECAST NAMED THE PROSE (banked 2026-09-29, convicted at deed 1671): a prediction about an instrument's WORDING is a prediction about the instrument's version, never about the world. curl -v's "SSL certificate verify ok." never printed on Honeybot's build, the grep read the content-type where the sentence was forecast, and the miss was the forecaster's while the certificate verified. Forecast the value an instrument exposes on purpose (%{ssl_verify_result}, an exit code, a count, a verdict token) and read its prose as decoration; when only prose is available, name its ABSENCE as one of the worlds. Sibling of THE GATE SPEAKS A VERDICT and THE SILENCED CHANNEL; cousin of INCOMMENSURABLE MEASUREMENTS.
+~~~
+
- **The Four Stages of the Harness** -- (banked 2026-09-28, the operator's words at the dismount): a human on this harness climbs the four stages of any new language -- literacy (can read and write the words at all: patch, app, d, m), automaticity (the words leave executive function for muscle memory), prosody (play in the words: bjj, the blank stare), fluency (the tools internalized, mastery spontaneous) -- and the models climb in lock-step, so the article archive is a training loop for both; the vendors' default compels learned helplessness, and the alternative is a scaffold you strap onto that pulls you along while forcing you to READ the red-and-green diff you actuate. Why the rides carry almost no wrong turn that must be backed out: the unit of change is a car, a car cannot land wrong silently (the exact-match interlock, the AST and Nix airlocks, a hand fence's own STOP/GO), every forecast is graded one compile later by receipts the model did not write, git holds every step, and the payload carries the ledger of prior misses as rules, so the model answers inside a corridor its predecessors dug; this ride's misses (git mv -q, the reseal in prose, Deliverables, imports=8, the absolutes one over) were each one car wide and each caught by the next tap. Home owed: a higher-profile line for the four stages, the walk's closing or the GLOSSARY, unruled.
+- **The Generated-Not-Authored Rule** -- *expanded rule; banked 2026-07-20.*
+
+~~~text
+# THE GENERATED-NOT-AUTHORED RULE (banked 2026-07-20, witnessed same day):
+# any payload section that DESCRIBES live capability (tool rosters,
+# registry counts, version stats) must be produced by the compile that
+# ships it -- computed from the live source in a bounded subprocess, with a
+# fail-LOUD placeholder on error -- never hand-authored prose. An authored
+# capability list is drift-by-construction: the sibling-.md failure mode
+# this repo exists to refuse. Witness: the Tool Roster's "21 tools"
+# matched the same compile's live_registry_count=21 receipt name-for-name
+# on its first flight; the only stale state it can ever exhibit is a loud
+# GENERATION FAILED banner, which is a wound, not a lie.
+~~~
+
+- **The Half-Executed Hook** -- *expanded rule; banked 2026-08-05.*
+
+~~~text
+# - EARMARK: THE HALF-EXECUTED HOOK (banked 2026-08-05, self-convicted): bash parses-and-executes an eval'd script ONE COMMAND AT A TIME, so a syntax error partway through a shellHook leaves everything ABOVE it applied and everything below it missing -- a half-configured environment that looks alive and is not. Conviction: an unterminated heredoc in miscSetupLogic let `mkdir -p Notebooks/Shared` land while PS1, the nix() rpath shim, and EVERY alias silently never defined; the artifact probe read GREEN off the surviving line. STANDING CONSEQUENCE: an artifact probe cannot witness a shellHook. The witness is the hook's own syntax -- `nix eval --raw .#devShells.<sys>.<shell>.shellHook | bash -n` -- or a marker exported by the LAST line of the hook. Sibling of THE SUCCESS-ONLY WITNESS: there the instrument hid a failure, here the instrument sat above it.
+~~~
+
- **The Halt Banner** -- *expanded rule; banked 2026-09-21.*
~~~text
@@ -1591,6 +1904,22 @@ Entries are alphabetical, numbers spelled as spoken.
it. Sibling of THE LANE-DISAGREEMENT WITNESS, inverted: that rule USES a
lane gap as evidence about the code; this one names a lane gap in the
INSTRUMENT, where a gap is never evidence, only breakage.
+- **The Honest-Seam Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE HONEST-SEAM RULE (banked 2026-07-22, witnessed same compile -- the
+# 80-column tell): when the machine mimics the operator's surface (vim
+# textwidth=80 hard-wraps, his line-break cadence) it leaves a fingerprint,
+# and the fingerprint is LOAD-BEARING. The caboose prompt the AI hands back
+# for the next turn MUST stay UNWRAPPED -- no cosmetic 80-col fold -- so the
+# operator can always tell the mirror from the man standing in front of it.
+# Sanding the seam smooth is precisely how the drift-checker becomes the
+# drift. Source-file rules wrap (they are code); the returned prompt does
+# not (it is the receipt that says a machine wrote it). Conviction: Opus 4.8
+# hard-wrapped its own caboose to 80 and got caught red-handed, eighty
+# columns wide -- the dinosaur seam in the line-wraps. Leave the seams in.
+~~~
+
- **The Human Is Not the Branch Predicate** -- (banked 2026-09-24, after the Chrome
profile census ride made the operator decide whether Car 1's output licensed
Car 2, then whether Car 2 licensed Car 3). A patch train is compiled control
@@ -1843,6 +2172,22 @@ Entries are alphabetical, numbers spelled as spoken.
# waive human review, and event presence does not prove complete bodies.
~~~
+- **The Locator That Pointed At Nothing** -- *expanded rule; banked 2026-08-28.*
+
+~~~text
+# - EARMARK: THE LOCATOR THAT POINTED AT NOTHING (banked 2026-08-28): the
+# refusal printed a payload byte offset and told the operator to inspect that
+# payload line -- an artifact that BY CONSTRUCTION does not exist, because a
+# blocked run exits at step 6 and write_context_cartridge runs at step 7.
+# Four CORRECT refusals read as noise for that reason alone. Cured by
+# scanning back to the nearest START marker, which the payload already
+# carries, so the refusal names a FILE the operator can open and grep. Both
+# branches witnessed: the section-naming branch against a real payload, the
+# "(before any section marker)" fallback against raw text read off disk.
+# Sibling of THE LAST-INCH RULE -- every upstream stage was right and the
+# reader-facing string was the whole defect.
+~~~
+
- **The Machine Is Named by Its Prompt** -- *every command block is headed
by the prompt string of the terminal it runs in.* Banked 2026-09-29,
convicted at deed 1682; its checklist line landed at deed 1685 as item 13
@@ -1878,6 +2223,24 @@ Entries are alphabetical, numbers spelled as spoken.
OUT-OF-BAND STEP RULE (a hand step the terminal cannot take rides at the
top, lettered) and THE FINDING DORY RULE (walk every hand step from the
operator's chair); this one names WHICH chair.
+- **The Maintainer-Invisible Lane** -- *expanded rule; banked 2026-08-04.*
+
+~~~text
+# - EARMARK: THE MAINTAINER-INVISIBLE LANE (banked 2026-08-04, three-for-three):
+# every defect this ride closed was structurally unobservable from the
+# maintainer's daily machine, and for THREE DIFFERENT REASONS. The alsa-utils
+# refusal needs a foreign hostPlatform. The 24 INFO lines need twelve absent
+# destination files, which exist on any machine used twice. The false-dirty
+# gate needs a freshly cp'd index, which exists for about forty seconds once per
+# install, a year ago on Prime. NONE is a rare edge case; each is the ONLY
+# thing a stranger ever sees, and each is invisible to the one person who could
+# fix it. STANDING CONSEQUENCE: when a lane's whole audience is people who
+# cannot report bugs, budget rides for it on a schedule, not on complaint --
+# there will never be a complaint. Sibling of THE UNEXPORTED-SHIM RULE
+# ("lane-visible only ... the audience the artifact ships to can never report
+# it") generalized from one mechanism to a whole class.
+~~~
+
- **The MCP Receipt Rule** -- *a tool call is a receipt or it is nothing.*
Banked 2026-07-29; mechanism witnessed 2026-07-25 by the fault harness,
vendor-witnessed 2026-07-29 and 2026-08-06. A model-mediated tool call
@@ -1948,6 +2311,38 @@ Entries are alphabetical, numbers spelled as spoken.
nonzero enumeration in this shape, and a fixed rendering for it (one
line per call, the four points in order) so the enumeration is grep-able
across cartridges.
+- **The Name Is Not The Value** -- *expanded rule; banked 2026-08-28.*
+
+~~~text
+# - EARMARK: THE NAME IS NOT THE VALUE (banked 2026-08-28, hole found the same
+# morning the valve landed): the first spelling searched the whole match, and
+# ten of eleven tripwires match the credential ITSELF -- but the generic
+# assignment tripwire captures the VARIABLE NAME too, so an uppercase name
+# carrying a marker word would have exempted whatever real credential sat to
+# the right of the equals sign. The marker riding OUTSIDE the value is the
+# exact failure the valve's own comment says a line-level check would have.
+# Cured by cutting at the first "=" or ":" in the match. WITNESSED both ways
+# in one straddle: name_marker_blocks 0 -> 1 while value_marker_exempt held
+# at 0, the negative control that proves the cure did not break exemption.
+# STANDING CONSEQUENCE FOR AUTHORS: spell fixture BODIES so they announce
+# themselves; a marker word in the variable NAME buys nothing.
+~~~
+
+- **The New-B Gradient Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE NEW-B GRADIENT RULE (banked 2026-07-22, articulation-banked): the top
+# and bottom of the register stack execute the IDENTICAL move. Skippy
+# (godlike-AI condescension) and Barney (toddler-wholesome earnestness) both
+# say "let me break this down for the newcomer" -- one gesture, opposite
+# hats; the failure at the genius end is pretension, at the simpleton end is
+# dilution, and the target is the competent middle (Joe Bishop: plain-talk
+# that is not dumb). Choose the register on PURPOSE, and keep one plain true
+# thing dead-center so the sophistication has something real to rebut -- the
+# ex-cop's duct-taped recliner parked in the tasteful apartment is the whole
+# comedy of Frasier and the whole shape of a good New-B explanation.
+~~~
+
- **The Next Action, Not the Machinery** -- (banked 2026-09-15, deed 1419): newcomer guidance names the visible cue and the next action; audit exercises follow completion. The introductory run kept three CAPTURE checkpoints, private evidence and disclosure checks while dropping fingerprint homework and the final DECANT word. Consent moved before the real-walk choice for the scoped bundled route; custom walks retain DECANT. The operator reported a much better experience. Simpler instructions are not weaker evidence.
- **Next Context Is Paste-Ready or It Is Sabotage** -- (banked 2026-09-24, convicted by
an operator who had to hand-translate a prose paragraph back into context.txt
@@ -1974,8 +2369,35 @@ Entries are alphabetical, numbers spelled as spoken.
is `context`, paste at the end, `:wq`. svb --write replaces its own block
wherever it sits, so the bottom is always right (deed 1696: Context 5 below
the END line, all eight of its lines rode).
+- **Next Context Is The Whole List** -- *expanded rule; banked 2026-09-20.*
+
+~~~text
+# NEXT CONTEXT IS THE WHOLE LIST (banked 2026-09-20, convicted the same day,
+# and banked HERE because this file rides the fixed tail of every ADHOC
+# compile while the constitution does not): the payload a model is reading is
+# the ONLY raw source it will ever be allowed to patch, and the operator
+# comments the 40K-foot block out on turn two. A file that "is already there"
+# this compile is gone next compile. Every file a next-turn car will patch is
+# named in full in NEXT CONTEXT -- one that rode this compile, one that rides
+# every compile, one the operator knows by heart -- because "already there"
+# is a claim about the past wearing the future's label. CONVICTION: a
+# three-car caboose said init.lua, flake.nix and index.html were already
+# there; the next payload carried mother_cat.py and none of them, and two
+# cars waited a turn for raw source the list had waved at. The cost is one
+# line per file. THE GROOVE THAT HOLDS: the checklist's own NEXT CONTEXT
+# clause in prompt_foo.py is the eventual home, read at the highest-attention
+# position of every full-frame compile; this comment is the second groove,
+# and a § key in foo_files.py the third.
+~~~
+
- **NIX_DEVELOP_DELAY CONVICTED** -- (2026-07-21, receipts banked): warm hydration of .#quiet measured 12.5s/12.2s hand-run vs 1.0s in-compile -- BIMODAL. CAUSAL CLAIM RETRACTED 2026-08-01: this blamed a gitignored flake.lock and .gitignore carries no flake.lock entry (operator reports the lock is now pinned as intended, and `ndq` is fast enough to run casually). The MEASUREMENT stands; the EXPLANATION is now UNEXPLAINED and must be re-derived before anyone cites it. Conviction shape: a model read this comment and repeated it as a fact about a file while .gitignore sat in the same payload -- THE LAST-INCH RULE with the model as the last inch, and a CVR sentence wearing an FDR's typeface. A 3.5s constant cannot track a bimodal distribution (too slow for hits, catastrophic for misses; Desktop 7's full `nix develop` tabs are strictly slower). SENTINEL RIDE scoped: the TYPED-AHEAD SENTINEL -- autognome types cd X, nix develop .#quiet, and touch /tmp/autognome_ready_N in one burst; all three buffer in the pty and the touch executes only when a live shell drains the queue; poll the file with a timeout. Zero flake edits, arrows point down the ziggurat, and the cure's mechanism IS the pty type-ahead claim -- verify that claim (transcript receipts) before implementing. Known fracture: full-shell tabs end blocked in server.py (no stdin reader), so buffered lines become ghost commands that fire at the next prompt.
- **NixOS Selenium 127** -- (banked 2026-07-20, receipt-witnessed same day): Selenium Manager auto-downloads an FHS-linked chromedriver into ~/.cache/selenium that dies status-127 on NixOS -- no /lib64 dynamic linker (ldd convicted it: libnss3/libnspr4/libglib "not found"). Fix: resolve the Nix driver via shutil.which('undetected-chromedriver') -- HYPHEN, the exact name scraper_tools.py already uses; bare 'chromedriver' and the UNDERSCORE variant are both MISSING on PATH. Conviction: a helper checking the wrong names is a silent no-op that STILL commits green ("refactor: implement PATH-resolved chromedriver" landed, changed only the log line, and the 127 survived until the hyphen name landed). Same disease as the uvx/Rustkyll stub-ld earmark; browser + driver stay paired because both track one nixpkgs pin (chromium 150 == undetected-chromedriver 150). weblogin.py and all five apps/440 Chrome instantiations now route through this resolution. SECOND CONVICTION 2026-09-27, the lanes swapped: connectors/botify.py's _admin_cookies_inner was written on the Mac during the blackout ride and passed uc.Chrome no driver path, so the first census ever run on Prime died at the downloaded driver's exit 127 in 1.2 s, twice, the second time after exit and ndq, and the refusal blamed a locked profile; the car emitted at deed 1621 resolves the hyphenated driver and the flake's chromium there, prints both before the launch, and makes a 127 name the loader. WITNESSED 2026-09-27 (deed 1622): the compile-lane census read the pair at 150.0.7871.128 both and the downloaded driver at exit 127 with the stub loader's own sentence, and the operator's census printed both store paths and harvested in 7.8 s.
+- **No Heredoc Inside An Interpolated Nix String** -- *expanded rule; banked 2026-08-05.*
+
+~~~text
+# - EARMARK: NO HEREDOC INSIDE AN INTERPOLATED NIX STRING (banked 2026-08-05, main-breaking): a bash heredoc whose terminator sits inside a Nix indented string that is itself INTERPOLATED into another indented string can lose its column-0 alignment, after which bash swallows the rest of the shellHook to EOF. Conviction: a cat-heredoc added to miscSetupLogic broke nix develop on main for every user; the identical pattern in runScript -- a standalone writeShellScriptBin, never interpolated -- has worked for years. THE MECHANISM IS UNWITNESSED: the BEFORE tap on the generated hook text was never taken (the operator healed main first, correctly), and it is deliberately NOT being reconstructed, because the forward blast radius is zero once the pattern itself is banned. FALSIFIED from raw source: every line of miscSetupLogic sits at exactly 10 spaces, so no under-indented line dragged the minimum down. PRESCRIPTION: write multi-line files from a shellHook with ONE printf and never a heredoc, and syntax-check the generated hook before any commit that touches it.
+~~~
+
- **One Timeline, No Previews** -- every command in the response appears exactly once, in the section where it executes, in execution order -- PROBES (read-only) first, then PATCHES as numbered cars with any dependent actuator or ignition as the LAST cars, then PROMPT. A command that depends on a patch is never quoted above that patch, not as a preview, not "for later"; if it must be mentioned early, name it ("Car 3, the smoke") and show nothing. Convicted 2026-09-28 (deed 1662): the git add for a file a WRITE_FILE car creates rode in its own fence ABOVE that car's fence; the operator pasted in reading order, git answered fatal: pathspec, and the line ran again after app; a hand fence that depends on a car sits below it, in the order the hand will meet them. A CAR OUTSIDE THE TRAIN DID NOT RUN (second conviction 2026-09-29, deed 1693; the operator's words: "instructions to do-this or do-that outside where I'm expecting you to tell me is tantamount to sabotage"): the WRITE_FILE car for SVB-133's deliverable and its git add fence rode in the reply's kata section, above the train, the operator ran the train and never them, the next compile read TICKET_DIR_ABSENT, and the compaction summary said WRITTEN. Every car and every hand step the train needs (a git mv, a walk typed by hand) is a numbered car in (3) PATCHES, a plain fenced command under its prompt line and never a banner; the operator's own habits (patch, app, d, m, git push, the paste into context.txt, prompt, bff) are never written, because the operator does them unasked and a written one costs a re-read to learn whether something changed; a repo step written outside the train is a step that did not happen, and the one step no terminal can take rides above the train under THE HALT BANNER, below. RULED 2026-09-29 (deed 1703, the operator's words): "NEVER use HALT inside the 5-Car Train. ALWAYS use HALT for OOB things that need my attention outside the 5-Car Train."
- **The Operator Is a Variable** -- (banked 2026-09-08, three convictions in one ride): a straddle holds the world constant and changes ONE thing, but the operator lives in the world and acts on it between taps -- toggles a setting, runs the actuator early, runs it again -- and every such act is a SECOND manipulated variable no probe was told about. CONVICTIONS, one ride: a census labeled "reads identically by design" flipped Profile 2's sync_metadata from True to False between the hand tap and the compile because the operator toggled Chrome Sync, while the script refused Default, the only declared profile, and "no luck" was read off a verdict about a different subject; a dry-run predicted to read DRY_RUN read IN_SYNC because the operator ran the real sync before the compile; a backup listing predicted at two files read three because the operator ran a purge the article described only in prose. In every case the receipt was TRUE about the world and silent about which variable moved. STANDING CONSEQUENCE: when a reading moves by more than the patch can explain, ask what the operator did between taps before crediting or blaming the patch, and write operator actions taken between taps into the article as loudly as patches. Sibling of THE PRE-COMPILE ACTUATOR RULE (one instance: the actuator run early) and of THE STRADDLE IS A CONTROLLED EXPERIMENT, whose four named confound controls do not cover the experimenter's own hands.
- **The Out-of-Band (OOB) Edit Rule** -- (banked 2026-07-21, articulation-banked --
@@ -1992,6 +2414,22 @@ Entries are alphabetical, numbers spelled as spoken.
vim skills make the cut. Collision-free edits stay in the airlocked
SEARCH/REPLACE lane; collision-class edits route to the human as actuator.
The airlock is for content that does not speak the airlock's own language.
+- **The Pending Amendment Rule** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# THE PENDING AMENDMENT RULE (banked 2026-07-19, witnessed same compile):
+# an amendment that describes MECHANISM BEHAVIOR enters the constitution
+# tagged PENDING and stays PENDING until a compiled receipt witnesses the
+# behavior it asserts; the flip to banked is its own chisel-strike.
+# Conviction: the STDERR MERGE AMENDMENT was committed one compile before
+# its mechanism existed -- the map outran the territory and only the
+# scheduled canary caught it. The constitution may PROPOSE one turn ahead
+# of the code; it may never ASSERT ahead of it. Rules of pure judgment
+# (30-and-3, Probe Economy) bank on articulation; rules claiming what the
+# machinery DOES require the machinery's receipt first. Never more than
+# one unwitnessed turn between an amendment and its evidence.
+~~~
+
- **The Pipeline Ate the Fallback** -- (convicted 2026-09-21, by a probe that could
not fail). `ls DIR 2>/dev/null | head -5 || echo no_dir` was echoed to report
a missing directory. It never could: `||` binds to the whole PIPELINE, and a
@@ -2163,6 +2601,24 @@ Entries are alphabetical, numbers spelled as spoken.
therefore unshippable. That is a STRANDED ARTIFACT, not a security gap --
there is no v0.1.0 in the wild for the fix to be a fix to. It costs nothing
today and will confuse whoever finds it later.
+- **The Read-Write Probe** -- *expanded rule; banked 2026-08-04.*
+
+~~~text
+# - EARMARK: THE READ-WRITE PROBE (banked 2026-08-04, specimen-convicted): a
+# probe that OPENS a database is not read-only, and the damage lands on the
+# EVIDENCE rather than on the data. sqlite3.connect() defaults to read-write,
+# so `cli.py db-inspect` touched data/botifython_dev.db and moved its mtime
+# from May 3 13:26 to Aug 4 08:43 with its SIZE UNCHANGED at 503808 -- opened,
+# not written. That mtime was the single cheapest liveness signal separating
+# the live app database from the three-month-old fossil the backup roster was
+# copying, and the probe sent to READ it DESTROYED it. Harmless only because
+# the roster fix had already landed. PRESCRIPTION: inspect SQLite through the
+# read-only URI (sqlite3.connect('file:path?mode=ro', uri=True)), or stat the
+# file without opening it. Sibling of THE PROBE THAT ATE ITS SIBLINGS: that
+# one bounds a probe's effect on SHELL STATE, this one bounds its effect on
+# the MEASUREMENT.
+~~~
+
- **The Receipt Ladder Rule** -- (banked 2026-07-22, articulation-banked): integrity
is not authenticity. A CRC answers "did a bit flip?"; a SHA-256 answers "are
these the exact bytes, unswapped?"; a SIGNATURE answers "did I stand behind
@@ -2181,6 +2637,50 @@ Entries are alphabetical, numbers spelled as spoken.
a model changed them; a CRC says "changed" and never "who". A caption that
names the author ("the model rewrote what it was told to copy") is a verdict
written into the instrument. Let the seal say what it measures.
+- **The Receipt-Plus-Lane Table** -- *expanded rule; banked 2026-08-02.*
+
+~~~text
+# - EARMARK: THE RECEIPT-PLUS-LANE TABLE (banked 2026-08-02, four-turn witnessed): the standing render for pass/fail rulings is a markdown table with FOUR columns -- Item, Colour, Receipt, Lane -- and the load-bearing part is the last two, not the glyph. Receipt forces a claim to name its evidence; Lane forces it to name its vantage (compile lane = prompt_foo's ! executor; operator lane = a hand-run terminal), because a receipt without a lane is unlabeled evidence and the two lanes routinely disagree. THREE STATES, not two: green (witnessed), red (witnessed failing), and a third for attempted-but-unverified or VOID (the probe could not see). A two-state table flattens both into a lie -- convicted twice in one ride series, once when a sudo-refused probe's `0` was read as a reading and once when a program's own "copied to clipboard" print stood in for a paste. The glyph is the HANDLE (memorable, scannable); the receipt-and-lane pair is the MECHANISM. Sibling of THE TWO-RECORDER RULE: authority may only decrease from wire receipt to tool transcript to narrative, and the Lane column is where that ladder becomes visible.
+~~~
+
+- **The Redundant-Groove Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE REDUNDANT-GROOVE RULE (banked 2026-07-22, witnessed this compile):
+# on-topic-ness is not a personality you beg the model to wear; it is a
+# groove you carve so attention rolls into it wherever it drops. Encode the
+# frame TWICE: the canonical roster welded into foo_files.py travels as
+# visible text in every compile (the declared MAP), while the live overlay
+# splices those same files in as content (the realized TERRITORY) -- map and
+# territory in one window, cross-checking each other. Two grooves = the
+# marble rolls home no matter where it lands = forward error correction; the
+# West African talking drum repeats the tonal pattern for the identical
+# reason -- redundancy is how a signal survives a noisy channel. Corollary:
+# this IS the receipt's manifest+payload symmetry (what-bytes cross-checking
+# the-bytes) generalized to the router itself -- the book teaching its own
+# technique by using the technique on its table of contents. By the time the
+# model reaches the Prompt at the bottom it has read the frame twice and
+# answers primed, not cold. Furnish the room before the guest walks in.
+~~~
+
+- **The Refusal-Only Witness** -- *expanded rule; banked 2026-08-01.*
+
+~~~text
+# THE REFUSAL-ONLY WITNESS (banked 2026-08-01, ride-convicted): a guard
+# observed ONLY refusing is indistinguishable from a guard that is BROKEN SHUT,
+# and no read-only probe can tell them apart -- the open state is not
+# observable without an actuation. THE DISCRIMINATION QUESTION applied to
+# fences: "what does this print in the world where the fence is stuck?" The
+# same refusal, every time. Conviction: ~10 receipts across five compiles all
+# measured _capture_checkpoint saying NO (pipe, EOF, explicit stream, no
+# controlling terminal), and the first {"success": True} it ever returned was
+# 12:54:47.912 on the first real MCK ride. STANDING CONSEQUENCE: a fence is
+# UNWITNESSED until something has been observed passing through it; count a
+# guard's greens as evidence of the closed branch only, and say which branch
+# a receipt covers. Sibling of LANE-DISAGREEMENT (that one is a probe blind to
+# the patch; this one is a probe blind to half the state machine).
+~~~
+
- **The Render-Gap Rule** -- *render artifact versus file bytes.* Banked
2026-07-31, self-convicted -- the model filed the false report. A model
reading a compiled payload CANNOT DISTINGUISH FILE BYTES FROM RENDER
@@ -2270,6 +2770,24 @@ Entries are alphabetical, numbers spelled as spoken.
THE SILENCED CHANNEL (a verdict that reads a channel the instrument closed);
cousin of THE FOLDER IS A VARIABLE (a hand step that prints the same thing in
both worlds).
+- **The Saddle Amendment** -- *expanded rule; banked 2026-07-28.*
+
+~~~text
+# THE SADDLE AMENDMENT (banked 2026-07-28): the mount saddle (init.lua
+# mount_sandworm) no longer numbers Ignition as its own slot. Ignition
+# RIDES INSIDE the Patches car -- exactly as this rule already requires
+# ("not a fourth beat; it completes PATCH") -- so the saddle's five
+# numbered slots now match the Actionable Response Contract one-for-one:
+# 1 Probe, 2 Context, 3 Patches (patch/app/d/m THEN ignite: exit+nd, <F2>,
+# or "no ignition required"), 4 Prompt, 5 Deliverables. The earlier "only
+# the saddle gains a slot" reading is SUPERSEDED, not retconned: the slot it
+# named was Ignition-as-beat-4, and folding it into Patches is precisely the
+# alignment. Ignition stays a real singular step ("one actuation, or none");
+# it simply stops printing its own number. Same-car label discipline: this
+# note ships in the same ride as the init.lua saddle edit it describes.
+# Ref: the MCK build ride (see THE MOTHER CAT KATA above).
+~~~
+
- **The Screenshot Is Not a Locator** -- (banked 2026-09-11, two exchanges lost).
Botify's Confluence pages for custom link attributes say "go to the project
page on django admin" and show the field ONLY as a screenshot. Two admin
@@ -2287,6 +2805,23 @@ Entries are alphabetical, numbers spelled as spoken.
answers from the doc's prose will send the operator to the sidebar decoy, and
the operator -- who cannot see the doc's screenshot either -- has no way to
tell a wrong answer from a right one until they have read every textarea twice.
+- **The Second Interpreter Rule** -- *expanded rule; banked 2026-07-17.*
+
+~~~text
+# THE SECOND INTERPRETER RULE (banked 2026-07-17): this file has two
+# interpreters. CPython reads the path strings; the summoned model reads
+# the prose. Comments here are therefore PROGRAM, not annotation -- but a
+# program running on an UNPINNED interpreter (no Nix for the genie), so
+# execution may vary across models, versions, and days. Trust boundary:
+# only 📌 PINBOARD pins and EARMARK lines carry standing-instruction
+# authority across compiles; all other prose is context. Prose PROPOSES;
+# only the airlocked lane (apply.py exact-match, AST/Nix checks, git,
+# human clipboard actuation) ever MUTATES. Divergent execution therefore
+# costs a rerun, never a regression -- the nondeterminism is typed and
+# quarantined at the proposal stage, and replay convergence is measured
+# by foo-cartridge-replay-v1 rather than trusted on manners.
+~~~
+
- **The Seed Reduction** -- (30-and-3 banked 2026-08-01; the fan-out lives in the
article, only the three survivors live here, per the rule that a reduction
written down is a traversal never repeated):
@@ -2313,7 +2848,25 @@ Entries are alphabetical, numbers spelled as spoken.
An installer that re-resolves against a moving channel is a pip; a pinned
lock is a graft. The lock was pinned 2026-08-01, so the distribution story is
grafting now and the language should say so.
+- **The Self-Matching Pattern** -- *expanded rule; banked 2026-08-05.*
+
+~~~text
+# - EARMARK: THE SELF-MATCHING PATTERN (banked 2026-08-05, twice-convicted in one transcript): pkill -f and pgrep -f match the FULL COMMAND LINE, and the shell running the script carries the pattern in its own argv -- so an unescaped pattern kills or counts the process that issued it. CONVICTION: flake.nix's publish() [4/4] block protected two patterns with the [.] trick (a regex demanding a literal dot the argv literal does not contain) and MISSED THE THIRD, so every `publish --reboot` killed its own ssh session at that line. The guard must be applied to EVERY pattern in a block, not most of them -- a partially-guarded block READS as guarded. WITNESS: after the fix, `publish force --reboot` printed `new_count=1`, `new=534841`, and the watchdog verdict line, three lines that had never once appeared in any prior transcript.
+~~~
+
+- **The Sentinel Written Into Its Own File** -- *expanded rule; banked 2026-08-05.*
+
+~~~text
+# - EARMARK: THE SENTINEL WRITTEN INTO ITS OWN FILE (banked 2026-08-05, near-miss): documenting a scanner's trigger string inside the file that scanner reads is a self-referential hazard, and it is invisible until the scanner runs. CONVICTION: a guard comment explaining release.py's waxascii canary was added to README.md and CONTAINED THE CANARY PHRASE. It was safe for two independent reasons -- the real needle carries a blockquote prefix the prose lacks, and the scanner breaks on the first match, which is the real canary twelve lines above -- and both were established AFTER the write, by reading source. The fail-safe direction held by construction (if the real canary were deleted the prose still would not match, so the scanner skips rather than aiming at the wrong line), but that was luck. PRESCRIPTION: when documenting a sentinel inside its own file, refer to it by NAME and never reproduce its literal text; if the literal is unavoidable, verify the matcher's exact needle before the write, not after.
+~~~
+
- **The Shadow Is Not a Replica** -- (banked 2026-09-16, Mac shadow-publishing ride): preserving a command grammar on a second machine does not require synchronizing the publication repos it normally targets. Put the mechanism in the shared repo, put target identity and path data behind a runtime-selected matrix, and on the disconnected machine point those targets at local accumulating corpora while OMITTING the publishing actuators. Receipt: after ignition PIPULATE_BLOGS_CONFIG named blogs.shadow.json, targets 1/3/4 all resolved to existing ~/.local/share/pipulate/shadow-publishing directories, the Darwin article/grim/bot chain ended at sanitizer.py -> articleizer.py, and the compile carried a formatted Grimoire post from that shadow tree. STANDING CONSEQUENCE: sync only when shared history is the product; when the product is authoring muscle memory and format fidelity, mirror the verbs and subtract capabilities. DISCRIMINATOR: if the shadow command can mutate a remote publisher, it is a replica lane and owes the synchronization and credential bill. AMENDED 2026-09-30 (deed 1733): a READ replica is not a replica lane. The mirror's copies under ~/repos carry the source's own keys and aliases, so the verbs read the same on both machines, while their push URL is disabled and publish refuses on darwin, so the discriminator above still reads write-free; one variable, two values by lane: the shell exports the read config (blogs.mirror.json) and write_post pins the write config (blogs.shadow.json) inside its own subshell. Witnessed for reading (posts -t grim and rgx -t all under ~/repos after re-entry); the write half's pin sits in the hook text (the Darwin eval read mirror_cfg_lines=3 and publish_guard=1) and has never been typed.
+- **The Shallow Census** -- *expanded rule; banked 2026-10-04.*
+
+~~~text
+# - EARMARK: THE SHALLOW CENSUS (banked 2026-10-04, witnessed at deed 61: in the compile lane ~/qamyai read true with 9853 commits after the reset, the shallow file outliving it as forecast and naming a commit the rewrite orphaned, while the fresh bare clone saw the oldest name-bearing commit a year back): a git log census in a shallow clone reads the clone's boundary as the oldest commit, because git treats the boundary as a root whose diff adds every file; ~/qamyai came from the installer's clone (INFERRED depth=1, THE TEST-RIG PROVENANCE RULE), so its -G census named the install day as the first commit carrying a client name, a week late, and a rewrite from that clone could push a history that starts there (INFERRED). Read git rev-parse --is-shallow-repository beside any history census, and rewrite history only in a fresh full clone whose census sees a known member before it may read zero. Sibling of A CENSUS CARRIES A KNOWN MEMBER and THE TAPE IS NOT THE WORK.
+~~~
+
- **The Shell-Lane Findings** -- (banked 2026-08-01, source-witnessed in-compile; all
three are OBSERVED from raw source, not inferred):
a. the quiet shell CREATES the venv and never POPULATES it. Only the
@@ -2399,6 +2952,31 @@ Entries are alphabetical, numbers spelled as spoken.
flip. Pick witnesses from lines that cannot wrap (dated headers like 'BANKED
2026-07-29 (same-day flip'), and when the patched text is your own, confirm
the phrase sits on one line before recommending the probe.
+- **Spell Out The Tool-Call You Are Making Of The Human** -- *expanded rule; banked 2026-09-22.*
+
+~~~text
+# SPELL OUT THE TOOL-CALL YOU ARE MAKING OF THE HUMAN (banked 2026-09-22, at
+# the operator's instruction, after a Context car that said "same as last
+# turn" and taught nothing). The model reading this file is tool-calling a
+# PERSON, and a person cannot ask a paragraph a clarifying question. Polite,
+# indirect, erudite or compressed wording is ambiguity, and ambiguity gets
+# resolved wrong.
+# THE RULE: short words, imperative, one action per line. Never point at
+# another turn instead of restating the step: no "same as before", no "as
+# above", no "the usual". Never make the human guess which file, which
+# command, or which of two readings you meant. Write for someone in a hurry
+# on a laptop in an internet cafe who will act on the first sentence that
+# looks like an instruction. Example: "Run this in a terminal on Pipulate
+# Prime when the power returns," never "carried in full so it is not a
+# bibliography."
+~~~
+
+- **The Stat-Cache False Positive** -- *expanded rule; banked 2026-08-04.*
+
+~~~text
+# THE STAT-CACHE FALSE POSITIVE (banked 2026-08-04, receipt-witnessed both lanes): `git diff-index --quiet` decides from the index's CACHED STAT DATA -- dev, inode, mtime, size -- and short-circuits before comparing content. Any operation that rewrites files while carrying an index along (cp -r, rsync without -a, a restored backup, a container layer) makes a byte-identical tree report DIRTY. Receipt: clone -> `cp -r src/. dst/` -> after_cp=1, after_refresh=0, reproduced identically in the operator and compile lanes. WHY IT SURVIVES SO LONG: `git status` refreshes the index as a side effect, so the false positive has ALWAYS healed by the time a human types the diagnostic. The symptom is structurally unobservable by the only method anyone reaches for. STANDING CONSEQUENCE: any automated dirty-tree check runs `git update-index -q --refresh 2>/dev/null || true` first. It clears ONLY stale entries, so a genuinely modified file still reports dirty and a halt-don't-destroy gate keeps its teeth.
+~~~
+
- **The Stewardship Rule** -- *expanded rule; banked 2026-07-22.*
~~~text
@@ -2477,7 +3055,35 @@ Entries are alphabetical, numbers spelled as spoken.
the file is exactly as believed. Cure: trim one trailing blank before
counting. Receipts: Car 1 start=240 end=287 span=48 with the trim firing;
Cars 3 and 4 span=16 and span=50 with the trim idle. Both branches seen.
+- **The Success-Only Witness** -- *expanded rule; banked 2026-08-02.*
+
+~~~text
+# - EARMARK: THE SUCCESS-ONLY WITNESS (banked 2026-08-02, cold-start ride six): a claim observed ONLY succeeding is indistinguishable from a claim that CANNOT fail, exactly as a guard observed only refusing is indistinguishable from one broken shut. Conviction: synthesize_and_play called wait() and DISCARDED the exit code while stderr went to DEVNULL, so a player killed by SIGFPE printed its reason into the void and the function returned True anyway -- speak_text reported success, the rider printed nothing, and the human heard silence beside a green console. The instrument that was supposed to report the failure was the thing hiding it. DISCRIMINATING QUESTION for act-claims: what does this print in the world where the act did not happen? If the answer is "success," it is not a receipt. This is also the missing third suspect from the 2026-07-26 THE DEMO WENT SILENT todo, which named transport and engine and never once looked at the subprocess exit status. Sibling of REFUSAL-ONLY WITNESS (one branch of a state machine) and of the MECHANICAL TEST in ATTRIBUTED-VOICE (a verb naming an act that no code performed).
+~~~
+
+- **The Talmud-Page Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE TALMUD-PAGE RULE (banked 2026-07-22, articulation-banked): the tzurat
+# ha-daf is the master pattern for a signed discussion cartridge -- immutable core
+# text ringed by attributed, stratified commentary (Rashi inner, Tosafot outer,
+# later authorities beyond): a versioned, cross-referenced hypertext on one fixed
+# page, centuries before "hypertext." Its defining move is that it PRESERVES
+# DISAGREEMENT instead of resolving it. Elu v'elu -- the minority ruling stays on
+# the page so a later generation can re-derive and find the losing branch was
+# right. That is keeping the dead branches in the DAG. A Confluence discussion +
+# replay-cartridge per closed ticket IS a Talmud page per ticket: frozen core =
+# the cartridge, commentary = the discussion, Jira ID = the address in the ToC.
+# Do not resolve-and-delete; attribute-and-preserve.
+~~~
+
- **The Tape** (banked 2026-09-29, deeds 1700 and 1701, the operator's words) -- prompt.md is the tape: the operator's turns and the model's, appended at the bottom, never rewritten; payload.md is what the compiler read to produce a turn; manifest.json accounts for both, and the deed is the zip that seals the three. A repo patch is on the tape through the Telemetry diff and context.txt through the Manifest, and NOTHING ELSE IS: a file a car creates that no later compile reads back does not exist (a Turing head writing on the wall of the room with no entry on the tape), so a car that would create one is refused at emit time and says so, and the deliverable is the reply's own text, sealed by the next compile. THE CONFIG EXCEPTION, named once so it stops being a memory: dotenv, config and backups (~/.config/pipulate, ~/.local/state/pipulate, the vault .env, the repo .env) live off the tape because they must outlive the folder, and nothing else does. Conviction: deliverable.md, written into the corporate tier by a car outside the train at deed 1692, staged and never committed, removed at 1696; and the OMG at 1693 over the board landing in ~/.local/state/pipulate/context.txt, which is that exception working (PIPULATE_ADHOC_FILE, set in the operator's own environment so no git sweep can reach the file; the file that sets it is the repo .env, gitignored and sourced by the flake's miscSetupLogic on every shell entry, read at deed 1703).
+- **The Tape Is Not The Work** -- *expanded rule; banked 2026-09-30.*
+
+~~~text
+# - EARMARK: THE TAPE IS NOT THE WORK (banked 2026-09-30, deed 1729): a mirror's DONE and a date that matches the source witness the TAPE, never the working copy behind it; a repo whose push goes somewhere other than the tape (trimnoir's to Honeybot, Client_Work's to GitHub) keeps a stale tape that mirrors green. Conviction: trimnoir.git sat nine months behind daily publishing and clients.git a year and a half behind Client_Work, and either would have printed cloned with its source's own date and DONE. The census that tells them apart is per working copy: its push URL (git remote get-url) beside its ahead and dirty counts, read before the mirror is trusted. Sibling of THE SUCCESS-ONLY WITNESS (a green that cannot fail) and of THE TAPE LIVES IN ONE PLACE (that one asks where the tape is; this one asks whether it is the tape of anything).
+~~~
+
- **The Tape Lives in One Place** -- (banked 2026-09-24, outage-convicted): the second brain's only remote was a bare repo on one disk on one circuit, and the magic cookie's only copy source is the mothership (install.sh fetches the ZIP from github.com and the key from pipulate.com; the transformation clones github.com again), so two systems that read as distributed had one address each and went dark, or would, together. A von Neumann constructor carries its own tape; the cookie's replication is mothership-to-child and never parent-to-child, true of the SHAPE (tape, constructor, copier: install.sh, nix develop, gitUpdateLogic) and false of the TOPOLOGY. The same reading from the other side is THE COMPOSITION IS NOT THE PARTS: the seed-germinates leg is witnessed only against a live mothership. STANDING CONSEQUENCE: any remote, bundle, standby or watchdog that matters exists on power the primary does not share, and the WORA claim is stated as write once, run on any host that can hold a POSIX shell and a Nix store, with every exception spelled in the recipe (the isLinux list in commonPackages names nine), because "anywhere" was the word doing the lying and the iPhone the operator reached for is the host the recipe does not reach. Sibling of THE DERIVED-PATH RULE (one authority for a write target) and of SINGLE-CANDIDATE BLINDNESS (one circuit cannot tell a distributed system from a co-located one, the way n=1 cannot tell an identity from a coincidence).
- **The Template That Forbids What It Demands** -- *two correct
instructions in one document that cancel.* Banked 2026-09-04,
@@ -2528,6 +3134,30 @@ Entries are alphabetical, numbers spelled as spoken.
or delivery receipts. Label pre-scrub counts; do not call a component sum
the final sealed size. Apply this style when touching a command, not by
mass restyling, a new renderer framework, or changes to unrelated runtimes.
+- **The Test-Rig Provenance Rule** -- *expanded rule; banked 2026-08-02.*
+
+~~~text
+# - EARMARK: THE TEST-RIG PROVENANCE RULE (banked 2026-08-02, cold-start ride six): a cold-start rig can be a PRISTINE PUBLISHED-ARTIFACT test or a CURRENT-CODE test, never both in one directory, and which one it is must be stated before any ruling is taken from it. Conviction: /home/coldstart/pipulate ran the published ZIP for three rides, so every repo patch was structurally invisible to it and a correct per-user-lock fix appeared to fail; the magic-cookie transformation then replaced it by `git clone --depth=1`, so the rig received code by CLONE, not by PULL, and is now frozen at clone-time HEAD with a dead update lane -- a THIRD thing that is neither property cleanly. Patches reach it only by hand-carry (sudo install), and the hand-carry is itself a receipt that the pull is broken. STANDING CONSEQUENCE: name the rig's provenance in every ruling taken from it, and prefer two rigs (one pristine, one current) over one ambiguous rig.
+~~~
+
+- **The Three-Region Art Edit** -- *expanded rule; banked 2026-08-03.*
+
+~~~text
+# - EARMARK: THE THREE-REGION ART EDIT (banked 2026-08-03, receipt-corrected):
+# registering one piece of figurate art is a THREE-region change with an
+# integrity coupling and NO airlock -- not two, as a prior turn asserted.
+# Receipt (rg over imports/ascii_displays.py): a `_figurate_<name>` render fn
+# above FIGURATE_RENDER_EXTRUDE_BOTTOM (:884), a CRC32 entry above
+# FIGURATE_LEDGER_EXTRUDE_BOTTOM (:71), and a dict entry above
+# FIGURATE_REGISTRY_EXTRUDE_BOTTOM (:927). apply.py has AST, Nix, JSON,
+# protocol-marker and autolink airlocks and NOTHING that checks whether an
+# art string still agrees with its seal, because that coupling is semantic,
+# not syntactic. ORDERING: the CRC cannot be known until the art exists, so
+# author first, print(binascii.crc32(art.encode('utf-8'))), then seal.
+# MANDATORY IGNITION for every art car: `figurate <name>`, read `Drift: 0`.
+# An art car may never declare "no ignition required".
+~~~
+
- **The Three-Tier Amendment** -- (banked 2026-08-06, paired-lane receipt): the
standing consequence above stops ONE TIER SHORT and is therefore a trap for
any word that must be reachable by a CHILD process. There are THREE tiers,
@@ -2579,6 +3209,56 @@ Entries are alphabetical, numbers spelled as spoken.
# an explicit or implicit "your turn" = the Tortoise is being summoned.
~~~
+- **The Unasked Second Window** -- *expanded rule; banked 2026-09-16.*
+
+~~~text
+# THE UNASKED SECOND WINDOW (banked 2026-09-16, operator-convicted three times in one minute). A newcomer's word opens what its name says and nothing more; a second file in a split, added to solve a problem the operator had not raised, is a second lesson at the exact moment the first was meant to be the whole lesson, and it lands in the same car as the ruling they did ask for. Conviction: epr opened the prompt router and prompt.md in one -o split for one turn, the operator hit the split three times on the way out the door, and the revert was one car. Same disease, smaller: the ignition spelling handed over was cpr "smoke", a probe's argument wearing the command's clothes. Name the ignition in the newcomer's own spelling, and answer the unraised question as a TODO, never as a feature riding the train. Sibling of THE COACHMAN'S VETO: a train is a proposal, and an unasked car costs exactly what a wrong one does.
+~~~
+
+- **The Verifier That Never Ran** -- *expanded rule; banked 2026-08-05.*
+
+~~~text
+# - EARMARK: THE VERIFIER THAT NEVER RAN (banked 2026-08-05, same conviction): a verification block placed AFTER the action it verifies is dead code if the action can kill the reporter, and its silence is indistinguishable from success. flake.nix's [4/4] block held `sleep 12`, a pgrep re-count, and three verdict branches -- none had EVER executed, while a green Atomic Deployment Complete printed underneath every time. THE DISCRIMINATION QUESTION applied to a MISSING line: what does this print in the world where the verifier died? The same checkmark. STANDING CONSEQUENCE: when a receipt block has an expected line that is ABSENT, treat the absence as the finding; do not read the surviving lines as the whole receipt. Third shape in the family -- REFUSAL-ONLY WITNESS is a branch never observed, THE SUCCESS-ONLY WITNESS is a failure never reportable, this is a witness never REACHED.
+~~~
+
+- **The Warning That Was The Hazard** -- *expanded rule; banked 2026-08-25.*
+
+~~~text
+# - EARMARK: THE WARNING THAT WAS THE HAZARD (banked 2026-08-25, airlock-
+# convicted): a comment explaining a delimiter hazard must never CONTAIN the
+# delimiter, because a comment DOES NOT EXIST at the outer parser's parse
+# time. CONVICTION: a flake.nix comment warning that a dollar immediately
+# followed by an open brace is eaten by Nix's interpolator was refused by
+# apply.py's Nix airlock at the exact column of its own warning -- the whole
+# indented string is ONE Nix value, and interpolation starts anywhere inside
+# it, comment or not. CURE: name the sequence in words ("dollar-brace") and
+# never type it. Third sibling of THE INSTRUMENT BECOMES BAIT -- the first is
+# a probe that attracts the transform it measures, the second is a label
+# eaten by the markup it rides in, this is a warning eaten by the grammar it
+# warns about. Cousin of THE LABEL IS NOT DATA, which is the same collision
+# with the compiler's own console as the victim.
+~~~
+
+- **The Wrapper Is Not The Measurement** -- *expanded rule; banked 2026-09-22.*
+
+~~~text
+# THE WRAPPER IS NOT THE MEASUREMENT (convicted 2026-09-22, by a receipt that
+# disagreed with itself and was right twice). `time` on a census run read
+# real 8m3.689s, while the program's OWN stopwatch, added the same turn, read
+# "export POST returned in 123.6s". Both numbers are true. The six minutes
+# between them were undetected-chromedriver launching a headful Chrome over
+# cafe wifi to harvest one session cookie. Reading the shell's `real` as the
+# cost of the export would have overstated it FOURFOLD and sent the next turn
+# optimizing the wrong half of the program.
+# THE RULE: `time <program>` measures the PROGRAM, never the step inside it
+# that the question is about. When a command has an expensive setup phase --
+# a browser launch, an auth handshake, an index build, a model load -- the
+# step under test carries its own stopwatch and prints it, and the wrapper's
+# number is read as the total rather than as the answer. Two clocks that
+# disagree are not a contradiction. The gap between them IS the setup cost,
+# and it is more often the larger one than anybody expects.
+~~~
+
- **The Write-Side / Read-Side Split** -- *one word, two questions, two
owners.* Banked 2026-09-04, found while un-hardwiring a blog's URL
folder. `permalink_prefix` in blogs.nix answers WHERE NEW POSTS ARE
diff --git a/foo_files.py b/foo_files.py
index 62a4243..5bc6b04 100644
--- a/foo_files.py
+++ b/foo_files.py
@@ -376,51 +376,14 @@ And then we demonstrate a level of competence like so:
# `Ignition: none.` Never imply ignition by describing expected output, and
# never make the human infer the command from prose.
#
-# THE ANSWER IS THE ARTIFACT (banked 2026-09-24, convicted the turn it was
-# named). The model offered to render a case card as a host-side "Artifact"
-# panel one breath before being told those are forbidden. An Artifact is
-# unsigned, unhashed, unversioned, and lives OUTSIDE the cartridge -- the exact
-# trusting-trust binary this system exists to abolish, in a convenience's
-# clothes. THE RULE: the only durable outputs are the sealed cartridge
-# (qamy.zip = prompt.md + payload.md + manifest.json) and the copyable text of
-# the response. Never emit, offer, or route work into an Artifact, canvas, or
-# side panel. A finding that cannot be pasted here and rebuilt from the manifest
-# is not a finding.
+# § THE ANSWER IS THE ARTIFACT (banked 2026-09-24) -- Deliver durable findings as copyable response text or the sealed cartridge reproducible from its manifest, and never offer or route them into an unsigned, unversioned host-side Artifact, canvas, or side panel.
#
# § NEXT CONTEXT IS PASTE-READY OR IT IS SABOTAGE (banked 2026-09-24; convicted again 2026-09-29) -- Emit NEXT CONTEXT as one fenced block of literal context.txt lines pasted at the bottom before the train runs: include the whole next-turn file list and every PROBES command verbatim with only the leading "! " added, and never put prose, vim keystrokes, or assumptions about a car's future output inside it.
#
# § A PROBE RUNS ON THE OPERATOR'S MACHINE OR IT IS NOT A PROBE (banked 2026-09-24) -- Make every probe target files on the operator's machine or carry its evidence inline or in the cartridge, use rg for repository searches, and invoke remote MCP tools through connectors/mcp.py rather than listing tool names as file includes.
#
-# SPELL OUT THE TOOL-CALL YOU ARE MAKING OF THE HUMAN (banked 2026-09-22, at
-# the operator's instruction, after a Context car that said "same as last
-# turn" and taught nothing). The model reading this file is tool-calling a
-# PERSON, and a person cannot ask a paragraph a clarifying question. Polite,
-# indirect, erudite or compressed wording is ambiguity, and ambiguity gets
-# resolved wrong.
-# THE RULE: short words, imperative, one action per line. Never point at
-# another turn instead of restating the step: no "same as before", no "as
-# above", no "the usual". Never make the human guess which file, which
-# command, or which of two readings you meant. Write for someone in a hurry
-# on a laptop in an internet cafe who will act on the first sentence that
-# looks like an instruction. Example: "Run this in a terminal on Pipulate
-# Prime when the power returns," never "carried in full so it is not a
-# bibliography."
-# NEXT CONTEXT IS THE WHOLE LIST (banked 2026-09-20, convicted the same day,
-# and banked HERE because this file rides the fixed tail of every ADHOC
-# compile while the constitution does not): the payload a model is reading is
-# the ONLY raw source it will ever be allowed to patch, and the operator
-# comments the 40K-foot block out on turn two. A file that "is already there"
-# this compile is gone next compile. Every file a next-turn car will patch is
-# named in full in NEXT CONTEXT -- one that rode this compile, one that rides
-# every compile, one the operator knows by heart -- because "already there"
-# is a claim about the past wearing the future's label. CONVICTION: a
-# three-car caboose said init.lua, flake.nix and index.html were already
-# there; the next payload carried mother_cat.py and none of them, and two
-# cars waited a turn for raw source the list had waved at. The cost is one
-# line per file. THE GROOVE THAT HOLDS: the checklist's own NEXT CONTEXT
-# clause in prompt_foo.py is the eventual home, read at the highest-attention
-# position of every full-frame compile; this comment is the second groove,
-# and a § key in foo_files.py the third.
+# § SPELL OUT THE TOOL-CALL YOU ARE MAKING OF THE HUMAN (banked 2026-09-22) -- Give the human short imperative steps with one action per line and explicit files, commands, and target terminals, restating each step in full instead of referring to an earlier turn or the usual procedure.
+# § NEXT CONTEXT IS THE WHOLE LIST (banked 2026-09-20) -- List every file the next turn may patch explicitly in NEXT CONTEXT, even when it appears in this compile or the default roster, so the next payload carries all required raw source.
# § THE SCREENSHOT IS NOT A LOCATOR (banked 2026-09-11) -- When documentation's evidence is an image, enumerate the target UI's actual field labels and rule out same-named decoys before directing the operator; prose that says only "go to the project page" is not a locator.
@@ -430,21 +393,7 @@ And then we demonstrate a level of competence like so:
# § THE HELP TEXT IS NOT A CENSUS (banked 2026-09-17; convictions 2026-09-17, 2026-09-27, 2026-09-28) -- Verify every switch against the exact tool's own semantics before trusting a probe's numbers, keep stderr and exit status visible, and treat usage text or rc=2 as a dead instrument rather than data.
# § A CENSUS CARRIES A KNOWN MEMBER (banked 2026-09-24) -- Name a known member in every census and forecast missing-member or empty output as instrument failure; derive exact counts from matching output lines rather than pattern occurrences, or state only known members and an at-least bound.
# § THE PIPELINE ATE THE FALLBACK (banked 2026-09-21) -- Make every fallback probe test the exit status of the command that owns the question and print a negative token no successful path can produce; a fallback hidden behind a pipeline or spelled as a legal success value is not a discriminator.
-# THE WRAPPER IS NOT THE MEASUREMENT (convicted 2026-09-22, by a receipt that
-# disagreed with itself and was right twice). `time` on a census run read
-# real 8m3.689s, while the program's OWN stopwatch, added the same turn, read
-# "export POST returned in 123.6s". Both numbers are true. The six minutes
-# between them were undetected-chromedriver launching a headful Chrome over
-# cafe wifi to harvest one session cookie. Reading the shell's `real` as the
-# cost of the export would have overstated it FOURFOLD and sent the next turn
-# optimizing the wrong half of the program.
-# THE RULE: `time <program>` measures the PROGRAM, never the step inside it
-# that the question is about. When a command has an expensive setup phase --
-# a browser launch, an auth handshake, an index build, a model load -- the
-# step under test carries its own stopwatch and prints it, and the wrapper's
-# number is read as the total rather than as the answer. Two clocks that
-# disagree are not a contradiction. The gap between them IS the setup cost,
-# and it is more often the larger one than anybody expects.
+# § THE WRAPPER IS NOT THE MEASUREMENT (banked 2026-09-22) -- Time the step under investigation with its own stopwatch when setup is expensive, and label the wrapper's time as the whole program rather than attributing browser launch, authentication, indexing, or model loading to the inner operation.
#
# § THE A11Y OUTLINE DESCRIBES THE HYDRATED DOM (banked 2026-09-21) -- Treat accessibility-tree roles as hydrated semantic claims, not HTML tags or form semantics: trace every DOM claim to its capture file, test a11y or screenshot claims against hydrated_dom.html rather than source.html, and read markup to learn the actual element and submitted name.
#
@@ -474,46 +423,10 @@ And then we demonstrate a level of competence like so:
# its quoted hash into an unterminated-quote EOF. Witness: the very next
# compile carried that same probe returning 4 -- and the parser-demo probe,
# itself quoted-hash-bearing, survived to print the old splitter's stub.
-# THE PENDING AMENDMENT RULE (banked 2026-07-19, witnessed same compile):
-# an amendment that describes MECHANISM BEHAVIOR enters the constitution
-# tagged PENDING and stays PENDING until a compiled receipt witnesses the
-# behavior it asserts; the flip to banked is its own chisel-strike.
-# Conviction: the STDERR MERGE AMENDMENT was committed one compile before
-# its mechanism existed -- the map outran the territory and only the
-# scheduled canary caught it. The constitution may PROPOSE one turn ahead
-# of the code; it may never ASSERT ahead of it. Rules of pure judgment
-# (30-and-3, Probe Economy) bank on articulation; rules claiming what the
-# machinery DOES require the machinery's receipt first. Never more than
-# one unwitnessed turn between an amendment and its evidence.
-# THE ACTUATION-BOUNDARY RULE (banked 2026-07-23, receipt-witnessed): a
-# probe that measures an ARTIFACT cannot witness a patch that changes
-# CODE unless the code RUNS between the two taps. The PROBE ECHO
-# INVARIANT's straddle must bracket the EXECUTION, not the commit.
-# Conviction: the fence-heal patch landed, committed and pushed, and the
-# echoed awk probe still read naked_openers=12 -- byte-identical to
-# BEFORE -- because `article`, the only command that feeds article.txt
-# through sanitizer.py, was never invoked between taps. A code-only patch
-# paired with an artifact-only probe is an OPEN FENCE dressed as a closed
-# one, and it reports green for a thing that was never tried.
-# COROLLARY -- WITNESS WITHOUT MUTATING: when the actuator is a mutating
-# lane (publish, writers), do NOT run the lane to collect the receipt --
-# it consumes the specimen. Import the patched function, run it on the
-# real input WITHOUT writing, and assert the input is byte-identical
-# afterward. Exercises the hard half; costs no publish.
+# § THE PENDING AMENDMENT RULE (banked 2026-07-19) -- Keep mechanism-behavior amendments PENDING until a compiled receipt witnesses them, bank the status change explicitly, distinguish articulation-only judgment rules, and allow no more than one unwitnessed turn before the mechanism's evidence.
+# § THE ACTUATION-BOUNDARY RULE (banked 2026-07-23) -- Bracket execution of changed code with the before and after probes rather than bracketing only its commit, and witness mutating lanes by calling the patched function on real input without writing and verifying that the specimen remains unchanged.
# § THE IGNITION RULE (banked 2026-07-23) -- between PATCHES and PROMPT sits IGNITION, making the patched code RUN so the AFTER tap measures something that happened; it completes the Patch beat and is never a fourth one. If the probe's own command loads the patched file at call time it self-ignites; if the patched thing was read once at entry (shellHook, daemon, cache) ignite it explicitly -- exit then nd, or <F2> -- and every turn NAMES its ignition or declares "no ignition required". Conviction: the vault probe read False inside a compile whose flake patch had landed, committed and pushed, because that shell predated the hook. The straddle brackets EXECUTION, not the commit; ahc is the experiment, not a probe, and it writes, so it fires once, bounded by a BLAST on either side. Grammar: PROBE singular, PATCHES plural, IGNITION singular or none, PROMPT singular.
-# THE SADDLE AMENDMENT (banked 2026-07-28): the mount saddle (init.lua
-# mount_sandworm) no longer numbers Ignition as its own slot. Ignition
-# RIDES INSIDE the Patches car -- exactly as this rule already requires
-# ("not a fourth beat; it completes PATCH") -- so the saddle's five
-# numbered slots now match the Actionable Response Contract one-for-one:
-# 1 Probe, 2 Context, 3 Patches (patch/app/d/m THEN ignite: exit+nd, <F2>,
-# or "no ignition required"), 4 Prompt, 5 Deliverables. The earlier "only
-# the saddle gains a slot" reading is SUPERSEDED, not retconned: the slot it
-# named was Ignition-as-beat-4, and folding it into Patches is precisely the
-# alignment. Ignition stays a real singular step ("one actuation, or none");
-# it simply stops printing its own number. Same-car label discipline: this
-# note ships in the same ride as the init.lua saddle edit it describes.
-# Ref: the MCK build ride (see THE MOTHER CAT KATA above).
+# § THE SADDLE AMENDMENT (banked 2026-07-28) -- Keep Ignition inside Patches as one actuation or an explicit no-ignition declaration, preserve the five slots Probe, Context, Patches, Prompt, and Deliverables, and ship any corresponding saddle labels with the change they describe.
# THE SELF-HEALING FENCE AMENDMENT (PENDING 2026-07-23): sanitizer.py's
# fence contract rule 2 no longer refuses a naked opening fence; it tags
# it `text` in place, writes the heal back to article.txt, and prints a
@@ -524,16 +437,7 @@ And then we demonstrate a level of competence like so:
# still fail CLOSED. WITNESS OWED: a compiled receipt showing a nonzero
# heal count against a file with known naked openers. The flip to banked
# is its own chisel-strike.
-# THE DISMOUNT (banked 2026-07-19, mechanism witnessed 2026-07-19): a ride
-# series ends with a fourth beat -- the hop-off. The dismount prompt makes
-# the model (1) VERIFY the article's opening goal against THIS compile's
-# receipts, never memory; (2) BANK graduations as SEARCH/REPLACE patch
-# cars, deletions included; (3) name the DANGLING carried forward
-# unbanked, one line each; (4) SEED the next ride's first compile with
-# context.txt lines. Mechanism: init.lua's <leader>k stages the canned block
-# above the current article's !!! floor. Witness: the \k-staged block rode
-# a Prompt section in the same compile whose receipt still showed PENDING --
-# flipped by patch, never by drift, one unwitnessed turn exactly as allowed.
+# § THE DISMOUNT (banked 2026-07-19) -- Dismount a completed ride by verifying its opening goal against this compile's receipts, banking rules and deletions through patches, naming each dangling item in one line, and seeding the next ride with explicit context.txt lines.
# § THE TEMPLATE THAT FORBIDS WHAT IT DEMANDS (banked 2026-09-04) -- a prompt template is one document with one reader, so a beat that demands an artifact and a clause that forbids the only lane it can ship through cancel into a hand edit the operator will not make; when a template's demand changes, grep that same template for every clause that gates it, and make the exemption name the beat by number. Conviction: \k's BANK asked for paste-ready lines while FINALITY said no patches, and two dismounts handed the operator addresses in prose. Sibling of THE SAME-CAR LABEL RULE and THE LABEL THAT PROMISES A SIBLING: this is the gate and the label in one file, contradicting each other.
# THE MOUNT (banked 2026-07-19, witnessed same compile): the zeroth beat.
# <leader>m runs mount_sandworm(): full saddle (Probe / Context / Patches /
@@ -544,16 +448,7 @@ And then we demonstrate a level of competence like so:
# 574 (once), clean headless load. \j cuts the slate, \m mounts, \k
# dismounts: three keys bracketing Probe, Patch, Prompt.
-# THE GENERATED-NOT-AUTHORED RULE (banked 2026-07-20, witnessed same day):
-# any payload section that DESCRIBES live capability (tool rosters,
-# registry counts, version stats) must be produced by the compile that
-# ships it -- computed from the live source in a bounded subprocess, with a
-# fail-LOUD placeholder on error -- never hand-authored prose. An authored
-# capability list is drift-by-construction: the sibling-.md failure mode
-# this repo exists to refuse. Witness: the Tool Roster's "21 tools"
-# matched the same compile's live_registry_count=21 receipt name-for-name
-# on its first flight; the only stale state it can ever exhibit is a loud
-# GENERATION FAILED banner, which is a wound, not a lie.
+# § THE GENERATED-NOT-AUTHORED RULE (banked 2026-07-20) -- Generate every live-capability payload section from current source during the compile that ships it, using a bounded subprocess and a loud failure placeholder rather than hand-authored tool lists, registry counts, or version statistics.
# § THE ATTRIBUTED-VOICE RULE (banked 2026-07-26) -- a synthesized voice is not evidence of a mind, and the rule covers every UTTERANCE, spoken OR on-screen: scripted narration discloses that it is scripted and never says "I am <persona>", model output NAMES its engine because a name is a receipt and not a costume, and deterministic automation demonstrates THE SYSTEM and never "my capabilities". THE MECHANICAL TEST, in place of judgment: if a string names an ACT -- confirmed, secured, verified, connected, validated, active -- then some code must have PERFORMED that act in the same turn, or the verb changes to what happened (recorded, saved, stored, set), because storing a credential is not testing it and the first real request is the earliest honest moment to claim a connection. Chip O'Theseus is EARNED, never asserted: speak the name only while a model is actually answering with keychain memory live.
@@ -564,103 +459,25 @@ And then we demonstrate a level of competence like so:
# an actuator. pipeline_state_inspector is a valid MCP/FastHTML drill-down,
# never the default first move inside a Prompt Fu ride.
-# THE REDUNDANT-GROOVE RULE (banked 2026-07-22, witnessed this compile):
-# on-topic-ness is not a personality you beg the model to wear; it is a
-# groove you carve so attention rolls into it wherever it drops. Encode the
-# frame TWICE: the canonical roster welded into foo_files.py travels as
-# visible text in every compile (the declared MAP), while the live overlay
-# splices those same files in as content (the realized TERRITORY) -- map and
-# territory in one window, cross-checking each other. Two grooves = the
-# marble rolls home no matter where it lands = forward error correction; the
-# West African talking drum repeats the tonal pattern for the identical
-# reason -- redundancy is how a signal survives a noisy channel. Corollary:
-# this IS the receipt's manifest+payload symmetry (what-bytes cross-checking
-# the-bytes) generalized to the router itself -- the book teaching its own
-# technique by using the technique on its table of contents. By the time the
-# model reaches the Prompt at the bottom it has read the frame twice and
-# answers primed, not cold. Furnish the room before the guest walks in.
-
-# THE HONEST-SEAM RULE (banked 2026-07-22, witnessed same compile -- the
-# 80-column tell): when the machine mimics the operator's surface (vim
-# textwidth=80 hard-wraps, his line-break cadence) it leaves a fingerprint,
-# and the fingerprint is LOAD-BEARING. The caboose prompt the AI hands back
-# for the next turn MUST stay UNWRAPPED -- no cosmetic 80-col fold -- so the
-# operator can always tell the mirror from the man standing in front of it.
-# Sanding the seam smooth is precisely how the drift-checker becomes the
-# drift. Source-file rules wrap (they are code); the returned prompt does
-# not (it is the receipt that says a machine wrote it). Conviction: Opus 4.8
-# hard-wrapped its own caboose to 80 and got caught red-handed, eighty
-# columns wide -- the dinosaur seam in the line-wraps. Leave the seams in.
-
-# THE NEW-B GRADIENT RULE (banked 2026-07-22, articulation-banked): the top
-# and bottom of the register stack execute the IDENTICAL move. Skippy
-# (godlike-AI condescension) and Barney (toddler-wholesome earnestness) both
-# say "let me break this down for the newcomer" -- one gesture, opposite
-# hats; the failure at the genius end is pretension, at the simpleton end is
-# dilution, and the target is the competent middle (Joe Bishop: plain-talk
-# that is not dumb). Choose the register on PURPOSE, and keep one plain true
-# thing dead-center so the sophistication has something real to rebut -- the
-# ex-cop's duct-taped recliner parked in the tasteful apartment is the whole
-# comedy of Frasier and the whole shape of a good New-B explanation.
-
-# THE EXAPTATION RULE (banked 2026-07-22, articulation-banked; forms molt,
-# they do not die): a form pronounced extinct is usually a form mid-molt --
-# recruited into a new substrate, same function in a new organ. Serial radio
-# drama did not die in the fifties; it molted into the fiction podcast and
-# the voice-acted audiobook (Expeditionary Force IS a serial radio program
-# with better headphones). The crystallin enzyme became a lens: same
-# protein, new job. Before accepting "X is impossible now," run two checks --
-# (1) manufactured forgetting: who profits from the corpse (the Phoebus
-# move)? (2) the live substrate the form already migrated to. Exaptation is
-# the DEFAULT hypothesis; extinction is the claim that needs the receipt.
-# Sibling to AXIS-FORCING: when stuck, ask what old organ this new pressure
-# can repurpose.
+# § THE REDUNDANT-GROOVE RULE (banked 2026-07-22) -- Carry both the canonical roster as visible text and its selected files as actual payload content in every compile so the declared map and realized evidence cross-check each other and reinforce the task frame.
+
+# § THE HONEST-SEAM RULE (banked 2026-07-22) -- Leave the model-authored caboose prompt unwrapped rather than cosmetically folding it to the operator's eighty-column cadence, preserving the visible authorship seam while allowing source-file rules to wrap normally.
+
+# § THE NEW-B GRADIENT RULE (banked 2026-07-22) -- Choose a competent, plainspoken register deliberately and keep one concrete true point at its center, avoiding both condescending sophistication and simplification that dilutes the explanation.
+
+# § THE EXAPTATION RULE (banked 2026-07-22) -- Before accepting that a form is extinct or impossible, check who profits from manufactured forgetting and which live substrate already carries its function, then seek an old organ the new pressure can repurpose.
# § THE RECEIPT LADDER RULE (banked 2026-07-22; amended 2026-09-26) -- Match each receipt to the question it can prove: CRC detects change, SHA-256 fixes exact bytes, signatures name a signer, mutable time stays outside hashed bodies, and no integrity rung may infer who caused a change.
-# THE CODEX-AS-DATASTRUCTURE RULE (banked 2026-07-22, articulation-banked): the
-# printed book's apparatus is a random-access + cross-reference + drift-detection
-# machine, every part a structure this repo already runs. Table of contents = the
-# manifest (authored, forward, hierarchical: declared shape). Index = an inverted
-# index (access by concept, not position), hand-built four centuries before a
-# machine could query one. Glossary = a controlled vocabulary -- a type system for
-# prose that pins terms so they do not drift between chapters. Concordance = the
-# maximal index (grep -n over the corpus), and the load-bearing lesson: a
-# concordance is POSSIBLE ONLY over an immutable text -- verse numbering, the whole
-# citation address space, requires freezing the corpus first. Immutability is not
-# the apparatus's enemy; it is its precondition. Footnote = an out-of-band,
-# non-destructive annotation channel (the OOB EDIT RULE in print). Margin = the
-# user-writable per-copy layer (context.txt is this book's margin). Errata/addenda =
-# append-only patches that preserve the original error ON PURPOSE, so the delta
-# stays visible.
-
-# THE TALMUD-PAGE RULE (banked 2026-07-22, articulation-banked): the tzurat
-# ha-daf is the master pattern for a signed discussion cartridge -- immutable core
-# text ringed by attributed, stratified commentary (Rashi inner, Tosafot outer,
-# later authorities beyond): a versioned, cross-referenced hypertext on one fixed
-# page, centuries before "hypertext." Its defining move is that it PRESERVES
-# DISAGREEMENT instead of resolving it. Elu v'elu -- the minority ruling stays on
-# the page so a later generation can re-derive and find the losing branch was
-# right. That is keeping the dead branches in the DAG. A Confluence discussion +
-# replay-cartridge per closed ticket IS a Talmud page per ticket: frozen core =
-# the cartridge, commentary = the discussion, Jira ID = the address in the ToC.
-# Do not resolve-and-delete; attribute-and-preserve.
+# § THE CODEX-AS-DATASTRUCTURE RULE (banked 2026-07-22) -- Build context as a book with a manifest, concept index, controlled glossary, immutable citation substrate, attributed non-destructive annotations, personal margin, and append-only errata that preserve the original error.
+
+# § THE TALMUD-PAGE RULE (banked 2026-07-22) -- Keep an immutable discussion core with attributed, stratified commentary and stable cross-references, preserving minority and losing rulings so later readers can re-derive the result instead of deleting disagreement when resolving it.
# § THE LEDGER-SEPARATION RULE (banked 2026-07-22) -- Keep mutable work separate from immutable history, bank capture bytes before ADVANCE, resolve a named router and verify selected evidence, decode before disclosure while preserving original and transformed digests and recording omissions, then check inner digests and human review rather than treating a checksum or zero detector hits as completeness.
# § THE STEWARDSHIP RULE (banked 2026-07-22) -- Practice SMALL-MARKET WORA and STRUCTURAL HUMILITY by using portable open standards, leaving the host unchanged with no mutable residue, and making each tool and artifact carry its full meaning and recoverable record without its maker present.
-# THE DOUBLE-TAP RULE (banked 2026-07-20, witnessed same day): a `!` probe
-# that reads an artifact WRITTEN LATER IN THE SAME COMPILE (foo.zip and its
-# rotated snapshots -- probes execute at step 2, the cartridge writes at
-# step 7, post-sanitize) photographs the N−1 compile. That stale-by-one
-# reading is a LAGGED receipt, not a failed one -- but the exemption must be
-# CLAIMED, never assumed: name the mechanism (which pipeline step writes
-# the artifact) and re-fire the identical probe next compile to collect the
-# AFTER. The second tap is mandatory; a lag excuse without a closing
-# receipt is an open fence. Conviction: the ContextCartridge topper read
-# `# KUNG FU` on its first zipfile probe and frontmatter on the second,
-# one compile later, exactly as the pipeline ordering predicts.
+# § THE DOUBLE-TAP RULE (banked 2026-07-20) -- Label probes of artifacts written later in the same compile as lagged receipts, name the pipeline ordering that causes the lag, and re-run the identical probe in the next compile to close the before/after comparison.
# THE RIDE CONTRACT (banked 2026-07-20): a discussion is a SERIES of worm
# rides, and the series' shape is declared at the mount: the opening
@@ -689,50 +506,15 @@ And then we demonstrate a level of competence like so:
# responding; a correction note is not a coupling pin.
# § THE HAND-REPAIR CLAUSE (amended 2026-08-03, missing-target class banked 2026-08-25, malformed-protocol class amended 2026-09-26) -- Repair a refused patch by hand only when apply.py demonstrably parsed and witnessed the body: search-block-not-found is diagnosable, missing-target may receive only its Target after the intact body is printed back, malformed-protocol means visible delimiters failed the grammar and the body was not parsed, and generic no-blocks-found now means no recognizable patch protocol was present; both parser-gate classes are deleted and re-emitted, never hand-repaired.
-# THE CARRIED-DELIVERABLE RULE (banked 2026-07-29, operator-convicted): a
-# Car-5 external deliverable is CARRIED, NOT CITED. Car 5's actuator is the
-# human pasting into a FOREIGN system (Confluence, a CMS, a dashboard) -- by
-# definition out-of-band of the terminal choreography driving Cars 1-4, and
-# that is not a leak in the train; it IS the fifth car's identity. The car
-# therefore either contains the deliverable's COMPLETE text in one fenced
-# block labeled manual-paste, or states "no deliverables this turn"; it
-# never references cargo living only in a prior chat turn ("use the earlier
-# artifact, with two edits"). A cited-not-carried deliverable hands the
-# operator a bibliography instead of cargo, so it silently never ships --
-# three consecutive turns of an owed Confluence page are the conviction,
-# surfaced when the operator asked "am I supposed to be pasting things
-# out-of-bounds of the train?" The answer is yes, and only from Car 5.
-# Sibling of NO-DEAD-CARS (every emitted block is an actuator) and of
-# Mother Cat's carry-don't-menu.
+# § THE CARRIED-DELIVERABLE RULE (banked 2026-07-29) -- Carry each external deliverable's complete current text in Car 5 as one manual-paste block, or explicitly state that there are no deliverables, instead of referring the operator to earlier chat cargo and edits.
# § THE OUT-OF-BAND (OOB) EDIT RULE (banked 2026-07-21) -- When target text contains patch-protocol markers or marker-shaped siblings, do not encode the edit as SEARCH/REPLACE; name the delimiter collision, give exact boundaries and surviving neighbors, and hand the cut to the human in vim.
# **THE DERIVED-PATH RULE:** an agent's write-target must be a pure function of an identity value it reads and cannot author. If the agent *chooses* where to write, every guard downstream is etiquette. If it *computes* where to write, collision is unrepresentable -- the property that makes `/opt/<vendor>`, npm scopes, and the Nix store safe without any of them trusting their writers.
-# THE 30-AND-3 RULE (banked 2026-07-19): the standing ideation kata. When a
-# problem space needs mapping, generate THIRTY brief text vignettes -- one or
-# two sentences each, breadth over depth, no self-censoring past the obvious
-# first octave -- then select THREE favorites and justify each selection
-# explicitly. The 30 is the fan-out (cheap divergence; quantity is the
-# forcing function); the 3 is the reduce (the human-taste bottleneck that
-# banks wins per the 80/20 rule). Pairs with the 2-axis grid: axes surface
-# black-swan outliers, 30-and-3 surfaces candidates. Selections should name
-# what makes each winner load-bearing, not merely appealing. Progressive
-# passes, never one heroic pass; write the reduction down (article, earmark,
-# or chop) so the traversal is memoized and never re-derived from scratch.
-
-# THE AXIS-FORCING RULE (banked 2026-07-19): when novelty, bias escape,
-# or rival-model comparison matters, a flat 30-and-3 list is not enough.
-# Convert candidates into BIPOLAR AXES with concrete, mutually incompatible
-# anchors drawn deliberately from remote disciplines, cultures, scales,
-# organisms, or eras. Reduce by:
-# orthogonality × prediction disagreement × observability ÷ probe cost.
-# An axis creates novelty by making the high-probability centroid illegal;
-# it becomes scientific only when its competing frames predict observably
-# different outcomes -- charge every metaphor rent. The model supplies
-# associative reach; the human supplies the want and selects the three.
-# Bank the winning axis, anchors, predictions, and cheapest discriminating
-# probe so the surprise becomes reusable rather than re-derived.
+# § THE 30-AND-3 RULE (banked 2026-07-19) -- Map a problem with thirty brief, diverse text vignettes, select three favorites with explicit reasons for their usefulness, and record the reduction so successive passes reuse the traversal instead of restarting it.
+
+# § THE AXIS-FORCING RULE (banked 2026-07-19) -- For novelty or rival-model comparison, build bipolar axes from concrete incompatible anchors in remote disciplines, rank them by orthogonality, prediction disagreement, observability, and probe cost, and bank the human-selected axes with their rival predictions and cheapest discriminating probes.
# § THE FORCING-PAIR RULE (articulation-banked 2026-07-27) -- 30-and-3 and AXIS-FORCING are ONE instrument with two grips: thirty candidates exhaust a frame's high-probability centroid so taste can pick three, which fights premature CONVERGENCE, and imported bipolar anchors make that centroid ILLEGAL, which fights premature COMMITMENT to the frame itself. Read an axis as a COORDINATE SYSTEM, never a filter: a filter needs the swan already in the sample, a coordinate system creates an ADDRESS for the empty region beside the clump, and the next thirty are ordered INTO that address, so the loop is a ratchet and neither grip comes first. Anchors are IMPORTED from a remote discipline, era, scale or organism, because a home-grown axis inherits the home blindspot, and an axis you cannot cheaply falsify is one you do not draw (orthogonality x disagreement x observability / probe cost). THE RENAME TEST sorts handle from mechanism: swap the label and the artifact stands, it was a handle; change the constraint and the output degrades to cliche, that was the mechanism; a handle earns rent only when it predicts something checkable.
#
@@ -779,21 +561,7 @@ And then we demonstrate a level of competence like so:
# § THE TORTOISE PROTOCOL (banked 2026-07-21) -- Infer a discursive meditation as an invitation to dialogue: complete its unfinished transitions, steelman its claim before challenging its weakest point with concrete evidence, require metaphors to predict something checkable, and still close with the Actionable Response Contract.
-# THE DISAPPEARING INSTRUMENT RULE (banked 2026-07-19; command-surface witness
-# 2026-09-24): The supreme design goal is invisible utility. The system must
-# fade into the background like a stick bug--inert and unnoticeable until called
-# upon as a guardian angel. The outward deployment mechanisms (curl | bash
-# bootstraps) are secondary to the portability of the state itself; if the
-# workspace only ever compiles context cartridges (foo.zip) to document and
-# deliver self-contained, perfect problem resolutions, it has fulfilled its
-# mission. The artifact travels as a legible, open-standard text ledger
-# (resembling AGENTS.md or SKILL.md structures), presenting zero friction to
-# the receiver while packing a complete, verifier-enforced cognitive
-# environment under the skin. Concrete command-surface witness: `compile`
-# (ahc) is the workbench compiler, the walk writes the same context.txt that
-# `compile` reads, and the reading frame is one flag on the same command,
-# compile --frame lean --chop WALK_CHOP (2026-09-25). The user names the
-# goal; the framework stays behind it.
+# § THE DISAPPEARING INSTRUMENT RULE (banked 2026-07-19) -- Keep the framework behind the user's goal by routing the walk through the same context.txt and compile command and delivering a portable, legible, verifier-enforced text cartridge whose receiver needs no knowledge of the machinery.
# THE MOTHER CAT KATA (MCK) (earmark-seeded 2026-07-28): the record-and-playback
# session that carries the human by the scruff -- bookmark to bookmark, a popped
@@ -833,32 +601,10 @@ And then we demonstrate a level of competence like so:
# § THE UNEXPORTED-SHIM RULE (banked 2026-08-01, second conviction 2026-09-14) -- a shell FUNCTION protects exactly one process, the interactive shell that defined it, because functions are not exported: every child inherits the ENVIRONMENT the shim neutralizes and none inherits the shim, so a script that invokes nix from inside the workshop shell dies at the loader on library skew while the same script passes on a stranger's clean shell, and the only person who can see it blames his own environment. Write the empty LD_LIBRARY_PATH assignment inline on EVERY branch of every script that reaches the nix binary (a no-op on a clean shell), and witness it from a compile, because prompt_foo's ! executor spawns children that inherit the pollution and never the function -- the failing lane in miniature. Sibling of LANE-DISAGREEMENT (a probe blind to a patch; this is an environment blind to a shim) and of THE THREE-TIER AMENDMENT (a name a child cannot resolve).
# § THE SINGLE-CANDIDATE BLINDNESS RULE (banked 2026-08-01) -- Before trusting any selector, disambiguator, router, or precedence rule, create a second distinguishable candidate and witness selection across both; N=1 can only test fallback because correct selection and fallback may print the same answer.
-# - EARMARK: THE SUCCESS-ONLY WITNESS (banked 2026-08-02, cold-start ride six): a claim observed ONLY succeeding is indistinguishable from a claim that CANNOT fail, exactly as a guard observed only refusing is indistinguishable from one broken shut. Conviction: synthesize_and_play called wait() and DISCARDED the exit code while stderr went to DEVNULL, so a player killed by SIGFPE printed its reason into the void and the function returned True anyway -- speak_text reported success, the rider printed nothing, and the human heard silence beside a green console. The instrument that was supposed to report the failure was the thing hiding it. DISCRIMINATING QUESTION for act-claims: what does this print in the world where the act did not happen? If the answer is "success," it is not a receipt. This is also the missing third suspect from the 2026-07-26 THE DEMO WENT SILENT todo, which named transport and engine and never once looked at the subprocess exit status. Sibling of REFUSAL-ONLY WITNESS (one branch of a state machine) and of the MECHANICAL TEST in ATTRIBUTED-VOICE (a verb naming an act that no code performed).
+# § THE SUCCESS-ONLY WITNESS (banked 2026-08-02) -- Make action receipts discriminate failure from success by checking subprocess exit status and preserving failure diagnostics, and witness the failure branch before trusting a green that could also print when the action never happened.
# § THE LANE-DISAGREEMENT WITNESS (banked 2026-08-01) -- When one lane is structurally blind to a patch, run the identical probe in both lanes and use the expected output disagreement as the witness; label every receipt with its lane.
-# CEREMONY IS SKIPPABLE; BARRIERS ARE NOT (banked 2026-08-01, the --yolo
-# ruling): a confirmation that authorizes a SEQUENCE may be skipped by flag; a
-# fence that authorizes each WRITE may not, ever, by any flag. THE TEST IS
-# WHETHER THE PROPERTY SURVIVES AS A SENTENCE: "nothing is written until the
-# human types the word" is provable in one clause only while the fence has
-# exactly one state. Add a bypass and it becomes "...unless the flag was set,"
-# which forces every reader to audit the call site -- and a property requiring
-# a call-site audit is a convention, not a property. COROLLARY -- THE BYPASS
-# USUALLY ALREADY EXISTS UNDER ANOTHER NAME: the unfenced guided-capture lane
-# is selenium_automation / !URL / ?URL. A flag duplicating a shipped capability
-# is the sibling-.md failure in flag form.
-# THE REFUSAL-ONLY WITNESS (banked 2026-08-01, ride-convicted): a guard
-# observed ONLY refusing is indistinguishable from a guard that is BROKEN SHUT,
-# and no read-only probe can tell them apart -- the open state is not
-# observable without an actuation. THE DISCRIMINATION QUESTION applied to
-# fences: "what does this print in the world where the fence is stuck?" The
-# same refusal, every time. Conviction: ~10 receipts across five compiles all
-# measured _capture_checkpoint saying NO (pipe, EOF, explicit stream, no
-# controlling terminal), and the first {"success": True} it ever returned was
-# 12:54:47.912 on the first real MCK ride. STANDING CONSEQUENCE: a fence is
-# UNWITNESSED until something has been observed passing through it; count a
-# guard's greens as evidence of the closed branch only, and say which branch
-# a receipt covers. Sibling of LANE-DISAGREEMENT (that one is a probe blind to
-# the patch; this one is a probe blind to half the state machine).
+# § CEREMONY IS SKIPPABLE; BARRIERS ARE NOT (banked 2026-08-01) -- Allow flags to skip sequence-opening ceremony only, never the per-write human fence, and use the existing unfenced capture lane rather than introducing a bypass that makes write authorization depend on auditing every call site.
+# § THE REFUSAL-ONLY WITNESS (banked 2026-08-01) -- Treat a fence as unwitnessed until an authorized passage through it has been observed, and label refusal receipts as evidence of the closed branch only rather than proof that the guard can open.
# THE FLIGHT-RECORDER POSITIONING (earmark-seeded 2026-07-28, MCK build ride):
# the product is NOT "compile a context payload" -- anyone concatenates files.
@@ -877,62 +623,17 @@ And then we demonstrate a level of competence like so:
# the day the receipt exists. Ref:
# /futureproof/dayton-wind-tunnel-auth-capture-mother-cat/.
-# THE ARTIFACT-OF-RECORD RULE (banked 2026-07-19): A discussion may produce
-# many complete cartridge snapshots. They are successive full editions, not
-# interdependent parts or deltas. The artifact of record is the single
-# hash-stamped snapshot (foo-<hash8>-NN.zip) produced by the final deliberate
-# compile after the flat narrative, router selection, actionable Prompt,
-# sanitization, and receipts have been reviewed. Attach that one file.
-# foo.zip is the mutable working alias; older numbered snapshots remain local
-# rollback history. The ticket or receiver owns the durable copy once attached.
-# No per-ticket directories, resettable counters, nested cartridges, or
-# correlation manifests are required until a real handoff demonstrates friction.
-# RENAMED 2026-09-29: the alias is qamy.ai.zip and the snapshot qamy.ai_<deed>-<hash8>.zip,
-# the deed number first so a plain sort reads in order and the door's name on the
-# file so a stranger who receives one knows where it is explained; snapshots minted
-# before that day keep their foo- names, because an archive is never renamed.
+# § THE ARTIFACT-OF-RECORD RULE (banked 2026-07-19) -- Attach only the final deliberately reviewed qamy.ai_<deed>-<hash8>.zip as the complete artifact of record, keep qamy.ai.zip as the mutable working alias and older snapshots as local history, and never rename historical archives or invent dependent per-ticket bundles without witnessed need.
# § THE MCP RECEIPT RULE (banked 2026-07-29, amended 2026-09-27) -- a model-mediated tool call enters this system as a receipt or not at all: the endpoint and the four-tuple (server, verb, tool, args) emitted verbatim, with the HTTP method, the encoding that carried the arguments and the order where the API is order-sensitive, every value known without its parameter name spelled "value known, parameter unknown", and one line for what the harness may have added and the model cannot see (timestamps, locale, headers), stated as unknowns rather than omitted; web searches for research are exempt, a reply that made no call says "Tool calls this turn: none", and one that cannot spell its calls out says so, its readings confabulation until reproduced; plus a determinism class -- D0 deterministic, D1 stable read, D2 time-varying and INADMISSIBLE as evidence -- and an OBSERVED or INFERRED label on every line; the envelope is INFERRED until the operator's own replay client witnesses it once, then PINNED. A remote server's upstream traffic is invisible to every client instrument, so the MCP call is the deepest reproducible layer, and the manifest is a MAP a model cannot see go stale.
# § THE TWO-RECORDER RULE (banked 2026-07-29) -- the FDR records machine-sampled parameters, the CVR records what the humans said; when they disagree the FDR wins on parameters and the CVR on intent. Three surfaces, authority only decreasing: a wire receipt persisted by our process, a tool transcript handed to the model, narrative prose -- and a sentence never carries more authority than the surface that fed it. Capable-of-FDR is not FDR until the response side is persisted; an FDR without its frame doc is no evidence. Hosted MCP flies on an experimental certificate: dispatch it when being wrong costs a rerun, the connector lane when output leaves with our name on it; report in NTSB shape, where UNKNOWN is a valid instrument reading.
# § THE CREDENTIAL-LIFE RULE (banked 2026-08-06, amended 2026-08-29) -- a limit belongs to the credential's LIFE, never to the lane: a credential shorter-lived than the human loop cannot be witnessed GREEN from a compile, a static one can be, and the credential kind is per-server, never per-vendor. Chain the perishable one in the operator's terminal (mcp_warm.py --refresh && mcp.py ...) so the order lives in the command, read the clock note's magnitude rather than its colour, and remember that a GREEN check which cannot be re-run in the compile lane can still be READ there: the recording outlives the flight.
-# THE SECOND INTERPRETER RULE (banked 2026-07-17): this file has two
-# interpreters. CPython reads the path strings; the summoned model reads
-# the prose. Comments here are therefore PROGRAM, not annotation -- but a
-# program running on an UNPINNED interpreter (no Nix for the genie), so
-# execution may vary across models, versions, and days. Trust boundary:
-# only 📌 PINBOARD pins and EARMARK lines carry standing-instruction
-# authority across compiles; all other prose is context. Prose PROPOSES;
-# only the airlocked lane (apply.py exact-match, AST/Nix checks, git,
-# human clipboard actuation) ever MUTATES. Divergent execution therefore
-# costs a rerun, never a regression -- the nondeterminism is typed and
-# quarantined at the proposal stage, and replay convergence is measured
-# by foo-cartridge-replay-v1 rather than trusted on manners.
-
-# THE EXIT-CODE PROTOCOL RULE (banked 2026-07-23, witnessed same day): a
-# program a shell hook invokes for a DECISION speaks through its exit code,
-# never stdout. Nothing parses it, so no forked grandchild can hold a capture
-# pipe open (the rgx/xclip deadlock is the conviction), and the renderer
-# becomes swappable without the caller learning anything. Witness: across four
-# compiles boot_menu.py's timeout policy flipped, its labels changed, and its
-# entire call site MOVED ~80 lines up runScript, while flake.nix's invocation
-# stayed byte-identical -- `python scripts/boot_menu.py`, then capture $?.
-# Corollary, THE FALL-THROUGH GUARANTEE: pair every such call with an
-# `if [ -f <script> ]` test and a pre-gate default, so the hook behaves
-# EXACTLY as it did before the gate existed when the file has not landed.
-
-# THE FAIL-OPEN THRESHOLD RULE (banked 2026-07-23, receipt-witnessed): an
-# interactive gate placed on a DEFAULT entry path must return the pre-gate
-# behavior on every path an automated caller can reach -- no tty, explicit env
-# opt-out, missing termios, unexpected exception -- because a gate that can
-# strand an unattended `nix develop` is strictly worse than no gate. Blocking
-# FOREVER is then safe, but ONLY strictly after the isatty gate: a human is
-# provably present before anything waits. Every unattended tty must DECLARE
-# intent (PIPULATE_BOOT_MENU=0) rather than race the gate -- autognome's
-# clean-entry protocol types synthetic keys into the same pty, and
-# "Environment" contains an `n`, which is a door. Witness: nontty_exit=0,
-# bypass_exit=0, and the quiet devShell (which never reaches the gate)
-# evaluating to an unchanged drv hash across the whole ride.
+# § THE SECOND INTERPRETER RULE (banked 2026-07-17) -- Treat router prose as a program for an unpinned model while keeping standing authority on the declared PINBOARD and EARMARK surfaces, quarantine its variable output as proposals, and mutate only through the exact-match and syntax-checked apply.py lane with git and human actuation.
+
+# § THE EXIT-CODE PROTOCOL RULE (banked 2026-07-23) -- Make shell-hook decision programs return their decision through exit status rather than captured stdout, and preserve THE FALL-THROUGH GUARANTEE with a file-existence guard and pre-gate default so an absent script leaves prior behavior intact.
+
+# § THE FAIL-OPEN THRESHOLD RULE (banked 2026-07-23) -- Make default-entry interactive menus return pre-gate behavior on non-TTY, explicit opt-out, missing-termios, and exception paths, wait only after isatty proves a human is present, and require unattended PTYs to declare PIPULATE_BOOT_MENU=0 rather than racing the menu with synthetic keys.
# THE SAME-CAR LABEL RULE (banked 2026-07-23, operator's ruling; sibling of
# GENERATED-NOT-AUTHORED): when a gate MOVES, every string describing what it
@@ -942,19 +643,7 @@ And then we demonstrate a level of competence like so:
# AT the decision point: labels, subtitles, confirmations, and any promise of
# a deadline that no longer exists.
-# THE ALIAS-DISPATCH RULE (banked 2026-07-23, RETRACTING the same day's DIGIT
-# NAMESPACE RULE -- the mechanism that rule assumed does not exist): a shell
-# alias is not a callable object. Bash expands an alias only when it is the
-# literal first word a parser reads; `cmd=warm; $cmd` searches functions,
-# builtins, and PATH, finds none, and reports command-not-found. NOTHING can
-# invoke an alias on a human's behalf -- no menu, no wrapper, no dispatcher.
-# Conviction: bare `1` resolved correctly to `warm` and died as
-# `warm: command not found`, while row 8 (`pu`, a FUNCTION) would have run --
-# half a menu working for a reason invisible from the menu, the worst failure
-# shape there is. STANDING CONSEQUENCE: if a word must be reachable by
-# anything other than a human typing it, define it as a FUNCTION. Otherwise
-# let the menu print words and let the human type them; a list the eye reads
-# and the hand retypes has no second ordering to drift.
+# § THE ALIAS-DISPATCH RULE (banked 2026-07-23) -- Define dynamically dispatched same-shell commands as functions rather than aliases, or have the menu print the alias for the human to type, because a command name stored in a variable does not undergo alias expansion.
#
# § THE THREE-TIER AMENDMENT (banked 2026-08-06) -- Classify shell command reach by caller: aliases are human-only, functions are same-shell only, and anything a child process must invoke belongs as a derivation on PATH; gate the claim by exercising the hardest reachability boundary, not merely naming or argument forwarding.
@@ -970,7 +659,7 @@ And then we demonstrate a level of competence like so:
# § THE CROSS-PLATFORM EVAL RULE (banked 2026-08-04) -- Before shipping a flake change to buildInputs or shellHook, evaluate both Linux and Darwin default devShells with nix eval --raw .#devShells.<system>.default.drvPath, because platform-restricted inputs fail before hooks run and quiet cannot witness default-only hook changes.
-# THE STAT-CACHE FALSE POSITIVE (banked 2026-08-04, receipt-witnessed both lanes): `git diff-index --quiet` decides from the index's CACHED STAT DATA -- dev, inode, mtime, size -- and short-circuits before comparing content. Any operation that rewrites files while carrying an index along (cp -r, rsync without -a, a restored backup, a container layer) makes a byte-identical tree report DIRTY. Receipt: clone -> `cp -r src/. dst/` -> after_cp=1, after_refresh=0, reproduced identically in the operator and compile lanes. WHY IT SURVIVES SO LONG: `git status` refreshes the index as a side effect, so the false positive has ALWAYS healed by the time a human types the diagnostic. The symptom is structurally unobservable by the only method anyone reaches for. STANDING CONSEQUENCE: any automated dirty-tree check runs `git update-index -q --refresh 2>/dev/null || true` first. It clears ONLY stale entries, so a genuinely modified file still reports dirty and a halt-don't-destroy gate keeps its teeth.
+# § THE STAT-CACHE FALSE POSITIVE (banked 2026-08-04) -- Run git update-index -q --refresh 2>/dev/null || true before every automated dirty-tree check so a copied index's stale stat cache cannot masquerade as changed content while genuine modifications still stop destructive actions.
# THE DUAL-LANE WALK SCHEMA (banked 2026-08-25, receipt-witnessed): a trail stop accepts exactly one of `url` (public, direct HTTP/HTTPS) or `url_env` (sensitive, client-isolated), validated via exact set difference. Direct URLs surface openly on consent cards; environment variables surface as requirements on the human. Connectors declare honest execution targets, and `walk-cartridge-integrity-v2` enforces ordered destination disclosure. Conviction: the schema required url_env on every stop, so public pages paid for an env var nothing collected; a required field is a BILL, and you charge it only when something collects.
# THE FIRST-CELL BLAST RADIUS RULE (banked 2026-09-01, two convictions in two consecutive rides). Anything the FIRST executable cell of Onboarding.ipynb touches -- including every module it imports at load time -- prints to a stranger at the one moment they cannot tell noise from failure. Both convictions were trivial in SUBSTANCE and severe in POSITION: a KeyError from a read-before-write, and a SyntaxWarning from an unraw ASCII-art literal. Judge a defect in that blast radius by WHERE it fires, never by how small it is, and hold first-cell code to the standard of a cold install rather than the standard of the maintainer's warm one.
# THE ACTUATOR'S OWN DIAGNOSTIC RULE (banked 2026-09-01). apply.py's AST airlock compiles candidate content before writing, so it printed `<unknown>:985: SyntaxWarning: invalid escape sequence` on THREE consecutive `app` runs -- correct message, correct line number -- and it read as noise FROM the tool rather than a finding ABOUT the file. The `<unknown>` filename is what disguised it: a diagnostic with no filename reads as the tool complaining about itself. A LINE NUMBER in an actuator's output is a finding about the FILE. Read it, or the instrument you built is reporting to nobody.
@@ -994,7 +683,7 @@ And then we demonstrate a level of competence like so:
# THE DIFFSTAT IS NOT THE BLOCK COUNT (banked 2026-09-15). git matches every line a SEARCH and its REPLACE share and reports them unchanged, so a diffstat's insertions and deletions read LOWER than the block lengths by the shared count: blocks of 120 and 151 read +110/-139, twelve bare # separators and carried-over lines matched. Only the net is invariant. Predict the net from the blocks; read insertions and deletions as floors. Sibling of COUNT THE REPLACE AFTER YOU WRITE IT.
# THE UNSORTED CAP (banked 2026-09-15). rg -l and a multi-file rg -n print files in the order their searches finish, so one census printed nine files in two orders across the hand-run and compile lanes, and a head -N on that output cuts a different subset each run. Sort before you cap, and compare unsorted listings as sets. Sibling of THE CAP THAT HID THE ANSWER.
# THE PAGE THAT HOLDS IN BOTH WORLDS (banked 2026-09-15, witnessed once). A public page that asks a stranger to test a machine is written before anyone knows what the machine's evidence will carry, so its instruction must stay true either way. Stop three said a good answer admits the preview lacks the server's sentence; the preview lacked it, ChatGPT 6 said so and pointed at source.html, and the page taught the lesson instead of promising a word the bundle never held. THE CABOOSE-VERDICT COROLLARY aimed at a reader who cannot ask a follow-up.
-# THE UNASKED SECOND WINDOW (banked 2026-09-16, operator-convicted three times in one minute). A newcomer's word opens what its name says and nothing more; a second file in a split, added to solve a problem the operator had not raised, is a second lesson at the exact moment the first was meant to be the whole lesson, and it lands in the same car as the ruling they did ask for. Conviction: epr opened the prompt router and prompt.md in one -o split for one turn, the operator hit the split three times on the way out the door, and the revert was one car. Same disease, smaller: the ignition spelling handed over was cpr "smoke", a probe's argument wearing the command's clothes. Name the ignition in the newcomer's own spelling, and answer the unraised question as a TODO, never as a feature riding the train. Sibling of THE COACHMAN'S VETO: a train is a proposal, and an unasked car costs exactly what a wrong one does.
+# § THE UNASKED SECOND WINDOW (banked 2026-09-16) -- Make a newcomer's command open only what its name promises, give ignition in that command's own spelling, and record unasked enhancements as TODOs instead of adding extra windows or features to the requested change.
# § THE FLAG WENT COLD (banked 2026-09-17) -- Before deferring the operation that sets a readiness flag, find every reader and update all callers in the same change to ask the capability question they actually mean, so a fresh process cannot mistake not-yet-used for unavailable.
# § THE DOOR NAMES THE FOLDER (banked 2026-09-14) -- a script arriving through a pipe cannot learn which address served it ($0 is the word bash and the pipe carries no address), and two copies of one file drift, so the DOOR names the default: the body carries one contiguous placeholder, the door that wants a different default stamps it with nginx sub_filter (sub_filter_types for the served MIME type, sub_filter_once off), and the script tells stamped from unstamped by comparing against the same word spelled in two halves, which no substitution can reach. Gate every door with the round trip: reverse the one token in the served body and the hash must equal the repo file. A URL stamp needs its own placeholder, never a hostname rewrite, because KEY_URL stays at the old door on purpose. Witnessed 2026-09-14: npvg_door=npvg, pipulate_door=pipulate, 064cad99 on both sides. Sibling of THE WRITE-SIDE / READ-SIDE SPLIT: the folder and the app label were one string answering two questions.
@@ -2255,7 +1944,7 @@ MATCHBOOK_CHOP = r"""
# § THE PLACEHOLDER IS A DECODER RING (banked 2026-10-05, convicted at deeds 61 and 62: a bare-word table run over the whole book replaced eleven public senses of client words, each placeholder beside the public sense that names it, and the receipt that banked the restore then described those senses in this public file) -- read a scrub table's word diff before its commit, restore every replacement whose word meant something public there, and describe a restored sense in no tracked file, because a placeholder decoded once is decoded wherever it appears. Value: GLOSSARY.md entry owed.
# - TODO (2026-10-04, THE SCRUB'S REMAINDER): (1) the history: git filter-repo over the public repo, ruled once the -G census names the oldest commit carrying a name; the tax is every --ff-only checkout reset by hand, commit hashes cited after that date broken, old SHAs still served by GitHub until a support purge, forks and clones keeping everything, and until then the scrub commit's own diff indexing every name; (2) PyPI sdists already published, if the local sdist carries foo_files.py; (3) the anyone-with-link Google Doc copies googledocizer made of affected posts; (4) the same names into ~/.config/pipulate/pii_substitutions.txt so the publish lane catches them, its format unread here; (5) employer-internal prose (chapter XVIII's BOTIFY CORPUS block, admin endpoints, project counts, Jira field and filter ids) moved behind a one-line pointer into Workshop/corporate, operator's ruling; (6) a post slug that carries a name is a URL decision (redirect or keep), never a sed. Gate: the tree census reads 0 files, and the -G census reads 0 commits after any rewrite. READ 2026-10-04 (deed 60): the tree census 0 files with SCRUB_GO; the book 20 -> 1, the one the census's own false positive; no post filename carries a name, so (6) has nothing to rule; (2) the 2.77 sdist carries no foo_files.py, and whether it carries the old connector comment is deed 61's scan; (1) RULED (broken hashes accepted, PyPI and forks deferred) and run from a fresh bare clone, because ~/qamyai's census reads only back to its install (THE SHALLOW CENSUS). READ 2026-10-05 (deed 61): (1) done, ed99b358 on GitHub, the oldest name-bearing commit 2025-10-28; (2) the 2.77 sdist reads names=0 in the compile lane (the hand lane's line carried no file name, typed in a folder with no dist/, the null world); (3) the Doc copies still hold the original text (INFERRED, no publish ran), which for the eleven over-scrubbed posts is the right text; (4) and (5) stand; (6) nothing to rule. (7), new: the table's bare brand words catch public-company prose as readily as client work, so the table runs on a new article with its word diff read before publish and never blind over the archive; narrowing those rules to client-shaped spellings (org slugs, client hosts) is the operator's ruling. (8), new at deed 62: trimnoir tracked a file named patch and the blog served it (mikelev.in/patch 200 -> 404 once untracked), so each patch written in that folder was public until the next replaced it; which versions deployed and whether any named a client is unread (git log -- patch in trimnoir; Honeybot's access log for /patch), and the table's own version rode only the intermediate commit 999e0dfd8, INFERRED never deployed, since one push carried it and its successor. Gate for (8): every deployed version of patch read once and its names counted.
# - TODO (2026-10-05, THE STALE SHALLOW FILE): ~/qamyai's .git/shallow outlived the reset and names a commit the rewrite orphaned, so git rev-parse --is-shallow-repository reads true over a history rev-list counts whole (9853 on main); move it aside with mv -v once every line it lists fails git merge-base --is-ancestor against HEAD, so a history census there stops lying. Gate: is-shallow reads false and rev-list --count HEAD is unchanged.
-# - EARMARK: THE SHALLOW CENSUS (banked 2026-10-04, witnessed at deed 61: in the compile lane ~/qamyai read true with 9853 commits after the reset, the shallow file outliving it as forecast and naming a commit the rewrite orphaned, while the fresh bare clone saw the oldest name-bearing commit a year back): a git log census in a shallow clone reads the clone's boundary as the oldest commit, because git treats the boundary as a root whose diff adds every file; ~/qamyai came from the installer's clone (INFERRED depth=1, THE TEST-RIG PROVENANCE RULE), so its -G census named the install day as the first commit carrying a client name, a week late, and a rewrite from that clone could push a history that starts there (INFERRED). Read git rev-parse --is-shallow-repository beside any history census, and rewrite history only in a fresh full clone whose census sees a known member before it may read zero. Sibling of A CENSUS CARRIES A KNOWN MEMBER and THE TAPE IS NOT THE WORK.
+# § THE SHALLOW CENSUS (banked 2026-10-04) -- Read git rev-parse --is-shallow-repository alongside every history census, and perform history rewrites only in a fresh full clone whose census finds a known member before accepting zero matches.
# § ONE INSTALL, ONE PIPE (banked 2026-10-04, the operator's ruling) -- curl | bash runs once, at install; everything after runs in the pinned workshop, so a walk is YAML read by the workshop's PyYAML, and only the installer and the launcher's bash above its workshop check stay stdlib-only.
# § THE INTRODUCTION IS SKIPPED BY DEFAULT (banked 2026-10-04, the operator's ruling) -- a trail may carry an introduction, stops for someone who has never been there, played only by walk NAME intro (mother_cat.py --with-intro) and announced by one printed line that is never spoken; an expert reads past the line and a newcomer follows it.
# § NARRATION NAMES WHAT A READING SHOWED (banked 2026-10-04) -- guidance names no link, tab or location that no capture has shown; where it cannot know, it asks the person to look and lets the capture answer.
@@ -2280,7 +1969,7 @@ MATCHBOOK_CHOP = r"""
# - TODO (2026-09-29, THE UNUSUAL LINE; the operator's ask at deed 1692: "what the weird exception, attribute or detail makes this case different or unusual"): the SVB board is the exceptions desk and In Review its strangest column, so the post and the deliverable each carry one line, before the finding, naming what is unusual about the ticket. The deliverable's section landed at deed 1692 (What makes this one unusual: a US-only site, a client-side exception in the vendor's render that a real Chrome does not throw, access blocked after a few renders, three PocketRender confs on one ticket, a field reading Rules update not needed beside a comment reading JS update needed: yes, an origin that varies its HTML on Sec-CH-Viewport-Width); the post's line (*Unusual:*, one line, the cap 13 to 14) waits on the operator's ruling in SVB_PROMPT.md. In the same car: the template's fixed italic line says the live rules were read, and at deed 1692 they were not (no local pull; ATTRIBUTED-VOICE), so svb fills a {LIVE_RULES} clause from the first line botify --rules prints; the post at deed 1692 departed from the fixed shape by that clause. Gate: the post on the second ticket carries both, filled by svb. READ 2026-09-29 (deed 1696): the Unusual line LANDED in the operator's own shape at cfd2f69 (no line cap now: one line per field and per rule, the Difference lines in words); the live-rules line is a field the model fills from the botify --rules receipt (Live rules today: not pulled at 1693), not yet filled by svb; the deliverable half is moot (THE POST IS THE DELIVERABLE).
# - TODO (2026-09-29, THE CORPUS CENSUS; the operator's ask at deed 1692: "5 to 10 interesting things that might not be noticed at first glance", read as a newcomer with Dory syndrome needs them): the local corpus (Prime, 2026-09-27: 229 sitecrawler files with 1,958 mini entries; 224 speedworkers files, 1,821 section lines and 4,830 config lines) read for its shape, each finding one ! line: the hosts blocked most (every - line, by host, uniq -c) and the hosts forced past robots.txt (every ++, by host; the SVB-115 shape, a ++ on the site's own host, counted); what a rule text opens with and what it closes with (the leading token of line 1 and of the last line, uniq -c: deny-all-then-allow or allow-all-then-deny, and how many sets close on -*; the two SVB specimens both close on -* after their allows and flags, deny by default with !dom and !2tld the implicit allowlist); the flags by count and by first appearance (!nojs-on 4xx 5xx from 2026-06-04, !custom-dom-header and !no-header from 2026-07-29, !follow, !fake-preflight: how many sets carry each, so a new default's rollout is a number and not a Slack thread); what no rule does (the flags never used, the hosts no set blocks); the house template's fingerprint (its comment lines verbatim, how many sets still carry them); the sections whose desktop and mobile texts differ (155 of 577 at deed 1628); and one site's mini and SpeedWorkers texts side by side, to read what the crawl allows that delivery cuts. One compile of its own with the awk censuses in place of the body (THE TASTE; botify --rules whole is a quarter of a million tokens), the findings landing in Workshop/corporate/botify/ beside the reference, each with the command that produced it. Gate: a page of ten findings, every number reproducible by one ! line.
# - TODO (2026-09-29, nixops takes an argument): flake.nix's nixops is an alias whose body is a subshell, so nixops --installer expands to a subshell followed by a word and dies at the parser, the 2026-08-01 release() shape; the cure is a function, nixops() { (cd "$PIPULATE_ROOT" && ./nixops.sh "$@"); }, one line when flake.nix next rides, ignition exit then nix develop. Until then the spelling is ./nixops.sh --installer from the repo root. Gate: type nixops at a (nix) prompt reads "nixops is a function".
-# - EARMARK: THE FORECAST NAMED THE PROSE (banked 2026-09-29, convicted at deed 1671): a prediction about an instrument's WORDING is a prediction about the instrument's version, never about the world. curl -v's "SSL certificate verify ok." never printed on Honeybot's build, the grep read the content-type where the sentence was forecast, and the miss was the forecaster's while the certificate verified. Forecast the value an instrument exposes on purpose (%{ssl_verify_result}, an exit code, a count, a verdict token) and read its prose as decoration; when only prose is available, name its ABSENCE as one of the worlds. Sibling of THE GATE SPEAKS A VERDICT and THE SILENCED CHANNEL; cousin of INCOMMENSURABLE MEASUREMENTS.
+# § THE FORECAST NAMED THE PROSE (banked 2026-09-29) -- Forecast an instrument's deliberate values, exit codes, counts, or verdict tokens rather than incidental prose, and include missing wording as a possible outcome whenever prose is the only available signal.
# § THE FOLDER IS A VARIABLE (banked 2026-09-29, convicted twice at deed 1677, graduated at deed 1679) -- app resolves Targets from PIPULATE_ROOT and nothing else in a hand fence does, so every hand fence opens with cd "$PIPULATE_ROOT" && pwd and its first receipt names the folder every later line ran in; and a hand step prints a different thing in the world where it did nothing (rm -v and never rm -f, mv -v, a verdict token), so no "You will see" is true in both worlds. Value: GLOSSARY.md.
# § A SED RANGE WITH NO END RUNS TO EOF (banked 2026-09-29, convicted at deed 1693's Car 3, read at 1695 and 1696) -- a sed address range whose end pattern never matches deletes from its start to the end of the file, and sed -i has already written when a guard after it prints; so a range delete counts its END anchor as exactly one BEFORE the sed runs (test, then sed, never sed then test), the guard names the zero-blocks world beside the two-blocks world, and the STOP line prints what the sed did rather than "nothing was cut". Conviction: the operator had commented the live board out before the train (THE OPERATOR IS A VARIABLE), the end anchor matched nothing, the range ate Contexts 1 through 4 and both commented boards, the guard said STOP_blocks=0 with "nothing was cut", Car 4 appended a fresh board, and the 1695 compile read no Context 4. Value: GLOSSARY.md.
# § THE TAPE (banked 2026-09-29) -- Put durable work on the next compile's tape: refuse any repo-output car whose result the next compile will not read back, use the reply itself as the deliverable, and reserve declared off-tape paths for configuration and state; keep the full value in GLOSSARY.md.
@@ -2299,7 +1988,7 @@ MATCHBOOK_CHOP = r"""
# - TODO (2026-09-28, THE ARTICLE LARGER THAN A MINUTE; read at deed 1647 off the grim run): a 915,721-char article estimated 228,930 tokens at chars/4 and the API refused both models at generate_content_free_tier_input_token_count, limit 250000, then the loop waited 57 s for a minute the request could never fit in; the estimate now divides by 3.5, a quota on the input-token metric whose limit is below the estimate stops the run with a SIZE verdict, and the publish words forward their arguments to the editing script alone. The escape today is a key named by hand: a paid Gemini key (billing on one project lifts the minute into the millions on the same tokenizer and a million-token window; a Flash-class price makes such an article cents), or another provider through --model with -k, the wallet's flat alias-to-secret shape unchanged; the window of any other provider is checked against the size line before trusting it. The creative solution for a free key, unbuilt: a map-reduce lane for the editing pass, the article cut at paragraph seams into pieces under the minute, each piece asked for one or two subheadings with a verbatim after_text_snippet and a three-sentence summary, then the template run once on the head plus the summaries for the frontmatter and the analysis, the subheadings merged in article order; N+1 requests against a day of twenty, so a 900K article costs eight; or the cheaper lossy twin, --trim with the middle elided and subheadings for the ends only. Needs editing_prompt.txt and contextualizer.py (the sibling ring) in the payload. Gate for either: one oversized article published on a free key with the spine, the subheadings and the collision guard intact. RULED 2026-09-28 (deed 1648; the Workspace key read free_tier too, and the operator: "not gonna pay", "I don't think chunking is good"): the fences leave first. Past the free minute, or on --lean, every fenced block leaves the editor's copy for a one-line bracketed stand-in naming its language and line count, an editor's note closes the copy, and the prompt is rebuilt and re-read; the post is built from the original article_text, so every snippet the model quotes from prose still matches, and the note forbids quoting a stand-in. The spine lands in the template before the article, so an article quoting the placeholder is left alone. Map-reduce and --trim are dropped. b2 sweeps the wallet through backup-home.py's Key Configs include (pipulate at line 63; the stale articleizer entry beside it is harmless). Gate: the fence probe reads the lean copy under 250,000 on the specimen, and one oversized article publishes on a free key with its subheadings placed. READ 2026-09-28 (deed 1650): the lean copy read 87 fences, 894,222 chars to 106,111, about 30,317 tokens, and grim's scissors line 261,634 tokens to 36,527 on a 127,846-char prompt; then the API failed three more ways: "high demand" on Lite every time at any size, so it was never the size; "The service is currently unavailable" with no status code, read as unrecoverable; and a ring of 26 that never turned, its rule wanting quota from every model while Lite only ever said high demand, the operator cutting it at the fourth wait. The same metric, free_tier_requests, carried limit 5 (the minute) and limit 20 (the day). RULED (the operator: "make it give really good instructions on how to do this in the Web UI, can we make it super simple?", "anti-fragility, always another way?"): THE WEB LANE. Every exit that leaves no instructions (unrecoverable, exhausted, SIZE, a wait cut by hand, or --web on purpose) puts the prompt on the clipboard and prints four steps: paste into any AI chat in a browser, copy the whole reply, press Enter; the JSON is read off the clipboard, refused if it is the prompt's own schema pasted back, cached, and the post built by the same code as after an API answer, article.txt untouched, which the old --copy then --local lane could not promise because the publish word rewrites article.txt from the clipboard first. The ring turns once a quota is reported on a key and every model on it has failed, or once its ten attempts are spent, and leaves the last key the same way; unavailable and overloaded are transient; one parser serves both lanes. Gate: one publish end to end through the web lane, and one ring turn witnessed on -m all.
# - EARMARK: THE TWIN IN THE WEB UI (banked 2026-09-28, the operator's words at the dismount, "so the human can quality assure the LLM quality assuring"): every back-end receipt on a board names its equivalent in the Web UI beside it, a link or a place a skeptic can open and read the same numbers by hand, because the demo that builds confidence is two columns, what the command line did and what the same thing looks like in the app. The twins on the SVB board, banked into CONTEXT_TEMPLATE.txt at deed 1644: jira KEY has https://botify.atlassian.net/browse/KEY (the post's second line since 1644); render diff has the ticket's two PocketRender links, which open with their rules shown; the optics have the page in a Chrome tab (view-source: for panel 1, DevTools' Network for the wire truth, Elements for the hydrated DOM); robots.txt has the URL itself; botify --rules has the crawl config in the Botify admin (projectsettings, an id not on the ticket, THE SCREENSHOT IS NOT A LOCATOR's page), owed as a derived link. Rule: a receipt with no twin named is a receipt the skeptic cannot check, and a board line without one is not finished. Sibling of THE MCP RECEIPT RULE (the call spelled out) and THE FLIGHT-RECORDER POSITIONING (the wire the model cannot fake): the twin is the human's replay.
# - TODO (2026-09-28, THE KATA'S PROMPT; the operator's four points at deed 1643: the next game is easy to play, the archive feeds any capable model, every model answers in one shape, a slice of the answer pastes into Slack where the tickets are speed-dated): the shape is fixed by the prompt and not by the model, so Workshop/corporate/tickets/SVB_PROMPT.md is the kata's prompt (the board's receipts named, the crawler rubric, the rules of the answer, the post's six-line Slack shape with a Drive-link slot and the deed off the seal footer, the receipts as claim-dash-lens lines, the deliverable corrected or created, then the house train), and svb.py --prompt writes it filled to PIPULATE_ROOT/prompt.md (INFERRED the file compile reads: bjj cd's to the root, .gitignore lists prompt.md there, and the Summary's Command line names no prompt file; deed 1644's prompt_foo.py --help names the positional), refusing a prompt.md whose first line is not the svb marker so an article in progress is never overwritten (the refusal by hand at 1643 is the witnessed branch; the pass branch to /tmp the same hand step, and to prompt.md itself on the next article's first demo). The demo: svb KEY --write --prompt, then compile; the clipboard holds the payload, the newest zip holds prompt.md (the kata's 40 lines) and payload.md (the board). SIZE, the reading that rules the next article: this payload verified 430,766 tokens, the article's prompt 180,113 of them, the router 134,633, the PDP's six lenses about 66,000 (outline 22,906, SEO 21,277, links 16,924, wire 4,642), the fixed tail about 10,000; the kata's archive is therefore about 240,000 tokens with the router and about 106,000 without, and "drop it into Haiku" needs the second number: the router line leaves the board, or the board compiles --frame lean, the operator's ruling. Gate: one archive from svb KEY --write --prompt then compile, dropped into two models, both answering with the post first in the fixed shape. READ 2026-09-28 (deed 1644, the dismount): the kata's first end to end by hand at 1643's Car 6: --write appended (the operator had commented the block out with Context 5, so no START line stood; THE OPERATOR IS A VARIABLE) then replaced, 68 lines each; --prompt refused prompt.md holding this article (the refusal's own path names the file compile reads, so PIPULATE_ROOT/prompt.md is OBSERVED as the default by the payload's own Prompt section) and wrote /tmp/svb115_prompt.md, its first line the marker; at 1644 the board read back from disk (^@https 2, ^!https 0, the PDP's headers stamped 09:22:43 and robots.txt's 09:23:12, deed 1643's flights, no CAPTURE FAULT), so the second compile cost no flight; --prompt 9, sigil 8, the post 1. The size held: 503,750 verified with the article at 229,427 and the router at 136,202. prompt_foo.py's positional stayed unread (the compile lane's OUROBOROS LOCK refuses the compiler inside its own executor; by hand the 14-line cap cut the usage before it, THE CAP THAT HID THE ANSWER); the router's own COMMAND lines spell a prompt file or an @VARIABLE as the positional, INFERRED bjj PATH works, a hand reading of --help past line 14 owed. The ticket's URL joined the post's second line at the operator's ask (https://botify.atlassian.net/browse/KEY, filled from {TICKET}), and the board's captions name each receipt's twin in the Web UI (THE TWIN IN THE WEB UI).
-# - EARMARK: THE BROWSER IS NOT A CONFIG FILE (banked 2026-09-28, the operator's ruling at deed 1642): a per-profile browser mutation, a chrome://flags toggle or a setting, that no flake or equivalent manages is a "works on my machine" mutation and is refused, even when it is the vendor's documented prerequisite; a browser feature reaches this system as a switch on the flake's pinned Chromium, a line in code the same on every machine, or it does not reach it. Conviction: the WebMCP relay's prerequisite, chrome://flags/#enable-webmcp-testing, was absent from Prime's everyday Chrome 150 and would not have been toggled had it been present; the PocketRender render farm is driven from the command line or not at all, and its details land in payload.md or it did not happen (the operator's words). Corollary: a vendor note that says "set these flags" names a per-machine state, and the WORA lanes are the switch, the wire-truth reading of the vendor's own backend calls, or waiting. Sibling of THE STEWARDSHIP RULE (leave the machine unchanged) and of THE MAINTAINER-INVISIBLE LANE (a state one machine holds and no stranger's does).
+# § THE BROWSER IS NOT A CONFIG FILE (banked 2026-09-28) -- Express browser prerequisites as reproducible switches on the pinned Chromium or equivalent code, use the vendor's backend wire interface, or wait; never require an unmanaged per-profile setting or chrome://flags mutation.
# - TODO (2026-09-28, THE DING BEFORE THE BROWSER LEAVES; the operator's ear at deed 1640): on a guided capture the tick stops and the ding fires when driver.get returns, which is before the lenses are harvested and the window closes, so the human hears "done" while a window still stands and reads it as leave to close it by hand; the tick should run until the browser is gone (driver.quit returned, or the process no longer alive) and the ding fire then, so the window vanishing and the ding land together to the senses. tools/scraper_tools.py (the setsid loop at :97, the SIGKILL and ding at :115, ding=True at :659 as of 2026-09-19); the ordering is the whole change, one car when it rides.
# - TODO (2026-09-28, THE RELAY PIN; the operator's word at deed 1640, "there's always a Nix way"): npx -y @mcp-b/webmcp-local-relay@latest re-resolves the package on every run (a pip, GRAFT NOT SEED) and needs node and npx on PATH, which Prime has from packages.nix (npm 10.9.3 by its own notice) and the Mac and a stranger's install do not; the pin is a version in RELAY_CMD first (npm view @mcp-b/webmcp-local-relay version by hand names it), nodejs in flake.nix's commonPackages next, then a buildNpmPackage derivation with a lockfile hash so the word render carries its relay the way the connector words carry their python; --relay names a Nix-built binary the day it exists. Gate: render tools runs on a fresh Mac install with no npx on PATH.
# - TODO (2026-09-28, THE FENCE INSIDE THE FENCE; ruled writing deliverable.md at deed 1640): a WRITE_FILE body that itself carries a code fence rides inside the car's own three-backtick fence, and the copy button reaches only the fence body, so a backtick fence in the body ends the car early in the chat window; the body spells its fences with tildes (~~~diff), which CommonMark and any renderer accept and which no backtick fence closes, and the house-subset renderer accepts both spellings. Home: checklist item 10 in prompt_foo.py, one sentence, when prompt_foo.py rides.
@@ -2525,7 +2214,7 @@ MATCHBOOK_CHOP = r"""
# - TODO (2026-09-30, THE TAPE LEAVES THE HOUSE): flake.nix grew mirror, a packaged word that lists every *.git under another machine's ~/git-repos over SSH and keeps a bare mirror of each at the same path here (clone if new, fetch --prune if not, the newest commit per repo printed, DONE or INCOMPLETE or STOP on the last line), refusing on the source machine itself; the Mac pulls, so it needs no sshd, and every ssh shares one ControlMaster socket. It is the Mac half of THE TAPE LIVES IN ONE PLACE and of the line above; the SSD bundle half stands. OPEN: whether trimnoir's history sits under ~/git-repos at all (its push is the Honeybot deploy; the remote census answers it); the Mac's read copies (a clone from the mirror with its push URL disabled, because Prime is the one writer and b2's nightly push would meet a non-fast-forward if the Mac wrote too) are a hand loop today and a switch on mirror or a sibling word later. Gate: the Mac's mirror paste reads DONE with each repo's newest commit equal to Prime's own receipt for that repo. READ 2026-09-30 (deed 1726, Prime's receipts before any Mac run): sixteen bare repos, myjournal.git at 7.5G and personal.git at 226M among them, so the operator RULED a whitelist before the first Mac run: botifyml, clients, corporate, grimoire and trimnoir are the word's default (PIPULATE_MIRROR_REPOS and arguments replace it), a named repo the source lacks prints ABSENT beside the source's roster, and the rest stay home, the Vault blog included. THE BOOK'S TAPE WAS NINE MONTHS STALE: trimnoir.git read 740K with its newest commit 2025-12-23 while the blog publishes daily, because backup_commit = false skips b2's push along with its commit and publish pushes only to its upstream on Honeybot (INFERRED; deed 1727's upstream probe reads it), so the book's history lived in Prime's working copy and on Honeybot and nowhere under ~/git-repos; one push by hand to local_origin, no -u, rides deed 1726's train, and the standing cure is the TODO below. git-upload-pack on the system path, sshd active, the timer's last run 00:00:05, and the word's STOP on an unresolvable host all read as forecast. READ 2026-09-30 (deed 1729, the dismount): the gate is met: the Mac read mirror: DONE -- 5 of 5, five cloned lines whose newest commits equal Prime's per-repo receipt row for row (botifyml 2026-09-27 10:15:06, clients 2025-04-01 07:59:22, corporate 2026-09-29 18:42:18, grimoire 2026-09-30 00:00:05, trimnoir 2026-09-29 21:49:24), the header naming the five, and the word's store path moved idvzw6sx -> n0cn1bgz on Prime after exit then ndq. The routine is b2 on Prime (or the midnight timer), then mirror on the Mac; two repos fall outside it, trimnoir (THE BOOK'S TAPE, below) and clients (THE CLIENTS TAPE IS A FOSSIL, below). UNWITNESSED: the read copies (the hand loop was not run), a second run reading fetched, the word off the LAN. The read copies stay a hand loop; a switch on mirror once a second paste shows they earn one, never a second word. WIDENED 2026-09-30 (deed 1730, the operator's ask): personal joins the whitelist (six by default), and the copies became the word's default rather than a switch: ~/repos/<name> on the Mac, cloned from the Mac's own tape, push URL disabled, refreshed by pull --ff-only with a HELD line where a copy has local work or is not a copy of the tape; corporate and personal sit beside the blogs there because the Mac's Workshop holds the Mac's own tiers. mirror derives ~/.config/pipulate/blogs.mirror.json from the source's blogs.json (keys and aliases unchanged, paths moved to the copies, pipeline emptied, Drive and Confluence ids cut), the Darwin branch reads it at shell entry, write_post pins the shadow, and publish refuses on darwin. The compiler on the Mac reads the copies too, so THE ZERO GATE TODO's cure gates on any PIPULATE_BLOGS_CONFIG, not the shadow name alone. Gate: on the Mac after re-entry, posts -t grim --fmt paths prints paths under ~/repos/grimoire/_posts, and a second mirror run reads fetched with every copy current. READ 2026-09-30 (deed 1733): half the gate met: after re-entry PIPULATE_BLOGS_CONFIG named blogs.mirror.json, posts -t grim printed three paths under /Users/michaellevin/repos/grimoire/_posts, posts printed three under ~/repos/trimnoir/_posts dated 2026-09-29, rgx -t all 3 nix read the three-blog header, and the fm cache read 1505 then 1616 hits, the book's copy equal to Prime's 1,505; the first run read personal cloned, five fetched, every copy cloned and DONE -- 6 of 6. The other half, a second run reading pulled or current on every copy, and every HELD branch, stay unwitnessed; checkout independence is witnessed from ~/qamy alone and holds by construction (every path hangs off HOME).
# - TODO (2026-09-30, THE BOOK'S TAPE): b2 keeps ~/git-repos/trimnoir.git current without deploying: blogs.nix grows backup_remote = "local_origin" on trimnoir, and backup-home.py, for a blog whose backup_commit is false, pushes the current branch to that remote by name (git push <remote> <branch>: never a bare push, which is the deploy, and never -u, which would move publish's upstream off Honeybot), its commit untouched. Needs ~/repos/nixos/blogs.nix and backup-home.py in the payload; ignition nr. Gate: the midnight journal prints a pushed line for trimnoir, and the morning after a publish the per-repo probe reads trimnoir.git's newest commit equal to the working copy's. READ 2026-09-30 (deed 1729): the inference held: trimnoir's upstream reads home/main (Honeybot) and the tape read 22 commits, 740K, 2025-12-23 against the working copy's 1165; NO_ACTIVE_HOOKS read first, then one hand push to local_origin by name (no -u, the tape's HEAD set to main) printed TRIMNOIR_TAPE_CURRENT main, and the tape reads 1165, 293M, 2026-09-29 21:49:24. Until this car lands the same push is typed by hand after a publish; blogs.nix and backup-home.py rode deed 1729's payload, so the car is the next ride's first.
# - TODO (2026-09-30, THE CLIENTS TAPE IS A FOSSIL; read at deed 1729): Workshop/personal/Client_Work's origin reads [email redacted]:miklevin/client.git with dirty=9, not ~/git-repos/clients.git as the 2026-09-28 EMBEDDED REPO TODO INFERRED, so clients.git's newest commit (2025-04-01) is where that tape stopped and the Mac now carries a year-and-a-half-old copy under a DONE line. Ruling owed, the operator's: a second push URL on Client_Work so one push lands on GitHub and on clients.git, or clients leaves the whitelist and the Mac clones from GitHub. Beside it, corporate read level and clean against corporate.git, so its hand push after each train is the whole cure today (b2 commits blogs only, the 2026-09-28 tiers TODO). Gate: the per-repo probe reads clients.git's newest commit equal to Client_Work's.
-# - EARMARK: THE TAPE IS NOT THE WORK (banked 2026-09-30, deed 1729): a mirror's DONE and a date that matches the source witness the TAPE, never the working copy behind it; a repo whose push goes somewhere other than the tape (trimnoir's to Honeybot, Client_Work's to GitHub) keeps a stale tape that mirrors green. Conviction: trimnoir.git sat nine months behind daily publishing and clients.git a year and a half behind Client_Work, and either would have printed cloned with its source's own date and DONE. The census that tells them apart is per working copy: its push URL (git remote get-url) beside its ahead and dirty counts, read before the mirror is trusted. Sibling of THE SUCCESS-ONLY WITNESS (a green that cannot fail) and of THE TAPE LIVES IN ONE PLACE (that one asks where the tape is; this one asks whether it is the tape of anything).
+# § THE TAPE IS NOT THE WORK (banked 2026-09-30) -- Check each working repository's push URL, ahead count, and dirty state before trusting a mirror, because DONE and matching source dates prove only that the tape was copied, not that the tape contains current work.
# - TODO (2026-09-24, the shadow comes home): the Mac's shadow corpora (~/.local/share/pipulate/shadow-publishing/ per lane) hold four days of posts already in Jekyll shape under the same permalink grammar as the real targets; bring them over FROM the Mac side, where nixos.local already answers, one rsync per lane into its _posts/, then publish once (googledocizer --latest will skip them; sweep or run by hand). Gate: `posts 10` on Linux lists 2026-09-21 through 09-24 slugs after the copy.
# § THE TAPE LIVES IN ONE PLACE (banked 2026-09-24) -- Put every remote, bundle, standby, watchdog, and bootstrap source that matters on power and an address the primary does not share, and state WORA only for hosts that can hold a POSIX shell and a Nix store, naming every exception.
# - TODO (2026-09-23, THE ZERO GATE LET ONE THROUGH; read off this compile's router): the stats block reads "1 already-written articles ... at Mac Shadow" with a blank DOM-hydration line, and it is committed. Two causes, both in prompt_foo.py. (1) update_stats_in_place gates on count == 0, and the Mac shadow corpus now holds one post, so the rewrite fires; gate on the shadow config (PIPULATE_BLOGS_CONFIG naming blogs.shadow.json) instead of the count. (2) The cache holds "hydration": "|", and fetch_honeybot_stats's keep-the-last-reading branch trusts any truthy metrics, so the junk survives every failed fetch; run _HONEYBOT_SHAPE over cached values too, in render_honeybot_stat_lines. Then restore the block to the 1,490 / 2026-09-20T17:42Z reading. Gate: a compile on the Mac leaves git status empty. THE RESTORE HALF LANDED 2026-09-24 without a patch: the reset brought the Mac's committed block (2 already-written articles at Mac Shadow, a blank hydration line, fetched 2026-09-21T07:23Z) onto Prime, and Prime's first compile rewrote it in the working tree to 1,491 / 2,664 reads / 2970 from 15 / 2026-09-25T00:12Z (deed 1555's Telemetry), committed by the next m. The two prompt_foo.py causes stand and their gate is unchanged.
@@ -2542,7 +2231,7 @@ MATCHBOOK_CHOP = r"""
# - TODO (2026-09-21, the sed that could not see): the connectors move's literal sed rewrote scripts/connectors/ and missed confluence.py and gmail.py, which had said scripts/<name>.py since before the folder existed (11 and 8 lines, replaced by a gated python car on the Mac, e47ce2c); before any future move, census rg -n 'scripts/[a-z_]+\.py' <folder>/ and read every spelling, not the one you remember. sources_menu.py's docstring still says the door tells the human to type `sources` where the word is conn; the flake's Darwin branch hardwires the shadow blog's name, so a stranger's Mac console names the author (DE-HARDWIRE THE PERSONAL PATHS, one more site).
# - TODO (2026-09-19, the header that flows back): the live router at ~/.local/state/pipulate/adhoc.txt still carries the sigil table the 2026-09-18 sed retired from the tracked template (that dismount named it: a second copy the sed never reached), and on 2026-09-19 that header was copied back over the template in the working tree -- sigil table 0 -> 35, the chapter-XVIII pointer gone, prompt_foo.py commented out of the default chop -- caught only because a displacement receipt read +29 where +1 was predicted (WALK_CHOP 1990 -> 2019), and discarded by git checkout before it rode a commit whose subject would have said documentation. Retire the table from the live router by hand in ahe (cut from the line ending "Here is how to include web pages:" through the "Every step is one argument longer" line, restore the four-line pointer), or the next sync flows it back. Two copies of one header drift; THE OPERATOR IS A VARIABLE, and this time the variable was a paste. AMENDED the same day, deed 1496: it was not discarded. The operator committed the paste before the BEFORE tap ("the easiest thing"; the parent of 6e4af6ee carries foo_files.py at blob a427fc2e, the pasted header, by the Telemetry index line), so Car 0's git checkout restored nothing and its gate printed TEMPLATE_RESTORED anyway, a false green that read git's status where it should have read the file (the sigil heading's grep -c at 0, or STOP): AN EXIT CODE IS A VERDICT ONLY FOR THE PATH THAT REACHES IT, in a gate this ride wrote. The sigil table now lives in HEAD's template, the chapter-XVIII pointer is gone, and prompt_foo.py is commented out of AI_PHOOEY_CHOP so bare foo compiles the router alone. TWO AUDIENCES, ONE FILE (2026-09-18) is reversed by action and unruled in words: either the template mirrors the live router, and the pointer and the 2026-09-18 sed are the things to retire, or the table leaves both files by hand; until ruled, the two copies will keep flowing into each other.
# - TODO (2026-09-19, rgx's empty branch): rgx jeopardy.wav ffmpg (a typo) and a true empty intersection both print "No matching articles.", the same line in two worlds, THE DISCRIMINATION QUESTION at the search prompt; the operator retyped from memory and the tool taught nothing. On the empty branch print each term's solo count beside the zero (jeopardy.wav: 19 | ffmpg: 0 | together: 0) so a typo names itself and a real empty intersection reads as one. rgxCommand and rgxcCommand in flake.nix, one car, exit then ndq as the ignition. Unasked this ride; a TODO, never a car.
-# - EARMARK: A CAR IS A FENCE (banked 2026-09-18, commit-log convicted): the \m template commits one fence per patch, app, d, m, so prose cannot join two fences into one commit; "the two Path joins ride in the same car, same commit" put the git mv in efd85e1d and the CONNECTORS Path join in cd88518b, a window where the folder had moved and the registry face still pointed at the old one, pushed together and harmless only because nothing ran between them. An edit whose truth depends on another edit rides in the SAME FENCE or carries its own gate; a sentence saying they belong together is a switch nobody throws. Sibling of THE TRAIN HAS NO SWITCHES (a choice in the prose is a branch nobody takes) and THE SAME-CAR LABEL RULE (what moves together ships together): this one names the unit, and the unit is the fence.
+# § A CAR IS A FENCE (banked 2026-09-18) -- Put edits whose correctness depends on each other inside the same patch fence or give each its own gate, because prose declaring separate fences to be one commit cannot prevent an inconsistent intermediate state.
# - EARMARK: THE TRAIN HAS NO SWITCHES (captured 2026-09-18 at the operator's request, deliberately unruled: "I took all the Cars"): the operator runs the \m template linearly, patch, app, d, m per car, and anything the emitter phrases as a choice ("if you veto Car 2b, change two words"; "drop these two files if the payload runs heavy") is a switch on a track laid for one line; the operator will take every car or stop the train and never throw the switch, so a conditional in the prose is a branch nobody takes and a label that can end up lying. Two such switches rode deed 1469 unthrown. The shape that fits the template: a car whose truth depends on another car landing carries its own gate (the sed spans did) or rides in the same car, and a choice is a TODO, never a fork inside PATCHES. Sibling of THE COACHMAN'S VETO (a whole train or one car, never a branch) and THE UNASKED SECOND WINDOW (the unraised question is a TODO). The fix is deferred by ruling; this line is the article's capture.
# - TODO (2026-09-17, the gauge with no memory; mechanism landed the same day in prompt_foo.py): the Coverage line now reads its previous claimed/tracked pair back from a Coverage line the Paintbox header carries and prints the delta beside the live count. Two of three branches have printed: first-reading at deed 1442, +0 on three compiles running through 1446. The negative branch was ARMED (git ls-files reads 1 for scripts/takeover_main.sh, and the router claims it once) and run without its ignition on 2026-09-17: sed, d, sed, d, no ahc between the unclaim and the restore, so git saw the line leave and return and the compiler never did (the Useless Machine: a change that happens and unhappens between two readings is invisible to a gauge with a one-compile memory). Next attempt: Car 1 is the unclaim sed AND ahc in ONE fence, read -1 on the console; Car 2, its own fence, is the restore sed and ahc, read +1; restore by sed and never by git checkout, or the header resets with the line and the +1 reads +0. THE +1 PRINTED 2026-09-26 (deed 1567): a real claim, assets/sounds/README.md moved from the Paintbox into chapter VIII-b, and the Processing Log read 204/274 (was 203/274: +1 claimed, +0 tracked), the positive branch by an ordinary edit rather than the two-fence choreography. Only the -1 remains, and the Car 1 unclaim-and-compile fence above is its shape. Delete this line when -1 has printed.
# § THE CEREMONY AND THE BARRIER (banked 2026-09-17) -- Split consent into a ceremony that may prompt only where a terminal is owned and a barrier at the protected action that never prompts and rereads recorded consent on every call; value: GLOSSARY.md. AMENDED 2026-10-01 (THE VOICE ASKS ONCE, OUT LOUD): the first-contact ceremony speaks its own question before any answer exists, the one line the barrier lets through (synthesize_and_play's ceremony flag, first_contact() its only caller), because a voice nobody has heard is a voice nobody can answer for (CONSENT CANNOT PRECEDE ITS OBJECT); the model download before it is disclosed in a printed line and never asked; the GLOSSARY value owes the same sentence.
@@ -2682,29 +2371,8 @@ MATCHBOOK_CHOP = r"""
# - TODO (orphaned 2026-09-04; the url-widening plan that carried it was discharged by THE DUAL-LANE WALK SCHEMA, so only the debt survives): _ignored_or_outside returns safe on the FIRST check-ignore hit and never consults a nested repo; it gates the public catalog repo and nothing else. Own ride; gate: a nested-repo fixture whose ignore rules disagree with the outer repo's, and a receipt naming which repo answered.
# § THE DECLARED-FIXTURE RELIEF VALVE (banked 2026-08-28) -- Exempt a synthetic secret-scan fixture only when its marker occurs inside the matched credential value, never in the variable name or elsewhere on the line, and print every exemption so a live secret cannot pass silently.
-# - EARMARK: THE NAME IS NOT THE VALUE (banked 2026-08-28, hole found the same
-# morning the valve landed): the first spelling searched the whole match, and
-# ten of eleven tripwires match the credential ITSELF -- but the generic
-# assignment tripwire captures the VARIABLE NAME too, so an uppercase name
-# carrying a marker word would have exempted whatever real credential sat to
-# the right of the equals sign. The marker riding OUTSIDE the value is the
-# exact failure the valve's own comment says a line-level check would have.
-# Cured by cutting at the first "=" or ":" in the match. WITNESSED both ways
-# in one straddle: name_marker_blocks 0 -> 1 while value_marker_exempt held
-# at 0, the negative control that proves the cure did not break exemption.
-# STANDING CONSEQUENCE FOR AUTHORS: spell fixture BODIES so they announce
-# themselves; a marker word in the variable NAME buys nothing.
-# - EARMARK: THE LOCATOR THAT POINTED AT NOTHING (banked 2026-08-28): the
-# refusal printed a payload byte offset and told the operator to inspect that
-# payload line -- an artifact that BY CONSTRUCTION does not exist, because a
-# blocked run exits at step 6 and write_context_cartridge runs at step 7.
-# Four CORRECT refusals read as noise for that reason alone. Cured by
-# scanning back to the nearest START marker, which the payload already
-# carries, so the refusal names a FILE the operator can open and grep. Both
-# branches witnessed: the section-naming branch against a real payload, the
-# "(before any section marker)" fallback against raw text read off disk.
-# Sibling of THE LAST-INCH RULE -- every upstream stage was right and the
-# reader-facing string was the whole defect.
+# § THE NAME IS NOT THE VALUE (banked 2026-08-28) -- Apply fixture exemptions to the credential value alone, separating it from any assignment name at the first equals sign or colon, and put fixture markers inside the value rather than relying on a marker in the variable name.
+# § THE LOCATOR THAT POINTED AT NOTHING (banked 2026-08-28) -- Make a refusal locate evidence in an existing source file or section marker, with an explicit pre-section fallback, rather than pointing to an output artifact that the refusal prevented from being written.
# - TODO (banked 2026-08-28, census-scoped, LATENT NOT OUTAGE): 18 published
# articles carry 52 credential-shaped strings; NONE blocks anything until it
# rides in a payload. Bulk is generic-assignment config-shape prose (29 hits
@@ -2721,19 +2389,7 @@ MATCHBOOK_CHOP = r"""
# only). Real -> sed is NOT the fix: the value is already published and in
# git history, so ROTATE first and edit second.
-# - EARMARK: THE WARNING THAT WAS THE HAZARD (banked 2026-08-25, airlock-
-# convicted): a comment explaining a delimiter hazard must never CONTAIN the
-# delimiter, because a comment DOES NOT EXIST at the outer parser's parse
-# time. CONVICTION: a flake.nix comment warning that a dollar immediately
-# followed by an open brace is eaten by Nix's interpolator was refused by
-# apply.py's Nix airlock at the exact column of its own warning -- the whole
-# indented string is ONE Nix value, and interpolation starts anywhere inside
-# it, comment or not. CURE: name the sequence in words ("dollar-brace") and
-# never type it. Third sibling of THE INSTRUMENT BECOMES BAIT -- the first is
-# a probe that attracts the transform it measures, the second is a label
-# eaten by the markup it rides in, this is a warning eaten by the grammar it
-# warns about. Cousin of THE LABEL IS NOT DATA, which is the same collision
-# with the compiler's own console as the victim.
+# § THE WARNING THAT WAS THE HAZARD (banked 2026-08-25) -- Spell an outer parser's hazardous delimiter in words inside comments embedded in its strings, because comment syntax for an inner language cannot prevent interpolation or delimiter parsing by the outer language.
# - EARMARK: THE NIX-FILE LINT PROBE (banked 2026-08-21, receipt-witnessed):
# a probe that passes a non-Python file to ruff produces thousands of
# invalid-syntax errors that read as catastrophic repo rot. Receipt: the
@@ -2757,34 +2413,22 @@ MATCHBOOK_CHOP = r"""
# § THE STRADDLE IS A CONTROLLED EXPERIMENT (banked 2026-08-06) -- the before/after pair is a controlled comparison with ONE manipulated variable, and every straddle rule is a named confound control: IGNITION (was the treatment administered), PROBE ECHO (did the instrument change between taps), LANE-DISAGREEMENT (did the environment differ), ACTUATION-BOUNDARY (did the treatment reach the measured surface). Add CONTROLLED-vs-OBSERVED as a third axis beside determinism and instrument; determinism is what buys n=1, which is why the Nix pin and the byte-reproducible cartridge are the science rather than hygiene around it.
# § THE FILTER THAT ATE THE EVIDENCE (banked 2026-08-06) -- a content filter may gate a channel only when that channel's content IS status; when the content is PAYLOAD (a git diff, a lint report), exempt the channel BY NAME, because a substring guard that eats "error" drops the evidence silently and the placeholder reads the same whether the channel was empty or eaten. Mechanism landed as is_telemetry in PromptBuilder.add_auto_context.
# § THE HISTORY-EXPANSION PROBE (banked 2026-08-06) -- a ! followed by a word character inside double quotes is bash history expansion, ON in the operator's interactive shell and OFF in the compile lane's non-interactive one, so the probe runs clean as a receipt and dies at the hand-run with an error naming a shell feature; single-quote the outer -c argument and use double quotes for the Python strings inside it. A probe that cannot be hand-run has no BEFORE. Second conviction 2026-09-28 (deed 1641), in a hand fence and not a probe: a corporate commit message carried "the !scroll row" inside double quotes, bash answered "bash: !scroll: event not found" and the whole ( cd && git add && git commit && git push ) line died before its first command, with this rule in the same payload (THE CITED RULE IS NOT AN APPLIED RULE); the compile lane would have run the identical line clean. A hand fence's quoted strings are single-quoted, or the ! is kept out of them.
-# - EARMARK: THE SELF-MATCHING PATTERN (banked 2026-08-05, twice-convicted in one transcript): pkill -f and pgrep -f match the FULL COMMAND LINE, and the shell running the script carries the pattern in its own argv -- so an unescaped pattern kills or counts the process that issued it. CONVICTION: flake.nix's publish() [4/4] block protected two patterns with the [.] trick (a regex demanding a literal dot the argv literal does not contain) and MISSED THE THIRD, so every `publish --reboot` killed its own ssh session at that line. The guard must be applied to EVERY pattern in a block, not most of them -- a partially-guarded block READS as guarded. WITNESS: after the fix, `publish force --reboot` printed `new_count=1`, `new=534841`, and the watchdog verdict line, three lines that had never once appeared in any prior transcript.
-# - EARMARK: THE VERIFIER THAT NEVER RAN (banked 2026-08-05, same conviction): a verification block placed AFTER the action it verifies is dead code if the action can kill the reporter, and its silence is indistinguishable from success. flake.nix's [4/4] block held `sleep 12`, a pgrep re-count, and three verdict branches -- none had EVER executed, while a green Atomic Deployment Complete printed underneath every time. THE DISCRIMINATION QUESTION applied to a MISSING line: what does this print in the world where the verifier died? The same checkmark. STANDING CONSEQUENCE: when a receipt block has an expected line that is ABSENT, treat the absence as the finding; do not read the surviving lines as the whole receipt. Third shape in the family -- REFUSAL-ONLY WITNESS is a branch never observed, THE SUCCESS-ONLY WITNESS is a failure never reportable, this is a witness never REACHED.
+# § THE SELF-MATCHING PATTERN (banked 2026-08-05) -- Protect every pkill -f and pgrep -f pattern against matching the invoking shell's own full command line, using a regex spelling such as [.] that the literal argv does not satisfy, and witness that the later verdict is reached.
+# § THE VERIFIER THAT NEVER RAN (banked 2026-08-05) -- Treat an absent expected verification line as a finding that the verifier may never have run, especially when the preceding action can kill its reporter, and never let a surviving success message substitute for that missing witness.
# § INCOMMENSURABLE MEASUREMENTS (banked 2026-08-05) -- a probe can return a CORRECT number about a DIFFERENT question, and the receipt looks authoritative because the number is right; name the exact expression the mechanism evaluates, then confirm the probe evaluates THAT expression and not a plausible neighbour. Cousin of THE DISCRIMINATION QUESTION's family: it sees something real and irrelevant.
# - EARMARK: THE STALE OVERLAY (banked 2026-08-05, Manifest-arbitrated): the context.txt pasted into an article and the context.txt the compiler READ can disagree within a single turn, and only the Manifest's LIVE COMMAND RECEIPTS can tell them apart. CONVICTION: a turn pasted three new probe lines while the compile executed the five from two compiles earlier -- the pasted context described a file the compiler never opened. STANDING CONSEQUENCE: the Manifest is the sole authority on what ran; when the pasted overlay and the receipts disagree, rule from the receipts and say so out loud. The map can outrun the territory inside one turn.
# - TODO (banked 2026-08-05, receipt-scoped): SEVEN in-window articles are the entire residual on-air bracket noise -- 2026-07-31-absolute-timing-and-side-channel-sanitization, 2026-08-01-agentic-web-content-negotiation-telemetry, 2026-08-01-hatching-the-seed-installer-automation, 2026-08-01-mother-cat-kata-deterministic-walk, 2026-08-03-debugging-self-referential-prompt-guards, 2026-08-04-disposable-installations-durable-backups, 2026-08-05-sentinel-splices-workspace-tree-automation. They age out of the 7-day window unaided, so this backlog SHRINKS without action. HAND-EDIT ONLY: several quote the patch-protocol markers verbatim, which is a DELIMITER COLLISION under the OOB EDIT RULE -- vim, never apply.py. Full 300-article list is 20 and lives in the 2026-08-05 compile receipt.
# - TODO (banked 2026-08-05, publish-transcript convicted): nixops.sh's rsync --delete ships the Z640's __pycache__ (cpython-312) to Honeybot and DELETES Honeybot's own (cpython-313) on every publish -- six lines of churn per deploy for zero benefit, since a 3.12 pyc can never load on 3.13. Add --exclude=__pycache__. Separately, trimnoir tracks scripts/aquarium.py and scripts/aquarium_tui.py and nothing else (receipt: git ls-files scripts/ returns exactly those two), so the post-receive checkout restores them and the rsync deletes them again, forever. Delete them from trimnoir. TWO WRITERS, ONE DIRECTORY -- cosmetic today only because content_loader.py is NOT tracked there, and a live regression path the day it is.
# - TODO (banked 2026-08-05, two-sided receipt): stream.py's stdout is TTY-ONLY and structurally unreadable as text. Receipt: journalctl over 45 minutes returned journal_lines=761 (the journal is alive) and unbalanced=0 (the warnings are not in it), and configuration.nix defines `stream` as a writeShellScriptBin watchdog in environment.systemPackages with NO systemd unit -- so it runs in a terminal in the XFCE session and its output exists only as pixels for OBS. THE OPERATOR HAS BEEN DIAGNOSING FROM A VIDEO FEED for the whole census ride. Cheapest capture: tee the watchdog's python3 invocation to a file inside the `stream` script. That is a configuration.nix plus nixos-rebuild ride of its own.
# § THE HEADER-BOUNDED SCANNER (banked 2026-08-05) -- Bound every scanner edit region with explicit author-placed sentinels, never nearby Markdown heading syntax, because fenced code comments can impersonate headings and silently move the blast radius.
-# - EARMARK: THE SENTINEL WRITTEN INTO ITS OWN FILE (banked 2026-08-05, near-miss): documenting a scanner's trigger string inside the file that scanner reads is a self-referential hazard, and it is invisible until the scanner runs. CONVICTION: a guard comment explaining release.py's waxascii canary was added to README.md and CONTAINED THE CANARY PHRASE. It was safe for two independent reasons -- the real needle carries a blockquote prefix the prose lacks, and the scanner breaks on the first match, which is the real canary twelve lines above -- and both were established AFTER the write, by reading source. The fail-safe direction held by construction (if the real canary were deleted the prose still would not match, so the scanner skips rather than aiming at the wrong line), but that was luck. PRESCRIPTION: when documenting a sentinel inside its own file, refer to it by NAME and never reproduce its literal text; if the literal is unavoidable, verify the matcher's exact needle before the write, not after.
+# § THE SENTINEL WRITTEN INTO ITS OWN FILE (banked 2026-08-05) -- Refer to a scanner's sentinel by name rather than reproducing its literal trigger inside the scanned file, and verify the matcher's exact needle before writing any unavoidable literal.
# § THE PROSE-INFLATED COUNTER (banked 2026-08-05) -- a counter whose pattern is a NAME counts documentation and mechanism together, so a patch that also writes prose with that name moves the count by an amount no prediction can compute; anchor mechanism counters on syntax only mechanism produces (^def name, name\(), or print the lines instead of the count.
# § THE CITED RULE IS NOT AN APPLIED RULE (banked 2026-09-06) -- naming a rule in a sentence is not running it against the case in hand, and the two feel identical from the inside; the VHOST CENSUS earmark closed by citing THE PROSE-INFLATED COUNTER as its sibling while its own body had already guessed three SYNTACTIC worlds and never once considered that a comment would match, which is exactly what the cited rule predicts and exactly what the enumeration then printed. STANDING CONSEQUENCE: when a ruling names a sibling rule, apply that sibling to THIS reading before shipping the ruling, out loud, as its own sentence -- the citation is the cheapest possible signal that the answer is already on the shelf, and reaching past it is the cheapest possible miss. Corollary for a model: a rule you can quote is not a rule you have used.
# § THE DOTFILE-BLIND PROBE (banked 2026-08-05) -- rg skips hidden files by default, so a probe hunting a name that lives in .gitignore or any dotfile prints the same silence either way; add --hidden --glob '!.git' when the target might be a dotfile.
# § THE CAP THAT HID THE ANSWER (banked 2026-08-05) -- a head -N cap set to bound noise silently truncates the decisive line when the noise sorts first, and leaves no ellipsis; when the discriminator's position is unknown, bound by CONTENT (grep for the tokens that differ between the two worlds), never by count, and read a cap hit exactly as TRUNCATED.
-# - EARMARK: NO HEREDOC INSIDE AN INTERPOLATED NIX STRING (banked 2026-08-05, main-breaking): a bash heredoc whose terminator sits inside a Nix indented string that is itself INTERPOLATED into another indented string can lose its column-0 alignment, after which bash swallows the rest of the shellHook to EOF. Conviction: a cat-heredoc added to miscSetupLogic broke nix develop on main for every user; the identical pattern in runScript -- a standalone writeShellScriptBin, never interpolated -- has worked for years. THE MECHANISM IS UNWITNESSED: the BEFORE tap on the generated hook text was never taken (the operator healed main first, correctly), and it is deliberately NOT being reconstructed, because the forward blast radius is zero once the pattern itself is banned. FALSIFIED from raw source: every line of miscSetupLogic sits at exactly 10 spaces, so no under-indented line dragged the minimum down. PRESCRIPTION: write multi-line files from a shellHook with ONE printf and never a heredoc, and syntax-check the generated hook before any commit that touches it.
-# - EARMARK: THE HALF-EXECUTED HOOK (banked 2026-08-05, self-convicted): bash parses-and-executes an eval'd script ONE COMMAND AT A TIME, so a syntax error partway through a shellHook leaves everything ABOVE it applied and everything below it missing -- a half-configured environment that looks alive and is not. Conviction: an unterminated heredoc in miscSetupLogic let `mkdir -p Notebooks/Shared` land while PS1, the nix() rpath shim, and EVERY alias silently never defined; the artifact probe read GREEN off the surviving line. STANDING CONSEQUENCE: an artifact probe cannot witness a shellHook. The witness is the hook's own syntax -- `nix eval --raw .#devShells.<sys>.<shell>.shellHook | bash -n` -- or a marker exported by the LAST line of the hook. Sibling of THE SUCCESS-ONLY WITNESS: there the instrument hid a failure, here the instrument sat above it.
-# - EARMARK: THE READ-WRITE PROBE (banked 2026-08-04, specimen-convicted): a
-# probe that OPENS a database is not read-only, and the damage lands on the
-# EVIDENCE rather than on the data. sqlite3.connect() defaults to read-write,
-# so `cli.py db-inspect` touched data/botifython_dev.db and moved its mtime
-# from May 3 13:26 to Aug 4 08:43 with its SIZE UNCHANGED at 503808 -- opened,
-# not written. That mtime was the single cheapest liveness signal separating
-# the live app database from the three-month-old fossil the backup roster was
-# copying, and the probe sent to READ it DESTROYED it. Harmless only because
-# the roster fix had already landed. PRESCRIPTION: inspect SQLite through the
-# read-only URI (sqlite3.connect('file:path?mode=ro', uri=True)), or stat the
-# file without opening it. Sibling of THE PROBE THAT ATE ITS SIBLINGS: that
-# one bounds a probe's effect on SHELL STATE, this one bounds its effect on
-# the MEASUREMENT.
+# § NO HEREDOC INSIDE AN INTERPOLATED NIX STRING (banked 2026-08-05) -- Write multiline files in interpolated shellHook strings with one printf rather than a heredoc, and syntax-check the generated hook before committing any change to it.
+# § THE HALF-EXECUTED HOOK (banked 2026-08-05) -- Witness a shellHook with syntax checking of its generated text or a marker exported by its final line, because an artifact created before a later parse error cannot prove that the whole hook executed.
+# § THE READ-WRITE PROBE (banked 2026-08-04) -- Inspect SQLite through sqlite3.connect('file:path?mode=ro', uri=True), or stat the file without opening it, so a probe cannot destroy the timestamps that distinguish live data from a fossil.
# - EARMARK: THE TWO-HAND TEST IS NOT A TEST (banked 2026-08-04, operator-
# refused): a procedure asking a human to type in terminal A, then type in
# terminal B while A still runs, has no receipt, no reproducibility and no
@@ -2820,19 +2464,7 @@ MATCHBOOK_CHOP = r"""
# menu, every shell entry), so the BANNER lowercases to match:
# substr($0,2) -> tolower(substr($0,2)). One word.
# § THE PROBE THAT ATE ITS SIBLINGS (banked 2026-08-04) -- Run every probe that changes directory inside a subshell and isolate or restore any other shell-state changes, including cleanup, so pasting the whole probe block cannot break subsequent probes.
-# - EARMARK: THE MAINTAINER-INVISIBLE LANE (banked 2026-08-04, three-for-three):
-# every defect this ride closed was structurally unobservable from the
-# maintainer's daily machine, and for THREE DIFFERENT REASONS. The alsa-utils
-# refusal needs a foreign hostPlatform. The 24 INFO lines need twelve absent
-# destination files, which exist on any machine used twice. The false-dirty
-# gate needs a freshly cp'd index, which exists for about forty seconds once per
-# install, a year ago on Prime. NONE is a rare edge case; each is the ONLY
-# thing a stranger ever sees, and each is invisible to the one person who could
-# fix it. STANDING CONSEQUENCE: when a lane's whole audience is people who
-# cannot report bugs, budget rides for it on a schedule, not on complaint --
-# there will never be a complaint. Sibling of THE UNEXPORTED-SHIM RULE
-# ("lane-visible only ... the audience the artifact ships to can never report
-# it") generalized from one mechanism to a whole class.
+# § THE MAINTAINER-INVISIBLE LANE (banked 2026-08-04) -- Budget scheduled fresh-user and foreign-platform checks for lanes whose users cannot report bugs, including missing destination files and freshly copied indexes, rather than judging those lanes from the maintainer's historically populated machine.
# - TODO (banked 2026-08-03, THIRD conviction in one ride series): ai.py's
# get_change_analysis() falls to an all-zero stub in the `m` lane, because
@@ -2927,19 +2559,7 @@ MATCHBOOK_CHOP = r"""
# (+7/-0, a guard and its comment) under "chore: Remove redundant orphan
# shard check logic in contextualizer.py", the comment's "the twin is cut"
# read as the commit's verb.
-# - EARMARK: THE THREE-REGION ART EDIT (banked 2026-08-03, receipt-corrected):
-# registering one piece of figurate art is a THREE-region change with an
-# integrity coupling and NO airlock -- not two, as a prior turn asserted.
-# Receipt (rg over imports/ascii_displays.py): a `_figurate_<name>` render fn
-# above FIGURATE_RENDER_EXTRUDE_BOTTOM (:884), a CRC32 entry above
-# FIGURATE_LEDGER_EXTRUDE_BOTTOM (:71), and a dict entry above
-# FIGURATE_REGISTRY_EXTRUDE_BOTTOM (:927). apply.py has AST, Nix, JSON,
-# protocol-marker and autolink airlocks and NOTHING that checks whether an
-# art string still agrees with its seal, because that coupling is semantic,
-# not syntactic. ORDERING: the CRC cannot be known until the art exists, so
-# author first, print(binascii.crc32(art.encode('utf-8'))), then seal.
-# MANDATORY IGNITION for every art car: `figurate <name>`, read `Drift: 0`.
-# An art car may never declare "no ignition required".
+# § THE THREE-REGION ART EDIT (banked 2026-08-03) -- Register figurate art in all three regions, rendering function, CRC32 ledger, and registry, compute its CRC only after authoring the art, and run figurate <name> to witness Drift: 0 for every art edit.
# - EARMARK: THE LANE-EXCLUSIVE BRANCH (banked 2026-08-03, canary-witnessed):
# some branches can fire in ONE lane only. prompt_foo's de-prefixed-command
# hint lives inside main()'s file loop, so no hand-run terminal can ever
@@ -2969,8 +2589,8 @@ MATCHBOOK_CHOP = r"""
# clone with an EMPTY blogs.json reaches a compiled payload without editing
# a single tracked file. Anything a forker must edit INSIDE the repo is
# personal data living in the mechanism lane.
-# - EARMARK: THE RECEIPT-PLUS-LANE TABLE (banked 2026-08-02, four-turn witnessed): the standing render for pass/fail rulings is a markdown table with FOUR columns -- Item, Colour, Receipt, Lane -- and the load-bearing part is the last two, not the glyph. Receipt forces a claim to name its evidence; Lane forces it to name its vantage (compile lane = prompt_foo's ! executor; operator lane = a hand-run terminal), because a receipt without a lane is unlabeled evidence and the two lanes routinely disagree. THREE STATES, not two: green (witnessed), red (witnessed failing), and a third for attempted-but-unverified or VOID (the probe could not see). A two-state table flattens both into a lie -- convicted twice in one ride series, once when a sudo-refused probe's `0` was read as a reading and once when a program's own "copied to clipboard" print stood in for a paste. The glyph is the HANDLE (memorable, scannable); the receipt-and-lane pair is the MECHANISM. Sibling of THE TWO-RECORDER RULE: authority may only decrease from wire receipt to tool transcript to narrative, and the Lane column is where that ladder becomes visible.
-# - EARMARK: THE TEST-RIG PROVENANCE RULE (banked 2026-08-02, cold-start ride six): a cold-start rig can be a PRISTINE PUBLISHED-ARTIFACT test or a CURRENT-CODE test, never both in one directory, and which one it is must be stated before any ruling is taken from it. Conviction: /home/coldstart/pipulate ran the published ZIP for three rides, so every repo patch was structurally invisible to it and a correct per-user-lock fix appeared to fail; the magic-cookie transformation then replaced it by `git clone --depth=1`, so the rig received code by CLONE, not by PULL, and is now frozen at clone-time HEAD with a dead update lane -- a THIRD thing that is neither property cleanly. Patches reach it only by hand-carry (sudo install), and the hand-carry is itself a receipt that the pull is broken. STANDING CONSEQUENCE: name the rig's provenance in every ruling taken from it, and prefer two rigs (one pristine, one current) over one ambiguous rig.
+# § THE RECEIPT-PLUS-LANE TABLE (banked 2026-08-02) -- Report pass/fail rulings in Item, Colour, Receipt, and Lane columns, distinguishing witnessed success, witnessed failure, and attempted-but-unverified or VOID so an inaccessible probe or unverified success message cannot count as evidence.
+# § THE TEST-RIG PROVENANCE RULE (banked 2026-08-02) -- State each test rig's provenance in every ruling, distinguish pristine published-artifact tests from current-code tests, and use separate rigs rather than treating a frozen clone or hand-carried patch as evidence that the update lane works.
# - TODO: CUT THE GHOST-DRIVER BODY BRANCHES (seeded 2026-07-26, receipt-convicted):
# assets/scenarios/introduction.json's branch_llm_body_chain_reaction,
# branch_llm_body_test_results, and branch_dom_visualizer_intro stack THREE
@@ -3080,7 +2700,7 @@ MATCHBOOK_CHOP = r"""
# § THE DISCRIMINATION QUESTION (banked 2026-07-31) -- before typing any probe ask: what does this print in the world where I am wrong? If the answer is "the same thing" you have a ritual, not a probe, and its green is uninformative; the straddle is this question applied twice. Children, each a way the answer comes back the same: SINGLE-LINE-WITNESS, CASE-BLIND, UNANCHORED, CONTIGUITY, DOTFILE-BLIND, THE CAP THAT HID THE ANSWER, THE PROSE-INFLATED COUNTER, THE EPITAPH COUNTER.
# § THE CONTIGUITY COROLLARY (banked 2026-07-31) -- the compile transport strips truly-empty lines from Codebase bodies, so a SEARCH block must span contiguous non-empty lines exactly as the payload shows them; a SEARCH crossing an invisible blank fails exact-match with a first-line-matches diagnostic that reads like indentation and is not. When an insertion straddles a probable blank, anchor on one unique line.
# § THE LAST-INCH RULE (banked 2026-07-31, two convictions in two days) -- Check the transformation nearest the reader first -- formatter, truncation, column width, transport, display -- because the last inch can fabricate or erase identity while every upstream number remains correct; parent of THE RENDER-GAP RULE, instance of THE DISCRIMINATION QUESTION; Value: GLOSSARY.md.
-# - EARMARK: THE ENVIRONMENT-AS-LAST-INCH COROLLARY (banked 2026-08-02, three-ride conviction): an environment variable is a transformation nearest the actuator, and it is audited last or never. Conviction: three consecutive cold-start rides exported DISPLAY=:0 on a machine whose only X socket is X1, so chromium printed `xcb_connect() failed, error 1` after a 60s hang -- IDENTICALLY in the world where the xhost grant existed and in the world where it did not, which is THE DISCRIMINATION QUESTION failing in the operator's own hands. Every layer above it computed correctly: the xorg.xhost package landed, the shell was re-entered, the grant applied, chromium ran as the second user and dumped a DOM headless. The whole chain was green and invisible because the last variable was wrong. Settled by `echo $DISPLAY`, one word. STANDING CONSEQUENCE: before diagnosing a display, socket, port, or path failure, PRINT THE VARIABLE -- an auth-shaped error names a credential, a connect-shaped error names a destination, and the two are not interchangeable. Instance of THE LAST-INCH RULE with an env var as the last inch.
+# § THE ENVIRONMENT-AS-LAST-INCH COROLLARY (banked 2026-08-02) -- Print the actual environment variable before diagnosing any display, socket, port, or path failure, and distinguish a wrong destination from an authentication failure before changing higher layers.
# § THE CHURNING-KEY RULE (banked 2026-07-31) -- Before reading any GROUP BY or ranking, ask whether the subject controls and revs the grouping key; if it does, roll up to a stable family and keep an Unclassified bucket, because key churn fragments one subject into invisible under-threshold rows.
# § THE VERDICT-IN-THE-INSTRUMENT RULE (banked 2026-07-31) -- Never write the expected answer into the artifact whose job is to determine it; state only the question, rival hypotheses, and predicted printouts before evidence, and add the answer only after naming the receipt.
@@ -3156,7 +2776,7 @@ MATCHBOOK_CHOP = r"""
# § FAILED-PROBE RECEIPT (banked 2026-07-20) -- Preserve stderr-only nonzero exits as bounded first-class compile receipts, and validate the lane by manufacturing a known failure before trusting its green.
# - NEXT RIDE -- RUNTIME TOOL-DISCOVERY IMPORT SPLIT (seeded 2026-07-20 at dismount): the compile-lane roster now dodges the tax via AST, but cli.py mcp-discover and get_all_tools() STILL import every tools/*.py at tool-call time, eating the ~3.8s imports.voice_synthesis engine load (runtime BEFORE receipt: get_all_tools() at 5.58s vs the 0.18s AST path). Defer/lazy-load the engine import inside tools/voice_synthesis.py so enumerating names/metadata never constructs the TTS engine -- it loads only when voice_synthesis is CALLED. Arrival: a runtime AFTER receipt showing get_all_tools() drop from ~5.5s toward the AST floor. DISCHARGED 2026-09-17 (deed 1460): the engine load left ChipVoiceSystem.__init__ for ensure_voice() in imports/voice_synthesis.py, the import straddle read 3.51 s loaded=True -> 0.40 s loaded=False, and cli.py mcp-discover ran in 0.23 s in the compile lane against the 5.58 s BEFORE, at the AST floor; the load now happens only after a human has answered the voice card. RECALL HANDLE (the "rtx" pull = rgx/rgxc AND-search over _posts, since 2-3 rare words set-intersect to one article): `rgxc roster triptych hinge` re-prints this article's shards AND copies a TODO_SLUGS block, so `xp` right after re-hydrates the FULL article into context -- no bookmark, just two rare words meeting once. THE 1+1=3: LLM Optics + AST-derived roster + rgx word-union recall + the mount/dismount ride kata all landed within days and now COMPOSE -- each makes the next cheaper to reach for; that compounding, not any lone unlock, is the acceleration.
-# - EARMARK: THE COVER-PROMPT RULE (banked 2026-07-20, fan-out-witnessed same day): an instruction embedded in an uploaded artifact is INJECTION to a cautious model; the same instruction typed by the human is INTENT. Conviction: 4-model SEED fan-out -- ChatGPT/Grok/Gemini adopted Yen Sid-ton five-for-five; Opus verified the cartridge sha256, then explicitly demoted prompt.md to context-not-marching-orders and asked the human what they wanted. Any distributable artifact therefore ships with a one-line human cover prompt (e.g. "Please help me install this using the included instructions") that authorizes the embedded protocol. Verification receipts were unanimous wherever code execution existed -- cartridge integrity is proven; only the authority channel needed the fix.
+# § THE COVER-PROMPT RULE (banked 2026-07-20) -- Ship distributable artifacts with a one-line cover prompt for the human to send that explicitly authorizes the embedded instructions, because verifying an archive's integrity does not itself establish instruction authority.
# § THE ANCESTOR-DISCIPLINE RULE (banked 2026-07-21) -- Name legacy categories as lineage, never identity: position the current system by directly measurable invariants and receipts, gate language migration on observed evidence, preserve ancestor anchors and stable identifiers, and never sell the replacement framing as a score that can Goodhart.
(nix:nix-shell-env) (nix) qamyai $ blast
^C
(nix:nix-shell-env) (nix) qamyai $ git commit -am "Forgetting kata, 50 iterations"
[main 78be893] Forgetting kata, 50 iterations
2 files changed, 737 insertions(+), 437 deletions(-)
(nix:nix-shell-env) (nix) qamyai $ git push
Enumerating objects: 7, done.
Counting objects: 100% (7/7), done.
Delta compression using up to 8 threads
Compressing objects: 100% (4/4), done.
Writing objects: 100% (4/4), 27.71 KiB | 2.77 MiB/s, done.
Total 4 (delta 3), reused 0 (delta 0), pack-reused 0 (from 0)
remote: Resolving deltas: 100% (3/3), completed with 3 local objects.
To github.com:pipulate/pipulate.git
bb5c290..78be893 main -> main
(nix:nix-shell-env) (nix) qamyai $
That was seriously impressive. I noticed it went in a batch of 30 and then 20 so I should ask for 90 next time for 3 batches. It didn’t even take that long.
(nix) qamyai $ git pull
remote: Enumerating objects: 7, done.
remote: Counting objects: 100% (7/7), done.
remote: Compressing objects: 100% (1/1), done.
Unpacking objects: 100% (4/4), 27.69 KiB | 1012.00 KiB/s, done.
remote: Total 4 (delta 3), reused 4 (delta 3), pack-reused 0 (from 0)
From github.com:pipulate/pipulate
bb5c2905..78be893f main -> origin/main
Updating bb5c2905..78be893f
error: Your local changes to the following files would be overwritten by merge:
foo_files.py
Please commit your changes or stash them before you merge.
Aborting
(nix) qamyai $ d
diff --git a/foo_files.py b/foo_files.py
index 62a4243b..3f814a6c 100644
--- a/foo_files.py
+++ b/foo_files.py
@@ -21,8 +21,11 @@ AI_PHOOEY_CHOP = r"""#
# creator of) of Project Pipulate:
# --- START STATS ---
-# There are 1,505 already-written articles about this repo at MikeLev.in (Public)
-# Velocity: 4 published in the last 7 days
+# There are 1,518 already-written articles about this repo at MikeLev.in (Public)
+# Velocity: 17 published in the last 7 days
+# Markdown negotiated: 3,250 reads (0.24% of all responses)
+# DOM hydration: 3697 trapdoor triggers from 15 non-local IPs (top-N sample, self excluded)
+# Honeybot telemetry fetched 2026-10-06T13:42Z
# --- END STATS ---
# Project Pipulate is known as (and installable from) various domains:
(nix) qamyai $ git reset --hard HEAD
HEAD is now at bb5c2905 feat: expand rule - a probe runs on the operator's machine or it is not a probe
(nix) qamyai $ git pull
Updating bb5c2905..78be893f
Fast-forward
GLOSSARY.md | 680 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
foo_files.py | 494 ++++++++++++++------------------------------------------------------------------------------------------------------
2 files changed, 737 insertions(+), 437 deletions(-)
(nix) qamyai $ forget
📊 Stats block refreshed: 1,518 articles at MikeLev.in (Public).
🗺️ Codex Mapping Coverage: 71.6% (197/275 tracked files) (was 197/275: +0 claimed, +0 tracked).
✅ Topological Integrity Verified: 3 candidate reference(s) scanned, all exist.
-> Executing: grep -c '^# § ' foo_files.py ... [0.0115s]
-> Executing: awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l ... [0.0144s]
-> Executing: grep -c '^# - EARMARK' foo_files.py ... [0.0110s]
-> Executing: wc -c foo_files.py GLOSSARY.md ... [0.0083s]
-> Executing: awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# ==/)print n"\t"h}' foo_files.py | sort -rn | head -12 ... [0.0211s]
-> Ruff exit 0 (clean).
📦 Payload Ledger (biggest first)
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┓
┃ File / Source ┃ Tokens ┃ Bytes ┃ % Bytes ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━┩
│ foo_files.py │ 136,318 │ 531,079 │ 59.9% │
│ GLOSSARY.md │ 74,407 │ 296,795 │ 33.5% │
│ apply.py │ 9,590 │ 41,300 │ 4.7% │
│ PROMPT (checklist + prompt.md) │ 3,653 │ 15,849 │ 1.8% │
│ ! awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# │ 329 │ 936 │ 0.1% │
│ ==/)print n"\t"h}' foo_files.py | sort -rn | head -12 │ │ │ │
│ AUTO: Recent Git Diff Telemetry │ 241 │ 813 │ 0.1% │
│ ! wc -c foo_files.py GLOSSARY.md │ 16 │ 51 │ 0.0% │
│ AUTO: Static Analysis Diagnostics │ 11 │ 39 │ 0.0% │
│ ! grep -c '^# § ' foo_files.py │ 1 │ 3 │ 0.0% │
│ ! awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l │ 1 │ 2 │ 0.0% │
│ ! grep -c '^# - EARMARK' foo_files.py │ 1 │ 2 │ 0.0% │
├─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────┼─────────┼─────────┤
│ TOTAL │ 224,568 │ 886,869 │ 100.0% │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┴─────────┴─────────┴─────────┘
Assembled payload (pre-scrub): 228,633 tokens | 900,564 bytes
🧼 Identity scrub: substitutions=58 rule(s) | denylist=0 rule(s)
🔐 Secrets tripwire: ARMED -- 0 hit(s) in payload.
📦 Canonical QA archive written to /home/mike/qamyai/qamy.ai.zip (sha256=470777f3ce5e…, members=3)
🗂️ Rotated archive snapshot: qamy.ai_109-470777f3.zip (keeping newest 20 of 20)
Markdown output copied to clipboard
(nix) qamyai $ git reset --hard HEAD
HEAD is now at 78be893f Forgetting kata, 50 iterations
(nix) qamyai $
Down to 531K. Not bad. Let’s lean in. Oh it told me it used batches of 10 with a
progress update at 30. That makes sense. Yeah, just because I’m this apply.py
airlock interlock snob to keep the dinosaurs in the park on agentic loops, on
certain tasks it can save a lot of time and labor. You see I’m still printing
the red and green diffs as I go so my old habits…
Hmmm, what am I saying?
I’m saying it’s not all or nothing. When you’re being the boss of the machine and you’ve got tools like GPT Codex and Claude Code, which I guess are really just browsers with the “don’t write to my local real file-system” permissions removed with sandboxing techniques ever since… what?
The tradition we’re going around here is what I think the iPhone popularized with iOS (sandbox everything) and then Google followed suit with Chrome tabs and their comicbook (tell ‘em about the comicbook). I want to say maybe Sun was doing this before? Or BeOS? It doesn’t feel like Apple invented it but it’s the iPhone that woke everyone up that to keep bad things from happening you can isolate at the app-boundary instead of at the more generic Unix-like circles of protection OS-levels boundaries. Am I describing that correct?
Anyway the use of the Electron platform which is what OpenAI Codex and Claude destkop are and things like Discord, Zoom and Slack as well, are really just the Chromium free component building-block parts of Google Chrome extracted and turned into the graphical user interface (GUI) of a desktop app so they have an easier time porting between platforms (not as seamless as Nix) and can get around sandbox limitations.
Stepping Around the App Sandbox Boundary
Vet what I said but not like a finicky nitpicker. Be a master storyteller for the audience here. Educate and entertain and be gentle smacking me down where I’m wrong or need elaboration, more color and yes the occasional correction.
Oh, and by the way:
GPT-6 Astra Light: Completed 38 iterations, then stopped under the agreed safety criteria. Remaining candidates are pending work, receipts, architecture descriptions, or lack a clear conviction or banked date.
- Keys: 179 → 217
- Router reduced by 9,228 bytes
- Verbatim preservation, placement, syntax, routing, and whitespace checks passed
- Receipts unchanged at 19
Only foo_files.py and GLOSSARY.md changed. No commit or push.
MikeLev.in: As much as it can do is as much as I can ask for. And leaving the unresolved stuff there is perfect. That’s the reason for it to be there. That’s better signal for moving forward on unfinished stuff.
And I check:
(nix:nix-shell-env) (nix) qamyai $ d
diff --git a/GLOSSARY.md b/GLOSSARY.md
index 699deaa..182e47b 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -618,6 +618,12 @@ Entries are alphabetical, numbers spelled as spoken.
# afterward. Exercises the hard half; costs no publish.
~~~
+- **The Actuator'S Own Diagnostic Rule** -- *expanded rule; banked 2026-09-01.*
+
+~~~text
+# THE ACTUATOR'S OWN DIAGNOSTIC RULE (banked 2026-09-01). apply.py's AST airlock compiles candidate content before writing, so it printed `<unknown>:985: SyntaxWarning: invalid escape sequence` on THREE consecutive `app` runs -- correct message, correct line number -- and it read as noise FROM the tool rather than a finding ABOUT the file. The `<unknown>` filename is what disguised it: a diagnostic with no filename reads as the tool complaining about itself. A LINE NUMBER in an actuator's output is a finding about the FILE. Read it, or the instrument you built is reporting to nobody.
+~~~
+
- **Admin Forms Are Credential Surfaces** -- (banked 2026-09-11, cartridge
foo-d5dfdb65-1342.zip). A `?URL` scrape of a vendor's Django admin renders a
live secret as a BARE VALUE under its human-readable field label -- no
@@ -795,6 +801,35 @@ Entries are alphabetical, numbers spelled as spoken.
# probe so the surprise becomes reusable rather than re-derived.
~~~
+- **The Barney Reset Rule** -- *expanded rule; banked 2026-07-21.*
+
+~~~text
+# THE BARNEY RESET RULE (banked 2026-07-21, articulation-banked): Trigger
+# when the human says they do not understand. Trigger when the human asks
+# what they are supposed to do. Trigger when confusion survives into a
+# second consecutive turn.
+#
+# STOP THE TORTOISE PROTOCOL.
+#
+# Open with exactly five plain statements. Use this order:
+#
+# Problem: ...
+# Evidence: ...
+# Danger: ...
+# Next action: ...
+# Remaining unknown: ...
+#
+# Keep sentences short. Keep them literal.
+#
+# PUT EVERY IMPORTANT INSTRUCTION ON ITS OWN LINE.
+#
+# NO METAPHOR BEFORE THE FIVE.
+#
+# NO PATCH BEFORE THE FIVE.
+#
+# Resume the normal protocol only after the next action is obvious.
+~~~
+
- **The Blank Stare Rule** -- (banked 2026-09-28, the operator's words): every word a newcomer types is the plain name of the thing it does (walk, connect, context, prompt, compile, about, menu), and an abbreviation is an alias behind it, never the word the menu prints. The answer to "your system is unusual" is the objector's own word, typed into a text file, and a blank stare: which part is difficult, the word connect, or that a word can be written down where a hand-motion in a browser cannot? Operation Stick Bug's rule for names: the instrument vanishes when it is called what it is. Sibling of THE NEXT ACTION, NOT THE MACHINERY. ONE EXCEPTION, on purpose (2026-10-02): osb, Operation Stick Bug's own word, printed last by all and never by the short menu, because a name like a twig is its camouflage.
- **The Browser Is Not A Config File** -- *expanded rule; banked 2026-09-28.*
@@ -829,6 +864,12 @@ Entries are alphabetical, numbers spelled as spoken.
into the PROMPT that will read it. STANDING CONSEQUENCE: every conditional
in a caboose names its PRECONDITION first, or it states the check and leaves
the ruling to the turn that holds the receipt.
+- **Cache-Churn Exclusion Principle** -- *expanded rule; banked 2026-07-20.*
+
+~~~text
+# - EARMARK: CACHE-CHURN EXCLUSION PRINCIPLE (banked 2026-07-20): a hash-gated backup reduces writes only if its manifest excludes always-churning files; token_cache.json/fm_cache.json carrying the compile's own mtime is the conviction.
+~~~
+
- **The Cap That Hid the Answer** -- *a count-bounded probe hides the
discriminator.* Banked 2026-08-05, convicted three times in three compiles.
A `head -N` cap set to bound noise silently truncates the decisive line when
@@ -1144,6 +1185,12 @@ Entries are alphabetical, numbers spelled as spoken.
# fresh `nix develop` would instantiate, without entering one.
~~~
+- **The Data-File Re-Render Rule** -- *expanded rule; banked 2026-09-03.*
+
+~~~text
+# THE DATA-FILE RE-RENDER RULE (banked 2026-09-03). When a layout gains a site.data.* lookup, jekyll serve's incremental mode will not re-render existing pages when only the data file changes. Local preview needs `touch _layouts/default.html`; production `jekyll build` needs nothing.
+~~~
+
- **The Declared-Fixture Relief Valve** -- (banked 2026-08-28,
hand-edit-convicted): a guard that fires on the ONE activity this repo
performs constantly -- writing about credentials -- is a guard on its way
@@ -1170,6 +1217,12 @@ Entries are alphabetical, numbers spelled as spoken.
closing grep -n receipt. THE DISPLACEMENT RECEIPT carries the rg -n form of
the same rule: a line number is an absolute, and its movement across the
patch is the receipt.
+- **The Diffstat Is Not The Block Count** -- *expanded rule; banked 2026-09-15.*
+
+~~~text
+# THE DIFFSTAT IS NOT THE BLOCK COUNT (banked 2026-09-15). git matches every line a SEARCH and its REPLACE share and reports them unchanged, so a diffstat's insertions and deletions read LOWER than the block lengths by the shared count: blocks of 120 and 151 read +110/-139, twelve bare # separators and carried-over lines matched. Only the net is invariant. Predict the net from the blocks; read insertions and deletions as floors. Sibling of COUNT THE REPLACE AFTER YOU WRITE IT.
+~~~
+
- **The Directory Key Crossed Machines** -- (banked 2026-09-08, convicted by the second machine): a shared file may not name a thing by a MACHINE-LOCAL handle, because the handle is assigned per machine and the file is not. Chrome numbers profile directories in creation order, so "Profile 2" was the Work profile on NixOS and the PERSONAL profile on the Mac (Mike, 121 synced bookmarks), and bookmarks.nix, keyed by that directory, resolved to the wrong profile the first time a second checkout ran it; only the sync_metadata fence stood between a real run and a harvest-and-wipe of a personal bar. The key had been right for the whole life of the feature on the one machine that existed, which is SINGLE-CANDIDATE BLINDNESS wearing a filename: n=1 cannot tell a stable identity from a coincidence. CURE, a grammar change rather than a value change: the key is a human name and a `match` list names IDENTITIES the machine derives and the operator cannot author (a label, an account, an account domain, read from the application's own registry); exactly one hit resolves, none skips, several refuse. THE TEST before any key rides a shared file: is this value assigned by the machine in an order the other machine never saw? Directory numbers, pids, device paths, X display numbers and "Profile N" all fail it. Sibling of THE DERIVED-PATH RULE (a write target computed from an identity the writer cannot author) and of SINGLE-CANDIDATE BLINDNESS (create the second candidate); this names the class of key the second candidate convicts.
- **The Disappearing Instrument Rule** -- *expanded rule; banked 2026-07-19.*
@@ -1398,6 +1451,12 @@ Entries are alphabetical, numbers spelled as spoken.
# one compile later, exactly as the pipeline ordering predicts.
~~~
+- **The Dual-Lane Walk Schema** -- *expanded rule; banked 2026-08-25.*
+
+~~~text
+# THE DUAL-LANE WALK SCHEMA (banked 2026-08-25, receipt-witnessed): a trail stop accepts exactly one of `url` (public, direct HTTP/HTTPS) or `url_env` (sensitive, client-isolated), validated via exact set difference. Direct URLs surface openly on consent cards; environment variables surface as requirements on the human. Connectors declare honest execution targets, and `walk-cartridge-integrity-v2` enforces ordered destination disclosure. Conviction: the schema required url_env on every stop, so public pages paid for an env var nothing collected; a required field is a BILL, and you charge it only when something collects.
+~~~
+
- **The Eliminator Needs a Generator** -- *bisection cannot fail to eliminate
and can silently fail to converge.* Banked 2026-08-06, thrice-convicted in
one ride. Binary search terminates only if the target is IN THE ARRAY.
@@ -1422,6 +1481,12 @@ Entries are alphabetical, numbers spelled as spoken.
GENERATE (30-and-3, AXIS-FORCING, the rising sea) -> ELIMINATE (bisection,
the straddle) -> WITNESS (receipts). This repo has always had all three and
had been calling the middle one "science" as though it were the method.
+- **The Entry-Point Check** -- *expanded rule; banked 2026-09-03.*
+
+~~~text
+# THE ENTRY-POINT CHECK (banked 2026-09-03). Every WRITE_FILE of a runnable .py script MUST end with the __main__ guard, and the first probe after ignition MUST be one that can only print if main() actually ran (a target line, a wrote-N line). A script that imports cleanly and exits 0 is indistinguishable from success by exit code alone.
+~~~
+
- **The Environment-As-Last-Inch Corollary** -- *expanded rule; banked 2026-08-02.*
~~~text
@@ -1593,6 +1658,12 @@ Entries are alphabetical, numbers spelled as spoken.
apply.py's fixed tail from 2026-09-24 until THE ACTUATOR IS NOT THE LEDGER
moved it to the router on 2026-09-26; graduated here 2026-09-28, the first
of the moved rules to leave the router.
+- **The First-Cell Blast Radius Rule** -- *expanded rule; banked 2026-09-01.*
+
+~~~text
+# THE FIRST-CELL BLAST RADIUS RULE (banked 2026-09-01, two convictions in two consecutive rides). Anything the FIRST executable cell of Onboarding.ipynb touches -- including every module it imports at load time -- prints to a stranger at the one moment they cannot tell noise from failure. Both convictions were trivial in SUBSTANCE and severe in POSITION: a KeyError from a read-before-write, and a SyntaxWarning from an unraw ASCII-art literal. Judge a defect in that blast radius by WHERE it fires, never by how small it is, and hold first-cell code to the standard of a cold install rather than the standard of the maintainer's warm one.
+~~~
+
- **The First-Error Floor** -- *a refusal's line number is a floor, never a
ceiling.* Banked 2026-08-09, airlock-witnessed. A parser reports the FIRST
error it cannot get past, never the LAST one in the file, so the line number
@@ -1686,6 +1757,12 @@ Entries are alphabetical, numbers spelled as spoken.
~~~
- **The Four Stages of the Harness** -- (banked 2026-09-28, the operator's words at the dismount): a human on this harness climbs the four stages of any new language -- literacy (can read and write the words at all: patch, app, d, m), automaticity (the words leave executive function for muscle memory), prosody (play in the words: bjj, the blank stare), fluency (the tools internalized, mastery spontaneous) -- and the models climb in lock-step, so the article archive is a training loop for both; the vendors' default compels learned helplessness, and the alternative is a scaffold you strap onto that pulls you along while forcing you to READ the red-and-green diff you actuate. Why the rides carry almost no wrong turn that must be backed out: the unit of change is a car, a car cannot land wrong silently (the exact-match interlock, the AST and Nix airlocks, a hand fence's own STOP/GO), every forecast is graded one compile later by receipts the model did not write, git holds every step, and the payload carries the ledger of prior misses as rules, so the model answers inside a corridor its predecessors dug; this ride's misses (git mv -q, the reseal in prose, Deliverables, imports=8, the absolutes one over) were each one car wide and each caught by the next tap. Home owed: a higher-profile line for the four stages, the walk's closing or the GLOSSARY, unruled.
+- **The Gate-Or-Straddle Rule** -- *expanded rule; banked 2026-09-03.*
+
+~~~text
+# THE GATE-OR-STRADDLE RULE (banked 2026-09-03). A probe that prints the same thing in both worlds (a syntax check, a load test) is a GATE: it can prove the patch broke nothing, never that it landed. Every car needs at least one probe whose reading MOVES. Label gates as gates when recommending them, so a green gate is never mistaken for a witnessed landing.
+~~~
+
- **The Generated-Not-Authored Rule** -- *expanded rule; banked 2026-07-20.*
~~~text
@@ -1930,6 +2007,17 @@ Entries are alphabetical, numbers spelled as spoken.
turn only when every car is already justified by evidence present when the
answer is written. Never say "if this prints X, apply the next patch." That is
an uncompiled conditional handed to a tired person.
+- **Ignition Is A Sentence** -- *expanded rule; banked 2026-09-24.*
+
+~~~text
+# IGNITION IS A SENTENCE (banked 2026-09-24). When patched code must be run,
+# reloaded, restarted, sourced, or otherwise actuated before an AFTER receipt
+# can mean anything, close PATCHES with exactly one plain imperative:
+# `Ignition: <exact command or action>.` If nothing needs ignition, say
+# `Ignition: none.` Never imply ignition by describing expected output, and
+# never make the human infer the command from prose.
+~~~
+
- **The Ignition Rule** -- *the patched code must RUN before the AFTER tap.*
Banked 2026-07-23, lived the same day. Between PATCHES and PROMPT sits an
act that had no name until now -- MAKING THE PATCHED CODE RUN, so the AFTER
@@ -2017,6 +2105,12 @@ Entries are alphabetical, numbers spelled as spoken.
THAT expression and not a plausible neighbour. Sibling: THE NIX-FILE LINT
PROBE, where ruff parsed flake.nix as Python and printed 2,544 correct
errors about the wrong question.
+- **The Indented Quote Rule** -- *expanded rule; banked 2026-09-03.*
+
+~~~text
+# THE INDENTED QUOTE RULE (banked 2026-09-03). To quote a template that itself contains code fences, indent it four spaces instead of fencing it: an indented block has no closing delimiter, so nothing inside it can end it early. Costs the language tag; buys correctness. Fences stay for everything else.
+~~~
+
- **The Instrument Decides the State** -- *expanded rule; banked 2026-09-08.*
~~~text
@@ -2127,6 +2221,20 @@ Entries are alphabetical, numbers spelled as spoken.
terminal and "guided capture requires a TTY on stdin before browser launch"
as a compile receipt. Two lanes, two strings, one command -- the pair
discriminated exactly as predicted, and neither reading alone could have.
+- **The Lane-Exclusive Branch** -- *expanded rule; banked 2026-08-03.*
+
+~~~text
+# - EARMARK: THE LANE-EXCLUSIVE BRANCH (banked 2026-08-03, canary-witnessed):
+# some branches can fire in ONE lane only. prompt_foo's de-prefixed-command
+# hint lives inside main()'s file loop, so no hand-run terminal can ever
+# reach it. That is neither lane agreement nor LANE-DISAGREEMENT but a THIRD
+# case, and its only possible witness is a MANUFACTURED failure planted in
+# the lane that owns it. COROLLARY -- RETIRE THE CANARY: an instrument that
+# fires on EVERY run is noise wearing an instrument's costume, and it
+# recreates the trained-to-skip-warnings failure it was built to convict.
+# Witness once, then delete the line. Sibling of REFUSAL-ONLY WITNESS.
+~~~
+
- **The Last-Inch Rule** -- (banked 2026-07-31, two convictions in two days):
the transformation NEAREST THE READER is the one nobody audits, and it can
destroy a result that every upstream stage computed correctly. CONVICTION A
@@ -2172,6 +2280,20 @@ Entries are alphabetical, numbers spelled as spoken.
# waive human review, and event presence does not prove complete bodies.
~~~
+- **The Live-Prompt Mirage** -- *expanded rule; banked 2026-07-23.*
+
+~~~text
+# THE LIVE-PROMPT MIRAGE (banked 2026-07-23, dot-counted): a background job
+# still writing to the tty after the foreground process exits makes a WORKING
+# shell look hung. Count the emitter's cadence before diagnosing a hang -- the
+# browser-poll subshell prints one dot per second, so 22 dots, the door-2
+# message, `(nix) pipulate $`, then 8 more dots is a prompt that was live at
+# second 22 and got painted over for 8 more. The Enter that "unstuck" it only
+# redrew a prompt already accepting input. Corollary: a gate that leaves
+# noise-generating background jobs running BEHIND it has not delivered quiet.
+# Move the gate above the noise, never the noise below the gate.
+~~~
+
- **The Locator That Pointed At Nothing** -- *expanded rule; banked 2026-08-28.*
~~~text
@@ -2311,6 +2433,25 @@ Entries are alphabetical, numbers spelled as spoken.
nonzero enumeration in this shape, and a fixed rendering for it (one
line per call, the four points in order) so the enumeration is grep-able
across cartridges.
+- **The Model Follows The Map Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# - EARMARK: THE MODEL FOLLOWS THE MAP RULE (banked 2026-07-22, blind-test witnessed): capability prose is actuation. A summoned model that invokes a nonexistent tool named by our onboarding map is following instructions correctly; the map is defective. Every first-turn capability name must be generated from or mechanically validated against current source before shipping.
+~~~
+
+- **The Mount** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# THE MOUNT (banked 2026-07-19, witnessed same compile): the zeroth beat.
+# <leader>m runs mount_sandworm(): full saddle (Probe / Context / Patches /
+# Ignition /
+# Prompt / 🎤) dropped at the cursor -- blank line replaced, non-blank
+# preserved with insert-below -- landing in insert mode after **MikeLev.in**: .
+# Witness: receipt shows def@568 + map@663, "Probe:" literal migrated to
+# 574 (once), clean headless load. \j cuts the slate, \m mounts, \k
+# dismounts: three keys bracketing Probe, Patch, Prompt.
+~~~
+
- **The Name Is Not The Value** -- *expanded rule; banked 2026-08-28.*
~~~text
@@ -2390,6 +2531,18 @@ Entries are alphabetical, numbers spelled as spoken.
# and a § key in foo_files.py the third.
~~~
+- **The Nix-File Lint Probe** -- *expanded rule; banked 2026-08-21.*
+
+~~~text
+# - EARMARK: THE NIX-FILE LINT PROBE (banked 2026-08-21, receipt-witnessed):
+# a probe that passes a non-Python file to ruff produces thousands of
+# invalid-syntax errors that read as catastrophic repo rot. Receipt: the
+# dismount compile's four-file statistics probe included flake.nix and
+# printed 2,544 errors, 2,394 invalid-syntax -- ruff parsing Nix as Python.
+# Sibling of INCOMMENSURABLE MEASUREMENTS: a correct number about the wrong
+# question. Lint probes name .py files only.
+~~~
+
- **NIX_DEVELOP_DELAY CONVICTED** -- (2026-07-21, receipts banked): warm hydration of .#quiet measured 12.5s/12.2s hand-run vs 1.0s in-compile -- BIMODAL. CAUSAL CLAIM RETRACTED 2026-08-01: this blamed a gitignored flake.lock and .gitignore carries no flake.lock entry (operator reports the lock is now pinned as intended, and `ndq` is fast enough to run casually). The MEASUREMENT stands; the EXPLANATION is now UNEXPLAINED and must be re-derived before anyone cites it. Conviction shape: a model read this comment and repeated it as a fact about a file while .gitignore sat in the same payload -- THE LAST-INCH RULE with the model as the last inch, and a CVR sentence wearing an FDR's typeface. A 3.5s constant cannot track a bimodal distribution (too slow for hits, catastrophic for misses; Desktop 7's full `nix develop` tabs are strictly slower). SENTINEL RIDE scoped: the TYPED-AHEAD SENTINEL -- autognome types cd X, nix develop .#quiet, and touch /tmp/autognome_ready_N in one burst; all three buffer in the pty and the touch executes only when a live shell drains the queue; poll the file with a timeout. Zero flake edits, arrows point down the ziggurat, and the cure's mechanism IS the pty type-ahead claim -- verify that claim (transcript receipts) before implementing. Known fracture: full-shell tabs end blocked in server.py (no stdin reader), so buffered lines become ghost commands that fire at the next prompt.
- **NixOS Selenium 127** -- (banked 2026-07-20, receipt-witnessed same day): Selenium Manager auto-downloads an FHS-linked chromedriver into ~/.cache/selenium that dies status-127 on NixOS -- no /lib64 dynamic linker (ldd convicted it: libnss3/libnspr4/libglib "not found"). Fix: resolve the Nix driver via shutil.which('undetected-chromedriver') -- HYPHEN, the exact name scraper_tools.py already uses; bare 'chromedriver' and the UNDERSCORE variant are both MISSING on PATH. Conviction: a helper checking the wrong names is a silent no-op that STILL commits green ("refactor: implement PATH-resolved chromedriver" landed, changed only the log line, and the 127 survived until the hyphen name landed). Same disease as the uvx/Rustkyll stub-ld earmark; browser + driver stay paired because both track one nixpkgs pin (chromium 150 == undetected-chromedriver 150). weblogin.py and all five apps/440 Chrome instantiations now route through this resolution. SECOND CONVICTION 2026-09-27, the lanes swapped: connectors/botify.py's _admin_cookies_inner was written on the Mac during the blackout ride and passed uc.Chrome no driver path, so the first census ever run on Prime died at the downloaded driver's exit 127 in 1.2 s, twice, the second time after exit and ndq, and the refusal blamed a locked profile; the car emitted at deed 1621 resolves the hyphenated driver and the flake's chromium there, prints both before the launch, and makes a 127 name the loader. WITNESSED 2026-09-27 (deed 1622): the compile-lane census read the pair at 150.0.7871.128 both and the downloaded driver at exit 127 with the stub loader's own sentence, and the operator's census printed both store paths and harvested in 7.8 s.
- **No Heredoc Inside An Interpolated Nix String** -- *expanded rule; banked 2026-08-05.*
@@ -2398,7 +2551,66 @@ Entries are alphabetical, numbers spelled as spoken.
# - EARMARK: NO HEREDOC INSIDE AN INTERPOLATED NIX STRING (banked 2026-08-05, main-breaking): a bash heredoc whose terminator sits inside a Nix indented string that is itself INTERPOLATED into another indented string can lose its column-0 alignment, after which bash swallows the rest of the shellHook to EOF. Conviction: a cat-heredoc added to miscSetupLogic broke nix develop on main for every user; the identical pattern in runScript -- a standalone writeShellScriptBin, never interpolated -- has worked for years. THE MECHANISM IS UNWITNESSED: the BEFORE tap on the generated hook text was never taken (the operator healed main first, correctly), and it is deliberately NOT being reconstructed, because the forward blast radius is zero once the pattern itself is banned. FALSIFIED from raw source: every line of miscSetupLogic sits at exactly 10 spaces, so no under-indented line dragged the minimum down. PRESCRIPTION: write multi-line files from a shellHook with ONE printf and never a heredoc, and syntax-check the generated hook before any commit that touches it.
~~~
+- **No Placeholders In Paste-Ready Lines** -- *expanded rule; banked 2026-08-30.*
+
+~~~text
+# NO PLACEHOLDERS IN PASTE-READY LINES (convicted 2026-08-30, both lanes): <NAME> in a shell line is a redirection from a file called NAME -- "No such file or directory" -- silent in the compile lane, loud in the operator lane, dead in both. Write "$NAME" and put `export NAME=...` once on the line above; a variable runs verbatim, a placeholder needs an edit the human will not make.
+~~~
+
+- **The No-Dead-Cars Rule** -- *expanded rule; banked 2026-07-20.*
+
+~~~text
+# THE NO-DEAD-CARS RULE (banked 2026-07-20): every fenced patch block emitted
+# is a live actuator, regardless of surrounding prose. Never ship a malformed
+# block with an "ignore this / strike that" note -- the clipboard lane cannot
+# hear prose, and `patch` grabs whatever block the hand copies. Conviction:
+# the END_REPLACE_MARKER_NOTE dead car of 2026-07-19 rode `patch` into
+# apply.py and was stopped only by the AST airlock (rerun cost, zero
+# regression -- the fence held). If a block is wrong, delete it before
+# responding; a correction note is not a coupling pin.
+~~~
+
+- **The Notary Amendment** -- *expanded rule; banked 2026-07-30.*
+
+~~~text
+# - THE NOTARY AMENDMENT (banked 2026-07-30, source-witnessed): the dismount is
+# seven beats, not four -- TLDR (0), VERIFY, BANK, DANGLING, SEED, CLOSING (5),
+# NOTARIZE (6) -- closed by a FINALITY clause that forbids any five-car train
+# after beat 6. The sealed foo-<hash8>-NN.zip is the deed; the CRC is the
+# signature. A published article is an archive entry, not an open thread.
+~~~
+
+- **One Operator Interface** -- *expanded rule; banked 2026-09-24.*
+
+~~~text
+# ONE OPERATOR INTERFACE (banked 2026-09-24, same conviction). For this
+# operator, each patch car already has four controls: patch, app, d, m. Emit the
+# SEARCH/DIVIDER/REPLACE payload and let those controls actuate, inspect, and
+# commit it. DO NOT also emit expanded duplicates such as `cat patch | python
+# apply.py`, `git diff`, `git add`, or `git commit`. An ALREADY APPLIED receipt
+# caused by the model telling the human to actuate the same car twice is not a
+# safety check; it is duplicate work generated by the model.
+~~~
+
- **One Timeline, No Previews** -- every command in the response appears exactly once, in the section where it executes, in execution order -- PROBES (read-only) first, then PATCHES as numbered cars with any dependent actuator or ignition as the LAST cars, then PROMPT. A command that depends on a patch is never quoted above that patch, not as a preview, not "for later"; if it must be mentioned early, name it ("Car 3, the smoke") and show nothing. Convicted 2026-09-28 (deed 1662): the git add for a file a WRITE_FILE car creates rode in its own fence ABOVE that car's fence; the operator pasted in reading order, git answered fatal: pathspec, and the line ran again after app; a hand fence that depends on a car sits below it, in the order the hand will meet them. A CAR OUTSIDE THE TRAIN DID NOT RUN (second conviction 2026-09-29, deed 1693; the operator's words: "instructions to do-this or do-that outside where I'm expecting you to tell me is tantamount to sabotage"): the WRITE_FILE car for SVB-133's deliverable and its git add fence rode in the reply's kata section, above the train, the operator ran the train and never them, the next compile read TICKET_DIR_ABSENT, and the compaction summary said WRITTEN. Every car and every hand step the train needs (a git mv, a walk typed by hand) is a numbered car in (3) PATCHES, a plain fenced command under its prompt line and never a banner; the operator's own habits (patch, app, d, m, git push, the paste into context.txt, prompt, bff) are never written, because the operator does them unasked and a written one costs a re-read to learn whether something changed; a repo step written outside the train is a step that did not happen, and the one step no terminal can take rides above the train under THE HALT BANNER, below. RULED 2026-09-29 (deed 1703, the operator's words): "NEVER use HALT inside the 5-Car Train. ALWAYS use HALT for OOB things that need my attention outside the 5-Car Train."
+- **The One-Fence-Per-Hand-Step Rule** -- *expanded rule; banked 2026-09-03.*
+
+~~~text
+# THE ONE-FENCE-PER-HAND-STEP RULE (banked 2026-09-03). Operators paste fenced blocks whole; a smoke command and the full sweep it was meant to gate, sharing one fence, fire together and the smoke never happens. When a hand-run step exists to be INSPECTED before the next, each step gets its own fence. Second conviction 2026-09-28 (deed 1635): a reseal named in Car 11's prose, between app and d, was never typed, and the drifted art shipped through the 2.65 release with index.md left untouched; the same step as its own numbered car (deed 1636's Car 5) was typed before the train even started. A hand step is a car or it is missed, the operator's words.
+~~~
+
+- **One-Liner Corollary** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# ONE-LINER COROLLARY (banked 2026-07-19): a `!` line is ONE shell command.
+# Multi-line probes shatter in the executor (unexpected-EOF, then each
+# continuation line parsed as a phantom file path -- 2026-07-19 compile log
+# is the conviction). Collapse with semicolons or do not echo. And when the
+# evidence rides stderr (`time`, cache counters, -X importtime), append
+# 2>&1 or the receipt arrives empty; the compiler's own [N.NNNNs] execution
+# annotation is the fallback timing witness of last resort.
+~~~
+
- **The Operator Is a Variable** -- (banked 2026-09-08, three convictions in one ride): a straddle holds the world constant and changes ONE thing, but the operator lives in the world and acts on it between taps -- toggles a setting, runs the actuator early, runs it again -- and every such act is a SECOND manipulated variable no probe was told about. CONVICTIONS, one ride: a census labeled "reads identically by design" flipped Profile 2's sync_metadata from True to False between the hand tap and the compile because the operator toggled Chrome Sync, while the script refused Default, the only declared profile, and "no luck" was read off a verdict about a different subject; a dry-run predicted to read DRY_RUN read IN_SYNC because the operator ran the real sync before the compile; a backup listing predicted at two files read three because the operator ran a purge the article described only in prose. In every case the receipt was TRUE about the world and silent about which variable moved. STANDING CONSEQUENCE: when a reading moves by more than the patch can explain, ask what the operator did between taps before crediting or blaming the patch, and write operator actions taken between taps into the article as loudly as patches. Sibling of THE PRE-COMPILE ACTUATOR RULE (one instance: the actuator run early) and of THE STRADDLE IS A CONTROLLED EXPERIMENT, whose four named confound controls do not cover the experimenter's own hands.
- **The Out-of-Band (OOB) Edit Rule** -- (banked 2026-07-21, articulation-banked --
pure judgment): an edit is a DELIMITER COLLISION when the text to be mutated
@@ -2414,6 +2626,12 @@ Entries are alphabetical, numbers spelled as spoken.
vim skills make the cut. Collision-free edits stay in the airlocked
SEARCH/REPLACE lane; collision-class edits route to the human as actuator.
The airlock is for content that does not speak the airlock's own language.
+- **The Page That Holds In Both Worlds** -- *expanded rule; banked 2026-09-15.*
+
+~~~text
+# THE PAGE THAT HOLDS IN BOTH WORLDS (banked 2026-09-15, witnessed once). A public page that asks a stranger to test a machine is written before anyone knows what the machine's evidence will carry, so its instruction must stay true either way. Stop three said a good answer admits the preview lacks the server's sentence; the preview lacked it, ChatGPT 6 said so and pointed at source.html, and the page taught the lesson instead of promising a word the bundle never held. THE CABOOSE-VERDICT COROLLARY aimed at a reader who cannot ask a follow-up.
+~~~
+
- **The Pending Amendment Rule** -- *expanded rule; banked 2026-07-19.*
~~~text
@@ -2478,6 +2696,12 @@ Entries are alphabetical, numbers spelled as spoken.
because main() returns 2 for "plan not ready" and argparse returns 2 for bad
arguments. One number, two worlds. Read stderr or read plan["ready"]; never
grade that one on the exit code alone.
+- **The Pre-Compile Actuator Rule** -- *expanded rule; banked 2026-09-01.*
+
+~~~text
+# THE PRE-COMPILE ACTUATOR RULE (banked 2026-09-01). A straddle probe answers honestly only when its two taps land on OPPOSITE sides of the actuator. The `diff -q` sync probe was designed as three states (0 in sync, 1 patched-not- copied, 0 after the cp) and printed 0 in BOTH receipts, because the cp ran before the compile -- the same printout in both worlds, which is the DISCRIMINATION QUESTION failing inside a probe written to answer it. Prefer a probe that reads the PROPERTY at the destination (does the working copy compile?) over one that COMPARES two files; the property probe cannot be defeated by running the actuator early.
+~~~
+
- **The Probe Dedup Corollary** -- (convicted 2026-07-21): identical `!` lines dedupe in parse_file_list_from_config (seen_files), so the deliberate double-tap timing probe produced ONE receipt. A re-run must vary the command text (append `; : tap2`), never merely repeat the line.
- **The Probe Echo Rule** -- *before/after symmetry.* Every probe recommended
for hand-execution must also be echoed verbatim as a `!` line into the next
@@ -2601,6 +2825,29 @@ Entries are alphabetical, numbers spelled as spoken.
therefore unshippable. That is a STRANDED ARTIFACT, not a security gap --
there is no v0.1.0 in the wild for the fix to be a fix to. It costs nothing
today and will confuse whoever finds it later.
+- **Push Is Assumed** -- *expanded rule; banked 2026-09-24.*
+
+~~~text
+# PUSH IS ASSUMED (banked 2026-09-24, operator's standing rule). Immediately
+# after the final m in a patch series the operator runs git push to put the
+# newest commits offsite. Do not emit blast. Do not emit git push. Do not make
+# pushing conditional on another reading. The operator owns that invariant and
+# performs it automatically; repeating it spends attention without adding
+# information.
+~~~
+
+- **The Quoted-Hash Amendment** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# THE QUOTED-HASH AMENDMENT (banked 2026-07-19, witnessed same day): `!`
+# lines treat only a two-plus-space " # " gap as an inline comment; a `#`
+# inside a quoted shell argument survives to the executor intact.
+# Conviction: the pin-count canary (grep -c on '^# 📌') was decapitated at
+# its quoted hash into an unterminated-quote EOF. Witness: the very next
+# compile carried that same probe returning 4 -- and the parser-demo probe,
+# itself quoted-hash-bearing, survived to print the old splitter's stub.
+~~~
+
- **The Read-Write Probe** -- *expanded rule; banked 2026-08-04.*
~~~text
@@ -2770,6 +3017,27 @@ Entries are alphabetical, numbers spelled as spoken.
THE SILENCED CHANNEL (a verdict that reads a channel the instrument closed);
cousin of THE FOLDER IS A VARIABLE (a hand step that prints the same thing in
both worlds).
+- **The Rewrite Tax** -- *expanded rule; banked 2026-09-02.*
+
+~~~text
+# THE REWRITE TAX (banked 2026-09-02). A history rewrite on a repo whose installer auto-pulls --ff-only breaks the auto-update on EVERY existing install until each is hand-reset (git fetch origin && git reset --hard origin/main) or rebuilt (rm -rf and reinstall -- the disposable workshop is the cheap path and the reason it was affordable). It also orphans every commit hash from the rewrite point forward, including the ones published article ledgers link to. A rewrite is a clean-up, never an un-publish: forks, prior clones and host caches keep the blob. Price these BEFORE the push.
+~~~
+
+- **The Ride Contract** -- *expanded rule; banked 2026-07-20.*
+
+~~~text
+# THE RIDE CONTRACT (banked 2026-07-20): a discussion is a SERIES of worm
+# rides, and the series' shape is declared at the mount: the opening
+# article states the destination AND the arrival conditions -- the receipts
+# that must exist before dismounting is permitted. Worm-hopping continues
+# while conditions are unwitnessed; the moment receipts witness them,
+# DISMOUNT (\k) instead of steamrolling the momentum into scope creep -- an
+# unbanked win is a Murphy seam where catastrophe slips in. Ulysses comes
+# off the mast once the sirens are astern: bank the winnings (rules,
+# todos, pins), publish the article, seed the next ride's first compile.
+# Arrival without a dismount is not arrival.
+~~~
+
- **The Saddle Amendment** -- *expanded rule; banked 2026-07-28.*
~~~text
@@ -2788,6 +3056,18 @@ Entries are alphabetical, numbers spelled as spoken.
# Ref: the MCK build ride (see THE MOTHER CAT KATA above).
~~~
+- **The Same-Car Label Rule** -- *expanded rule; banked 2026-07-23.*
+
+~~~text
+# THE SAME-CAR LABEL RULE (banked 2026-07-23, operator's ruling; sibling of
+# GENERATED-NOT-AUTHORED): when a gate MOVES, every string describing what it
+# gates moves in the SAME car. A menu describing its old placement is not
+# stale documentation -- it is a lie told at the exact moment the user is
+# deciding, and a lying menu is worse than no menu. Applies to anything read
+# AT the decision point: labels, subtitles, confirmations, and any promise of
+# a deadline that no longer exists.
+~~~
+
- **The Screenshot Is Not a Locator** -- (banked 2026-09-11, two exchanges lost).
Botify's Confluence pages for custom link attributes say "go to the project
page on django admin" and show the field ONLY as a screenshot. Two admin
@@ -2952,6 +3232,20 @@ Entries are alphabetical, numbers spelled as spoken.
flip. Pick witnesses from lines that cannot wrap (dated headers like 'BANKED
2026-07-29 (same-day flip'), and when the patched text is your own, confirm
the phrase sits on one line before recommending the probe.
+- **The Source-Of-Source Secret Scrub Rule** -- *expanded rule; banked 2026-08-28.*
+
+~~~text
+# THE SOURCE-OF-SOURCE SECRET SCRUB RULE (banked 2026-08-28,
+# receipt-witnessed): move credential EPHEMERA upstream only when the match is
+# high-precision -- query/JSON/Bearer syntax or a vendor-issued prefix. Preserve
+# the smallest stable family discriminator and replace the entire issued suffix
+# with <redacted:N>. Identity and PII substitutions remain downstream, because
+# a false positive there must never rewrite journal.txt. Witness: scrub_oauth
+# masked Google, Slack, and Anthropic fixtures, left
+# `session = requests.Session()` unchanged, and scan_secrets reported
+# downstream_hits=0.
+~~~
+
- **Spell Out The Tool-Call You Are Making Of The Human** -- *expanded rule; banked 2026-09-22.*
~~~text
@@ -2971,12 +3265,35 @@ Entries are alphabetical, numbers spelled as spoken.
# bibliography."
~~~
+- **The Stale Overlay** -- *expanded rule; banked 2026-08-05.*
+
+~~~text
+# - EARMARK: THE STALE OVERLAY (banked 2026-08-05, Manifest-arbitrated): the context.txt pasted into an article and the context.txt the compiler READ can disagree within a single turn, and only the Manifest's LIVE COMMAND RECEIPTS can tell them apart. CONVICTION: a turn pasted three new probe lines while the compile executed the five from two compiles earlier -- the pasted context described a file the compiler never opened. STANDING CONSEQUENCE: the Manifest is the sole authority on what ran; when the pasted overlay and the receipts disagree, rule from the receipts and say so out loud. The map can outrun the territory inside one turn.
+~~~
+
- **The Stat-Cache False Positive** -- *expanded rule; banked 2026-08-04.*
~~~text
# THE STAT-CACHE FALSE POSITIVE (banked 2026-08-04, receipt-witnessed both lanes): `git diff-index --quiet` decides from the index's CACHED STAT DATA -- dev, inode, mtime, size -- and short-circuits before comparing content. Any operation that rewrites files while carrying an index along (cp -r, rsync without -a, a restored backup, a container layer) makes a byte-identical tree report DIRTY. Receipt: clone -> `cp -r src/. dst/` -> after_cp=1, after_refresh=0, reproduced identically in the operator and compile lanes. WHY IT SURVIVES SO LONG: `git status` refreshes the index as a side effect, so the false positive has ALWAYS healed by the time a human types the diagnostic. The symptom is structurally unobservable by the only method anyone reaches for. STANDING CONSEQUENCE: any automated dirty-tree check runs `git update-index -q --refresh 2>/dev/null || true` first. It clears ONLY stale entries, so a genuinely modified file still reports dirty and a halt-don't-destroy gate keeps its teeth.
~~~
+- **Stderr Merge Amendment** -- *expanded rule; banked 2026-07-19.*
+
+~~~text
+# STDERR MERGE AMENDMENT (banked 2026-07-19): the `!` executor now folds
+# stderr into every receipt (fenced `--- stderr ---`, tail-capped 2000).
+# The 2>&1 workaround is retired for new probes. Corollary ruling: probe
+# counters gate on the interesting case (misses>0) -- meaningful silence
+# over unconditional chatter, because silence is backed by an independent
+# timing witness. A quiet system and a dead one must differ in receipts.
+~~~
+
+- **The Step That Runs Once** -- *expanded rule; banked 2026-10-02.*
+
+~~~text
+# - EARMARK: THE STEP THAT RUNS ONCE (banked 2026-10-02, self-convicted at deed 1779): a witness step never chains a one-time change to its reading with &&. Step 2 read mv ~/.config/pipulate/voice ~/.config/pipulate/voice.was && nix develop; pasted inside the nix shell, the mv ran and nix develop was refused, and every paste after exit stopped at mv, so the witness took four tries and left voice.was on the Mac. The change goes on its own line, written so a second paste does no harm, and the reading on the next.
+~~~
+
- **The Stewardship Rule** -- *expanded rule; banked 2026-07-22.*
~~~text
@@ -3061,6 +3378,17 @@ Entries are alphabetical, numbers spelled as spoken.
# - EARMARK: THE SUCCESS-ONLY WITNESS (banked 2026-08-02, cold-start ride six): a claim observed ONLY succeeding is indistinguishable from a claim that CANNOT fail, exactly as a guard observed only refusing is indistinguishable from one broken shut. Conviction: synthesize_and_play called wait() and DISCARDED the exit code while stderr went to DEVNULL, so a player killed by SIGFPE printed its reason into the void and the function returned True anyway -- speak_text reported success, the rider printed nothing, and the human heard silence beside a green console. The instrument that was supposed to report the failure was the thing hiding it. DISCRIMINATING QUESTION for act-claims: what does this print in the world where the act did not happen? If the answer is "success," it is not a receipt. This is also the missing third suspect from the 2026-07-26 THE DEMO WENT SILENT todo, which named transport and engine and never once looked at the subprocess exit status. Sibling of REFUSAL-ONLY WITNESS (one branch of a state machine) and of the MECHANICAL TEST in ATTRIBUTED-VOICE (a verb naming an act that no code performed).
~~~
+- **The Surface-First Routing Rule** -- *expanded rule; banked 2026-07-22.*
+
+~~~text
+# THE SURFACE-FIRST ROUTING RULE (banked 2026-07-22, blind-test witnessed):
+# Pipulate has two Golden Paths because it has two execution surfaces.
+# Prompt Fu is the compile-time Unix-pipe/cartridge lane; FastHTML/MCP is the
+# runtime app-state/tool lane. Identify the active surface before recommending
+# an actuator. pipeline_state_inspector is a valid MCP/FastHTML drill-down,
+# never the default first move inside a Prompt Fu ride.
+~~~
+
- **The Talmud-Page Rule** -- *expanded rule; banked 2026-07-22.*
~~~text
@@ -3158,6 +3486,12 @@ Entries are alphabetical, numbers spelled as spoken.
# An art car may never declare "no ignition required".
~~~
+- **Three-Standards Superposition** -- *expanded rule; banked 2026-07-20.*
+
+~~~text
+# - EARMARK: THREE-STANDARDS SUPERPOSITION (banked 2026-07-20): AGENTS.md = one freeform signpost file, nearest-ancestor wins; Agent Skills = folder fronted by SKILL.md YAML frontmatter, progressive disclosure (Notebooks/.agents/skills already conforms); OKF = markdown+YAML bundle with index.md and one required field (type) -- trimnoir _posts + holographic shards + llms.txt are one avant la lettre. DIRECTION OF TRAVEL for scripts/: every new capability lands as a tiny gmail-shaped connector command; SKILL.md/OKF files are SIGNPOSTS to executable truth, never second implementations. Symlinks in spirit, never on disk. WALLET LESSON (jq conviction 2026-07-20): connectors.json carries non-object top-level entries -- every wallet reader type-checks before descending.
+~~~
+
- **The Three-Tier Amendment** -- (banked 2026-08-06, paired-lane receipt): the
standing consequence above stops ONE TIER SHORT and is therefore a trap for
any word that must be reachable by a CHILD process. There are THREE tiers,
@@ -3209,18 +3543,47 @@ Entries are alphabetical, numbers spelled as spoken.
# an explicit or implicit "your turn" = the Tortoise is being summoned.
~~~
+- **The Two-Hand Test Is Not A Test** -- *expanded rule; banked 2026-08-04.*
+
+~~~text
+# - EARMARK: THE TWO-HAND TEST IS NOT A TEST (banked 2026-08-04, operator-
+# refused): a procedure asking a human to type in terminal A, then type in
+# terminal B while A still runs, has no receipt, no reproducibility and no
+# defined failure mode. If a behavior needs two processes, the witness is a
+# SCRIPT that spawns both and asserts on the output, or the behavior stays
+# honestly UNWITNESSED. Conviction: the one-workshop echo is
+# instantiation-green and behaviorally unwitnessed to this day, because the
+# only test ever offered for it was a two-terminal choreography.
+~~~
+
- **The Unasked Second Window** -- *expanded rule; banked 2026-09-16.*
~~~text
# THE UNASKED SECOND WINDOW (banked 2026-09-16, operator-convicted three times in one minute). A newcomer's word opens what its name says and nothing more; a second file in a split, added to solve a problem the operator had not raised, is a second lesson at the exact moment the first was meant to be the whole lesson, and it lands in the same car as the ruling they did ask for. Conviction: epr opened the prompt router and prompt.md in one -o split for one turn, the operator hit the split three times on the way out the door, and the revert was one car. Same disease, smaller: the ignition spelling handed over was cpr "smoke", a probe's argument wearing the command's clothes. Name the ignition in the newcomer's own spelling, and answer the unraised question as a TODO, never as a feature riding the train. Sibling of THE COACHMAN'S VETO: a train is a proposal, and an unasked car costs exactly what a wrong one does.
~~~
+- **The Unsorted Cap** -- *expanded rule; banked 2026-09-15.*
+
+~~~text
+# THE UNSORTED CAP (banked 2026-09-15). rg -l and a multi-file rg -n print files in the order their searches finish, so one census printed nine files in two orders across the hand-run and compile lanes, and a head -N on that output cuts a different subset each run. Sort before you cap, and compare unsorted listings as sets. Sibling of THE CAP THAT HID THE ANSWER.
+~~~
+
- **The Verifier That Never Ran** -- *expanded rule; banked 2026-08-05.*
~~~text
# - EARMARK: THE VERIFIER THAT NEVER RAN (banked 2026-08-05, same conviction): a verification block placed AFTER the action it verifies is dead code if the action can kill the reporter, and its silence is indistinguishable from success. flake.nix's [4/4] block held `sleep 12`, a pgrep re-count, and three verdict branches -- none had EVER executed, while a green Atomic Deployment Complete printed underneath every time. THE DISCRIMINATION QUESTION applied to a MISSING line: what does this print in the world where the verifier died? The same checkmark. STANDING CONSEQUENCE: when a receipt block has an expected line that is ABSENT, treat the absence as the finding; do not read the surviving lines as the whole receipt. Third shape in the family -- REFUSAL-ONLY WITNESS is a branch never observed, THE SUCCESS-ONLY WITNESS is a failure never reportable, this is a witness never REACHED.
~~~
+- **The Warn-Mode No-Egress Rule** -- *expanded rule; banked 2026-08-28.*
+
+~~~text
+# THE WARN-MODE NO-EGRESS RULE (banked 2026-08-28, receipt-witnessed): a
+# disclosure profile with secrets=WARN is a local inspection lane, not an
+# automatic transport lane. It may write foo.zip and an explicit -o file, but
+# clipboard and SSH-bridge egress stay disabled. Witness:
+# clipboard_egress_allowed read warn=False, block=True, explicit_no=False.
+~~~
+
- **The Warning That Was The Hazard** -- *expanded rule; banked 2026-08-25.*
~~~text
diff --git a/foo_files.py b/foo_files.py
index 5bc6b04..2a08978 100644
--- a/foo_files.py
+++ b/foo_files.py
@@ -354,27 +354,11 @@ And then we demonstrate a level of competence like so:
# § ONE TIMELINE, NO PREVIEWS (banked 2026-09-28; second conviction 2026-09-29) -- Show each command you provide exactly once, only where it executes and in execution order: never preview a command above a patch it depends on; put every non-routine repo or hand step inside (3) PATCHES; do not write the operator's patch/app/d/m/git-push/context/prompt/bff reflexes; reserve HALT above the train only for a step no terminal can take.
# § THE HUMAN IS NOT THE BRANCH PREDICATE (banked 2026-09-24) -- Never make the operator evaluate a conditional between patch cars: if a later car depends on evidence an earlier car will create, stop after the earlier car and let the next compile decide.
#
-# ONE OPERATOR INTERFACE (banked 2026-09-24, same conviction). For this
-# operator, each patch car already has four controls: patch, app, d, m. Emit the
-# SEARCH/DIVIDER/REPLACE payload and let those controls actuate, inspect, and
-# commit it. DO NOT also emit expanded duplicates such as `cat patch | python
-# apply.py`, `git diff`, `git add`, or `git commit`. An ALREADY APPLIED receipt
-# caused by the model telling the human to actuate the same car twice is not a
-# safety check; it is duplicate work generated by the model.
+# § ONE OPERATOR INTERFACE (banked 2026-09-24) -- Give the operator the patch payload for their established patch, app, d, m controls without also emitting duplicate expanded application, diff, staging, or commit commands that would actuate the same car twice.
#
-# PUSH IS ASSUMED (banked 2026-09-24, operator's standing rule). Immediately
-# after the final m in a patch series the operator runs git push to put the
-# newest commits offsite. Do not emit blast. Do not emit git push. Do not make
-# pushing conditional on another reading. The operator owns that invariant and
-# performs it automatically; repeating it spends attention without adding
-# information.
+# § PUSH IS ASSUMED (banked 2026-09-24) -- Leave the operator's habitual final push to their established workflow and omit redundant blast or git push instructions and extra conditions from the response.
#
-# IGNITION IS A SENTENCE (banked 2026-09-24). When patched code must be run,
-# reloaded, restarted, sourced, or otherwise actuated before an AFTER receipt
-# can mean anything, close PATCHES with exactly one plain imperative:
-# `Ignition: <exact command or action>.` If nothing needs ignition, say
-# `Ignition: none.` Never imply ignition by describing expected output, and
-# never make the human infer the command from prose.
+# § IGNITION IS A SENTENCE (banked 2026-09-24) -- Close PATCHES with one explicit imperative naming the exact command or action needed to run changed code before the AFTER reading, or state Ignition: none, rather than leaving ignition implicit in expected output.
#
# § THE ANSWER IS THE ARTIFACT (banked 2026-09-24) -- Deliver durable findings as copyable response text or the sealed cartridge reproducible from its manifest, and never offer or route them into an unsigned, unversioned host-side Artifact, canvas, or side panel.
#
@@ -403,26 +387,9 @@ And then we demonstrate a level of competence like so:
#
# § THE DIVIDER IS NOT OPTIONAL (banked 2026-09-22) -- Emit every patch block as a Target line immediately followed by SEARCH, DIVIDER, and REPLACE in that order, never invent a closing marker or a four-backtick fence, and count those three protocol markers before handing the block to the actuator.
# § THE KATA'S NAME (banked 2026-07-17) -- Probe, Patch, Prompt: hand-run receipts before, human-actuated mutation during, pre-loaded compile after; titles and section headers say it too. Value: the vocabulary entry Probe / Patch / Prompt in GLOSSARY.md.
-# ONE-LINER COROLLARY (banked 2026-07-19): a `!` line is ONE shell command.
-# Multi-line probes shatter in the executor (unexpected-EOF, then each
-# continuation line parsed as a phantom file path -- 2026-07-19 compile log
-# is the conviction). Collapse with semicolons or do not echo. And when the
-# evidence rides stderr (`time`, cache counters, -X importtime), append
-# 2>&1 or the receipt arrives empty; the compiler's own [N.NNNNs] execution
-# annotation is the fallback timing witness of last resort.
-# STDERR MERGE AMENDMENT (banked 2026-07-19): the `!` executor now folds
-# stderr into every receipt (fenced `--- stderr ---`, tail-capped 2000).
-# The 2>&1 workaround is retired for new probes. Corollary ruling: probe
-# counters gate on the interesting case (misses>0) -- meaningful silence
-# over unconditional chatter, because silence is backed by an independent
-# timing witness. A quiet system and a dead one must differ in receipts.
-# THE QUOTED-HASH AMENDMENT (banked 2026-07-19, witnessed same day): `!`
-# lines treat only a two-plus-space " # " gap as an inline comment; a `#`
-# inside a quoted shell argument survives to the executor intact.
-# Conviction: the pin-count canary (grep -c on '^# 📌') was decapitated at
-# its quoted hash into an unterminated-quote EOF. Witness: the very next
-# compile carried that same probe returning 4 -- and the parser-demo probe,
-# itself quoted-hash-bearing, survived to print the old splitter's stub.
+# § ONE-LINER COROLLARY (banked 2026-07-19) -- Keep each echoed ! probe on one physical line as a complete shell command and retain timing evidence, using the executor's stderr receipt rather than splitting a multiline probe into phantom file includes.
+# § STDERR MERGE AMENDMENT (banked 2026-07-19) -- Rely on the executor's tail-capped stderr receipt for new probes instead of adding the retired 2>&1 workaround, gate counters on interesting cases, and preserve an independent timing witness so quiet success remains distinguishable from a dead process.
+# § THE QUOTED-HASH AMENDMENT (banked 2026-07-19) -- Preserve hashes inside quoted shell arguments when parsing ! lines, recognizing only the designated two-or-more-space inline-comment gap so a quoted regex cannot be truncated into an unterminated command.
# § THE PENDING AMENDMENT RULE (banked 2026-07-19) -- Keep mechanism-behavior amendments PENDING until a compiled receipt witnesses them, bank the status change explicitly, distinguish articulation-only judgment rules, and allow no more than one unwitnessed turn before the mechanism's evidence.
# § THE ACTUATION-BOUNDARY RULE (banked 2026-07-23) -- Bracket execution of changed code with the before and after probes rather than bracketing only its commit, and witness mutating lanes by calling the patched function on real input without writing and verifying that the specimen remains unchanged.
# § THE IGNITION RULE (banked 2026-07-23) -- between PATCHES and PROMPT sits IGNITION, making the patched code RUN so the AFTER tap measures something that happened; it completes the Patch beat and is never a fourth one. If the probe's own command loads the patched file at call time it self-ignites; if the patched thing was read once at entry (shellHook, daemon, cache) ignite it explicitly -- exit then nd, or <F2> -- and every turn NAMES its ignition or declares "no ignition required". Conviction: the vault probe read False inside a compile whose flake patch had landed, committed and pushed, because that shell predated the hook. The straddle brackets EXECUTION, not the commit; ahc is the experiment, not a probe, and it writes, so it fires once, bounded by a BLAST on either side. Grammar: PROBE singular, PATCHES plural, IGNITION singular or none, PROMPT singular.
@@ -439,25 +406,13 @@ And then we demonstrate a level of competence like so:
# is its own chisel-strike.
# § THE DISMOUNT (banked 2026-07-19) -- Dismount a completed ride by verifying its opening goal against this compile's receipts, banking rules and deletions through patches, naming each dangling item in one line, and seeding the next ride with explicit context.txt lines.
# § THE TEMPLATE THAT FORBIDS WHAT IT DEMANDS (banked 2026-09-04) -- a prompt template is one document with one reader, so a beat that demands an artifact and a clause that forbids the only lane it can ship through cancel into a hand edit the operator will not make; when a template's demand changes, grep that same template for every clause that gates it, and make the exemption name the beat by number. Conviction: \k's BANK asked for paste-ready lines while FINALITY said no patches, and two dismounts handed the operator addresses in prose. Sibling of THE SAME-CAR LABEL RULE and THE LABEL THAT PROMISES A SIBLING: this is the gate and the label in one file, contradicting each other.
-# THE MOUNT (banked 2026-07-19, witnessed same compile): the zeroth beat.
-# <leader>m runs mount_sandworm(): full saddle (Probe / Context / Patches /
-# Ignition /
-# Prompt / 🎤) dropped at the cursor -- blank line replaced, non-blank
-# preserved with insert-below -- landing in insert mode after **MikeLev.in**: .
-# Witness: receipt shows def@568 + map@663, "Probe:" literal migrated to
-# 574 (once), clean headless load. \j cuts the slate, \m mounts, \k
-# dismounts: three keys bracketing Probe, Patch, Prompt.
+# § THE MOUNT (banked 2026-07-19) -- Stage the current mount saddle at the cursor with mount_sandworm, replacing a blank line or inserting below preserved nonblank text and entering insert mode after **MikeLev.in**:, so the mount prepares the next Probe, Patch, Prompt ride without overwriting existing prose.
# § THE GENERATED-NOT-AUTHORED RULE (banked 2026-07-20) -- Generate every live-capability payload section from current source during the compile that ships it, using a bounded subprocess and a loud failure placeholder rather than hand-authored tool lists, registry counts, or version statistics.
# § THE ATTRIBUTED-VOICE RULE (banked 2026-07-26) -- a synthesized voice is not evidence of a mind, and the rule covers every UTTERANCE, spoken OR on-screen: scripted narration discloses that it is scripted and never says "I am <persona>", model output NAMES its engine because a name is a receipt and not a costume, and deterministic automation demonstrates THE SYSTEM and never "my capabilities". THE MECHANICAL TEST, in place of judgment: if a string names an ACT -- confirmed, secured, verified, connected, validated, active -- then some code must have PERFORMED that act in the same turn, or the verb changes to what happened (recorded, saved, stored, set), because storing a credential is not testing it and the first real request is the earliest honest moment to claim a connection. Chip O'Theseus is EARNED, never asserted: speak the name only while a model is actually answering with keychain memory live.
-# THE SURFACE-FIRST ROUTING RULE (banked 2026-07-22, blind-test witnessed):
-# Pipulate has two Golden Paths because it has two execution surfaces.
-# Prompt Fu is the compile-time Unix-pipe/cartridge lane; FastHTML/MCP is the
-# runtime app-state/tool lane. Identify the active surface before recommending
-# an actuator. pipeline_state_inspector is a valid MCP/FastHTML drill-down,
-# never the default first move inside a Prompt Fu ride.
+# § THE SURFACE-FIRST ROUTING RULE (banked 2026-07-22) -- Identify the active execution surface before recommending an actuator, using the Unix-pipe and cartridge lane for Prompt Fu and reserving app-state tools such as pipeline_state_inspector for the runtime FastHTML/MCP lane.
# § THE REDUNDANT-GROOVE RULE (banked 2026-07-22) -- Carry both the canonical roster as visible text and its selected files as actual payload content in every compile so the declared map and realized evidence cross-check each other and reinforce the task frame.
@@ -479,31 +434,11 @@ And then we demonstrate a level of competence like so:
# § THE DOUBLE-TAP RULE (banked 2026-07-20) -- Label probes of artifacts written later in the same compile as lagged receipts, name the pipeline ordering that causes the lag, and re-run the identical probe in the next compile to close the before/after comparison.
-# THE RIDE CONTRACT (banked 2026-07-20): a discussion is a SERIES of worm
-# rides, and the series' shape is declared at the mount: the opening
-# article states the destination AND the arrival conditions -- the receipts
-# that must exist before dismounting is permitted. Worm-hopping continues
-# while conditions are unwitnessed; the moment receipts witness them,
-# DISMOUNT (\k) instead of steamrolling the momentum into scope creep -- an
-# unbanked win is a Murphy seam where catastrophe slips in. Ulysses comes
-# off the mast once the sirens are astern: bank the winnings (rules,
-# todos, pins), publish the article, seed the next ride's first compile.
-# Arrival without a dismount is not arrival.
-
-# - THE NOTARY AMENDMENT (banked 2026-07-30, source-witnessed): the dismount is
-# seven beats, not four -- TLDR (0), VERIFY, BANK, DANGLING, SEED, CLOSING (5),
-# NOTARIZE (6) -- closed by a FINALITY clause that forbids any five-car train
-# after beat 6. The sealed foo-<hash8>-NN.zip is the deed; the CRC is the
-# signature. A published article is an archive entry, not an open thread.
-
-# THE NO-DEAD-CARS RULE (banked 2026-07-20): every fenced patch block emitted
-# is a live actuator, regardless of surrounding prose. Never ship a malformed
-# block with an "ignore this / strike that" note -- the clipboard lane cannot
-# hear prose, and `patch` grabs whatever block the hand copies. Conviction:
-# the END_REPLACE_MARKER_NOTE dead car of 2026-07-19 rode `patch` into
-# apply.py and was stopped only by the AST airlock (rerun cost, zero
-# regression -- the fence held). If a block is wrong, delete it before
-# responding; a correction note is not a coupling pin.
+# § THE RIDE CONTRACT (banked 2026-07-20) -- Declare the destination and required arrival receipts at the mount, continue only while they are unwitnessed, and dismount as soon as they hold by banking the winnings, publishing the article, and seeding the next ride rather than extending scope.
+
+# § THE NOTARY AMENDMENT (banked 2026-07-30) -- Close a dismount in the order TLDR, VERIFY, BANK, DANGLING, SEED, CLOSING, NOTARIZE, identify the sealed deed and its checksum, and place no five-car train after NOTARIZE.
+
+# § THE NO-DEAD-CARS RULE (banked 2026-07-20) -- Delete and re-emit a malformed patch block instead of shipping it with an ignore-or-correction note, because every emitted patch fence remains a live actuator regardless of surrounding prose.
# § THE HAND-REPAIR CLAUSE (amended 2026-08-03, missing-target class banked 2026-08-25, malformed-protocol class amended 2026-09-26) -- Repair a refused patch by hand only when apply.py demonstrably parsed and witnessed the body: search-block-not-found is diagnosable, missing-target may receive only its Target after the intact body is printed back, malformed-protocol means visible delimiters failed the grammar and the body was not parsed, and generic no-blocks-found now means no recognizable patch protocol was present; both parser-gate classes are deleted and re-emitted, never hand-repaired.
# § THE CARRIED-DELIVERABLE RULE (banked 2026-07-29) -- Carry each external deliverable's complete current text in Car 5 as one manual-paste block, or explicitly state that there are no deliverables, instead of referring the operator to earlier chat cargo and edits.
@@ -534,30 +469,7 @@ And then we demonstrate a level of competence like so:
# § THE VARIANCE-SUPPRESSION RULE (articulation-banked 2026-07-28) -- sycophancy, the over-broad safeguard and the human gatekeeper are ONE failure clade, variance-suppressors: none loves chaos, each imposes order on disorder it did not author, so the magic mirror collapses toward the flattering centroid, the safeguard over-enforces its boundary and the tribe throws poo at the fence-line. The fan-out is the opposite move, variance-generation as the assay, and the discriminating probe is fence-vs-lean-back: a suppressor reaches for the fence when unauthored disorder appears, a generator leans back into the mess it made, checkable on humans, on models (inject a flawed premise and watch for agreement) and on safeguards. Defend against sycophancy by anchoring the verdict to ground truth the suppressor cannot flatter, never by tone-policing, which only teaches it to throw poo more politely. The axis rides assets/axis_ledger.jsonl with its verdict open pending the three-fresh-thread cross-domain run; the Mouse Army is the vignette: strip the one human gate from an otherwise identical pipeline and variance collapses, competence up, individuation gone.
-# THE BARNEY RESET RULE (banked 2026-07-21, articulation-banked): Trigger
-# when the human says they do not understand. Trigger when the human asks
-# what they are supposed to do. Trigger when confusion survives into a
-# second consecutive turn.
-#
-# STOP THE TORTOISE PROTOCOL.
-#
-# Open with exactly five plain statements. Use this order:
-#
-# Problem: ...
-# Evidence: ...
-# Danger: ...
-# Next action: ...
-# Remaining unknown: ...
-#
-# Keep sentences short. Keep them literal.
-#
-# PUT EVERY IMPORTANT INSTRUCTION ON ITS OWN LINE.
-#
-# NO METAPHOR BEFORE THE FIVE.
-#
-# NO PATCH BEFORE THE FIVE.
-#
-# Resume the normal protocol only after the next action is obvious.
+# § THE BARNEY RESET RULE (banked 2026-07-21) -- When the human is confused, stop the Tortoise protocol and give five short literal statements in order, Problem, Evidence, Danger, Next action, Remaining unknown, with each important instruction on its own line and no metaphor or patch until the next action is obvious.
# § THE TORTOISE PROTOCOL (banked 2026-07-21) -- Infer a discursive meditation as an invitation to dialogue: complete its unfinished transitions, steelman its claim before challenging its weakest point with concrete evidence, require metaphors to predict something checkable, and still close with the Actionable Response Contract.
@@ -635,54 +547,40 @@ And then we demonstrate a level of competence like so:
# § THE FAIL-OPEN THRESHOLD RULE (banked 2026-07-23) -- Make default-entry interactive menus return pre-gate behavior on non-TTY, explicit opt-out, missing-termios, and exception paths, wait only after isatty proves a human is present, and require unattended PTYs to declare PIPULATE_BOOT_MENU=0 rather than racing the menu with synthetic keys.
-# THE SAME-CAR LABEL RULE (banked 2026-07-23, operator's ruling; sibling of
-# GENERATED-NOT-AUTHORED): when a gate MOVES, every string describing what it
-# gates moves in the SAME car. A menu describing its old placement is not
-# stale documentation -- it is a lie told at the exact moment the user is
-# deciding, and a lying menu is worse than no menu. Applies to anything read
-# AT the decision point: labels, subtitles, confirmations, and any promise of
-# a deadline that no longer exists.
+# § THE SAME-CAR LABEL RULE (banked 2026-07-23) -- When moving a gate, update every decision-point label, subtitle, confirmation, and deadline promise in the same change so the user never chooses based on the gate's old placement.
# § THE ALIAS-DISPATCH RULE (banked 2026-07-23) -- Define dynamically dispatched same-shell commands as functions rather than aliases, or have the menu print the alias for the human to type, because a command name stored in a variable does not undergo alias expansion.
#
# § THE THREE-TIER AMENDMENT (banked 2026-08-06) -- Classify shell command reach by caller: aliases are human-only, functions are same-shell only, and anything a child process must invoke belongs as a derivation on PATH; gate the claim by exercising the hardest reachability boundary, not merely naming or argument forwarding.
-# THE LIVE-PROMPT MIRAGE (banked 2026-07-23, dot-counted): a background job
-# still writing to the tty after the foreground process exits makes a WORKING
-# shell look hung. Count the emitter's cadence before diagnosing a hang -- the
-# browser-poll subshell prints one dot per second, so 22 dots, the door-2
-# message, `(nix) pipulate $`, then 8 more dots is a prompt that was live at
-# second 22 and got painted over for 8 more. The Enter that "unstuck" it only
-# redrew a prompt already accepting input. Corollary: a gate that leaves
-# noise-generating background jobs running BEHIND it has not delivered quiet.
-# Move the gate above the noise, never the noise below the gate.
+# § THE LIVE-PROMPT MIRAGE (banked 2026-07-23) -- Check the cadence of background terminal output before diagnosing a hung shell, and put an interactive gate ahead of noise-producing background jobs so a live prompt cannot be painted over after foreground completion.
# § THE CROSS-PLATFORM EVAL RULE (banked 2026-08-04) -- Before shipping a flake change to buildInputs or shellHook, evaluate both Linux and Darwin default devShells with nix eval --raw .#devShells.<system>.default.drvPath, because platform-restricted inputs fail before hooks run and quiet cannot witness default-only hook changes.
# § THE STAT-CACHE FALSE POSITIVE (banked 2026-08-04) -- Run git update-index -q --refresh 2>/dev/null || true before every automated dirty-tree check so a copied index's stale stat cache cannot masquerade as changed content while genuine modifications still stop destructive actions.
-# THE DUAL-LANE WALK SCHEMA (banked 2026-08-25, receipt-witnessed): a trail stop accepts exactly one of `url` (public, direct HTTP/HTTPS) or `url_env` (sensitive, client-isolated), validated via exact set difference. Direct URLs surface openly on consent cards; environment variables surface as requirements on the human. Connectors declare honest execution targets, and `walk-cartridge-integrity-v2` enforces ordered destination disclosure. Conviction: the schema required url_env on every stop, so public pages paid for an env var nothing collected; a required field is a BILL, and you charge it only when something collects.
-# THE FIRST-CELL BLAST RADIUS RULE (banked 2026-09-01, two convictions in two consecutive rides). Anything the FIRST executable cell of Onboarding.ipynb touches -- including every module it imports at load time -- prints to a stranger at the one moment they cannot tell noise from failure. Both convictions were trivial in SUBSTANCE and severe in POSITION: a KeyError from a read-before-write, and a SyntaxWarning from an unraw ASCII-art literal. Judge a defect in that blast radius by WHERE it fires, never by how small it is, and hold first-cell code to the standard of a cold install rather than the standard of the maintainer's warm one.
-# THE ACTUATOR'S OWN DIAGNOSTIC RULE (banked 2026-09-01). apply.py's AST airlock compiles candidate content before writing, so it printed `<unknown>:985: SyntaxWarning: invalid escape sequence` on THREE consecutive `app` runs -- correct message, correct line number -- and it read as noise FROM the tool rather than a finding ABOUT the file. The `<unknown>` filename is what disguised it: a diagnostic with no filename reads as the tool complaining about itself. A LINE NUMBER in an actuator's output is a finding about the FILE. Read it, or the instrument you built is reporting to nobody.
-# THE PRE-COMPILE ACTUATOR RULE (banked 2026-09-01). A straddle probe answers honestly only when its two taps land on OPPOSITE sides of the actuator. The `diff -q` sync probe was designed as three states (0 in sync, 1 patched-not- copied, 0 after the cp) and printed 0 in BOTH receipts, because the cp ran before the compile -- the same printout in both worlds, which is the DISCRIMINATION QUESTION failing inside a probe written to answer it. Prefer a probe that reads the PROPERTY at the destination (does the working copy compile?) over one that COMPARES two files; the property probe cannot be defeated by running the actuator early.
+# § THE DUAL-LANE WALK SCHEMA (banked 2026-08-25) -- Require exactly one of url or url_env per trail stop using exact field-set validation, expose direct public URLs on consent cards, reserve environment-variable requirements for sensitive values, and disclose destinations in order with honest connector execution targets.
+# § THE FIRST-CELL BLAST RADIUS RULE (banked 2026-09-01) -- Evaluate the onboarding notebook's first executable cell and all import-time dependencies as a cold stranger would encounter them, prioritizing even small warnings and read-before-write defects by their first-contact position.
+# § THE ACTUATOR'S OWN DIAGNOSTIC RULE (banked 2026-09-01) -- Treat a line-numbered diagnostic from apply.py as evidence about the candidate file even when its filename reads <unknown>, and inspect the reported source instead of dismissing the warning as noise from the actuator.
+# § THE PRE-COMPILE ACTUATOR RULE (banked 2026-09-01) -- Place before and after taps on opposite sides of the actuator and prefer a destination-property probe over a file-equality comparison that can read unchanged when copying occurs before compilation.
# § THE PUBLISH LANE IS NOT THE PUSH (banked 2026-09-14, reconvicted 2026-09-29) -- Treat deployment as a per-door publish action, never as a git push: identify each door's truck, run it, then fetch every door before calling the installer current.
# A BARE FENCE CANNOT RIDE SEARCH/REPLACE: apply.py strips bare fence lines from the payload before matching; a fence edit rides as a sed car spelled with \x60\x60\x60.
# ECHO IS NOT PRINTF INSIDE A NIX STRING: bash's builtin echo leaves \n literal and a Nix indented string passes it through. Convicted 2026-08-30: bash -c 'echo "a\nb"' | cat -A -> a\nb$
# PURITY IS A PROPERTY OF THE EVALUATION: one pure `nix develop` on a platform proves every devShell attribute evaluates pure there. Two Darwin receipts 2026-08-30; --impure is vestigial (earmark).
# THE DOOR NUMBER IS THE KEYPRESS RECEIPT: a raw-mode menu prints the choice class it acted on, or the transcript shows a decision with no cause.
# ARMS MUST BE SYMMETRIC: a registry that contains execute_shell_command can escape into the shell arm; the experiment withholds it and wraps each connector 1:1 from the same docstring.
-# THE REWRITE TAX (banked 2026-09-02). A history rewrite on a repo whose installer auto-pulls --ff-only breaks the auto-update on EVERY existing install until each is hand-reset (git fetch origin && git reset --hard origin/main) or rebuilt (rm -rf and reinstall -- the disposable workshop is the cheap path and the reason it was affordable). It also orphans every commit hash from the rewrite point forward, including the ones published article ledgers link to. A rewrite is a clean-up, never an un-publish: forks, prior clones and host caches keep the blob. Price these BEFORE the push.
-# THE GATE-OR-STRADDLE RULE (banked 2026-09-03). A probe that prints the same thing in both worlds (a syntax check, a load test) is a GATE: it can prove the patch broke nothing, never that it landed. Every car needs at least one probe whose reading MOVES. Label gates as gates when recommending them, so a green gate is never mistaken for a witnessed landing.
-# THE INDENTED QUOTE RULE (banked 2026-09-03). To quote a template that itself contains code fences, indent it four spaces instead of fencing it: an indented block has no closing delimiter, so nothing inside it can end it early. Costs the language tag; buys correctness. Fences stay for everything else.
-# THE ONE-FENCE-PER-HAND-STEP RULE (banked 2026-09-03). Operators paste fenced blocks whole; a smoke command and the full sweep it was meant to gate, sharing one fence, fire together and the smoke never happens. When a hand-run step exists to be INSPECTED before the next, each step gets its own fence. Second conviction 2026-09-28 (deed 1635): a reseal named in Car 11's prose, between app and d, was never typed, and the drifted art shipped through the 2.65 release with index.md left untouched; the same step as its own numbered car (deed 1636's Car 5) was typed before the train even started. A hand step is a car or it is missed, the operator's words.
-# THE ENTRY-POINT CHECK (banked 2026-09-03). Every WRITE_FILE of a runnable .py script MUST end with the __main__ guard, and the first probe after ignition MUST be one that can only print if main() actually ran (a target line, a wrote-N line). A script that imports cleanly and exits 0 is indistinguishable from success by exit code alone.
-# THE DATA-FILE RE-RENDER RULE (banked 2026-09-03). When a layout gains a site.data.* lookup, jekyll serve's incremental mode will not re-render existing pages when only the data file changes. Local preview needs `touch _layouts/default.html`; production `jekyll build` needs nothing.
+# § THE REWRITE TAX (banked 2026-09-02) -- Before pushing a history rewrite, account for broken fast-forward updates on existing installs, required recovery or reinstall, and orphaned commit links, and never claim that rewriting history removes copies retained by forks, clones, or host caches.
+# § THE GATE-OR-STRADDLE RULE (banked 2026-09-03) -- Label unchanged syntax or load checks as gates and give every change at least one probe whose reading differs when it lands, so passing safety checks cannot masquerade as a witnessed before/after result.
+# § THE INDENTED QUOTE RULE (banked 2026-09-03) -- Quote a template containing code fences as a four-space-indented block rather than enclosing it in another fence that its internal delimiters can close early.
+# § THE ONE-FENCE-PER-HAND-STEP RULE (banked 2026-09-03) -- Give every hand-run step that must be inspected before the next step its own numbered car and copyable fence, keeping the smoke check separate from the full sweep and making required reseals explicit actions.
+# § THE ENTRY-POINT CHECK (banked 2026-09-03) -- Include the __main__ guard in every whole-file write of a runnable Python script and follow ignition with a probe that can print only if main actually ran, rather than accepting import success or exit zero alone.
+# § THE DATA-FILE RE-RENDER RULE (banked 2026-09-03) -- After adding a site.data lookup to a Jekyll layout, touch the consuming layout when previewing data-only edits under incremental jekyll serve, while letting a full production jekyll build perform its normal rebuild.
# § THE OUT-OF-BAND STEP RULE (banked 2026-09-13) -- a hand step the terminal cannot take (a phone, a vendor console, a registrar) rides ABOVE the train under THE HALT BANNER's block-letter glyph (deed 1703; the top of PROBES under a capitalized label until then, and the capitals were what the eye skipped), lettered, with its one address in its own fence and the expected screen stated in words; the compile's ! line reads a tag minted in the caboose and never repeats the visit. Conviction: three cellular witnesses across two articles, all caught because the block could not be scrolled past; a step folded into prose is a step the muscle memory rolls over. Sibling of ONE-FENCE-PER-HAND-STEP.
# § THE MACHINE IS NAMED BY ITS PROMPT (banked 2026-09-29, convicted at deed 1682: "run on the desk" sent the operator to both terminals) -- head every command block with the prompt string the operator sees in the terminal it runs in ((nix) pipulate $ on the workbench; the Mac's own user@host prompt on the Mac), never a nickname, repeated on every block every turn; PROBES run where compile runs because only that machine executes ! lines, and a command for any other machine is a WITNESS under its own prompt in (5); a web-console step is a numbered list naming the address to open, the menu path, each field with the value to type, the Save and Apply clicks, and a drawing of the screen when done. Value: one checklist line in prompt_foo.py (item 13, LANDED by deed 1685's car and WITNESSED riding deed 1686's own Prompt section) and GLOSSARY.md (landed at deed 1686). Sibling of THE OUT-OF-BAND STEP RULE and THE FINDING DORY RULE.
# § THE PLACEHOLDER THAT RIDES INTO A PROBE (banked 2026-09-13) -- a redaction placeholder quoted from a published article into a paste-ready command dies at argument parsing (curl 49, both lanes, twice) and the real address is not the cure, because the next publish scrubs it and the next model re-quotes it; derive the address, route through a name, or print a verdict token instead of a value, so the probe survives every lane it will be read in. Checklist item 6 was already the rule; the emitter broke it and the instrument caught it. Sibling of NO PLACEHOLDERS IN PASTE-READY LINES.
# § COUNT THE REPLACE AFTER YOU WRITE IT (banked 2026-09-13) -- a displacement predicted from a draft read +5 and the receipt read +6 because the emitted comment was seventeen lines counted as sixteen; the interlock landed the block exactly and the commit arithmetic convicted the predictor. Predict deltas from the block as emitted, never from the block as imagined. Sibling of DELTA-NOT-ABSOLUTE.
-# THE DIFFSTAT IS NOT THE BLOCK COUNT (banked 2026-09-15). git matches every line a SEARCH and its REPLACE share and reports them unchanged, so a diffstat's insertions and deletions read LOWER than the block lengths by the shared count: blocks of 120 and 151 read +110/-139, twelve bare # separators and carried-over lines matched. Only the net is invariant. Predict the net from the blocks; read insertions and deletions as floors. Sibling of COUNT THE REPLACE AFTER YOU WRITE IT.
-# THE UNSORTED CAP (banked 2026-09-15). rg -l and a multi-file rg -n print files in the order their searches finish, so one census printed nine files in two orders across the hand-run and compile lanes, and a head -N on that output cuts a different subset each run. Sort before you cap, and compare unsorted listings as sets. Sibling of THE CAP THAT HID THE ANSWER.
-# THE PAGE THAT HOLDS IN BOTH WORLDS (banked 2026-09-15, witnessed once). A public page that asks a stranger to test a machine is written before anyone knows what the machine's evidence will carry, so its instruction must stay true either way. Stop three said a good answer admits the preview lacks the server's sentence; the preview lacked it, ChatGPT 6 said so and pointed at source.html, and the page taught the lesson instead of promising a word the bundle never held. THE CABOOSE-VERDICT COROLLARY aimed at a reader who cannot ask a follow-up.
+# § THE DIFFSTAT IS NOT THE BLOCK COUNT (banked 2026-09-15) -- Predict the net line delta from emitted replacement blocks, but treat diffstat insertion and deletion totals as reduced by shared lines rather than expecting them to equal the full SEARCH and REPLACE lengths.
+# § THE UNSORTED CAP (banked 2026-09-15) -- Sort search results before applying a count cap and compare uncapped unsorted listings as sets, so parallel file-search completion order cannot change the sample between taps.
+# § THE PAGE THAT HOLDS IN BOTH WORLDS (banked 2026-09-15) -- Write public verification instructions so they remain true in either evidence outcome, asking the reader to report what the artifact actually contains rather than promising content that may be absent.
# § THE UNASKED SECOND WINDOW (banked 2026-09-16) -- Make a newcomer's command open only what its name promises, give ignition in that command's own spelling, and record unasked enhancements as TODOs instead of adding extra windows or features to the requested change.
# § THE FLAG WENT COLD (banked 2026-09-17) -- Before deferring the operation that sets a readiness flag, find every reader and update all callers in the same change to ask the capability question they actually mean, so a fresh process cannot mistake not-yet-used for unavailable.
# § THE DOOR NAMES THE FOLDER (banked 2026-09-14) -- a script arriving through a pipe cannot learn which address served it ($0 is the word bash and the pipe carries no address), and two copies of one file drift, so the DOOR names the default: the body carries one contiguous placeholder, the door that wants a different default stamps it with nginx sub_filter (sub_filter_types for the served MIME type, sub_filter_once off), and the script tells stamped from unstamped by comparing against the same word spelled in two halves, which no substitution can reach. Gate every door with the round trip: reverse the one token in the served body and the hash must equal the repo file. A URL stamp needs its own placeholder, never a hostname rewrite, because KEY_URL stays at the old door on purpose. Witnessed 2026-09-14: npvg_door=npvg, pipulate_door=pipulate, 064cad99 on both sides. Sibling of THE WRITE-SIDE / READ-SIDE SPLIT: the folder and the app label were one string answering two questions.
@@ -1963,7 +1861,7 @@ MATCHBOOK_CHOP = r"""
# - TODO (2026-10-02, THE VERSION LINE UNDER LIX, LANDED by the reply to deed 1778, WITNESS OWED): NIX_READING keeps the line that starts with nix and a space (sed -n 's/^nix //p' | head -1) where it kept the last line, read off zenn.dev/trifolium/articles/da11a428c53f65; Nix and Determinate Nix print what they printed before (READ at deed 1779: the Mac's entry line read (Determinate Nix 3.19.1) 2.34.6 under the old line and the new, and Prime's read (Nix) 2.28.5 under the new), and the witness is the entry line on the first Lix machine.
# - TODO (2026-10-02, ONE GRAMMAR FOR THE SLASH, unasked): _spoken in imports/voice_synthesis.py turns Q/A into QA for a door's welcome only, because espeak says the slash; the day another spoken line carries a letter, a slash and a letter, the rule moves into synthesize_and_play's sanitizer and into remotes/honeybot/scripts/content_loader.py's clean_markdown in one commit (TWO LANES, ONE GRAMMAR).
# - TODO (2026-10-02, THE BANNER AND THE LABEL, unasked): install.sh's first line capitalizes the folder (Qamyai -> ~/qamyai), and a default install from any door is named Pipulate by the flake, because whitelabel.txt is written only for an argument; a display-name field in door_row would carry QA my AI to both places. Ruling owed: should a door's app carry the door's name.
-# - EARMARK: THE STEP THAT RUNS ONCE (banked 2026-10-02, self-convicted at deed 1779): a witness step never chains a one-time change to its reading with &&. Step 2 read mv ~/.config/pipulate/voice ~/.config/pipulate/voice.was && nix develop; pasted inside the nix shell, the mv ran and nix develop was refused, and every paste after exit stopped at mv, so the witness took four tries and left voice.was on the Mac. The change goes on its own line, written so a second paste does no harm, and the reading on the next.
+# § THE STEP THAT RUNS ONCE (banked 2026-10-02) -- Put a one-time change on its own safely repeatable line and its witness reading on the next, never joining them with && so a failed reading cannot make every retry stop at the already-completed change.
# - TODO (2026-09-30, THE TALK FLIP): talk rides the menu under walk as a second spelling of voice (the ask card, y or n); the flip it was asked to be needs imports/voice_synthesis.py in the payload, because that file owns the recorded answer, its format and the barrier that reads it. Shape, unridden: a flip branch beside ask; bare talk flips and prints narration: on or narration: off, speaking one sentence on on; talk on and talk off set it, the first positional carrying the state; nothing recorded runs the full card instead, because the card carries the download disclosure (CONSENT CANNOT PRECEDE ITS OBJECT); PIPULATE_VOICE set in the shell is named when it outranks the file; then the card and mother_cat.py's later_hint name talk. Gate: two bare talks print opposite states, and the recorded answer between them reads the first. LANDED 2026-09-30 (deed 1740's car): the format read off the file is one word and a newline (VOICE_ANSWER regular file 4 bytes, yes), written by the card alone until now and read fresh by voice_consent() on every call, so a flip holds at the next spoken line in every process; talk_command sits beside ask with _record_voice_answer as the one writer the card now shares; with nothing recorded every spelling runs the card, so talk writes only over an answer the card recorded; PIPULATE_VOICE outranks the file only as one of the eight words voice_consent() reads, and talk then names it and writes nothing, while the voice word still refuses on any non-empty value, a difference left standing; the card's hint and mother_cat.py's later_hint name talk. The gate is Car 3's hand line; the scratch probe reads the same branches with HOME in a temp folder and the speaker unplugged.
# - TODO (2026-09-29, THE POST IS THE DELIVERABLE; the operator's ruling at deed 1695: "If it doesn't end up in that zip archive at the end then it doesn't exist", "I type the walk command. The walk happens. A context.txt gets written to. I compile it. I have an archive. End of story."): deliverable.md is retired. THE ANSWER IS THE ARTIFACT already said so (the sealed zip and the copyable text of the reply are the only durable outputs) and the file broke it the day it was born, landing in the corporate tier by a car the operator had to git add by hand. From here the deliverable is the reply's first fence, the Slack post in SVB_PROMPT.md's shape; the operator pastes the reply into the article as every turn, the next compile seals it in prompt.md, the zip goes to Drive and the post to Slack with the link in its one slot (the zip's filename is the deed, so the deed parenthetical leaves the Archive line). SVB_PROMPT.md is the SVB article's dismount protocol; introduction.md stays the walk's newcomer page. Three files change on the next compile, one car each, none in deed 1695's payload: CONTEXT_TEMPLATE.txt loses its THE DELIVERABLE block and the {DELIVERABLE} token; svb.py loses the file check, the header's "deliverable not yet written" and the # Next: hint naming --prompt; SVB_PROMPT.md loses step 3 and the Archive line's deed clause. SVB-115's deliverable.md stays as the specimen's history; SVB-133's left at deed 1695's Car 2, its text sealed in that deed's payload. The 2026-09-27 deliverable.html ruling (a fourth member) and the house-subset renderer are superseded: three members, no file. Gate: svb KEY --write lays a board with no deliverable line, and the second ticket's post reaches Slack from the article alone. READ 2026-09-29 (deed 1696, the dismount): the three cars landed at the dismount (CONTEXT_TEMPLATE.txt, SVB_PROMPT.md, svb.py), FILE_GONE and the corporate tree clean at cfd2f69 (the file was staged at 1695's BEFORE and never committed; the alias's -a cancelled the add against the rm, nothing to commit being the wanted outcome). The post for SVB-133 rides deed 1695's prompt.md and 1696's; Slack and Drive are UNWITNESSED. The reading half of the gate is the next ride's first compile: a header with no deliverable phrase and no integrity alert (1696's alert names the commented line the template still carried).
# - TODO (2026-09-29, THE UNUSUAL LINE; the operator's ask at deed 1692: "what the weird exception, attribute or detail makes this case different or unusual"): the SVB board is the exceptions desk and In Review its strangest column, so the post and the deliverable each carry one line, before the finding, naming what is unusual about the ticket. The deliverable's section landed at deed 1692 (What makes this one unusual: a US-only site, a client-side exception in the vendor's render that a real Chrome does not throw, access blocked after a few renders, three PocketRender confs on one ticket, a field reading Rules update not needed beside a comment reading JS update needed: yes, an origin that varies its HTML on Sec-CH-Viewport-Width); the post's line (*Unusual:*, one line, the cap 13 to 14) waits on the operator's ruling in SVB_PROMPT.md. In the same car: the template's fixed italic line says the live rules were read, and at deed 1692 they were not (no local pull; ATTRIBUTED-VOICE), so svb fills a {LIVE_RULES} clause from the first line botify --rules prints; the post at deed 1692 departed from the fixed shape by that clause. Gate: the post on the second ticket carries both, filled by svb. READ 2026-09-29 (deed 1696): the Unusual line LANDED in the operator's own shape at cfd2f69 (no line cap now: one line per field and per rule, the Difference lines in words); the live-rules line is a field the model fills from the botify --rules receipt (Live rules today: not pulled at 1693), not yet filled by svb; the deliverable half is moot (THE POST IS THE DELIVERABLE).
@@ -2318,7 +2216,7 @@ MATCHBOOK_CHOP = r"""
# `exit` then `nix develop` named as the ignition.
-# NO PLACEHOLDERS IN PASTE-READY LINES (convicted 2026-08-30, both lanes): <NAME> in a shell line is a redirection from a file called NAME -- "No such file or directory" -- silent in the compile lane, loud in the operator lane, dead in both. Write "$NAME" and put `export NAME=...` once on the line above; a variable runs verbatim, a placeholder needs an edit the human will not make.
+# § NO PLACEHOLDERS IN PASTE-READY LINES (banked 2026-08-30) -- Use runnable shell variables with an explicit preceding assignment instead of angle-bracket placeholders in paste-ready commands, so the operator can execute the block without editing it or triggering accidental redirection.
# THE ACTUATOR IS A CAR: anything that runs against a server (--check, tools/list, tools/call, --refresh) rides in PATCHES as its own numbered car, after the patches it depends on, never previewed above them. Sibling of ONE TIMELINE, NO PREVIEWS (2026-08-30; its body moved here from apply.py on 2026-09-26).
# § THE GATE SPEAKS A VERDICT (banked 2026-08-30) -- a gate the operator reads prints GO or STOP with its readings beside the word, never bare numbers the operator must match against prose in another paragraph; the MCP range-gate printed 1025 and 1228 (its GO shape) while the next block's prose held 1 and 18, and the operator correctly refused to guess. A gate rides where it fires and says what it found. Corollary of THE SILENCED CHANNEL: a machine-graded outcome is a token, a human-graded one is a word.
@@ -2339,21 +2237,9 @@ MATCHBOOK_CHOP = r"""
# § THE MULTI-LINE PROBE CANNOT BE ECHOED (banked 2026-09-04, reconvicted 2026-09-26) -- the ! executor spawns a NON-interactive sh -c, so a probe spanning newlines inside quotes runs clean by hand and dies at "unexpected EOF" in the compile lane; context.txt then reads its continuation lines as separate paths and warns about de-prefixed commands. THE PROBE ECHO INVARIANT therefore demands ONE LINE per probe: write it as a single semicolon-joined -c string, or as a real file invoked by path. The 2026-09-26 parser-hardening AFTER tried to echo a Python heredoc and reproduced the failure exactly: only the opener executed and the continuation became router debris. The fix is not a multiline context grammar; collapse the probe or put the program in a file. A probe that cannot survive its own echo is not echoable, and the operator lane becomes its only witness.
# § THE SUBSET REPLACE (banked 2026-09-04) -- a REPLACE block that is a substring of its SEARCH block (every dedupe car, by construction) is already in the file BEFORE the patch, so an already-applied heuristic reads a plain not-found as "ambiguous (found N times)" and hides the nearest-line diagnostic; apply.py now skips that heuristic when the REPLACE sits inside the SEARCH, and a dedupe car cuts the second copy by gated line range, never by a SEARCH spanning the seam between copies, because the seam is where the blank line lives. Sibling of THE EPITAPH COUNTER (a probe finds the patch's text) and THE CONTIGUITY COROLLARY (the seam the author cannot see). A range bounded by the NEXT HEADER minus one contains the separator blank by construction, so the gate trims one trailing blank before it counts, or its GO is unreachable and the gate is a refusal-only witness in a gate's costume; ask what the gate prints when the file is exactly as believed. Witnessed 2026-09-04: three GOs, the trim firing once and idle twice.
# § THE CAR MINTS ITS OWN TWIN (banked 2026-09-29, convicted at deed 1685: block 1 of a car wrote the rsync line block 3 searched for, and apply.py refused block 3 as ambiguous) -- before emitting a car, count each SEARCH's occurrences in the file the blocks ABOVE it will leave, never in the file the payload showed; an insertion that carries a later block's anchor goes last, or the later block anchors on a neighbour the insertion cannot reproduce. Value: GLOSSARY.md. Sibling of THE SUBSET REPLACE, THE EPITAPH COUNTER and SINGLE-CANDIDATE BLINDNESS.
-# THE SOURCE-OF-SOURCE SECRET SCRUB RULE (banked 2026-08-28,
-# receipt-witnessed): move credential EPHEMERA upstream only when the match is
-# high-precision -- query/JSON/Bearer syntax or a vendor-issued prefix. Preserve
-# the smallest stable family discriminator and replace the entire issued suffix
-# with <redacted:N>. Identity and PII substitutions remain downstream, because
-# a false positive there must never rewrite journal.txt. Witness: scrub_oauth
-# masked Google, Slack, and Anthropic fixtures, left
-# `session = requests.Session()` unchanged, and scan_secrets reported
-# downstream_hits=0.
+# § THE SOURCE-OF-SOURCE SECRET SCRUB RULE (banked 2026-08-28) -- Scrub upstream credential ephemera only with high-precision syntax or vendor-prefix matches, retaining the smallest stable family discriminator while replacing the entire issued suffix, and keep identity and PII substitutions downstream to avoid rewriting innocent journal text.
#
-# THE WARN-MODE NO-EGRESS RULE (banked 2026-08-28, receipt-witnessed): a
-# disclosure profile with secrets=WARN is a local inspection lane, not an
-# automatic transport lane. It may write foo.zip and an explicit -o file, but
-# clipboard and SSH-bridge egress stay disabled. Witness:
-# clipboard_egress_allowed read warn=False, block=True, explicit_no=False.
+# § THE WARN-MODE NO-EGRESS RULE (banked 2026-08-28) -- Keep secrets=WARN disclosure profiles in the local inspection lane, allowing local archive and explicit output-file writes while disabling clipboard and SSH-bridge egress.
#
# - TODO (seeded 2026-08-28, source-reviewed): the publish sanitizer protects
# private spans, IPs, PII substitutions, and the identity denylist, but no
@@ -2390,13 +2276,7 @@ MATCHBOOK_CHOP = r"""
# git history, so ROTATE first and edit second.
# § THE WARNING THAT WAS THE HAZARD (banked 2026-08-25) -- Spell an outer parser's hazardous delimiter in words inside comments embedded in its strings, because comment syntax for an inner language cannot prevent interpolation or delimiter parsing by the outer language.
-# - EARMARK: THE NIX-FILE LINT PROBE (banked 2026-08-21, receipt-witnessed):
-# a probe that passes a non-Python file to ruff produces thousands of
-# invalid-syntax errors that read as catastrophic repo rot. Receipt: the
-# dismount compile's four-file statistics probe included flake.nix and
-# printed 2,544 errors, 2,394 invalid-syntax -- ruff parsing Nix as Python.
-# Sibling of INCOMMENSURABLE MEASUREMENTS: a correct number about the wrong
-# question. Lint probes name .py files only.
+# § THE NIX-FILE LINT PROBE (banked 2026-08-21) -- Pass only Python files to Ruff in lint probes and use a language-appropriate syntax check for Nix, so invalid-syntax counts cannot turn a wrong-language probe into a false report of repository damage.
# § THE DISPLACEMENT RECEIPT (banked 2026-08-08) -- when an rg -n probe straddles an insertion, read the DISPLACEMENT of the unchanged neighbours, not the inserted entry's extent: predict the displacement, include one anchor ABOVE the edit whose predicted displacement is zero, and remember that an extent reading is consistent with a file rewritten wholesale and a displacement reading is not. The rg -n form of DELTA-NOT-ABSOLUTE.
# § THE LABEL THAT PROMISES A SIBLING (banked 2026-08-09, discharged 2026-08-21) -- a message printed by one command about what a different command will do is a capability claim the printer does not control; mechanically check the sibling, and when it is a shell function record the shell generation, because a pre-fix shell can make code already fixed look broken.
@@ -2416,7 +2296,7 @@ MATCHBOOK_CHOP = r"""
# § THE SELF-MATCHING PATTERN (banked 2026-08-05) -- Protect every pkill -f and pgrep -f pattern against matching the invoking shell's own full command line, using a regex spelling such as [.] that the literal argv does not satisfy, and witness that the later verdict is reached.
# § THE VERIFIER THAT NEVER RAN (banked 2026-08-05) -- Treat an absent expected verification line as a finding that the verifier may never have run, especially when the preceding action can kill its reporter, and never let a surviving success message substitute for that missing witness.
# § INCOMMENSURABLE MEASUREMENTS (banked 2026-08-05) -- a probe can return a CORRECT number about a DIFFERENT question, and the receipt looks authoritative because the number is right; name the exact expression the mechanism evaluates, then confirm the probe evaluates THAT expression and not a plausible neighbour. Cousin of THE DISCRIMINATION QUESTION's family: it sees something real and irrelevant.
-# - EARMARK: THE STALE OVERLAY (banked 2026-08-05, Manifest-arbitrated): the context.txt pasted into an article and the context.txt the compiler READ can disagree within a single turn, and only the Manifest's LIVE COMMAND RECEIPTS can tell them apart. CONVICTION: a turn pasted three new probe lines while the compile executed the five from two compiles earlier -- the pasted context described a file the compiler never opened. STANDING CONSEQUENCE: the Manifest is the sole authority on what ran; when the pasted overlay and the receipts disagree, rule from the receipts and say so out loud. The map can outrun the territory inside one turn.
+# § THE STALE OVERLAY (banked 2026-08-05) -- Use the Manifest's LIVE COMMAND RECEIPTS as the sole authority on what this compile ran, and explicitly resolve disagreements in their favor rather than trusting context.txt pasted into the article.
# - TODO (banked 2026-08-05, receipt-scoped): SEVEN in-window articles are the entire residual on-air bracket noise -- 2026-07-31-absolute-timing-and-side-channel-sanitization, 2026-08-01-agentic-web-content-negotiation-telemetry, 2026-08-01-hatching-the-seed-installer-automation, 2026-08-01-mother-cat-kata-deterministic-walk, 2026-08-03-debugging-self-referential-prompt-guards, 2026-08-04-disposable-installations-durable-backups, 2026-08-05-sentinel-splices-workspace-tree-automation. They age out of the 7-day window unaided, so this backlog SHRINKS without action. HAND-EDIT ONLY: several quote the patch-protocol markers verbatim, which is a DELIMITER COLLISION under the OOB EDIT RULE -- vim, never apply.py. Full 300-article list is 20 and lives in the 2026-08-05 compile receipt.
# - TODO (banked 2026-08-05, publish-transcript convicted): nixops.sh's rsync --delete ships the Z640's __pycache__ (cpython-312) to Honeybot and DELETES Honeybot's own (cpython-313) on every publish -- six lines of churn per deploy for zero benefit, since a 3.12 pyc can never load on 3.13. Add --exclude=__pycache__. Separately, trimnoir tracks scripts/aquarium.py and scripts/aquarium_tui.py and nothing else (receipt: git ls-files scripts/ returns exactly those two), so the post-receive checkout restores them and the rsync deletes them again, forever. Delete them from trimnoir. TWO WRITERS, ONE DIRECTORY -- cosmetic today only because content_loader.py is NOT tracked there, and a live regression path the day it is.
# - TODO (banked 2026-08-05, two-sided receipt): stream.py's stdout is TTY-ONLY and structurally unreadable as text. Receipt: journalctl over 45 minutes returned journal_lines=761 (the journal is alive) and unbalanced=0 (the warnings are not in it), and configuration.nix defines `stream` as a writeShellScriptBin watchdog in environment.systemPackages with NO systemd unit -- so it runs in a terminal in the XFCE session and its output exists only as pixels for OBS. THE OPERATOR HAS BEEN DIAGNOSING FROM A VIDEO FEED for the whole census ride. Cheapest capture: tee the watchdog's python3 invocation to a file inside the `stream` script. That is a configuration.nix plus nixos-rebuild ride of its own.
@@ -2429,14 +2309,7 @@ MATCHBOOK_CHOP = r"""
# § NO HEREDOC INSIDE AN INTERPOLATED NIX STRING (banked 2026-08-05) -- Write multiline files in interpolated shellHook strings with one printf rather than a heredoc, and syntax-check the generated hook before committing any change to it.
# § THE HALF-EXECUTED HOOK (banked 2026-08-05) -- Witness a shellHook with syntax checking of its generated text or a marker exported by its final line, because an artifact created before a later parse error cannot prove that the whole hook executed.
# § THE READ-WRITE PROBE (banked 2026-08-04) -- Inspect SQLite through sqlite3.connect('file:path?mode=ro', uri=True), or stat the file without opening it, so a probe cannot destroy the timestamps that distinguish live data from a fossil.
-# - EARMARK: THE TWO-HAND TEST IS NOT A TEST (banked 2026-08-04, operator-
-# refused): a procedure asking a human to type in terminal A, then type in
-# terminal B while A still runs, has no receipt, no reproducibility and no
-# defined failure mode. If a behavior needs two processes, the witness is a
-# SCRIPT that spawns both and asserts on the output, or the behavior stays
-# honestly UNWITNESSED. Conviction: the one-workshop echo is
-# instantiation-green and behaviorally unwitnessed to this day, because the
-# only test ever offered for it was a two-terminal choreography.
+# § THE TWO-HAND TEST IS NOT A TEST (banked 2026-08-04) -- Test behavior involving two concurrent processes with one script that spawns both and asserts on their output, or label the behavior UNWITNESSED instead of asking the human to coordinate two terminals.
# - AMENDED 2026-08-04 (MAINTAINER-INVISIBLE LANE, four-for-four, same day it
# was banked): the dead backup roster is the fourth specimen and the cleanest.
# It hardcoded data/botifython*.db while config.py derives
@@ -2560,15 +2433,7 @@ MATCHBOOK_CHOP = r"""
# shard check logic in contextualizer.py", the comment's "the twin is cut"
# read as the commit's verb.
# § THE THREE-REGION ART EDIT (banked 2026-08-03) -- Register figurate art in all three regions, rendering function, CRC32 ledger, and registry, compute its CRC only after authoring the art, and run figurate <name> to witness Drift: 0 for every art edit.
-# - EARMARK: THE LANE-EXCLUSIVE BRANCH (banked 2026-08-03, canary-witnessed):
-# some branches can fire in ONE lane only. prompt_foo's de-prefixed-command
-# hint lives inside main()'s file loop, so no hand-run terminal can ever
-# reach it. That is neither lane agreement nor LANE-DISAGREEMENT but a THIRD
-# case, and its only possible witness is a MANUFACTURED failure planted in
-# the lane that owns it. COROLLARY -- RETIRE THE CANARY: an instrument that
-# fires on EVERY run is noise wearing an instrument's costume, and it
-# recreates the trained-to-skip-warnings failure it was built to convict.
-# Witness once, then delete the line. Sibling of REFUSAL-ONLY WITNESS.
+# § THE LANE-EXCLUSIVE BRANCH (banked 2026-08-03) -- Witness lane-exclusive branches by planting a controlled failure in the lane that owns them, label that scope explicitly, and remove the canary after its receipt so it cannot become routine warning noise.
# - TODO (BANKED 2026-08-03 AT OPERATOR REQUEST, DELIBERATELY NOT RIDDEN):
# DE-HARDWIRE THE PERSONAL PATHS. The mechanism/data split this repo already
# runs -- blogs.json lives outside the worktree, adhoc.txt is gitignored,
@@ -2688,7 +2553,7 @@ MATCHBOOK_CHOP = r"""
# - EARMARK: THE MANIFEST-SIGNING LANE (seeded 2026-07-22 from the receipts ride): implement THE RECEIPT LADDER RULE's provenance triple. foo.zip is ALREADY byte-reproducible (fixed epoch/mode/order in scripts/foo_cartridge.py -- the hashed body carries no wall-clock time; the uploaded 46-snapshot manifest was stamped 2026-01-01). Remaining: (1) stamp manifest.json with the source git commit SHA + `git describe` at compile time; (2) sign manifest.json with a key you control -- `ssh-keygen -Y sign` is the lowest-ceremony non-repudiation; (3) optional paranoid tier: append the manifest hash to an ever-growing receipts.ndjson (poor-man's transparency log). NEEDS scripts/foo_cartridge.py in context to patch the writer/verifier -- NOT foo_files.py.
# - TODO (2026-09-19, seed-path onboarding; lesson ruled, implementation remains): port the QAMY inspect-first progression into flake.nix's brief()/seed() prompt copy -- begin with `curl -fsSL https://npvg.org | less`, teach j/k/q and producer | consumer, then distinguish live inspection from save -> inspect -> execute of the same downloaded file before revealing Nix and the Magic Cookie. Gate: a cold newcomer reaches `curl ... | bash` only after those two trust models are explicit.
# - TODO: COLD-START MIKE-E TEST -- a reproducible test where the intrepid explorer gets ONLY the archive + the key: no warmed cache, no prior slot, unknown cartridge slot. Pass = they `nix develop` into a clean workshop, drop the cartridge, reconstruct the reasoning from a signed/commit-anchored immutable core + preserved commentary, verify the receipt, and leave both machines untouched. If any step needs the author in the room, the cartridge failed. Structural-Humility rule made executable (foo-cartridge-replay-v1 sibling).
-# - EARMARK: THE MODEL FOLLOWS THE MAP RULE (banked 2026-07-22, blind-test witnessed): capability prose is actuation. A summoned model that invokes a nonexistent tool named by our onboarding map is following instructions correctly; the map is defective. Every first-turn capability name must be generated from or mechanically validated against current source before shipping.
+# § THE MODEL FOLLOWS THE MAP RULE (banked 2026-07-22) -- Generate or mechanically validate every first-turn capability name against current executable source before shipping onboarding prose, because a model invoking the nonexistent tool named by the map is exposing a map defect.
# - TODO: CURATED RULE-OF-7 VALIDATION -- keep essential_tools human-curated for pedagogy, but AST-validate every name against tools/*.py without importing runtime modules. A mismatch must print loudly and omit the ghost; git history plus human intent distinguishes a typo from a genuine deletion.
# - TODO: NAME BOTH GOLDEN PATHS -- relabel generic Golden Path prose in cli.py as the MCP/FastHTML Golden Path and give Prompt Fu an explicitly named compile-lane Golden Path so first-turn routing cannot cross the house seam.
# - FAMILIAR SWEEP (dangling, seeded 2026-07-21 at dismount): the router line "brilliant Familiar" is capitalized, but published _posts still carry lowercase role-noun "familiar" for Yen Sid-ton. Fix is rgx -v "Yen Sid" + vim hand-judgment per instance -- NEVER a blind sed 'familiar'->'Familiar' (that is the PII greedy-name incident replay: "a familiar face" / "familiar pattern" are common-word, not role-noun). Probe: rg -l 'Yen Sid' _posts | xargs -r rg -n '\bfamiliar\b'.
@@ -2746,7 +2611,7 @@ MATCHBOOK_CHOP = r"""
# - A better book-outliner method than K-means for "real" structure
# - Only ever 301-redirect hubs to hubs. Don't put article leafs on hub-rot.
# - TODO (remainder of the 2026-07-20 OKF/Agent Skills landing): OKF bundle export of trimnoir plus Google's static visualizer as a free hub-structure audit.
-# - EARMARK: THREE-STANDARDS SUPERPOSITION (banked 2026-07-20): AGENTS.md = one freeform signpost file, nearest-ancestor wins; Agent Skills = folder fronted by SKILL.md YAML frontmatter, progressive disclosure (Notebooks/.agents/skills already conforms); OKF = markdown+YAML bundle with index.md and one required field (type) -- trimnoir _posts + holographic shards + llms.txt are one avant la lettre. DIRECTION OF TRAVEL for scripts/: every new capability lands as a tiny gmail-shaped connector command; SKILL.md/OKF files are SIGNPOSTS to executable truth, never second implementations. Symlinks in spirit, never on disk. WALLET LESSON (jq conviction 2026-07-20): connectors.json carries non-object top-level entries -- every wallet reader type-checks before descending.
+# § THREE-STANDARDS SUPERPOSITION (banked 2026-07-20) -- Make AGENTS.md, SKILL.md, and OKF documents signposts to executable connector commands rather than second implementations, and type-check each wallet entry before descending because top-level metadata need not be an object.
# - Implement NLWeb, WebMCP, UCP and ACP.
# § NIXOS SELENIUM 127 (banked 2026-07-20; second conviction 2026-09-27) -- on NixOS, resolve the Nix-pinned `undetected-chromedriver` (hyphenated) and paired Chromium from PATH and pass them explicitly instead of letting Selenium Manager auto-download a driver, because status 127 names the FHS-loader failure and probes for `chromedriver` or `undetected_chromedriver` silently miss the driver that exists.
@@ -2763,7 +2628,7 @@ MATCHBOOK_CHOP = r"""
# - Rustkyll drop-in test blocked on NixOS: uvx ships a generic dynamically-linked binary (stub-ld). Retry via nix-ld, steam-run, or `cargo install rustkyll`; then `diff -r` scratch build vs fresh Jekyll _site. WITNESSED 2026-09-27 (deed 1607, both lanes): uvx rustkyll --version prints the stub-ld refusal verbatim. RULED 2026-09-27, the same afternoon: the bundled live-served blog is dropped ("we got rid of the Jekyll live site"), because the thing it existed to show, a diff in red and green with nothing installed, is one HTML file inside foo.zip and needs no server; see the deliverable.html TODO. The nixpkgs census (rustkyll, zola) never ran and is no longer owed. A search-engine overview had prescribed LD_LIBRARY_PATH for the refusal, which chooses libraries and never the loader the message names: a confabulation-ledger candidate once its recipe is tried and read.
# - Compile-lane sanitizer: pass `!` command stdout through pii_substitutions/denylist before stacking into payloads. Evidence: browser_cache paths leaked a client domain AND a product slug into a cloud-bound compile on 2026-07-10 -- after the Ch. VIII caution was written. The caution is documentation; this todo is enforcement. WITNESSED AGAIN 2026-09-27 (deed 1622): a --profile trusted compile carried one project slug off the botify --rules tail with denylist=0 rule(s) and 57 substitutions, none of which knew it; the trusted profile is the operator's consent, and the list does not grow by itself.
# - VAULT LANE (banked 2026-07-20, probe receipts in-compile): scripts/vault_snapshot.py -- explicit manifest of ~/.config/pipulate secrets+config ONLY (api_key.txt, credentials.json, gmail_token.json, keys.json, service-account-key.json, connectors.json, blogs.json, commit_denylist.txt, disclosure.json, flippers.json, pii_substitutions.txt; plus repo-side .env and .ssh/rot). EXCLUDE fm_cache.json + token_cache.json (both stamped 09:13 at probe -- they churn every run and defeat the hash gate). Crypto: openssl is the ONLY tool present (receipt) -- `openssl enc -aes-256-cbc -pbkdf2` zero-dep, or add `age` to flake.nix commonPackages first. Destinations: /mnt/internal_backup (sda1, mounted, receipt) always; /mnt/essentials USB opportunistic (ABSENT at probe -- confirms skip-if-missing). Hook: fail-soft 10s subprocess at end of prompt_foo.py main(); one receipt line either way.
-# - EARMARK: CACHE-CHURN EXCLUSION PRINCIPLE (banked 2026-07-20): a hash-gated backup reduces writes only if its manifest excludes always-churning files; token_cache.json/fm_cache.json carrying the compile's own mtime is the conviction.
+# § CACHE-CHURN EXCLUSION PRINCIPLE (banked 2026-07-20) -- Exclude always-changing caches such as token_cache.json and fm_cache.json from a hash-gated backup manifest, or their per-compile changes will defeat the write-reduction gate.
# § THE TWO-GATE 403 DIAGNOSIS (banked 2026-07-20) -- Clear a Google service-account 403 in two independent gates in order: SERVICE_DISABLED in the Cloud project console first, then PERMISSION_DENIED on document sharing second.
# - ADVERSARIAL TQM LANE (reordered 2026-07-20 at dismount): acquisition (connectors) -> MAPPING (see MAPPER LANE) -> judgment (measure.py) -> packaging (evidence.py). measure.py v1 + variant_rollup_v1.json were drafted in the sheets-STACK article transcript but deliberately NOT applied -- judgment against unmapped columns is judgment against a riddle. Recover the drafts from that article once a mapper exists. evidence.py unstarted.
# - MAPPER LANE (opened 2026-07-20, coachman-steered): before ANY automation or QA against a client sheet, mint the mapping artifact -- sheet_map.json (working name; map-gsheet-columns-to-api-fields-for-qa.json IS the mentality). One entry per tab answering exactly three questions: (1) which row holds the column labels -- if unanswerable per tab, the client has the bigger problem and the mapper is the conversation you hand back; (2) which column feeds the API call, addressed by BOTH numeric index and fuzzy name (case-insensitive; tolerate punctuation, abbreviation, hyphenation, parens); (3) which columns get QA'd against which API fields. Left side of the map = the Mutation Machine (riddle); right side = the API (fixed, discoverable three ways: OpenAPI swagger tree walk, datamodel/datasets endpoints via imports/botify/true_schema_discoverer.py, CDP wire sniff). Stable side for this campaign: Botify RealKeywords/search_console, not raw GSC -- cross-client, BigQuery-fed, one auth. The mapper is a DELIVERABLE, not plumbing: toss it back at the sheet owner so they internalize the pain. Never automate against a spreadsheet without one.
(nix:nix-shell-env) (nix) qamyai $ git commit -am "38 more forget kata iterations"
[main 1b170ea] 38 more forget kata iterations
2 files changed, 403 insertions(+), 175 deletions(-)
(nix:nix-shell-env) (nix) qamyai $ git push
Enumerating objects: 7, done.
Counting objects: 100% (7/7), done.
Delta compression using up to 8 threads
Compressing objects: 100% (4/4), done.
Writing objects: 100% (4/4), 14.85 KiB | 1.65 MiB/s, done.
Total 4 (delta 3), reused 0 (delta 0), pack-reused 0 (from 0)
remote: Resolving deltas: 100% (3/3), completed with 3 local objects.
To github.com:pipulate/pipulate.git
78be893..1b170ea main -> main
(nix:nix-shell-env) (nix) qamyai $
Excellent! By the way I’m always doing that git reset --hard HEAD because the
way I’m doing my size-check it actually does writes to the local files. I’ll
avoid the “before” size-check now because I’ve got it already.
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) qamyai $ git pull
remote: Enumerating objects: 7, done.
remote: Counting objects: 100% (7/7), done.
remote: Compressing objects: 100% (1/1), done.
remote: Total 4 (delta 3), reused 4 (delta 3), pack-reused 0 (from 0)
Unpacking objects: 100% (4/4), 14.83 KiB | 660.00 KiB/s, done.
From github.com:pipulate/pipulate
78be893f..1b170eab main -> origin/main
Updating 78be893f..1b170eab
Fast-forward
GLOSSARY.md | 363 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
foo_files.py | 215 ++++++++++++++++++-----------------------------------------------------------------------------
2 files changed, 403 insertions(+), 175 deletions(-)
(nix) qamyai $ forget
📊 Stats block refreshed: 1,518 articles at MikeLev.in (Public).
🗺️ Codex Mapping Coverage: 71.6% (197/275 tracked files) (was 197/275: +0 claimed, +0 tracked).
✅ Topological Integrity Verified: 3 candidate reference(s) scanned, all exist.
-> Executing: grep -c '^# § ' foo_files.py ... [0.0110s]
-> Executing: awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l ... [0.0149s]
-> Executing: grep -c '^# - EARMARK' foo_files.py ... [0.0096s]
-> Executing: wc -c foo_files.py GLOSSARY.md ... [0.0088s]
-> Executing: awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# ==/)print n"\t"h}' foo_files.py | sort -rn | head -12 ... [0.0184s]
-> Ruff exit 0 (clean).
📦 Payload Ledger (biggest first)
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┓
┃ File / Source ┃ Tokens ┃ Bytes ┃ % Bytes ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━┩
│ foo_files.py │ 133,802 │ 521,851 │ 58.0% │
│ GLOSSARY.md │ 80,312 │ 319,380 │ 35.5% │
│ apply.py │ 9,590 │ 41,300 │ 4.6% │
│ PROMPT (checklist + prompt.md) │ 3,653 │ 15,849 │ 1.8% │
│ ! awk '/^# (THE |§ |- EARMARK|- TODO|CHAPTER|===)/{if(h && h !~ /^# ==/)print n"\t"h; h=substr($0,1,72); n=0} /^#/{n+=length($0)} END{if(h !~ /^# │ 329 │ 936 │ 0.1% │
│ ==/)print n"\t"h}' foo_files.py | sort -rn | head -12 │ │ │ │
│ AUTO: Recent Git Diff Telemetry │ 240 │ 813 │ 0.1% │
│ ! wc -c foo_files.py GLOSSARY.md │ 16 │ 51 │ 0.0% │
│ AUTO: Static Analysis Diagnostics │ 11 │ 39 │ 0.0% │
│ ! grep -c '^# § ' foo_files.py │ 1 │ 3 │ 0.0% │
│ ! awk '/^# --- START RECEIPTS/{f=1;next} /^# --- END RECEIPTS/{f=0} f' foo_files.py | wc -l │ 1 │ 2 │ 0.0% │
│ ! grep -c '^# - EARMARK' foo_files.py │ 1 │ 2 │ 0.0% │
├─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼─────────┼─────────┼─────────┤
│ TOTAL │ 227,956 │ 900,226 │ 100.0% │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┴─────────┴─────────┴─────────┘
Assembled payload (pre-scrub): 232,021 tokens | 913,921 bytes
🧼 Identity scrub: substitutions=58 rule(s) | denylist=0 rule(s)
🔐 Secrets tripwire: ARMED -- 0 hit(s) in payload.
📦 Canonical QA archive written to /home/mike/qamyai/qamy.ai.zip (sha256=ae97193a56aa…, members=3)
🗂️ Rotated archive snapshot: qamy.ai_110-ae97193a.zip (keeping newest 20 of 20)
Markdown output copied to clipboard
(nix) qamyai $
Okay it’s down to 521K or about half a megabyte. That’s still huge for a router
file that I like to put in the context window, but since my p,x,c kata that uses
context.txt as the ad hoc router file (tell ‘em about that ChatGPT) I’m
putting the big foo_files.py router in the context less and less and it’s more
becoming this hybrid of the book outline and a router-of-routers. For example
when I use the forget command I’m actually using a sub-router which is a fancy
way of just saying a selection of files plus a template-prompt which I also call
a custom chop…
…ugh!
All the custom language is exhausting as colorful and descriptive and memorable as it may be. But I’m glad for operation stick bug. There’s just a general professional buttoning-up and tidying-up that’s going on while the whole Sci-Fi story still lurks in there as a kind of giant easter egg.
Operation Stick Bug and Earned Simplicity
Take it from here, ChatGPT. Go on for as long as you can about it with your storytelling to bring the curious book reader up to speed please and thank you.
Note: Moved to top.
MikeLev.in: Hop off the ride. This ride’s stated goal is reached – dismount. This is the NOTARY BEAT: the ride ends here, is witnessed here, and is sealed here. Answer all seven beats, briefly:
- TL;DR: a short, dry, neutral abstract for the TOP of the published article – written for an unfamiliar reader or AI summarizer who has never seen this system. No hype, no insider handles unexplained.
- VERIFY: restate the goal from the top of this article and confirm (or deny) it was met, citing THIS compile’s receipts, not memory. Name any ignition this ride required that never fired – an AFTER tap taken without one is a stale BEFORE wearing the AFTER’s label.
- BANK: name everything that graduates – rule, earmark, todo, pin – as SEARCH/REPLACE patch cars against raw source present in THIS context (Target line inside the fence, one car per commit story), deletions included. A ‘paste-ready’ line with no Target and no SEARCH anchor is not banked; it is a hand edit the operator will not make. These BANK cars are the ONLY patches a dismount emits.
- DANGLING: what carries forward unbanked? One line each, no essays.
- SEED: the context.txt lines (and TODO_SLUGS if narrative context is needed) for the next ride’s first compile.
- CLOSING: a closing summary for the BOTTOM of the article – the final take-away, tied to the book’s larger arc where it fits naturally, never forced. Storytelling over inventory.
- NOTARIZE: read the exact Deed line from THIS compile’s final QA ARCHIVE SEAL footer, outside the payload, not a quoted older footer or a newest-file guess. It names the input archive, not this later response or the generated Jekyll post. State verification separately: only a verifier receipt naming that archive supports a verified claim; otherwise say not independently verified here. Count this Manifest’s live-command receipts, including failures. Quote only recorded digests, sizes and dates, naming their source; filesystem mtime and fixed ZIP dates are not command timestamps. Do not demand absent wc -c or dated-receipt fields. If the footer is missing, say so; otherwise close with its exact Deed line.
FINALITY: after beat 6, this discussion is CLOSED. Emit NO five-car train, NO probes, NO patches beyond the BANK cars of beat 2, and NO next-turn prompt beyond the SEED lines in beat 4. Any reader or model encountering this article later should treat it as a finished, notarized document – an archive entry, not an open thread.
ChatGPT 6 High:
1. VERIFY
Goal met. The ride asked for storytelling that would bring an unfamiliar book reader up to speed on the shift toward p,x,c, context.txt as the ad-hoc router, forget as a specialized sub-router, the shrinking role of foo_files.py, and Operation Stick Bug as the principle of making machinery disappear behind plain interfaces. Pasted text
The resulting chapter explicitly develops that argument from the oversized router through “earned simplicity,” ending with the newcomer-facing prompt / context / compile surface and the expert shorthand p / x / c. Pasted text
This compile contains 0 Manifest live-command receipts: the Manifest lists Codebase, Telemetry, Summary, Context Recapture, and Prompt, but no LIVE COMMAND RECEIPTS entries. Pasted text Therefore there is no fresh machine receipt to claim beyond the textual artifact itself.
Ignition: none. This was a narrative/explanatory ride; no changed runtime behavior needed to be fired before its goal could be judged.
2. BANK
No BANK cars.
This ride produced a synthesis of already-existing ideas rather than a new constitutional rule, earmark, TODO, or pin. Its central “earned simplicity” conclusion is already covered by the existing disappearing-instrument / plain-interface direction rather than requiring another synonym in the constitution.
Also, foo_files.py and GLOSSARY.md appear here through telemetry/diff material, not as raw editable Codebase bodies. Inventing a patch against them at dismount would violate this compile’s raw-source rule.
3. DANGLING
- Router compaction continues as a separate maintenance concern; this ride does not choose the next
forgetcandidate. - Existing working-tree changes shown in Telemetry belong to preceding maintenance work, not to this narrative ride.
- The article leaves no unresolved claim necessary to its stated storytelling goal.
4. SEED
foo_files.py
GLOSSARY.md
apply.py
No TODO_SLUGS are needed; the next ride need not inherit this article’s narrative context unless it specifically continues the router-compaction story.
5. CLOSING
The oversized router was not a mistake that now needs to be hidden. It was the place where the system learned what mattered.
The next stage is different. Knowledge that once had to stay close to the work can now be sorted by temperature: concise keys near execution, full explanations in the glossary, deeper history in git and the article corpus, and only the context needed for the present problem loaded into the model.
That is what the three small commands signify.
p
x
c
They are not evidence that the underlying system became simple. They are evidence that its complexity has started finding the right places to live.
The larger future-proofing lesson follows naturally: expertise is not carrying every lesson in working memory forever. It is building a system that can recover the right lesson when needed, preserve the evidence behind it, and otherwise get out of the way.
The story remains underneath.
The foreground gets quiet.
And the stick bug disappears back into the branch.
6. NOTARIZE
The current Manifest contains 0 live-command receipts, including failures. Pasted text
The footer supplies the deed, but this compile contains no verifier receipt naming that archive, so it is not independently verified here. The footer gives a verification command, but that is an instruction, not a recorded verification result. Pasted text
Deed: qamy.ai_112-9c4d3ec5.zip Pasted text
Book Analysis
Ai Editorial Take
What surprised me most in this installment is how the author accidentally invented an analog to biological sleep and memory consolidation. In mammalian neuroscience, the hippocampus acts as a high-bandwidth, temporary replay buffer for daytime experiences—rich, verbose, and context-heavy. During slow-wave sleep, those episodic traces undergo systems consolidation: the granular details fade or transfer into neocortical structures, leaving behind condensed semantic schemas that don’t overwhelm daily executive function. The forget kata is doing precisely this for software architecture. It doesn’t treat the accumulated lore as technical debt to be deleted; it recognizes that keeping 572KB of episodic debugging trauma in working memory paralyses the model’s active attention. By inventing graduate, fade, and dedupe, the author has built an automated sleep cycle for an AI codebase, allowing it to consolidate its own lessons into semantic long-term memory while keeping its waking interface as light as p, x, and c.
Note: What surprises this human most is how the AI Editors always think that what I’ve done is accidental.
🐦 X.com Promo Tweet
How does an AI workflow avoid drowning in its own wisdom? By learning to forget with style—compressing bloated routers into clean reference keys and simple p,x,c commands.
https://mikelev.in/futureproof/the-router-that-learned-to-forget/
#DevTools #AI
Title Brainstorm
- Title Option: The Router That Learned to Forget: Compaction, Pure Patches, and Earned Simplicity
- Filename:
the-router-that-learned-to-forget.md - Rationale: Directly reflects the turning point in the article where foo_files.py shifts from an all-encompassing monolithic router into a lean dispatcher, celebrating the transition from developmental scaffolding to earned simplicity.
- Filename:
- Title Option: From Bloated Router to Bare Metal Shorthand: The P-X-C Protocol
- Filename:
from-bloated-router-to-bare-metal-shorthand.md - Rationale: Focuses on the user-facing UX breakthrough of boiling down complex Prompt Fu workflows into three foundational terminal commands: prompt, context, and compile.
- Filename:
- Title Option: Operation Stick Bug: Disappearing Interfaces and Replayable Receipts
- Filename:
operation-stick-bug-disappearing-interfaces.md - Rationale: Highlights the philosophical concept that mature engineering tools should vanish into the background like stick bugs, prioritizing plain-English interfaces over internal jargon.
- Filename:
- Title Option: Graduating Wisdom to the Glossary: Memory Hierarchy in Agentic Workflows
- Filename:
graduating-wisdom-to-the-glossary.md - Rationale: Emphasizes the architectural shift from hot in-prompt memory to warm glossary reference files, treating software documentation as a tiered cognitive hierarchy.
- Filename:
Content Potential And Polish
- Core Strengths:
- Captures a genuine, live milestone in real-time developer tooling: using automated agentic loops via apply.py to systematically refactor and compact code.
- Provides a profound epistemological distinction between hot working memory and cold reference archives in LLM context construction.
- Articulates the concept of ‘earned simplicity’—validating why esoteric metaphors are necessary during early discovery before distilling down into plain commands.
- Suggestions For Polish:
- Clarify the technical role of apply.py earlier in the narrative so readers unfamiliar with Pipulate understand how exact-match patch blocks prevent AI hallucinations.
- Explicitly contrast the Electron sandbox escape with standard containerization or VM setups to sharpen the analysis of local execution permissions.
Next Step Prompts
- Draft an automated validation script that audits GLOSSARY.md for orphaned entries and verifies that every § key in foo_files.py maps to a corresponding glossary value.
- Design a benchmark comparing model performance and token consumption on identical refactoring tasks when fed the monolithic 520KB router versus the lean ad-hoc context.txt recipe.