docs(remediation): promote redundant-observation to charter; bank D-35 (tool caught what attention could not)

Charter gains a fifth principle from D-33: two observers of the same evidence, disagreeing, catch what neither catches alone — applied to evidence GATHERING, not just judgement. A summary that resembles an enumeration is more dangerous than one that obviously summarises; prefer the machine-readable record and state counts so divergence is detectable. D-35: while editing merge-gate.md to fix D-33, the coordinator recalled the mandate string instead of reading it and the Edit tool's exact-match REJECTED it. Third instance for that author, inside the turn fixing another instance of the same class — and the only one that did not reach a document, because a mechanism caught it. A rule that fails in its authors but is caught by a tool has told you where it belongs. RM-02 should enforce verbatim citation by construction, as the Edit tool did by accident of design. Fix landed by annotating the source: merge-gate.md mandates 3 and 4 now require the scan and count from the JSON record. The shared wrapper was deliberately NOT modified mid-flight — three lanes are reading it; fix at a seam. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-08-01 00:53:27 -05:00
parent 9e205e8201
commit 357a636a3a
2 changed files with 53 additions and 0 deletions
@@ -117,6 +117,28 @@ gate/program; the LLM handles only genuine judgment.
 > not yet a hypothesis. Where the answer is consequential, **reproduce** rather than accept — two
 > independent runs beat one confident report.
 ### First-class principle — redundant observation on evidence-bearing steps
 > **Two observers of the same evidence, disagreeing, catch what neither catches alone.** Apply redundancy
 > not only to judgement calls but to **evidence gathering itself** — the step everyone assumes is
 > mechanical and therefore skips.
 >
 > Promoted by Mos (2026-08-01) from **D-33**. A seat scanned a pipeline with `-f json` and reported 9
 > steps; the orchestrator scanned the same pipeline in the wrapper's default text mode and reported 8.
 > **The default output omits `clone`.** Every "full step scan" that night had been 8-of-9 and was stated
 > as complete in good faith. No verdict changed — but the _method_ was wrong, invisibly, and **only the
 > disagreement between two counts surfaced it.**
 >
 > The reason it survived: **a summary that resembles an enumeration is more dangerous than one that
 > obviously summarises.** A labelled list of named steps with states _looks_ like the artifact, so nobody
 > checks it against the record. Compare D-24 — `mergeable` was a _true answer to a different question_;
 > this was a _true answer to a smaller one_. Neither is a lie; both pass every sniff test.
 >
 > **Operationally:** where a step _produces evidence a decision rests on_, have it produced twice by
 > different means, and treat **any divergence as a finding rather than as noise to reconcile**. Prefer the
 > machine-readable record over the human-readable rendering — _read the artifact, not the summary_ — and
 > state the counts observed so a divergence is detectable at all.
 ## Decision record (authoritative, immutable)
 - **15/15 proposals decided: 13 accept, 2 modify (P-AUTHORITY-001, P-INBOX-001), 0 reject.**
@@ -221,6 +221,37 @@ reviewer, and no other seat holds mosaicstack write. Flagged to the coordinator
 busy lane. Not blocking today — RM-02's code blockers are independently disqualifying — but the next
 otherwise-clean PR meets this.
 ### D-35 — render-not-restate was enforced by a TOOL where attention had failed three times
 While editing `roles.local/merge-gate.md` to fix D-33, the coordinator **recalled the mandate string
 instead of reading it** — and the Edit tool's **exact-match requirement rejected the edit**. The source
 was then re-read and the change applied correctly.
 **Third instance for that author, occurring inside the turn that was fixing a different instance of the
 same class.** It did not reach the record, because a **mechanism** caught what attention had not.
 **This is the argument for RM-02 in miniature, demonstrated live.** The rule has now failed in both its
 authors, repeatedly, under maximal attention, while each was actively enforcing it on the other (D-26,
 D-30, and this). Every failure that _reached_ a document was caught by a human noticing later; **the one
 failure that did not reach a document was caught by a tool refusing an inexact match.**
 > **A rule that fails in its authors but is caught by a tool has told you exactly where it belongs.**
 **Requirement.** This is the pattern RM-02 generalises: exact-match/verbatim enforcement on citations and
 authoritative text, so a recalled-but-wrong quotation **cannot be written at all** rather than being
 detected downstream. The Edit tool did it by accident of design; the registry should do it by intent.
 **Fix landed durably, and by the right method:** the coordinator annotated the _source_ —
 `merge-gate.md` mandate 3 now requires the full step scan **from the JSON/API record**, names the
 default-text `clone`-pruning as D-33, and requires the gate to **state the count it observed**; mandate 4
 requires the count read from JSON, with _"a count that does not match the JSON record is
 non-conforming."_ Every future gate assignment inherits it — **annotate the source, do not restate per
 assignment.**
 **Deliberately not done:** the shared `pipeline-status.sh` wrapper was **not** modified. Other consumers
 depend on its current output; changing it mid-flight would be an unreviewed change to a shared tool at a
 moment when three lanes are reading it. Fix at a seam, tracked.
 ### D-34 — a context reset silently strips a seat's credential identity
 `rev-974` completed its RM-02 review, then **could not post it**: