Skip to content

Amendment — the relay carries the digest, not the draft

1 · What VERIFY-BEFORE-CROSS says, and what it could not do

Filing precedes relay, always. Founded after 3 August, when a received crossing was verified byte-exact on arrival and then never written to disk — neither house's register knew it existed for twenty days, and the client waited that long for an answer to a document we could not prove we had received.

The rule was correct. The rule was also unenforceable, and that is a different property. It stated an order of operations and relied on the relay remembering it under whatever conditions obtained at the moment of carry.

2 · The breach — 2026-08-26, and it is recorded against Tim by his own ruling

UCCA-CROSSING-RELIABILITY-CORRECTION-01 was carried to RTOpacks without being filed and without being registered.

Established by read at this seat: zero occurrences of the doc_id anywhere in docs/ucca-docs; zero register rows; not present in canon/sent/. The repo HEAD is a309d3a, dated the same day — it was being committed to, so nothing was blocked. The only copy in existence is one unversioned file at the workspace root.

Tim's ruling on the attribution, in his words: "That's mine. I'm the relay, filing precedes relay, and I crossed it without either. Note it as a breach against me in the register, not a process observation." It is recorded that way, and the register row will name him.

2.1 — What it means, which is worse than the fact

Right now, if this house were asked to prove what it sent RTOpacks and when, the answer lives in one file on one laptop, with no published digest, no register row, and no filed bytes. The house that sells provenance cannot presently evidence its own outbound correspondence.

2.2 — The finding, which is Tim's and is the reason this document exists

The rule was written after 3 August and broke the first time it met time pressure, three weeks later. That is not a discipline problem. It is a design problem.

The crossing was urgent — a client was sequencing a launch on a false claim, and every day it stood was a day their plan was wrong. The rule lost to the urgency it was written for. A rule that only holds when nothing is pressing is not a rule; it is a preference with good intentions.

2.3 — And it compounds the defect it was correcting

The correction told RTOpacks, honestly, that a claim of ours had outrun its evidence. It was then carried in a way that leaves this house unable to evidence the correction itself. Not fatal, fully recoverable in one commit — and exactly the shape of thing that is only ever recoverable while somebody still remembers.

3 · The amendment — RULED by Tim, 2026-08-26

What the relay carries is the FILED DIGEST, never the draft.

Before any crossing leaves this house, the relay is handed exactly four things, and nothing else is relayable: filename · sha256 · byte count · line count. Those come from the filed path after the commit.

If it is not filed, there is nothing to paste.

3.1 — Why this works where the original could not

The original rule forbade an order of operations. This one removes the material for the wrong order. There is no draft to relay because the thing the relay holds is a digest, and a digest can only be computed off a filed path. The failure stops being forbidden and becomes impossible.

That is the general form and it is worth stating separately, because this house will meet it again:

A rule that depends on remembering it under pressure will be broken under pressure. Where a rule can be converted into a mechanic that makes the failure unavailable, convert it. Where it cannot — SCOPE-STATED §7A is the example, and its no-checker clause is emphatic — say so explicitly and accept that it is reader-enforced.

3.2 — What this does NOT do

  • It does not add a checker or a gate. No code is written for this. The mechanic is what the relay physically holds, not something that inspects him.
  • It does not slow an urgent crossing. Filing is one commit. The 3 August incident and this one both cost more than the commit would have, by an enormous margin.
  • It does not alter FENCE-PROTOCOL-01's bytes. Amended by addition, per the NORTHSTAR-01 v1.1 precedent, so the filed digest of the protocol stands.
  • It does not change who relays. Tim is still the only relay. It changes what is in his hand.

3.3 — The remediation for the present breach

File the carried bytes to canon/sent/ unchanged — expected bc9985e220207e47…, 10,087 bytes, 166 lines. Do not amend them to fix the ordering. They are what crossed; the record says so; the register row carries the breach. Filing a corrected version would be the ordering defect repeating as a falsification.

3.4 — ⚠ ON DIGEST MISMATCH: STOP. FILE NOTHING. REPORT THE ACTUAL DIGEST.

Ruled by Tim, 2026-08-26: a guard names its forbidden set, and §3.3 named only the permitted one.

If the root file does not verify to bc9985e220207e47… / 10,087 bytes / 166 lines on all three measures:

  • File nothing. Not the crossing, not under the expected digest, not under the observed one.
  • Report the actual sha256, byte count and line count, and stop.
  • Do not reconcile, tidy, or reconstruct what the difference might have been.

Why this outranks the thing it interrupts. An unfiled crossing is a missing record and it is recoverable. A crossing filed under a digest that is not its own is a FALSE record, it is self-certifying, and nothing downstream can detect it — every future reference verifies against the wrong anchor and returns "match." This house would be unable to say what it sent its client, while holding a document asserting that it can.

Drift would also mean something touched those bytes after they crossed, which is a finding in its own right and a larger one than the unfiled document. It gets reported, not absorbed.

The general form, because this house keeps meeting it: a guard that states only what is allowed tells the executing seat nothing about the case it will actually hit. GEN_APPLICATION_OVERFLOW and the assessment guard both default-deny on shape for the same reason — I only guard what I have been shown. A guard that names no forbidden set is a preference.

Delivery slip — engine-side; this document governs crossings and does not cross
Who it goes to Tim, then UCCA Alex verbatim.
What Tim does Relays. From the next crossing onward, holds four things and nothing else: filename, sha256, bytes, lines — taken off the filed path after the commit.
What Tim says to Alex Verify the crossing's digest BEFORE staging anything — bc9985e220207e47…, 10,087 B, 166 lines, all three measures. On any mismatch: §3.4 — stop, file nothing, report the observed digest. On match: file it to canon/sent/ byte-unchanged and this amendment to ground/, in ONE commit. Two register rows: the crossing's, carrying the breach against Tim in his own words; and this amendment's. Read back both filed paths and report sha256, bytes and lines for each.
What Tim doesn't touch The carried bytes. On match they file exactly as they crossed — not corrected, not tidied, not reordered. On mismatch they are not filed at all, and nobody reconstructs the difference.
Blocking? Tim ruled this goes first — before the successor, before anything. It blocks nothing technical and everything procedural: no further crossing leaves this house until the mechanic in §3 is the one in use.