UCCA Time Machine — 2026-08-25 (D)

1 · The sentence that matters

A rename landed correctly without the halt that was chasing it, because the executing seat read the substrate before acting; a build stamp turned an attestation into a verification for the first time in this house's history, by recomputation and without its author's cooperation; the engine was found to be instructing the model to emit bytes its own parser rejects, and losing whole correct modules to them; and this seat was wrong six times in two days by exactly one mechanism — reasoning about code instead of running it.

2 · What is true now, and was not at -C

• Unit B landed — 8161dac + 8c23100, deployed v45. The marketing path was not touched. All eight protected files verified untouched at this seat across 1bb93cc..8c23100.
• A4 is JOB-PROVED, not test-proved. -C §5.3's ledger entry moves. §4.
• The engine has completed three times. fc704558 is the third, and it retried.
• The build stamp was verified by recomputation at this seat — twice, on two commits. §3.
• The poller is not merely unreachable in production — it is absent from the image. §5.1.
• A self-inflicted parse defect was found, fixed and deployed the same day — 30d34a9, v46. §6.
• The whole of 2026-08-25 is filed — fourteen documents at docs 63a1fe7, root drained.
• The workspace root is STAGING, ruled by Tim. The nine-window question is closed. §7.
• §9 item 13 is CLOSED — DECLINED, ruled by Tim this window. §10.
• The assessment path has the weakest guarantees in the engine, and that is the next job. §8.

3 · The instrument that finally closed the loop

-C §5.1 argued that a content digest beats a version label because it is a comparison rather than an assertion. That was an argument this morning. It is now a demonstrated property.

The 48-file fingerprint at 8161dac was recomputed at this seat, from git, using the algorithm at consumer.py:411-446 — and matched the stamp in Checkpoint B exactly, along with its witness hash. Repeated at 30d34a9 against Alex's pre-fire number for v46: exact.

This is the first time in the ledger that an attestation from Alex became a verification here without his cooperation. Not "his report is consistent" — the same number, derived independently. A3 has done the thing it was built for, and the class of dispute it retires is the one this house has lost the most time to.

Digests of record: 8161dac → 7b071629… (48 files) · 8c23100 v45 → cce1de01… (48) · 30d34a9 v46 → e60591c6… (49).

4 · A4, proved by an accident nobody arranged

Job fc704558 crashed after module 1 and retried. Four trace records, outcome 1 bound twice across two distinct epochs; the sealed module_ids are exactly attempt 2's three; the dead pass stayed on disk and reached no envelope. Byte-for-byte the shape that killed 74c92ec5, with the fix holding.

It was not engineered, and that is what makes it strong. A fix surviving an unplanned occurrence of the exact failure it was built for is better evidence than any constructed test, because nothing about the run was arranged to be favourable.

5 · What we told the other house, and what is actually in the tree

UCCA-CROSSING-ENGINE-SCOPE-ANSWER-01 §2, carried under this house's name, says: "What exists is a field named video_script." Singular. Exclusive. False. generator/video_script.py → generate_video_script() — "Creates engaging 45-60 second sales scripts for courses" — is wrapped by renderer/video_script.py, registered in renderer/router.py, and requested by a hardcoded output_formats list at backend/jobs/poller.py:147. RTOpacks withdrew video-script generation. We answered by saying the thing they named did not exist.

5.1 — And then Act VII resolved the severity, decisively. .dockerignore allow-lists engine/ · generator/ · reasoner/ · requirements.txt; reasoner/Dockerfile COPYs exactly those three; nothing in them imports backend or renderer; the sole caller is ucca:304-306, the local dev CLI. The generator is not in the image. Absent, not merely unreachable.

So: severity resolves in this house's favour; accuracy does not. §2 claimed what the engine contains. The claim RTOpacks actually cares about — the engine you consume does not generate video scripts — is true and now provable from the image manifest.

The correction owed shrinks from its own crossing to a paragraph in whatever crosses next, and that remains Tim's ruling alone. No fence action was taken this window and none is proposed. The ADR-0002 concern over the hardcoded list largely evaporates with it — a constant in a dev CLI that never enters the image is not domain knowledge in the throat.

6 · The engine was killing its own responses

The cause. course_generator.py:340 tells the model to "Separate paragraphs with a blank line." When the model obliges literally, a raw U+000A lands inside "body_text"; RFC 8259 forbids it; strict json.loads rejects the whole response. Attempt 1 of fc704558 lost a complete, correct 2,492-character module — braces balanced, all four contract keys present — to one byte at offset 692.

Three instruments watched and said nothing, and they are one disease in three places: except Exception: parsed = None recorded that the parse failed and inferred what; A2's shape record was computed and then discarded, because it lives only in failure.json which writes on job failure and this job sealed; and D1 is blind to a failed pass inside a successful job — the only witness that attempt 1 happened is sixteen cognitive_cost rows for eleven calls, which is the known duplication defect leaving an accidental trace. An accident is not an instrument.

The fix, landed at 30d34a9 / v46. strict=False alone was rejected at the brief's own gate — it admits all 32 control characters, 29 of which reach content_html unimpeded. Instead: permit TAB/LF/CR, refuse the other 29 by name, pre-parse, carrying codepoint and offset. It fails loudly and never slices — APPLICATION_CEILING's docstring is the precedent and its ruling is that a silent slice is the worst available failure because nobody learns. Not deterministic, so with_retry keeps its budget. Unit 3 landed with it: three previously identical failures are now distinguishable, with the response bytes bounded out of the record.

Unit 2 — deleting :340 — is WITHDRAWN, not deferred. Its premise (that the newlines reach nothing) was falsified by measurement. Unit 4 is designed, accepted, and NOT built.

Same move as A2, and it should be named as a pattern: do not measure how often the model misbehaves; make the misbehaviour unable to hurt you.

7 · The filing, and a nine-window question closed

Nothing from 2026-08-25 had been filed at all. Fourteen documents filed in one commit (docs 63a1fe7), then the marker and the harness correction (9117eea). Verified at this seat: nine hash byte-identical to their pre-copy digests, and the three received copies' bodies tail-hash exactly to the crossed bytes beneath their headers.

RULED BY TIM: the workspace root is a STAGING AREA, not a permanent mirror. A filed document's root copy is removed; the root therefore holds only unfiled work, and anything sitting there is visibly owed. Standing law from 2026-08-25. -C §9 item 1 had carried this unanswered for nine windows.

Its first application exposed the scale: the root holds 297 further documents — 214 already filed and byte-identical (drainable), 76 genuinely unfiled, and 4 whose bytes differ from their filed copy. (Alex reported seven; three were received crossings whose whole files differ only by the RECEIVED COPY header — corrected at this seat by tail-hash.) Priority among the four: UCCA-AMENDMENT-NORTHSTAR-HONESTY-2026-07-24, where the root copy is larger than canon's — the only shape in which the root copy might govern.

8 · Next window — first act is a build

The assessment path carries the weakest guarantees in the engine. Read at this seat:

field	guard
title	_require_text
body_text	_require_text, min_len=40
content_html	built from both, then _assert_no_python_repr_leak
quiz.questions	data.get("quiz_questions", []) or [] — nothing
module learning_outcomes	data.get(…) or [] — nothing

assembler.py:40 and :467 carry the quiz into the sealed envelope. It is structurally governed — assembler.py:196-217 validates against the frozen v1 schema with jsonschema and fails closed — and semantically ungoverned: every content rule this house has ruled on lives inside _require_text. So _FILLER_STRINGS is unchecked there; ORDER-03's no-HTML rule is unchecked there; there is no minimum length; the repr-leak guard never looks at it.

And the sharpest instance, which nobody has named: answer_index is {"type": "integer"} with no minimum, no maximum, and no relation to options length, and nothing in the generator checks it. A sealed, signed assessment can assert that the correct answer is option 7 of a four-option question.

This house's claim is that it certifies competence. The quiz is the assessment instrument, and it has the weakest guarantees in the pipeline. Brief it, then build it.

Then, in order: Unit 4 (designed, accepted, unbuilt) · the four conflicted root files · the 76 unfiled · the harness, now with a real job (§10 item 11).

9 · Corrections this seat took — six in two days, one mechanism

claim	what was actually checked
"no video pipeline exists"	encoders and TTS — not the word
"eleven sites in three files"	a grep, four commits stale
"the eight home-side documents"	nine were listed directly beneath it
"the harness answers the base rate"	its name, not its diagnose() call
except Exception: parsed = None (the engine's own)	that it failed — never what
"newlines cannot reach sealed content"	the code, read — never run

Every one is a narrower check reported as a wider conclusion. The last was stamped ESTABLISHED AT THIS SEAT — the strongest claim this house's frontmatter offers — on a fact that had never been executed, inside the brief that catalogued the fifth.

-C is wrong on four points, corrected here: A4 is job-proved not test-proved (§4); Unit B landed rather than halted (§2); the harness cannot answer the base-rate question (§10 item 11); and UCCA-FINDING-VIDEO-SCRIPT-NAMING-COLLISION-2026-08-25's central claim is wrong twice over (§5). All stand as filed; none is rewritten.

The gates held every time. The brief demanded its control-character read be reported before the unit landed and named the narrower fix if it went badly; it went badly, and nothing shipped. Alex halted at a gate against a document this seat wrote, twice. A house whose seats are wrong six times in two days and ships none of it is a house whose controls are working.

10 · Open, and owed by Tim

1. Three documents are UNFILED at close — the control-char brief, its amendment, and this baton. Under §7's new standing law they are visibly owed, which is the law working.
2. ~~Workspace root — staging or mirror?~~ CLOSED 2026-08-25: staging. §7.
3. CLAUDE.md wrong-house naming. Unchanged.
4. The credit clock. Price-lookup repair unowned; ucca-engine credential expiry unwatched. The $0.0349 anchor is from 2026-08-24 and no new figure was taken today.
5. The in-flight freeze rule — ratify, amend or decline. Tenth window carried.
6. Unit 2 / retention tiering. RULING-A stands; the rest unruled.
7. The _model.json attribution defect — still owed its own brief. Fifth window carried.
8. The inner-artefact direction (ADR-0005's rider).
9. Unit 4 — a failed pass inside a successful job leaves no durable record. Design accepted: <run bundle>/_pass_<epoch>.json, riding the retention mirror. Not built. Its stated limit — client bundles are unmirrored under ADR-0010, so a client's failed pass still leaves only an event trail — is a retention-custody question and it is Tim's.
10. The quiz/assessment guard gap — §8. New, and it is the largest open item in the house.
11. The generated structural census. Six corrections in two days is the argument.
12. The harness. Registry built and tested — ten probe sets, eight domains — never fired. It measures diagnosis honesty, not generation shape, so it does not close item 13. Its real job: the third drift-check, "does this only work because the provider is Claude?", which is asserted in canon and tested nowhere. Phase 2's trigger needs R-RAIL-2, unbuilt.
13. Does :340 buy a visible paragraph break? Unmeasured. Decides whether the instruction is valuable, half-working, or decorative. Deliberately not asked — this seat reasoned wrongly about how that field renders twice in one day.
14. ~~The reader question, deferred until the base rate is known.~~ CLOSED — DECLINED, ruled by Tim 2026-08-25. The base rate is not measured and does not need to be: A2 converted silent loss into a named refusal. No instrument is owed. It was a deferral with no exit condition.
15. The four conflicted root files, and the 76 unfiled. §7.
16. The repr-leak guard is pattern-narrow, first covered by test yesterday. And it never looks at the quiz (§8).
17. The build stamp does not reach R2 for client jobs. Unchanged, low severity.
18. AI Gateway / a second provider — raised and explicitly parked by Tim: not near a discussion. Recorded so it is not rediscovered as new. The promo clock does not move any gate.

11 · The fence

Closed. Nothing crossed this window; nothing was drafted. The five crossings of this exchange are now filed — three received byte-verbatim under RECEIVED COPY headers, two sent unchanged including the one containing the false §2. Filing records what was said; it does not repair it.

One thing is owed and it is Tim's: a correction to RTOpacks over §2 — now a paragraph, not a crossing (§5.1). VERIFY-BEFORE-CROSS binds: filing precedes relay, one crossing in flight, Tim is the only relay.

12 · The standing lesson

-C §13 held that any control that infers rather than records will eventually be silently wrong, and that the variable which changed was proximity to the substrate, not care.

This window sharpens it, because proximity turned out to be insufficient. Six wrong claims were made with the repo mounted and open. Reading code and reasoning about its behaviour is inference — the bridge does not convert it into record. Running the code on the input in question does.

The engine now has four instruments that enforce that distinction on itself: a content digest instead of a version label, a minted epoch instead of an attempt counter, an explicit refusal instead of a pattern list, and a recorded parse reason instead of a swallowed exception. Nothing enforces it on this seat. Six rows in two days is the cost of that absence, and §10 item 10 is the entry that buys the enforcement.

And the counterweight, which is the day's real result: not one of the six reached production. Every one died at a gate — three of them at gates this seat had written into its own briefs, and two because the executing seat refused a document from the drafting seat and showed the bytes instead. The controls are load-bearing and they are carrying the load.

End of baton. Session marker: UCCA-TM-2026-08-25-D. Reads WITH the finding, the correction, the brief and the amendment filed or owed this window, and supersedes UCCA-TM-2026-08-25-C as session reference. Handover complete when the next window echoes this doc_id and this line — and its first act is a build: brief the assessment guard gap before anything else is opened.