core/docs/assessment/31-hindrance-audit.md

# The Hindrance Audit

**Assessor:** Fable 5 (Phase 4) · **Verified at:** `8927c563` (2026-07-27)
**Discipline:** A hindrance is something *present* that works against the goal — a wrong solution for its underlying problem, a responsibility lodged in the wrong owner, a trade-off tuned instead of dissolved, or a record that misleads the next reasoner. Every entry carries evidence, a fitness verdict from the schema vocabulary, a **proposed better home**, and its deciding authority. Per standing rule: settled rulings are constraints — an entry may flag a ratified decision only on evidence, only for ruling, never as a unilateral recommendation to reverse. **This audit decides nothing.**

Ranked by leverage (cognitive/structural load removed ÷ effort), per the AGENTS.md protocol — not by ease.

**Amended:** 2026-07-27 at `ed06dd64` (Opus 5, Phase 6) · **re-verified 2026-07-28 at `797ebad5`** (H-12's ten-file delta re-measured and unchanged; H-8d's wording corrected on re-verification — see the entry). **H-12 added** (the two smoke gates have diverged). **H-8 gains a fourth instance**, located inside the source rather than the documents. **H-1 gains a note**: its exposure is already pinned. Derivations in [`50-execution-plan.md`](50-execution-plan.md) §0.
**Amended again:** 2026-07-28 at `8f0ccfe3` (Fable 5, external-assessment triage). Two external first-principles assessments were verified against code line-by-line; two of their observations survived and are entered as **H-13** and **H-14**, **H-8 gains a fifth instance (e)**, and six of their proposals were examined and cleared (see the closing section). Every rejected proposal failed on evidence one file-read away from its claims — the third recurrence of the N-1 scan-artifact class.

---

## H-1 · License evidence counted on an independence assumption replay violates
**Verdict:** `wrong-solution` (the *counting basis*, not the gating) · **Layers:** M5
**Evidence:** Wilson lower-bound licensing (θ_SERVE=0.99, ADR-0175 lineage) assumes independent trials; a replay of the same sealed case is one trial observed again, not a new one. Measured consequence recorded in the prior arc: **21 of 25 ratified bands fall short** of their floor when replays are deduplicated.
**Why it hinders:** the entire earned-license architecture — CORE's mechanism for *deserving* to serve — rests on the evidence count. An overstated count grants licenses the evidence doesn't support, which is precisely the failure the mechanism exists to prevent. The gate is right; the arithmetic feeding it is not.
**Better home:** distinct-evidence counting at the seal boundary (count distinct cases; a replay refreshes, never increments), declared in the ledger schema the way ADR-0263 Rule 5 declares absence policy — in the table, not the call site.
**Note (Phase 6):** the exposure is **already pinned in-repo**. `tests/test_volume_honesty.py` (ADR-0264 R9, in the local smoke gate) pins *"21 of 25 bands do not clear θ_SERVE on distinct evidence"* **in both directions**, measured 2026-07-25 at `6ada6f7a` with every band at 720 committed decisions, and its own comment calls the inventory *"an EXPOSURE INVENTORY, not an approved baseline."* The audit source is `docs/research/distinct-evidence-audit-2026-07-25.md`. The open work is therefore **applying** the shortfall, not discovering it — and that pin moves in the same PR.
**Authority:** ADR amendment (0175/0263 lineage) + a re-count of the 25 bands, authorized by R-13. The re-count may demote licenses; that is the mechanism working.

## H-2 · Decoration in the runtime constructor — objects built and never read
**Verdict:** decoration (fails the sabotage test) · **Layers:** M6/M3
**Evidence:** `DriveGradientMap` constructed at `chat/runtime.py:716`, read nowhere. `InhibitionMask`/`InhibitionOperator` exported by `core/physics/__init__.py`, constructed on no path. Deleting either changes no output.
**Why it hinders:** dead structure is not neutral — it is *testimony*. Both objects tell every reader that drive mapping and inhibition masking are live, and Phase 1 of this very assessment initially believed them. Decoration is how architecture lies without anyone lying.
**Better home:** deletion (mastery algorithm step 2: the best part is no part), with their *intents* preserved where they belong — drive in the CR-2 design (G-4), the mask's disposition in the CR-1 ADR (G-14). If a future mechanism needs them, re-adding a deleted class is cheap; un-believing a phantom is not.
**Authority:** mechanical PR + one line each in the CR-1/CR-2 decisions.

## H-3 · The typed refusal is constructed, then discarded at the public boundary
**Verdict:** `strained` — truth built and unserved · **Layers:** M4
**Evidence:** `InnerLoopExhaustion` carries reason, region, and per-step rejected-attempt evidence; `respond()`/`arespond()` convert it to `""` for the `str` contract, so a refusing turn serves the empty string with `refusal_reason == ""`. The plumbing to materialise (`CognitiveTurnResult.refusal_reason`, `compute_trace_hash` fold) already landed; `runtime_contracts.md` names it a residual awaiting a future ADR.
**Why it hinders:** the honesty machinery is the product. A system whose refusals are richer than its answers, serving its refusals as nothing, undersells its own thesis on every hard turn.
**Better home:** materialise into `ChatResponse.refusal_reason` (and a minimal honest surface), per the contract's own anticipation.
**Authority:** small ADR — the chain already reserved the seam.

## H-4 · Composer-arm precedence is ordered branches above a declarative resolver
**Verdict:** `strained` — a solved pattern not yet extended · **Layers:** M4
**Evidence:** `core/cognition/surface_resolution.py` (494 lines) resolves the pipeline seam by *declared* precedence, self-documenting, with an in-code falsifiable contract for its own regression. Upstream, the composer arms (deduction `:1834`, curriculum `:1850`, pack/narrative/example/relation `:1871–:1936`, determination, estimate, gate, hedge) remain ordered branches across `chat/runtime.py`, in a different package with a different owner — nothing structurally prevents arm N+1 from bypassing the resolver's disciplines.
**Why it hinders:** prospectively — each new serving capability adds an arm ahead of any declared order. With only deduction ON, the live complexity is modest; the time to dissolve the pattern is *before* the next three arms, not after.
**Better home:** extend the resolver's declared-precedence pattern upstream to arm selection — the Third Door here is half-built and proven to fit this codebase.
**Authority:** refactor ADR; low-risk while one arm is live.

## H-5 · Underived constants at the semantic center of generation
**Verdict:** `strained` — Pillar I violation with an in-repo counterexample · **Layers:** M3/CR-1
**Evidence:** `salience_top_k=16`, `inhibition_threshold=0.3` gate every token walk's candidate set; no recorded derivation exists for either. The contrast is instructive and in-repo: `admissibility_margin δ=0.4` was derived from the minimum observed margin of a characterization corpus (0.456), declared *falsifiable*, and survived a 20-case stratified attempt — the standard exists two config lines away.
**Why it hinders:** "thresholds tuned for good-enough" at the exact point where the system decides what it may consider. Also the self-narrowing budget feedback (`stream.py:637`) — a real cognitive property nobody has named or justified.
**Better home:** the CR-1 ADR (G-14) with an empirical derivation in the δ=0.4 style.
**Authority:** ADR + a small characterization run.

## H-6 · The half-forced flag pair gating the lived learning loop
**Verdict:** `misplaced` responsibility — a *set* decision made one flag at a time · **Layers:** M6/M5
**Evidence:** F-6 (`05-phase3-findings.md`): the daemon forces the consolidator, not the accruer; the loop's writer and its consumer are gated independently, and only the consumer is on.
**Why it hinders:** flags that must be coherent *as a set* are owned nowhere as a set. `CONTINUOUS_LIFE_CONFIG_FLAGS` is the right pattern (a named, documented flag *profile*) applied to the wrong subset.
**Better home:** the flag-default register (G-8) with named profiles (one-shot / eval / continuous-life), each profile ruled as a unit.
**Authority:** ruling on the accrual flag + the register PR.

## H-7 · The production ingest boundary lacks the trust contract its sibling has
**Verdict:** `strained` — the standard exists and stops one layer short · **Layers:** M2
**Evidence:** formation declares six boundaries — content-addressed in/out, no floats in hashed payloads, no pickle, an audit record per rejection. `ingest/gate.py`, facing untrusted user text in production, has the versor gate and the AGENTS.md trust-boundary defaults, but no comparable declared table.
**Why it hinders:** asymmetric rigor invites the assumption that the un-tabled boundary is the less important one; it is the opposite.
**Better home:** an M2 trust-boundary table in `runtime_contracts.md`, formation-style; hardening PRs only where the table exposes real deltas.
**Authority:** documentation first; evidence decides whether code follows.

## H-8 · The record contradicts the code at three load-bearing points
**Verdict:** `wrong-solution` as *record-keeping* — divergence that reasoners inherit · **Layers:** governance
**Evidence:** (a) ADR-0146 rejects the daemon shape and places *"cross-process file locking, daemon synchronization, and signal handling"* out of scope; `chat/always_on_daemon.py` ships all three (`fcntl.flock` single-instance lock, SIGINT/SIGTERM, load-time identity guard) and is unowned. (b) ADR-0252's headline "34 organs" has no reproducible basis (18 `resolve_promotable_*` entry organs at the ratification commit *and* at `ed06dd64`; ~32 modules). (c) `architecture-assessment-verification-2026-07-25.md` asserts accrual "is enabled by the production L10 process"; the flag set says otherwise. **(d) — added Phase 6, and it is inside the code.** `core/config.py`'s docstring for `accrue_realized_knowledge` states *"the production L10 process enables it alongside `persist_session_state`"*, and the docstring for `consolidate_determinations` states the same about *"`accrue_realized_knowledge` + `persist_session_state`"*. `CONTINUOUS_LIFE_CONFIG_FLAGS` (`chat/always_on_daemon.py:45-49`) forces `persist_session_state`, `consolidate_determinations`, `strict_identity_continuity`, and **not** `accrue_realized_knowledge` — so the first docstring is false outright, and the second is false in its *"alongside `accrue_realized_knowledge`"* clause. *(Stated precisely on the 07-28 re-verification: an earlier draft of this entry said the flag set "contains neither claim's subject," which is wrong — it does contain `consolidate_determinations`. The false clause, in both docstrings, is the one naming the accrual flag as co-enabled. A third comment, on `persist_session_state:283`, makes the same shape of claim and is **true**.)*
**Why it hinders:** demonstrated, not hypothetical — this assessment's own Phase 0 inherited a stale-record error, and the 2026-07-25 doc (itself a *corrective* document) introduced one. Every divergence is a future wrong analysis. Instance (d) is the sharpest: it is one layer *below* the documents, where a reader checking the code against the docs would stop and believe.

**(e) — added 2026-07-28 (external-assessment triage), and it is inside the code again.** `core/cognition/inductive_closure.py`'s docstring rule *"Cycle: if path would revisit a node, skip"* (`:106`) describes a check the implementation does not perform — it checks `a == c` and known-triple membership only (`:189-193`), **which is sufficient**: the fixed point is monotone over a finite triple set, so no path-based check is needed for termination, and adding one would *refuse sound transitive derivations* (a witness path that revisits a node still proves a true fact). Separately, `path` records only `(a, b, c)` even for derivations whose chain is longer (`:198`), so the provenance serialized into `operator_invocation` is incomplete for multi-step derivations. The remedy splits: the **docstring correction is mechanical** and belongs with the amendment batch; extending `path` to full provenance **changes `operator_invocation` bytes and therefore `trace_hash`**, so it is held to the trace-change bar and must not land silently.
**Better home:** five amendments — ADR-0146 addendum owning the daemon (drafted in `50-rulings.md` R-12a); ADR-0252 basis footnote (drafted, R-12b); a correction note on the 07-25 doc; the two docstrings corrected or the flag added, per R-3; and the inductive-closure docstring correction (e), mechanical.
**Status (2026-07-28): (e) CORRECTED.** `expand_relation_closure`'s docstring now states that termination is structural (monotone growth over a finite triple set) and that **no path-revisit check is performed and none should be** — one would refuse sound transitive derivations. It also records that `path` is the *witnessing* step rather than full ancestry, and that extending it would move `operator_invocation` and `trace_hash`, so it is deliberately not done. (a)–(d) remain open on their rulings.
**Authority:** docs PRs + ruling signatures (R-12 for the two ratified ADRs, R-3 for the docstrings).

## H-9 · Dead instruments still standing as if live
**Verdict:** `superseded-in-place` (unratified) · **Layers:** MV/governance
**Evidence:** `docs/gaps.md` — 26/26 closed, no entry from any 2026-06+ arc; `substrate-liveness-ratchet` — v5, stale since ~2026-05-24, all OPEN items L10-chained; ~130 analysis docs with no aggregator. The system map — the best macro artifact — is local, gitignored, 48 days stale, and was wrong precisely where the project moved fastest; its phantom "L12" stratum exists nowhere else.
**Why it hinders:** an instrument that *looks* authoritative converts "I should check" into "I already checked." Phase 0's error was this mechanism operating on this assessment.
**Better home:** this register supersedes `docs/gaps.md` (marked historical); the ratchet's 7 OPEN items migrate here (G-5 absorbs their L10 dependency); the map stays a regeneratable local index per D5, with "L12" dropped; the assessment directory becomes the standing ruled record, `verified_at`-stamped.
**Authority:** ruling (one PR).

## H-10 · The demotion that mispriced the paradigm experiment
**Verdict:** `strained` framing — a correct ruling casting an incorrect shadow · **Layers:** M3/governance
**Evidence:** GSM8K was demoted to diagnostic (correct — the flags-and-benchmarks reasoning stands). The §5 SME experiment lives in GSM8K's neighborhood (`holdout_dev/v1`, math structures), so it inherited the demotion's priority — but its verdict governs the *comprehension paradigm for everything*, per ADR-0252's own §4 conformance bar.
**Why it hinders:** the highest-leverage open item in the project (G-1) has been priced as math-lane housekeeping.
**Better home:** none needed — G-1's execution *is* the fix; this entry exists so the mispricing mechanism is named and not repeated.
**Status (2026-07-28): confirmed and discharged.** G-1 ran to a recorded NO-GO in hours, not an arc (`docs/research/sme-experiment-verdict-797ebad5.md`) — which is the mispricing demonstrated rather than asserted. The entry also understated itself: the experiment had *already been run twice* and returned GO both times, and both results sat unmerged on `rnd/` branches while the highest-leverage item in the project was recorded as unstarted. The demotion's shadow fell not only on the priority but on the *retrieval* of work already done.
**Authority:** already covered by G-1's ruling.

## H-11 · A silent-failure pinhole inside a typed layer
**Verdict:** `strained` (small, cheap, principled) · **Layers:** M3
**Evidence:** `_accrue_in_turn`'s broad guard converts any exception in the read→realize→determine chain into a no-op accrual with no telemetry (F-10). Defensible as a backstop; invisible as a signal — in the one layer whose constitution is "failures are typed, never silent" (INV-34).
**Better home:** count the swallow (a telemetry field on `IdleTickResult`/turn accrual), not a behavior change.
**Authority:** mechanical PR.

## H-12 · The two smoke gates have diverged by ten files, and one comment says they cannot
**Verdict:** `strained` — a real asymmetry, *smaller* than it first looks · **Layers:** MV
**Evidence:** `TEST_SUITES["smoke"]` is **23** files; `.github/workflows/smoke.yml` is 8 path patterns expanding to **13**. The ten local-only files are `test_audit_ledger_r7`, `test_cli_runner_contract`, `test_pack_draft_serve_boundary`, `test_workbench_deduction_provenance`, `test_prior_surface_deduction_binding`, `test_negation_survives_articulation`, `test_adr_status_governance`, `test_adr_index`, `test_volume_honesty`, `test_curriculum_polarity`.
**State the counter-evidence first.** AGENTS.md §CI/CD is explicit that `.github/workflows/*.yml` are *"secondary observability only — never a substitute for local gates"*: the merge gate **is** the in-worktree run, and the in-worktree run is the **superset**. Eight of the ten files carry in-code comments saying they belong *"on the pre-push gate"* — which is exactly where they are. **Under doctrine, nothing is unguarded**, and any reading of this entry as "ten pins run nowhere" is wrong.
**Why it hinders, precisely:** (1) **two independent places assert the parity** — the audio block in `core/cli_test.py` says it is listed explicitly *"so the local-first pre-push gate (AGENTS.md protocol) **equals** the CI gate rather than silently narrowing it,"* accurate about the six audio files and false as the statement about the suite a reader will take it for; and `scripts/hooks/pre-push`, the *automation of the AGENTS.md protocol itself*, describes its own step 1 as *"the `smoke` suite — **exact CI-gate parity**"* while running 23 files against CI's 13. A claim made twice inside the enforcement tooling is the strongest available evidence that the drift was never intended; (2) the real exposure is the **push that skipped the local gate** — from a cloud session, another machine, or an agent — for which CI is the only automatic check, and for which ADR-0265's denial pin, both ADR-governance pins, volume honesty, and curriculum polarity currently run nowhere before merge. Six of these files were promoted *after* real silent-regression incidents (#136, #113, the 2026-07-20..24 register-axis drift), so the failure mode they exist to catch is demonstrated, not hypothetical.
**Better home:** the gate-parity pin in G-7 — the drift is only invisible because nothing measures it. Measured parity cost: **429 tests in 46s** on the Act runner's own hardware (`ubuntu-latest:host` = native macOS host).
**Authority:** R-14 sets the direction (raise CI, or lower local, or keep them different and correct the comment); the pin itself is mechanical.

## H-13 · The speculative-marker cache un-marks a sibling proposal's material on promotion
**Verdict:** defect — honesty regression on a served marker · **Layers:** M4/M5
**Evidence:** `_speculative_subjects` is a flat token `OrderedDict` with no owner tracking (`core/cognition/pipeline.py:161`). A SPECULATIVE proposal seeds its subject plus every ≥4-char non-stopword token (`:726-729`); on COHERENT promotion, `_forget_speculative_subject` pops the subject and each token **regardless of which proposal added it** (`:736-739`, `:1045-1055`). Promoting "practical wisdom" therefore evicts the shared token "wisdom" while an independent "wisdom" proposal is still SPECULATIVE — and that proposal's material is then served **without its marker**.
**Why it hinders:** the marker is the honesty surface for unreviewed material, and the failure direction is served-unhedged — the direction this architecture treats as the expensive one. *(Provenance: surfaced by an external assessment that described this seam with the direction inverted — it claimed under-eviction; the code over-evicts. The verification that caught the inversion is what confirmed the real bug.)*
**Better home:** a reference-counted cache (token → count of live proposals; decrement on promotion, evict at zero), with the LRU cap retained as a size valve. **Failing test first:** promote one proposal, assert the sibling's marker survives — red before green.
**Authority:** mechanical PR + red-then-green test; flag at review whether ADR cover is wanted, since served-marker behavior changes (in the honest direction).
**Status (2026-07-28): FIXED.** `_speculative_subjects` is now `OrderedDict[str, int]` — a reference count; `_forget_speculative_subject` decrements and evicts at zero, flooring at removal so an unmatched release cannot borrow against a later proposal's claim. Four new pins in `tests/test_speculative_subject_lifecycle.py`, **all four observed red before green**; the eight pre-existing lifecycle pins pass unchanged. **Ratification note:** this changes served surfaces — markers now appear on turns where they previously vanished. The direction is toward disclosure, and it restores ADR-0021 §Articulation's stated intent rather than extending it, so it is offered as a defect fix; say if you want ADR cover before it ships.
**Found while fixing it (G-7's mechanism, live):** `tests/test_speculative_subject_lifecycle.py` — the file that pins this exact behavior — is **in no curated suite tuple**, reachable only through `full`. The pin that would have caught this defect on a pre-merge gate does not run on one. Assignment left to PR-4, which is designed to place every orphan; adding it to `TEST_SUITES["smoke"]` alone would widen N-3's ten-file delta and prejudge R-14's direction, so it was deliberately not done here.

## H-14 · The cognitive spine's turn method is 759 lines, with back-stamp repairs as the symptom
**Verdict:** `strained` — structure debt on the highest-traffic path; H-4's sibling · **Layers:** M3/M4
**Evidence:** `_run_turn` spans `core/cognition/pipeline.py:189-947` (759 lines) under a module docstring still describing a thin delegating wrapper ("delegates to ChatRuntime internals… clean plug-in surface"). Trace-hash inputs accumulate across the whole span, and two explicit back-stamp calls exist (`finalize_turn_trace_hash` ×2, `finalize_turn_surface` ×1) because those values cannot be computed atomically where first needed.
**Why it hinders:** prospectively, H-4's mechanism — each landing phase is added inline, and the contributor must manually audit every prior phase for trace determinism. The back-stamps are the measured symptom, not the disease.
**Better home:** staged decomposition — deterministic pre-turn context → the delegated `runtime.chat()` call → post-turn resolution → **a stateful learn stage** (the teach step mutates the teaching store and the speculative cache, so a pure-tripartite framing is wrong and would mislead its own implementer). Zero-delta bar: byte-identical trace on the live lanes, PR-10's discipline.
**Authority:** refactor ADR, sequenced with or after PR-10 (H-4); not before Wave 2.

---

## Explicitly examined and cleared

For symmetry with the Candidate Register's "considered and not registered" — hindrance candidates this audit *rejects*:

- **The 18 derivation organs** — condemned but *ruled* to keep serving (`superseded-in-place` by explicit ruling); their continued service is governance working, not failing. The hindrance was their unreproducible count (H-8b), not their existence.
- **Off-serve quarantines** (holographic vault, wave modules, `topological_reasoning`) — capacity that exists and cannot be used *by AST-pinned design*; legitimate research containment with failing-when-violated enforcement. An exit criterion would be nice (M1 card); the quarantine itself is fit.
- **Pure-Python-by-default algebra** — measured as the correct posture: determinism is the product, `versor_condition` is 0.22% of turn time, and the urgency argument for Rust-by-default dissolved under measurement. The open parity question (blocked on network) is a question, not a hindrance.
- **The five unreconciled articulations** — dissolved by the taxonomy (D1), not a standing hindrance; the residue is one stale Draft banner (folded into H-8's amendment batch).
- **Flag-gated conservatism itself** — seventeen dark flags is not inherently hindrance; *unregistered* darkness is (G-8). The posture may be exactly right; the register exists so that judgment can be made deliberately.
- **Six proposals from two external assessments (2026-07-28)** — each verified against code and cleared, with the refuting file named: **EpistemicState compression** (the "unused" states are the vault's refuse-forcing states and the serving path's `UNVERIFIED_POSSIBLE` — `vault/store.py:99-103`, `chat/runtime.py:1329`; ADR-0206 already partitions the taxonomy per-state in `core/response_governance/policy.py:64-100`); **an EpistemicState×NormativeClearance product type** (forbidding DECODED+SUPPRESSED at the type level erases the refusal's evidence — H-3's failure rebuilt as a type constraint; the coupling already exists as policy, where the legitimate combinations are decided); **PID attestation on `lived_life.json`** (a reboot-resumed life's writer PID is dead by definition, so the check refuses every legitimate resume, and PID reuse defeats attestation — the same pid-file pitfalls the lock's own comment derives against); **path-based cycle skipping in the inductive closure** (would refuse sound transitive derivations; see H-8e — the docstring, not the code, is the wrong side); **a depth-enrichment session cache** (the cost it targets is already `@lru_cache`d at the pack layer, `chat/pack_resolver.py:19`; measure first — the 0.22% Rust precedent); **a unified reasoning engine presented as refactor** (changes `operator_invocation` bytes → `trace_hash`, silently widens capability by letting compose see closure-derived triples, and reduces entailment to set membership one merge after ADR-0265 ratified denial representation — the underlying facts are real and are recorded as design considerations under H-4/H-14). Triage rule kept from this round: **no external lead folds in without the one-more-file check** — every rejected proposal above failed on a file its author did not open.