Forty-eight controls, and what they still don't catch.

The verdict gate — four levels, one direction

1-ACADEMIC/primary-sources/_index/verdict.py

Decides what a retrieved passage may be used for, evaluating narrowest-first and never widening. A hard fence checks before the register is even read; an unreadable register drops everything to CITE_ONLY; OCR damage patterns demote a passage on sight; and the top level requires a human page-check that no upstream approval can substitute for.

Third-party access verified on a fact already held

DELEGATION_LOG.md · D-29, elevated into CANON.md § Sourcing

A delegated assistant's access to a source is gated on metadata already possessed — a page count, a filename — and never on content. The stated reason: a fabricated transcription is exactly what an assistant without the file produces, so asking for content as proof of access proves nothing.

Refusal before spend, not review after

0-PROJECT/delegation/_bin/plan_generation.py

The generation planner shells out to the drift check and the wardrobe check and exits non-zero before pricing anything. It also refuses on an empty cast, on an uncast name appearing in the action, and on a gated text match. It spends nothing itself by design.

A withholding class no runtime flag can reach

build_cast_cards.py · held_atrocity

Twelve beats across three units are withheld because canon forbids aestheticising mass killing — and a generative model's default register for a battle is exactly that. Deliberately implemented as a separate mechanism from the consultation gate, so relaxing one cannot relax the other.

Byte-collapse detection on authority files

_bin/check_knowledge_precedence.py · COLLAPSE = 0.40

Content-hashes the authority set against a baseline and fails on a drop greater than 40% — “an authority file does not lose that much by editing.” It also refuses to re-baseline while failures are outstanding, so the evidence cannot be cleared before it is read.

A search that found nothing, recorded as proof nothing exists

Seven logged instances, named individually in QUOTE_REGISTER.md

The project's signature failure and the one it names most often. Twice it condemned real quotations as fabrications on a single source's silence. Once the search tool itself had never executed since the corpus moved — every absence established with it was a property of the tool, not the archive.

A rule written down, never enforced

knowledge/DELEGATION.md · check_ledger_presence.py

“Regenerate before every send” was recorded as a standing rule after one incident and failed the first time it was tested. Separately, the builder had warned on all three of a pilot's failure cases on every build for weeks and nobody read the log.

The wrongly-resolved reference — silent, and worse than a missing one

staging/PHASE-2b_GENERIC-CUES.md · D-153, D-159

Two character ids — one consultation-gated, one not — shared a display name through a flat, last-write-wins alias map, so an ungated archetype answered for a gated group across eight beats. Separately, one name matched as a substring inside another and cast the wrong person into four beats, one already generated three times.

A ruling made, and the mechanism silently doesn't carry it

D-130 · D-149 · D-153 · D-161 and the caption regression

The most common shape of defect in the build layer: a decision is recorded correctly in an authority file, and the code path that should implement it quietly does not. Five separate instances follow this pattern.

Stale state carried across a session boundary

check_ids.py docstring · QA_LOG.md

A superseded identifier was cited from memory into two live registers; an existing acquisition id was reused for a different document; a correction stamp reading “corrected to the written pages” predated the decision that moved the underlying spine, leaving four wrong ages in the file that tells an illustrator what to draw.

The register overturns two of its own condemnations

QUOTE_REGISTER.md · Pass 006

Two quotations had been marked FABRICATED and purged. Both were real. The instrument built to stop fabrication had produced two false positives of its own — and recorded that fact as prominently as it had recorded the original verdicts.

A verdict refuted by a volume that was in the corpus all along

Q-34 · refuted 2026-08-25

The finding “no usable Burr–Jackson quotations” turned out to be a search failure rather than an archival fact. The volume had been held the whole time and was never opened for that question; it carries six letters verbatim. The narrow claim survived as a rule — no record exists of anything either man said aloud.

Round 03 finds a condemnation resting on an absence that wasn't one

6-QUALITY-ASSURANCE/rounds/ROUND-03_2026-09-02.md

Ten condemned phrases were re-tested across eleven volumes and all ten stayed absent. One did not: a claim condemned partly for being missing from a correspondence it was in fact present in. The scope ruling that followed made the entry narrower, not looser — the recovered phrase is available only to scenes set after its documented date, and its second sentence remains fabricated.

A checker reporting clean while its own build was crashing

_bin/check_cast_drift.py

The drift checker once reported “8 cards, clean” while the reference build it compares against was failing. It now carries a distinct build-failure code, refuses to compare a card to its own previous version, checks in both directions, and shells out for a fresh build to catch hand edits.

Five gates green, with a fabricated citation sitting in the register

check_ids.py — written 2026-08-31, after the fact

A superseded identifier was cited into an audit pass and a character bible, and an existing acquisition id was reused for a different document. Every automated check passed. It was caught only because the principal questioned a claim that had been built on it.

The one hard factual error on a page

CROSS_ARTIFACT_AUDIT_2026-08-26.md §2.1 → ruled 2026-08-27

An epilogue heading staged a treaty signing in the wrong place — the document was signed elsewhere. The audit surfaced it and explicitly declined to resolve it, marking it as needing the principal's judgment. The ruling restaged the scene around the paper's arrival, so nobody signs anything in frame.

A file contradicting itself in adjacent lines

A _VISUAL.md frontmatter block · resolved 2026-08-31

One line read appearance_provenance: "[INVENTED] and LOCKED"; the next read locked: false. It survived several review passes because nothing compares a file to itself — the drift checker compares a card to its authorities, never a document to its own contents.

A ruling on how the programme may be reported

0-PROJECT/STAGING_PROGRAM.md §5b

The principal ruled out burndown reporting, coverage percentages presented as progress, and framing open decisions as debt — because beats may be removed or changed as depth is added, so beats-closed does not measure success. Separately, a proposed classification field was written but deliberately not applied, because deciding who is classified is the judgment the consultation exists to inform.

Round 01 — full rubric, full corpus · 26 Aug 2026

66/75, Strong. No critical-failure condition triggered; three given qualified rather than clean status. 119 tracked quotations, 34 caught as fabricated and purged. Six of the project's own false verdicts logged, all from the same cause, and the governing rule rewritten as a result. Five open questions carried forward by name.

Round 02 — re-run of invalidated negatives · 2 Sep 2026

Not a score. A mandated re-run after the search tool was found never to have executed. Four negatives re-confirmed against a 22% larger corpus; one absence held at exactly the same hit count, which the round treats as a strengthened verdict rather than a repeated one. Two leads left unruled by design — “no verdict was edited; these are the principal's to rule.”

Round 03 — purge-list re-verification · 2 Sep 2026

Ten condemned phrases re-tested across eleven volumes; all ten stayed absent. One entry was partly refuted and the scope ruling that followed made it narrower, not looser.

Stood open as the highest-leverage unbuilt control here: a repository initialised with zero commits and 868 files staged, with forty-six manual snapshot folders substituting for it at far higher cost and lower coverage — no snapshot ever contained a cast card, so an entire artifact class had no undo at all. The project's own diagnosis: “git init and a first commit would have made the whole question a two-minute diff.”

Closed 3 September 2026 — commit 1f66deb, 901 files, 17.3 MiB packed.

And closing it found a live breach of another control. The staged index held 139 MB including the Papers of Andrew Jackson text layers and the 26 MB index built from them — material .gitignore already forbade in its own words, “primary sources are not ours to redistribute; a repo is a distribution mechanism.” The rule was written after the original git add, and an ignore rule does not apply retroactively to a path already in the index. The first commit would have shipped the corpus.

The human page-check ledger is empty and no tooling exists to write to it, so the top permission level is unreachable and the whole corpus caps at paraphrase. The failure is safe — nothing can be misquoted — but the control is unproven, and an unproven control should not be counted as a working one.

By the project's own axiom — a rule a human must remember is not a gate — nearly half its controls are not gates. Several of the most consequential (never hand-edit below the authority layer; never regenerate from memory; the two-file consumer interface) are prose and prompts, not enforcement.

Stages 1–3 — character sheets, location plates, shot specifications — do not exist; the directories are empty. Images were generated from cast cards instead. The result may well be better, but a pipeline document describing a route nobody takes has stopped governing, and its stage gates cannot be evaluated.

Coverage is inferred from wardrobe data, and a covered person correctly has none — so the gate can miss the people it exists to protect. Four compensating fences were added. The clean fix is a declared classification field, deliberately unbuilt because deciding who is classified is the judgment the consultation exists to inform.

After an overwrite, four scripts read damaged inputs and reported clean. The project's verdict — “it is not clean, it is blind; a checker that cannot see its own input is worse than no checker, because it converts an unknown into a false assurance” — is exactly right, and the recommended remedy is still unimplemented.

Scored 3/5 on the rubric specifically for this, and ten third-party assets have unrecorded provenance. Correct discipline is being observed in its absence — nothing paywalled reproduced, no cultural specifics invented — but the round's own phrasing stands: correct discipline, not compliance.

Separate retrieval permission from assertion permission

A document being findable and a sentence being quotable are different privileges with different evidence requirements. Most retrieval systems collapse them and inherit a source's authority onto a lossy extraction of it.

Make the tool report what it could not see

A retrieval failure and a genuine absence are indistinguishable at the point of use. Printing scope, exclusions and known holes on every result — especially empty ones — is what stops an empty result being read as a finding.

Verify third-party access on a held fact, never on content

Asking a model to prove it has a document by quoting from it proves nothing — a fabricated quotation is precisely what a model without the document produces. Gate on metadata you already possess.

Fail closed, and say so in the error

Absent policy, absent classification, absent baseline — each defaults to the restrictive branch, and the refusal names which condition fired. A refusal a user can read is a control; a silent restriction is a bug report waiting to happen.

Surface, do not auto-remediate

Automated checks that fix what they find destroy the distinction between a defect and a deliberate exception. The cost is a queue somebody clears; the benefit is that the record stays interpretable.

Refuse a capability before it embarrasses you

A tiered feasibility assessment that approves two tiers and refuses the third on a stated rationale, written before the capability existed — naming the harm and the alternative rather than deferring to a review that never comes.

Count against the real denominator

Coverage measured against what exists on disk rather than what was supposed to exist will always look better than it is, and will hide precisely the items that were never created.

Keep an audit trail that moves in both directions

Reversed verdicts stay visible with their corrections attached, because a pass that only ever tightens is not auditing, it is flinching. A control programme that only ever adds restrictions is not measuring anything.