docs(register): C-82 — guard the prose claims that can be guarded, drop the rest

[Polichinel]

Closes C-82. Registers C-84.

What C-82 was

Governance prose carries numbers and statuses that nothing checks. test_register_integrity.py checks structure and no prose at all.

The entry's own count had gone stale while it sat open — it said the actual was 24; #90 made it 25. That is the argument, not an irony: a count nothing checks is a claim with a half-life.

What is mechanised, and what deliberately is not

The general case — arbitrary prose asserting an arbitrary number — is not mechanisable, and this PR does not pretend otherwise. What recurred and is checkable is the shape where a claim names an artifact:

guard	claim it checks
test_test_files_named_by_live_entries_exist_or_name_their_repo	a live entry may not name a test file that does not exist unless it names the repo that owns it
test_a_cic_review_date_is_not_older_than_its_own_content	a CIC's Last reviewed may not predate dates in its own body
test_the_docstring_states_the_same_edition_the_constants_declare	appwrite_env.py's prose edition must equal its constant

The first is scoped to Open Concerns and Disagreements on purpose. Eleven missing test paths exist register-wide; nine are resolved entries correctly recording what discharged them. A blanket check would cry wolf and be deleted within a day — ADR-014 §3, prefer a false negative to a false alarm.

Numbers that could not be guarded were removed in favour of the command that produces them (C-33's precedent, after its measurement was wrong five times), not re-counted. Historical counts inside dated closure records are left alone: "18 tests, committed in #141" was true at #141 and is a record.

The first draft of the first guard was the bug it was written to catch

Worth reading, because it is the failure mode this repo keeps rediscovering.

Its foreign-repo exemption reused _FOREIGN_PREFIXES — the list that namespaces identifiers — over a sixty-character window. That list holds ordinary English: models, frames, pipeline-core. Mutation M1 planted a vanished test file in a live entry and the guard stayed green, because a sentence three words earlier said "pinned pipeline-core-free".

It had found its two real defects by luck of their neighbouring words and would have missed most others. Rebuilt to require the owning repo immediately abutting the path — a declaration, not a proximity heuristic — and re-proven against three mutations including the one that defeated the draft.

A guard nobody has watched fail is decoration. A guard watched failing on the wrong mutation is worse, because it has a proof attached.

Records disposed of in the same change (ADR-014 §5)

• D-11 said a branch "currently has no scheduled deletion PR" two paragraphs after recording its deletion.
• test_enrichment.py was cited as live coverage; it was deleted with GaulLookupEnricher in S5 — build_gaul_lookup.py: pyarrow-native build #90/B3b. The closure it supported was argued from a list that deletion shortened.
• views-faoapi's tests/forecast/test_wire_golden_fixture.py was stated as if it were ours. The register namespaces foreign IDs but had no rule for foreign paths; it does now.
• Clusters I, J and D-09 — the other instances C-82 named — were measured on 2026-08-05 and returned zero hits each, already fixed by intervening passes. Recorded because that is the failure mode: the register self-heals where someone happens to look and rots everywhere else. D-11 sat contradicting itself for five days in a section nobody had cause to re-read.

Seam Contract pin: 1.4.1/90fc105 → 1.4.4/fcf32c9

Not planned work — test_the_pinned_contract_edition_still_matches_the_registry failed mid-task because views-appwrite moved. Coordinate names re-verified against the new edition, unchanged; no values copied. Both partners bumped together.

The bump is what surfaced C-84, and it also exposed that both docstrings still said v1.4.1 with every guard green — hence the third test above.

C-84 (new, Tier 2) — a date, not a mechanism

The operator console read of 2026-08-05 (views-appwrite v1.4.3/v1.4.4) recorded that both platform keys expire 2026-11-17, 3h35m apart. The UN FAO key is what this delivery authenticates with.

Three and a half hours is not a stagger. After 16:10 that afternoon every identity on the seam is dead at once — model and ensemble writes, the un_fao delivery, the CRAF'd delivery, all preflights, and FAO's own read access. Neither key can cover for the other.

This repo cannot fix it — it holds no credentials and must not (þing-01 D3). A validity preflight would mean an authenticated call against the only project that exists, which is production. So this is registered as a date to act on, not a mechanism to build; inventing one would be building the wrong thing to feel busy.

C-81 updated to record that the same console session moved neither of its halves — no CI token for the two private siblings, protect_main's ref-name include-list still empty. Noted explicitly because "the operator did a console session" is the kind of adjacent fact that gets mistaken for progress.

Verification

ruff check .        # clean
pytest -q           # 360 passed, 40 xfailed

Register 83/11/72 → 84/11/73.

🤖 Generated with Claude Code