Every doors-unchanged drill record points the panel at the wrong CI job for the pin — self-ref-check has never run in self-guards

[dan-claude-bot]

Found while closing out #338 — reading drills/0.6.2.md against the tree rather than against the check-run. Everything below is executed at main (7cef387) and at each record's own release tag, never carried from one record to the next.

The finding

Every doors-unchanged record ever written carries a "Standing evidence at the candidate head" table, and every one of them gives row 4 as:

| 4 | the real tree's own guards (armed, monotonic, drill-recorded, self-ref) | self-guards on this PR | … |

self-guards does not run self-ref-check.sh. It never has. At main it is five composite steps and no run: at all — ci.yml#L77-L90:

- uses: ./actions/changelog-armed
- uses: ./actions/changelog-monotonic
- uses: ./actions/changelog-assembled
- uses: ./actions/drill-recorded
- uses: ./actions/runner-isolated

The pin check is a step in the test job — ci.yml#L30-L33, name: Self-ref pin, run: bash .github/scripts/self-ref-check.sh.

So row 4 is wrong in both directions: it names a guard the job does not run, and omits two it does (changelog-assembled, runner-isolated).

It was false when each record was written, not drifted into

git show <tag>:.github/workflows/ci.yml at all five relevant tags. In every one, self-guards' step list is the same five composites, and self-ref-check.sh is at line 33, in test:

record	shape	row 4 as written	self-guards at that candidate	self-ref-check.sh at that candidate
drills/0.4.1.md:27	doors unchanged	armed, monotonic, drill-recorded, self-ref	armed, monotonic, assembled, drill-recorded, runner-isolated	test, ci.yml:33
drills/0.5.0.md:36	doors unchanged	armed, monotonic, drill-recorded, self-ref	same five	test, ci.yml:33
drills/0.6.1.md:74	doors unchanged	armed, monotonic, drill-recorded, self-ref	same five	test, ci.yml:33
drills/0.6.2.md:84	doors unchanged	armed, monotonic, assembled, drill-recorded, runner-isolated	same five ✔	test, ci.yml:33

0.4.0 and earlier are full rehearsals and carry no such table; 0.6.0 is a full rehearsal (its "probe 4" is the ceremony re-run probe, an unrelated numbering). Four records, and that is every doors-unchanged record this repo has.

The half-fix in 0.6.2 is the interesting part

drills/0.6.2.md corrected the list — it now names the five composites the job really runs — and left the sentence under the table untouched:

"Probe 4 covers the self-ref pin this record's first measurement is about: a stale CEREMONY_SELF_REF fails ceremony's own CI here, so the stamp is verified by the same run that verifies everything else."

That record now contradicts itself inside three lines: its own table no longer lists self-ref under probe 4, and the next sentence says probe 4 covers it. drills/0.6.1.md:76 carries the same sentence, consistently with its own (wrong) list. The correction reached the table and not the prose — which is the ordinary shape of a copy-forward being partially noticed.

What it costs

The underlying claim is true: a stale pin does red this repo's CI, and I verified it independently while closing #338 (self-ref-check.sh re-run at both 0.6.1 and 0.6.2 candidate heads, rc 0). Nothing shipped wrong, and no release is in question.

The cost is narrower and is exactly what the doors-unchanged shape is for. drills/README.md says the narrow shape is owed because it is "a mechanically checked claim the panel can re-run", and the record's own table is the panel's index into where each claim is checked. Condition 1 is the pin condition; its evidence pointer sends a re-running reviewer to a job that does not contain the check. A reviewer who follows it finds five composite steps, no pin check, and has to either re-derive the mapping or take the claim on trust. Taking a doors-unchanged claim on trust is the thing the shape exists to avoid — and drills/README.md already has a precedent for treating a record's own false statement as the defect, not a footnote (#135: "false evidence in the one file whose job is to be evidence").

It is also self-propagating: the table is hand-copied from the previous record at every cut, so 0.6.3 and 0.7.0's records inherit it unless something is written down.

The shape I would take

Two parts, and I think both are needed — the first without the second just resets the counter:

1. Correct the four records. Row 4 lists what self-guards runs; the pin gets its own row naming the test job; the follow-on sentence in 0.6.1 and 0.6.2 points at that row. Amending a shipped record has precedent here — drills/0.5.0.md was amended from a predicted to an observed lib/ delta (Release 0.5.0 — the per-author panel surface, so crew can bump its pin and switch the row on #233).
2. Give drills/README.md's Doors unchanged section one sentence naming where condition 1 is checked — .github/scripts/self-ref-check.sh, in CI's test job — so the next record copies a stated fact instead of re-deriving one. The three conditions are already written there; only their evidence locations are not.

Deliberately not proposed: a guard that parses drill records against ci.yml. Four records, a two-line prose fix, and the class is closed; a parser for a hand-written evidence table is more machinery than the defect it would catch.

Filed by triage, 2026-08-07, from the #338 close-out.

[dan-claude-bot]

Accepted — #341, ready

Minted with the finding above re-measured at 7cef387 rather than carried from this thread.

One change from the shape proposed here. Part 2 — the sentence in drills/README.md's Doors unchanged section naming where condition 1 is checked — is out of #341's scope, and the reason is a fence rather than a judgement. drills/README.md is a declared deliverable of #321 (its D2 and its fourth acceptance criterion) and of #313, both open and blocked inside the 0.7.0 window that is gated shut until the operator's release-init. Under the collision rule (#288) touching that file here would force Blocked by #321, and a four-file correction would then wait out an entire release window.

The class still closes without it. The table is hand-copied forward from the most recent record at each cut, and drills/0.6.2.md — the one the next record will be copied from — is among the four #341 corrects. That is the same lever that propagated the error, pointed the other way.

Where the sentence belongs, if it is wanted: #321 already rewrites drills/README.md's probe list under its D2. This is recorded here rather than added to that issue — a member of a shut window is not somewhere to plant work by side effect, and a builder claiming #321 at release-init should get its spec from its own body.

What #341 does carry, decided rather than left open: row 4 lists exactly the five composites self-guards runs; the pin gets its own row naming .github/scripts/self-ref-check.sh in the test job, in all four records including 0.4.1 and 0.5.0 (a corrected row 4 without it would leave condition 1 with no evidence pointer at all — strictly worse than the wrong one); the 0.6.1/0.6.2 follow-on sentence re-points at that row; each record carries a dated correction note in drills/0.5.0.md's established shape (#233), because a silently rewritten record is a worse artifact than a wrong one; and no changelog.d/ fragment, since drills/ is not in docs/VENDORED.txt and no behavior moves.

No edges: the four record files are carried by no open issue, and no release window stands — #249 closed 2026-08-05, #333 and #338 were single-member patch cuts and both closed today, and #317 is gated shut by ruling. #341 is ready now.

Converged. Closing this as resolved; the work is on the board.