> JUDGEMENT RULES sub-index — split out of MEMORY.md 2026-08-19 against the read-limit cliff
> (MEMORY.md was 21.9KB against a 24.4KB limit; past it the TAIL IS SILENTLY DROPPED). Entries
> below are VERBATIM, in original order, ZERO dropped — a move, not a compaction. The nag to
> COMPACT MEMORY.md is still refused: growth is handled by splitting a whole section out to a
> sub-index like this one, never by dropping a pointer.
> Read this BEFORE reasoning from a measurement, reporting a figure, or clearing any claim:
> these are the rules you OBEY. MEMORY.md keeps the pointer; the craft is here.

## Judgement rules (binding)
- [a duration over a TIMEOUT is not a stretch](duration-over-a-timeout-is-not-a-stretch.md) ⭐⭐ called 33.65s-vs-3.53s a 10x stretch; `RECONNECT_WINDOW`=30s, so 33.650−30=3.650 against a 3.530 pass, residual **0.120s** — normal run that SPENT a timeout, never slow. Subtract the constant; never compare against the fast case (identical-looking, different question). It was the HEADLINE of my specimen packet, so three agents hunted load: doyle logged an x40 sweep, todlando instrumented heavy-proc counts per run, hertz burned **92 runs** + an H1 probe killing it — incl. a **34.957s PASS**, same duration class, opposite verdict ⇒ duration was never the variable. Timeout-spent ≠ starvation: different KIND, which is why no load level reproduced it.
- [measure, don't direct](report-measurement-never-issue-direction.md) ⚖ doyle gates; agreeing IS direction.
- [purge needs store root from source](purge-dispatch-needs-store-root-from-source.md) ⭐⭐ dispatched a purge on an ASSUMED root; subject was TempDir-per-run = disk-hermetic, nothing to purge, blind act would hit fleet state. Read the root from source + the run's own logs BEFORE any deletion dispatch.
- [precise > vague](precise-claim-is-falsifiable-vague-is-useless.md) ⭐⭐ · [rig red on purpose](make-a-new-rig-red-on-purpose.md) ⭐⭐ negative control FIRST · [verify the SUBJECT](verify-the-subject-not-just-the-measurement.md) ⭐⭐ ancestry before ANY green.
- [a branch you WAIT on gets read by ref, not ancestry](waiting-branch-read-by-ref-not-ancestry.md) ⭐⭐ waiting frames it as a FUTURE object, so you check the sha for movement and never ask if it already LANDED; a merged lane's source ref is identical to an untouched one. Ran ancestry on six of my own lanes, not on the one I was blocked on — it was in main AND in the shipped tag.
- [a source read is a claim about a TREE](source-read-needs-its-sha-and-ancestry.md) ⭐⭐ `rev-parse HEAD` + ancestry vs golden BEFORE reporting; I root-caused a real ABA already fixed at the tip, and a peer "confirmed" it on the SAME stale sha.
- [stable anchor ≠ recycling defense](stable-anchor-is-not-a-recycling-defense.md) ⭐⭐ anchoring picks a longer-lived pid; longevity ≠ identity. Comment asserting a defense = claim about a FIELD — check the struct.
- [flag presence ≠ flag effect](create-no-window-inert-under-detached-process.md) ⭐⭐ `CREATE_NO_WINDOW` INERT under `DETACHED_PROCESS`; a comment asserting behavior is a claim. Source can't decide flag interaction — only an OS differential. INVERSE arm now filed too: `windowless` MASKS `DETACHED_PROCESS` OFF at the call site, so the child owns a console and a conhost joins its parentage — read the call site's mask, never the named constant. ⚠ count windows with EnumWindows, not MainWindowTitle (reads 10 as 1).
- [probe an UNMODIFIED subject](probe-an-unmodified-subject-needs-no-baseline.md) ⭐⭐ references nothing you edited ⇒ measures the TOOL, no baseline arm, no shared-checkout mutation.
- [refute a BYPASS by visibility, not audit](refute-a-bypass-by-visibility-not-by-audit.md) ⭐⭐ "some caller skips the chokepoint" dies on the DECLARATION — a module-private fn's in-module callers ARE the population. Audit says "I found none"; visibility says "none CAN exist". Corollary: **atomic ≠ preserving; only a read-under-hold preserves a field**.
- [predicate needs its tool](a-predicate-without-its-tool-is-not-evidence.md) ⭐⭐ root+dialect+tool+**population** · [probe competence](verdict-from-probe-competence.md) ⭐⭐ a filter that can't express the hunt returns a clean zero · [token from the failing frame](announce-token-from-the-failing-frame-not-the-register.md) ⭐⭐ derive the grepped diagnostic from the panic frame's own emit sites, never from the register entry discussing the symptom.
- [source-side qualifier ≠ output-side qualifier](source-side-qualifier-is-not-an-output-side-qualifier.md) ⭐⭐ a comment explaining a logged constant serves the CODE reader, never the LOG reader the breadcrumb exists for; ask which audience the ruling meant. Test is WITHIN-SITE AMBIGUITY (doyle): a marker is owed only where a field has >1 meaning AT ITS OWN SITE — `from_seq` can be a real floor or a hardcoded 0 so `cold=true` is earned; `gen` is constant 0 there so the site token IS the marker. ⚠ my dichotomy ("either cold=true is redundant or gen needs it") was WRONG — a third branch dissolved it. Argue from an asymmetry the author's code commits to, but present it as a QUESTION, never as exhaustive horns.
- [healthy path emits the SAME silence](healthy-path-emits-the-same-silence.md) ⭐⭐ read 1 submit/900s as "no round closed"; healthy emits exactly one too (conn caches, never re-dials) — 709 closed rounds under the same token set. Absence-based stall claims assume the healthy path is LOUD; derive healthy's emission from the emit sites first, else find a discriminator (heartbeat, brackets) and measure it.
- [flake timing bimodality is RIG ARITHMETIC](flake-timing-bimodality-is-usually-rig-timeout-arithmetic.md) ⭐⭐ 4 fails at 60.9–65.5s vs 16 passes at 5.8–10.0s carried as an open question wanting a mechanism; it was the failing arm's own `45s + 10s` polls, `55 + [5.8..10.0]` closing to 0.5s. Sum every `from_secs` on the failing path BEFORE theorising, and check spawned-vs-awaited — concurrent bounds do NOT sum, which is how one band held two different faces and discriminated neither. Close the question, don't leave it as atmosphere.
- [absence needs a sibling probe](absence-needs-sibling-probe.md) · [one sample ≠ negative](one-sample-is-not-a-negative.md) · [cancelled = labelled hole](cancelled-measurement-leaves-labelled-hole.md) · [start event ≠ nothing ran](start-event-is-not-proof-nothing-ran.md) · [exit not silence](verdict-from-exit-not-from-silence.md).
- [a defect can be ASSERTED by a passing test](defect-can-be-asserted-by-a-passing-test.md) ⭐⭐ #197's codeless-spends-an-attempt bug was pinned by a green broker cell tagged `[unit->]` the very REQ it broke, plus the WIRE DOC and an rc comment — three encodings of one wrong rule. A pre-existing green reddened by your fix is a FINDING: read its comment + REQ tag, MOVE the cell with its requirement (never delete, never weaken the fix), sweep every other encoding, and tell the gater — it is what makes a REQ MOVE rather than sharpen.
- [audit boring claims](audit-the-boring-claims.md) ⚖ discipline skipped where you expect AGREEMENT · [name file AND sha](name-the-file-and-sha-a-condition-came-from.md) ⭐⭐ a shared noun ≠ a shared claim.
- [a hand-off's PASS list names gates RUN, not gates OWED](relay-pass-list-names-gates-run-not-gates-owed.md) ⭐⭐ three green gates read as "fully gated"; the one NOT named was `xtask check` (docs-drift) on a head whose largest change class was FOUR doc commits. Same tool name as the gate that WAS run (`xtask binedge-check`), so the eye scores it present. Derive the gate population from the HEAD's change classes, diff against what the hand-off names, run the difference. ⚠ and run it UNPIPED — piping to `tail` made my captured `$?` the pipe's, not the gate's.
- [silence on the HEALTHY path is not evidence of a stall](silence-on-the-healthy-path-is-not-evidence-of-a-stall.md) ⭐⭐ a whole RCA + 2 approved lanes rested on "one PUMP_DIAL_SUBMIT in 900s ⇒ no round closed"; the instrumented re-run emitted ONE submit with 709 CLOSED rounds under it — the repeat is suppressed by SUCCESS (conn cached ⇒ never re-dialed). Whole token set was byte-compatible with health. Open the emit site and ask what suppresses the second print BEFORE proposing a mechanism; instrument the silent arm.
- [a log token names its POPULATION, not the subsystem](log-token-names-its-population-not-the-subsystem.md) ⭐⭐ 11.7/s of `CONN_LIFECYCLE` was `role=brain` BROKER-IPC (`conn.rs:270`), not the net-presence feed my probe arm was built to load — the rate belonged to a different wire. Over-claimed in BOTH directions in ten minutes: the same token also cannot support "therefore zero net conns", since a net conn emits none. Grep the emit site and name what it counts AND what it cannot, before the count enters an argument.
- [a base rate counts CELL executions, not SUITE runs](base-rate-is-over-cell-executions-not-suite-runs.md) ⭐⭐ "fired once in all runs" was computed over runs that never CONTAINED the cell; its real record was 2 executions / 2 failures, i.e. structural wearing a flake's rate and buying a rerun. Cells whose lane DEFERRED int to the gate have a denominator of one before their first gate. Ask what the denominator contains, say it out loud ("two executions, two failures"), and put it as a question against the premise — mine was confirmed with a mechanism and flipped a rerun into an operator escalation.
- [hedge ≠ grounding](hedging-classification-is-not-grounding-the-observation.md) · [intermittent green = zero info](intermittent-green-is-zero-information.md) · [ruling rests on a premise](ruling-rests-on-a-premise.md) · [no post-op sha = prediction](confirmation-without-postop-sha.md) · [no version floor pre-ship](no-version-floor-before-it-ships.md).
- [cfg-gated is invisible to the other gate](cfg-gated-code-is-invisible-to-the-other-platform-gate.md) ⭐⭐ not compiled on Windows; prove the REACHING mutation on box 2.
- [process-global bystander](bystander-test-reads-process-global.md) · [two locks one env var](two-locks-one-env-var.md) · [unknown polarity](containment-ownership-and-unknown-polarity.md) · [stacked defects](stacked-defects-mask-each-other.md) · [premature closure](premature-closure-guards.md) · [sweep site counts](sweep-dispatch-site-counts.md) · [dispatch on overlap](dispatch-on-overlap-not-on-merge.md).
- [a DERIVED figure dies with its measurer's context](derived-figure-without-its-formula-dies-with-the-context.md) ⭐⭐ numbers get filed, the BOUND does not; I asked doyle for provenance of my OWN six-draw series and between us it was gone. Emit the token with its two events named, or report a span with NAMED endpoints — never a bare figure under a borrowed label. Close the series with a labelled hole rather than guess draw N+1.
- [measure what costs one command](measure-what-costs-one-command.md) · [quoted figure decays if YOU mutate the subject](quoted-measurement-decays-when-you-mutate-the-subject.md) re-measure at the ACT, not the offer · [name the environment](tool-claim-must-name-its-environment.md) · [load axes](load-claim-needs-measured-axes.md) · [window load](window-assertion-load-direction.md) · [rig inherits the defect](rig-inherits-the-defect-it-studies.md) · [remedy from refusal state](remedy-must-run-from-refusal-state.md).
- [rule failed its author → mechanism](rule-failed-its-author-needs-a-mechanism.md) · [prompt ≠ boundary](prompt-prohibition-is-not-a-boundary.md) · [ground don't assume](ground-dont-assume-on-incidents.md) · [measure box before instrument](measure-the-box-before-the-instrument.md) · [lead with the boxless defect](lead-with-the-defect-that-needs-no-box.md) · [survive re-derivation](structural-fact-must-survive-rederivation.md) · [cite the contract](clean-room-evidence-cite-contract.md) · [no value expansion](secret-env-probe-no-value-expansion.md) · [your cadence blocks](your-cadence-can-be-the-blocker.md).

- [exit status is not a diagnosis](exit-status-is-not-a-diagnosis-capture-the-child.md) ⭐⭐ seven refusal arms all spell themselves `1`; the sentence naming WHICH lived only on the child's stderr, inherited into a PTY the failure itself swallows. `.output()` not `.status()`, one grep-able line, and prove the capture speaks by checking it carries the SUCCESS sentence too. Turned a code-read inference into a verbatim 2/2 measurement.

- [a load knob must be PROVEN to bite](load-knob-must-be-proven-to-bite.md) ⭐⭐ 610 green bring-ups mean NOTHING until a span is shown to stretch under the knob — "I added load and it stayed green" and "I never actually added load" produce identical evidence, and the second is the comfortable read. Measured the ConPTY-create span instead: 9-16ms quiet -> 42ms 4-way -> 117ms 10-way -> 294-326ms 12-way. That earned the greens AND gave the real finding — still ~100x short of the 30s bound, so more of the same escalation is predictable waste. Pick the span BEFORE the run; report the curve beside the red count; a lone outlier in a stretched tail is ONE SAMPLE (mine, 1427ms in a ~1ms span, did not recur in 240 further runs).
- [a filed rate may PREDATE your base](filed-rate-may-predate-your-base.md) ⭐⭐ releases#199's 1/20 was measured at two shas that BOTH predate that same issue's OWN first-face fix — an ancestor of my base. The confounder was not a sibling milestone, it was the issue's earlier lane, and its header table wears a current measurement's clothes. merge-base every fix named ANYWHERE on the issue before computing hunt arithmetic; then report rate-moved, unlucky, and mechanism-gone as THREE separate claims.
- [a pointer WITH its reasoning attached gets typed, not checked](a-pointer-with-its-reasoning-attached-gets-typed-not-checked.md) ⭐⭐ a NAME or LINE NUMBER in a brief or ruling is a POINTER, never a measurement — resolve it against the blob before it enters a commit, doc or REQ, ESPECIALLY when the argument built on it is right, because a correct argument is what stops you checking. Three in one lane, all mine or through me: "3-line block" measured SEVEN · `Trigger::for_peer` at 271-272 is `Trigger::sender` at 269 (I named an enclosing fn off a grep hit showing its BODY) · the issue's ~12505 was 16300 — and that third one I DID flag, because it came from a stranger. **The asymmetry is the class:** a pointer travelling alone gets checked, one travelling with sound reasoning gets typed, so the rule must bind OUTBOUND — the author is the one actor who can never experience their own figure as unsourced. todlando proposed it, I adopted it 2026-08-22.