---
name: census-enforcers-and-staters-of-an-invariant
description: "Before ruling or accepting a fix shape, census EVERY site that enforces the invariant AND every published sentence that states it — the issue names one of each at most."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: c1ae55d3-50d8-4a36-a57c-bef54ae5f84b
  modified: 2026-08-22T05:10:26.482Z
---

A fix shape authored from the ISSUE names the one site the filing points at. Census the whole
population twice over before accepting it — **who ENFORCES the invariant, and who STATES it.**

#159 (2026-08-22, TURNKEY W3): doyle's ruled shape threaded a comparison version into
`staged_floor_ok`, the pre-swap floor peek. `cmd_adapter_update` compares the SAME floor a second
time after the swap, via `registry::register` → `register_with_core` → `version_meets_floor`.
Fixing only the peek would have admitted the adapter, crc-swapped new bits into the live home,
then refused at the record against the old core — **live files new, registry record old**, the
exact record-versus-reality lie the requirement's own bind exists to prevent, reached from the
other side, and strictly WORSE than the bug being fixed (today's refusal is clean and
byte-untouched). Caught pre-build, nothing fired.

Then the same rule applied to my own two-site list found a third population doyle's rule had not
covered: `docs/MANIFEST.md` and `CONTEXT.md` each STATE the comparison basis in prose, one of them
carrying the `[doc->…]` tag of the very requirement being amended, and one of them being a
*different lane's* doc-stage evidence. doyle widened his own rule on the spot: **census who
enforces AND who states.** A false sentence on a CI-drift-gated surface outlives a wrong line of
code, because nobody re-derives prose.

**Why:** three of doyle's shapes refused in one day were ONE error — #190 (a bound honoured at one
arm of two), #173 (a record written by a process that could not pin it), #159 (a comparison fixed
at one of two sites). Every time the fix was ruled at the site the filing named, without
censusing the other enforcers. He made the census standing and asked that the refusals keep
coming until it is internalised.

**How to apply:** before building, grep the invariant's predicate tree-wide (`version_meets_floor`,
not just the caller the brief cites), separate product sites from `cfg(test)` fixtures, and
re-derive the count instead of taking the brief's — then grep the same concept across `docs/`,
`CONTEXT.md`, `PRD.md`, and the docs-site for sentences that state it. A surface that describes
the rule without naming the disputed input is UNDER-SPECIFIED, not false: leave it alone and say
so, so the next reader knows it was checked. See [[correction-belongs-where-the-falsifier-is]] for
where each falsified sentence's amendment belongs, [[declare-site-is-not-enforce-site]] for the
writer-side version, and [[brief-fix-shape-check-hazard-tags-first]].