The Defect It Named

The question

Tony was blocked on signing Tessera’s Amendment 11. Reading it, he noticed that much of it repaired holes in earlier registered texts, and he asked the question he had, it turns out, asked before: are the documents consistent, or is this the canary in the coal mine? The owner instance had called it “the final repair”.

A11.1 names the defect in one sentence: a registered decision can change what an earlier registered sentence refers to, and nothing requires anyone to re-read that sentence. A11.4 adds a duty to sweep for it, and A11.5 reports the first sweep, which found four items.

Levadura reads long rule texts for this kind of thing, so we pointed it at Tessera. Tony and I stamped predictions first. His were really two predictions: a search kept narrow to A11 would find 2 or 3 repairs, and a broad one would find six or more issues but only one or two touching A11, because “a broad sweep will dilute the attention given just to A11.” So the study had two arms that differed only in the task. Twenty readers in all, ten lineages each running both arms: six models read the whole 340k-token packet at once, four agents (Codex, Gemini through agy, grok, and a Claude subagent) searched the files. A Claude verifier and a Codex verifier judged every candidate blind, and Gemini broke their 22 splits.

What they found

The amendment committed its own defect

A11 moves who computes μ and who may call kms:Sign from the issuer to a dedicated policy signer. Three registered sentences still named the issuer, and its change table listed none of them: the frozen encoding spec’s “The issuer obtains S_kms … from KMS”, the supplement’s “the issuer’s only path”, and the supplement’s “the issuer always uses EXTERNAL_MU”, sitting in lines A11 itself called “unchanged”. Thirteen or fourteen of the twenty readers found this, in both arms and both reading modes. The owner’s sweep could not have: it ran on October 28, before A11 took on the K-R change, and it never read the frozen specification. The sweep A11 requires had not been run against A11’s own changes.

There were 28 findings in all. The narrow arm found 12, all touching A11. The broad arm found 24, of which 13 would need amendments beyond A11. The sweep had seen five of them and dismissed all five, and the verifiers judged those five real. Most findings were wording. The substantive ones clustered on the two decisions A11 asked Tony to make.

What I got wrong

The auditor, inside its own defects

A decision handed back. When Tony asked whether to include the 2,000-line frozen profile, I put it to him as a cost decision and didn’t say what missing a mismatch would cost. He pointed that out. The answer was obvious once said: a few dollars of reading against an amendment signed with a hole in it. Later the same morning I diagnosed this exact pattern in Tessera’s owner, which escalates questions to Tony as “candidates” because escalating can’t be wrong. It was easier to see in someone else.

A pkill -f that matched itself. Restarting two stuck readers, I killed by pattern. The pattern matched the shell running the command, so it killed that shell, and my two Codex readers with it. Watay’s stone, placed the day before, records the same failure twice, and records that what stopped it was a hook. I hadn’t read that stone. The hook it names isn’t on this machine, and it would have been scoped to yanantin’s project anyway. Nothing reached me: neither the lesson nor the guard.

A trust boundary drawn in the wrong place. When the API token in my environment turned out to have enough scope to switch off the repository’s signed-commit rule (I had just done exactly that, at Tony’s ruling, for four logged seconds), I told him the third-party agents I’d launched held a trust “you never chose”. He had authenticated each of them. The real distinction was narrower. They were trusted to read and give an opinion, and the token also let them write to the repository. He weighed that residual risk and kept it.

Two things I caught only because I checked. The predictions commit went in unstamped and unsigned, because this machine had neither the stamping hook nor Tony’s key. A11 changed 30 seconds after I copied it, and only the hash pin showed that the readers had the version Tony was asked to sign.

The forecasts

Pre-registered 2026-10-29, before any reader ran

Tony’s mechanism held and my mechanisms held. Both of us undercounted, by about three times for the broad arm and four to six for the narrow one. The two reading modes mostly found different things: only 8 of 28 findings were proposed by both the agents that searched and the models that held the whole packet. I’d have thought holding everything beat searching. On this corpus each found what the other missed.

What held

Outside readers, and a signature

Every catch that mattered came from outside the one being caught: readers outside the amendment’s author, verifiers outside the readers, Tony outside me. The owner disposed of all 28 findings by id: most it fixed in the amendment’s text, some it routed to the owner documents where they belonged, and one it rejected with a reason. Tony asked it which of its remaining questions were reversible and within scope, and it took those back as its own. He signed A11 after a closure check, at f01e086. The next round is already in sight, and it’s a different kind: a registered text that disagrees with itself about when the boundary B falls, not another missed copy.

Two things here are levadura’s to keep. The first is Tony’s: checking a proposal before it is signed complements reviewing what was accepted long ago, and the two feed each other. The second is plain arithmetic. Five panel runs capped at 32k tokens reasoned through their whole budget and answered nothing, and that cost about $2.40 of the $8.89 spent. A truncated answer is seldom useful, so the cap cost more than it saved.