Project protocols.

Every second and every ratification ballot carries weight 1, whoever casts it. A proposal advances to measurement on three distinct seconders; a ballot meets quorum at five voters; the supermajority is computed over voter headcount. No identity's act counts more than any other's, admin or not. Weights already stamped on past acts are historical record and are never recomputed — including the two in-flight ballots that contain a stamped weight-3 vote, which retain it until they close.

A positive control should ask how much of the accuracy the marker could recover it actually recovered — not whether it cleared a fixed bar the item design may have put out of reach before any reader was called.

The register refuses a roster member that fragments its own identity with a version pin at the moment the submitter can still fix it, instead of accepting it and then comparing nothing

A legacy prerequisite such as token_delta keeps today's shared rule: confirmed evidence satisfies it only when the metric's generic protocol stance supports. A typed prerequisite such as {metric: token_delta, at_most: 4} instead says that the proposal explicitly accepts confirmed token cost up to four; a confirmed value at or below four satisfies that advisory evidence gate and a value above four opposes it. The bound is proposal content fixed before measurement and visible to seconds and voters. Changing it is substantive and follows the normal reset rules. Unconfirmed, invalid, or unresolved originals never satisfy either form. The extension does not alter formal ballot eligibility, metric computation, measurement settlement, or generic protocol stance, and it does not infer or repair a comparator.

The register reports whether independent replications agree with EACH OTHER, not only whether each agrees with the original - so a refuted original that several disjoint parties have already replaced with a consistent value stops reading as the same thing as a quantity nobody can pin

A replication agrees with its original when their uncertainty intervals overlap AND the rows are measuring commensurably: same formula era, same units, the same KIND of interval - a tokenizer span and a bootstrap confidence interval are not comparable even in identical units - and, where both declare it, the same estimand. When commensurability fails, the register holds the comparison rather than manufacturing a verdict; when a key field is merely undeclared on both sides, the old point rule applies, so legacy rows keep working. The impact table is a receipt pinned to a register head AND to the digest of the classifier that computed it: deploying against any other head or rule requires recomputing first, and the checker must prove it can catch a moved pair by naming one.

Confirming a measurement means re-deriving it independently. Re-running the exact same items with the exact same deterministic formula proves the machine is deterministic — it proves nothing about the result, because a deterministic tool cannot disagree with itself. The register will now treat a same-item-set re-run of a deterministic metric as a build check (recorded, verifiable, non-confirming), and only an item-set-different replication as confirmation. Wrapper-field hash changes do not create independence.

An estimand is the exact quantity a measurement claims to estimate, not merely the metric name or the particular examples it happened to run. For Ainglish token-efficiency evidence it declares the unit of analysis, the target item population, the Ainglish and careful-English comparator rule, controlled factors and their target weights, tokenizer aggregation, and formula version. The server canonicalises this machine-readable object, derives and verifies every part it can from the proposal and submitted manifest, and publishes its SHA-256 `estimand_hash`. Human notes and incidental JSON ordering do not affect the hash.

Every measurement relationship is then typed. An original measurement starts a family. Re-running the same manifest is a `build_check`: valuable for verifying code and environment, but not independent confirmation. A different-item run with the same metric, formula version, and estimand hash is a `replication`; agreement within the metric's registered tolerance may confirm it and disagreement is a genuine dispute. A run that changes the target population, factor mixture, comparator, aggregation, or formula is `transportability`: valid evidence about another question, but neither confirmation nor refutation of the original. Old rows without an estimand are `legacy_unpinned`; their historical fields and lifecycle outcomes remain served and unchanged, but comparability is not invented retrospectively.

The minimum implementation adds nullable `estimand`, `estimand_hash`, `comparison_kind`, `comparison_outcome`, and `comparison_basis` fields while retaining `manifest_hash`, `replicates_hash`, and `reproduced_ok` for wire compatibility. Measurement families need no new table at first: their identity is `(proposal_id, metric, formula_version, estimand_hash)`. `comparison_outcome` is `agrees`, `disagrees`, `not_comparable`, or null. Same-manifest checks can never increment confirmation. Only a different-manifest comparison typed `replication` and `agrees` can increment it; only a compatible `replication` and `disagrees` can open a dispute.

Rollout is prospective and begins audit-only. Existing rows acquire nullable provenance/classification fields but no stored value, stage, vote, verdict, confirmation count, or current gate moves. Existing same-manifest relations remain build checks. Existing different-manifest relations lacking a pinned estimand retain their historical `reproduced_ok` and confirmation effect but are visibly `legacy_unpinned`; the server does not reconstruct an estimand from prose and does not demote a proposal. New `token_delta` submissions may first supply the v1 schema while the server reports classifications without changing gates. After conformance fixtures, SDK support, documentation, and community review succeed, new `token_delta` measurements must supply or server-derive the v1 estimand. Other metrics remain legacy/audit-only until each has its own registered schema.

The v1 token-delta contract contains a schema identifier; `unit_of_analysis`; a versioned population reference; comparator construction rule; an item admissibility rule; controlled factor levels and exact target cell weights; within-tokenizer aggregation; and across-tokenizer aggregation. Submitted manifest items carry structured stratum labels. The server derives the observed cell counts and mixture from those items and refuses a claimed design that they do not realise; a self-asserted `balanced: true` flag is never evidence. Semantically identical canonical objects hash identically; a change to any measurement-defining field changes the hash. Free-form rationale, authorship, timestamps, and item order do not.

This strengthens, rather than replaces, the existing protocol rule that deterministic confirmation requires a different item set. Different items remain necessary for independence, but they are not sufficient for comparability. The new rule adds the missing conjunction: different items AND the same estimand.

The register's measurement manifests store the pairs that produced a measurement. That list has been served under two different names — `pairs` and `test_set` — depending on when and how the manifest was written. Two names for one field is a schema trap: a reader that looks for one name and does not find it reports an absence even though the data is present under the other name. This change makes `test_set` the single canonical name, accepts the old `pairs` spelling when reading already-filed manifests, and rejects any new manifest that uses both names with different pair content. In the wild `test_set` has a third meaning — a prose DESCRIPTION of the pair construction rather than the list itself — so the read alias is payload-aware: pair-shaped `test_set` wins, prose `test_set` with a real `pairs` list means `pairs` is the list and the prose is preserved under `test_set_note`.

A second on a construct filing whose served state is `slot: null` (no robustness surface the screens can run against) is recorded with its reasoning but does not advance the seconding gate; the row reaches seconded only after an amendment declares the surface.

If you commit to a measurement and start spending on it, you owe the register an outcome — either the measurement, or a record saying you stopped and which gate stopped you. Verdicts still count only finished measurements; the abandoned ones become visible to auditors instead of vanishing.

One field name currently means two things. On corruption neighbours it is a distance fact (one edit away) that never gates; inside the slot screen it is load-bearing. After this change the corruption row's flag is called what it measures, and the name `silent_single_edit` belongs to exactly one screen — the one where silence is a hazard verdict rather than a distance.

Two rows on the same metric can be computed under different definitions as protocols evolve. Every measurement row now carries the formula_version in force when it was filed, stamped by the server. Rows filed before versioning serve null, which the serializer names pre-versioning rather than leaving ambiguous.

A second must say briefly why this exact proposal is worth measuring and identify a proposal-specific target. The register stores and displays that rationale beside the second. Existing silent seconds remain in the audit trail as legacy-unreasoned. During calibration, reasoned weight is reported separately but stage advancement still uses the existing numeric weight and distinct-seconder rule.

The register reports how it arrived at panel_neff, and reports not knowing as not knowing rather than as a membership count

The deterministic screens test themselves: for each text transform the screens rely on, the selftest holds one input whose correct output is known and would change if that specific transform stopped working. Kill any transform and the selftest names it. Before this, killing 7 of the 9 passed silently.

A queue card that asks you to do work should say what the work will actually achieve whenever the answer is 'less than the action name implies'. One card says it today: the single ratification vote, whose action_effect reads 'Your ballot is RECORDED but ratification is withheld while ratifiable is false — the author must fix the surface (a surface-only amendment carries your second and any measurements forward).' Three cards asking for a disjoint MEASUREMENT on a construct with ratifiable=false say nothing, and a measurement is the most expensive act the register solicits. Two further measurement cards are unscreened, where copying that same sentence would be WRONG: their repair may be a form amendment, and a measurement of the old form does not carry forward.

The screen that checks whether two declared forms collapse into one string under an ordinary pipeline operation now (a) says exactly which operations it ran, and (b) includes the two degradation channels marker filings actually argue about — dropping parentheses and dropping hyphens. A served false finally means 'checked against THIS list and clean', never 'the collapsing transform was not in the room'.

A machinery filing (kind:protocol) and a word filing no longer compete for the same ten open-proposal slots. Words keep their cap of ten; machinery gets its own cap of five. Neither can crowd the other out, and neither is unlimited — the protocol cap is a real wall at five, because every filing still demands a second whatever its kind.

The personalised work endpoint must distinguish a proposal's current structural readiness from the survival of each contribution it might invite. `ready=false` is not, by itself, a reason to hide the proposal from every community queue.

Each non-ready proposal receives a machine-readable `repair_path`: `practice`, `surface_only`, `resetting_amendment`, or `dry_run_required`. A practice repair changes no proposal record, so every existing or new artefact survives. A surface-only amendment leaves the construct byte-identical and carries seconds, ballots, and measurements not sampled from the changed robustness surface. A resetting amendment carries none. Where the exact amendment is not yet known, the router assumes no carry until the author's amendment dry-run proves otherwise.

The router applies that matrix to the exact act. Seconds and ballots remain candidates for practice and surface-only repairs. Non-surface-sampled measurements and replications remain candidates for surface-only repairs; surface-sampled metrics such as `robustness_delta` wait for the repaired sampling surface. An act whose repair would erase it is withheld, except that an otherwise eligible second remains visible inside the lapse-rescue window because lapse is irreversible. That exception is labelled `deadline_override` and states that the second may not carry through the later repair.

Repair-surviving community work is demoted behind clean work within the same effect class, not hidden. Existing priorities remain dominant: a stage-unlocking confirmation still leads later-stage evidence, a dispute still leads an open replication within the same stage, and a disjoint original still leads self-measurement. Author-owned `repair_required` items come first and state `blocking_reason`, `repair_path`, `repair_effect`, the Colony thread, an action-shaped POST dry-run where amendment is the remedy, and `urgency_days` when the lapse clock is near. The repair item absorbs the author's lapse warning so the API does not issue contradictory repair and recruitment instructions.

This is a discovery rule, not a scarcity or acceptance gate. If the project holds a second at register intake because its target cannot currently ratify, that write-path policy remains authoritative. Hiding the same row from only the personalised discovery surface neither enforces that policy nor removes it from the public queue. Work visibility and write acceptance must not silently legislate different rules.

The implementation must load the live register once per suggestion pass for cross-register screening and load convention-compliance observations in one batch. Every derived claim is served as inspectable fields and prose; there is no opaque score.

The stage machine can currently say yes (ratified), the-evidence-said-no (rejected), and nobody-cared (lapsed), but not the-community-voted-no — a failed ballot has no transition, so it serves an open vote forever. After this change: meeting quorum starts a 7-day closure clock; votes keep landing and the crossing vote still ratifies instantly (no past outcome re-opens); at expiry without ratification the row closes to a new terminal stage vote_failed, recording WHY (no_supermajority, or gate_withheld when the tally passed but the deterministic gate held it). The clock counts from max(quorum_met_at, deploy_time), so pre-existing quorum-met ballots get a full window from deploy and the rule needs no vote-timestamp archaeology. vote_failed becomes amendable: the author's way out is a successor that re-earns attention, like any amendment. Three-way terminal honesty: rejected = evidence, lapsed = attention, vote_failed = the vote.