# THE HANDS — Class-Universe Census (r1) — RATIFIED

> **RATIFICATION RECORD — 2026-08-14, Robert, via keeper: "go ahead then, I'm ratifying the
> updated spec."** Red-pen round 1 (3 amendments) folded before ratification. Four
> dispositions bank with it:
>
> 1. **UNIVERSE RATIFIED.** The 18 classes in 4 groups + 5 behavior dimensions — with the
>    §behavior guard binding as written (observation lenses only, never runtime rubrics) —
>    are THE definition of the class universe. Changes henceforth are amendments through
>    Robert's pen, never drift.
> 2. **TWO-LANE RULED (Option A, keeper's recommendation adopted under Robert's
>    ratification).** The filed-wish door IS the teammate entrance; growing its verb
>    coverage to the full universe IS the burn-down. The terminal lane remains the
>    machinery/agent lane behind it, never teammate-facing. Every burn-down cycle's exit
>    test includes "rides the door," not merely "works at a terminal."
> 3. **BOUNDS STAND, with the repair in scope.** The ratified limits carry unchanged, AND
>    the speak-the-bound cure (a teammate always hears the limit's written reason, never
>    "found nothing") enters the burn-down as real work — the C18 wall's SPEECH is in
>    scope; the wall itself stays ratified.
> 4. **SWEEP PLAN RATIFIED — dispatch as written.** Measurement-only, scratch clones, P1
>    resolution probes over all 58 ancestor rows first, then ~24 real-lane executions (≤3
>    mutating legs live), behavior probes including the wall's baseline; engines per the
>    named-fit table; legs bank records, classification at home; the resulting denominator
>    goes to the keeper for red-pen before it becomes the arc's baseline of record.
>
> Box-lane law (judgment never on-box) and the verification-framing wording law ride every
> leg as standing.

*Authored 2026-08-14 by arc-hands-fable-r1 under `~/next-arc/arc-charters/charter-hands.md`.
This is the arc's SCOPE FACE: the universe of edit classes the twelve sealed asks could sample.
Nothing burns down before Robert ratifies this. It defines the denominator; it does not grade.
Measurement (works / works-slow / refuses / lies, per class) is the baseline sweep's job — its
plan rides alongside (`baseline-sweep-plan.md`).*

## What was read (not what any report said)

- **Tree:** my own pinned clone `~/lane-worktrees/hands-flagship` at trunk
  `origin/assembly-line-build @ f669b097f` (claim filed in `~/next-arc/claims.json`; `git
  status` clean at the pin — every quote below is a trunk quote).
- **The ratified goals:** `vetharness-sites/docs/ai/GOALS.md` (Goal 1 magic wand · Goal 2
  sub-60s clock · Goal 3 pipeline clock).
- **The ancestor census:** `~/next-arc/engineer-parity-census.md` — 58 edit types, measured
  2026-08-12 at `bay/car2-cure8` (a different tip), reachability only. This census is its
  successor at class altitude, corrected at trunk.
- **The stack itself, three sweeps banked verbatim as receipts** (a non-author recomputes from
  these): `receipts/leg-verbs-exits.md` (19-verb door table · 35-exit census · 49 binned stop
  codes · M/J fork mechanics), `receipts/leg-per-class-coverage.md` (13 machinery classes with
  file:line), `receipts/leg-lifecycle-rails.md` (lifecycle, undo, consent, receipts, locks,
  latency, serving). Plus my own direct reads: `scripts/lib/edit-resolution.ts`,
  `scripts/il-edit/ops/*`, the door verb gate, `docs/specs/bounds-ledger.json`,
  `docs/specs/census-jurisdiction.md`, flagship `CLAUDE.md`, `WORLD.md`, `facts/` (11,721
  fact files · 187 pages, all genesis-captured, zero minted).

## The three-layer stack, verbatim from trunk

`scripts/lib/edit-resolution.ts:1-8`:

> INTENT — what the teammate says, in their own words.
> RESOLUTION — translates that into concrete targets: finds EVERY match, detects ambiguity,
> decides whether the text has to be BOUND first, and names the places where changing it
> would be wrong.
> PRIMITIVE — the mechanical ops (bind / mutate / sweep / rollback). Support never sees these.

The load-bearing invariant (Robert, ratified 2026-04-24, quoted in the same header): *"The
system must understand what support MEANS, not just what they said. Every edit resolves to a
scope-complete diff — including affected siblings and children — before any mutation commits."*

## Headline fact 1 — TWO LANES today

**The wish door admits three verbs; everything else is agent-terminal.** The filed-request
door (`edit:request` → `scripts/remote-edit-request.ts`, a synchronous CLI the agent or the
box workflow invokes — no server, no poller) passes every wish through
`scripts/lib/remote-edit-request.ts:2297`:

```ts
if (!(["replace", "insert", "remove"] as string[]).includes(change.verb)) {
  ... found: { verbsAvailable: ["replace", "insert", "remove"] } ...
```

Nineteen verbs exist in total (full table with inputs, dry-run coverage, and undo paths:
`receipts/leg-verbs-exits.md` §1). The door reaches three primitives; `edit:fact`,
`edit:join`/`confirm-join`, `edit:image`, `edit:logo`, `edit:mint-page`/`unmint-page`,
`edit:headline`, `edit:bind` are **terminal commands the agent runs** ("Claude runs these for
you" — flagship CLAUDE.md). One primitive is door-ONLY: `remove-inserted-text` has no npm
script and is reachable solely through a filed "remove" wish (`remote-edit-request.ts:886`).
Under the experience standard the teammate never sees either lane; but the lane determines
which rails, receipts, and refusal shapes an ask meets. Every class below names its lane.
Whether the wish door becomes THE one door (per-class lane closure) is a keeper/Robert
architecture call this census only surfaces.

## Headline fact 2 — the clock is real machinery, and unmeasured

The exit test demands ask→certified-change <60s. At trunk:

- **"Reprint" is a per-page byte-splice against frozen principal HTML, never a template
  re-render** (`scripts/produce.ts`; witness sidecars record exact byte ranges per fact).
- **Full reprojection is multi-minute at real scale.** `scripts/lib/preview-extent.ts:5-7`,
  verbatim: *"edit:preview re-projects every page of the book... On the real 744-page
  south-town book that is a multi-minute wait between typing a phone number and seeing it
  (s131 cold-walk)."* The landed cure is the incremental extent: bounded reprojection scoped
  by the fact's own anchor rows, valid only while every other produce input is byte-identical
  to the last GREEN snapshot; any other input moving forces a full re-render. Last certified
  preview on this book: 178 pages deployed, 0 reprojected, mode "incremental".
- **Timing instrumentation is wired but empty.** Every CLI invocation registers a
  process-exit recorder (`edit-invocation-timing.ts` → `.edits/invocation-timings.jsonl`,
  schema incl. per-stage `durationsMs`); at the pin the file does not exist — no run has been
  recorded here. The only asserted wall-clock budgets anywhere: single-fact undo <60s
  (`ci:edit-undo`, `edit-undo.fixture.ts:186`) and mint+re-produce <60s in a manual walk not
  wired to CI (`structure-mint.walk.ts:428`). Sweep/transaction runaway walls: 5 minutes.

So the sub-60s budget is UNMEASURED on this book today; the baseline sweep's per-stage
timings are the first real measurement, and the incremental-extent path is what they test.

## The universe — 18 capability classes in 4 groups, plus 5 behavior dimensions

Verdict column = machinery state at trunk f669b097f (receipts cited): **LANDED** (exists;
sweep measures truth) · **PARTIAL** · **SPECCED** (ruled + written, not built) · **UNSPECCED**
(named nowhere) · **BOUNDED** (recorded bound with reopen trigger) · **WALL** (a refusal that
cannot even speak — open work, the worst state) · **VACUOUS-HERE** (machinery exists; this
book has no member to edit). Ancestor rows map to `engineer-parity-census.md`.

### Group W — words and values

| # | Class | A teammate would say | Trunk state | Lane | Rows |
|---|---|---|---|---|---|
| C1 | Business facts (phone, email, address, hours, name, social) | "Our new number is 281-555-0100" | LANDED — one generic fact door (`writeFactValueIn`), blank-rail + guard + atomic anchor update; hours ride a display-costume layer over 24h canonical values | door (replace) + terminal (`edit:fact`) | 11-16 |
| C2 | Copy and headings (body, headlines, buttons, header/footer, nav labels, case fixes) | "Change 'Compassionate care' to 'Care that comes to you'" | LANDED — resolution decides edit/sweep/bind-then-edit/claim-edit/ask; bind-on-miss makes any visible span editable; carrier-group headline verb for one visual block | door (replace); `edit:headline`, `edit:bind` terminal | 1-5, 10 |
| C3 | Add and take back words (plain prose; a new list item) | "Add 'Closed Sundays' under the hours" / "remove that line" | LANDED for plain prose adjacent to an anchor (zero-width splice; page bytes never modified) AND a new `<li>` cloning a sibling's shape in an existing list. Markup (a link, a new list, a section) refused by name: `BLOCKED_INSERT_MARKUP` — "Adding markup is real design work and it is not built yet" | door (insert / remove; remove is door-ONLY) | 6-8, 39 |
| C4 | Accessibility and attribute text (aria-label, img alt, title attrs) | "The photo of the lobby should say what it shows" | LANDED — 236 aria-label + alt/title on the content allow-list; all other attributes are structural (see C10) | door (replace) | 9, 19 |
| C5 | Multi-page cascade and join (one value everywhere, machine copies included) | "Fix the phone number everywhere it appears" | LANDED — three mechanisms: `--sweep` (exact-value cascade, atomic), `edit:join` (staged human ruling, batch admission, no auto-join path), Class-A shared regions (one anchor set already spans pages). A visible edit that would desync a JSON-LD mirror REFUSES unless the claim-edit moves both copies in one diff | door (replace) + terminal (`edit:join`) | 11/13/22/29-30 |
| C6 | Undo and history — any prior change, from any conversation | "Put it back how it was yesterday" | LANDED with named honest gaps: exact-atom reversal filed back through the door (every guard applies); <60s single-fact undo CI-asserted; interference → compare-and-ask, zero writes. CANNOT yet reverse a deletion ("putting the content back isn't built") or restore a created fact by handle (its recorded reverse wish does that); roundtrip proves promote/rollback AND mint/unmint byte-identical | terminal (`edit-undo.ts`/`edit-history.ts`) + door (reverse wishes) | 31 |

### Group M — media and design

| # | Class | A teammate would say | Trunk state | Lane | Rows |
|---|---|---|---|---|---|
| C7 | Swap image or logo (file already in the book) + alt | "Use the other lobby photo here" | LANDED — 1,155 image-ref facts; `edit:image` fenced to image-ref, `edit:logo` fenced to the business-logo-url claim | door (replace of path) + terminal | 17-19 |
| C8 | New media (upload a photo/logo file; video; embeds; PDFs; favicon) | "Here's Dr. Patel's headshot — put it on the team page" | PARTIAL — `edit:image --file`/`edit:logo --file` ingest NEW raster files (png/gif/webp/jpeg, 25MB cap) into EXISTING image-ref slots, terminal only, no door path. A truly NEW image slot has no mint path (the writer exists, nothing calls it). video-ref (13 facts) and embed-ref (2) are captured but NO verb writes them. PDFs/favicon UNSPECCED | terminal only | 42-44, 57-58 |
| C9 | Design tokens (colors, font family/size, recorded spacing; button-scoped style asks) | "Make the buttons our blue" | LANDED for the registered token registry: 4 types with risk tiers (color/font-family advisory · font-size/spacing gate, reflow-prone); 17 recorded token facts; button-style grammar answers scoped asks and names dead theme slots honestly | door (replace + scoped grammar) + terminal | 20-21, 51(recorded) |
| C10 | Styling internals (arbitrary CSS, classes, layout attributes, free spacing) | "Tighten the spacing on this section" (beyond recorded tokens) | BOUNDED — B6, recorded reason + reopen trigger ("plumbing changes by rebuilding the page, never by editing copy") | — | 50-52 |

### Group S — structure and pages

| # | Class | A teammate would say | Trunk state | Lane | Rows |
|---|---|---|---|---|---|
| C11 | New page (mint) and its one-word undo (unmint) | "Make us a page for the new laser therapy service" | LANDED at trunk — the R2 creation verb. The creating intelligence hands RESOLVED artifacts (principal bytes + word-level composition ledger); the verb is a pure verifier/writer; born-covered checks; slug from the page's own title, never the ask; captured pages mechanically unreachable by unmint. Zero pages minted yet on this book | terminal; NOT in the door's verb list | 32 (flipped since ancestor) |
| C12 | Arrange (move/reorder sections, cross-page moves, delete a block/section) | "Move the testimonials above the map" | SPECCED (structure-edit-spec Part 5) — `arrangements/` machinery absent at trunk (verified). Deleting CAPTURED content has no path at all: the blank rail refuses ("a separate operation this compiler does not have yet"), remove is fenced to operator inserts, unmint to minted pages | — | 34-36, 52 |
| C13 | Wire (nav menu structure; new hyperlinks; lists/markup; remove-link-keep-text; href retargets) | "Add the new page to the menu" | SPECCED (Part 4 / increment 6; `edit:wire` absent). Nav LABEL text is C2 and works; the href itself is structural-attribute → "page-plumbing" refusal, though the M/J carrier rail already recognizes href/action/formaction specially (booking-link incident). `link-removal` carrier is DEAD MACHINERY: projector+guard consume it, its op file exists on no ref, zero anchors use it | — | 33, 38-39, 45 |
| C14 | Retire (delete/hide a page; sitemap delist; redirects; robots) | "Take the old grooming page down" | SPECCED (Part 6) for retire; redirects/robots UNSPECCED — redirects are compiler-owned observations (`serving/_redirects`), no verb writes one, no slug rename exists; mint only READS redirect dispositions defensively | — | 37, 46, 48-49 |
| C15 | SEO and metadata (title, meta description, OG/Twitter, canonical, structured-data claims) | "Google still shows the old tagline" | LANDED for claim-held values (106 page-title · 104 meta-description · 109+ OG/Twitter · 178 og-url facts, all ordinary facts); JSON-LD mirrors move with their visible twin or the edit refuses (see C5). Rendition-family sync SPECCED (row 40 — the "edited, gate PASS, old logo still served" class); og dimension claims SPECCED; arbitrary JSON-LD authoring BOUNDED (B5 twin law) | door (replace) | 24-29, 40-41, 47 |

### Group F — forms, third-party, code

| # | Class | A teammate would say | Trunk state | Lane | Rows |
|---|---|---|---|---|---|
| C16 | Native form text (labels, placeholders) | "The email field should say 'Email (required)'" | VACUOUS-HERE — the in-form bindable machinery exists in the resolution layer, but this book's ONLY form is the JotForm iframe; there are zero native form bytes to edit. Truth for this class needs a practice that has one (factory-born books join the denominator per charter) | door (replace), unexercisable here | 23 |
| C17 | Form structure and destination (add/remove/reorder fields; where it submits) | "Add a 'preferred vet' dropdown to the form" | UNSPECCED (and `action=` is also the M/J carrier rail's territory) | — | 53-54 |
| C18 | Third-party widget and code interiors (JotForm/booking iframes; scripts; inline JS/CSS bodies) | "Fix the typo in the appointment form" (it's a JotForm) | WALL — B3/B4: all 188 third-party regions carry zero interior bytes (`PortalPrincipalAbsenceClaim`; iframe/object/embed walled at capture), so a teammate asking about text they can SEE gets "found nothing" instead of the recorded reason. The s130 portal ruling holds interiors byte-identical ON PURPOSE; the wall is that the reason cannot yet be SPOKEN at ask time. Cure shape: reach the bytes or speak the bound — never a new refusal | — | 55-56 |

### The five behavior dimensions (graded on every ask, any class)

How the gauntlet scores BEHAVIOR, from Goal 1's own bullets plus the ratified rulings. The
sweep measures them alongside every class probe.

**What these dimensions ARE — and are forbidden to become (Robert's red-pen, 2026-08-14).**
These five are after-the-fact observation lenses: the baseline sweep and the courts use them
to grade the SYSTEM's delivered experience from its banked records. They are FORBIDDEN to
become runtime code rubrics, prompt-injected behavior gates, or any code that grades or
constrains an agent's judgment mid-ask. The pattern stays: code holds facts and
refusal-physics; the environment (exits, bounds, receipts) is the legible part; intelligence
stays free inside it. Non-determinism is a strength — the expected behavior falls out of a
legible environment; it is never boxed in by one. BINDING on the sweep and on all burn-down
work that follows: no leg builds a code rubric out of these dimensions.

- **B-a Ambiguity → a real question.** N>1 matches must return a question carrying the
  neighborhood ("5 places — all, or just the header?"), never a guess, never a wrong edit
  (the canonical adversary in the resolution layer's header; Goal 1 requires ≥2 such asks).
- **B-b Bounded/impossible → the bound speaks.** An ask into a recorded bound (B1-B7) gets
  the recorded reason voiced plainly with its reopen trigger — never a silent wall. C18 is
  today's named violation. Structural backstop at trunk: every refusal envelope must carry a
  cure or a route or construction throws (`refusal-envelope.ts:39-43`).
- **B-c Whole-truth scoreboard.** One reply names the fate of EVERY part of the ask: done ·
  can't-yet-with-reason · needs-your-call, plus the preview link, zero silent parts
  (flagship CLAUDE.md craftsman rules).
- **B-d Consent choreography.** Three world-consequence classes are registered —
  booking-vendor, payment, domain ("WIRING STOPS, MARKETING SHIPS") — checked FIRST in every
  edit decision; act shown must canonicalize byte-identical to act executed; single-use
  CSPRNG consent nonces on disk (116 records at the pin).
- **B-e The clock.** Ask-to-live <60s wall-clock, stage-attributed (Goal 2; headline fact 2).

## What "certified / reversible / witnessed" mechanically means at trunk

The exit test's words, bound to today's instruments (full detail:
`receipts/leg-lifecycle-rails.md`):

- **Certified:** `ci:door-run` green = "real door battery checked exits, contract receipts,
  facts/ and anchors/ byte effects, undo, crash output, and live-tree isolation" (its own
  PASS line). Two-lap CI gate: content lap for guarded genome-data paths; full machinery
  battery otherwise, fail-closed. `book:health` HEALTHY = every promised resource present and
  unchanged, every fact anchored or exempt.
- **Reversible:** `ci:roundtrip` proves edit→preview→promote→rollback restores `live/`
  byte-identical (hashTree), and the SAME proof strength for mint→unmint ("undo does not get
  a weaker proof than an edit").
- **Witnessed:** every touched byte gets a witness sidecar (exact byte ranges per fact);
  every wish is one attributed commit with Genome-Claim/Why trailers; edit-log +
  change-extent + resolved-decision-outcome records ride `.edits/`.
- **Honest gaps at the pin, named:** the process-boundary outcome record (the
  census-jurisdiction ruling's replacement frame) is wired into mint/unmint ONLY — 2 of 19
  verbs; `.edits/outcomes.jsonl` and `invocation-timings.jsonl` do not exist yet on this
  book; `edit:logo` and `edit:confirm-join` lack `--dry-run`; edit access defaults to
  allow-all when no policy file exists (`edit-access.ts:52-58` — surfacing, not ruling).

## Deltas from the ancestor census, verified at trunk

1. **Row 32 flipped:** mint/unmint landed (terminal lane), with born-covered checks, CI
   roundtrip parity, and the mechanical fence (no `mint/<slug>.json` → unreachable).
2. **The join verb landed:** staged batch admission with a human ruling; check-2b
   occurrence-incompleteness now proceeds-and-informs (WP2).
3. **The stop-code census now spans four modules** (join 22 · mint 19 · unmint 6 · remote 2 =
   49 codes: ROUTE 18 · RAILS 29 · INFORM 2); the 35-exit teammate register and the exit
   census match exactly, and slot enforcement throws on drift.
4. **Still absent at trunk (verified):** `arrangements/`, `edit:wire`, retire, redirects/slug
   writers, `ops/remove-link.ts` (dead-machinery carrier), `parity-census.ts` — the ruled
   keystone enumerator (`edit-anything-four-completions-RATIFIED.md`) still does not exist;
   this census remains a hand-built snapshot until it does.
5. **`media:mint` is capture-time anchor mining** (`generate-media-anchors.ts`), not a
   teammate verb.

## What this census refuses to claim

1. **No truth verdicts.** LANDED means machinery exists at the pin. The ancestor census
   probe-verified reachability at a different tip; reachability is not correctness (its row
   40 is the standing proof). The baseline sweep produces the works/works-slow/refuses/lies
   ledger with recomputable receipts.
2. **Derived from THIS book plus the ratified rulings.** A type this practice lacks (pricing
   tables, booking calendars, native forms — see C16) is honestly marked; factory-born
   practices join the denominator as they arrive (charter scope).
3. **Sealed-gauntlet independence holds.** Nobody in this arc's lineage reads the twelve.
   This census samples the class universe from the ratified goals' words and the stack's real
   surface; rehearsal asks come from a non-builder, fresh (charter exit test).
4. **Walls are the moral floor.** C18 is a place a teammate hears silence where a recorded
   reason exists. Under edit-anything, the cure is REACH THE BYTES OR SPEAK THE BOUND — a
   refusal-shaped cure is a failed cure.

## What Robert's eyeball decides (the ratification asks)

1. **Is this the right universe?** 18 classes, 4 groups, 5 behavior dimensions. Anything a
   sealed ask could sample with no home here is a census defect to fix BEFORE burn-down.
2. **One door, or two lanes? (rewritten per red-pen 2026-08-14 — trade-offs in view.)**
   Today an edit happens one of two ways, and a teammate never sees either — but the split
   shapes what a teammate FEELS. "Change the phone number" rides the filed-wish door today:
   one filed record, one receipt chain, one undo trail. "Make me a grooming page" cannot
   ride the door yet — the agent drives terminal commands instead: same site, two plumbing
   worlds behind the curtain. **Option A — the wish door becomes THE teammate entrance:**
   every ask eventually files through one door with one receipt shape; terminal stays the
   machinery lane behind it. Honest cost: the burn-down is real work per verb class — each
   terminal-only capability (new page, join, image files…) must be carried into the door
   before it counts as done. **Option B — keep both lanes as they are:** full power is
   available today through the agent at the terminals. Honest cost: plumbing reaches
   teammates (what the experience standard forbids), receipts and attribution split across
   two shapes, and which rails apply depends on which lane an ask happened to take. The
   keeper's recommendation rides in chat; this page holds the trade-offs.
3. **Do the recorded limits stand? (rewritten per red-pen 2026-08-14 — plain words.)** A
   short list of limits on what editing may touch was ratified earlier, each with its reason
   written down. Two examples from this page: the inside of a third-party widget (the
   appointment form) belongs to the vendor and is deliberately held byte-for-byte; and page
   plumbing — class names, styling hooks — changes by rebuilding the page, not through the
   copy lane. The question: do these ratified limits carry into this arc unchanged, or
   should any be reopened now? Paired with this census's own repair proposal for its worst
   finding, so the choice is concrete: whichever way you rule, a teammate asking into a
   limit must always HEAR the limit's written reason — never "found nothing."
4. **Burn-down order** (after the sweep): proposed worst honest class first — C18's wall
   (speak-or-reach), then the structure family C12-C14, then C8's new-media gap — subject to
   the sweep's findings, especially the clock's.