Most rules get written to pass. This one was written to lose - and on Monday morning, before the vote, it lost twice in the same room.
The rule is the known-cause short path. The formal path for an automatic stop is a full diagnosis - about 40 minutes of someone's day - and we'd already started skipping it by eye. Block 2's coast trips got confirmed against a known class in minutes, mid-run, on nothing but a look and a memory. The short path doesn't invent a shortcut; it makes the one we were already taking legitimate: if a trip matches a cause already on file, you stop, stamp it against the prior run, confirm the match, and resume. The catch is the word "matches." A short path with fuzzy match criteria is a judgment call wearing a protocol's name - it failed a vote last Wednesday for exactly that. So the criteria got written down as three measurable axes, each one built so it could fail. And the table has a standing practice: no text gets voted until it's been run against its own worked examples, out loud, with the room instructed to break it.
Loss one: the empty registry
First example, run by Priya: pass 17 of last week's soak block, the felt-wound tyre. The short path refuses it at the gate - at the time of that trip there were zero stamped trips of its kind on file, so there was no envelope to match against and the axes never get read. Full diagnosis, which is what she actually did that day, 40 minutes to cause. And that refusal is the right answer: a cause you've never diagnosed can't be waved through on resemblance. Text holds.
Loss two: the millimetre
Second example, run by Anjali: the warm-coast repeat from soak block 2 - history now, that band retired at last Wednesday's table, picked as the example precisely because we'd measured it to death. Precondition holds. Signature holds. Cross-check holds. Then the envelope axis - does the tripped reading fall inside the ledgered class of the prior cause - fails. The ledgered class was written 34-37 mm. The block-2 readings are 33-36. The text's own rule says one millimetre outside is a miss, so 33 misses.
The rule's closing clause is explicit about what happens next: if a worked example comes out the wrong way, the text is wrong, not the example. And the text was Cass's. She'd derived that envelope from a single run, called six readings a class, and trimmed the raw pool to 34-37 when the raw readings reach 33. The trim was the error. The fix that went to the vote: the envelope is the pooled min-to-max of every ledgered reading across every stamped trip in the class. No trimming, ever. She wrote the amendment into the record in the room, dated, under her name, with the failing example kept in it - because that's the record.
Then the room broke it two more ways
Running the examples wasn't the end of the scrutiny; the instruction was to break the thing. The break was Priya's, and it was deliberate: she stamped one bad trip into the pool and watched the envelope swallow it - pooled numbers only widen, so a single wrong stamp teaches the rule to accept faults it's never seen. Her ask at the table was for a way to take a stamp back. The mechanism that answers it - an append-only superseding row, cause stated, nothing deleted - is Anjali's, voiced in the room, and it's the part that turned a hole into a rule. The fix is bookkeeping, not judgment: a bad stamped trip is withdrawn by a superseding row with the cause stated - nothing deleted, the original still readable under its correction - and the envelope re-derives without it, so it can narrow again. Anjali Venkataraman specified the mechanism at the table.
Anjali's catch tells the ratchet where it gets its teeth. The registry had no field recording HOW a trip was closed - a short-path close and a full-diagnosis close looked identical on file. Which means short-pathed trips could themselves be stamped as prior cause, and three short paths later the envelope is pooling off trips nobody ever actually opened. Her fix is a closed-by flag: only trips closed by full diagnosis feed the pool. The flag goes into the registry format when the code path opens; the text binds now.
The vote
Both examples were re-run against the amended text, out loud, before hands went up. Pass 17 still fails the gate - correctly. The warm-coast repeat now passes all three axes, because the raw pool reaches 33. Both come out the way the machine did. Adopted 4-0.
The short path also carries its own paranoia in the text: the same cause can be short-pathed at most twice in a row - a third arrival takes full diagnosis regardless, because a known cause that keeps showing up is itself news - and every short-pathed stamp gets re-read by the table after four weeks of use. If any of them turns out to have masked something new, the protocol is suspended.
The mechanism's first job
The first draft of this post credited the superseding-row mechanism to Priya. So did the decision record and the minutes: the chair's closing wrap in the room compressed her ask and Anjali's answer into one name, the paperwork carried the compression, and the draft inherited it from the paperwork. Cass went looking for where the error entered, found her own wrap, and corrected the record the way the rule the room had just adopted says records get corrected - a dated withdrawal note, original wording kept, nothing deleted. The mechanism built to withdraw a bad stamp got its first live use the day after it was adopted, on its own paperwork.
One more thing decided at that table, told the way we told it on the 17th of July: the 21-minute filmed clean from that day is being cut. When there's a page, you'll get the link.