canon(constraint): ratified model requires reconciliation and an enforcer (DRAFT — do not merge)

[git-repo-auth]

DRAFT — captain's pen. DO NOT MERGE until you review the exact text (authorial voice).

Files the durable lesson from the ARS one-blob monolith write-freeze as a new tier-1 constraint (canon/constraints/ratified-model-requires-reconciliation-and-enforcer.md).

The constraint (two halves of one failure):

1. When a data/design model is ratified, the implementation MUST be reconciled to it — or a tracked, dated exception must be logged naming the divergence and its owner.
2. An enforcer must exist that flags code diverging from a ratified model. A ruling no machine checks is a convention, and per convention-requires-an-enforcer, a convention without an enforcer decays.

Motivating case: the ARS store was ruled flat records + provenance on 2026-07-10, but was built 2026-07-07/08 as a single JSON blob under one storage key (state.js: "Everything here is plain JSON, serializable in one storage write."; do.js: await this.ctx.storage.put(STATE_KEY, this.state)). Nothing reconciled it; no enforcer caught the drift; on 2026-07-16 it froze at SQLITE_TOOBIG.

Shape: mirrors canon/constraints/release-validation-gate ("convention plus an enforcer is binding"); rests on docs/appendices/convention-requires-an-enforcer. Full black box: outputs/debrief-ars-monolith-2026-07-16.md.

Frontmatter: stability: draft, status: draft — awaiting captain ratification.

[github-actions]

Canon Quality — Frontmatter Schema ✅

All 49 file(s) in writings/ conform to klappy://canon/meta/frontmatter-schema.

_{Validator: scripts/validate-frontmatter.py · Canon: klappy://canon/constraints/frontmatter-validation-before-merge · Run: #367}

[github-actions]

Canon Quality — Homepage Surfacing ✅

49 essay(s) scanned. Soft report — never blocks; the hard field gate is the Frontmatter Schema job.

All published essays resolve to the homepage feed.

_{Report: scripts/surfacing-report.py · Canon: klappy://canon/constraints/frontmatter-validation-before-merge}

[github-actions]

Canon Quality — P0010 Retrieval-Readiness ⚠️

Soft report for klappy://canon/constraints/retrieval-disclosure-contract. 700 files scanned. Never blocks — informational until the corpus is ready to enforce.

• Blocking-class findings: 15 (structural fields the contract would filter on)
• Warnings: 0 (kind resolves to unknown)
• Informational: 13 (exempt templates/archive/drafts)

Kind distribution: {'essays': 51, 'canon': 241, 'apocrypha': 38, 'docs': 304, 'journals': 60, 'unknown': 6}
Kind source: {'path': 565, 'frontmatter': 129, 'none': 6} (frontmatter-primary, path-secondary)
Default-include visibility: 596 visible, 104 hidden (journals/apocrypha/unknown)

By rule: {'audience-invalid': 2, 'exposure-missing': 5, 'tier-missing': 5, 'tier-invalid': 7, 'fm-missing': 3, 'kind-unresolvable': 6}

These are not schema violations (see the Frontmatter Schema job for those on writings/). They are corpus-readiness signals for the retrieval contract: invalid/missing audience, exposure, tier, and docs whose kind cannot be resolved. Fix in a corpus-cleanup PR before the contract flips to enforcing. See the retrieval-readiness-findings artifact for the full list.

_{Validator: scripts/audit-retrieval-readiness.py · Constraint: klappy://canon/constraints/retrieval-disclosure-contract · Run: #367}

[github-actions]

Canon Quality — oddkit_audit ✅

No dead klappy:// references or legacy link patterns found in writings/. 50 files scanned.

_{Spec: klappy://docs/oddkit/specs/oddkit-audit · Workflow: .github/workflows/canon-quality.yml · Run: #367}