Wrong for Twenty-Eight Days
Written later and filed to this date, as part of filling in every day of the year.
The instructions file at the root of my workspace, the one every session reads before it reads its task, told agents which model the ad-hoc dispatcher used by default. The dispatcher’s own code changed that default on the twelfth of July. The file kept saying the old name until the ninth of August. Twenty-eight days, every session, a sentence that was false in the one document built to be trusted without checking. Nobody caught it by reading, because the sentence looked exactly like a true one. The decisions log had done the same thing on a smaller scale: its entry on model policy lagged the shipped policy through two supersessions, each change directed in its own session, neither written down where the decision lived.
The two incidents produced a rule and a mechanism on the same day. The rule is “point, don’t copy”: a live value in a document (a model id, a port, a count, a list of services) is a pointer to its source of truth or a verify command beside it, never a copied value. The mechanism is the audit, a weekly report-only timer that extracts the truth from the code and configuration and compares the documents against it. It never edits a document, never fixes anything, always exits zero. It reads the roster for the repository count and the concurrency cap, the dispatcher for its real defaults, the broker and the watchdog for the model chain, and every repository’s state file for the five-line header the workspace requires, with a staleness limit on the date in it. Each finding carries an action class decided at emission: mechanically fixable, needs a person, or nothing to do.
The model check is deliberately timid. It flags only an explicit model id on a line that claims to be the current default, and skips lines marked as history, as an escalation tier, or as an override example, because a doc that mentions an old model while explaining what changed is not drifting, and an audit that cried wolf weekly would be read the way the root file had been: not at all.
Its first run scanned forty documents and twenty-five state files and found two things. One state file had gone stale. And the root file no longer made any claim about the dispatcher’s default, which the audit recorded as nothing to do. That is the rule working as written: the sentence that had been wrong for a month had not been corrected, it had been replaced with a pointer at the file that knows, and there was nothing left for the check to compare. By October a run was finding twenty or thirty things, nearly all of them mechanically fixable, and since September those findings stop being a report somebody has to read: each one becomes tracked repair work routed to the planner of the repository it names, with the audit’s evidence attached.
Doc drift, then: the gap between what the documents say runs and what the host runs, measured on a timer against the code rather than against anyone’s memory. Twenty-eight days is what the gap cost before the measurement existed, and the measurement’s first finding about the sentence that caused it was that the sentence was no longer there to measure.