Document begins

How this fossil was published

An archive that asks you to trust it has already failed. What follows is the actual boundary these pages passed through, including the parts that do not work.

The one rule everything else hangs off

Derive, never move.

An earlier version of the plan proposed promoting internal files outward after “a light editorial pass”. That was thrown out, in the plan’s own words, because “promoting a document by copying it wholesale and assuming the bad bits got spotted is exactly how private material ships.”

So the public archive is a deliberately lossy projection of the private corpus. Every page here is a new file, authored from a source that never moved and was never edited. The originals sit exactly where they were, as the evidentiary record.

internal/source.md            private — stays put, never edited, never moved
      │
      │  1. DERIVE — author a new file. Rewrite, don't copy.
      ▼
docs/archive/page.md          new artefact, carrying a provenance header
      │
      │  2. SCAN — automated, blocking, exits non-zero on any hit
      ▼
   scan report
      │
      │  3. HUMAN READ — a person reads the derived file in full,
      │     against the carve-out, and signs off by name and date
      ▼
   4. BUILD                   normal build; `make check` must pass

Four rules make that a boundary rather than a suggestion:

• The scan is blocking, not advisory. Non-zero exit means it does not ship.
• The scan cannot approve, only reject. A clean scan is necessary and never sufficient.
• The human reads the derived file in full, not the diff. Reviewing a diff hides what was carried over silently — which is the failure mode that matters.
• Default to hold. Unsure means it does not go.

And one that is easy to miss: byte-identical is a smell. If a derived file matches its source exactly, nobody made a publication decision, and the build fails on it.

The twelve things that are never published

The carve-out is deliberately much broader than “personal information”, because de-identification is not regexing email addresses into the void.

1. Credentials and secrets — including revoked ones, because they reveal structure and confirm what exists.
2. Private correspondence — email, messages, meeting chat, quoted or paraphrased, including our own words to third parties. Publishing a conversation is a decision for everyone in it.
3. Unpublished negotiation strategy — offer positions, walk-away numbers, approach sequencing. Live value to a future counterparty.
4. Legal advice and privileged material. Published source research — statutes, regulator guidance — is fine. Advice on our position is not.
5. Third-party documents without republication rights — listings, valuations, building and survey reports, heritage datasheets, press articles. Link or cite; do not host.
6. Personal contact and identity details, including photographs of identifiable people without consent on file.
7. Embedded metadata — EXIF, PDF and document properties, tracked changes, revision history. “A ‘clean’ PDF that still carries its author field is not clean.”
8. Uniquely identifying anecdotes, even with names removed. In a town of a few thousand, “the publican’s neighbour who objected at the second meeting” is an identification. The test is whether the person is identifiable, not whether the name string is present.
9. Real people’s campaign data — expression-of-interest, pledge, enquiry, survey and mailing-list records. Aggregate figures only, and only where the aggregate cannot re-identify.
10. Agent and prompt contracts.
11. Buyer, owner and receivership speculation. Name nobody. If a public record later names a buyer, that is a fresh decision requiring sign-off, not an automatic unlock.
12. Anything not already cleared. Default hold.

Category 8 is the one that does real work and the one no tool can enforce. It is also the category that changed a page in this tranche: a decision in the choice map originally discussed “the town’s other licensed venue” as a “potential objector”. The name was already gone. In a town this size the description was still an identification, and the characterisation was of a third-party business that had no part in the document. It was generalised.

Category 10 was contested. The constraint architecture page publishes a narrow selection of exactly that material, and rather than ship in knowing breach of a standing rule, the project amended the rule: AGENTS.md, which governs, now carries an explicit exception for representative, human-reviewed excerpts, with the raw prompt and contract corpora still withheld and no agent able to authorise a release under it. The conflict, and its resolution, are recorded on that page’s face.

The scanner, and what it is for

scan_archive_candidate.py carries fifteen rules across categories including credentials, correspondence, negotiation posture, personal identifiers, buyer speculation and embedded metadata. It runs on every candidate file, in make check, and blocks.

Two design decisions are worth stealing.

No global bypass. There is deliberately no --fossil flag. Historical documents legitimately trip these rules — a document explaining why a 5% dividend promise was dangerous has to quote the promise. The temptation is a switch that turns the scanner off for the archive, and that switch would have eventually turned it off for something else. Instead a single line can be waived with an inline, rule-scoped marker naming the exact rule it suppresses. A bare marker with no rule named is itself a finding. So is a marker naming a rule that does not exist.

Waivers are auditable. Every waiver is one line, in the file, naming the rule, permanently visible to any reader.

There are 145 of them across 34 pages, and it would be dishonest to describe that as a handful. Here is the whole set:

The pattern is worth naming, because it is the structural problem with scanning a historical archive: a document explaining why a dangerous claim was wrong necessarily contains the dangerous claim. The scanner cannot tell the promise from the retraction — the table above needed two waivers of its own, for the rows describing the waivers. Neither can a regex written by anyone else. That is why the waiver has to name a rule, sit on one line, and stay visible — so a sceptical reader can check every single one of these 145 decisions rather than trusting that they were made carefully.

The scanner’s real limitation is stated in its own output, every time it passes:

A clean scan is NOT approval. It catches patterns, not judgment. Carve-out 3 (negotiation strategy), 4 (privilege) and 8 (uniquely identifying anecdotes) are invisible to a regex. A human must still read every derived file in full before it ships.

A gate that reports its own blind spots on success is a rare and good thing.

Prepared is not published

Every page carries a provenance header, machine-checked, recording what the original was, when, why, where it came from, how it was treated, what changed, who prepared it and who reviewed it.

The first version of that header had a bug worth describing, because it is the kind of bug that looks like nothing.

There was a single published field. It was set to the date the derived copies were authored — while reviewed_by was still empty on every page. So the preview build asserted a publication date for documents no human had signed off. Nothing had actually been published; the pages simply claimed it.

The field was split. prepared is when the copy was derived; published is when a human signed it off and it went out. And the split was made enforceable rather than conventional:

A page may not carry a publication date unless a named human has signed it off.

The gate fails on any file with a published date and an empty reviewed_by. Until sign-off, a page renders “Not published — prepared only” and carries a preview banner, and the archive index reports how many documents are still pending rather than claiming a date. A stricter mode, run before anything ships to production, requires both a named reviewer and a real publication date on every page.

The general form of that lesson: one field doing two jobs will eventually assert the more flattering of them.

Where it failed

Every automated gate passed on a page of Tranche 1 that contained an inverted legal fact.

The source described two unregistered creditor caveats on the title. The derived copy removed the dealing numbers and the caveators’ names — correctly, under carve-out 6 and 8 — and in the same edit described them as “two registered caveats”.

That is the opposite of the record, and the unregistered status is not decoration: it is the substance of the risk. The scanner had nothing to say about it, because nothing about the sentence looks dangerous. The provenance gate had nothing to say about it. It was caught by a human reading the derived page against the original, at the last gate before sign-off.

The lesson generalised into a second review question, now applied to every page:

De-identification and fact-generalisation are two different operations. Never let the first silently perform the second.

So each page is now read twice, with two questions:

1. If this exact page were screenshotted, quoted without context, indexed forever, or read by someone personally involved — am I still comfortable having published it?
2. Did the derivation accidentally alter any meaningful fact, uncertainty, chronology, attribution or relationship?

The first question is what everyone thinks review is for. The second is the one that catches the errors that matter, and it would not have been asked if the first had been the whole checklist.

What the full read then found

Both questions were put to all fifty-six pages in a single pass before sign-off, after every automated gate had passed on every one of them. The pass found more than the caveat error, in five recognisable classes. All of it is corrected in the pages you are reading; none of it was corrected quietly.

The same failure mode, a second time. The source register recorded the two caveats as lodged on 16 and 21 March 2026. A derived page removed the dealing numbers and the caveators’ names — correctly — and in the same edit replaced the interval with “three weeks apart”. It is five days. A second page had inherited the wrong figure while a third had it right, so the archive also contradicted itself. De-identification had performed fact-generalisation again, in a different document, in exactly the way the rule above warns about.

Redactions that only happened on some pages. Four pages named the previous prospective purchaser — a private individual whose purchase did not proceed — while the assumptions register withheld that name deliberately and the project’s own published meeting transcript had anonymised him at the time. Separately, a page whose treatment note said the insolvency firm was referred to only by role printed the firm’s web address three times, in a heading, a fetched URL and a source line; another page published a private research-workspace identifier that a different page’s note said was withheld; another carried an author’s surname that two other pages withheld. In each case the archive already contained the correct decision — it just had not been applied everywhere.

The archive contradicting its own verification work. One page described a comparator co-operative’s asset as “a former hotel building” and gave a sale year and an investor count. The project’s own case-study verification had checked that entity against primary sources and recorded, in two other archive pages, that the asset is not a hotel and that “local hotel” was a mischaracterisation; the sale year and investor count were never in the verified set. Another page published survey contribution bands that a second page had redacted, citing the source’s own instruction not to externalise them.

A claim about the record that the record does not support. Three pages stated that the steering committee’s decision log held three real decisions made at the first meeting. It holds none. The three rows are worked examples the drafter wrote before the meeting, and they still carry their [name] and 2026-05-[DD] placeholders. The error ran in the direction that flattered the project, which is the direction these errors usually run.

Counting and mechanical damage. The waiver table on this page said 145 waivers across 33 pages; it is 34. A page said twelve of twenty generated artefacts were withheld, implying eight were published; all twenty were. Several name substitutions had left visible scars — “the the appointed receivers”, “by then-owner the then-owner”, “a second law firm Davies” where a firm name had been half-removed. One internal link pointed at a page that does not exist.

Two sweeps run in the same pass came back clean, which is worth recording alongside the failures: every dollar figure and percentage in the intact pages traces to its source, and no page anywhere reintroduced the original “registered caveats” inversion.

The honest summary is that the automated gates caught none of this, and could not have. Every item was a judgement, a cross-document consistency question, or a fact that had to be checked against a source document. That is what the human read is for, and the number of findings is an argument for doing it rather than evidence that it was not needed.

What this process does not give you

It does not give you a guarantee. It gives you a reviewable trail: a stated carve-out, a blocking scanner whose rules are readable, waivers visible in the text, a provenance header on every page recording who did what, and a public record of every error the automation missed.

If you find another, that is the process working rather than failing. The originals still exist, unedited, and a correction is a dated addendum — never a quiet edit.