reconcile: reject a projected marker in the corpus, and check form per root

20-contract.md claimed the index raises DuplicateRegionId when an id appears in both
marker forms 'anywhere in the repository'. Nothing enforced it for the corpus, and the
gap was live: dropping ':declared:' from both markers of mirror-AttributeState made the
region invisible and the run still reported Valid, exit 0, with the obligation guarding
the wisdom defect silently gone.

A both-forms rule would not have caught that - the id never appears in declared form -
so the rule is that a projected marker in the corpus is MalformedRegion at all. The
corpus has no projector: SS1 makes every module read-only.

- Read-SpecSet.ps1: the pattern gains the projected form; seeing one fails the run
- Read-SpecSet.Tests.ps1: the typo is rejected, the declared form still accepted
- 20-contract.md: both sites narrowed to what is checked, and the half that stays open
  named - an id declared in the corpus and projected outside it, which CP9 puts beyond
  the spec-set checker and the glob table puts beyond IdCollision

Decision recorded in 90-decisions.md and design/state/decisions/.

Author: claude

design/20-contract.md

@@ -480,8 +480,12 @@ Authors write these; no code declares them, so this is their only home. The four
 *Authored records* above. Binding on the corpus:
 
 - A region's opening and closing markers must match and must not nest.
-- A `(document, id)` pair must be unique, and one id must not appear in both marker forms anywhere
-  in the repository.
+- A `(document, id)` pair must be unique within the corpus.
+- **Every region in the corpus is declared, and a projected marker anywhere in it is a finding.**
+  The corpus has no projector — SS1 makes every module read-only — so a rendered region cannot
+  legitimately appear here, and treating one as merely unrecognised is how an obligation
+  disappears without trace: drop `:declared:` from both of a region's markers and the region
+  ceases to exist, the obligation with it, on a run that still reports `Valid`.
 - A region must have a non-empty body.
 - `provisional-register` occurs exactly once across the whole corpus.
 
@@ -742,10 +746,26 @@ clean. A declaration the index skipped is a declaration no check examined.
 |---|---|---|
 | `UnreadableDocument` | A corpus file cannot be opened or decoded as UTF-8 | Fix the file; check encoding, per `agent.md` on CP1252 imports |
 | `UnknownDeclarationForm` | A fence contains a construct the restricted grammar does not accept | Extend the grammar, or rewrite the declaration into a known form |
-| `MalformedRegion` | A marker is unclosed, mismatched, or nested | Fix the markers |
-| `DuplicateRegionId` | A `(document, id)` repeats, or one id appears in both marker forms anywhere in the repository | Rename one region or make the form consistent |
+| `MalformedRegion` | A marker is unclosed, mismatched, nested, or written in the projected form, which the corpus has no writer for | Fix the markers |
+| `DuplicateRegionId` | A `(document, id)` repeats within the corpus | Rename one region |
 | `CorpusNotFound` | `-CorpusPath` does not resolve to a directory | Fix the invocation |
 
+**`MalformedRegion` covers the projected form as well as the unbalanced ones, and the name
+reading narrower than what it checks is the price** — paid deliberately, for the third time in
+this document, on the reasoning that widened `AnchorMissing` and `EnforcementUnevidenced` rather
+than splitting them: the check, the remedy, and the reason are the same in every case, and a
+second reason would have split one rule across two names for nothing.
+
+**What this does not reach, stated rather than left to be found: an id declared in the corpus and
+projected outside it.** `AGENTS.md` § *Marked regions* makes form consistency repository-wide and
+`90-decisions.md` (2026-08-21, marked-region identity) settled it, but no checker applies it
+across both roots. `IdCollision` enforces it over the design-state document set, which
+§ *Artifacts of a unit kind* never resolves into `docs/docs/games/`; the spec-set checker cannot
+reach the other direction either, because CP9 keeps it to exactly one corpus root and widening
+that is a contract amendment rather than a slice's call. The exposure is small and worth naming:
+the corpus's ids are `mirror-`, `provisional-`, `lifecycle-` prefixed and nothing outside it
+projects under those names. The rule stands; what is checked is each root against itself.
+
 `UnknownDeclarationForm` becoming frequent is the countable condition that reverses
 `90-decisions.md` (2026-08-20, restricted grammar). When status 2 stops meaning "look at this" and
 starts meaning "run it again", the real parser has become correct.

design/90-decisions.md

@@ -9,6 +9,40 @@ Append-only. Newest at the top. The rejected alternatives are the point — with
 
 ---
 
+### 2026-08-31 — A projected marker in the corpus is a finding; form consistency is checked per root
+Context: `20-contract.md` claimed in two places — § *The marker vocabulary* and the
+`DuplicateRegionId` row — that an id appearing in both marker forms "anywhere in the repository"
+is raised by the spec-set index. Nothing enforced it for the corpus: `Get-DeclaredRegions` matched
+only the declared form, and `IdCollision`, which does enforce the policy, runs over the
+design-state document set that § *Artifacts of a unit kind* never resolves into
+`docs/docs/games/`. The gap was not theoretical. Dropping `:declared:` from both markers of
+`mirror-AttributeState` made the region invisible, took the obligation guarding the `wisdom`
+defect the brief is named for with it, and the run still reported `Valid`, exit 0, with the
+obligation count quietly down from two to one.
+Chosen: A projected-form marker anywhere in the corpus is `MalformedRegion`, not a both-forms
+collision. A both-forms rule would not have caught this at all — the typo drops `:declared:` from
+the start and the end together, so the id never appears in declared form and there is nothing to
+collide with. The corpus has no projector (SS1 makes every module read-only), so a rendered region
+there is always wrong and can be rejected on its own. `MalformedRegion` absorbs it rather than a
+new reason being minted, on the reasoning that widened `AnchorMissing` and `EnforcementUnevidenced`
+rather than splitting them. The two contract sites are narrowed to what is actually checked —
+`(document, id)` uniqueness within the corpus — and the half that stays open is named: an id
+declared in the corpus and projected outside it is checked by neither root, because CP9 keeps the
+spec-set checker to one corpus root. The 2026-08-21 policy is untouched; only who enforces it
+where is now written down truthfully.
+Rejected: Correcting the contract and leaving the index alone — prose only, no code, and rejected
+because it writes the silent retirement of an obligation down as accepted when the fix is one
+alternative in the pattern the file already owns (SS2) plus a test. Also rejected: adding
+`docs/docs/games/*.md` to § *Artifacts of a unit kind*'s document row so `IdCollision` covers the
+corpus, which would make the repository-wide claim literally true — rejected because it raises
+`UnrecordedArtifact` on all eight corpus files at once, and changes the installed design-state
+path's policy for another path's benefit, the shape `90-decisions.md` (2026-08-30, the content
+path is contracted as a third scope) already rejected by name when it declined to make
+`src/campaigns/` a unit kind.
+Reversibility: cheap — one regex alternative, one guard, one test, and three prose edits.
+
+---
+
 ### 2026-08-31 — The `lifecycle-` marker vocabulary is reserved to the derived concept set
 Context: `Test-SpecSet.ps1`'s concept check raises a third finding the contract's § *Checks* table
 does not list — a `lifecycle-` region whose name is outside the derived concept set — and S6.5

design/state-index.md

@@ -158,6 +158,7 @@ This document is a navigation view generated from `design/state/`. Edit the reco
 | decision/2026-08-30-the-engine-s-published-surface-is-enforced-by-a-check-not-only-by-prose | `unit/document/design-10-design`, `unit/document/design-20-contract` |
 | decision/2026-08-30-the-game-content-path-enters-design-through-a-design-pass-before-it-is-contracted-or-sliced | `unit/document/design-10-design`, `unit/document/design-20-contract`, `unit/document/design-30-slices` |
 | decision/2026-08-31-a-length-narrowing-on-a-collection-field-is-cp10-compliant-s21-3-is-fully-met | — |
+| decision/2026-08-31-a-projected-marker-in-the-corpus-is-a-finding-form-consistency-is-checked-per-root | — |
 | decision/2026-08-31-cp2-and-cp3-are-scoped-to-production-sources-and-the-cp3-check-is-tightened-to-match | — |
 | decision/2026-08-31-the-lifecycle-marker-vocabulary-is-reserved-to-the-derived-concept-set | — |
 <!-- decision-affects:end -->

design/state/decisions/2026-08-31-a-projected-marker-in-the-corpus-is-a-finding-form-consistency-is-checked-per-root.md

@@ -0,0 +1,17 @@
+# decision/2026-08-31-a-projected-marker-in-the-corpus-is-a-finding-form-consistency-is-checked-per-root
+Date: 2026-08-31
+Anchor: 2026-08-31 — A projected marker in the corpus is a finding; form consistency is checked per root
+Status: accepted
+
+## Claim
+A marker written in the projected form anywhere in the corpus is `MalformedRegion`. The corpus has
+no projector — SS1 makes every module read-only — so a rendered region cannot legitimately appear
+there, and leaving it merely unrecognised let a region disappear silently: dropping `:declared:`
+from both of a region's markers retired its obligation on a run that still reported `Valid`. A
+both-forms collision rule would not have caught that, because the id then never appears in
+declared form at all. `MalformedRegion` absorbs the case rather than a new reason being minted,
+on the reasoning that widened `AnchorMissing` and `EnforcementUnevidenced`. Form consistency is
+checked per root: `IdCollision` over the design-state document set, the spec-set index over the
+corpus, and an id declared in one and projected in the other is reached by neither — CP9 keeps
+the spec-set checker to a single corpus root, so `20-contract.md` names that bound instead of
+claiming a reach it does not have.

tools/Read-SpecSet.Tests.ps1

@@ -65,6 +65,22 @@ Describe 'Read-SpecSetIndex' {
         $index = Read-SpecSetIndex -CorpusPath $corpus
         $index.State | Should -Be 'NotEvaluated'; $index.Reason | Should -Be 'DuplicateRegionId'
     }
+    It 'a projected-form marker anywhere in the corpus yields MalformedRegion' {
+        # The corpus has no projector - every module is read-only (SS1) - so a rendered region
+        # cannot legitimately appear here. Left unlooked-for, dropping ':declared:' from both
+        # of a region's markers retires that obligation with no trace: before this was
+        # rejected, the fixture below indexed zero obligations and the run reported Valid.
+        $corpus = Join-Path $TestDrive 'projected-form'; New-Item -ItemType Directory -Path $corpus | Out-Null
+        Set-Content -LiteralPath (Join-Path $corpus '01-fixture.md') -Value "# Fixture`n`nList: <!-- mirror-Foo:start -->a, b<!-- mirror-Foo:end -->" -NoNewline
+        $index = Read-SpecSetIndex -CorpusPath $corpus
+        $index.State | Should -Be 'NotEvaluated'; $index.Reason | Should -Be 'MalformedRegion'; $index.Line | Should -BeGreaterThan 0
+    }
+    It 'still accepts the declared form of the same region, so the rejection is the form and not the id' {
+        $corpus = Join-Path $TestDrive 'declared-form'; New-Item -ItemType Directory -Path $corpus | Out-Null
+        Set-Content -LiteralPath (Join-Path $corpus '01-fixture.md') -Value "# Fixture`n`nList: <!-- mirror-Foo:declared:start -->a, b<!-- mirror-Foo:declared:end -->" -NoNewline
+        $index = Read-SpecSetIndex -CorpusPath $corpus
+        $index.State | Should -Be 'Indexed'; $index.MirrorObligations.Count | Should -Be 1
+    }
     It 'S3.4: a mirror region naming an open declaration is still indexed as an obligation' {
         $corpus = Join-Path $TestDrive 'open-decl'; New-Item -ItemType Directory -Path $corpus | Out-Null
         $content = @'

tools/Read-SpecSet.ps1

@@ -165,13 +165,20 @@ function Get-SpecSetLineNumber {
 function Get-DeclaredRegions {
     param([string] $Text, [string] $DocumentPath)
 
-    $pattern = '<!--\s*(?<sid>[A-Za-z][\w.-]*):declared:start\s*-->|<!--\s*(?<eid>[A-Za-z][\w.-]*):declared:end\s*-->'
+    # Both marker forms are matched, though only the declared one may appear here. The corpus
+    # has no projector - every module is read-only (SS1), so nothing can write a rendered
+    # region into it - which makes a projected marker in a corpus document always wrong, and
+    # silently so if it is not looked for: dropping ':declared:' from both markers of a region
+    # retires that obligation without a trace, and the run still reports Valid. The id
+    # character class excludes ':', so the projected alternative cannot match the declared form.
+    $pattern = '<!--\s*(?<sid>[A-Za-z][\w.-]*):declared:start\s*-->|<!--\s*(?<eid>[A-Za-z][\w.-]*):declared:end\s*-->|<!--\s*(?<pid>[A-Za-z][\w.-]*):(?:start|end)\s*-->'
     $regions = [System.Collections.Generic.List[object]]::new()
     $seenIds = [System.Collections.Generic.HashSet[string]]::new()
     $openId = $null; $openLine = 0; $openBodyStart = 0
 
     foreach ($m in [regex]::Matches($Text, $pattern)) {
         $line = Get-SpecSetLineNumber -Text $Text -Index $m.Index
+        if ($m.Groups['pid'].Success) { return [pscustomobject]@{ Failure = 'MalformedRegion'; Line = $line } }
         if ($m.Groups['sid'].Success) {
             if ($openId) { return [pscustomobject]@{ Failure = 'MalformedRegion'; Line = $line } }
             $openId = $m.Groups['sid'].Value; $openLine = $line; $openBodyStart = $m.Index + $m.Length