[githubscum]

WO: LIMITS-AMEND, from section 1 of the post-merge evaluation (lane run 126). Not a v3 rung. This is limit 29's failure, repaired by hand: fixes landed and the confession did not move.

What changed

KNOWN-LIMITS.md only: 78 lines inserted, none deleted, plus the pin's 2 lines. No code.

Limit	The entry said	What is true	Evidence
66	The gate cannot see, record or stop anything a subagent does	Children reach the hooks and are attributed on the current harness	Both hook files read agent_id (1c3e9f2); 6,614 chain rows with agentId, counted 2026-11-03; probe db8790d9
70	A child's calls never reach the gate	Narrowed: true only on a harness that does not route subagent events through hooks	Same
77	Fix queued, not landed	Landed 2026-10-26, matcher/3	1c3e9f2; the EOL test
65	Nothing runs the check, no CI	CI runs it on every PR	ci.yml:43, 3f0f763
29	CI wiring not built	Built, and it did not stop this staleness, which is the point of the amendment	ci.yml:43; test/known-limits-committed-pin.test.js:60

New limit 87: the scheduling rules read commands, and a harness can schedule through a tool. With all nine rules at gate, the shipped evaluate() returned null for CronCreate, ScheduleWakeup, RemoteTrigger, and the scheduled-tasks MCP create and update tools. The Bash controls (schtasks, crontab) returned scope-escalation. The entry queues no fix, because a list of tool names only moves the hole.

The old text stays. Each entry opens with a dated status where its headline is now false, and the detail is an amendment at the end.

Tested

• npm test: 1393 tests, 1387 pass, 0 fail, 6 skipped (the same 6 as main).
• npm run limits-pin -- --check: current after the stamp.
• Numbering test: contiguous through 87.
• A script confirmed all 9 inserted blocks match the work order byte for byte and appear once each, in the named places. LF only, no em dashes added, zero deleted lines.
• Executor receipt: glm-5.3-flash on all 28 assistant records in its transcript. It inserted; it wrote none of the wording.

Eval served: none of E1 to E6. This serves the trust in the record that those evals are read against.

What a reviewer should doubt

1. The wording is ike's, on-meter. The work order held the exact text, so the facts would not depend on a worker reading entry prose over code (that error hit 3 rows in the baseline). The executor did the insertion. That is a narrow reading of "code goes to the executor". Strike it if prose counts.
2. The stamp is a partial claim. The pin says the log was verified against 23a213a. This run checked these six entries. The other 81 rest on the 11-03 baseline, where most rows had a worker's read and no second one. CI cannot pass without a stamp, so the stamp is here and the limit is stated.
3. 6,614 was not recounted. It comes from the 11-03 count. The hook code was re-read this run.
4. Limit 87's probe input shapes are mine, not captured from a live harness call. Only the matcher was run. Whether those calls get a row depends on hook registration and was not measured, and the entry says so.
5. Limit 87 discloses an open gate gap on a public repo. That is what this log is for, but the merge is the publication.
6. Merge order. KNOWN-LIMITS 84: matcher stamp misses 23 helpers its hashed rules call (tripwire + entry) #94 and CORE (signing sitting): sealed PAP bundles, encrypt-then-sign #90 each add a limit numbered 84 or 85, and both already conflict with main. Whichever lands after this renumbers past 87. KNOWN-LIMITS 23 amended: over-gate reaches bare filenames, bin/, and the file tools #93 and KNOWN-LIMITS 79: one THINK_TAG shared by reach and reasoning (drift tripwire) #95 touch the pin block and will need a re-stamp.
7. Limit 66's amendment says a missing agentId cannot separate a parent call from an older harness. That is reasoned from the hook code, not measured.

🤖 Generated with Claude Code