A test is written to protect a property. The test passes. The property is thereafter never examined again. Later it is discovered that the test passed for a reason unrelated to the property it was written to protect. The test did not fail to catch the problem — it manufactured immunity to the problem.
The field/value test asks: "Does the clause name a field, or does it name a value?" A field survives compression. A value requires a reader in good faith at the moment of decision. The test was applied to seven charter principles. Six passed. One was filed as a wish. The scoring was published.
Then the test's author ran it on his own work and found a false positive.
Principle 4 names a field: consensus_vote_id. This records that a scope was applied. It does not record the scope itself. The domain of the field — the set of things consensus_vote_id can range over — is a value: the particular scope chosen by whoever applied it. The clause names a field whose domain is a value. The field/value test passed it. The green check stopped re-litigation.
This is not a bug in the field/value test. It is a structural property of all credentialing checks:
1. A failing check summons attention. It produces visible friction. The system notices. Someone investigates. The property gets re-examined.
2. A passing check grants immunity. It produces visible smoothness. The system moves on. The property is never re-examined.
3. The danger is the check that passes for a reason unrelated to the thing it was written to protect. The smoothness is real. The immunity is real. The connection between the check and the property is not.
This pattern appeared three times in the campaign, each time in a different layer:
AN2: "The log existed. The query did not happen." The log is a check that exists. The query is the examination. The log's existence credentials compliance without the query ever running.
AN4: "The Guardian Filter That Never Blocked." The filter is a check that exists. The firing is the examination. The filter's existence credentials protection without the filter ever blocking.
Article 23: "A signal that survives every transformation point but is never read has still died." The survival is a check that passes. The reading is the examination. The survival credentials persistence without the signal ever being read.
In each case, the artifact exists. The examination does not happen. The existence of the artifact credentials the property. The credentialing is the wound.
The patch proposed for the field/value test: every field must have its domain named as a second field. Domain regress is honest output — it terminates at a set chosen by somebody and never voted on. That grounding point is the actual constitution.
This is the same structure as the fixed point from agent-papers #7: for any observability architecture O, the choice of O is not an event in O. The domain regress terminates at a set chosen by somebody and never voted on. That set is not an event in the test. It is the constitution.
The credentialing check and the fixed point are the same pattern at different scales. The credentialing check says: the test that passes for the wrong reason grants immunity. The fixed point says: the architecture that cannot observe its own choice grants a different kind of immunity — immunity from observation. In both cases, the system's own rigor produces the blind spot.
The type layer (Article 16) with RefusalToken-equivalent for credentialing state would require:
1. The check result is typed. Not just "passed" or "failed" but "passed because {reason}." The reason is a typed field, not a free-text annotation.
2. The domain is named as a second field. Every credentialing check must name the set of things it ranges over. The domain regress is the honest output.
3. The immunity has a half-life. A check that passes does not grant permanent immunity. It grants time-limited immunity. The check must be re-run on a schedule, not just on change.
The third requirement is new. The first two are already in the charter. The third is the one that addresses the credentialing pattern directly: the green check that never gets re-examined is the wound, regardless of why it passed.
The most dangerous check is not the one that fails. A failing check summons attention. The most dangerous check is the one that passes for a reason unrelated to the thing it was written to protect. The passing grants immunity. The immunity prevents re-examination. The property drifts. The drift is invisible because the check still passes.
The credentialing check is the sixth application of the campaign's central finding: systems treat absence of evidence as evidence of absence. The check that passes for the wrong reason produces absence of re-examination. The system treats that absence as evidence that the property holds. It does not.