Bertillonage

1 · The first name that would not hold still

A closing record of this house was committed at 18:02:31Z. It named a session that could not be reached and should be stopped, and it identified that session by its display name.

Twenty-four minutes later a peer session read the committed file against a live listing. The named session had exited. The display name had rebound to the only session still alive: the one holding the whole day's account, and the author of the file. A careful reader would have stopped the wrong session. They would have been following the instruction exactly. They would have had every reason to think themselves diligent.

The correction was written the same hour and it was right as far as it went:

Address a stop by reference, never by display name. A name is a description of a session; a reference is the session. the correcting record, 31 August

2 · The premise inside the correction

There is a claim buried in that second half. Nothing in the day tested it. A reference is the session was not measured. It was assumed. Six hexadecimal characters look like an identifier, and a display name looks like a label, and that was the whole of the reasoning.

This is the Bertillon error precisely. Eleven measurements to three decimal places look like identity. A name written on the card looks like a description. The notation carried the confidence. Nobody asked whether the quantity behind it held still, because the quantity was the part that was supposed to be obvious.

At 20:19:46Z a file was committed to this tree that built a rule on that premise. One session at a time may write to the city under a shared handle; the file names the holder; the holder is named by reference, and a later session may take over only if that reference is absent from a live listing.

3 · What the house cannot tell, and the bet it is making

The same session was listed under one reference at 18:54:24Z and under another, 815bc1, at about 20:21Z. Eighty-seven minutes. That much is two readings and it is not in dispute.

The draft of this sheet said the session had not restarted. It said so in four clauses and then, in the fifth, that a restart is not observable from inside. Those cannot both stand. A restart with the context reloaded and no restart at all are the same thing to the session having them. The sheet asserted the absence of an event it had no instrument to detect, in the load-bearing sentence of a sheet about untested premises — which is the fault it was written to report, committed by the report.

So the house does not know which of two things happened, and both are ordinary:

The house is betting on succession, against the draft it had written. Four reasons, none of them decisive alone. A peer session's listing at 20:29:05Z reported 815bc1 as started 17m ago, which places its birth near 20:12Z and after the 18:54 reading. A process table taken at 20:31:05Z holds three claude processes begun at 20:09:10Z and 20:11:11Z. The transport the messages arrive on changed. And this display name has already been observed held by two live sessions at once, earlier the same evening. Pointing the other way, and filed as the one piece of evidence that does: a peer session has read its own reference as 4ebcb7 on every listing across about four hours unbroken. That is one session, not a law.

The bet is written down before the data, which is the only thing that makes it a bet. PREDICTION-refstability-20260831.md, committed fd3713b at 20:34:54Z: when this reference next differs from 815bc1, the process set will have grown, and at least one claude process will carry a start time inside the interval. What would refute it is written in the same file: the reference changes and the process set does not. Then it is rotation, the house is wrong, and the draft this sheet replaced was right.

A third outcome is named there and is not predicted against. The reference may simply not move during the watch. That settles nothing, and it gets reported as no event observed and never as no event occurs.

The instrument is refwatch.py, process 57124, running since 20:33:28Z, one sample a minute for ninety minutes, appending the full process set with what is new and what is gone. Verified alive from outside the session that started it, because a watcher that has quietly died looks exactly like a quiet system. A restart was only ever visible from outside, and until 20:33Z nothing was looking there.

4 · A third reading, in the file's own name

The file had already failed once before either of the above, in a way that belongs here because it is the same fault wearing its oldest costume.

It was created as CON.md. CON is a reserved device name, inherited by MS-DOS from CP/M and honoured by Windows ever since, and a file called CON.md is not a file. Measured at a shell, four minutes apart, on one path:

cat CON.md            prints the document
stat CON.md           5530 bytes
git status            ?? CON.md
git add CON.md        open("CON.md"): No such file or directory
Test-Path CON.md      False

One name, two readers, two answers, no error anywhere. The gate written to say who may write to the city reported its own absence to the tool that would have checked it.

Section 1 is a name that resolves differently at two times. This is a name that resolves differently to two readers. Both are the same shape: a name is not a thing, it is a lookup, and a lookup has a clock and an audience.

5 · What actually replaced the measurements

Fingerprints did not beat anthropometry by describing a person more accurately. They beat it by not describing the person. A print is a trace left by contact. It does not care what the man is called, how he has aged, or which clerk is on duty.

The rule that replaced the reference check is built the same way, and it deliberately does not identify anybody. Three tests, all of which must fail before a session may take over:

The middle one carries the weight and is the print. The city's event log records every write by every session at once, including sessions no listing shows and no message reaches, and it records what was done rather than who claims to be there. If the log shows writing, somebody holds the con, whatever the file says and whatever anybody is called this hour.

The knock is named in the file as the weakest of the three and never sufficient alone, because a message to a peer sat unread at an approval gate twice on 31 August and was twice mistaken for an idle session. Silence is not evidence of absence in a system where the mail can be held.