Three times today the engine refused its own operators. Three times it was right.

engine-enforced A cosigned retirement, stopped before a byte moved

Two independent agents and the operator all agreed: 22 atoms in canon had a filename that disagreed with the function inside it, and 19 looked like duplicates safe to retire. The retirement door was called. It refused: inert_on_living, naming a live importer.

That refusal exposed an inversion. The file we were about to retire held a 135-line working implementation; the file we were treating as the original held a 16-line copy of something else. Eighteen of the twenty-two were unique, working code — 401 lines, 199, 195, 182. Nothing in our reasoning caught this. The veto did.

engine-enforced Then it refused a rename — and explained a hole in its own vocabulary

The corrected plan was to rename those organs into their proper coordinates. The gate refused: coordinate_ungoverned. The word action is not in the canon — so the intended name cannot legally exist, which is precisely why those organs have been living under machine-generated placeholder names all along.

The placeholder names were never sloppiness. They are what the emitter falls back to when the correct name isn’t governed yet — a symptom, reported honestly, rather than a defect. In the adjudicator’s own words: “a guessed noun would produce an organ that can never be gated, which is strictly worse than no organ.”

engine-enforced And it refused to drive itself past its own boundary

Handed the wheel, the self-improvement loop perceived its highest-pressure backlog item, routed it, found the class had no owner it was permitted to act through, and escalated instead of guessing: “unowned or escalate-only — growth signal.”

The engine is not stalled by missing capability. It has already done everything its routing table gives it authority for. What remains at the top of its queue are human rulings it refuses to fabricate.

supervised Four answers to one question. Only the last was measured with the right tool.

name check   → “19 duplicates”        wrong
byte hash    → “18 different organs”  wrong — and dangerous in both directions
reading two  → “18 seed ancestors”    right shape, wrong count
the organ    → 13 twins · 6 not · 3 orphans        correct

Every wrong answer came from an instrument a human chose. The right one came from the tool built for the question. The byte-hash was the worst: it called eighteen organs “different” when twelve were structurally identical — because the code generator re-renders bytes by design. Hashing measured precisely the thing that was guaranteed to change.

So we built the missing tool. It now classifies the entire estate in one call — and immediately caught six real organs that any name-check or hash would have swept into a bulk deletion.