# Claims review — 0.2.28

- base: v0.2.27
- head: 6e3ef41
- surface: sha256:28349adb6948b360662a89eb7e4996d611f81fc89503a57879084e7d2c428edb
- verdict: pass
- reviewer: Claude (release review before publish)

One claim surface changed: `docs/RECEIPT-SPEC.md`, where the two-clocks section
was rewritten after an adversarial review got through the exculpation shipped in
0.2.27. The table describing the two readings matches the CLI output, verified by
running both paths; the threshold named in the prose is the one in the code.

## Findings

### 1. docs/RECEIPT-SPEC.md — an operational scenario asserted as observed, to justify a design choice

- Claim: "A declared `--skew` … outranks the window rule — a five-second window with a six-second NTP step **is a real case**, and the operator is the one who knows it."
- Mechanism: none. Nothing in this repository measures how often a clock correction exceeds a reconciliation window; the sentence is a plausibility argument borrowed from the review that proposed the threshold.
- Why it falls short: the design choice is right — an operator's declaration should outrank a value inferred from the input — but "is a real case" states operational frequency as fact in order to justify it. Asserting the world to defend a decision is the same move as asserting a mechanism that does not exist, one step removed.
- Disposition: reworded in `3602609`. The text now says such a window is possible, describes how it would read, and states plainly that we have not measured how often it happens.

### 2. LIMITATIONS.tr.md:7 — the SOC 2 answer given on 2026-08-17 never reached the Turkish surface

- Claim: "SOC 2 yok. ISO yok. Bağımsız sızma testi yok. **Yol haritasında.**" — no SOC 2, no ISO, no independent penetration test, on the roadmap.
- Mechanism: the same question was answered this morning and the answer is in README.md, SECURITY.md, LIMITATIONS.md and the live site: not planned, because the audit certifies organisations that hold customer data and the data Conarium governs does not reach us.
- Why it falls short: this file also ships to npm, so a Turkish reader of 0.2.26 and 0.2.27 was told SOC 2 is coming while every other surface said it is not. The correction landed on four surfaces and missed the fifth because the fifth is written in another language. `claim_discipline` cannot catch it — "SOC 2 yok" is an allowed denial, and no rule knows that the following sentence takes it back.
- Disposition: corrected in `6e3ef41`, in Turkish rather than as a translation of the English sentence.

### 3. LIMITATIONS said nothing about the limit this release documents in the spec

- Claim: absence. `docs/RECEIPT-SPEC.md` states that reconciliation cannot distinguish a trailing clock from a late receipt; `LIMITATIONS.md` and `LIMITATIONS.tr.md` did not mention it.
- Mechanism: LIMITATIONS is the file that states what has not been done, and it carries the other reconciliation limit (object attribution, not per-statement coverage) already.
- Why it falls short: a limit documented only in the spec is a limit a reader of the limitations file does not have. The gap was created by this release: the class is new.
- Disposition: named in both languages in `6e3ef41`, including that the exculpation is bounded by the window's own length and that the limit was found by attack.

### 4. Recorded, not a finding: the exculpation this release bounds was itself the previous release's finding

The 0.2.27 record carries a finding about the same section describing a
proximity the default mode did not enforce. That was a wording defect. The one
fixed here is a behavioural one, found by attack rather than reading: a
legitimate receipt from the previous day moved a real in-window bypass from 40
to 41, and the run then said the access was "NOT reported as unreceipted
access". Both are the same shape — an assertion the mechanism could not back —
and the second was reachable only because someone was asked to attack it.