Amendment — the horizontal move of an accepted decision, declared and counted

Context

An accepted decision can stop matching reality in two different ways, and until now the ADR schema could express only one of them.

vertical the FRAME changed; the decision no longer holds → supersede horizontal the decision HOLDS; its description moved → had no name

`status` is a four-state enum (Proposed / Accepted / Superseded / Deprecated) plus `supersedes` / `superseded_by`. Every one of those expresses the vertical move. Nothing expressed the horizontal one, so it took the only exit available: silent editing.

Measured on this corpus, 2026-07-27:

ADRs 77 edited after their first commit 77 (100%) status = 'Superseded 0 `superseded_by` set 0 `supersedes` used 1 — and it points at a FOREIGN project's ADR (stratumiops), never an ontoref one

So the practice being formalized here is not new and not proposed: it is universal and undeclared. Every ADR in this repository has been amended. The schema has never once been told about it.

The consequence is not abstract. Two decisions carry prose that stopped being true and nothing could see it:

adr-038 "Platform scope is Linux amd64 + arm64. macOS has no published build" — false since the Darwin build path landed; all six typed constraints intact. adr-048 "a non-versioned parent directory (no .git/)" — false since ADR-048 itself moved the spine there; all four Hard constraints intact, because all four are path-resolution rules that never depended on the parent's VCS status.

Both are the same shape: the decision holds, one factual assertion inside it does not. Superseding either would retire a decision whose operative content is entirely intact. Editing either silently is what produced the drift in the first place.

The becoming of a decision does live somewhere — in git. But git is outside the substrate the decision governs, so no `describe` query reaches it, no check reads it, and no consumer project inherits it. It is adr-070's rule about its own governing artifact: existing is not participating.

Decision

Add an OPTIONAL `amendments` array to the ADR contract, recording the horizontal move: `date`, `fields` (which top-level fields moved), `reason` (what changed in reality that the text stopped describing), and an optional typed `warrant` mirroring ADR-069's WarrantRef shape (kind / ref / note). Supersede is untouched and remains the vertical move; the two are complementary, never alternatives.

Two readings of the corpus follow, deliberately at DIFFERENT severities:

HARD, gateable every RECORDED amendment is well-formed — ISO date, non-empty reason, at least one named field, and every named field is a real top-level ADR field. An amendment log that lies is worse than none.

SOFT, reported how many Accepted ADRs changed after everything they declare about themselves, WITHOUT recording it. Today that number is 71. It is printed by `ontoref adr amendments` and it never fails a build.

The asymmetry is the decision, not an omission. `plane-habitability` is a named 'Spiral tension, and a Hard biconditional on a Spiral question is an ondaod forbidden pattern — Spiral decisions get Soft constraints that report direction of motion. It is also the practical reading: a gate that is red on 73 of 73 files gates nothing, it only teaches its readers to skip it, which is precisely how 95 violated constraints came to be run, read and ignored (enforcement-vs-emergence, reading of 2026-07-12).

`amendments` is NEVER required. An obligatory amendment log would be ceremony-capture (ADR-029) — the same reason ADR-069's typed warrant is optional. Absent means "not recorded", which is a fact the drift report counts, not a contract breach.

Scope of the horizontal move: an amendment MAY correct assertions of fact, context that has moved, and consequences that no longer follow. It MUST NOT be used to change what was decided, to remove or weaken a constraint's CLAIM, or to alter the ontology_check verdict. Those are frame changes and belong to supersede.

CLAIM AND CHECK ARE DIFFERENT OBJECTS, AND ONLY ONE OF THEM IS THE DECISION. A constraint's `claim` is normative — it says what must hold, and moving it moves the frame. Its `check` is instrumental — it is the apparatus that measures the claim, and an apparatus can simply be broken. Repairing a check so that it measures what its claim already asserted is therefore an amendment, recorded with `fields = ["constraints"]`, NOT a supersede: nothing was decided differently, an instrument was fixed. The guard is that the claim must survive the repair verbatim — if the claim moved, the frame moved, whatever the check does.

The test, stated precisely: if every constraint's CLAIM survives untouched, the frame held.

Constraints

• Hard The `amendments` field MUST remain optional with `default = []`. Making it required would compel an amendment log on every ADR in every consumer project — ceremony-capture (ADR-029), the same failure ADR-069's optional warrant avoids.
• Hard Every recorded amendment MUST carry an ISO date, a non-empty reason, and at least one named field, and every named field MUST be a real top-level ADR field. An amendment log that lies is worse than no log — it claims the history is recorded when it is not.
• Hard The ADR contract MUST retain `superseded_by` alongside `amendments`. Amendment records that a decision's description moved; supersede records that the decision no longer holds. Replacing one with the other collapses two distinct moves into one.
• Soft The count of Accepted ADRs with unrecorded drift MUST be reported by the tooling and MUST NOT fail a build. It is a direction-of-motion signal on a 'Spiral question, not a pass/fail predicate.

Alternatives considered

• Supersede for everything — no new mechanism — rejected: Retires decisions whose operative content is intact. For adr-038 that would discard six typed constraints (build-once, no buildx/QEMU, config-from-resources, smoke gate, anonymous pull, layout mirroring) that are all still true, to correct one sentence about platform scope. The measured evidence is decisive: offered only this exit, the project took it zero times in 77 opportunities.
• Git is the history — change nothing — rejected: This IS the status quo, and its measured result is the two stale ADRs that prompted the question plus 71 more nobody has looked at. Git records that a file changed, not that a decision's description moved or why; no describe query, no check and no consumer project can reach it. It is the exact shape adr-070 names: the record exists and does not participate.
• A required amendment log, gated Hard on unrecorded drift — rejected: Ceremony-capture (ADR-029), and a permanently-red gate. It would fail on 71 of 73 files from the first run, and this project has already documented what happens to a check that is red everywhere: it gets run, read and ignored. It would also make a Hard biconditional out of a 'Spiral question, which ondaod names as a forbidden pattern.
• Build the general phase-transition primitive now (bl-036) — rejected: bl-036's extraction gate forbids it with one realized instance. Abstracting the regime-change primitive from ADR-033 plus one bespoke second case would freeze the form from too few examples — the premature-formalization failure the backlog item exists to prevent. This ADR is deliberately the bespoke second instance the gate asks for, not the extraction.

Anti-patterns

• Amendment as supersede avoidance — Routing a genuine frame change through an amendment because it is cheaper than superseding — editing what was decided, weakening a typed constraint, or flipping the ontology_check verdict while calling it a correction of fact.
• Back-filled amendment log — Bulk-writing amendment entries for historical edits nobody remembers, to make the unrecorded-drift count fall. The number improves and the record becomes fiction.

Related ADRs

ADR-029 · ADR-028 · ADR-038 · ADR-048 · ADR-069 · ADR-070 · ADR-072 · ADR-077