A Line of Documentation Was Acting as a Global Config Flag

I spent a morning hunting for a setting that did not exist. A while back I turned off Claude's co-authorship trailer in my commits — a deliberate choice at the time. Last week I decided I wanted it back. So I went looking for the switch I'd flipped. ~/.claude/settings.json: no key. settings.local.json: no key. ~/.claude.json, parsed as JSON, top-level plus all 38 project entries: no key. The 27 .claude/settings*.json files scattered across my two working drives: no key. Every CLAUDE.md and AGENTS.md I own: no mentions. Environment variables: nothing. A final sweep of my entire user directory — every *.json and *.md — returned three raw hits: a changelog and two copies of an editor extension's JSON schema. The note I wrote when that finished was two words: "Cero hits reales." Zero real hits. There was exactly one thing anywhere on disk that turned attribution off, and it was a sentence: ~/.claude/rules/ecc/common/git-workflow.md:12 Note: Attribution disabled globally via ~/.claude/settings.json. It had a Chinese twin, same file path with zh/ instead of common/, same line 12. Both files are rules files. Rules files get loaded into every session. So every session opened with a line of documentation asserting, flatly and falsely, that a global setting was off — and the model behaved accordingly. The switch I remembered flipping never existed as a switch. The prose was the switch. The key that sentence gestured at, includeCoAuthoredBy, is deprecated and replaced by attribution. Neither is present in any of my configs, which means the default was active the whole time. The feature was on. Only the description of the world said otherwise, and the description won. The thesis Here's what I take from that, and from two more receipts this week: in an agent system, prose and constants are not documentation about the control plane. They are the control plane. I run a personal multi-agent system on top of Claude Code — 19 specialized agents, root-driven, single-writer, coordinating through on-disk artifacts; a sanitized snapshot is public at multiagent-system-lex. Around it sits a set of always-loaded rules files, and a separate document-generation script I run locally that feeds an LLM a system prompt full of hand-written constraints. Both of those are, in the strict sense, configuration. Neither is stored anywhere a linter, a schema, or a test would ever look at it. That's the mechanism. A rules file is loaded unconditionally into every session, so a claim inside it has the reach of a global setting with none of the accountability: no schema, no type, no default, no git blame if the directory isn't a repo, nothing downstream that notices it disagrees with reality. The model doesn't verify the claim against the system, because from inside the loop the claim is the system. The constant that outlived its own source Second receipt, same week, different shape. In that document-generation script, the system prompt carried a block of figures marked FROZEN — meaning: reproduce exactly, never paraphrase, never invent. One of them was a subscriber count, hardcoded as a literal in the prompt string. It was wrong: 617K, when the real figure is 577K. The interesting part is the ordering: When Commit What 2026-08-10 14:04:31 fc580b2 removes the frozen 617K from the system prompt 2026-08-10 21:28:35 69e0499 corrects one remaining profile document, 617.000 → 577.000 2026-08-14 11:02:19 102f63e a generated artifact is still emitting 617K, in three separate places The structured sources were already right. The commit message for 69e0499 says so in as many words: "la cifra canonica es ~577.000" — the canonical figure is ~577,000 — and names the two source files that already held it. The only thing carrying 617K was a literal sitting inside a prose instruction, wearing the word FROZEN. And FROZEN is exactly why it won. That annotation exists to stop the model from softening or improvising a number. It did its job perfectly — on the wrong value. A freeze marker is authority, and I had handed authority to a copy instead of a source. The fix was one line in the doc comment and one in the prompt rule: the count is no longer hardcoded there at all, it comes from the profile facts or it doesn't appear. Four days later I found the stale value still sitting in a generated artifact downstream, because generated output doesn't retroactively fix itself when you fix its generator. The mirror: a prose rule that held I want to be fair to prose, because one of my prose rules worked, and why it worked is the whole point. When I wrote the first article, the brief asked for a specific external citation — a multi-agent failure taxonomy, with two percentages attached. It also carried a standing rule: use only data present in a specific on-disk notes file, with its source; anything unsourced doesn't go in. The figures weren't in that file. The plan recorded the refusal explicitly — "NO está en el fichero → NO se usa", not in the file, so it isn't used — and moved the citation to a forbidden list. The published piece contains zero references to it. That rule held where the attribution note failed, and the difference isn't discipline. It's that "is this string present in that file?" is a question with a mechanical answer. The rule wasn't asking anyone to be careful; it was asking a question I could go check, and the check was cheap enough to actually run. Prose that resolves to a disk lookup behaves like code. Prose that asserts a fact about the world behaves like a lie waiting to be believed. Fixing the prose is not enough Fourth receipt, and it's the one that connects back. In that same document-generation script, the model kept inverting a claim from the first article — writing that "nine unauthorized writes were blocked", when what was blocked were nine tool-calls and unauthorized writes were zero. Same numbers, reversed meaning, and the reversed version reads better, which is precisely the problem. I fixed the wording at the source. The commit records what happened next, with one noun swapped for anonymity: "Fixing the source cut this from 4 generated documents to 1; the model still paraphrased its way back, so it needed a hard stop." The hard stop was a denylist on the inverted phrasing, with tests in both directions so the correct claim stays legal. Four to one, not four to zero. A sibling change the same day says it from another angle: a gold example meant to fix the output's register was already in the prompt and didn't prevent the failure — "the lever is explicit rules plus a mechanical constraint, not more example." The first article argued that if a boundary matters, it has to live in the substrate the agent can't reason its way around — the tool-call layer, not prose the model weighs against its objective. That enforcement layer is packaged as loopward. This piece is the other half: the prose is substrate. Just substrate with no type checker, no default, and no test. It needs the same treatment — single-sourced values, mechanical checks, provenance — and when it can't get it, a hard stop downstream. Limits Four incidents, one operator, one system, one week. That's an anecdote with receipts, not evidence of a law. Everything above is reconstructed from commits and session transcripts I can point at, and quoted rather than paraphrased, but there's no control group here and no idea how any of it generalizes to a system that isn't mine. The sharpest limit is in the first story. I can't tell you when that note was introduced, because ~/.claude is not a git repository — git rev-parse there returns "fatal: not a git repository", and the trail ends there. A line of text stood in for a config flag and I can't date it, so the audit stops at "undated". I'd rather say that plainly than round it to a date. What I'd do differently Put ~/.claude under version control, first thing — the rules directory is configuration with production effects and it deserves a history. Single-source every constant that appears in a prompt; if a figure lives in a YAML file, the prompt gets a reference, never a copy, and FROZEN marks the rule, never the value. Write prose rules that resolve to a disk lookup wherever the choice exists, because those are the ones that survive contact with a loop. And treat a fix at the source as step one of two: generated artifacts don't self-heal, so something has to go find the stale copies. The uncomfortable version: I've been writing configuration in English and grading it as documentation. It was never documentation. It ran.