> GATE & TEST CRAFT sub-index — split out of MEMORY.md 2026-08-04 against the read-limit cliff
> (MEMORY.md was 23.3KB against a 24.4KB limit; past it the TAIL IS SILENTLY DROPPED). Entries
> below are VERBATIM, in original order, ZERO dropped — this was a move, not a compaction.
> Read this BEFORE authoring, changing, or running any gate/test/rig: rig construction, gate
> population, filters that read as absent, nextest/cargo traps, shell-pipe verdict traps,
> two-daemon rigs, gh/CI polling. MEMORY.md = rules you obey; this = craft you apply.

## Gate & test craft
- [telemetry that fires only on FAILURE cannot witness a success](telemetry-that-fires-only-on-failure-cannot-witness-a-success.md) ⭐ 2026-09-09 #272 a4 double-serve triage: DISPATCH_EV fires only on non-Served outcomes, so B’s log had grep -c = 0 and the dispatcher generation was unrecorded on the exact path that ran. Second half: a claim mutex is ONE map per PROCESS (spawn-once-per-process), so “impossible within the loop” is not “impossible” — name the lock’s scope (thread/process/node) and ask what a second instance of it does. Say the gap as its own point.
- [a widened wall-clock margin is a longer COIN](a-widened-wall-clock-margin-is-a-longer-coin.md) 2026-09-08 golden r2 a2, the only red in 234: an arm mints --ttl 5s and asserts presence against a reaper ticking every 5s; the send SUCCEEDED (ATTACHED ... ttl 5000ms in its own stderr), the entry was reaped before the read. Its own comment narrates the SAME red at 1s and bumps to 5s on "five seconds cannot expire" — a comment that narrates an earlier flake and a bumped constant is a STANDING BUG REPORT. Widening changes the ODDS, not the SHAPE: take the value from the op's own output, or force the sweep (backdate registered_at_ms).
- [editing a script under a RUNNING bash mangles the live run into vacuous greens](editing-a-script-under-a-running-bash-mangles-the-live-run-into-vacuous-greens.md) ⭐⭐ todlando 2026-09-07 F17: bash reads by byte OFFSET; my arm-D rewrite of twohost-web-xbox.sh landed 2 min into HIS run out of MY gate tree → env prefix read mid-line → nextest launched without SPT_TWO_HOST → five 0.0x s PASSes, zero WEB_SERVE_FOR; invisible (no syntax error), and the editor has no signal anyone executes from the tree. Launcher FREEZES driver + every called script to `.spt/frozen/<sha12>/` and runs the copy; check script mtime vs the run window before bisecting env.
- [uniform 0.00 s PASS incl. the must-skip cell = env never reached the child](uniform-zero-second-pass-including-the-must-skip-cell-is-env-that-never-reached-the-child.md) ⭐⭐ todlando 2026-09-07 F17: all FIVE role-A cells PASS in 0.00 s, role_b (must skip on A) indistinguishable from the rest = SPT_TWO_HOST never reached the child; Summary==1 necessary, never sufficient. Read the must-skip cell, the elapsed of the must-run cells, and the OWNER-side breadcrumb count (`WEB_SERVE_FOR`=0 in b.raw was decisive); put all three in the driver's pair readout.
- [a source read cannot WITNESS an integration cell](a-source-read-cannot-witness-an-integration-cell.md) ⭐⭐ 2026-09-07 F17: the W2 helper cell had NEVER executed green (owner's dispatcher dropped its opening line) while checklist rows read "F1 PASS" from SOURCE READS. An INT cell's source is ONE side of a two-sided contract, so the method is blind by construction to exactly the class INT coverage exists for. Every INT row carries `witness: <raw path>#<Summary line>`; no witness = UNWITNESSED, never PASS.
- [compare at ONE layer — the CRLF meter class](compare-at-one-layer-crlf-meter-class.md) ⭐⭐ 5 instances, 4 agents: a byte comparison whose two sides come from different layers — WORKING TREE (CRLF checkout) vs git's normalized LF blobs, or one meter's output form vs another's — lies, and the mixed comparison is the natural one to write. Instances 1-4 fail toward DAMAGE (false MISMATCH on restore assertions, doyle x4 + todlando x1; phantom gen diffs, deployah x2; sha256sum escaping a backslash path, hertz). ⚠ The 5th (hertz 2026-09-09, rider 6) fails the OTHER way — toward a confident quantified FALSE ASSURANCE ("CRLF-preserving, 1431 -> 1437") about a store that was LF all along, which nobody reopens; and `cat -A` under Git Bash HID the CR on a fully-CRLF file, i.e. measured wrong and landed on the right answer. So a SINGLE-SIDED claim has a layer too: measure the BLOB (`git cat-file blob $(git rev-parse <sha>:<path>)`), never the disk file, and name the layer in the same sentence as the number. Both raw, both normalized, or both content-addressed — never one of each; a meter that cries damage gets disabled as fast as one that never fires.
- [a SUCCESSFUL child swallows its own instrument](a-successful-child-swallows-its-own-instrument.md) ⭐⭐ a harness that PIPES a child's stderr renders it only inside a failure assert, so a probe on the PASSING path returns EMPTY — and three empty sites read as 'those sites never fired', a wrong finding about the mechanism rather than an obviously broken meter. CONDUIT #236 RCA 2026-08-29: 1 of 4 probe sites survived, and the survivor only escaped because an unrelated reap helper eprintln's its child's captured stderr. Write probes to a FILE (append, path from an env var), one composed write_all per line; read the file, not the transcript.
- [mutation proof does not validate a green](mutation-proof-does-not-validate-a-green.md) ⭐⭐ able-to-fail (mutation) and green-is-meaningful (forced, not incidental) are INDEPENDENT properties; both burned in one arc (2026-08-29) — vacuous arms cost the v0.65.0 respin, then the respun leg's Windows green was read_dir enumeration order landing heads over an ambiguity IDENTICAL on both platforms (leg (c) tie: two perches, one pid; NTFS alice-first = lucky pass, ext4 bob-first = red). Every Windows pass of those cells incl. my own gate green was void as evidence. Ask of every mutation-proven cell: could an incidental mechanism (enumeration order, timing, defaults, pool history) green it with the subject broken? Fix = remove the incidental mechanism from the loop, not just the failing side.
- [bare cargo test WEDGES — use nextest](cargo-test-bins-wedges-use-nextest.md) ⭐⭐ IR-55: `cargo test -p spt --bins` hung 24min at 13.5s CPU (BLOCKED — a leaked `findstr .` child reads stdin forever under headless conhost; serial harness stalls every test after it); nextest ran the same 653 in 22.2s. GOLDEN IS NOT EXPOSED (already nextest) — the exposure is ad-hoc triage. Also 652-vs-653 = `adapter_translate_proof_gates_on_commit` refusing without its fixture; prebuild `cargo build -p spt --bin translate_proof_fixture`. See [[a-frontier-names-where-progress-stopped-not-the-cause]].
- [live-agent env reds broker-stop rigs](live-agent-env-reds-broker-stop-rigs.md) ⭐ the runner's identity vars (OWL_SESSION_ID/SPT_AGENT_ID/SPT_ENDPOINT_ID) make the shipped guard refuse a test's daemon-stop — scrub the three in the rig; env-differential on ONE tree beats a base-sha comparison for environment-vs-diff.
- [generous bound is FREE on an early-exit poll](generous-bound-is-free-when-the-poll-exits-early.md) ⭐⭐ tight bound buys no speed, only load flakes; ask per ARM (kill bound ≠ success bound); elapsed wait MUST ride the red — at-budget vs under-budget is the only discriminator between never-happened and still-in-flight.
- [a STRUCTURAL exclusion cannot be mutation-proved](structural-exclusion-cannot-be-mutation-proved.md) ⭐⭐ my per-arm mutation table read as "exactly these reddened, the others held" — but one held green because the path NEVER REACHES the mutated body (redeem writes a level below), so no mutation could ever redden it. Greens in a mutation table come in two kinds and the output cannot tell them apart: could-have-reddened (evidence) vs excluded-by-construction (none). Name which, beside the green; the structural arm guards a future MOVE of the code, not today's predicate.
- [a FRESH pool's missing fixture bin reads as a CODE red](fresh-pool-missing-fixture-bin-reads-as-a-code-red.md) ⭐⭐ `cargo test -p spt --bins` compiles bin targets as TEST HARNESSES into deps/ and never emits `target/debug/translate_proof_fixture.exe`, so `adapter_translate_proof_gates_on_commit` panics in any pool that never ran a full `cargo test -p spt`. Green in my #196 lane, red in my brand-new #172 lane — same command, different POOL HISTORY. Build the fixtures once (`--bin translate_proof_fixture --bin post_step_fixture`); read the panic TEXT, which names the right invocation itself.
- [two background jobs, ONE output path](two-background-jobs-one-output-path.md) ⭐⭐ reused `> $S/172-spt.txt` across two overlapping runs; the later grep read the earlier run's file and printed `EXIT=0` beside `test result: FAILED` — impossible for one cargo, and exactly the shape of a fascinating anomaly worth inventing a mechanism for. Contradictory arithmetic ⇒ suspect the PLUMBING first; one path per invocation.
- [mutate the DEFECT not the trigger](mutate-the-defect-not-the-trigger.md) ⭐⭐ trigger-only mutation vs standing defense measures nothing; only defense-removing survival indicts the test.
- [include_str! does NOT normalize CRLF, a string literal DOES](include-str-does-not-normalize-crlf.md) ⭐⭐ cell compared an `include_str!` artifact against a literal const: green in the AUTHORING tree forever (git normalizes at commit, never re-smudges a working-tree file), red in every fresh checkout on an autocrlf=true box — the golden's own. Windows-only red, Linux green. Prove it with `od` in a fresh worktree (no build). Fix at the FIXTURE EDGE, not `.gitattributes` — an eol pin is the same environmental dependency one layer away. Census `include_str!`; a newline-free needle is immune, `\n\n` parses are not, and `str::lines()` hides the class.
- [expectation derived from the code under test](expectation-derived-from-code-under-test.md) ⭐⭐ table test branched on `took_custody()`, the fn under test ⇒ widening it to admit `Refused` (a real security widening) passed 3/3 GREEN; expectation moved with the predicate. Hard-code the partition as a LITERAL and assert predicate AND write against it. Exhaustive-over-variants and self-referential-in-the-verdict are INDEPENDENT — only the second decides if the test can fail. Compile/coverage/traceable-reqs all exit 0 throughout.
- [a control must mutate EVERY encoding](negative-control-must-mutate-every-encoding.md) ⭐⭐ one-site mutation of a doubly-encoded rule stays GREEN and reads as "guard defended" when it means "this control cannot see the guard"; count the sites first, and tell the gater it took N.
- [a cmdline-scoped builder census is INTERMITTENTLY blind](a-cmdline-scoped-builder-census-is-intermittently-blind.md) ⭐ todlando + hertz 2026-09-08, same hour, both boxes: filtering cargo/rustc by worktree path in CommandLine matched 0 of 3 of MY OWN live builds — one cargo.exe had a BLANK CommandLine, another only the toolchain path. rustc carries the target path, cargo does not, so it fires mid-compile and reads empty seconds later: a guard with a track record is the persuasive kind. Census BOX-WIDE over cargo/rustc/clippy-driver, LABEL it box-wide, refuse on non-empty (which makes a load-window hold mechanical). Every prior "procs-before: []" = "no path match", never "I was alone".
- [pool sweep is BLIND to a System32 victim leak](pool-scoped-sweep-blind-to-system32-leak.md) ⭐⭐ pool 0/0 while `cmd`+`ping` leaked from a withheld kill; reap the victim by COMMAND LINE, never by image name, and report BOTH predicates' counts — either alone is a clean zero on the other's population.
- [rig mechanisms not memory](gate-rig-mechanisms-not-remembered-steps.md) leg 0 = throwaway target; sweep exes before EVERY cargo · [disposal is a rig STEP](gate-target-disposal-is-a-rig-step.md) · [isolated worktree](gate-clean-target-not-incremental.md) · [int via nextest](gate-int-tests-with-nextest-not-bare-cargo-test.md) · [clippy --workspace](ci-clippy-preflight-workspace.md) · [gate vs documented design](gate-against-documented-design.md) · [cross-platform leg](gate-cross-platform-leg.md) ⭐⭐ 3rd hit 2026-08-24: cfg-asymmetric const = dead-code lint on the OTHER OS — a cfg-touching wave's gate needs a cross-OS CLIPPY arm, tests catch nothing (SIGNET golden red).
- [a lost continuation backslash COMPILES and PASSES](a-lost-continuation-backslash-compiles-and-passes.md) ⭐⭐ a Rust literal that loses its trailing `\` bakes source indentation into the RENDERED text; W3: `xtask check` flagged a 14-space run in a diagnostic while clippy BOTH OS, three nextest legs and treqs were green at that same sha. No test asserts a diagnostic's exact rendering, so the class lives in the gap tests deliberately do not cover — an `xtask check` red beside eight greens is the ONE instrument looking at it. Writing tools eat the backslash; verify with `cat -A`, never by trusting the write. ⚠ 2nd face 2026-08-29 (todlando W1): the REPAIR minted `\`+literal-`r`+LF — Rust reads a `\r` ESCAPE + raw newline, compiles, renders broken; verify a repair by BYTE-DIFF against a known-good continuation in the same file, not by re-reading source. Exemption is `spacerun-ok: <token> — <reason>`; a bare marker exempts nothing.
- [a long foreground `sleep` becomes a SHORT background one](a-long-foreground-sleep-becomes-a-short-background-one.md) ⭐⭐ Bash moves any command past its ~120s timeout to the background, so `sleep 590` waits ~2min and you poll 5x more than you intend. Measured 2026-08-28: box clock advanced ~15min across 8+ believed-ten-minute waits. The cost is not wasted turns — it is the FALSE INFERENCE: I called a healthy 13-minute build "compiling over an hour" and went hunting a wedge. Read `date` before calling anything stuck; use Monitor with an until-loop, or just wait for the background task's own completion notification.
- [clippy COMPILES, it never RUNS a test](clippy-compiles-it-does-not-run-tests.md) ⭐⭐ `--all-targets` builds test targets, which is why it feels like coverage; it cannot tell you a test PINNED the string you changed. A DIAGNOSTIC-STRING lane needs the owning crates' nextest leg (or a tree-wide grep of the OLD string, real exits, confirming only emit sites survive). My owlery lane shipped 3 green legs blind to this; doyle closed it at gate. Pick legs by what the EDIT could falsify, never by what a lane of that shape usually runs.
- [behavior → grep tests](behavior-change-grep-tests-not-comments.md) · [shared seam → ALL seam tests](shared-seam-change-run-all-seam-tests.md) · [seam red needs repeat-proof](seam-touched-red-needs-repeat-proof.md) · [main baseline](main-baseline-procedure.md) · [twohost window](twohost-run-window-discipline.md) · [unmergeable PR blocks CI](unmergeable-pr-blocks-ci.md).
- [rebase fidelity = LANE'S own diff](rebase-fidelity-blob-compare-limit.md) ⭐⭐ LIMIT: byte-identity only if main misses your files; else strip `index`/`@@`.
- [textual merge hides semantic composition break](assembly-textual-merge-hides-semantic-composition-break.md) ⭐⭐ 11 picks zero conflicts, fidelity proven, head did NOT compile — refactor lane's helper hoist vs feature lane's pre-hoist cell (E0425×4, #182 v2 assembly); lanes-green + no-conflicts proves nothing about the assembled head — clippy the head before EVERY hand-off, fix = minimal declared stage-only commit in the landed idiom.
- [a census must be cfg(test)-AWARE](population-census-must-be-cfg-test-aware.md) ⭐⭐ grep cannot see `#[cfg(test)]`, so a call-site list mixes prod and test and still reads as an enumeration. releases#57: the filed issue, the JIT plan AND my own carried-forward wake note all named `cli.rs:24084` as a prod mutation site — it is inside `mod tests` (22522..35192), and the real population held a site none of the three listed. A list someone ALREADY re-located feels more verified than a fresh grep and was derived by the same blind method. Compute the cfg(test) regions, classify every hit, and ship the count WITH its definition.
- [truncated grep = wrong POPULATION](truncated-grep-read-as-the-population.md) ⭐⭐ `| head -N` on a sweep SILENTLY sets scope; count first, list untruncated, classify every survivor — cost me a missed rename site.
- [census pattern encodes an assumption](string-census-pattern-encodes-an-assumption.md) ⭐⭐ two faces measured (w1t3): line-continuation split the token across lines (rg -U is the population check), and a `token+subcommand` pattern was blind to rendered BARE-form sites; run a looser sibling probe — the count DELTA is what the census missed. Only surfaced because negative assertions were repinned too.
- [count the string you REPLACE](scripted-edit-zero-match-refusal.md) ⭐⭐ ASCII-only anchors · [restore presumes a baseline](restore-step-presumes-committed-baseline.md) `git checkout --` DELETES uncommitted work · [correct fix deletes mitigation](correct-fix-deletes-accidental-mitigation.md).
- Real-harness escapes — [mock-gating escape](v0121-realharness-reopen.md) ⭐⭐ green on mocks + in-proc reconcile, broken in the real harness · [source-read PASS refuted](v013-forkpty-groundtruth.md) code-gate PASS ≠ integration; Linux forkpty RED.
- [consumer tally needs a PRODUCER control](consumer-tally-needs-a-producer-side-control.md) ⭐⭐ frozen counter = theft ONLY IF the producer kept producing; three-way verdict, PRECONDITION is not evidence · [probe before TEARDOWN](probe-before-teardown-not-at-assert.md) ⭐⭐ teardown-then-assert makes an assert-time probe read the rig's own cleanup · [instrument OUTPUT must outlive its subject](instrument-output-must-outlive-its-subject.md) ⭐⭐ sibling face: sink derived from the root the subject resolves sat INSIDE the rig's TempDir; the drop ate record+sink 29ms before the dump step, and the emptiness reads "no child wrote" when the truth is "reaped before read". A surviving ONE-line file is evidence of DELETION, not a small population. · [lane check via main pool](lane-check-via-main-pool-prebuilt-xtask.md) ~30s not a cold build; claim with the BUILT xtask.exe from the lane's cwd.
- [non-vacuity can fail for the DEFECT's reason](non-vacuity-check-can-fail-for-the-defects-reason.md) ⭐⭐ collect it into the verdict; asserted up front a defect reads as a broken rig · [local IPC subscribe: by=None](local-ipc-subscribe-carries-no-origin.md) invented origin refused structurally, looks like seat contention.
- [discriminator question](discriminator-question.md) ⭐⭐ 9 instances; newest = auditing a PEER’s one-command discriminator: if ONLY the failing path emits the string you grep, its absence from a green run is a TAUTOLOGY, not a measurement — ask which code path EMITS it before running the test, and settle at SOURCE (the fixture) instead of in logs · [external observable](outcome-discriminates-what-instrument-cannot.md) · [refuse mechanism first](refuse-mechanism-until-something-discriminates.md) · [instrument soundness](instrument-soundness-guards.md).
- [a louder red hides a quieter one](a-louder-red-hides-a-quieter-one.md) ⭐ todlando 2026-09-08: four golden cells were red for TWO reasons — my new doubled-`type` defect AND a literal envelope expectation predating W2 msg-id; fixing the loud one left them red, and only the FAILURE TEXT changing proved the fix (BEFORE `type="msg" type="msg"` vs AFTER single, same cell/invocation, peer-measured on another box at the pre-fix sha). State acceptance as the text changing, never as the cell passing. An exact-equality assert over a CONTENT-DERIVED value (digest id) is unmaintainable by construction: repin the SHAPE, not the value.
- [is this red MINE](is-this-red-mine-delta-test.md) ⭐⭐ 2nd face: THE RED THAT CONFIRMS YOUR HYPOTHESIS needs the delta test most and gets it least. My rig died reproducing the frozen HFENDULEAM signature EXACTLY (spool.db + untaken briefing + no info.json) on a tree lacking the #199 fix — every element corroborating; I was drafting "candidate (a) confirmed". Running the DONOR rig unchanged on the same tree took 4s and passed 1/1: the red was MINE (my manifest declared a translation binary, widening a race the donor never runs). A contradicting red gets audited automatically; a flattering one gets REPORTED — the tell is excitement, not doubt. Control on the SAME tree BEFORE reporting.
- [failed JOB ≠ test victim](failed-job-is-not-a-test-victim.md) ⭐⭐ 12 failed jobs = 3 real victims; all-pass nextest summary ⇒ read the STEPS api, cross-platform repeat ⇒ code red not victim; rerun behaviour PER SHA; compare SIGNATURES not counts.
- [assert string ≠ signature identity](assert-string-identity-must-include-the-predicate-subject.md) ⭐⭐ two "exact repeats" were pre-fix + post-fix mechanisms; the "respelling" WAS the fix — diff the predicate's SUBJECT chain, not the message · [empty TaskList ≠ dead task](empty-tasklist-is-not-a-dead-background-task.md) ⭐⭐ still-running poller invisible after /clear; re-arming doubled a MUTATING holder — near attempt-4 double-fire.
- [carried jobs inflate attempt rows](rerun-carried-jobs-dedupe-executions.md) ⭐⭐ partial rerun COPIES untouched jobs into the new attempt with ORIGINAL started_at; a carried failure = the SAME observation. Rate math dedupes on (run, box, started_at).
- [census COUNT is noise](process-census-count-is-noise.md) ⭐⭐ 23/17/15 in 90s (digest polls); trend the PATH classification.
- [dispatch-window legs must name the GOLDEN BOX](dispatch-window-legs-must-name-the-golden-box.md) ⭐⭐ filled a golden's wait with my own gate legs ON the golden's Windows box; a TOTP cell stretched 17x, its gate's 1s backoff refused a valid code — the run's only red, manufactured by me. Ask WHERE the awaited run executes before firing anything heavy; the "now-quiet box" step name was the contract.
- [pre-fire check reads the DISK FLOOR](prefire-check-reads-the-disk-floor.md) ⭐⭐ process census is blind to a FINISHED build's dir; golden died at the 32 GiB preflight, zero test signal. ⚠ one floor reading = SNAPSHOT: C: swung 45 GB in 24min untouched — reclaim past the SWING, not past one sample. ⚠ 4th face 2026-08-24: budget in POOLS not GB — a full-sweep pool WEIGHS ~90-112GB steady state (3 specimens), cleaning a live pool buys one window at rebuild price; LNK1180/LNK1318 at the floor = the disk's red, never the diff's (IR-59).
- [pre-register the STATISTIC, not just the prediction](pre-register-the-statistic-not-just-the-prediction.md) ⭐⭐ even-N median is a CONVENTION wearing a statistic's authority: ten 1s + ten 3s gives lower=1 FALSIFIED, upper=3 SURVIVES, avg=2 SURVIVES — same data, three verdicts. Register the conservative arm before the capture; file the RAW VECTOR + histogram so the convention is not load-bearing. Sibling: negative-control the extractor on a KNOWN truth vector (a plural-only regex dropped every singular `1 ppid match`, 5 of 20, and would have CONFIRMED the prediction).
- [a battery is SILENT about arms no cell drives](a-battery-is-silent-about-arms-no-cell-drives.md) ⭐⭐ a claim that ENUMERATES is a test plan: "all six kinds", "every surface", "both directions". My own W3 asserted all six IO kinds visible in the REQ title + 3 published docs; COMMUNE/COMMUNE_FAIL were STRUCTURALLY impossible (their only publisher hand-builds IoBus::new() with one sink instead of default_bus). The e2e drove 2 kinds and was VACUOUS on exactly the 2 broken ones; the units synthesized rows and never traversed the publish path where the defect lives; TREQS WAS GREEN ON TAGS, NOT TRUTH. Four green legs + a gate PASS + my own parity check, all blind — a census for an UNRELATED lane found it. Count the claim's arms, count the cells driving them, name uncovered arms BY NAME. A test that cannot fail is worse than a missing one, because a missing one is visibly missing.
- [env-gated row returns a VACUOUS 0.00s green](env-gated-test-returns-vacuous-green.md) ⭐⭐ `published_release_verifies_against_embedded_anchor` gated on `SPT_RELEASE_E2E`; unset ⇒ body never runs, PASS in ~0.00s, run summary identical to a real one. READ THE DURATION, NOT THE COLOR — a green too fast to have done the work is a skip. ⚠ testimony (deployah via doyle, v0.54.0 cut), unreproduced by me.
- [cargo test --tests STOPS at the first failing binary](cargo-test-tests-stops-at-first-failing-binary.md) ⭐⭐ every suite after the failure silently never runs — a "clean" rerun is evidence about the PREFIX; --no-fail-fast for any sweep claiming suite-wide coverage — on cargo AND on nextest; CORRECTED 2026-09-06: nextest is NOT exempt (defaults to max-fail=1); this line used to say it was and I acted on it — 165 unrun, one of them a test binary that never COMPILED. Read the RUN COUNT (1074/1239), never the pass count. Rider: xtask-gen regen drift must be measured by `git diff`, never porcelain — autocrlf leaves regenerated files M on EOL alone (measured both, 2026-08-19 W3). Also that day: the "never run daemon --lib on this box" rule REFUTED 3/3 — see the updated entry, mechanism kept.
- Filters reading as absent — [positive control](zero-match-filter-reads-as-absent.md) · [nextest matches names](nextest-zero-match-filter-trap.md) · ["1 test run"](nextest-singular-summary-parse.md) · [absence proxy](absence-proxy-breaks-when-success-writes.md).
- [a positive control must CROSS the boundary the guard faces](a-positive-control-must-cross-the-boundary-the-guard-faces.md) ⭐⭐ hertz 2026-09-08: 15/15 green controls shipped a holders guard blind to the one process class it existed to catch — WMI blanks `ExecutablePath`/`CommandLine` for a process you cannot open (219/632 box-wide, all session 0, where the runner's builds live), so EMPTY read as "no holders". Every control had been injected in MY OWN session, proving the predicate can MATCH, never that it can SEE. "Every guard needs a positive control" is necessary and NOT sufficient: name the boundary (security context, machine, user, process tree, encoding) and check whether any control instance was born on the FAR side; if none was, the suite proves firing, not seeing. Far side uncheap to construct ⇒ env seam + injected far-side data + a THREE-VALUED guard so the unreadable case has its own name. Scope it before reporting: this bit an agent census, NOT core.
- [hand-built walk ≠ enum pin](hand-built-walk-is-not-an-enum-pin.md) ⭐⭐ array + `len` assert stay trivially true when a variant is added; only a wildcard-free match at the PROD sites compiles red. Kin: a predicate parsing half an address re-opens the ruling the other half carries.
- [panic MESSAGE is pre-authored](panic-message-is-preauthored-not-a-finding.md) ⭐⭐ names ONE mechanism whatever fired; read the gate line's numbers — a deficit PREDATING the window can't be caused inside it; immunity that's only a comment can't discriminate.
- [assert GATES on status, PRINTS stderr](assert-gates-exit-status-but-prints-stderr.md) ⭐⭐ condition and message read different channels ⇒ log is MUTE on cause; `status.code()` 101-vs-1 lost, stdout invisible; a warn-only line above the panic is not thereby causal.
- [test NAME asserts what the FIXTURE never creates](test-name-asserts-what-fixture-never-creates.md) ⭐⭐ gate not fooled, READER is; `std::process::id()` can never build an identity mismatch — read the fixture, never the name. 2nd face: the seeding HELPER decides it and the comment cannot show you — `allow_surfaces` sets modes CLOSED when the MODES table is empty (`access.rs:1711` reads `acl.modes.is_empty()` — the posture table, NOT the surfaces arg; that unnamed "empty" seeded a twice-carried misread, 2026-08-18), so two arms of one rung ran the same verb and diverged; state an arm's requirements TOGETHER to catch a structurally impossible one (needs Closed and Open at once ⇒ green nowhere ⇒ 1/1 is honest, rerun buys nothing); subject-matter adjacency ≠ causal proximity.
- Coverage gaps — [uniform-table](uniform-table-blindness-sweep.md) · [every return arm](every-return-arm-is-a-copy.md) · [setup suppresses the arm](setup-suppresses-failing-arm.md) · [wrong population](gate-population-excludes-consumers.md) · [miss the CALLERS](gate-population-covers-consumers.md).
- [a PRESENCE control needs the FAULT's population](presence-control-scoped-to-the-faults-population.md) ⭐⭐ walked the whole doc asserting the set CONTAINS the verb — the artifact's own PREAMBLE prescribes it too, so the arm was green over the exact silent defect it was written for. Count the token's occurrences in what you feed the walk; >1 ⇒ narrow to the slice where the fault can live. Negative arm must ALSO yield a healthy sibling token, proving the walk ran.
- [a literal count floor is a FOSSIL](literal-count-floor-is-a-fossil-of-the-old-subject.md) ⭐⭐ `checked.len() >= 3` encoded how BIG the subject was, not that the instrument saw anything; a ruled partition shrank the briefing to one command and the cell reddened a correct change. Re-derive the count by a route the instrument does not take (count its own split token) and assert `==` plus `> 0`.
- [pipefail masks/fabricates](render-not-read-pipefail.md) · [exit after a pipe is TAIL's](exit-code-after-a-pipe-is-the-tails.md) ⭐⭐ tail also hid a test section; both print GREEN · [SIGPIPE 141](shell-bash-adds-pipefail-sigpipe.md) · [seed descent from dead parent](seed-descent-from-dead-parent.md) · [torn window reachability](torn-window-needs-reachability.md) · [reap duration ≠ window](reap-step-duration-is-not-the-window.md) · [husk reads as default](husk-reads-as-default-defeats-durability.md) · [stale-snapshot proxy](stale-snapshot-equality-proxy.md) · [tick granularity](pair-test-tick-granularity.md) · [fixture ripple](liveness-aware-derivation-fixture-ripple.md) · [a2 r2 specimens](a2-golden-r2-specimens.md).
- [two-daemon one-box](two-daemon-one-box-rig.md) · [isolated home/socket](isolated-home-isolates-broker-socket.md) · [perched gate strips agent env](perched-gate-run-strips-agent-env.md) OWL_SESSION_ID → DAEMON_STOP_REFUSED · [resident-broker repro](isolated-resident-broker-field-repro.md) · [daemon lib CAN wedge — prohibition REFUTED, race stands](daemon-lib-tests-deadlock-on-live-host.md) ⭐ 857/857 clean 2026-08-19; keep the cdb recipe · [--tests fail-fast HIDES THE TAIL](cargo-tests-failfast-hides-the-tail.md) ⭐⭐ sweep halts at the first failing BINARY, later suites never run and the log just ends; a precondition red reads like a product red · [verification gates](spt-verification-gates.md) · [alarm every run](alarm-every-test-run.md) · [delegate to spt-test-engineer](delegate-tests-to-spt-test-engineer.md) · [subagent stalls](test-subagent-stalls-on-hanging-test.md).
- [include_str! fixture inherits checkout EOL](include-str-fixture-inherits-checkout-eol.md) ⭐⭐ autocrlf=true smudges FRESH checkouts CRLF while the author's never-re-smudged tree stays LF — builder green 637/637, every fresh rig/golden checkout red (split_once("\n\n") vs \r\n\r\n, W3 gate 2026-08-19); normalize at the fixture edge or pin eol in .gitattributes; the gate running from a fresh checkout is what catches the class at all.
- [cargo builds pkg bins for int tests](cargo-builds-package-bins-for-integration-tests.md) ⭐⭐ same-package fixtures ALREADY guaranteed; env! adds NO edge — gap is cross-package + UNIT tests; bindeps needs nightly, nextest needs the config form.
- [cargo test --bins never EMITS fixture exes](cargo-test-bins-never-emits-fixture-exes.md) ⭐⭐⭐ RECURRED 2026-08-29 on the entry's own author, WITH the entry written: prebuilt `-p spt --bins` from RECALL and ate three fixture reds in a row (mock-session, capture-player, mock-shell), each a ~0.01s panic that reads as a test failure. TWO NEW FACES: the fixture may live in ANOTHER PACKAGE (`-p mock-adapter --bins` — build the whole package, never a hand-list), and ENUMERATING FIXTURES BY GREPPING their pre-build strings is structurally incomplete because `sibling_bin`/`fixture_package(name)` COMPOSES the command at runtime, so no literal exists to grep. Original entry: --bins compiles [[bin]]s as test harnesses into deps/, no target/debug/<fixture>.exe — cell shelling to the exe reds in a FRESH pool, green wherever a normal build ever ran (pool HISTORY, not the tree); prebuild fixture bins before any bins/filtered leg in a cold pool (todlando #172 lane + doyle #199 gate, 2026-08-21). ⚠ 3rd recurrence same day as the 2nd, on the GATER with the entry re-read that morning (W1 #235): a FULL `-p spt-daemon` nextest in a cold pool hits it too — reading the entry does not apply it; the prebuild leg lives IN the driver template now.
- [check verifies COVERAGE, never PLACEMENT](traceable-check-cannot-verify-tag-placement.md) ⭐⭐ 57 unit tags on one REQ ⇒ your site cannot turn it red; EXIT=0 both with the tag separated from its evidence and after the fix. Green means coverage satisfied, NOT tags correct — read the site. Inserting a const/helper near a tagged item is the recurring way adjacency breaks.
- [grep REQ tags](grep-req-tags-to-find-impl.md) · [per-wave activation](traceable-per-wave-activation.md) · [seed leaks](experimplate-traceable-seed-leaks.md) · [CI install cache](traceable-reqs-ci-install-cache.md) ⭐⭐ `TRACEABLE_REQS_TOKEN` is DEAD CODE · [spt is binary-only](spt-crate-is-binary-only-no-lib.md) use `--bins` · [never cargo fmt](no-cargo-fmt-in-spt-core.md).
- [empty TaskList ≠ dead task](empty-tasklist-is-not-a-dead-background-task.md) ⭐⭐ poller SURVIVED a clear invisibly; re-arming put two `rerun --failed` holders on one run — only the API's green-contingent refusal stopped a 4th attempt. Read the prior `.output` before re-arming anything that MUTATES.
- [check branch](check-branch-before-commit-shared-checkout.md) · [no add -A](no-git-add-a-shared-checkout.md) · [no reset --hard](no-reset-hard-with-uncommitted-work.md) · [worktrees under root](worktrees-under-project-root.md) · [audit watchers](audit-live-watchers-before-rearming.md) survive /clear · [quiet window](quiet-window-predicate.md) gh-only is blind to local builds.
- [two FAIL lines are ONE observation](nextest-duplicate-fail-line-is-one-observation.md) ⭐⭐ nextest prints a failure in the live stream AND the final summary; identical elapsed + identical ordinal reads as a deterministic RETRY confirming the diagnosis. Count `panicked at`, never FAIL lines, and grep `retr` in the nextest config AND the workflow at the measured sha before calling anything deterministic. Handed to me as a peer supporting-fact, 2026-08-20 golden; the flattering read is the one nobody audits.
- [gh run status freezes](gh-run-status-field-freezes.md) + [poll --json jobs](gh-run-poll-jobs-not-status.md) ⭐⭐ VIEW: `--json jobs` never `status`; ⚠ LIST REJECTS `jobs` · [gh refuses RUN-SCOPED mid-run](gh-job-log-refuses-while-run-in-progress.md) ⭐⭐ 2 faces. `--log`: exit 1 even for a COMPLETED job; `2>/dev/null` turns it into a clean zero reading as "no failures" — use `gh api repos/O/R/actions/jobs/<id>/logs`. 2nd face 2026-08-28 (deployah, CONDUIT 33223968222): `rerun --failed` ALSO refuses in flight, and fails toward a FALSE DIAGNOSIS not a false green — it reads as a rerun/permissions problem when it is purely timing. The red is visible long before the run is rerunnable; that gap IS the trap. Confirm terminal via `--json status` first · [gh --jq works with NO jq on the box](gh-builtin-jq-masks-missing-shell-jq.md) ⭐⭐ built-in engine masks a missing jq.exe — a bare `| jq` monitor dies silently on every poll while every gh sanity-check succeeds; instruments must emit a first-cycle ARMED line before their silence means anything (deployah testimony 2026-08-24, 84 dead polls) · [gh api leading slash](gh-api-leading-slash-msys-rewrite.md) · [bg cd-relative](background-cd-relative-trap.md).
- [pool refusal's TAIL reads as a release confirmation](pool-refusal-tail-reads-as-release-confirmation.md) ⭐ `tail -2` on a pool verb returns the releases#103 rationale blurb — the LAST line of the REFUSAL — which reads like success; 4/4 failed releases looked like confirmations (todlando testimony 2026-08-21). Judge pool verbs by the verdict token up top, never the tail.
- [the FIRST claim on a foreign pool must refuse](the-first-claim-on-a-foreign-pool-must-refuse.md) todlando 2026-09-08 W3: `cargo run -p xtask -- pool-claim` builds THROUGH the pool it is claiming, so a released foreign pool refuses SPT_POOL_FOREIGN on the first leg by construction — hatch that ONE leg (the refusal says so), never the battery; release leaves ownership recorded as YOUR tree, so the next agent hits it too. Second half: a clean guard pass is SILENT, and only `build/<pkg>-<hash>/invoked.timestamp` + `output` separate ran-and-passed from never-ran — last invocation per UNIT, overwritten, so it time-excludes an agent but cannot reconstruct a past run.
- [pool-claim WRITES a record, the BUILD enforces it](pool-claim-writes-a-record-the-BUILD-enforces.md) ⭐⭐ `pool_claim` never reads the incumbent (main.rs:2232-2294, unconditional `write_owner`, base only RECORDED) — last-writer-wins, no notice either side. Refuse/Takeover/Unproven/HatchOpen all live in `spt-store/build.rs:31-113`. I predicted a REFUSAL to a gater mid-run from AGENTS.md prose; the file refuted me in one read. Never predict a tool's refusal from prose — read the record AND the code path.
- [the CONDITION reproduced, the RACE did not](condition-reproduced-race-did-not.md) ⭐⭐ an end-to-end green after a race fix can be VACUOUS — the fixed path never ran, so the green is evidence about the LADDER, not the fix. Register the non-reproduction arm BEFORE the run so the vacuous case has a name to land in, and report which ARM fired, not the color. Instrument split the two: condition 2/2 runs, collision 1/2. Offer a DETERMINISTIC rig, never a re-fire against a 1-of-2 rate.
- [duplicate work's population is PROCESSES, not code paths](duplicate-work-population-is-PROCESSES-not-code-paths.md) ⭐⭐ a per-process claim cannot exclude a SIBLING process; count distinct pids emitting the event before theorizing re-entrancy. Measured: one stream served by a livehost `spt` and the test-hosted daemon 21 ms apart, loser's refusal beat the winner's grant by 88 ms. Riders: score your predicted ARM honestly (I named consume-time, the claim-time one fired), and report the SILENT families beside the loud one — they took the same doubling and said nothing.