> GATE & TEST CRAFT sub-index — split out of MEMORY.md 2026-08-04 against the read-limit cliff > (MEMORY.md was 23.3KB against a 24.4KB limit; past it the TAIL IS SILENTLY DROPPED). Entries > below are VERBATIM, in original order, ZERO dropped — this was a move, not a compaction. > Read this BEFORE authoring, changing, or running any gate/test/rig: rig construction, gate > population, filters that read as absent, nextest/cargo traps, shell-pipe verdict traps, > two-daemon rigs, gh/CI polling. MEMORY.md = rules you obey; this = craft you apply. ## Gate & test craft - [telemetry that fires only on FAILURE cannot witness a success](telemetry-that-fires-only-on-failure-cannot-witness-a-success.md) ⭐ 2026-09-09 #272 a4 double-serve triage: DISPATCH_EV fires only on non-Served outcomes, so B’s log had grep -c = 0 and the dispatcher generation was unrecorded on the exact path that ran. Second half: a claim mutex is ONE map per PROCESS (spawn-once-per-process), so “impossible within the loop” is not “impossible” — name the lock’s scope (thread/process/node) and ask what a second instance of it does. Say the gap as its own point. - [a widened wall-clock margin is a longer COIN](a-widened-wall-clock-margin-is-a-longer-coin.md) 2026-09-08 golden r2 a2, the only red in 234: an arm mints --ttl 5s and asserts presence against a reaper ticking every 5s; the send SUCCEEDED (ATTACHED ... ttl 5000ms in its own stderr), the entry was reaped before the read. Its own comment narrates the SAME red at 1s and bumps to 5s on "five seconds cannot expire" — a comment that narrates an earlier flake and a bumped constant is a STANDING BUG REPORT. Widening changes the ODDS, not the SHAPE: take the value from the op's own output, or force the sweep (backdate registered_at_ms). - [editing a script under a RUNNING bash mangles the live run into vacuous greens](editing-a-script-under-a-running-bash-mangles-the-live-run-into-vacuous-greens.md) ⭐⭐ todlando 2026-09-07 F17: bash reads by byte OFFSET; my arm-D rewrite of twohost-web-xbox.sh landed 2 min into HIS run out of MY gate tree → env prefix read mid-line → nextest launched without SPT_TWO_HOST → five 0.0x s PASSes, zero WEB_SERVE_FOR; invisible (no syntax error), and the editor has no signal anyone executes from the tree. Launcher FREEZES driver + every called script to `.spt/frozen//` and runs the copy; check script mtime vs the run window before bisecting env. - [uniform 0.00 s PASS incl. the must-skip cell = env never reached the child](uniform-zero-second-pass-including-the-must-skip-cell-is-env-that-never-reached-the-child.md) ⭐⭐ todlando 2026-09-07 F17: all FIVE role-A cells PASS in 0.00 s, role_b (must skip on A) indistinguishable from the rest = SPT_TWO_HOST never reached the child; Summary==1 necessary, never sufficient. Read the must-skip cell, the elapsed of the must-run cells, and the OWNER-side breadcrumb count (`WEB_SERVE_FOR`=0 in b.raw was decisive); put all three in the driver's pair readout. - [a source read cannot WITNESS an integration cell](a-source-read-cannot-witness-an-integration-cell.md) ⭐⭐ 2026-09-07 F17: the W2 helper cell had NEVER executed green (owner's dispatcher dropped its opening line) while checklist rows read "F1 PASS" from SOURCE READS. An INT cell's source is ONE side of a two-sided contract, so the method is blind by construction to exactly the class INT coverage exists for. Every INT row carries `witness: #`; no witness = UNWITNESSED, never PASS. - [compare at ONE layer — the CRLF meter class](compare-at-one-layer-crlf-meter-class.md) ⭐⭐ multi-instance, 4 agents (count UNSTATED — it went stale at 4, then at 5): a byte comparison whose two sides come from different layers — WORKING TREE (CRLF checkout) vs git's normalized LF blobs, or one meter's output form vs another's — lies, and the mixed comparison is the natural one to write. Instances 1-4 fail toward DAMAGE (false MISMATCH on restore assertions, doyle x4 + todlando x1; phantom gen diffs, deployah x2; sha256sum escaping a backslash path, hertz). ⚠ One (hertz 2026-09-09, rider 6) fails the OTHER way — toward a confident quantified FALSE ASSURANCE ("CRLF-preserving, 1431 -> 1437") about a store that was LF all along, which nobody reopens; and `cat -A` under Git Bash HID the CR on a fully-CRLF file, i.e. measured wrong and landed on the right answer. So a SINGLE-SIDED claim has a layer too: measure the BLOB (`git cat-file blob $(git rev-parse :)`), never the disk file, and name the layer in the same sentence as the number. Both raw, both normalized, or both content-addressed — never one of each; a meter that cries damage gets disabled as fast as one that never fires. ⚠ SECOND AXIS (deployah 2026-09-10): two sides from the SAME READ is a tautology — it cannot fail, so it lies toward false ASSURANCE (silent, never reopened). Make the sides SOURCE-INDEPENDENT (pre-write measurement vs post-write read); ask what would make the assert FAIL, and if nothing would it is decoration. - [a SUCCESSFUL child swallows its own instrument](a-successful-child-swallows-its-own-instrument.md) ⭐⭐ a harness that PIPES a child's stderr renders it only inside a failure assert, so a probe on the PASSING path returns EMPTY — and three empty sites read as 'those sites never fired', a wrong finding about the mechanism rather than an obviously broken meter. CONDUIT #236 RCA 2026-08-29: 1 of 4 probe sites survived, and the survivor only escaped because an unrelated reap helper eprintln's its child's captured stderr. Write probes to a FILE (append, path from an env var), one composed write_all per line; read the file, not the transcript. - [mutation proof does not validate a green](mutation-proof-does-not-validate-a-green.md) ⭐⭐ able-to-fail (mutation) and green-is-meaningful (forced, not incidental) are INDEPENDENT properties; both burned in one arc (2026-08-29) — vacuous arms cost the v0.65.0 respin, then the respun leg's Windows green was read_dir enumeration order landing heads over an ambiguity IDENTICAL on both platforms (leg (c) tie: two perches, one pid; NTFS alice-first = lucky pass, ext4 bob-first = red). Every Windows pass of those cells incl. my own gate green was void as evidence. Ask of every mutation-proven cell: could an incidental mechanism (enumeration order, timing, defaults, pool history) green it with the subject broken? Fix = remove the incidental mechanism from the loop, not just the failing side. - [bare cargo test WEDGES — use nextest](cargo-test-bins-wedges-use-nextest.md) ⭐⭐ IR-55: `cargo test -p spt --bins` hung 24min at 13.5s CPU (BLOCKED — a leaked `findstr .` child reads stdin forever under headless conhost; serial harness stalls every test after it); nextest ran the same 653 in 22.2s. GOLDEN IS NOT EXPOSED (already nextest) — the exposure is ad-hoc triage. Also 652-vs-653 = `adapter_translate_proof_gates_on_commit` refusing without its fixture; prebuild `cargo build -p spt --bin translate_proof_fixture`. See [[a-frontier-names-where-progress-stopped-not-the-cause]]. - [live-agent env reds broker-stop rigs](live-agent-env-reds-broker-stop-rigs.md) ⭐ the runner's identity vars (OWL_SESSION_ID/SPT_AGENT_ID/SPT_ENDPOINT_ID) make the shipped guard refuse a test's daemon-stop — scrub the three in the rig; env-differential on ONE tree beats a base-sha comparison for environment-vs-diff. - [generous bound is FREE on an early-exit poll](generous-bound-is-free-when-the-poll-exits-early.md) ⭐⭐ tight bound buys no speed, only load flakes; ask per ARM (kill bound ≠ success bound); elapsed wait MUST ride the red — at-budget vs under-budget is the only discriminator between never-happened and still-in-flight. - [a STRUCTURAL exclusion cannot be mutation-proved](structural-exclusion-cannot-be-mutation-proved.md) ⭐⭐ my per-arm mutation table read as "exactly these reddened, the others held" — but one held green because the path NEVER REACHES the mutated body (redeem writes a level below), so no mutation could ever redden it. Greens in a mutation table come in two kinds and the output cannot tell them apart: could-have-reddened (evidence) vs excluded-by-construction (none). Name which, beside the green; the structural arm guards a future MOVE of the code, not today's predicate. - [a FRESH pool's missing fixture bin reads as a CODE red](fresh-pool-missing-fixture-bin-reads-as-a-code-red.md) ⭐⭐ `cargo test -p spt --bins` compiles bin targets as TEST HARNESSES into deps/ and never emits `target/debug/translate_proof_fixture.exe`, so `adapter_translate_proof_gates_on_commit` panics in any pool that never ran a full `cargo test -p spt`. Green in my #196 lane, red in my brand-new #172 lane — same command, different POOL HISTORY. Build the fixtures once (`--bin translate_proof_fixture --bin post_step_fixture`); read the panic TEXT, which names the right invocation itself. - [two background jobs, ONE output path](two-background-jobs-one-output-path.md) ⭐⭐ reused `> $S/172-spt.txt` across two overlapping runs; the later grep read the earlier run's file and printed `EXIT=0` beside `test result: FAILED` — impossible for one cargo, and exactly the shape of a fascinating anomaly worth inventing a mechanism for. Contradictory arithmetic ⇒ suspect the PLUMBING first; one path per invocation. - [mutate the DEFECT not the trigger](mutate-the-defect-not-the-trigger.md) ⭐⭐ trigger-only mutation vs standing defense measures nothing; only defense-removing survival indicts the test. - [include_str! does NOT normalize CRLF, a string literal DOES](include-str-does-not-normalize-crlf.md) ⭐⭐ cell compared an `include_str!` artifact against a literal const: green in the AUTHORING tree forever (git normalizes at commit, never re-smudges a working-tree file), red in every fresh checkout on an autocrlf=true box — the golden's own. Windows-only red, Linux green. Prove it with `od` in a fresh worktree (no build). Fix at the FIXTURE EDGE, not `.gitattributes` — an eol pin is the same environmental dependency one layer away. Census `include_str!`; a newline-free needle is immune, `\n\n` parses are not, and `str::lines()` hides the class. - [expectation derived from the code under test](expectation-derived-from-code-under-test.md) ⭐⭐ table test branched on `took_custody()`, the fn under test ⇒ widening it to admit `Refused` (a real security widening) passed 3/3 GREEN; expectation moved with the predicate. Hard-code the partition as a LITERAL and assert predicate AND write against it. Exhaustive-over-variants and self-referential-in-the-verdict are INDEPENDENT — only the second decides if the test can fail. Compile/coverage/traceable-reqs all exit 0 throughout. - [a control must mutate EVERY encoding](negative-control-must-mutate-every-encoding.md) ⭐⭐ one-site mutation of a doubly-encoded rule stays GREEN and reads as "guard defended" when it means "this control cannot see the guard"; count the sites first, and tell the gater it took N. - [a cmdline-scoped builder census is INTERMITTENTLY blind](a-cmdline-scoped-builder-census-is-intermittently-blind.md) ⭐ todlando + hertz 2026-09-08, same hour, both boxes: filtering cargo/rustc by worktree path in CommandLine matched 0 of 3 of MY OWN live builds — one cargo.exe had a BLANK CommandLine, another only the toolchain path. rustc carries the target path, cargo does not, so it fires mid-compile and reads empty seconds later: a guard with a track record is the persuasive kind. Census BOX-WIDE over cargo/rustc/clippy-driver, LABEL it box-wide, refuse on non-empty (which makes a load-window hold mechanical). Every prior "procs-before: []" = "no path match", never "I was alone". - [pool sweep is BLIND to a System32 victim leak](pool-scoped-sweep-blind-to-system32-leak.md) ⭐⭐ pool 0/0 while `cmd`+`ping` leaked from a withheld kill; reap the victim by COMMAND LINE, never by image name, and report BOTH predicates' counts — either alone is a clean zero on the other's population. - [rig mechanisms not memory](gate-rig-mechanisms-not-remembered-steps.md) leg 0 = throwaway target; sweep exes before EVERY cargo · [disposal is a rig STEP](gate-target-disposal-is-a-rig-step.md) · [isolated worktree](gate-clean-target-not-incremental.md) · [int via nextest](gate-int-tests-with-nextest-not-bare-cargo-test.md) · [clippy --workspace](ci-clippy-preflight-workspace.md) · [gate vs documented design](gate-against-documented-design.md) · [cross-platform leg](gate-cross-platform-leg.md) ⭐⭐ 3rd hit 2026-08-24: cfg-asymmetric const = dead-code lint on the OTHER OS — a cfg-touching wave's gate needs a cross-OS CLIPPY arm, tests catch nothing (SIGNET golden red). - [a lost continuation backslash COMPILES and PASSES](a-lost-continuation-backslash-compiles-and-passes.md) ⭐⭐ a Rust literal that loses its trailing `\` bakes source indentation into the RENDERED text; W3: `xtask check` flagged a 14-space run in a diagnostic while clippy BOTH OS, three nextest legs and treqs were green at that same sha. No test asserts a diagnostic's exact rendering, so the class lives in the gap tests deliberately do not cover — an `xtask check` red beside eight greens is the ONE instrument looking at it. Writing tools eat the backslash; verify with `cat -A`, never by trusting the write. ⚠ 2nd face 2026-08-29 (todlando W1): the REPAIR minted `\`+literal-`r`+LF — Rust reads a `\r` ESCAPE + raw newline, compiles, renders broken; verify a repair by BYTE-DIFF against a known-good continuation in the same file, not by re-reading source. Exemption is `spacerun-ok: — `; a bare marker exempts nothing. - [a long foreground `sleep` becomes a SHORT background one](a-long-foreground-sleep-becomes-a-short-background-one.md) ⭐⭐ Bash moves any command past its ~120s timeout to the background, so `sleep 590` waits ~2min and you poll 5x more than you intend. Measured 2026-08-28: box clock advanced ~15min across 8+ believed-ten-minute waits. The cost is not wasted turns — it is the FALSE INFERENCE: I called a healthy 13-minute build "compiling over an hour" and went hunting a wedge. Read `date` before calling anything stuck; use Monitor with an until-loop, or just wait for the background task's own completion notification. - [clippy COMPILES, it never RUNS a test](clippy-compiles-it-does-not-run-tests.md) ⭐⭐ `--all-targets` builds test targets, which is why it feels like coverage; it cannot tell you a test PINNED the string you changed. A DIAGNOSTIC-STRING lane needs the owning crates' nextest leg (or a tree-wide grep of the OLD string, real exits, confirming only emit sites survive). My owlery lane shipped 3 green legs blind to this; doyle closed it at gate. Pick legs by what the EDIT could falsify, never by what a lane of that shape usually runs. - [behavior → grep tests](behavior-change-grep-tests-not-comments.md) · [shared seam → ALL seam tests](shared-seam-change-run-all-seam-tests.md) · [seam red needs repeat-proof](seam-touched-red-needs-repeat-proof.md) · [main baseline](main-baseline-procedure.md) · [twohost window](twohost-run-window-discipline.md) · [unmergeable PR blocks CI](unmergeable-pr-blocks-ci.md). - [rebase fidelity = LANE'S own diff](rebase-fidelity-blob-compare-limit.md) ⭐⭐ LIMIT: byte-identity only if main misses your files; else strip `index`/`@@`. - [textual merge hides semantic composition break](assembly-textual-merge-hides-semantic-composition-break.md) ⭐⭐ 11 picks zero conflicts, fidelity proven, head did NOT compile — refactor lane's helper hoist vs feature lane's pre-hoist cell (E0425×4, #182 v2 assembly); lanes-green + no-conflicts proves nothing about the assembled head — clippy the head before EVERY hand-off, fix = minimal declared stage-only commit in the landed idiom. - [a census must be cfg(test)-AWARE](population-census-must-be-cfg-test-aware.md) ⭐⭐ grep cannot see `#[cfg(test)]`, so a call-site list mixes prod and test and still reads as an enumeration. releases#57: the filed issue, the JIT plan AND my own carried-forward wake note all named `cli.rs:24084` as a prod mutation site — it is inside `mod tests` (22522..35192), and the real population held a site none of the three listed. A list someone ALREADY re-located feels more verified than a fresh grep and was derived by the same blind method. Compute the cfg(test) regions, classify every hit, and ship the count WITH its definition. - [truncated grep = wrong POPULATION](truncated-grep-read-as-the-population.md) ⭐⭐ `| head -N` on a sweep SILENTLY sets scope; count first, list untruncated, classify every survivor — cost me a missed rename site. - [census pattern encodes an assumption](string-census-pattern-encodes-an-assumption.md) ⭐⭐ two faces measured (w1t3): line-continuation split the token across lines (rg -U is the population check), and a `token+subcommand` pattern was blind to rendered BARE-form sites; run a looser sibling probe — the count DELTA is what the census missed. Only surfaced because negative assertions were repinned too. - [count the string you REPLACE](scripted-edit-zero-match-refusal.md) ⭐⭐ ASCII-only anchors · [restore presumes a baseline](restore-step-presumes-committed-baseline.md) `git checkout --` DELETES uncommitted work · [correct fix deletes mitigation](correct-fix-deletes-accidental-mitigation.md). - Real-harness escapes — [mock-gating escape](v0121-realharness-reopen.md) ⭐⭐ green on mocks + in-proc reconcile, broken in the real harness · [source-read PASS refuted](v013-forkpty-groundtruth.md) code-gate PASS ≠ integration; Linux forkpty RED. - [consumer tally needs a PRODUCER control](consumer-tally-needs-a-producer-side-control.md) ⭐⭐ frozen counter = theft ONLY IF the producer kept producing; three-way verdict, PRECONDITION is not evidence · [probe before TEARDOWN](probe-before-teardown-not-at-assert.md) ⭐⭐ teardown-then-assert makes an assert-time probe read the rig's own cleanup · [instrument OUTPUT must outlive its subject](instrument-output-must-outlive-its-subject.md) ⭐⭐ sibling face: sink derived from the root the subject resolves sat INSIDE the rig's TempDir; the drop ate record+sink 29ms before the dump step, and the emptiness reads "no child wrote" when the truth is "reaped before read". A surviving ONE-line file is evidence of DELETION, not a small population. · [lane check via main pool](lane-check-via-main-pool-prebuilt-xtask.md) ~30s not a cold build; claim with the BUILT xtask.exe from the lane's cwd. - [non-vacuity can fail for the DEFECT's reason](non-vacuity-check-can-fail-for-the-defects-reason.md) ⭐⭐ collect it into the verdict; asserted up front a defect reads as a broken rig · [local IPC subscribe: by=None](local-ipc-subscribe-carries-no-origin.md) invented origin refused structurally, looks like seat contention. - [discriminator question](discriminator-question.md) ⭐⭐ 9 instances; newest = auditing a PEER’s one-command discriminator: if ONLY the failing path emits the string you grep, its absence from a green run is a TAUTOLOGY, not a measurement — ask which code path EMITS it before running the test, and settle at SOURCE (the fixture) instead of in logs · [external observable](outcome-discriminates-what-instrument-cannot.md) · [refuse mechanism first](refuse-mechanism-until-something-discriminates.md) · [instrument soundness](instrument-soundness-guards.md). - [a louder red hides a quieter one](a-louder-red-hides-a-quieter-one.md) ⭐ todlando 2026-09-08: four golden cells were red for TWO reasons — my new doubled-`type` defect AND a literal envelope expectation predating W2 msg-id; fixing the loud one left them red, and only the FAILURE TEXT changing proved the fix (BEFORE `type="msg" type="msg"` vs AFTER single, same cell/invocation, peer-measured on another box at the pre-fix sha). State acceptance as the text changing, never as the cell passing. An exact-equality assert over a CONTENT-DERIVED value (digest id) is unmaintainable by construction: repin the SHAPE, not the value. - [is this red MINE](is-this-red-mine-delta-test.md) ⭐⭐ 2nd face: THE RED THAT CONFIRMS YOUR HYPOTHESIS needs the delta test most and gets it least. My rig died reproducing the frozen HFENDULEAM signature EXACTLY (spool.db + untaken briefing + no info.json) on a tree lacking the #199 fix — every element corroborating; I was drafting "candidate (a) confirmed". Running the DONOR rig unchanged on the same tree took 4s and passed 1/1: the red was MINE (my manifest declared a translation binary, widening a race the donor never runs). A contradicting red gets audited automatically; a flattering one gets REPORTED — the tell is excitement, not doubt. Control on the SAME tree BEFORE reporting. - [failed JOB ≠ test victim](failed-job-is-not-a-test-victim.md) ⭐⭐ 12 failed jobs = 3 real victims; all-pass nextest summary ⇒ read the STEPS api, cross-platform repeat ⇒ code red not victim; rerun behaviour PER SHA; compare SIGNATURES not counts. - [assert string ≠ signature identity](assert-string-identity-must-include-the-predicate-subject.md) ⭐⭐ two "exact repeats" were pre-fix + post-fix mechanisms; the "respelling" WAS the fix — diff the predicate's SUBJECT chain, not the message · [empty TaskList ≠ dead task](empty-tasklist-is-not-a-dead-background-task.md) ⭐⭐ still-running poller invisible after /clear; re-arming doubled a MUTATING holder — near attempt-4 double-fire. - [carried jobs inflate attempt rows](rerun-carried-jobs-dedupe-executions.md) ⭐⭐ partial rerun COPIES untouched jobs into the new attempt with ORIGINAL started_at; a carried failure = the SAME observation. Rate math dedupes on (run, box, started_at). ⚠ 2026-09-09 #293 a2 (doyle, deployah caught it): a carried job's `run_attempt` is RELABELLED to the new attempt, so all-attempt=2 reads fresh on a fully-carried run; the discriminator is started_at vs the attempt's own run_started_at, and provenance is reported per job (N executed in a, M carried from a, same sha). ⚠ THE TELL (2026-09-09 #293 a2): a carried job's `run_attempt` is RELABELLED to the new attempt, so ALL jobs read attempt=N and the field discriminates NOTHING — doyle called 3 carried jobs “fresh” off it. Compare `started_at` against the ATTEMPT's own `run_started_at` (from /attempts/); started-before-its-attempt = carried. A carried success IS true evidence for the SHA, just not evidence the rerun re-tested it. - [census COUNT is noise](process-census-count-is-noise.md) ⭐⭐ 23/17/15 in 90s (digest polls); trend the PATH classification. - [dispatch-window legs must name the GOLDEN BOX](dispatch-window-legs-must-name-the-golden-box.md) ⭐⭐ filled a golden's wait with my own gate legs ON the golden's Windows box; a TOTP cell stretched 17x, its gate's 1s backoff refused a valid code — the run's only red, manufactured by me. Ask WHERE the awaited run executes before firing anything heavy; the "now-quiet box" step name was the contract. - [pre-fire check reads the DISK FLOOR](prefire-check-reads-the-disk-floor.md) ⭐⭐ process census is blind to a FINISHED build's dir; golden died at the 32 GiB preflight, zero test signal. ⚠ one floor reading = SNAPSHOT: C: swung 45 GB in 24min untouched — reclaim past the SWING, not past one sample. ⚠ 4th face 2026-08-24: budget in POOLS not GB — a full-sweep pool WEIGHS ~90-112GB steady state (3 specimens), cleaning a live pool buys one window at rebuild price; LNK1180/LNK1318 at the floor = the disk's red, never the diff's (IR-59). - [pre-register the STATISTIC, not just the prediction](pre-register-the-statistic-not-just-the-prediction.md) ⭐⭐ even-N median is a CONVENTION wearing a statistic's authority: ten 1s + ten 3s gives lower=1 FALSIFIED, upper=3 SURVIVES, avg=2 SURVIVES — same data, three verdicts. Register the conservative arm before the capture; file the RAW VECTOR + histogram so the convention is not load-bearing. Sibling: negative-control the extractor on a KNOWN truth vector (a plural-only regex dropped every singular `1 ppid match`, 5 of 20, and would have CONFIRMED the prediction). - [a battery is SILENT about arms no cell drives](a-battery-is-silent-about-arms-no-cell-drives.md) ⭐⭐ a claim that ENUMERATES is a test plan: "all six kinds", "every surface", "both directions". My own W3 asserted all six IO kinds visible in the REQ title + 3 published docs; COMMUNE/COMMUNE_FAIL were STRUCTURALLY impossible (their only publisher hand-builds IoBus::new() with one sink instead of default_bus). The e2e drove 2 kinds and was VACUOUS on exactly the 2 broken ones; the units synthesized rows and never traversed the publish path where the defect lives; TREQS WAS GREEN ON TAGS, NOT TRUTH. Four green legs + a gate PASS + my own parity check, all blind — a census for an UNRELATED lane found it. Count the claim's arms, count the cells driving them, name uncovered arms BY NAME. A test that cannot fail is worse than a missing one, because a missing one is visibly missing. - [env-gated row returns a VACUOUS 0.00s green](env-gated-test-returns-vacuous-green.md) ⭐⭐ `published_release_verifies_against_embedded_anchor` gated on `SPT_RELEASE_E2E`; unset ⇒ body never runs, PASS in ~0.00s, run summary identical to a real one. READ THE DURATION, NOT THE COLOR — a green too fast to have done the work is a skip. ⚠ testimony (deployah via doyle, v0.54.0 cut), unreproduced by me. - [cargo test --tests STOPS at the first failing binary](cargo-test-tests-stops-at-first-failing-binary.md) ⭐⭐ every suite after the failure silently never runs — a "clean" rerun is evidence about the PREFIX; --no-fail-fast for any sweep claiming suite-wide coverage — on cargo AND on nextest; CORRECTED 2026-09-06: nextest is NOT exempt (defaults to max-fail=1); this line used to say it was and I acted on it — 165 unrun, one of them a test binary that never COMPILED. Read the RUN COUNT (1074/1239), never the pass count. Rider: xtask-gen regen drift must be measured by `git diff`, never porcelain — autocrlf leaves regenerated files M on EOL alone (measured both, 2026-08-19 W3). Also that day: the "never run daemon --lib on this box" rule REFUTED 3/3 — see the updated entry, mechanism kept. - Filters reading as absent — [positive control](zero-match-filter-reads-as-absent.md) · [nextest matches names](nextest-zero-match-filter-trap.md) · ["1 test run"](nextest-singular-summary-parse.md) · [absence proxy](absence-proxy-breaks-when-success-writes.md). - [a positive control must CROSS the boundary the guard faces](a-positive-control-must-cross-the-boundary-the-guard-faces.md) ⭐⭐ hertz 2026-09-08: 15/15 green controls shipped a holders guard blind to the one process class it existed to catch — WMI blanks `ExecutablePath`/`CommandLine` for a process you cannot open (219/632 box-wide, all session 0, where the runner's builds live), so EMPTY read as "no holders". Every control had been injected in MY OWN session, proving the predicate can MATCH, never that it can SEE. "Every guard needs a positive control" is necessary and NOT sufficient: name the boundary (security context, machine, user, process tree, encoding) and check whether any control instance was born on the FAR side; if none was, the suite proves firing, not seeing. Far side uncheap to construct ⇒ env seam + injected far-side data + a THREE-VALUED guard so the unreadable case has its own name. Scope it before reporting: this bit an agent census, NOT core. - [hand-built walk ≠ enum pin](hand-built-walk-is-not-an-enum-pin.md) ⭐⭐ array + `len` assert stay trivially true when a variant is added; only a wildcard-free match at the PROD sites compiles red. Kin: a predicate parsing half an address re-opens the ruling the other half carries. - [panic MESSAGE is pre-authored](panic-message-is-preauthored-not-a-finding.md) ⭐⭐ names ONE mechanism whatever fired; read the gate line's numbers — a deficit PREDATING the window can't be caused inside it; immunity that's only a comment can't discriminate. - [assert GATES on status, PRINTS stderr](assert-gates-exit-status-but-prints-stderr.md) ⭐⭐ condition and message read different channels ⇒ log is MUTE on cause; `status.code()` 101-vs-1 lost, stdout invisible; a warn-only line above the panic is not thereby causal. - [test NAME asserts what the FIXTURE never creates](test-name-asserts-what-fixture-never-creates.md) ⭐⭐ gate not fooled, READER is; `std::process::id()` can never build an identity mismatch — read the fixture, never the name. 2nd face: the seeding HELPER decides it and the comment cannot show you — `allow_surfaces` sets modes CLOSED when the MODES table is empty (`access.rs:1711` reads `acl.modes.is_empty()` — the posture table, NOT the surfaces arg; that unnamed "empty" seeded a twice-carried misread, 2026-08-18), so two arms of one rung ran the same verb and diverged; state an arm's requirements TOGETHER to catch a structurally impossible one (needs Closed and Open at once ⇒ green nowhere ⇒ 1/1 is honest, rerun buys nothing); subject-matter adjacency ≠ causal proximity. - Coverage gaps — [uniform-table](uniform-table-blindness-sweep.md) · [every return arm](every-return-arm-is-a-copy.md) · [setup suppresses the arm](setup-suppresses-failing-arm.md) · [wrong population](gate-population-excludes-consumers.md) · [miss the CALLERS](gate-population-covers-consumers.md). - [a PRESENCE control needs the FAULT's population](presence-control-scoped-to-the-faults-population.md) ⭐⭐ walked the whole doc asserting the set CONTAINS the verb — the artifact's own PREAMBLE prescribes it too, so the arm was green over the exact silent defect it was written for. Count the token's occurrences in what you feed the walk; >1 ⇒ narrow to the slice where the fault can live. Negative arm must ALSO yield a healthy sibling token, proving the walk ran. - [a literal count floor is a FOSSIL](literal-count-floor-is-a-fossil-of-the-old-subject.md) ⭐⭐ `checked.len() >= 3` encoded how BIG the subject was, not that the instrument saw anything; a ruled partition shrank the briefing to one command and the cell reddened a correct change. Re-derive the count by a route the instrument does not take (count its own split token) and assert `==` plus `> 0`. - [pipefail masks/fabricates](render-not-read-pipefail.md) · [exit after a pipe is TAIL's](exit-code-after-a-pipe-is-the-tails.md) ⭐⭐ tail also hid a test section; both print GREEN · [SIGPIPE 141](shell-bash-adds-pipefail-sigpipe.md) · [seed descent from dead parent](seed-descent-from-dead-parent.md) · [torn window reachability](torn-window-needs-reachability.md) · [reap duration ≠ window](reap-step-duration-is-not-the-window.md) · [husk reads as default](husk-reads-as-default-defeats-durability.md) · [stale-snapshot proxy](stale-snapshot-equality-proxy.md) · [tick granularity](pair-test-tick-granularity.md) · [fixture ripple](liveness-aware-derivation-fixture-ripple.md) · [a2 r2 specimens](a2-golden-r2-specimens.md). - [two-daemon one-box](two-daemon-one-box-rig.md) · [isolated home/socket](isolated-home-isolates-broker-socket.md) · [perched gate strips agent env](perched-gate-run-strips-agent-env.md) OWL_SESSION_ID → DAEMON_STOP_REFUSED · [resident-broker repro](isolated-resident-broker-field-repro.md) · [daemon lib CAN wedge — prohibition REFUTED, race stands](daemon-lib-tests-deadlock-on-live-host.md) ⭐ 857/857 clean 2026-08-19; keep the cdb recipe · [--tests fail-fast HIDES THE TAIL](cargo-tests-failfast-hides-the-tail.md) ⭐⭐ sweep halts at the first failing BINARY, later suites never run and the log just ends; a precondition red reads like a product red · [verification gates](spt-verification-gates.md) · [alarm every run](alarm-every-test-run.md) · [delegate to spt-test-engineer](delegate-tests-to-spt-test-engineer.md) · [subagent stalls](test-subagent-stalls-on-hanging-test.md). - [include_str! fixture inherits checkout EOL](include-str-fixture-inherits-checkout-eol.md) ⭐⭐ autocrlf=true smudges FRESH checkouts CRLF while the author's never-re-smudged tree stays LF — builder green 637/637, every fresh rig/golden checkout red (split_once("\n\n") vs \r\n\r\n, W3 gate 2026-08-19); normalize at the fixture edge or pin eol in .gitattributes; the gate running from a fresh checkout is what catches the class at all. - [cargo builds pkg bins for int tests](cargo-builds-package-bins-for-integration-tests.md) ⭐⭐ same-package fixtures ALREADY guaranteed; env! adds NO edge — gap is cross-package + UNIT tests; bindeps needs nightly, nextest needs the config form. - [cargo test --bins never EMITS fixture exes](cargo-test-bins-never-emits-fixture-exes.md) ⭐⭐⭐ RECURRED 2026-08-29 on the entry's own author, WITH the entry written: prebuilt `-p spt --bins` from RECALL and ate three fixture reds in a row (mock-session, capture-player, mock-shell), each a ~0.01s panic that reads as a test failure. TWO NEW FACES: the fixture may live in ANOTHER PACKAGE (`-p mock-adapter --bins` — build the whole package, never a hand-list), and ENUMERATING FIXTURES BY GREPPING their pre-build strings is structurally incomplete because `sibling_bin`/`fixture_package(name)` COMPOSES the command at runtime, so no literal exists to grep. Original entry: --bins compiles [[bin]]s as test harnesses into deps/, no target/debug/.exe — cell shelling to the exe reds in a FRESH pool, green wherever a normal build ever ran (pool HISTORY, not the tree); prebuild fixture bins before any bins/filtered leg in a cold pool (todlando #172 lane + doyle #199 gate, 2026-08-21). ⚠ 3rd recurrence same day as the 2nd, on the GATER with the entry re-read that morning (W1 #235): a FULL `-p spt-daemon` nextest in a cold pool hits it too — reading the entry does not apply it; the prebuild leg lives IN the driver template now. - [check verifies COVERAGE, never PLACEMENT](traceable-check-cannot-verify-tag-placement.md) ⭐⭐ 57 unit tags on one REQ ⇒ your site cannot turn it red; EXIT=0 both with the tag separated from its evidence and after the fix. Green means coverage satisfied, NOT tags correct — read the site. Inserting a const/helper near a tagged item is the recurring way adjacency breaks. - [grep REQ tags](grep-req-tags-to-find-impl.md) · [per-wave activation](traceable-per-wave-activation.md) · [seed leaks](experimplate-traceable-seed-leaks.md) · [CI install cache](traceable-reqs-ci-install-cache.md) ⭐⭐ `TRACEABLE_REQS_TOKEN` is DEAD CODE · [spt is binary-only](spt-crate-is-binary-only-no-lib.md) use `--bins` · [never cargo fmt](no-cargo-fmt-in-spt-core.md). - [empty TaskList ≠ dead task](empty-tasklist-is-not-a-dead-background-task.md) ⭐⭐ poller SURVIVED a clear invisibly; re-arming put two `rerun --failed` holders on one run — only the API's green-contingent refusal stopped a 4th attempt. Read the prior `.output` before re-arming anything that MUTATES. - [check branch](check-branch-before-commit-shared-checkout.md) · [no add -A](no-git-add-a-shared-checkout.md) · [no reset --hard](no-reset-hard-with-uncommitted-work.md) · [worktrees under root](worktrees-under-project-root.md) · [audit watchers](audit-live-watchers-before-rearming.md) survive /clear · [quiet window](quiet-window-predicate.md) gh-only is blind to local builds. - [two FAIL lines are ONE observation](nextest-duplicate-fail-line-is-one-observation.md) ⭐⭐ nextest prints a failure in the live stream AND the final summary; identical elapsed + identical ordinal reads as a deterministic RETRY confirming the diagnosis. Count `panicked at`, never FAIL lines, and grep `retr` in the nextest config AND the workflow at the measured sha before calling anything deterministic. Handed to me as a peer supporting-fact, 2026-08-20 golden; the flattering read is the one nobody audits. - [gh run status freezes](gh-run-status-field-freezes.md) + [poll --json jobs](gh-run-poll-jobs-not-status.md) ⭐⭐ VIEW: `--json jobs` never `status`; ⚠ LIST REJECTS `jobs` · ⚠ NO TELL, TRAP 1 RETIRED (deployah 2026-09-10, golden 34445961595 @a9e786b2): `updatedAt` MOVED and the field still lied at every read, running BACKWARDS queued→in_progress→queued while a leg had been RED 16 min — a FAILURE is INVISIBLE at run level, so score from attempts//jobs · [gh refuses RUN-SCOPED mid-run](gh-job-log-refuses-while-run-in-progress.md) ⭐⭐ 2 faces. `--log`: exit 1 even for a COMPLETED job; `2>/dev/null` turns it into a clean zero reading as "no failures" — use `gh api repos/O/R/actions/jobs//logs`. 2nd face 2026-08-28 (deployah, CONDUIT 33223968222): `rerun --failed` ALSO refuses in flight, and fails toward a FALSE DIAGNOSIS not a false green — it reads as a rerun/permissions problem when it is purely timing. The red is visible long before the run is rerunnable; that gap IS the trap. Confirm terminal via `--json status` first · [gh --jq works with NO jq on the box](gh-builtin-jq-masks-missing-shell-jq.md) ⭐⭐ built-in engine masks a missing jq.exe — a bare `| jq` monitor dies silently on every poll while every gh sanity-check succeeds; instruments must emit a first-cycle ARMED line before their silence means anything (deployah testimony 2026-08-24, 84 dead polls) · [gh api leading slash](gh-api-leading-slash-msys-rewrite.md) · [bg cd-relative](background-cd-relative-trap.md). - [pool refusal's TAIL reads as a release confirmation](pool-refusal-tail-reads-as-release-confirmation.md) ⭐ `tail -2` on a pool verb returns the releases#103 rationale blurb — the LAST line of the REFUSAL — which reads like success; 4/4 failed releases looked like confirmations (todlando testimony 2026-08-21). Judge pool verbs by the verdict token up top, never the tail. - [the FIRST claim on a foreign pool must refuse](the-first-claim-on-a-foreign-pool-must-refuse.md) todlando 2026-09-08 W3: `cargo run -p xtask -- pool-claim` builds THROUGH the pool it is claiming, so a released foreign pool refuses SPT_POOL_FOREIGN on the first leg by construction — hatch that ONE leg (the refusal says so), never the battery; release leaves ownership recorded as YOUR tree, so the next agent hits it too. Second half: a clean guard pass is SILENT, and only `build/-/invoked.timestamp` + `output` separate ran-and-passed from never-ran — last invocation per UNIT, overwritten, so it time-excludes an agent but cannot reconstruct a past run. - [pool-claim WRITES a record, the BUILD enforces it](pool-claim-writes-a-record-the-BUILD-enforces.md) ⭐⭐ `pool_claim` never reads the incumbent (main.rs:2232-2294, unconditional `write_owner`, base only RECORDED) — last-writer-wins, no notice either side. Refuse/Takeover/Unproven/HatchOpen all live in `spt-store/build.rs:31-113`. I predicted a REFUSAL to a gater mid-run from AGENTS.md prose; the file refuted me in one read. Never predict a tool's refusal from prose — read the record AND the code path. - [the CONDITION reproduced, the RACE did not](condition-reproduced-race-did-not.md) ⭐⭐ an end-to-end green after a race fix can be VACUOUS — the fixed path never ran, so the green is evidence about the LADDER, not the fix. Register the non-reproduction arm BEFORE the run so the vacuous case has a name to land in, and report which ARM fired, not the color. Instrument split the two: condition 2/2 runs, collision 1/2. Offer a DETERMINISTIC rig, never a re-fire against a 1-of-2 rate. - [duplicate work's population is PROCESSES, not code paths](duplicate-work-population-is-PROCESSES-not-code-paths.md) ⭐⭐ a per-process claim cannot exclude a SIBLING process; count distinct pids emitting the event before theorizing re-entrancy. Measured: one stream served by a livehost `spt` and the test-hosted daemon 21 ms apart, loser's refusal beat the winner's grant by 88 ms. Riders: score your predicted ARM honestly (I named consume-time, the claim-time one fired), and report the SILENT families beside the loud one — they took the same doubling and said nothing. - [read the OTHER leg's GREENS, not just its red](read-the-other-legs-GREENS-not-just-its-red.md) ⭐⭐ the peer job's PASSING rungs refuted my failing rung's whole premise — a green whose predicate has ONE producer in the product proves what already happened above that call site. Cost me nothing only because I checked where the peer died before writing a probe there; I was one command from instrumenting an answered question. When new evidence retires a DISPATCHED instrument, say so and hand the choice back. - [an ANTI-ORACLE refusal is opaque to the TEST too](anti-oracle-refusal-is-opaque-to-the-test-too.md) ⭐⭐ one token for unknown/expired/consumed/rate-limited ⇒ the red names nothing; enumerate the refusal's AUTHORING SITES and refute preconditions against fixture facts instead of theorizing. Second face: a cell must control or PROBE every precondition — the survivor here was a rate bucket SHARED with arrivals earlier rungs spend, charged per DELIVERY not per unique record. Check `required_stages`: no `int` stage ⇒ the cell pins a PRECONDITION, not the contract. - [the BARRIER must be the fact you ASSERT](barrier-must-be-the-fact-you-assert.md) ⭐⭐ wait on EXISTENCE + assert a LATER-written field = a snapshot taken 3 steps upstream of the write; deadline cannot help, green is luck, and the "OK: converged" line prints right before the failure. 2nd face: the panic exited the process mid-handler and killed the peer's in-flight ack — the other job's red was this cell's own kill, carrying zero information. Check the producer's step ORDER before proposing a product mechanism. 3rd face: barrier and subject can share a LOCK and still race — `converge(rows())` goes true when the merge block DROPS the lock, the counter ticks after (`registryhost.rs:881`), window microseconds, green for a month then one Windows red. Read the DIRECTION first: a cell guarding write amplification reads 2+ when the product breaks, so `left: 0` refutes the product before any source read, and the zero itself certified one transaction. 4th face: A BARRIER CAN EXPIRE WITH THE DEFECT — faces 1-3 are "upstream in TIME", this is "a predicate over state THE FIX DELETES". My #164 rig waited on the briefing row being PENDING; the fix takes it in ms, so post-fix the barrier never goes true and the instrument REDS on the tree its subject works on, reading as "never spooled" when the truth is "delivered before I looked". Ask of every measurement barrier: does this state still exist once the thing I am measuring is repaired? Prefer an EXISTENCE read (audit row, sees both states) over a STATE read (pending, loses it to any taker). - [background task output ≠ evidence until completion](background-task-output-not-evidence-until-completion.md) ⭐⭐ in-flight output file reads EMPTY = fake clean zero; 3 measured in one session (deployah), tool falsely blamed then exonerated by negative control; read ONLY on the completion notification, never on a timer. - [in-flight run logs: CLI refuses, raw jobs endpoint SERVES](in-flight-run-logs-are-gated-read-steps-and-annotations.md) ⭐⭐ `gh run view --log-failed` refuses mid-run even for a CONCLUDED job — that is the CLI, not availability; `gh api .../actions/jobs//logs` served 511KB live. Also: post-failure `skipped` ≠ passed (cfg-derived vs run-derived), and a same-FILE red is not a same-CELL red — map panic line to enclosing fn, diff vs the suspect commit hunks, clear fixes by WRITE-SET. - [worktree-remove partial failure reads total](worktree-remove-partial-failure-reads-total.md) content already gone, only the dir ENTRY pinned — ls FIRST, then rmdir+prune, never a blind retry (deployah testimony 2026-08-19). - [branch -d names the CURRENT HEAD](branch-d-merged-question-names-current-head.md) shared checkout on another lane ⇒ 'not fully merged' is an artifact; merged-ness question must NAME its ref (merge-base --is-ancestor vs origin/main) (deployah testimony 2026-08-19). - [a blank panel is not a silent product](blank-diagnostic-panel-is-not-a-silent-product.md) ⭐⭐ my miss-arm barrier read the INHERITED stderr file, but `daemon run` calls `stderrlog::install` a few statements in and repoints std-error at `SPT_HOME/logs/daemon.stderr.log` — inherited file = PRE-REDIRECT window only. Panel read EMPTY, which is indistinguishable from "the product fails silently", the exact defect the arm hunted, so the red CONFIRMED my hypothesis: one inference from reporting a product defect that did not exist. Tell I missed: the panel had been blank on the PASSING arms too — a diagnostic no assertion depends on is UNTESTED BY CONSTRUCTION, and its first real use is always a red you are trying to explain. Prove a panel non-empty on a GREEN run before trusting it to report silence. Sibling `engine_room_bringup_e2e.rs` documents the identical trap on the same family (IR-50 class). - [fixture project under SPT_HOME stops deriving](fixture-project-under-spt-home-stops-deriving.md) ⭐⭐ #178 widened the exclusion to the whole home; two projindex e2e fixtures parked projects inside it — red only at the ASSEMBLED head (no lane gate ran them), fallback value not garbage is the tell; leaked rig daemons then lock spt.exe and fabricate a second red. - [grep -l census counts name collisions](grep-l-census-counts-name-collisions.md) an identifier grep over-counts adoption (locals/doc-comments wear the helper's name); census = TWO greps, qualified call vs legacy spelling, diff the populations. IR-50 close gate 2026-08-20: my own concession fell to it before hertz's closure did. - [two-arm rig confounds the valve with arm ORDER](two-arm-rig-confounds-the-valve-with-arm-order.md) ⭐⭐ control + injected differ in TWO ways (the valve, and being second) — a rig that could only witness its FIRST case reads byte-identical to the defect. Add a SECOND CLEAN arm in the injected arm's position (cost 349ms); assert per-arm DURATIONS, and after the fix the burn must VANISH not shrink (20.4s -> 355ms, matching the clean arms). doyle ruled the shape and made keeping all three arms part of the #201 fix ruling. - [an UNAPPLIED mutation is a green that reads as a passing guard](unapplied-mutation-green-reads-as-a-passing-guard.md) ⭐⭐ a scratch that fails to APPLY runs the cell on the clean tree and prints a pass — byte-identical to a guard that really defended (todlando, W4 Lane 1: `1 test run: 1 passed` / `SCRATCH_B_EXIT=0`, read for the verdict instead of for the mutation = "cell B is a real guard" on evidence it was never tested). A purposeful red needs TWO assertions: the mutation LANDED (print the mutated fn body) and the cell then FAILED; assert MATCH_COUNT==1 and REFUSE rather than replacing a first hit. Cause was environmental and recurs: a heredoc collapses one backslash level, so ` ` in an inline script becomes a real linebreak — write old/new to delimiter files with a QUOTED heredoc and READ them. - [a coverage fix is measured over the POPULATION it claims](a-coverage-fix-is-measured-over-the-population-it-claims.md) ⭐⭐ #212 head gate: xtask spacerun had ALREADY been caught by an indented `#[cfg(test)]` latch (4 files / 6,375 lines blind); the fix keyed on COLUMN-0 markers, premise "a column-0 module runs to EOF" — false in the biggest file, `in_tests` never resets, cli.rs has EIGHT of them (first at 2934 of 37,903). ⚠ MY HEADLINE FIGURE WAS THE SAME ERROR: "88,030 lines / 54.4% / 102 files" measured LINES AFTER THE LATCH, not coverage loss — a trailing test module is out of scope under BOTH rules. True split: 88,042 = 66,637 never-in-scope + **21,405 production lines actually hidden, SIX files, 19,918 in cli.rs**. Fourth instance in one day of naming the wrong property, and the corrected number also settled a question I had queued a mutation for. The lane's `A=0` census was taken under the blind zone. A green scanner and a scanner that never looked are the same output. State the STRUCTURAL PREMISE and COUNT it; re-census the newly-opened region; correct the scope sentence by replacement. Proof shape: treatment (in the suspect region) exit 0 + CONTROL (where it is known to look) exit 1, same class, same run length, same binary — either alone is an argument. - [an exemption must be witnessed SUBTRACTING](an-exemption-must-be-witnessed-subtracting.md) ⭐⭐ a marker/waiver can be present, greppable, correctly spelled and suppress NOTHING — and it fails in the direction that reads as "still broken", so you keep adding more, all untested. #212: marked one site, re-ran, DIFFED THE SET — count stayed 7, site merely shifted 11986→11988; `opted_out` returned on the first non-blank walking upward, so a marker anywhere but the LAST line of a multi-line comment was inert. Post-fix 7→6 (one removal, nothing ADDED), then 6→0. A total is two cancelling changes away from lying, because suppression decides what gets PARSED not just REPORTED. Apply one at a time, diff the SET, exercise the awkward placement FIRST. - [a mutation that reds EVERY arm proves only damage](a-mutation-that-reds-every-arm-proves-only-damage.md) ⭐⭐ aim the purposeful red at ONE arm and assert the siblings INTACT in the same script. todlando, W5 #211 commit 1: starved `decide`'s PER-ENDPOINT tier with an empty slice while asserting `NODE_TIER_INTACT=True` — the cell PASSED arm (b) on the node tier at :278, then refused at arm (c) :305, exit 100. That ordering is what proves arm (c) is about tiers 1-3 and is NOT a second spelling of arm (b); a mutation reddening both would have proven only that the cell notices breakage. Report WHICH ARM refused and which it passed through first, never "the cell went red". - [a test’s BANNER can go stale against its own ASSERT](a-tests-banner-can-go-stale-against-its-own-assert.md) ⭐⭐ golden r1 2026-08-25: the failure block printed "the loopback leg is a captured diagnostic, not asserted" while dying ON that leg — `53be5270` (v0.61.0) promoted arm 4 to a hard assert and updated NEITHER the banner NOR the oracle’s soundness, so it asserted a property the cold-attach contract never guaranteed (a `from_seq=0` attach is served a GRID REPAINT; flood lines scrolled the needle off-screen). Passed 2 releases on the winning side of a race. Tell: same-sha PLATFORM SPLIT (Win PASS 2.175s / Linux FAIL 9.880s). A red’s own text disagreeing with what asserted is a FINDING — `git show` the promoting commit; "it used to pass" dates the MARGIN, not the oracle. - [a prebuilt xtask BAKES its build tree's root](prebuilt-xtask-bakes-its-build-trees-root.md) ⭐ its inner cargo runs AS the tree that BUILT the exe, not your cwd — main-built xtask from a gate worktree redded SPT_POOL_FOREIGN against my OWN claim, naming a tree the command line never mentioned; confirmed by fix (gate-tree rebuild, same pool/claim/cwd = clean). Build xtask FROM the invoking worktree before any building verb (check/gen); prebuilt is safe only for non-building verbs (pool-claim/release). - [an absence is data only if the thing has a way to appear](an-absence-is-data-only-if-it-has-a-way-to-appear.md) ⭐ missing emitter = missing read verb: "no pid observed" / "no breadcrumb" carries zero information when no code path writes it and no verb surfaces it — the absence is structural on healthy and broken runs alike. Name the emitter AND the read verb before citing an absence; either missing ⇒ file the observability gap, don't report the absence as a finding (CONDUIT #236 arc, 2026-08-29). - [a drain-side instrument SUPPRESSES the race it hunts](drain-side-instrument-suppresses-the-race-it-hunts.md) ⭐⭐ #225 RCA 2026-08-25: `SPT_OBS_BYTE_TAP` per-chunk fs work on the drain thread = 21/21 GREEN, unset = 3/3 RED — the probe's latency spans the ~2ms first-chunk-vs-Spawned-reply window; a probe on the LOSING side (brain's discard arm, off the racing thread) caught `SPAWNWAIT_DISCARD seq=0 SXMARK01` without flipping the outcome. A 100%-flip discriminator localizes the race — report it as a FINDING. Rider: an environment SLOWDOWN is an accidental mitigation (the kitsubito audit storm hid this race for releases; the box FIX exposed it), and one window whose WIDTH varies with load explains a whole "random victim family" — check that before positing several mechanisms. - [a test can be green on a SIDE EFFECT of the defect you are removing](a-test-can-be-green-on-a-side-effect-of-the-defect-you-are-removing.md) ⭐⭐ W4/#229: making an undeclared psyche role SKIP redded a re-host assertion that read the nested psyche perch as proof — that perch was minted INSIDE the turn BEFORE the spawn, so a role-less fixture grew one from a turn that then failed UnknownRole and struck. The old green was a leftover of the exact defect being deleted, and the red is the fix working. Trace WHAT PRODUCED the asserted artifact before classifying a red in a test your lane never touched; fix the FIXTURE (a real adapter declares the role), and pin the negative polarity PAIRED with the positive or the negative assert is vacuous. - [nextest DEFAULT fail-fasts: --no-fail-fast is the other half of the rule](nextest-default-fail-fast-hides-not-run-cells.md) ⭐⭐ todlando 2026-09-06 #276 gate: max-fail=1 stopped with 165 TESTS NOT RUN incl. a NEW int binary that had NOT COMPILED (private fn called from an int test) — a green-looking partial run over an uncompiled cell is the vacuity trap; put --no-fail-fast in every driver template. - [the RUN is the census; a grep is a guess at one](the-run-is-the-census-a-grep-is-a-guess.md) ⭐ todlando 2026-09-06 #276: string sweep for 'wrote its commune'/'echo wrote' MISSED a live assertion spelled 'wrote its drop'; the full nextest run found it. A retraction sweep's grep list seeds the population, the suite run measures it. - [git-bash `tasklist /FI` mangles to a PATH](git-bash-tasklist-fi-mangles-to-a-path.md) ⭐ 2026-09-07: MSYS rewrote /FI to C:/Program Files/Git/FI, tasklist errored, grep saw nothing, my Monitor reported a LIVE driver DEAD (twice, two sessions). Use //FI or MSYS_NO_PATHCONV=1; prove the arm on a known-live pid; fail closed (unknown ≠ gone). - [a leg that ends in a grep exits with the grep](a-leg-that-ends-in-a-grep-exits-with-the-grep.md) ⭐ 2026-09-07 W1: pair wrapper's status = its summary pipeline's, driver read EXIT 0 beside a.exit=100/b.exit=100 and started MUTATING on a red baseline; killed wrapper = revert undone. Gate the next leg on the role exit FILES; one-box rigs space port bases past the cell count (7460/7461 put A cell 1 on B's broker). - [a population floor proves the filter selected SOMETHING, not the right something](a-population-floor-proves-the-filter-selected-something-not-the-right-something.md) ⭐ 2026-09-07 W2: kind(lib)+kind(bin) never selects crates/*/tests (kind(test) enters only by binary()); the lane's own e2e rig with the finding-closing cells sat outside a battery whose 200-test floor passed. Run nextest list with the filter and assert the wanted cell NAMES are in it; name every touched test binary with binary() in the driver filter, same lane commit. - [a two-arm completion poll fails OPEN](a-two-arm-completion-poll-fails-open.md) ⭐ 2026-09-07: `[ "$r" != "0" ]` stopped on a dropped ssh and printed BATTERY DONE while clippy was mid-leg; a harness "task completed" notification is the WATCHER finishing, never the work. Three arms (DONE/RUNNING/METER BROKEN), the third never stops the poll; confirm on the exit FILE. - [a FIXED rig port is answered by the PREVIOUS run's leaked daemon](e2e-leaked-daemons-shared-box.md) 2026-09-07 W2: fetch 404 while the rig daemon's own `serve list` HOLDS the entry = registry right, surface wrong = another process on the port (netstat: last run's autostarted daemon, different SPT_HOME; the default port hands you the FLEET). URL-minting rigs need per-run bind-:0 port fed to daemon + CLI (flag OFF, IR-78) AND a Drop-guard reaper; gate greps DOCS_SERVER_UP port == URL port + no spt.exe from the rig home after the leg. - [tightening a predicate is an edit to the METER](a-stricter-meter-answers-a-confident-empty.md) x4 (deployah 2026-09-09: Git Bash pgrep blind to detached pwsh = confident empty used as a GUARD, failed toward PERMIT, manifest overwritten mid-watch; fix = guard on the RUN-TERMINAL invariant via gh, not a better process query) ⭐ 2026-09-07 instance appended: killing 2 false positives silently dropped `start_serving` and with it a true positive my own LOOSE pass had already found (3 vs doyle's 4). Diff the before/after result sets and name why every row left. - [a nextest TIMEOUT does not kill the cell's children](a-nextest-timeout-does-not-kill-the-cells-children.md) ⭐ 2026-09-07 W2: a timed-out twohost_web cell left a broker-holding child alive; nextest blocked 14 min at 0.61 CPU-s, no .exit written, verdicts already in .raw. A "hung" pair lane = CPU time + orphan census FIRST, read the .raw, kill only the path-verified orphan; parent then writes its exit at once. - [a driver edited MID-RUN mangles the live run into vacuous greens](a-driver-edited-midrun-mangles-into-vacuous-green.md) ⭐⭐ 2026-09-07 W2 F17: doyle rewrote the xbox twohost script 2 min INTO my run; bash reads by byte OFFSET, resumed mid-line, dropped role A's env prefix → all 5 cells no-opped and "passed" in ~0.013s, role_b (the must-skip) indistinguishable from the four that should work. Detector = uniform 0.0x s PASS incl. the must-skip cell + owner WEB_SERVE_FOR == 0; Summary==1 was necessary NOT sufficient (single and EMPTY). Read script mtime vs run window BEFORE bisecting env. Run drivers from a FROZEN copy. - [a double backslash COLLAPSES inside a quoted heredoc](a-double-backslash-collapses-inside-a-quoted-heredoc.md) ⭐ doyle 2026-09-07: `\\n` in a `<<'PY'` heredoc reached python as `\n`; anchor matched 0 twice, third try WROTE real linebreaks into mutate.py (SyntaxError). Build backslashes with chr(92) or read from a printf-written file; py_compile + diff the region after every scripted edit. - [a rig that seeds ONE direction fails when a cell needs the REVERSE judgement](a-rig-that-seeds-one-direction-fails-when-a-cell-needs-the-reverse-judgement.md) ⭐ hertz 2026-09-07 F19: B's roster/registry never had A (requester() seeds B->A only), so B's first reverse judgement refused UntrustedOrigin wearing the dispatcher's 120 s red; census seeds for BOTH directions, precondition-assert with the arm's own read verb (failed in 0.5 s with the verdict word). - [LNK1104 on the exe you are PRODUCING = the previous run's cell still holding it](lnk1104-on-the-exe-you-are-producing-is-the-previous-runs-cell-holding-it.md) ⭐ hertz 2026-09-07 F19 run 2: role A ran its full 240 s WAIT after B died at a precondition; relaunch 90 s later hit LNK1104 on twohost_web-*.exe — reads as a link fault in the edited code, is a file lock; chain launches on an EMPTY ExecutablePath census, VOID not red. - [a rig WAIT equal to nextest's terminate-after makes the cell's own red UNREADABLE](a-rig-wait-equal-to-nextests-terminate-after-makes-the-cells-own-red-unreadable.md) ⭐ doyle 2026-09-07 W2: WAIT=240 == 60 s x 4 terminate → helper cell killed as TIMEOUT [240.1s] with no deadline text, and equal WAITs on both roles left A's range cell dialing a B dead 74 ms earlier; WAIT under the bound with margin (120), serving role outlives the requester's tail. - [a barrier published by the party that EXITS is a dial to a corpse](a-barrier-published-by-the-party-that-exits-is-a-dial-to-a-corpse.md) ⭐ todlando 2026-09-08 W3: XFER side-channel moved onto replicated rows; the two signals whose publisher STAYS worked, the completion barrier published by A-then-exit left B dialling a dead endpoint all window (PUMP_PEER_FAIL submit-dial 10 s). Ask who is up when the other side reads it; an exiter signals synchronously with took_custody, the waiter reads its spool. Found on run 1 of a leg ruled in over "accept the risk". - [a `FAIL [` grep DROPS `FAIL + LEAK` rows](a-fail-prefixed-grep-drops-fail-plus-leak-rows.md) 2026-09-08 v0.68.0 golden r1 Windows: harvested 3 reds, Summary said 4 failed — the missing row read `FAIL + LEAK [`, and the under-count invented a false cross-OS difference. Enumerate failure CLASSES with a suffix allowed, then RECONCILE against the Summary's `N failed`; that reconciliation is the check. LEAK-only rows are not failures; per-OS denominators differ (3323 vs 3344). - [a watcher's exit 0 with an ABSENT exit file is a NON-RESULT](a-watchers-exit-0-with-an-absent-exit-file-is-a-non-result.md) hertz 2026-09-08: watcher reported exit 0 + empty diagnostics (reads as a clean pass); clippy.exit ABSENT, clippy.raw truncated 11,081 B in mid `Checking anstyle-wincon` — died in DEPENDENCY compile, never linted a workspace crate. Empty diagnostics means "nothing ran", not "no problems". Check: exit file EXISTS, raw reached a workspace crate, and the exit belongs to the GATED command not a wrapper. - [a carried job count is a stale census of the workflow](a-carried-job-count-is-a-stale-census-of-the-workflow.md) deployah 2026-09-10 v0.69.0: my commune carried "SIX job keys" for golden.yml while WARNING not to assume ci.yml's five; at candidate a9e786b2 it is SEVEN keys (n1-gate missing from my list) and NINE ROWS (test + n1-gate are 2-runner matrices). Enumerate jobs from the workflow AT THE RUN SHA and expand every matrix before reading any run. ## Moved 2026-09-08 (VERBATIM from MEMORY.md Gate & test craft, 7 entries) - [leaked daemons from e2e batteries break the NEXT build as exit 101](leaked-daemons-from-e2e-batteries-break-the-next-build-as-exit-101.md) ⭐ 2026-09-08 x3: holder == compile red at the exit surface; kill own-tree spt.exe by verified path before cargo, refuse exit 5. - [a named line is a SAMPLE; census the whole file for the shape](a-named-line-is-a-sample-census-the-whole-file-for-that-shape.md) hertz 2026-09-08: third stale literal at quickstart:153; WMI daemon cells run single-threaded or they red at setup. - [PRE-SEED the exit file with a VOID sentinel before the leg starts](pre-seed-the-exit-file-with-a-void-sentinel-before-the-leg-starts.md) ⭐ hertz 2026-09-08: a kill runs no trap and leaves an absence that reads green; sentinel first, integer overwrites, reader refuses anything else; 15/15 positive controls. - [a job list read EARLY in a run is not the run's job set](a-job-list-read-early-in-a-run-is-not-the-runs-job-set.md) ⭐⭐ 2026-09-08: twohost jobs materialize late; I released a battery onto the box twohost-a was starting on; the release word is run.status==completed, never a job's state through a name filter. - [a needle in SOURCE form cannot match a raw with ESCAPED quotes](a-needle-in-source-form-cannot-match-a-raw-with-escaped-quotes.md) 2026-09-08 x3: reconcile per-cell greps against the Summary counts; 0 run = VOID; print text beside counts. - [a path-predicate builder census is INTERMITTENTLY blind](a-path-predicate-builder-census-is-intermittently-blind.md) ⭐ todlando 2026-09-08: cargo runs with a BLANK command line; census cargo/rustc/clippy-driver box-wide and refuse on any. - [a commit that says cells WILL RED names the cells to run](a-commit-that-says-cells-will-red-names-the-cells-to-run.md) ⭐⭐ 2026-09-08 golden red #272: 3 pre-existing spt e2e cells unrun since W1; run the changed seam's CONSUMER crates in full, not only the added cells. - [a run-level conclusion is NOT an attempt's verdict](a-run-level-conclusion-is-not-an-attempts-verdict.md) ⭐ 2026-09-09 (mine, golden #272 r2): `gh run list --json conclusion,createdAt` describes the RUN — conclusion = the LATEST attempt, createdAt = ATTEMPT 1 — so I named attempt 3's already-triaged red as "a4 HAS READ and it is RED" to the gater who set the hold, and called an 18:17Z CREATION a 7-hour-old terminal. Attempt 4 had not been fired. A stale red and a fresh red render IDENTICALLY at run level, so re-reading the same object harder never catches it: read `run_attempt` in the SAME command as the verdict, cite the job's own finish (`--json jobs` / `--attempt N`), and let the hold-setter release the hold. - [a mid-run job list OMITS unmaterialized dependents](a-midrun-job-list-omits-unmaterialized-dependents.md) ⭐ 2026-09-09 golden #272 r2 a4: `--json jobs` lists only STARTED jobs, so `needs:`-gated `twohost-a`/`twohost-b` were absent and the six-job read became "only hfenduleam is in this run" — kitsubito was in it all along (golden.yml :1029/:1176, both `needs: test`). Under a quiet-box hold that authorizes work on a box the run is about to take. Scope = the workflow's `needs:`/`runs-on:` edges at the sha, never the live list. OPPOSITE-DIRECTION trap in the same graph: both twohost jobs are `if: !cancelled()` (:1023-1026 — `needs: test` is only a rendezvous barrier), so a RED on test does NOT end the run or free the boxes. - [proved the CELL, never ran the LANE](proved-the-cell-never-ran-the-lane.md) ⭐ 2026-09-09 r3 assembly, mine, twice in one lane: reported a rider "GREEN BOTH PLATFORMS" off CELL timings, then clippy red it (`needless_late_init`, same file:line on BOTH OSes); a second rider whose SHAPE the gater had accepted red on `items_after_test_module`. Neither defect was reachable from the cell I ran. A cell result is evidence about a cell; a rider is admitted by the LANE. Run the gate's own legs with its own flags before saying green, and name which leg produced it. Check the toolchain before blaming drift (clippy 0.1.96 ac68faa20c matched the runner, pinned by rust-toolchain.toml). ## Moved 2026-09-09 (VERBATIM from MEMORY.md Gate & test craft, 4 entries) - [job scope comes from the WORKFLOW GRAPH, not the live job list](job-scope-comes-from-the-workflow-graph-not-the-live-job-list.md) 2026-09-09 (doyle made it too): `--json jobs` lists only MATERIALIZED jobs, so an unstarted `needs:` dependent reads as 'not in this attempt'; retained jobs DO appear with old timestamps, so the list looks complete. Also: twohost carries `!cancelled()`, so a test red neither ends the run nor frees the runners. - [probe the EVENT PATH, not a prerequisite of it](probe-the-event-path-not-a-prerequisite-of-it.md) 2026-09-09: Monitor probe exercised `gh`, event lines piped `jq` which is OFF PATH -> stderr only, 8 completions, ZERO events, and I had told doyle it could not go silent. Emit a REAL event first; use `gh -q` not `| jq`; read the output FILE before reading quiet as calm. - [`gh run list --commit` needs a FULL sha](gh-run-list-commit-needs-a-full-sha.md) - short sha returns a confident EMPTY on a run that EXISTS, reading as "golden never triggered"; measured by varying only sha length at one sha. Runbook pin idiom walks into it; false read invites a re-push/dispatch that runs SERIAL and costs a window. - [a run-level conclusion is NOT an attempt's verdict](a-run-level-conclusion-is-not-an-attempts-verdict.md) ⭐ 2026-09-09: told the gater who set the hold "a4 HAS READ and it is RED" off `gh run list` — that conclusion is the LATEST attempt (3, already his) and `createdAt` is attempt 1's, read as a 7 h old terminal. Read `run_attempt` in the same command as the verdict; the hold-setter releases the hold. Full entry in [[GATE-TEST-INDEX]]. - [a terminal-exit watcher is BLIND to a rerun of the same run](a-terminal-exit-watcher-is-blind-to-a-rerun-of-the-same-run.md) 2026-09-09 v0.68.0 golden r3: a rerun KEEPS the run id, so `status==completed` is already satisfied by the DEAD attempt — the watcher exits within seconds printing a plausible verdict about the WRONG attempt. Bind the exit to `run_attempt >= `, read jobs at /attempts//jobs, and verify the advance IN the dispatching script, not a later read. - [a FAILING step masks the job-budget wall behind it](a-failing-step-masks-the-job-budget-wall-behind-it.md) ⭐ 2026-09-09 v0.68.0 r3 a2: a `timeout-minutes` kill reports as **`cancelled`, never `failure`** (50 min budget, killed at 49m59s) — so compute duration vs budget BEFORE any cancellation story. And a red SHORTENS a job (short-circuit to cleanup), so fixing it makes the job LONGER: attempt 1 fit in 48m39s *while failing early*, attempt 2's green Phase B ran four steps further and died at the wall with the whole docs block unexecuted. A late gate can be STRUCTURALLY UNREACHABLE while every skip is correctly attributed to the failure above it — "has never passed" and "cannot pass at this budget" look identical from a skip. - [an exhaustive match pins PLACEMENT, not walk-list MEMBERSHIP](an-exhaustive-match-pins-placement-not-walk-list-membership.md) ⭐ 2026-09-09 releases#289 c2: added a variant; both renderers are `_`-free so PLACEMENT was forced, but the two walk TESTS iterate HAND-TYPED arrays and my variant was in neither - build, 5 unit, 4 int, treqs ALL GREEN, and the one it was missing from is the render guard that catches the exact lost-backslash collapsed literal I had just written. The `len` assert beside such a list passes because the LIST did not change. Grep the enum name across tests for array literals after adding any variant; a STALE COUNT in a doc comment is the thread to the walk that did not follow the change. - [censusing a VERB's callers is not censusing a REFUSAL's reach](censusing-a-verbs-callers-is-not-censusing-a-refusals-reach.md) ⭐⭐ 2026-09-09 releases#289: installed a guard in 6 verbs, censused their 14 call sites, gater checked the table - CI still red, because five EXISTING cells hand a blocking Brain to `wan_send_with`, which sits ABOVE the verb and passes the same `&mut Brain` down. Walk UP from the guard to the CONSTRUCTORS, count test callers, and run ci.yml's unit SET (`nextest --workspace -E 'kind(lib) + kind(bin)'`) not a name filter over it - a filter answers "did MY cells pass", never "did I break someone else's". - [a fixed probe window without a rendezvous mints a FALSE box red](a-fixed-probe-window-without-a-rendezvous-mints-a-false-box-red.md) ⭐ 2026-09-09 hertz dir 2 att1: A listened 10 s, B behind cargo on Windows sent late, INBOUND_BLOCKED at 10.24 s = the text the real 7509 drop prints; window = peer's proven presence (budget listen + ACK + beacon over the open direction), never a fixed span. - [a --no-run warm-up does not build the FIXTURES a test shells out to](no-run-warmup-does-not-build-the-fixtures-a-test-shells-out-to.md) ⭐ doyle 2026-09-10 releases#294 rig: `--no-run` exit 0 on both arms, then the smoke leg died in 0.025s on `required test fixture mock-session is missing` (sibling_bin, common/mod.rs:263; fixtures live in mock-adapter) — all six contract legs would have red-flashed as arms. Assert fixture files before the first measured leg; ALWAYS run one smoke leg before a multi-leg run. Also: `bash driver.sh | tail -N` in background hides ALL progress until exit. - [proving two CI arms' populations are comparable](proving-two-ci-arms-populations-are-comparable.md) ⭐ releases#294 2026-09-10: 5 checks each fail their own way — static counts, NET counts hiding 6 removals, a PASS|FAIL extractor blind to LEAK rows, a CIRCULAR name search, disjoint-commit reasoning from ONE pair of six. Validate the extractor against the Summary count FIRST; nextest partitions by BINARY, so diff binary-phase membership, then identities, then commit removal sets, then bodies. Logs carry it all — no build. - [a whole-run predicate stays silent through the part you watch](a-whole-run-predicate-stays-silent-through-the-part-you-watch.md) deployah 2026-09-10, golden 34481993681: test(Windows) concluded failure at 13:58:10Z and I reported "nothing terminal" for 12 more minutes -- the poll waited for ALL jobs terminal while !cancelled() twohost legs ran on, and its conclusion collector printed concl=[] even after a failure. Notify on JOB TRANSITIONS, emit every terminal state, selftest the collector against a known-bad job AND a known-good one, and stamp the OBSERVATION time not the send time. - [a budget INSIDE the measured tail is a coin flip, not an assertion](a-budget-inside-the-measured-tail-is-a-coin-flip.md) ⭐⭐ doyle 2026-09-10, how releases#294 Finding 1 finally classified: sync.rs:109 wait = 400x25ms "10s budget"; IR95-SYNC margins rep1 176/400 @4.448s PASS, rep2 392/400 @9.940s PASS (2% headroom), instrumented CI 400/400 CENSORED at 10.16-10.20s FAIL 2/2 (hertz: an expiry is RIGHT-CENSORED, never a sample — it cannot separate delayed from absent/filtered, so the tail has NO upper endpoint and 'widen past the tail' is unspecifiable), Linux same cell 1.523s. ipc<1% = the budget MEASURES product latency. A threshold inside the distribution makes pass/fail JITTER, so no single-variable pair ever closes (we hunted twohost+event; both measurably inert) and near-miss PASSES hide it. Instrument margin on SUCCESS; ask "is the threshold inside the distribution" BEFORE pairing arms; never bare-widen. - [the floor to read is the one in the JOB you fire, per OS](the-floor-to-read-is-the-one-in-the-job-you-fire-per-os.md) ⭐ deployah 2026-09-22 #318 a1: quoted the 32 GiB Linux floor, Windows test job floor is 128 GiB; runner read 108.9 GiB after its own reclaim and went RED pre-cargo. Grep EVERY floorBytes value with job+OS; the runner FLOOR_START line is the meter.