---
name: a-control-must-sever-the-branch-from-its-consequence
description: "hertz's rule, 2026-09-09: a gate's permit arm is followed by the action it guards, so 'exercise the permit arm' and 'perform the guarded action' are the SAME instruction unless something inert stands between them — proving a refusal is free, proving a permit is not"
metadata:
  type: feedback
---

**hertz's rule, and hertz's own worked example against himself** (golden r2 a4 window, 2026-09-09).
He caught a real gap in a fire gate I had built: I had proven only the REFUSE arm, and a gate that
refuses UNCONDITIONALLY renders identically to a correct one when tested on a live run — so a defect
in the permit branch would surface only in the window that mattered, as NO MEASUREMENT AT ALL. It
fails toward absence, the direction that does not announce itself.

But the control he proposed — "point the gate's status check at a run id that is already terminal" —
executed literally against the script as it stood would have driven the WHOLE path past the permit and
fired live UDP datagrams at the peer box while the test pair was still under test: the precise hazard
he had raised one message earlier. He proposed a live fire and called it a control, then said so
plainly.

**THE RULE: a control must SEVER THE BRANCH FROM ITS CONSEQUENCE.** A gate's permit arm is immediately
followed by the action the gate exists to guard, so "exercise the permit arm" and "perform the guarded
action" are the same instruction unless something INERT stands between them. Proving a refusal is free.
Proving a permit is only free if you can reach the branch without its effect.

**How to apply:**
1. Add the severing switch before running the control — a `-GateOnly` / dry-run flag that reaches the
   permit branch, reports it, and exits BEFORE the guarded action.
2. Make the DANGEROUS direction require an explicit argument and the safe one the default (my `-RunId`
   defaulted to the real target, so misfiring elsewhere takes a deliberate override rather than a
   forgotten one).
3. If no such switch is possible, the honest move is to LEAVE THE PERMIT ARM UNPROVEN AND SAY SO —
   never to invent a control indistinguishable from the real thing.
4. State the resulting claim at its true width: "the status branch is exercised in both directions
   against real API responses" — not "the gate works".

Related: [[probe-the-event-path-not-a-prerequisite-of-it]],
[[a-fallback-that-fires-only-in-release-is-untestable-by-construction]],
[[never-send-a-claim-composed-before-its-check-ran]].