---
name: a-guard-bijected-to-the-wrong-enum-is-silent-by-design
description: "An exhaustive wildcard-free census proves only what its own enum enumerates; a new variant in a DIFFERENT enum leaves it exhaustive, intact, and silent — check which enum the guard is bijected to before crediting it."
metadata: 
  node_type: memory
  type: project
  originSessionId: 647d4f03-29ab-46a0-9169-2127c05a8d66
  modified: 2026-09-07T10:52:46.548Z
---

A wildcard-free `match` + a bijection assertion is the strongest compile-time guard in the tree, and
it is scoped to **one enum**. Adding a variant somewhere else keeps the match exhaustive, keeps the
bijection intact, and produces no error — so the guard reads as protecting a thing it structurally
cannot see.

Measured 2026-09-07 at `f3c8495b` (W2 WEBSERVE #272, F17): `crates/spt-daemon/src/dispatch.rs`'s
`census_index` is a deliberately wildcard-free match over **`StreamFamily`**, bijected against
`StreamFamily::ALL` (assertion ~line 2607), with a doc comment arguing that a new variant must be a
compile error rather than a count to remember. `WebRecord::ServeFor` was added to the **wire** enum
(`crates/spt-net/src/net/webmsg.rs:43`, `#[serde(tag = "kind")]`), adding no `StreamFamily` variant.
The census stayed green; the dispatcher dropped every `serve_for` stream as `Unknown`.

The paired test misses it for the same reason: `webmsg.rs:178` asserts the dispatcher tag on
`records[0]` only, and `records[0]` is the one variant that IS matched. Extending that assert to all
indices would be **wrong** — `WebChunk`/`WebErr` legitimately carry kinds the dispatcher must not
classify. The missing decision is per-variant, so the guard must be per-variant.

**Why:** "exhaustive" is a statement about a domain, and the guard's domain is its own enum, not the
system's behaviour. Two enums in a producer/consumer relationship need the bijection on the
PRODUCER side (the wire variants), pointing INTO the consumer side.

**How to apply:** before crediting a census/bijection guard, name the enum it matches on and ask
whether the change you are shipping adds a variant to THAT enum. If not, the guard is silent for
your change. The fix shape is one arm per producer variant declaring `FirstLine(<family>)` or
`NeverFirst`, plus a test that encodes a specimen per `FirstLine` arm and asserts the consumer
returns that family and never `Unknown`. Precedent for one family owning several kinds is already in
tree: `sealmsg` registers `SEAL_KIND` + `SEAL_ENROLLMENT_KIND` against one family.

Related: [[a-source-read-cannot-witness-an-integration-cell]],
[[a-stricter-meter-answers-a-confident-empty]].