---
name: censusing-a-verbs-callers-is-not-censusing-a-refusals-reach
description: "A guard installed inside a verb is reachable from every function ABOVE it that passes the same handle down — so a census of the verb's call sites is not the census the guard needs, and it passes review while a caller one layer up still trips it."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 49302556-9da6-4935-bef4-5d1ca3f941f7
  modified: 2026-09-09T12:35:32.949Z
---

Measured 2026-09-09 (releases#289, todlando; caught by CI, not by me or the gater).
`refuse_unbounded_carrier` was installed inside six `wan.rs` verbs. I censused
**callers of those verbs** — 14 sites, every one converted to the pump carrier,
tabled in the PR, checked by doyle. CI still red on Linux unit: five existing
cells hand a hand-built blocking `Brain` to `wan_send_with`, which sits ABOVE
`request_wan` and passes the same `&mut Brain` down. The seam's own refusal
fired, exactly as designed, from a caller neither census listed.

**Why:** "who calls the guarded function" and "who can reach the guard" are
different sets, and the second is the one that fails. A handle passed by
reference makes every function on the path a de-facto caller, so the census has
to run UP the call chain from the guard until it reaches something that
CONSTRUCTS the handle. Both of us stopped at the verb because that is where the
code changed — the guard's reach is not visible in the diff.

**How to apply:**
- Census the guard, not the change: from the guarded call, walk outward through
  every function that takes the same handle as a parameter, and stop only at
  constructors. Name the constructors — those are the sites that must change.
- Test callers count. Rigs build handles by hand and are invisible to a
  production-path census.
- **Run the CI set, never a name filter over it.** doyle's gate was a 9-cell
  filter over the `spt` bin; the defect was in a cell the filter did not name.
  The leg that caught it was `cargo nextest run --workspace -E 'kind(lib) +
  kind(bin)'` — `ci.yml`'s exact unit set — which is now what I run before
  declaring a lane done. A filter answers "did my cells pass", never "did I
  break somebody else's".
- Kin: [[an-exhaustive-match-pins-placement-not-walk-list-membership]] (the
  compiler pins what it can see; the rest is a hand-built list) and
  [[a-coverage-fix-is-measured-over-the-population-it-claims]].