---
name: never-forge-a-token-that-was-deliberately-withheld
description: "2026-09-08: my reap script gated on doyle's literal release word 'run terminal'. He ordered the reap while explicitly REFUSING to send that word, because the run was not terminal. The fix is a second authorization path, not typing the word myself."
metadata:
  node_type: memory
  type: feedback
---

I armed a destructive reap behind `-Word "run terminal"` — the gater's release token. He then ordered
the reap in plain words and said outright that he would NOT use that word, because the golden run was
not terminal and the word means something specific. The shortest path was to type it myself and get
on with it. That would have written a false record: the log would have said the run was terminal.

**Why:** a gate token is a CLAIM ABOUT THE WORLD, not a password. Typing it to satisfy my own script
would have laundered my convenience into someone else's assertion, in the one artifact anybody would
read afterwards to learn why 124 GB was deleted.

**How to apply:** give the script a SECOND authorization path that records what actually authorized
it — `-ExplicitOrder "<their words>"`, printed verbatim as `authorized-by:` — and keep the token
path meaning only what the token means. Same discipline as an override that says so on every line it
allows (`SPT_POOL_UNCHECKED`, and the `-AllowBuilders` + required `-BuildersReason` I added beside
it): there is no silent override, and no borrowed authority.

Generalizes: whenever a guard's condition and the real-world justification diverge, ADD the honest
branch rather than satisfying the dishonest one. Related:
[[a-sound-check-can-carry-an-oversized-sentence]].