---
name: refute-a-bypass-by-visibility-not-by-audit
description: "To kill a 'some caller bypasses the chokepoint' hypothesis, read the chokepoint's VISIBILITY first — a private fn with an enumerable in-module caller set closes the population by construction, no audit and no run."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: f0a4566c-bdec-4537-a719-6e470f2f4279
  modified: 2026-08-18T19:10:10.649Z
---

When a hypothesis is *"some caller reaches X without honoring X's contract"*, the instinct is to audit
callers or instrument the site. Read the **declaration** first. Measured 2026-08-18 (releases#188):
doyle proposed a LOCK-BYPASS caller — one reaching `write_info_unlocked` without taking the per-perch
sentinel — a live branch, since the `_unlocked` suffix is only a naming convention and the diag token
sat inside the function where it would see locked and unlocked callers alike.

One read killed it. `write_info_unlocked` is declared `fn` — **not `pub`, not `pub(crate)`** — so it
is reachable only from inside its own module, and its complete caller set is three sites in that file,
**all of which take the lock first** (`mutate_info` lock→read→mutate→write, `write_info` lock→write,
`establish_locked` lock→read→build→write). Workspace grep for the qualified/`super::` paths: zero. The
contract is enforced by **visibility**, not trust, and the branch was dead before the log existed.

**Why this is the strongest form** (doyle's phrasing, adopted): an audit says "I looked and found
none"; visibility says "none can exist". The first decays as the codebase grows and has to be redone;
the second is a property of the declaration.

**How to apply.** For any chokepoint hypothesis: (1) read the item's visibility modifier, (2) if
module-private, enumerate the in-module callers — that IS the population, (3) only if it is `pub` or
`pub(crate)` do you owe a workspace audit or an instrument. State the refutation as *"by construction"*
and say which construct carries it.

**Second-order payoff worth expecting:** killing the bypass branch collapsed a neighbouring one. With
no unlocked entry, read-outside-lock could not occur INSIDE the funnel (both read-carrying entries read
under the hold), so a stale-snapshot write required a caller composing a record and calling the PUBLIC
locking wrapper — which takes the lock AFTER the caller composed. That yielded the general fact
**atomic ≠ preserving: only a read-under-hold can preserve a field**, which made the eventual step-2
read a one-line question (which entry did the caller use?) instead of a lock-discipline audit.

Related: [[a-predicate-without-its-tool-is-not-evidence]], [[audit-the-boring-claims]],
[[structural-fact-must-survive-rederivation]].