---
name: remedy-must-run-from-refusal-state
description: A printed remedy/heal command must be executable FROM the state that prints it — prove by running it verbatim from the refusal; units cannot see this class.
metadata: 
  node_type: memory
  type: project
  originSessionId: 520cc386-a467-49d9-b1f9-c90853dfed9b
  modified: 2026-08-02T11:08:53.941Z
---

A guard's refusal message printed `cargo run -p xtask -- pool-claim ...` as the remedy — but xtask depends on the guarded crate, so BUILDING the claim tool went through the very pool being refused. The operator is told what to do and then prevented from doing it: a dead end wearing a suggestion (hertz, releases#103 leg 1, 2026-08-02).

**Why:** to a unit test the remedy is just a string; to a person it is a promise. No unit suite over the decision function can detect that the promised command is unbuildable/unrunnable from the refusal state.

**How to apply:** whenever a surface prints a command-shaped remedy (heal line, claim command, re-run-elevated), (1) design so the escape hatch LEADS the remedy — the sanctioned crossing is the one path allowed through the guard; (2) assert in a unit that every command-shaped remedy carries the hatch; (3) prove in the field by running the printed line VERBATIM from the refusing state. Related: [[instrument-soundness-guards]], [[key-must-ride-the-crossing-artifact]].

**Reading a hatched claim (todlando + hertz + my W3 re-run, 2026-09-08 — two retractions in one thread):** the hatch is required for the CLAIM LEG ALONE (the claim tool builds through the pool it claims). Do NOT read "later raws carry no banner" as proof the guard passed clean: (a) cargo REPLAYS the claim leg's banner into any later leg sharing that build-script unit ([[cargo-replays-cached-build-script-warnings]] — seen a 3rd time: my 4-xtask.raw carried the banner naming the owner BEFORE my claim, so it was minted in leg 0); (b) build.rs:10-32 re-runs on TREE ALTERNATION (fingerprint carries CARGO_MANIFEST_DIR), not every build — consecutive A A A A fires it once, and a clean pass PRINTS NOTHING, so "no banner" = "ran clean" OR "never ran", indistinguishable in the raw. The only argument that survives is from CONTENT: a banner naming a pre-claim owner was minted in the claim leg. Judge the pool from POOL-OWNER.json + whether the var was set in the invocation. Register rider: a one-line clean-path announcement would make the pass observable. A released pool records the LAST claimant as its owning tree ('released, still owned by X'), so the next lane's claim from another tree hits SPT_POOL_FOREIGN + 'lane: <none claimed>' by construction — expected, hatch it once.
Addendum (todlando, same thread): a build script that FAILED (SPT_POOL_FOREIGN refusal) is not a cached success and re-runs on the next invocation regardless of alternation — which is why a refused claim followed by a hatched claim from the SAME tree still prints the banner. Falsifier (replay vs hatch: re-run one leg with the var unset on a warm pool) SKIPPED for W3 by ruling — not in the verdict's evidence set.
**THE POOL CAN ANSWER (hertz 2026-09-08 13:16Z):** `target/debug/build/spt-store-<hash>/invoked.timestamp` is stamped WHEN the build script ran and the sibling `output` holds what it printed — a fresh timestamp + 0-byte output = 'ran, passed silently', the state the raws cannot show. Read-only, survives the run. Limits: per-UNIT hashes (3 stamps != 3 legs) and no leg/agent attribution — match by time against driver.log LEG START lines (my W3 re-run: 13:11:11Z hatched = my leg 0-claim; 13:12:04Z / 13:14:22Z silent = legs 2 and 4/5). Register rider: the DRIVER prints POOL_GUARD ran=<ts> banner=<none|text> per leg from those files.
Limit (todlando): invoked.timestamp is OVERWRITTEN IN PLACE per unit — it records the LAST invocation, not a log; it can prove the guard ran on a passing leg and time-EXCLUDE an agent, but never reconstruct a battery another battery has run over. The driver rider copies the stamp per leg before the next run destroys it. (Attribution closed 2026-09-08: the 13:11:11Z hatched stamp was my own leg 0-claim.)