---
name: source-read-needs-its-sha-and-ancestry
description: "A source-read finding is a claim about a TREE — check HEAD's ancestry vs the golden head before reporting, or you report a real defect that is already fixed at the tip"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: fa318e90-f559-40d6-8edd-bb4863516cb6
  modified: 2026-08-04T18:15:52.066Z
---

2026-08-03: I root-caused a real bind-conflict ABA (recycled pid ⇒ perch permanently unbindable),
measured it rigorously, and it was **already fixed at the golden head**. My working tree was
`932e14b`; golden was `b7b00c3`; `git merge-base --is-ancestor 932e14b b7b00c3` = TRUE — main had
not fast-forwarded, so I read pre-fix source all day. Between the two shas `api/auth.rs` gained 122
lines and `api/startup.rs` 384. doyle had independently "CONFIRMED @932e14b" — **the same stale
tree**, so peer corroboration did not catch it either. It surfaced only when he asked whether my
finding was pre- or post- the v0.53.0 bind-ownership fix.

**Why:** ⭐⭐ [[verify-the-subject-not-just-the-measurement]] applies to SOURCE READS, not just CI
greens. Neither my measurement nor my reasoning was wrong — the SUBJECT was. A grep, a line number,
and a quoted snippet are all claims about one tree, and none of them carry which tree. Cost: a full
report, a board filing (releases#134), a register correction, and a stage-1 population audit, all
against source that no longer existed at the tip. The population list and its line numbers had to be
thrown out and re-cut.

**How to apply:** before reporting ANY finding derived from reading code — `git rev-parse HEAD`, and
check ancestry against the shipping head. Name file AND sha in the report
([[name-the-file-and-sha-a-condition-came-from]]). On a shared checkout that others fast-forward,
assume your HEAD is behind until measured. When a fix is rumored to exist, diff the SITE across the
two shas rather than re-reading your own tree more carefully.

**ADDENDUM 2026-08-04 — the POSITIVE form: a stale-tree read can be made valid, and showing that is
cheap.** Chasing the USHER #150 golden red I read `cmd_listen`'s `--once` path from a working tree at
`8f291e1` (main) to make a claim about golden head `fc7fad1` — which does NOT contain my HEAD. Rather
than re-checkout or hedge, I ran `git diff 8f291e1..fc7fad1 -- <the one file>`: two COMMENT lines,
zero code delta. That makes the read byte-identical on the golden head and the claim transfers, stated
as evidence instead of assumption. **The rule is not "never read a stale tree" — it is "a read is
scoped to a tree until you show the SITE is unchanged between them."** One targeted path-scoped diff
converts a worthless read into a sound one, and it costs one command. Note the polarity: an EMPTY diff
at the site is the proof; a non-empty one means re-read at the real sha, never "probably fine".

⭐ Secondary, and it caught both of us: doyle ruled `Unproven ⇒ ALLOW` and I proposed
`Unproven ⇒ refuse`. The shipped code does NEITHER — it defers to the OLD predicate where the birth
oracle is unavailable, because `process_started_at`'s `unix, not(linux)` arm returns `None`
UNCONDITIONALLY, so an allow-ward default would delete squat protection platform-wide. Two people
reasoned about a tri-state's default without measuring what PRODUCES the third state.
See [[create-no-window-inert-under-detached-process]] for the same-day sibling: flag presence ≠ flag
effect, and source is not where interaction is decidable.