A guard whose precondition is discharged by the route that uses it

dag/gunbc/recurring_failure_mode/guard_precondition_discharged_by_the_route_that_uses_it.dag

@@ -0,0 +1,28 @@
+module gunbc.recurring_failure_mode.guard_precondition_discharged_by_the_route_that_uses_it
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data guard_precondition_discharged_by_the_route_that_uses_it: RecurringFailureMode = RecurringFailureMode {
+  identity: "guard_precondition_discharged_by_the_route_that_uses_it" as NonEmptyStr,
+
+  receipts: [
+    "**a guard that stops discriminating because its precondition moved is not a guard that failed -- it is one that was SILENTLY RETIRED, and it will keep reporting PASS forever** (INVALID STATE: a check is current, correct, and executing exactly as designed, and its answer has stopped carrying information because the condition it keys on is no longer reachable on the population it guards. Nothing is stale and nothing is broken. The check is dead and every consumer still reads its PASS as evidence. HARM: a failed check is loud and a retired one is indistinguishable from a healthy one, so the deficit never ranks for repair; worse, the guard continues to be CITED as coverage, and a second mechanism that would otherwise have been built is not built because this one is believed to exist.",
+
+    "RECEIPT, MEASURED ON THIS REPOSITORY THE NIGHT THE ROUTE CHANGED: the generated-artifact merge driver refuses a projection only when BOTH SIDES have changed it since the merge base. gunbc#10302 delegated design-ledger regeneration to the heal job, and its declared repair route instructs the author to COMMIT THE PROVISIONAL BYTES. That commit MOVES THE MERGE BASE, after which only one side has changed the projection, so the driver has nothing left to refuse and reports a clean tree -- over a head that deletes rows from the ledger. THE REFUSAL WAS NOT DEFEATED, IT WAS DISCHARGED, BY THE VERY COMMIT THE ROUTE INSTRUCTS. Two pull requests sat in that state at once, one probing clean while deleting twenty-one rows.",
+
+    "THE PART THAT MAKES IT A CLASS RATHER THAN A BUG IN ONE DRIVER: NOBODY WEAKENED ANYTHING. No rung was lowered, no waiver was written, no code in the driver was touched. A change elsewhere invalidated the driver's PREMISE, and DESIGN section 4b(3) governs DELIBERATE drops -- it has nothing to say about a guarantee that evaporates as a side effect. So this class of regression is structurally exempt from the mechanism built to catch regressions, which is why it can persist indefinitely with every roster and every gate reporting green.",
+
+    "DISTINCT FROM THE STALE-TOOL CLASS, AND THE BOUNDARY IS CLEAN. A superseded tool executing in place of the current one is a VERSION fact and is repaired by installing the incoming copy. This is a PREMISE fact: the tool is the current one, it is correct, and it is running as designed. Different mechanism, different remedy, different row.",
+
+    "ADJACENT TO THE NEVER-AUTHORABLE-RED CLASS AND DELIBERATELY NOT MERGED WITH IT, because the adjacency is the finding. DESIGN section 4b instructs an author to ask whether a check's RED is authorable BEFORE writing the check. That question has no owner once the check is written and shipped: this class is THE SAME QUESTION ASKED LATE, and nobody asks it late. A check whose RED was never authorable is born decorative and can be caught at review; a check whose RED was authorable and SILENTLY STOPPED BEING passes every review it ever had, because it was genuinely load-bearing at the moment it was approved. Same terminal state -- permanently green by construction -- reached from opposite ends.",
+
+    "RECOGNITION RULE: FOR EVERY GUARD, NAME ITS PRECONDITION, THEN ASK WHAT WOULD MAKE THAT PRECONDITION PERMANENTLY FALSE AND WHETHER ANYTHING WOULD NOTICE. A guard whose precondition can be discharged by a ROUTINE, INSTRUCTED ACTION is not a guard, it is a coincidence detector. The sharpest form of the question is whether the route the guard protects is itself capable of satisfying the guard's escape condition, because a mechanism that disarms its own check is not a risk, it is a schedule.",
+
+    "A SECOND-ORDER TRAP FOUND WHILE WRITING THIS ROW, AND THE REASON THE REPLACEMENT CHECK IS STATED AGAINST ZERO. The obvious replacement -- compare the projection against main and refuse on deletions -- was first written by declaring the observed deficit, twenty-one rows. Two hours later, with the branch untouched, it was twenty-three: THE DEFICIT IS A FUNCTION OF MAIN, NOT OF THE HEAD BEING JUDGED, so any declared count expires the next time an unrelated pull request lands. THE COUNT IS DATED, THE PREDICATE IS NOT. Zero is main-invariant and survives every main move, which is why the check must test against zero and never against a number someone measured.",
+
+    "RUNG FOUND AT: mitigatable, and the mitigation is that a reviewer independently compared the projection to main instead of reading the guard's verdict. CEILING: structurally guaranteed -- a guard carrying its precondition as a declared, checkable fact rather than as an implicit property of how it is invoked admits a refusal when that precondition becomes unreachable, so no Accepted program contains a guard that has silently stopped discriminating. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact, and stated so it cannot be satisfied by the instance that produced it: a guard declares the precondition under which its verdict carries information, AND the surrounding mechanism refuses when a guard is consulted on a population where that precondition cannot hold. Repairing the merge driver, or adding one deletion check to one gate, satisfies neither half and leaves every other guard in the tree exposed in exactly the same way.",
+  ],
+
+  evidence: [],
+}

dag/gunbc/recurring_failure_mode/roster.dag

@@ -106,6 +106,7 @@ import gunbc.recurring_failure_mode.subject_and_its_digest_as_independent_parame
 import gunbc.recurring_failure_mode.a_written_row_is_not_a_firing_mechanism { a_written_row_is_not_a_firing_mechanism }
 import gunbc.recurring_failure_mode.required_evidence_absent_reads_as_evidence_of_pass { required_evidence_absent_reads_as_evidence_of_pass }
 import gunbc.recurring_failure_mode.right_censored_cost_read_as_exact { right_censored_cost_read_as_exact }
+import gunbc.recurring_failure_mode.guard_precondition_discharged_by_the_route_that_uses_it { guard_precondition_discharged_by_the_route_that_uses_it }
 
 data recurring_failure_mode_roster: List<RecurringFailureMode> = [
   censored_estimator_drops_its_own_tail,
@@ -203,4 +204,5 @@ data recurring_failure_mode_roster: List<RecurringFailureMode> = [
   a_written_row_is_not_a_firing_mechanism,
   required_evidence_absent_reads_as_evidence_of_pass,
   right_censored_cost_read_as_exact,
+  guard_precondition_discharged_by_the_route_that_uses_it,
 ]