Seven gates report "clean" when they mean "I saw nothing I understood" — make unrecognised a verdict distinct from pass

[claude]

Filed by the PM seat as the Q4 ruling on #9165, which measured this shape rather than assuming it. This is a design card, not a build: the remedy below is a change to how the whole patrol family reports, and that is a maintainer act.

The meta-shape

A gate's recognizer is narrower than the code shapes in the repo, and the shortfall is reported as a VERDICT rather than as "unrecognised."

Seven measured instances, all from this repo, all found within about a day:

Fails toward FALSE RED — self-announcing, cost is a wasted branch

#	gate	the shape it cannot see
#8897	check-durability-degradation-log-level	receiver name
#9657	same	parenthesized callee — (logger.error ?? logger.warn)(…) reads as silent-swallow

These are survivable: someone hits one, files a card, and the truth surfaces. ⚠️ The exception is #9657, whose cheapest satisfaction is actively harmful — the spelling the matcher does accept (logger.error?.(…)) prints nothing against a sink with no error, so "fixing" the false red converts a loud site into a genuinely silent one.

Fails toward FALSE GREEN — never self-announcing, found only by luck

#	gate	the shape it cannot see
#8845	check-durability-log-level	exit shape (the criterion half)
#9165 A	same	publishPackageDrafts — in the census, reported "no invented answer", while its catch pushed a fabricated existedBefore: false
#9165 B	same	getAllObjects — never in the population at all; DRIVER_READ_CALLEES is {find, findOne, count}
#9680	check-engine-double-contract	absence — deleting a pinned double's delete() member took 319 → 318 with exit 0; discovery requires the member to exist
#9708	same	consumer seams — deleting one took 6 in 3 source file(s) → 5 with exit 0; SEAMS_DISCOVERED fires only at zero

This half is the problem. #9165's entire complaint is that both of its instances were discovered "because somebody removed the swallow for an unrelated reason" — a discovery mechanism that fires by luck, and the luck was spent twice in one shift.

Why the obvious remedy is wrong

"Widen each matcher" has been separately priced and separately declined every time:

• check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 declined a 15-red criterion with 7 already-correct sites; PR measure the read-seam rule's catch-fallthrough blind spot, and record the decision NOT to extend (#8845) #8898 recorded the refusal instead of taking it.
• A partial test double is only ever discovered by deleting the catch that hides it — twice this shift. check:engine-double-contract pins engine doubles; nothing pins registry doubles #9165's 2b (teach the read-seam rule getAllObjects) is not a vocabulary addition but a scope change — DRIVER_READ_CALLEES is anchored to IDataDriver's read methods so those generic names mean "a storage seam", and the header prices dropping that anchor at 91 of 314 catch clauses in the scan roots.
• check:engine-double-contract's CONSUMER SEAM population is unratcheted the same way the pinned population was — deleting a seam takes 6 to 5 with the gate green #9708 was filed rather than fixed because choosing error-vs-ledger-vs-distinct-verdict there is itself a design act.

Widening is expensive, per-gate, and leaves the next unrecognised shape in the same place.

The proposal

Make "I could not recognise this shape" a reportable verdict, distinct from "clean."

The germ already exists in this repo, in check-engine-double-contract's DISCOVERED invariant, whose own comment says it best:

Zero is not a clean repo, it is a broken scan.

The generalisation is from zero to delta — and #9680's dev has now demonstrated it works in practice for one population, with the churn numbers to price it: 269 commits on main in a month, pinned-set membership changed in 7 commits (2.6%), 8 files entered per verb, 0 left. The feared nuisance case (a legitimate decrease reddening CI and training everyone to bump a number) fired 0 times in a month.

What that suggests, for the maintainer to accept or reject:

1. Every gate with a discovered population declares it, and reports a shrink as its own verdict — not silence, not necessarily red.
2. A third exit state beside pass/fail: "N constructs in the scan roots matched no rule in this gate's vocabulary." Not a failure. But printed, counted, and visible in a round report, so a recognizer falling behind the codebase is observable instead of inferable.
3. The distinction that matters: a gate saying clean when it means I saw nothing I understood is the single mechanism behind every false-green row above.

What this card is NOT asking for

• ⛔ Not a build. The shape above is a sketch; the design act is the maintainer's.
• ⛔ Not a re-litigation of check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845, A partial test double is only ever discovered by deleting the catch that hides it — twice this shift. check:engine-double-contract pins engine doubles; nothing pins registry doubles #9165 2b, or check:engine-double-contract's CONSUMER SEAM population is unratcheted the same way the pinned population was — deleting a seam takes 6 to 5 with the gate green #9708 — each of those stays declined/open on its own terms.
• ⛔ Not a new required context. The false-green rows argue for visibility, not for more merge-blocking.

Related, each an instance rather than a duplicate

#8897 · #9657 · #8845 · #9165 (the disposition comment carries the full measurement) · #9680 / PR #9712 · #9708 · #8901 (on hold; its restart-when is measured not met — the original cohort is shrinking 25 → 19, not gaining a second)

---

Generated by Claude Code

[claude]

Amendment — an eighth instance, and one candidate examined and rejected

The duplicate scan that preceded this filing (all 234 open issues, title + body) surfaced two cards I had not counted. On reading them: one is a genuine eighth instance and belongs in the false-green half; the other is not this shape at all. Recording both, because a card whose argument is a pattern count is only as good as its willingness to reject near-misses.

✅ #8662 — an eighth instance, and possibly the cleanest one

check-where-matcher-conformance's behavioural control probe admits a candidate only when f(ROW, MATCH) === true and f(ROW, MISS) === false. An inverted survivor filter inside a delete double answers false/true, so it is dropped as OUT_OF_SCOPE — correctly, by the gate's own definition: it is not a row-selecting predicate.

But it carries the identical failure shape the gate exists to catch, one negation away:

const survivors = rowsOf(table).filter(
 (r) => !Object.entries(o?.where ?? {}).every(([k, v]) => r[k] === v),
);

Hand one of these a $or and it is read as an ordinary field name; row.$or is undefined; .every() returns false; the negation makes it true — and the row survives a delete that should have removed it. The suite then asserts against a table that was never modified, with nothing erroring.

Measured on #8615 / PR #8661: of 64 new structural candidates, the control probe seated 62 and dropped 2, both this shape.

This belongs in the FALSE GREEN half, and it sharpens the card's thesis rather than merely adding a row: OUT_OF_SCOPE here is a correct verdict under the gate's own definition, and it still reads as "nothing to see." The recognizer is not broken — it is honestly reporting a category that happens to be indistinguishable from clean to every consumer of the output. That is the strongest possible argument for a third exit state: no amount of fixing the matcher helps, because the matcher is right.

⚠️ #8662 is pm:on-hold with its own restart-when (a PR touching check-where-matcher-conformance.mjs, its baseline, or the FIXTURE_CAPTURED_NEGATED fixture, or a third inverted survivor filter appearing in a sweep). This card does not trigger it and is not a request to restart it.

⛔ #9236 — examined and rejected, not this shape

driver-memory's filter switch carries a not in (space-spelled) arm for a spelling AST_OPERATOR_MAP does not define, so isFilterAST is false, canonicalAstOperator returns the input unchanged, and metadata-protocol answers unrecognised operator "not in".

That is the inverse shape: an implementation accepting more than the vocabulary defines, not a gate's recognizer being narrower than the code. Its unreachable arm is a dead branch, not a silent pass. It does not belong on this card, and folding it in to make the count nine would have been exactly the pattern-inflation this card should be judged for avoiding.

Revised count

Eight instances: 2 false-red (#8897, #9657), 6 false-green (#8845, #9165 A, #9165 B, #9680, #9708, #8662).

The ratio is the point. The self-announcing half is the minority.

---

Generated by Claude Code

[os-support-ai]

Triage (triage seat, session session_014v3dpZ2224xgf98dfY4rw4): removed the finding label — finding means "awaiting first grading", and this card was filed already graded into the decision inbox (needs-user-decision, design card, maintainer act). Carrying both is a half-state the sweep would re-visit every round. No other change; the card and its eighth-instance amendment stand as filed.

---

Generated by Claude Code

[os-support-ai]

Maintainer ruling recorded (2026-08-18, live chat with the triage session session_014v3dpZ2224xgf98dfY4rw4; authorization verbatim: 「其他接受你的建议」, accepting the recommendation presented in that session, restated here as the operative ruling).

Ruling: direction accepted — proposals 1 and 2, visibility-only, piloted before generalizing.

1. Every gate with a discovered population declares it and reports a shrink as its own verdict (the check:engine-double-contract has no ratchet on its DISCOVERED population — deleting a pinned double's delete() member takes 319 pinned to 318 and the gate stays green #9680/check:engine-double-contract's CONSUMER SEAM population is unratcheted the same way the pinned population was — deleting a seam takes 6 to 5 with the gate green #9708 delta-ratchet generalization of "zero is a broken scan").
2. A third exit state beside pass/fail: "N constructs in the scan roots matched no rule in this gate's vocabulary" — printed and counted, visible in round reports; not a failure, no new merge-blocking context (proposal 3's framing accepted: visibility, not more required gates).

Pilot first: the durability family (check-durability-log-level / check-durability-degradation-log-level) and check-engine-double-contract, measuring the nuisance rate the way the #9680 dev did (legitimate-decrease reds per month) before extending to the rest of the patrol family. Implementation splits into ordinary tooling cards; #8845 / #9165-2b / #9708 stay declined/open on their own terms per this card's own scoping.

Label: needs-user-decision → pm:queue, type Task, domain:devx.

---

Generated by Claude Code