Entry 009 — Every debt id contained a ruling id, so the gate that guards operator work had an exception on almost every commit

Theory — the hypothesis held before the instruments answered

“Deleting anything under the protected directories requires citing a filed decision. That is a deliberate act nobody performs by accident.”

Date — introduced long before, found and cured 2026-09-07.

Symptom

None. Nothing failed, nothing was lost, and no alarm sounded. The gate was found by a probe written to fail on purpose: a change was committed with no decision cited, expecting a refusal.

It was allowed through. The reason it printed was worse than the outcome:

admitted on a cited ruling id

The message said no decision at all.

Diagnosis

Two kinds of identifier live in this estate. Decisions are numbered D-MM-060. Problems are numbered TD-MM-170. The gate recognised a decision with an unanchored pattern:

D-[A-Z]*-?[0-9]+

Unanchored means it matches anywhere in a longer string. And every problem id contains a decision id — TD-MB-122 contains D-MB-122; TD-007 contains D-007. Measured:

'close TD-MB-122'   matches   D-MB-122
'TD-007 cured'      matches   D-007

Naming the item you are working on is the single most common thing a message in this estate says. The exception was therefore available on nearly every commit ever made.

The same pattern was the exception for two gates, not one. The other protects drafts, templates, receipts and source documents — the human work product — from being deleted or moved.

Cure

The pattern requires a non-letter before the D. The shell form matches it rather than asserting it, because the shell’s regular expressions have no way to look backwards:

(^|[^A-Za-z])D-[A-Z]*-?[0-9]+

A form using a word boundary was tested and rejected: a hyphen is itself a word boundary, so it still matched the D inside TD-. That was checked, not assumed.

Measured

'close TD-MB-122'   no match   gate holds
'TD-007 cured'      no match   gate holds
'under D-MM-066'    match      exception open, correctly
'D-048'             match      the older un-namespaced form still works

The last line matters as much as the first. A gate that stops recognising legitimate authority is a gate people route around.

Permanent

Both checking suites gained a new test, and the wording of both is the point:

• a message carrying an item id and no decision → refused
• the same deletion citing a real decision → allowed

The suites had been green for days. Their refusal tests all used messages with no identifier; their permission tests used real decision numbers. Nothing tested the space between — a string that looks like a citation and is not.

That is the reusable part. A suite that tests only valid and absent has not tested the gate. The dangerous input is the one that is neither.

Sources

Estate record, private: technical-debt ledger TD-MM-170, opened and closed 2026-09-07.

The exception was one ordinary sentence away, on every commit, for as long as the gate existed.