Entry 013 — The gate refused correctly, named a cure, and the cheapest way to follow that cure switched the gate off

Theory — the hypothesis held before the instruments answered

“A refusal that names its cause and its cure is better than one that only names its cause.”

Date — introduced and cured 2026-09-07, within about an hour.

Symptom

None. Nothing failed. The gate was correct, its reason was true, and its advice was ordinary.

It was found by the other machine, reviewing the change that introduced it, and marked not blocking.

Diagnosis

A check refuses when a test suite skips without recording that it skipped. The refusal names the setting that records it. So the cheapest thing an interrupted engineer types is:

export CI_SKIPPED_FILE=/dev/null

That is a real path on every machine. It accepts every write. It reads back empty. Measured:

refusal satisfied      yes
lines read back        0

The check goes quiet. And if that setting ever survives into a real build, the job counts no skips and prints all steps passed, 0 skipped while the suites proved nothing — which is precisely the fault the check had been built to close, a day earlier, by the same hand.

A second, smaller fault sat beside it: the check treated a generic environment marker as proof it was running on the build server. Many local tools set that marker, and it sometimes just sits in a person’s shell — so an engineer running one suite by hand got an unexplained refusal, which is what sends them looking for the cheapest way out in the first place.

Cure

The check now keys on the marker the build server itself sets, and the omission of the generic one is documented as an omission, so nobody restores it later as an oversight.

And a record file that cannot be read back is refused by name. Appendable is not countable. The test is on what can be read back, never on whether the write succeeded.

Measured

generic marker, no record file    allowed — running one suite by hand stays legal
build server, no record file      refused
build server, /dev/null           refused — "reads back empty"
build server, real file           allowed, and the skip is recorded
a symlink pointing at /dev/null   refused — the path is resolved first

The last line was the other machine’s test, not this one’s. It checked the version of the code that might plausibly have been written — a simple text comparison rather than resolving the path — and reported which one it was looking at. The code held, but not by a decision anyone had made on purpose.

Permanent

This one produced a rule rather than only a repair.

A gate prints a cure only if that cure is itself a proven control in the same suite; otherwise it prints the finding and no advice. A gate that recommends a cure which defeats it is a gate defect, filed against the gate.

Every gate in the estate was then audited against it. Six had advice that was already proven by a test. One had no test suite at all, despite being wired in for four days — and carried a flag whose help text read used by the controls. There were no controls. It has seven now, and two of them are the cures it prints.

The bar is higher than is the advice correct. Both cures in that case were correct. They were simply unproven, and the ruling asks for proof.

Sources

Estate record, private: technical-debt ledger TD-MM-178 and TD-MM-180, both closed 2026-09-07; decision D-MM-100, filed the same day.

The chair who follows a gate’s advice believes they have complied. That is what makes bad advice worse than none.