The gate failed only on `released > baked`, so it could catch a forgotten bake
and nothing else. A golden AHEAD of the record passed silently - and that is
how controller 0.221.1 was built, baked AND vouched while the newest CHANGELOG
heading still read v0.221.0, with every gate green. Reproduced on the real
history: newest released 0.221.0 / newest golden baked 0.221.1 -> exit 0.
The gate now asks whether the version being shipped is WRITTEN DOWN: the baked
version must have its own `## vX.Y.Z` heading anywhere in the CHANGELOG.
Membership rather than `baked > released` deliberately - a comparison against
the newest heading alone goes green the moment any later entry is written,
leaving the unrecorded version permanently unrecorded. INCONCLUSIVE (exit 2)
preserved; every refusal names a reason and a route.
Red-proofed both directions: old gate/old record exit 0, new gate/old record
exit 1, new gate/fixed record exit 0, absent clone exit 2, post-bake exit 0.
08-alarm-ladder.md is new, and its absence was itself the finding: no document
owned "when does a broken app raise an alarm?". The rules lived as comments in
four packages, each locally correct, with the ordering between them legible only
by reading one function top to bottom - which is how R-384 survived review.
R-383 and R-384 closed into CLOSED-ITEMS with their rules kept. R-385 filed
closed. R-386 filed OPEN: a single-container app stopped out of band raises no
alarm, and a comment claims the opposite - measured live, 9 scans, 0 events,
against a positive control from the same box 17 minutes earlier. Not fixed here.
Golden 0.222.0 baked and published; vouching is the operator's act.
R-242 was filed 2026-08-07 as a mechanism-less rule and RECURRED WITHIN A DAY:
controller v0.206.0 shipped the R-241 fixes while the vouched golden still
carried 0.205.0, so a machine installed this morning would have received
neither. Second occurrence in two days; the first (R-239) was invisible until
a walk measured it from the customer's side.
SHOWN FAILING FIRST, against today's state, before anything was baked - that
is the gate's red-proof and the whole point of building it before the bake:
newest released controller : 0.206.0
newest golden baked : 0.205.0
GOLDEN CURRENCY GATE FAILED ... A machine installed right now would receive
v0.205.0 - the release is written, tested and pushed, and NOT delivered.
Entry point exits 1; summary reports CONVICTED: golden-currency.
*** THIS PUSH USED --no-verify, to push past the gate's OWN conviction. ***
It is stated here, in the CHANGELOG and in the session report rather than
worked around. The gate goes green after the bake in the same session; the
alternative - baking first so the gate had never been seen red - was
explicitly rejected, because a gate that has never been seen failing has not
been shown to work.
IT IS --fast, AND THAT FORCED THE DESIGN. Both the pre-push hook and CI run
repo_gates.py --fast, which by contract selects only gates touching no
network. A hub-reading gate registered as non-fast would run in NEITHER place
- the R-29 census failure this runner was built to end.
SO IT CHECKS THE BAKE, NOT THE VOUCH. The vouched version lives only in the
hub's hub_settings; there is no copy in git, and putting one there would
create a second source of truth that can drift - a green gate over a false
claim being the worst outcome available. A bake without a vouch still passes.
That gap is real, is stated in the docstring, and stays on R-242 rather than
being hidden. The recurrence this gate exists for was a missing BAKE.
IT COMPARES VERSIONS, NOT BEHAVIOUR, so a release that changed nothing
customer-visible also trips it. Accepted deliberately: judging
"customer-visible" by hand is what failed twice, and the cost of a false trip
is one bake. A waiver belongs in the register, never in a habit of bypassing.
Inconclusive (exit 2) on an absent controller clone or an unparseable header:
not knowing is never a pass.
admin