[tannevaled]

Three refusals in the instrument that measures this repository's conformance,
each one earned by a figure that was published and wrong.

1. -move is required, and has no default

The census of what a version move does to the corpus already existed, in
cmd/guards, and its own README said what it was: "an analysis tool, not a
gate: nothing fails when it is not run."

On 2026-11-01 it was not run. The 4.0 move was measured by comparing passing
counts and published as ten examples of work. The real figure is about
seventy-five. Three core/binding/implicit_parameter*_spec.rb files are
pass=0 fail=0 error=0 below 4.0 — every example behind a guard — and 37
failures above it, and -dir had never been pointed at core/binding at all.
The note saying "ask what the target version adds before measuring what moves"
had been written months earlier.

So the reading moved into internal/guardcensus — shared with cmd/guards, so
the two cannot drift — and specdelta will not produce a table until the caller
says which comparison this is:

declaration	what it asserts
-move none	both engines read the corpus at the same RUBY_VERSION
-move 3.4.1:4.0.9	they do not: the guards move too

With a move declared it censuses the corpus and refuses before starting either
engine when the move touches a file -dir does not measure:

specdelta: the move 3.4.1 → 4.0.9 touches 49 file(s) that -dir core/set does not measure:
    core/binding/implicit_parameter_defined_spec.rb
    core/binding/implicit_parameter_get_spec.rb
    core/binding/implicit_parameters_spec.rb
    …

The refusal comes first because a core/ sweep is an hour. Against the
pinned corpus, 3.4.1 → 4.0.9 opens 67 block guards in 50 files, closes 45,
flips 5 inline sites.

2. Provenance — a repeat offence

pass=118 fail=1 was published for #858 from a binary built before that
branch existed. The notes already held the same shape from an earlier arc: a
control built from the working tree rather than the commit, attributing +3
to the wrong fix.

go build stamps vcs.revision and vcs.modified into every binary, verified
on a real one rather than from the documentation. specdelta reads both engines
before running either, prints what it found above the table, and refuses:

what it finds	why the comparison is void
the same revision twice	one of them was not rebuilt
vcs.modified=true	the revision does not name the code in the binary
the work tree moved past the binary's revision	the binary is not the code being measured — #858

An engine with no Go build information (MRI, a shell fake) is not refused —
it is legitimately not a Go binary — but the report is stamped
⛔ UNPROVENANCED.

3. An example that went red inside a file that improved

Measured yesterday, control and treatment built from the same commit minus one
change:

core/thread/raise_spec.rb   51 → 68   +17
1 file(s) moved, 0 regressed          ← exit 0

True, and incomplete. Nineteen examples turned green and two turned red, and
no count of passes, of failures, or of both can show a swap. They were found by
hand, comparing the two runs' failure descriptions; the example that broke had
been passing because of a different defect, so nothing about it looked wrong.

specdelta now compares those descriptions as a multiset, names each one the
treatment reports more often, and exits 1:

core/thread/raise_spec.rb                 51      68    +17
      ⛔ WENT RED: fail  shared kernel_raise | raises a TypeError when passed a message and an extra argument (×2)

1 file(s) moved, 0 regressed, 2 example(s) WENT RED

Rebuilt and pointed at the same two binaries, it finds what I had found by hand
and the exit status goes 0 → 1.

Derogations, and controls

-partial and -unprovenanced stamp the report rather than silencing the
gate: an opt-in that only removed a message would leave the same number
published with nothing attached to it.

Every refusal test carries a control beside it, or it would only prove the gate
always fires: widening -dir is accepted; a move declared none leaves a quiet
file out of a -quiet report; a file that only improves is not flagged; and a
differing message under the same description is not an example that broke
(messages carry object addresses that differ between two runs of the same
binary).

Refs #799

🤖 Generated with Claude Code