An independent cold-context review found the guard could be disabled or bypassed in
four ways, one of them silently.
HIGH — the guard's only wiring was untested. Deleting `wing_faults=record_wing_faults()`
from main() left the ENTIRE suite green (120 passed) while a real block-scalar record
vanished again with `decisions-validate: OK`. Every existing test either called the
collector directly or handed validate() a hand-built list, so nothing pinned that
main() ever invokes it — the #609 "prints OK while doing nothing" defect, one level up,
inside the fix for that same defect. Independently reproduced before fixing. Now pinned
by a monkeypatched sentinel test.
MEDIUM — a record could escape by BASENAME. `_NON_DECISION_FILES` is a set of TOPIC-dir
names ({README, migration-map, retrieval-eval}) and was applied to the wings too, so a
genuine record at records/docs/retrieval-eval.md was skipped. Not hypothetical: the
path<->key rule forces key `docs.retrieval-eval` to that exact filename, and
dl.active_files() applies that filter only to the TOPIC_DIR glob — so the file would be
a corpus source while exempt from the guard. Now nothing is exempt by basename.
MEDIUM — the archive exemption was by LOCATION but justified by IDENTITY. Anything
directly in archive/ was skipped, so a new unparseable archive/foo.md would vanish in
the one directory left unwatched. Now exempt only if it really is a #610 stripped index:
one keyless record with a known generated heading.
LOW — parse-to-WRONG. `rule: >-` with an UNINDENTED continuation containing a colon
parses to one VALID keyed record whose rule is literally ">-", plus a junk key, silently
truncating the real value. PyYAML rejects that input, so the hand reader is more
permissive than the writer. Now faulted via an unknown-frontmatter-key check.
LOW — an absent or empty wing reported clean. Now loud: refusing to certify a corpus
from a scan of nothing.
Doc corrections, all measured rather than asserted: "all 167 records use single quoted
lines" was false (117 of 168 rule: values are unquoted plain scalars — the invariant is
single-LINE); the archive shape in the record, ci-cd.md and the rule: field said
`archive/<area>/` where the code deliberately uses archive/** ; the mutation count is 10,
not five; and the "converts ANY reader limitation" claim is softened to the class it
actually covers.
125 passed.
Refs #621
timothy
98b3e8715b