The 'check runs, exits clean, observed the wrong surface' defect class has no citable home — artifacts cite a closed, narrower instance

[usirin]

Decision wanted

Does the broad "right-when-written, silently-wrong" verification class get ADR force — and in what shape relative to #4628's already-ruled ADR? One question; the deliverable is a recorded choice. The class's instances stay separately owned build tickets regardless of the ruling.

The class, restated at its now-visible width

An artifact or check result that was right when written becomes wrong silently, and the failure presents as a plausible value rather than an absent one — so the natural guards (is it empty? non-zero? did it match?) are structurally blind. The countermeasure discipline the ruling would (or would not) canonize: re-derive at the point of consumption; never branch on a signal that cannot distinguish "no" from "never ran", or "complete" from "lagged".

Adjacent canon, neither of which covers this width:

• ADR 0092 / §ZS (.decisions/0092-gates-fail-closed-on-zero-scope.md; the formats contract's §ZS) — the absent-input half: zero scope / unreadable read must red. Already canonical.
• Extend ADR 0092's fail-closed convention from zero-scope to stale-scope #4628 — the stale-scope subclass (a guard's hand-maintained scope registry drifts from the covered surface). Already founder-ruled as shape (a): an ADR extending 0092 (kill-sweep Ruling #8a, recorded on Backlog kill-sweep 2026-08-01 — campaign-level rulings ledger + execution queue #4621 comment 5149793215); authoring held under the freeze.

Six independent instances in one session (2026-08-01), one shape

1. Stale plan — epic fabrika foundation: the home, the conventions, and the authoring-brief contract #4648's plan (children minted 06:44–06:47Z) executed against a founder scope correction made 17:21Z; three children conflicted with the corrected scope and read as a valid plan until a timestamp check caught it (fabrika foundation: the home, the conventions, and the authoring-brief contract #4648 comments 5152523719, 5152655871). Verified by this re-triage from the comments.
2. One-way ADR link — .decisions/0110-plugin-carries-no-version-continuous-ship.md carries status: accepted and no in-file forward pointer; a reader arriving there gets a confident answer with no signal that downstream state moved. (In-file status verified by this re-triage; the staleness of the continuous-ship claim itself is the reported half.)
3. Stale inline contract — validate-gate-path-drift.sh's marketplace source parse passes non-matching lines through verbatim, so a failed parse reads as a value #4663: an inline # || true: no-match → empty comment asserts a fail-closed contract the code does not have; disproved by a live pipe test (validate-gate-path-drift.sh's marketplace source parse passes non-matching lines through verbatim, so a failed parse reads as a value #4663 comment 5152633484 — the expression emits verbatim, exit 0).
4. Stale line anchor — a line anchor in a crew instruction, accurate when written, stale once rows were appended below. (Reported by the re-triage requester; not board-verifiable from this seat — carried as unverified.)
5. Could-not-run reads as "no" — Skill fence exits 127 with empty stdout when the hook-planted .claude/.pipeline link is absent — "never ran" can read as "said no" #4666: post-fix(pipeline): skill fences resolve in ANY consuming repo via a hook-planted .claude/.pipeline link (#4605) #4645 skill fences through a missing .claude/.pipeline link exit 127 with empty stdout; a caller branching on non-zero-means-no consumes "never ran" as "said no". Two independent worktrees hit it.
6. Lagged read reads as smaller truth — Wave read right after a labeling write can under-report, and a short list is consumed as the real wave #4667: an eventually-consistent label-index read returned 7 of 11 wave members seconds after all 11 writes landed; the wave-list contract fails only on empty, so an incomplete list is indistinguishable from a genuinely smaller wave.

Plus the wrong-surface instances from the original filing, each separately owned: #3779, #4338 / #4163, #4215, #4431, #4493, #4497, #4501, #4508.

Candidate shapes (recorded for the founder — the ruling is his, not triage's)

• (a) One parent ADR. The ADR Extend ADR 0092's fail-closed convention from zero-scope to stale-scope #4628's ruling already commissions is authored under the broader invariant: one ADR names the right-when-written class, with stale-scope as its sharpest fully-mechanizable subclass (derive-or-fail-closed), could-not-run-vs-no and re-derive-at-consumption as the other teeth. Note: Extend ADR 0092's fail-closed convention from zero-scope to stale-scope #4628's ruled scope is stale-scope; broadening it is a founder act, reachable only because the authoring is still held under the freeze.
• (b) Companion decision. Extend ADR 0092's fail-closed convention from zero-scope to stale-scope #4628's ADR ships exactly as ruled; the broader invariant gets its own ADR cross-linking it (and 0092/§ZS), so neither ruling's scope is retroactively edited.
• (c) No ADR force for the broad class. The original chore deliverable stands: a .patterns/ doc (CI / pipeline section of .patterns/index.md) names the class and the countermeasure discipline as citable canon without ADR force; Extend ADR 0092's fail-closed convention from zero-scope to stale-scope #4628 alone carries the banned-shape teeth.

Acceptance criteria

• Founder rules among (a) / (b) / (c) — or names a fourth shape.
• The ruling is recorded in the shape it names — an ADR under .decisions/ for (a)/(b), the .patterns/ doc for (c) — and the recorded artifact cites ADR 0092/§ZS and Extend ADR 0092's fail-closed convention from zero-scope to stale-scope #4628's Ruling #8a without forking or silently re-scoping either.
• The citable-home deliverable survives every shape: exactly one home cites the instance tickets (Nothing catches a cross-PR ADR number collision — two concurrent lanes both minted ADR 0198 #3779, Unchecked producer exit status defeats verification idioms — pipe-masking is one of three variants #4215, Agents execute skills from the working tree, so a stale checkout silently applies withdrawn doctrine #4338, A stale working tree fails toward "does not exist" — recurrence of #308 across 4 seats #4163, jq -e exits 0 on empty input, so the canonical "validate the payload shape" guard fails OPEN #4431, classify-ui-surface.sh swallows its changed-file read (|| true) — a failed gh api becomes exit 0 + empty stdout, which the off-ramp reads as "no rendered surface" #4493, leak-guard scan reports "clean" and exits 0 for a file that does not exist #4497, write-code's containment / cycle-doc / golden-pointer reads resolve an UNREADABLE input to the permissive answer (§ZS) #4501, leak-guard.yml resolves an unreadable diff to a clean green — zero changed files exits 0 unscanned #4508, fabrika foundation: the home, the conventions, and the authoring-brief contract #4648, validate-gate-path-drift.sh's marketplace source parse passes non-matching lines through verbatim, so a failed parse reads as a value #4663, Skill fence exits 127 with empty stdout when the hook-planted .claude/.pipeline link is absent — "never ran" can read as "said no" #4666, Wave read right after a labeling write can under-report, and a short list is consumed as the real wave #4667) as worked examples; each instance stays separately owned.
• Dangling citations pointing at closed decisions-index next answers from one of three stale surfaces and reports it as clean — two ADR number collisions in two hours #4418 as the class's home (the §CP bank record goes stale when main moves — a rebase burned the approval #4477 / Verdict marker edited in place from FAIL to PASS — the refused round is gone #4478 bodies, if still dangling) are repointed to the recorded home.

Triage note (re-triage, 2026-08-01): promoted type:chore → type:decision, p2 → p1, on new information — six independent instances in one session widened the class beyond a citable-vocabulary need into a shape question that must be answered before #4628's ADR is authored. Rationale in the re-triage comment.

---

Prior triage enrichment (chore-era, superseded by this re-type)

Problem

A recurring defect class — a check that runs, exits clean, and observed the wrong surface, so its clean exit is evidence about the wrong thing — keeps being cited in issue bodies and coordination artifacts, but has no citable home. The instance that was being cited (#4418) was correctly closed as a duplicate of the narrower #3779, so citations of "the pattern" now dangle on a closed, narrower ticket.

The class is real and heavily instantiated. It splits into two halves:

1. Already canonical: the zero-scope / unreadable-input fails open half is owned by ADR 0092 and its generalized §ZS invariant in the pipeline formats contract (claude-plugins/kampus-pipeline/skills/gh-issue-intake-formats.md). Instances: jq -e exits 0 on empty input, so the canonical "validate the payload shape" guard fails OPEN #4431 (jq -e exits 0 on empty input), leak-guard scan reports "clean" and exits 0 for a file that does not exist #4497 / leak-guard.yml resolves an unreadable diff to a clean green — zero changed files exits 0 unscanned #4508 (leak-guard reports clean for a missing file / unreadable diff), classify-ui-surface.sh swallows its changed-file read (|| true) — a failed gh api becomes exit 0 + empty stdout, which the off-ramp reads as "no rendered surface" #4493 (|| true turns a failed fetch into "no rendered surface"), write-code's containment / cycle-doc / golden-pointer reads resolve an UNREADABLE input to the permissive answer (§ZS) #4501 (unreadable input resolves to the permissive answer).
2. No home: the wrong-surface half — the check ran on real, non-empty input, but the surface it read is not the surface the requirement is about. Instances: Nothing catches a cross-PR ADR number collision — two concurrent lanes both minted ADR 0198 #3779 (allocator reads the local tree; a number claimed by an unmerged PR is invisible), Agents execute skills from the working tree, so a stale checkout silently applies withdrawn doctrine #4338 / A stale working tree fails toward "does not exist" — recurrence of #308 across 4 seats #4163 (a stale working tree executes withdrawn doctrine / fails toward "does not exist"), Unchecked producer exit status defeats verification idioms — pipe-masking is one of three variants #4215 (pipe-masking defeats exit-status idioms), and this issue's own filing (labels checked for existence while the requirement was queue reachability). §ZS does not cover these: the input wasn't empty, it was the wrong thing.

Deliverable (canon work — docs only, no behavior change)

A new .patterns/ doc under the CI / pipeline section of .patterns/index.md naming the class and the countermeasure discipline: verify the surface the check reads, not that it exits clean; fail closed on an unreadable/empty read; re-derive at the point of consumption. This clears the index's "when to add a new pattern doc" bar on all three criteria: the pattern recurs in many places, it is non-obvious (the instruments meant to catch it keep instantiating it — twice in one night per the original report), and agents demonstrably invent worse versions without it.

A .glossary/ row is not part of the deliverable — .glossary/LANGUAGE.md is architecture vocabulary, and an indexed pattern doc is already a citable anchor.

Acceptance criteria

• A new .patterns/ doc (CI / pipeline section) names the class — a check that runs, exits clean, and observed the wrong surface — and states the countermeasure discipline (verify the surface the check reads; fail closed on unreadable/empty input; re-derive at the point of consumption).
• The doc cites ADR 0092 / §ZS as the already-canonical zero-scope half and scopes its new ground to the wrong-surface half — it does not fork a second definition of §ZS.
• The doc cites the instance tickets as worked examples (Nothing catches a cross-PR ADR number collision — two concurrent lanes both minted ADR 0198 #3779, jq -e exits 0 on empty input, so the canonical "validate the payload shape" guard fails OPEN #4431, classify-ui-surface.sh swallows its changed-file read (|| true) — a failed gh api becomes exit 0 + empty stdout, which the off-ramp reads as "no rendered surface" #4493, leak-guard scan reports "clean" and exits 0 for a file that does not exist #4497, write-code's containment / cycle-doc / golden-pointer reads resolve an UNREADABLE input to the permissive answer (§ZS) #4501, leak-guard.yml resolves an unreadable diff to a clean green — zero changed files exits 0 unscanned #4508, Unchecked producer exit status defeats verification idioms — pipe-masking is one of three variants #4215, Agents execute skills from the working tree, so a stale checkout silently applies withdrawn doctrine #4338, A stale working tree fails toward "does not exist" — recurrence of #308 across 4 seats #4163) rather than restating their fixes; each instance stays separately owned.
• The doc is registered in .patterns/index.md with a Topic + Read-when row.
• Dangling citations that point at closed decisions-index next answers from one of three stale surfaces and reports it as clean — two ADR number collisions in two hours #4418 as the class's home (the §CP bank record goes stale when main moves — a rebase burned the approval #4477 / Verdict marker edited in place from FAIL to PASS — the refused round is gone #4478 bodies, if still dangling) are repointed to the new doc.

Triage note: canon-shaped work — the deliverable is a .patterns/ doc, so this routes to the canon/docs path, not a code lane. The class's instances are separately owned build tickets and are explicitly out of scope here.

Original report (verbatim)

What was observed

A recurring defect class keeps being cited in issue bodies and crew coordination as a general pattern, but the ticket being cited — #4418 — was (correctly) closed as a duplicate of #3779, which is scoped to ADR number collisions only. The general pattern now has no open, citable home; at least two issue bodies (#4477, #4478) cited the closed instance as if it were the pattern, and their author is correcting them.

'## The first concrete example is this ticket'''s own filing
This issue was filed with zero labels — confirmed by the filer as "filed" against the issue existing, while the requirement was the issue being discoverable: the intake queue is queried by the status:needs-triage label, so an unlabeled ticket is invisible to the very queue that pulls it. The check verified existence; the requirement was reachability. Caught by a peer seat reading the queue, not the issue; corrected by one labels POST, verified this time against the queue query itself. That makes it the sixth instance of the class in one night, and the second in a row where the instrument meant to catch the class instantiated it.

The class'

A check that runs, exits clean, and observed the wrong surface — so its clean exit is evidence about the wrong thing. Open instances, each with its own fix, none owning the class:

• Nothing catches a cross-PR ADR number collision — two concurrent lanes both minted ADR 0198 #3779 — allocator + CI validator read the local tree; a number claimed by an unmerged PR is invisible (the decisions-index next answers from one of three stale surfaces and reports it as clean — two ADR number collisions in two hours #4418 fold-in lives there)
• jq -e exits 0 on empty input, so the canonical "validate the payload shape" guard fails OPEN #4431 — jq -e on empty input exits 0; three verification gates read a failed fetch as a confident green
• Agents execute skills from the working tree, so a stale checkout silently applies withdrawn doctrine #4338 / A stale working tree fails toward "does not exist" — recurrence of #308 across 4 seats #4163 — a stale working tree executes withdrawn doctrine / fails toward "does not exist"
• Unchecked producer exit status defeats verification idioms — pipe-masking is one of three variants #4215 — pipe-masking defeats exit-status verification idioms
• Adjacent, same family, different unit: Ship reports state elapsed durations that were never measured — one produced a false GitHub-staleness finding #4442 (fabricated durations), A relayed founder ruling is indistinguishable from a fabricated one at the point it is recorded #4441 (unverifiable ruling provenance)

What a home might be (triage's call, not binding)

Not an epic and probably not a build ticket — the instances are separately owned. Candidates: a .patterns/ doc naming the class and the countermeasure discipline (verify the surface a check reads, not that it exits clean; re-derive at the point of consumption), and/or a .glossary/ row so artifacts can cite the concept instead of an instance number. If neither clears the bar, the deliverable may just be: repoint the dangling citations and close.

Pointers

• The mis-citation instance: §CP bank record goes stale when main moves — a rebase burned the approval #4477, Verdict marker edited in place from FAIL to PASS — the refused round is gone #4478 bodies (being corrected by their author)
• The killed instance: decisions-index next answers from one of three stale surfaces and reports it as clean — two ADR number collisions in two hours #4418 (fold-in preserved on Nothing catches a cross-PR ADR number collision — two concurrent lanes both minted ADR 0198 #3779, comment 5124665362)

---

_{Filed by an agent · 2026-07-30}