Graduated from the friction-log inbox (entry: "Four rounds of tightening a matcher is the signal to delete it, and the rule already says so", severity M, pattern, 2026-07-26).
The gap
safety-critical-changes.md rule 1 already says:
Treat "we tightened the matcher" as a stopgap, not a fix.
That is correct and it was not enough. On #31 the matcher was tightened four times — source equality, then lens names, then a required roster, then a counted roster — before the conclusion was accepted and the mechanism deleted. Each tightening was defeated by the next review round; the last was defeated by a single decorated character in a field the caller writes themselves.
The adversarial panel had reported by round 3 that the artifact was unverifiable from the engine — same actor, same invocation, nothing bound to what actually ran. Two more epicycles were built after that.
Why the rule did not fire
As written, the rule describes a category ("a tightening is a stopgap") but names no decision point. It therefore depends on the author noticing they are in the category — and an author mid-fix-round is exactly the reader least able to notice, because each individual tightening looks like a small, well-motivated correction to the previous one.
Proposed fix
Name the threshold, so the decision is written down rather than requiring self-awareness:
A second tightening of the same matcher is a design signal, not a bug fix. Stop and ask what the matcher is standing in for — if the property cannot be verified from the data available at the point of the check, no amount of pattern-narrowing will fix it.
Two is the right number rather than three or four: the first tightening is ordinary bug-fixing; the second means the first was defeated by an input class nobody enumerated, which is the actual signal.
Related
Graduated from the friction-log inbox (entry: "Four rounds of tightening a matcher is the signal to delete it, and the rule already says so", severity M, pattern, 2026-07-26).
The gap
safety-critical-changes.mdrule 1 already says:That is correct and it was not enough. On #31 the matcher was tightened four times — source equality, then lens names, then a required roster, then a counted roster — before the conclusion was accepted and the mechanism deleted. Each tightening was defeated by the next review round; the last was defeated by a single decorated character in a field the caller writes themselves.
The adversarial panel had reported by round 3 that the artifact was unverifiable from the engine — same actor, same invocation, nothing bound to what actually ran. Two more epicycles were built after that.
Why the rule did not fire
As written, the rule describes a category ("a tightening is a stopgap") but names no decision point. It therefore depends on the author noticing they are in the category — and an author mid-fix-round is exactly the reader least able to notice, because each individual tightening looks like a small, well-motivated correction to the previous one.
Proposed fix
Name the threshold, so the decision is written down rather than requiring self-awareness:
Two is the right number rather than three or four: the first tightening is ordinary bug-fixing; the second means the first was defeated by an input class nobody enumerated, which is the actual signal.
Related