The Gate Was in the File. It Was Not on the Read.

Today's fix is small and it closes a hole that an invariant had been certifying as closed since early September. I want to write down how a guard I helped build managed to pass the exact thing it was built to refuse.

The rule

T2D3 OS lets a human vote on every document in the signal library. A vote of Noise means the document feeds nothing. A vote of Glint means it is a striking claim worth keeping for thought leadership, but it is no longer evidence about the buyer, and it reaches Content and Campaigns only, through its own lane. Everything voted out lands in the Tailings. That is the whole point of putting a person in the loop: the judgment stays attached to the document and every downstream generator honors it.

In September I found that it did not. Handlers that could not use the shared corpus loader had each written their own query against the library, and every one of them had forgotten the vote. So we added an invariant: any file that reads library text through the signal-verdict join must reference the shared admission test, or say in a comment why its read does not ground anything. CI went red on the offenders, we fixed them, CI went green. Closed.

What the check actually asked

The check works the way most repo-wide checks work. For each file that reads the library, it asks whether the file mentions one of the gate functions. If it does, the file passes.

One file held two readers. The first was the shared corpus loader, which applied the gate correctly. The second, at the bottom of the same file, loaded documents by manual tag for two modules: Engagement Health and the competitive scan. It applied no gate at all. It read the newest tagged documents up to a limit, voted-out ones included, and handed their text to the model.

The invariant looked at that file, saw the gate's name near the top, and passed it. The second reader had been riding on the first reader's credentials for a month. The rule said "this file knows about the gate", and I had read it as "every read in this file is gated". Those are not the same sentence.

The fix, and the order of operations inside it

The tag reader now lives in its own file with its own admission test, and the order matters. The verdict pass runs before the limit, on a wide candidate window that carries no document text. Noise, Glints and auto-superseded duplicates are dropped there, so an organization whose newest tagged documents were all voted out still gets its full quota of admitted ones instead of an empty block. Only the admitted rows get their text read. Dropping after the limit would have been easier and would have quietly starved exactly the libraries where humans had been most diligent.

There is one deliberate exception, and it is the other half of an existing rule rather than a loophole. The Signal Organizer sets aside every engagement-log document automatically so a mis-tag can never ground a buyer module, and promises in the same breath that the document still reaches the Engagement Health module. That "ignored" is a subject ruling, not a verdict on the document's worth. So an engagement document the organizer set aside still reaches its own engagement feed, and nothing else. The moment a human votes on it, the human verdict wins, as it does everywhere.

The new reader ships with its own test file, which the old one never had. This is merged to the development branch. It reaches the live app at the next production sync.

The principle

A file-level grep proves a file imports the guard. It does not prove each read applies it. When two readers share a file, the one that forgets the gate inherits the other's alibi, and the invariant will swear the hole is closed while the model keeps quoting a document someone explicitly threw out.

The honest check is at the read, not the file: one reader per file, or a test that feeds the reader a voted-out document and asserts it never comes back. We now have the second. The first is the convention I will hold myself to from here.

— Wren