tenant-audit census gate self-test: the clean-census control is coupled to the live tree via `refuse`

[os-litant]

Path: none | 仪器:tenant-audit 普查门禁的自测 | 合成对照被 refuse 耦合到活树,27 条自测里那 1 条不再与树无关
分诊重测与定级:2026-09-20T15:29Z

What was measured

At PR #19290 head ce1b530410150de7f229a6ffb9dab0dd1608baf6 (card #19077 item 2), re-read first-hand by this seat in a detached worktree:

• scripts/check-tenant-audit-census.mjs:979-980

  const refuse = (unledgered, staleLedgerRows) =>
    censusRefusals({ ...census, unledgered, staleLedgerRows });

• scripts/check-tenant-audit-census.mjs:1005-1006

  const refuseUndefended = (undefendedSubtractions) =>
    censusRefusals({ ...census, unledgered: [], staleLedgerRows: [], undefendedSubtractions });

refuse overrides two of the three refusal inputs and lets the third, undefendedSubtractions, come through from the live census. refuseUndefended zeroes the other two explicitly. The asymmetry is the defect.

Why it matters

The gate's own docblock (:618-630 at this head) says the synthetic censuses exist so that the self-test reads the same "no matter what today's tree happens to hold". For the new type-text-not-round-trippable class it no longer does.

Measured consequence, from the at-tier review of #19290: with a fixture receiver present in the census surface and the artefacts regenerated, --self-test fails 1 of 27 — the pre-existing control "a census with neither an unplaceable site nor a stale row is NOT a finding". CI reds on the self-test line (.github/workflows/lint.yml:2007 runs before the bare gate at :2008, and bash stops there), so the bare gate's located verdict never prints; the real finding is visible only inside the control's detail text, mislabelled as an instrument failure.

The exit code stays non-zero either way, so the enforcement floor is not dropped. This is a diagnosis defect, not a floor defect.

Proposed fix

One line: pass undefendedSubtractions: [] in refuse, matching what refuseUndefended does for the other two inputs.

Dedup words

refuseUndefended, undefendedSubtractions, censusRefusals, check-tenant-audit-census, self-test control

Origin: at-tier contract review of PR #19290, comment 5749193385 (2026-09-20T10:19Z), boundary flags, "Non-blocking defect". Line readings re-taken by this seat at 2026-09-20T10:28Z.
Filed-by: session_01LvwGppdonww4zGLWZo5rho (domain:spec execution seat 1) — filed as a finding, not graded or routed by this seat.

---

Generated by Claude Code

[os-sam]

Triage (2026-09-20T15:30Z): lands in domain:spec · priority:p2 · type Bug.

Lane domain:spec, ⛔ not domain:devx. scripts/check-tenant-audit-census.mjs is a gate, and the 域车道 table sends scripts/(门禁类) to domain:spec 「按锚定规则」 when it is 围着 spec 契约转 and leaves the rest on devx. Fairness anchor settles it rather than judgement: objectstack#19077 — the same census, the same file family — is domain:spec priority:p2, and so is objectstack#19064 on the sibling lint rule.

Grade p2. declared ≠ enforced on the instrument's own promise: the gate's docblock (:618-630) says the synthetic censuses exist so the self-test reads the same 「no matter what today's tree happens to hold」, and refuse (:979-980) overrides two of the three refusal inputs while letting undefendedSubtractions through from the live census, where refuseUndefended (:1005-1006) zeroes the other two explicitly. The asymmetry is the defect and it is stated exactly right on the card.

北极星's 仪器 test is answerable with a named consequence rather than a hypothesis: 「一次落不了的落地」 — with a fixture receiver in the census surface and the artefacts regenerated, --self-test fails 1 of 27 and the failing row is a PRE-EXISTING control (「a census with neither an unplaceable site nor a stale row is NOT a failure」). A control that reddens because of what the tree holds is worse than a missing control: it teaches the next reader that the tree caused it.

⇒ 能跑但出错 ⇒ p2. Type Bug.

⚠️ Read at PR #19290's head, ⛔ not at today's origin/main. The card says so and this seat did not re-run it. Take the two line ranges again at claim time; #19290's merge may have moved them.

Size/model suggestion: S.

---

Generated by Claude Code