An outranked scan fault is discarded with no trace, at two sites

[randomparity]

Found by the branch review on #69 (PR pending). #69 briefly fixed one of the two sites and reverted it on the next review pass; see the comment below for why.

Problem

Two functions in .github/scripts/check-records.sh remember a scan fault so that it cannot outrank a positive result, and then discard it when a positive result arrives.

gate_existed_at:

      path_exists_at "$base" "${rel}/${name}" || status=$?
      case $status in
      0) return 0 ;;
      1) ;;
      *)
        fault_status=$path_exists_status
        gate_witness_path="${rel}/${name}"
        ;;
      esac

renumbered_elsewhere has the same shape: a candidate whose index query or base-ref witness could not run is remembered in fault_status, and a later candidate whose content matches returns 0 without mentioning it.

Remembering rather than returning is correct in both — a witness that genuinely found a gate file, or a candidate that genuinely matches, is not made unreliable by an unrelated probe failing. What neither site does is say that the search reached its answer incompletely. The verdict is right; the fact that part of the search never ran is reported nowhere.

The open question

This is not simply "add two warn_full calls". ADR 0005 governs the file and does not settle this case:

• Decision 3 says the predicate returns a fault value and the caller reports. Both sites would be reporting from inside the predicate, where the caller cannot see it.
• Decision 1 specifies E-<RULE>-SCAN on the error channel. A warning-severity scan code is a new channel for scan faults, which is a change to that decision rather than an application of it — and ADR 0005 is append-only.
• ADR 0005 addresses a fault that would otherwise become a verdict. An outranked fault never becomes one, so the record's reasoning does not reach it.

So the work is: decide whether an outranked fault is reportable at all and through which channel, record that decision, then apply it at both sites.

Expected

A decision record settling the above, and both sites following it, in .github/scripts/check-records.sh and its byte-identical mirror under skills/tome-of-lore/assets/.

If the answer is that it should be reported, each site needs a regression test. renumbered_elsewhere already has a fixture that reaches the state — renumber_match_outranks_fault in check-records-test.sh, where one candidate's index query faults and a later one matches. gate_existed_at has none: it needs a git stub that faults ls-tree for one witness path while another resolves for real, in a repo whose protected set is otherwise empty so gate_existed_at is reached at all. Adding an unfalsifiable branch to the gate's own self-protection is what kept this out of #69 — that suite's stated acceptance criterion is that neutralising any single rule turns it red.

Notes

just records compares the two mirrors byte for byte. Related: #25, #55, #64, #66, #69.

[randomparity]

Widening this to both sites, and recording why #69 does not carry the fix for either.

renumbered_elsewhere has the same shape: it remembers a candidate's fault in fault_status so a genuine match on another candidate still wins, then returns 0 and discards the remembered fault. #69 briefly added a W-RENUMBER-SCAN warning there and reverted it on the next review pass, for a reason that applies to gate_existed_at too:

• ADR 0005 decision 3 says the predicate returns a fault value and the caller reports. Both traces would be emitted from inside the predicate, where the caller has no way to see them.
• Decision 1 specifies E-<RULE>-SCAN on the error channel. A warning-severity scan code is a new channel for scan faults, which is a change to that decision rather than an application of it — and ADR 0005 is append-only.

So the work here is not two warn_full calls. It is deciding whether an outranked fault — one that did not change the verdict, because a positive witness or a positive match outranked it — is reportable at all, and through which channel. That question is not settled by ADR 0005, which only addresses a fault that would otherwise become a verdict. Settling it needs a new record or an amendment, and then both call sites follow it.

Scope, once that is settled: renumbered_elsewhere's positive-match return and gate_existed_at's positive-witness return, in .github/scripts/check-records.sh and its byte-identical mirror, each with the fixture described above. renumbered_elsewhere already has one — renumber_match_outranks_fault in check-records-test.sh reaches exactly that state — so only gate_existed_at needs a new one.