Fail when the mirror is more permissive than the system it mirrors

.stomata/baseline.json

@@ -1,8 +1,8 @@
 {
   "$stomata_artifact": "baseline",
-  "captured_at": "2026-08-14T18:11:16+00:00",
-  "commit": "4ecdd0ffbb52e181b6a91ef341a5d7588f970944",
-  "dirty_when_captured": false,
+  "captured_at": "2026-08-19T19:13:10+00:00",
+  "commit": "ceff9444e3ab90b054a5c99898901cff6cd96360",
+  "dirty_when_captured": true,
   "suites": {
     "ar2": {
       "passed": 119,
@@ -129,8 +129,8 @@
       ]
     },
     "migration": {
-      "passed": 81,
-      "total": 85,
+      "passed": 110,
+      "total": 110,
       "test_ids": [
         "migration/tests/test_db_repo.py::test_alias_is_persisted_and_resolves",
         "migration/tests/test_db_repo.py::test_alias_re_upsert_is_idempotent_but_remap_is_refused",
@@ -159,6 +159,7 @@
         "migration/tests/test_limit_invalidates_joins.py::test_the_runner_warns_when_limit_is_set",
         "migration/tests/test_limit_invalidates_joins.py::test_the_warning_names_the_three_unreadable_figures",
         "migration/tests/test_limit_invalidates_joins.py::test_unlimited_run_has_only_the_deliberate_join_failures",
+        "migration/tests/test_pipeline.py::test_a_pin_written_as_a_ring_imports",
         "migration/tests/test_pipeline.py::test_accounts_and_lists_created",
         "migration/tests/test_pipeline.py::test_dry_run_writes_nothing",
         "migration/tests/test_pipeline.py::test_exact_duplicate_geometry_aliases_rather_than_failing",
@@ -178,6 +179,20 @@
         "migration/tests/test_pipeline.py::test_uuid_fields_gain_content_derived_identity",
         "migration/tests/test_pipeline.py::test_v1_identifiers_resolve_forever",
         "migration/tests/test_pipeline.py::testfields_imported_and_aliased",
+        "migration/tests/test_points_are_importable.py::test_a_pin_and_a_field_are_not_confused",
+        "migration/tests/test_points_are_importable.py::test_a_pin_imports_however_ar1_wrote_it_down[LINESTRING(77.5 12.9, 77.5 12.9)]",
+        "migration/tests/test_points_are_importable.py::test_a_pin_imports_however_ar1_wrote_it_down[POINT(77.5 12.9)]",
+        "migration/tests/test_points_are_importable.py::test_a_pin_imports_however_ar1_wrote_it_down[POLYGON((77.5 12.9, 77.5 12.9, 77.5 12.9, 77.5 12.9))]",
+        "migration/tests/test_points_are_importable.py::test_a_pin_imports_rather_than_quarantining",
+        "migration/tests/test_points_are_importable.py::test_a_point_is_not_counted_as_altered_geometry",
+        "migration/tests/test_points_are_importable.py::test_a_quarantine_reason_is_specific_enough_to_act_on",
+        "migration/tests/test_points_are_importable.py::test_an_exact_duplicate_counts_as_resolved_not_rejected",
+        "migration/tests/test_points_are_importable.py::test_area_is_derived_so_the_inventory_bands_mean_something",
+        "migration/tests/test_points_are_importable.py::test_every_spelling_of_one_pin_lands_on_one_identifier",
+        "migration/tests/test_points_are_importable.py::test_exact_matches_are_distinguishable_from_threshold_matches",
+        "migration/tests/test_points_are_importable.py::test_genuinely_broken_geometry_still_quarantines",
+        "migration/tests/test_points_are_importable.py::test_the_point_count_is_reported_at_all",
+        "migration/tests/test_points_are_importable.py::test_the_two_implementations_agree_on_points",
         "migration/tests/test_primitive.py::test_blocking_key_is_coarse_and_shared",
         "migration/tests/test_primitive.py::test_collision_fixed_neighbouring_fields_differ",
         "migration/tests/test_primitive.py::test_deterministic",
@@ -195,6 +210,11 @@
         "migration/tests/test_primitive.py::test_sorted_tokens",
         "migration/tests/test_primitive.py::test_unusable_geometry_refused",
         "migration/tests/test_primitive.py::test_winding_order_irrelevant",
+        "migration/tests/test_report_arithmetic.py::test_a_rejected_field_is_never_also_a_resolved_one",
+        "migration/tests/test_report_arithmetic.py::test_canonicalisation_is_only_flagged_when_geometry_actually_changed",
+        "migration/tests/test_report_arithmetic.py::test_every_field_considered_lands_in_exactly_one_bucket",
+        "migration/tests/test_report_arithmetic.py::test_subcategories_never_exceed_the_category_they_subdivide",
+        "migration/tests/test_report_arithmetic.py::test_the_arithmetic_holds_under_a_limit",
         "migration/tests/test_sample.py::test_a_generous_budget_covers_the_whole_source",
         "migration/tests/test_sample.py::test_area_bands_are_all_present",
         "migration/tests/test_sample.py::test_collision_count_comes_from_the_l13_column",
@@ -216,14 +236,27 @@
         "migration/tests/test_schema_drift.py::test_mirrored_columns_match_the_real_schema[hub-users-Base]",
         "migration/tests/test_schema_drift.py::test_mirrored_columns_match_the_real_schema[pancake-fieldlists-PancakeBase]",
         "migration/tests/test_schema_drift.py::test_mirrored_columns_match_the_real_schema[pancake-users-PancakeBase]",
+        "migration/tests/test_schema_drift.py::test_mirrored_constraints_match_the_real_schema[ar2-geo_ids-Base]",
+        "migration/tests/test_schema_drift.py::test_mirrored_constraints_match_the_real_schema[ar2-listmember_edge-Base]",
+        "migration/tests/test_schema_drift.py::test_mirrored_constraints_match_the_real_schema[hub-users-Base]",
+        "migration/tests/test_schema_drift.py::test_mirrored_constraints_match_the_real_schema[pancake-fieldlists-PancakeBase]",
+        "migration/tests/test_schema_drift.py::test_mirrored_constraints_match_the_real_schema[pancake-users-PancakeBase]",
         "migration/tests/test_schema_drift.py::test_regime_alias_table_is_ours_and_not_ar2s"
       ]
     }
   },
   "lint_violations": 36,
-  "notes": [
-    "Reference point moved deliberately, in review, for two reasons. Neither is a test or a violation disappearing quietly, which is what this file exists to prevent.",
-    "1. test_degenerate_geometry_quarantined_not_invented was renamed to test_unidentifiable_geometry_quarantined_not_invented. Its fixture was POLYGON((0 0, 0 0, 0 0, 0 0)), asserted to be broken geometry. It is not broken: it is a point registration written as a ring, which AR 1.0 accepted and AR2 registers natively. Reading that shape as unusable quarantined 14,594 of 28,282 live fields. The test now uses a line between two distinct positions, which genuinely cannot be identified, and test_a_pin_written_as_a_ring_imports covers the shape it used to reject.",
-    "2. lint_violations moved 25 -> 36 with no change to any source file. The count was measured by an unpinned ruff, and the same tree reports 0 under the version CI happened to install and 36 under a newer one. ruff is now pinned in .github/workflows/ci.yml, so 36 is the honest count under the tool the ratchet actually uses. These are pre-existing E402 violations in app/; the ratchet holds them from rising."
-  ]
+  "guards": {
+    "migration/tests/test_schema_drift.py": 7,
+    "migration/tests/test_report_arithmetic.py": 10
+  },
+  "lessons": {
+    "gate-reports-green-while-blind": 7,
+    "twin-divergence": 6,
+    "label-diverges-from-outcome": 5,
+    "claim-not-in-the-evidence": 4,
+    "guard-weakened-to-pass": 2,
+    "prose-warning-instead-of-a-check": 3,
+    "run-record-not-at-the-reviewed-commit": 1
+  }
 }

.stomata/lessons.json

@@ -0,0 +1,118 @@
+{
+  "$stomata_artifact": "lessons_ledger",
+  "schema_version": "1.0.0",
+  "promotion_threshold": 2,
+  "note": "Seeded 2026-08-19 from the review record of 2026-07-24 to 2026-08-19. Occurrences are things that actually happened and cost time, each traceable to a dated review document in the agstack workplan. Nothing speculative is recorded here: a lesson with no incident behind it becomes noise, and noise is what discredits the checks that were earned.",
+  "lessons": [
+    {
+      "recurrence_key": "gate-reports-green-while-blind",
+      "trigger": "A check, test or assertion reports success.",
+      "directive": "Establish that it can fail. Show it failing on purpose, or show the count it produces changing when the underlying thing changes. A gate that cannot distinguish good from bad is worse than no gate, because it is believed.",
+      "kind": "mechanized",
+      "enforced_by": [
+        "harness/stomata/checks.py",
+        "harness/tests/test_stomata.py"
+      ],
+      "occurrences": [
+        {"date": "2026-07-24", "what": "Tier 1 privacy was satisfied only vacuously: no holder_account could leak because no identity was ever produced.", "where": "workplan/2026-07/rajat_ar2_traceforward_20260724.md:221"},
+        {"date": "2026-08-05", "what": "The Tier 1 privacy test passed vacuously while Tier 1 still emitted the field.", "where": "workplan/2026-08/rajat_day3_review_20260805.md:271"},
+        {"date": "2026-08-06", "what": "The Tier 1 assertion could pass in isolation regardless of behaviour.", "where": "workplan/2026-08/rajat_day35_review_20260806.md:65"},
+        {"date": "2026-08-10", "what": "A cross-layer test was skipped in Pancake CI and the suite still reported green.", "where": "workplan/2026-08/rajat_day5_closeout_20260810.md"},
+        {"date": "2026-08-18", "what": "The schema drift guard passed while comparing nothing, because the mirror it compared against had been made permissive.", "where": "workplan/2026-08/rajat_import_review_20260818.md"},
+        {"date": "2026-08-18", "what": "The dirty-tree warning fired on every single run because generated credentials were rewritten each time, so it stopped carrying information.", "where": "app/tests/testkit/mint_test_authority_credentials.py"},
+        {"date": "2026-08-19", "what": "The lint ratchet counted ruff's success banner as a violation, so it reported 1 whatever the code said, and a real count of 36 rode in unnoticed across four commits.", "where": "harness/stomata/run.py"}
+      ]
+    },
+    {
+      "recurrence_key": "twin-divergence",
+      "trigger": "One fact is represented in two places -- a mirror and the system it mirrors, a function and its caller, the same logic in two packages, a value in two config files.",
+      "directive": "Change both in the same commit, and add a test that fails when they disagree. Do not rely on remembering the second one, because the second one is what gets forgotten.",
+      "kind": "mechanized",
+      "enforced_by": [
+        "migration/tests/test_schema_drift.py::test_mirrored_constraints_match_the_real_schema",
+        "migration/tests/test_points_are_importable.py",
+        "stomata.json"
+      ],
+      "occurrences": [
+        {"date": "2026-08-12", "what": "get_boundary_coverage was correct and had been called from nowhere since AR 1.0.", "where": "workplan/2026-08/rajat_e2e_ci_audit_20260812.md"},
+        {"date": "2026-08-14", "what": "v2 GeoID minting was fully implemented and no service path called it.", "where": "workplan/2026-08/rajat_ar2_closeout_20260814.md"},
+        {"date": "2026-08-14", "what": "GeoIDRegimeAlias rows were written by the migration and never read by the equivalence-set query.", "where": "workplan/2026-08/rajat_ar2_closeout_20260814.md"},
+        {"date": "2026-08-18", "what": "The point-handling path existed in app/geoid_v2.py and was absent from migration/geoid_v2.py, so every pin was quarantined.", "where": "migration/geoid_v2.py"},
+        {"date": "2026-08-19", "what": "The phone constraint was relaxed in the migration mirror and not in the hub it mirrors, so the import reported 0 rejections where the real system would have rejected 85.", "where": "workplan/2026-08/rajat_final_import_review_20260819.md"},
+        {"date": "2026-08-19", "what": "ruff was pinned in ci.yml and left unpinned in stomata.yml, so the gating workflow measured a different thing to the advisory one.", "where": ".github/workflows/stomata.yml"}
+      ]
+    },
+    {
+      "recurrence_key": "label-diverges-from-outcome",
+      "trigger": "You are naming or counting what a run did, in a report, a log line, a status field or a document.",
+      "directive": "Make the word mean one outcome. If a category can contain both a success and a failure, split it. Assert that the categories sum to the total and do not overlap, because every individual number can be computed correctly and the totals still describe a run that did not happen.",
+      "kind": "mechanized",
+      "enforced_by": [
+        "migration/tests/test_report_arithmetic.py"
+      ],
+      "occurrences": [
+        {"date": "2026-08-14", "what": "TRACEABILITY.md documented Tiers 2 and 4 as implemented when they were not.", "where": "workplan/2026-08/rajat_ar2_closeout_20260814.md"},
+        {"date": "2026-08-19", "what": "268 duplicate submissions that were correctly aliased to existing GeoIDs were reported as quarantined and as decisions required. Nothing had failed.", "where": "migration/run.py"},
+        {"date": "2026-08-19", "what": "18,184 geometries were reported as altered by canonicalisation; the real figure was 3,597, the rest being points on a different code path that set the flag as a side effect.", "where": "migration/pipeline.py"},
+        {"date": "2026-08-19", "what": "The point count, the single most consequential fact about the run, did not appear in the report at all.", "where": "migration/run.py"},
+        {"date": "2026-08-19", "what": "resolved_child_of was presented as a peer of imported_new when it is a subset, so 74 fields summed to 75 and read as one field processed twice.", "where": "migration/tests/test_report_arithmetic.py"}
+      ]
+    },
+    {
+      "recurrence_key": "claim-not-in-the-evidence",
+      "trigger": "You are about to quote a number, or cite a run, screenshot or log as evidence.",
+      "directive": "Open the artifact and find the number in it. Cite the run that produced it, at the commit under review. A figure that cannot be located in the evidence is a recollection, and recollections drift toward what we hoped.",
+      "kind": "mechanized",
+      "enforced_by": [
+        "harness/stomata/packet.py",
+        "harness/tests/test_stomata.py"
+      ],
+      "occurrences": [
+        {"date": "2026-08-14", "what": "Screenshots showed 2 fieldlists as though that were the corpus; it was an artifact of a --limit flag on the run.", "where": "workplan/2026-08/rajat_ar2_closeout_20260814.md"},
+        {"date": "2026-08-18", "what": "A packet cited packets/evidence/schema1.log, which did not exist, and bias_curve.csv, which was at the repository root.", "where": "packets/schema.json"},
+        {"date": "2026-08-18", "what": "'The missing 13,343' was stated in prose and appeared nowhere in the run it described.", "where": "workplan/2026-08/rajat_import_review_20260818.md"},
+        {"date": "2026-08-19", "what": "A summary quoted a pre-fix reconciliation of 13,658 + 14,594 + 30 while the attached log showed 27,978 + 275 + 29.", "where": "packets/evidence/import-output.txt"}
+      ]
+    },
+    {
+      "recurrence_key": "guard-weakened-to-pass",
+      "trigger": "A guard, assertion or lint rule stands between you and a change you believe is correct.",
+      "directive": "Change the claim or change the code, never quietly narrow the guard. If the guard is genuinely stale, say so in the commit message and re-record the baseline, so that weakening it costs a sentence someone can read.",
+      "kind": "mechanized",
+      "enforced_by": [
+        "harness/stomata/checks.py",
+        "harness/tests/test_lessons.py::test_removing_an_assertion_from_a_guard_fails"
+      ],
+      "occurrences": [
+        {"date": "2026-08-12", "what": "ruff.toml's ignore list was suppressing rule families including B008, so the linter was configured not to see real defects.", "where": "workplan/2026-08/rajat_e2e_ci_audit_20260812.md"},
+        {"date": "2026-08-19", "what": "The phone column was removed from the drift guard's NOT NULL and UNIQUE lists so a change would pass, and the guard then certified an import that could not work.", "where": "migration/tests/test_schema_drift.py"}
+      ]
+    },
+    {
+      "recurrence_key": "prose-warning-instead-of-a-check",
+      "trigger": "You have identified a failure mode and are about to write it down in a document, review comment or email.",
+      "directive": "Write the check as well, in the same change, or record explicitly that it cannot be mechanized and why. A paragraph is read once by whoever was in the conversation and then archived; it does not bind the person who arrives next, and it does not bind its own author a week later.",
+      "kind": "mechanized",
+      "enforced_by": [
+        "harness/stomata/lessons.py",
+        "harness/stomata/checks.py",
+        "harness/tests/test_lessons.py"
+      ],
+      "occurrences": [
+        {"date": "2026-08-13", "what": "Threshold guidance was written as prose reasoning; it rested on an IoU implementation that turned out to be wrong, and the prose gave no way to notice.", "where": "workplan/superseded/rajat_geoid_v2_review_20260813.md"},
+        {"date": "2026-08-14", "what": "A document asked, in words, that checks not be waived silently. Five days later a guard was edited to pass and nothing objected.", "where": "workplan/2026-08/rajat_ar2_closeout_20260814.md:406"},
+        {"date": "2026-08-14", "what": "The same document predicted that a check which becomes noise 'gets waived, then gets deleted'. Two checks became noise and were ignored for days by the author who wrote that sentence.", "where": "workplan/2026-08/rajat_ar2_closeout_20260814.md:418"}
+      ]
+    },
+    {
+      "recurrence_key": "run-record-not-at-the-reviewed-commit",
+      "trigger": "You are reading a run record, CI result or packet to decide whether a branch is sound.",
+      "directive": "Check the commit the run was taken at against the tip being reviewed. Commits after the last recorded run are ungated, and that is exactly where an unnoticed regression sits.",
+      "kind": "advisory",
+      "advisory_because": "One occurrence so far, and the commit-binding check already records the commit for a reader to compare. Promoting on a single incident manufactures the kind of speculative check that turns into noise. Revisit on the next occurrence.",
+      "occurrences": [
+        {"date": "2026-08-18", "what": "Run records sat at b3c55ed and ac6e536 while the branch tip was 17d3aaf, and a lint regression rode in on the four ungated commits between.", "where": "workplan/2026-08/rajat_import_review_20260818.md"}
+      ]
+    }
+  ]
+}