Claims That Borrow Their Authority
In one line: the most dangerous claim is not the one nobody checked — it is the one standing next to something that was checked, close enough to inherit the feeling of having been measured.
Three failures, on unrelated subject matter, share this shape. In each, a real measurement was made and then its authority was spent on an adjacent question it never answered.
R161 — The substitution premise. Removing a carried value on the grounds that
something else re-derives it requires a test that runs the re-deriver on the
input the removed value covered, and that was watched failing. The test of the
behaviour you changed passes whether or not the premise is true, so it is not
evidence for the removal. Measured: a carried blocker was dropped because a
sweep "re-derives it"; the sweep read string roster entries only, so a structured
{"ownership_percentage": 150.0} raised nothing, and the removal would have
traded an unwithdrawable blocker for a missing one.
R162 — Absence authority. Only an explicitly stated absence authorizes
overwriting stored data with "absent". A record's shape, a missing key, or a
producer's default None never does — and where no producer states it, the clear
stays closed and the stale value is preserved. Measured: four consecutive
review rounds on one rule, each fix creating the next finding, because a document
that found an owner but could not read a stake emitted exactly what an assessed
absence emitted. It resolved on a pre-existing outcome enum that distinguishes
NOT_FOUND from NOT_ASSESSED, INCONCLUSIVE and SOURCE_UNAVAILABLE.
R163 — Sequence claims. A number drawn from a shared sequence — an ADR id, a migration revision — is claimed by the open pull-request set, not by mainline. A gate over such a sequence derives its ceiling from the open PRs; a hole scan cannot serve, because it is bounded by its own input and therefore sees only the interior, never the tip where every contested number lives. Measured: two collisions in two days — a migration revision, then three consecutive ADR numbers held by open PRs and invisible on mainline.
The trigger, because judgement is what fails
A rule that exists and does not fire is worth nothing, and the canon already carried the general form of all three (§5.9, rule 160: a quantity asserted without a number is an input nobody has measured). It was broken three times in one day by its own author, hours after writing it. So the operating instruction is deliberately syntactic rather than a call for care:
A sentence containing a consequence word — live, broken, deleted, idling, every, exposed, N of them — must be followed, in the same breath, by the command whose output produced it. If you cannot name the command, the sentence is a hypothesis and is written as one.
This is cheaper than a rule about care because it does not require noticing that care is needed. The three instances that produced it all had a nearby real measurement: the gate had been run an hour earlier on the very PR later described from a weaker signal; the function was read correctly before its location was asserted. Proximity to a real measurement is what makes an unmeasured claim feel measured.
Evidence: all three rules survived an adversarial pass whose default was to reject and whose kill criteria included "already covered by an existing rule" and "could not have changed a decision made today"; six sibling candidates were killed under exactly those criteria, two of them falsified by their own evidence. Declared gap: the evidence under R161 and R162 is one repository over two days and must not be quoted as more.