ADR-0006 D3. Nine standing control gates now say what they check, what
they have caught with pointers, when their keep-or-kill argument is due,
and what would retire them. make gate-review reports what is overdue and
what has caught nothing; it never fails the build, for CB-RES-0005 §4's
reason.
Drift is checked in both directions and both are pinned by self-tests: a
dependency of `make all` that is neither a registered control gate nor
listed in not_control_gates is a loop-lint finding, so a new gate cannot
acquire permanence without a review date, and an entry naming a target
the Makefile lacks is a finding too.
First run: 0 due, 2 silent. The silent two are the chaos roll, whose
12-declaration window exists precisely to find out, and gate-review
itself, which is not exempt from its own rule — if it has retired,
tightened or forced the re-justification of nothing by 2026-12-31 it is
a ritual and goes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ADR-0006 D1. cb-cost gains pass_costs, which buckets responses into
workplan windows in a single read of the transcripts — calling collect()
once per boundary would re-read every transcript per window, and status
is supposed to stay cheap enough that nobody replaces it with ls.
make status now reports the share over a trailing three passes with the
per-pass breakdown, keeps the lifetime figure labelled NOT the metric,
and prints the D2 exemption so the next reader does not re-derive the
standoff where the budget blocked its own repair. One pass would be a
coin flip: a meta pass reads 100%, a product pass 0%. Three is the
smallest window where the ratio means something and still moves.
First reading: 36% over the last three passes against 49% lifetime,
with CB-WP-0008 at 0%.
The first run reported $0.00 for every window. Transcript stamps are
UTC Z and git prints a local offset, so the string comparison put every
response before the first boundary. Both the fix and a self-test for it
are in; reverting the conversion turns four checks red.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CB-EV-0007 found three defects in how gates are designed rather than in
any one gate: the meta budget cannot see the pass it governs, it blocks
its own repair, and nothing retires any gate.
D1 budgets measure their own window. D2 a soft breach is a signal, and
repairing the instrument that reports a breach is always in budget — a
gate must never block its own remedy, which is the trap CB-RES-0005 §4
named for session shape and that got built anyway two tasks later. D3
every gate declares what would retire it and a date to argue it on. D4
loop work cashes out into something runnable in the pass that invents
it, from the measured finding that cost per response tracks distance
from a runnable check. D5 the tier table finally covers changes to the
loop's own operation — CB-RES-0005 §6 said a second instance should
trigger it, and this ADR is the second.
The workplan is meta and above the budget line on recorded maintainer
authorization, which is D2's first use.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
