EPIC: the guards this arc built do not guard what they claim — fifteen verified defects, and the reason they survived three reviews #241

Rewritten 2026-08-12 after an expert review of the standing decisions. The first draft was nine stories of widening guards. This one is mostly deletion, and it is scoped so that PR #240 can merge after three issues, not nine.

The problem, in one paragraph

This repository has 9,200 lines of tests against 2,998 lines of package, and 3,182 of those test lines guard the repository's claims about itself rather than the product. A post-merge review of #239 found fifteen defects, all reproduced. They are not fifteen unrelated slips. Every one sits on a check that tries to verify a fact this repository does not own — another repo's source layout, another repo's edition semantics, every markdown dialect a person might write. Those checks cannot be proven against reality, so they get proven against the author's imagination, and then they fail inspection. That is the loop this epic exists to break.

The root decision

A check here may rest on a fact we own, on a fact another repository has declared in the public registry, or on an outcome we can observe. It may never rest on another repository's implementation.

Where a needed fact is none of those three, the check is not built here. It is requested as a declaration, requested as a consumer obligation, or registered as an accepted gap with a named owner and trigger.

ADR-003 already says this. It was applied rigorously to the product and not at all across the repository boundary. Landing it as an ADR-017 clause is what makes this a roadmap instead of a queue.

The evidence it is right: the consumer source-read broke twice in 24 hours — views-faoapi on 2026-08-11, views-crafdapi on 2026-08-12 — both times because the other repository refactored a literal into a named constant. Their code got better and our test went red. The regex was measuring their code quality and reporting it as our failure.

What ships, and when

This is an MVP with one maintainer. The test for every item below is: does this make the thing smaller, or does it add a second product to maintain?

Gate 1 — blocks PR #240. Three issues, almost entirely deletion.

After these three, #240 merges. Nothing below blocks the release.

Gate 2 — cheap, same week, each makes the code smaller or truer

Gate 3 — the two paragraphs that stop the next round

Deliberately NOT built — deferred with named triggers

Each of these was recommended by the expert review. Each is defensible. Each is also a second thing to maintain, and none of them is needed to ship.

Desired end state

• PR Sync development → main: the sibling-CI arc, three ADRs, and a drift check that matches on the right thing #240 merged; FAO has the eight days of work.
• No guard in this repository reads another repository's source. Ever again.
• The drift check fires on exactly one condition: a row we name moved between the pin and their main.
• The no-copy scan's stopping rule is written down, mechanical, and derived from this repo's own documents rather than from imagination.
• Every proof in the arc fails under mutation of the thing it names.
• The guard surface is smaller than when this epic started.

Out of scope, permanently for this epic

• Any change to delivered bytes. CONTRACT_VERSION stays 1.5; tests/fixtures/ stays byte-identical. Any story that would touch either is wrong and must stop.
• De-inheritance (C-40 / Cluster G).
• main branch protection and required status checks (C-81, C-86) — operator-owned, and deliberately sequenced after this epic. The epic is what makes requiring the check cheap, by shrinking what CI needs from siblings.
• Editing views-faoapi or views-crafdapi. This epic may file issues there; it does not touch them.

Acceptance criteria

• Gate 1 complete; PR Sync development → main: the sibling-CI arc, three ADRs, and a drift check that matches on the right thing #240 green and merged.
• ruff check . clean; suite green; no test skipped that was not skipped before.
• CONTRACT_VERSION == "1.5"; git diff origin/main..HEAD -- tests/fixtures/ empty.
• wc -l tests/*.py is lower than at the start of this epic. If it is higher, the epic did the opposite of its purpose and needs re-reading.
• Every deferral above is in the register with an owner and a trigger (ADR-014 §4).
• C-89 … C-96 each resolved or amended with a measured residual.
• A review pass by something other than the author finds nothing above suggestion severity.

Provenance

Every claim here was reproduced locally against views-appwrite@origin/main (registry v1.6.0) and views-faoapi@origin/development. Where the review that raised an item overstated it, the issue says so.