S10 (#192) — repair the þing-01 redaction guard; a declared root that vanishes now fails

[Polichinel]

Closes #192. Closes register C-74. Part of epic #181.

The defect

tests/test_redaction_guard.py pins the þing-01 #135 delivery-log redaction audit over five module trees. Epic #148's #153 moved the machinery from unfao/ to contract/, and four of the five roots were never re-pointed.

	files scanned
stale roots (as merged, for two days)	6
repaired	17

Silent by construction. _python_sources calls rglob on anything that is not a file, and rglob on a nonexistent directory yields an empty iterator rather than raising. A missing root and a clean root are indistinguishable to the scan.

Re-pointing fixes today; the existence assertion fixes the class

That is the half worth having. A declared path that does not exist is now an error rather than silence, and a third check bounds the count so narrowing surfaces as a number.

Mutation-proven by restoring the pre-S10 roots — two failures:

declared credential-blind root(s) no longer exist:
  ['unfao/wire', 'unfao/historical.py', 'unfao/track_a_source.py', 'unfao/frame_extraction.py']

the credential-blind scan covers only 6 files.

And the guard is now proven to bite on the defect it was written for — a module reading os.environ['APPWRITE_DATASTORE_API_KEY']. That had never been demonstrated, which is what two silent days buys you.

List, not derivation — decided, per the issue

test_clone_readiness.py enumerates an overlapping module set for a different question ("does the machinery import without the partner?"). Folding them together would couple two guards whose sets are free to diverge — a module can be partner-neutral without being credential-blind. Two lists that each say what they mean beat one that means neither.

What makes the explicit list safe is the existence assertion. Without it, a list is exactly the fragile thing it looked like here.

No leak occurred

Checked at registration and again now: zero hits for os.environ, getenv, load_dotenv, API_KEY, credentials across all 17 files. The audited fact stayed true. What had gone was the thing that would notice it stopping.

Two claims restored, not quietly reverted

C-57 said the redaction clause was "already mechanically enforced"; Cluster I's fix strategy cited this exact file as the guard pattern working. Both were corrected when C-74 was registered this morning. Both are true again — and the episode is left visible, because a claim that was false for two days is worth more as a record than as a correction tidied away.

The register's own guard caught me mid-story

The extraction regex for moving C-74 used a (?=^### ) boundary. C-74 was the last entry in Open Concerns, so the match ran past the section break and swallowed the ## Disagreements heading, filing three D-entries under Open.

Four integrity tests failed immediately:

header says 17 open concerns, the file holds 20
disagreement(s) filed under 'Open Concerns': ['D-12', 'D-11', 'D-09']

Fixed with a section-aware boundary. The guard S2 built, catching a defect in the tooling that maintains the register it guards — which is the epic's thesis arriving from an unexpected direction.

Verification

ruff check .                                     # clean
pytest -q                                        # 302 passed, 3 skipped, 41 xfailed, 5 known pyarrow
pytest -q tests/test_redaction_guard.py          # 5 passed
pytest -q tests/test_register_integrity.py       # 10 passed
git diff --stat origin/main -- tests/fixtures/   # empty

Register: 74 concerns, 17 open, 57 resolved.

🤖 Generated with Claude Code