Ack census counts files, not sites: a second exemption in an allowlisted file stays green

[aurascoper]

Raised by Codex on PR #19 (f49fe94), deferred there deliberately.

The defect

tests/radiodialysis_basis_gate.jl bounds the basis_gate_ack exemption with a census that walks the Julia AST for assignments and collects the filenames that open the gate:

_opens_gate(parsed) && push!(found, relpath(path, repo))
@test found == expected

Because every detected opening collapses to its filename, adding a second basis_gate_ack = true anywhere in a file already on the allowlist leaves found unchanged. A new production constructor in export_checkpoint.jl — currently listed for one narrow use — would open the gate with the census still green.

So the test does not establish the bound it claims. It establishes that no new file opens the gate.

Why it was deferred rather than fixed

The four findings ahead of it were defects in the model or in gates that fail open. This one protects a test that protects an exemption to a gate. The residual risk is a future contributor widening an exemption inside an already-listed file, which a human reviewer looking at that diff would see.

That is a real gap, not a non-issue — it is third in line, not out of line.

What a fix looks like

Codex's suggestion, and it is the right one: record individual AST locations (file plus line, or file plus a count per file) rather than a set of filenames, with a same-file duplicate as the negative control — the census must fail when a second opening is added to a listed file, or the fix repeats the original mistake at higher resolution.

Centralising acknowledgement construction behind one helper is the alternative. It does not close the hole by itself, since a caller can still write the field directly, but it would make the census a one-line assertion about who calls the helper.

Known scope limit, unchanged by this

The census is static. A value splatted through RadiolysisParams(; kw...) at runtime is not detectable, and the test says so rather than claiming otherwise. Closing that would need a runtime counter on the guard, which is a separate change.

Context

The gate itself is _assert_basis_gate in biofilms_potts.jl / biofilms_potts_jacc.jl; it enforces RADIODIALYSIS: BLOCKED at the coupled biomass basis. Four sites hold the acknowledgement today: validate_serial.jl, tests/genealogy_tests.jl, tests/checkpoint_io_tests.jl, export_checkpoint.jl.

🤖 Generated with Claude Code

[aurascoper]

Linked: #22 files the gate defect this deferral exposed — scripts/preflight_merge.sh decides on isResolved alone, so resolving a deferred finding reads as fixed.

#22 carries an acceptance criterion naming this issue: before its register ships, either this is closed (the finding fixed, so the resolution was honest after all) or thread PRRT_kwDONEeyC86dXE6w on #19 is re-opened and given the register's first row. The register only downgrades open threads, so otherwise the case that motivated it sits permanently outside it.