Development record

2026-08-02 — iss-34 (v0.5.0 item C8): the five untested refusal guards now carry detectors, and the audit that opened the round is worth keeping because the ledger's "zero coverage" claim was true for only three of the five. ML001's single-source branch was ALREADY covered by `TestLintRejectsMalformed/external_missing_licence` — forbidden page, blocker code, exit contract — so nothing was added there; padding a satisfied guard with a second test buys no detection and costs a reader's trust in the corpus. The symlink-dereference guard was covered on its REJECT half only (escape, denied target), which is the interesting general point: a guard whose job is to refuse SOME inputs and safely dereference the rest is only half-pinned by refusal tests, because dropping the dereference silently ships nothing rather than shipping something forbidden — a regression that reads as "stricter" and never trips a deny assertion. Both halves are now pinned, and the cycle guard turns out not to mislabel a rejection when removed but to hang the resolve outright. The three genuinely uncovered guards — the scripts runtime closure, the MQ001 quotation budget, and the `ask --file-back` write path — each gained the full shape the convention asks for: forbidden input presented literally, the specific reason code or error type asserted (not merely "an error"), and absence of side effects proved, which for file-back means a byte-level snapshot of the whole store taken before and after each refusal rather than a spot check on one filename. Two design choices are reusable: the scripts test drives the shipped `ClosureFn` seam and adds a no-closure polarity control, so the exclusions are demonstrably the gate's doing rather than an unrelated default-deny; and each case was verified by disabling its guard and watching the test fail, which for already-shipped guards is the only available form of "watched fail before". No guard was found broken, so the increment is test-only, `go.mod` is untouched, and there is no CHANGELOG entry — the repo's definition of done ties an entry to a user-facing change, and coverage alone is not one. The entry's promotion path — a pairing lint between declared invariants and named tests — is deliberately NOT built here; it is a convention increment, not part of the coverage corpus this item scoped.