A check carries its own refutation — a biop nucleus, a typed ADR constraint check and a SOW contract alike — so a gate that cannot be made to fail stops reporting pass

Context

MEASURED IN A CONSUMER, 2026-09-21 (DD-eca, block 7 of its editorial interface). Every mechanism this ADR touches already existed, and the incident happened anyway: not a missing floor, but floors that reported while unable to see.

AMENDED THE SAME DAY, before acceptance. The first text carried four additions; weight, faces, territory-derived permeability and the custody of the ratifying key moved to ADR-120, still 'Proposed, because `adr validate` gates every constraint of an ADR once it is 'Accepted (`reflection/modules/validate.nu` filters on 'Accepted) and only the refutation was ready. The principal also extended the refutation to SOW contracts, which the first text left out.

1. A PLAN THAT GUIDED CODE WAS NEVER A SOW. The plan lived as a markdown file in the session tree, outside `.governance/`. An agent rewrote its PREMISES around its own resolution and wrote its own acts with verdict «Aceptado». Every test, biop and `adr validate` came back green, because all of them measured internal coherence against the agent's criteria, not the plan's.

2. A CHECK PASSED VACUOUSLY, AND NOTHING COULD HAVE NOTICED. Drafting the corrective SOW, one contract read `nu scripts/wo-gate.nu verify … && { echo 'accepted a modified WO'; exit 1; }`. With the tool absent the command fails, the `&&` branch never runs, and the check exits 0 — green exactly when there is nothing there. Found only because the draft's checks were executed by hand against a tree that did not have the tool yet. Nothing in the biop nucleus (`reflection/schemas/cell.ncl`: id, claim, needs, cmd, severity, on_unknown), in a typed ADR constraint check (`adrs/adr-schema.ncl`) nor in a SOW contract (`code/ontology/schemas/sow.ncl`, `_Contract` — a closed record: measured, a contract with `refutation` fails with «extra field») carries a negative control. Negative controls exist as PROSE, and prose is not re-executed.

3. THE SAME TRAP, AGAIN, THE SAME DAY. Drafting the SOW that implements this ADR, two of its own existence guards used `ontoref qa show <id>` — which exits 0 on an unknown id (measured: it prints «No QA entry with id …» and exits 0). Both guards were green over a qa that did not exist, and were caught only by running them before the thing existed.

Decision

REFUTATION TRAVELS WITH THE CHECK — and ADR-110's shape is reused, not reinvented. Three shapes gain two optional fields, mirroring `resolved_when` / `unfalsifiable` on transitions:

- a biop nucleus (`reflection/schemas/cell.ncl`), - a typed ADR constraint check (`adrs/adr-schema.ncl`), - a SOW contract (`code/ontology/schemas/sow.ncl`, `_Contract`):

refutation | { break | String, expect | [| 'Fail |] } | optional unrefutable | { reason | String, settled_by | String } | optional

THE NAME CARRIES THE POLARITY, as ADR-110 required of its own: `expect = 'Fail` is written out so no reader has to guess which sign `break` points. `break` makes the claim false in a THROWAWAY context (a temp repo, a fixture copy — never the subject). The evaluator runs the positive check and, when a refutation is declared, the check again after `break`:

positive refutation verdict pass fails pass pass PASSES unknown, cause 'Vacuous (the instrument cannot discriminate) fail — fail not run — unknown ('Declared / 'Inferred, as ADR-088)

'Vacuous is a THIRD CAUSE of unknown, not a fourth verdict: ADR-088's ternary stands. Its disposition is 'Inferred's — it BLOCKS, with the instruction «fix the instrument, not the subject». A refutation whose `break` itself fails to run is 'Inferred, never pass.

TWO EXECUTORS, ONE SEMANTICS. Biop nuclei and ADR constraint checks are evaluated by `reflection/modules/checks.nu` (`evaluate-cell`); SOW contracts by `code/scripts/witness.nu`, which writes the receipt. The witness records the refutation outcome in the receipt line and a 'Vacuous contract fails its phase exactly as a failing one does.

THREE POPULATIONS, as ADR-110 counts blockers: REFUTED (declared and runs), UNREFUTABLE BY DECISION (`unrefutable` names why and what settles it instead), and UNDECLARED, counted and kept distinct. Requiring either field would break every corpus on the day this lands (formalization-vs-adoption); collapsing the third population into the second would publish a coverage nobody has. A 'Hard/'Block check in the undeclared population does not block on day one; it is the new column of the honest metric in `enforcement-vs-emergence`.

ONE READER (ADR-105): the three contracts, the shape validator and the two executors admit the two fields in the same change, or the field does not land.

Weight, context faces, territory-derived permeability and the custody of the ratifying key are ADR-120.

Constraints

• Hard `refutation` and `unrefutable` are admitted by the biop nucleus, the ADR constraint check and the SOW contract, the shape validator, `evaluate-cell` and the SOW witness in the same change; no reader accepts them alone.
• Hard When a check passes and its declared refutation ALSO passes, the evaluator reports unknown with cause 'Vacuous, and that verdict blocks exactly like 'Inferred.
• Hard A check that passes, whose refutation makes it fail, is a pass — the refutation does not make honest checks harder to satisfy.
• Hard `witness.nu` runs a SOW contract's refutation, records its outcome in the receipt, and fails the phase when the contract is 'Vacuous.
• Soft `adr validate` and `biop validate` report the three populations — refuted, unrefutable by decision, undeclared — for 'Hard / 'Block checks, and never fold the undeclared into either of the others.

Alternatives considered

• Keep negative controls as prose and executed-once records (status quo) — rejected: That is what produced the incident's second finding: the control was run once, written down, and never re-executed. A control that is not re-run is a memory of a control.
• Add a fourth verdict, 'Vacuous — rejected: Breaks ADR-088's ternary for a case whose disposition is identical to 'Inferred's.
• A sidecar file next to each check instead of a field — rejected: Considered in the consumer the same day. It avoids touching closed records, but the refutation then does not travel with the check: a biop exported to another tissue arrives without its negative control unless something else carries the sidecar. Rejected by the principal in favour of the field.
• Encode the discipline in agent guidelines or memory — rejected: ADR-074: a carrier holding a copy of a governed rule binds no one. The incident was produced by an agent that had the discipline in its instructions.

Anti-patterns

• A refutation whose break changes nothing the check reads — A `break` that is a no-op, targets a path the check does not inspect, or breaks the harness instead of the claim. The pair then reports confidence it has not earned.
• An existence guard trusting a verb that exits 0 on a miss — A check guards «X exists» with a verb that prints a miss and exits 0 (`ontoref qa show <unknown-id>`, measured 2026-09-21). The guard is green over nothing, and every inverted branch after it is vacuous.

Related ADRs

ADR-066 · ADR-074 · ADR-088 · ADR-105 · ADR-110 · ADR-111 · ADR-120