--- name: justify-a-return-value-by-running-it summary: Never justify what a value returns without running it - five defects here, two of them rights leaks group: nextgraph scope: local created: 2026-09-24 --- # A claim about what a value returns must be RUN before it is written **Rule:** Before writing a comment, a docstring or a contract clause that says a value is safe to pass on, forward, skip or trust BECAUSE OF WHAT IT RETURNS OR CARRIES, execute it. One line against the real artifact - the installed package's shipped `dist`, not the checkout this repo cites, and not the language semantics you remember. If the claim cannot be run, it is a bet: label it one, and name the version you did not check. **Why:** Five defects in this repository had one cause, and each was found only after the justification had been written, reviewed and shipped. Two of them were RIGHTS LEAKS in a package whose central promise is that one identity of a shared wallet cannot read another's data. - *"A plain property carries no items"* - true of the orm release this repo CITES, false of the one it BUILDS AGAINST, whose `useShape` hangs every identity's items off `data`, `promise` and `subscription`. A stranger read all three. - *"The `get` trap is the read"* - false for `Object.getOwnPropertyDescriptor`, which handed back the raw collection and the refused handle. - *"They take an item and return void or a boolean, so they yield nothing to leak"* - `Set.prototype.add` returns `this`. One line in a REPL says so. Holding what it returned also unlocked destruction. - *"A primitive cannot reach an item"* - a COUNT is a primitive that describes the items, so any count member not spelled `size` or `length` published how many the holder may not read. The test suite asserted that as CORRECT, six lines above a test calling the same thing the defect. - *"`$?` after a pipeline gives the command's status"* - it gives the LAST command's, so an exit-code check measured `tail`. Written by the agent that had just explained this failure mode to its user. Adjacent and the same shape: *"the summary line says 46 passed, so the suite is green"* - the runner prints a clean verdict and then intermittently hangs until its own deadline aborts it, so the summary is not the exit code. Every one of these was reasonable, was written with confidence, and was never executed. That is the whole pattern: not carelessness, but a plausible sentence about a value nobody ran. **How to apply:** The tell is a comment whose grammar is *"X is safe because it returns/carries Y"* - forwarding, passing through, skipping, trusting, not filtering. Those are the sentences to run, and they are cheap to run: `bun -e` or a throwaway probe, against `node_modules//dist`, takes less time than writing the justification did. Three corollaries, each earned: - **Verify against what SHIPS, not what is cited.** This repo's provenance annotations point at a `nextgraph-rs` checkout that is three releases behind the packages it compiles against. A claim about the installed release refuted by reading that tree is refuted against the wrong version - which happened twice, and was caught twice. - **A fake that has never been compared to the shipped shape makes every gate meaningless.** The first rights leak above survived ten adversarial passes and every re-run suite, because the only artifact exercising that path was hand-written and nobody had asked whether it resembled what the SDK returns. A green suite is worth exactly the fidelity of its doubles - in BOTH directions: one of these fakes was later found more CORRECT than the target, and another more permissive. - **A default that passes the unknown breaks silently at the next version; one that refuses it breaks loudly.** The prohibition worth keeping is not on enumerating - it is on letting an unrecognised member through. Prefer decided-or-refused. Read through [[rules-allow-judgment]]. The sibling rule [[surface-mirrors-the-sdk]] covers the same gap at the level of CITATIONS (a true reference attached to a false claim); this one covers it at the level of RUNTIME. A claim you have run needs no hedging - the target is the claim nobody executed.