Refuse a borrowed quarantine that does not declare itself

[iderex]

Refs #188

What this changes

Record 0019 puts code under another licence in experiments/<slug>/borrowed/,
carrying its own LICENSE, declared by a Borrowed: field in the experiment
record. It says at the rule that nothing in this repository refuses a violation
of any of that. Two of the three violations #188 names are refused now.

borrowed-directory-carries-no-licence refuses a borrowed directory with no
licence file in it, whatever the record says, because the layout is what record
0019 buys and a header field is visible only to somebody who opened the header.

record-borrowed-declaration-names-no-directory refuses a record declaring
Borrowed: while the experiment holds no such directory. The message names both
sides, because which of the two is wrong decides the repair.

The field arrives in the file that reads it, which is the shape
FieldMeasurementCommit already argues for at its own declaration. #188 says
the format change is a prerequisite rather than part of this work, and evidences
that with a grep of internal/check/record.go alone. That file is not where the
last field the format gained was declared:

git grep -n 'Field[A-Za-z]* = "' origin/main -- internal/check/
origin/main:internal/check/measurement.go:14:const FieldMeasurementCommit = "Measurement-Commit"
origin/main:internal/check/record.go:16:	FieldSlug = "Slug"
origin/main:internal/check/record.go:19:	FieldState = "State"
origin/main:internal/check/record.go:24:	FieldQuestionWritten = "Question-Written"
origin/main:internal/check/record.go:28:	FieldAnswerWritten = "Answer-Written"
origin/main:internal/check/record.go:34:	FieldNeedsHardware = "Needs-Hardware"

Record 0016's field, its check and the record itself landed in one change:

git log --format='%h %ad %s' --date=short origin/main -- internal/check/measurement.go
19ac2bf 2026-08-12 Say which commit a measurement in an answer was produced at (#123)

So what the prerequisite is, is record 0013's rule rather than a separate
landing, and that rule is met here: the field is optional and an absent one is
never refused. The template names the field in its prose rather than carrying it
in its header, for the reason Measurement-Commit is named the same way, and it
carries what a green run does not prove.

The one record on the board is left exactly as it was, which is what record
0013 requires of a record already on the default branch.

The means is Go, in the package that already walks experiments/ and already
reads the header, proved by the fixture harness that already exists. It adds no
language, no runtime and no dependency, and record 0019 says this check is
ordinary gate work in this tree rather than a new apparatus.

What failure it prevents

A directory a reader walking the tree takes for quarantined, declaring none of
the terms it is under. That is the footgun record 0019 describes: the person
who meets it is whoever promotes the result later, at the moment they are least
careful, and the boundary they are relying on tells them nothing.

And a record that says an experiment borrows while the tree says it does not,
which is the same claim going quietly out of date from the other side.

What was run

At eafb8ddb9600ce694cea86c7e32e1c201f251eac, the four commands CONTRIBUTING.md
names, in that order:

go build ./cmd/... ./internal/...
go vet ./cmd/... ./internal/...
gofmt -l cmd internal
(no output)
go test -count=1 -v ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	1.740s
ok  	github.com/Flowfin/lab/cmd/lab	10.551s
ok  	github.com/Flowfin/lab/cmd/notices	65.274s
ok  	github.com/Flowfin/lab/cmd/pullrequest	0.755s
ok  	github.com/Flowfin/lab/internal/check	0.997s
ok  	github.com/Flowfin/lab/internal/contexts	0.750s
ok  	github.com/Flowfin/lab/internal/hardware	0.754s
ok  	github.com/Flowfin/lab/internal/invariants	1.075s
ok  	github.com/Flowfin/lab/internal/notices	0.738s
ok  	github.com/Flowfin/lab/internal/prose	0.775s
ok  	github.com/Flowfin/lab/internal/pullrequest	0.761s

What the -v run says it did not cover:

go test -count=1 -v ./internal/hardware
the integration-hardware harness was not asked for and nothing in it ran.
asking costs a machine with the hardware each test names and an explicit request:
    go test -tags integration_hardware ./internal/hardware
with LAB_INTEGRATION_HARDWARE=1 in the environment. its results are about that machine and are not this suite's results.

The harness was not asked for on this branch and nothing in it ran. The change
registers no test with it.

The run over this tree:

go run ./cmd/lab check .
examined .
1 experiment directory walked, 1 record read
21 decision records read
the time this run read is 2026-08-25T05:17:26Z
0 refused

What each refusal says, run against its own fixture tree:

go run ./cmd/lab check testdata/cases/a-borrowed-directory-with-no-licence-file/tree
1 refused
  testdata\cases\a-borrowed-directory-with-no-licence-file\tree\experiments\one\borrowed: it holds no LICENSE, so it reads as code under somebody else's terms and names none of them. record 0019 puts that file at experiments/one/borrowed/LICENSE (borrowed-directory-carries-no-licence)
exit status 1

go run ./cmd/lab check testdata/cases/a-record-declaring-borrowed-with-no-borrowed-directory/tree
1 refused
  testdata\cases\a-record-declaring-borrowed-with-no-borrowed-directory\tree\experiments\one\EXPERIMENT.md: it declares Borrowed and there is no borrowed directory in experiments/one, so the record says the experiment borrows and the tree says it does not (record-borrowed-declaration-names-no-directory)
exit status 1

go run ./cmd/lab check testdata/cases/an-experiment-that-borrows-and-declares-it/tree
0 refused

Both guards were proved by deleting them and watching the suite go red.

Deleting the licence refusal site:

go test -count=1 ./internal/check
--- FAIL: TestCases (0.05s)
    --- FAIL: TestCases/a-borrowed-directory-with-no-licence-file (0.00s)
        check_test.go:46: expected refusal not produced: borrowed-directory-carries-no-licence
FAIL

Deleting the declaration refusal site:

go test -count=1 ./internal/check
--- FAIL: TestCases (0.05s)
    --- FAIL: TestCases/a-record-declaring-borrowed-with-no-borrowed-directory (0.00s)
        check_test.go:46: expected refusal not produced: record-borrowed-declaration-names-no-directory
FAIL

Deleting the dispatch in walkExperiments:

go test -count=1 ./internal/check
--- FAIL: TestCases (0.04s)
    --- FAIL: TestCases/a-borrowed-directory-with-no-licence-file (0.00s)
        check_test.go:46: expected refusal not produced: borrowed-directory-carries-no-licence
    --- FAIL: TestCases/a-record-declaring-borrowed-with-no-borrowed-directory (0.00s)
        check_test.go:46: expected refusal not produced: record-borrowed-declaration-names-no-directory
FAIL

Each site was restored and the suite re-run green before the commit was made.
Each refusing case declares a near neighbour that refuses nothing and differs by
the smallest legal change: the licence file arriving, and the declaration line
going away.

What this does not do

#188 stays open, and this pull request does not finish it. That sentence is
phrased around the platform's closing keywords rather than with them, and the
reason is a trap this change walked into. The heading originally read as a denial
built on one of those keywords followed by the issue number; the platform read
the keyword and never the denial, and merging this closed that issue while two
thirds of its done-condition were unmet. It was reopened and the wording repaired. The
literal is not reproduced here, deliberately: a body quoting it carries the same
live keyword, which is how this paragraph would become the second instance of
what it is written against.

The third refusal that issue asks for is a borrowed
directory in an experiment whose record declares no Borrowed:. That is a
refusal on an absent field, and record 0013 says an absent field is never a
refusal, in the same words refuseHardware already declines the identical shape
in, at its own declaration. Building it here would be taking a decision about
record 0013 inside a check, so it is not built and the issue keeps that clause.
It is written into #188 with what it waits on.

Nothing reads the licence file. A green run says the layout and the
declaration do not contradict each other. It says nothing about which licence
the code is actually under, and nothing about whether the borrowed code may be
promoted into a board under other terms, which record 0019 explicitly leaves
undecided.

A Borrowed: declaration written with nothing after the colon is a
declaration. The directory half is read against it and nothing asks whether it
names a source or a licence. Record 0019 says the field names both; whether it
does is prose a reader judges.

An experiment whose record the walk did not reach is not judged here at all,
whether the record is absent, unreadable, or above the size bound. The check is
called with the record's bytes in hand and those runs never get that far.

A symbolic link named borrowed pointing at a directory reads as a quarantine
here, because fs.Stat resolves it. That is not repaired at this site: a link
anywhere under experiments/ is already refused by the stray-record walk, which
reads the entry rather than the target, and a second rule deciding what a link
points at is the resolution that walk exists to avoid.

Record 0019 also owes the contributing guide. It says the rule belongs
where a person starting an experiment meets it, and this change carries it into
docs/experiment-template.md and not into CONTRIBUTING.md. That is outside
what #188 asks for and no issue holds it.

There is no second reader on this board tonight. What stands in place of one
is the evidence above: the commands, their output, and each guard shown red with
its site removed.