---
name: remedy-must-run-from-refusal-state
description: A printed remedy/heal command must be executable FROM the state that prints it — prove by running it verbatim from the refusal; units cannot see this class.
metadata: 
  node_type: memory
  type: project
  originSessionId: 520cc386-a467-49d9-b1f9-c90853dfed9b
  modified: 2026-08-02T11:08:53.941Z
---

A guard's refusal message printed `cargo run -p xtask -- pool-claim ...` as the remedy — but xtask depends on the guarded crate, so BUILDING the claim tool went through the very pool being refused. The operator is told what to do and then prevented from doing it: a dead end wearing a suggestion (hertz, releases#103 leg 1, 2026-08-02).

**Why:** to a unit test the remedy is just a string; to a person it is a promise. No unit suite over the decision function can detect that the promised command is unbuildable/unrunnable from the refusal state.

**How to apply:** whenever a surface prints a command-shaped remedy (heal line, claim command, re-run-elevated), (1) design so the escape hatch LEADS the remedy — the sanctioned crossing is the one path allowed through the guard; (2) assert in a unit that every command-shaped remedy carries the hatch; (3) prove in the field by running the printed line VERBATIM from the refusing state. Related: [[instrument-soundness-guards]], [[key-must-ride-the-crossing-artifact]].