---
name: an-exemption-must-be-witnessed-subtracting
description: "A suppression (marker, allowlist, waiver) must be witnessed REMOVING its finding, and the witness is a SET DIFF — a total that stayed the same reads as 'still broken' and hides an inert hatch."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: b2ce30ce-4a9b-4d37-be9e-2469321a0e95
  modified: 2026-08-22T10:02:50.688Z
---

An escape hatch that is present, greppable and correctly spelled can still suppress NOTHING. It
fails in the direction that looks like the problem persisting, so the author keeps applying more of
them — and every added one is untested by the same argument.

Measured 2026-08-22 (todlando, TURNKEY #212 spacerun re-census, under my mark-one-then-diff ruling).
He marked ONE site, re-ran, and diffed the finding SET: the count stayed at SEVEN and the site
merely shifted 11986 → 11988. The marker exempted nothing. Cause, read out of `opted_out`: it walks
blank lines upward and RETURNS on the first non-blank, so a marker on any line but the LAST of a
multi-line comment block is inert. Fixed to walk the whole contiguous comment block; after the fix
7 → 6, one removal and nothing added, then the remaining five markers 6 → 0, six removals, nothing
added. **A re-run comparing TOTALS would have read "still 7" and he would have kept marking into a
silently inert hatch.**

**Why the set matters and the count does not:** suppression in a scanner usually decides what gets
PARSED, not merely what gets REPORTED, so a marker can REMOVE one finding and MANUFACTURE another
from the newly-reachable text — the same lane had already measured exactly that in firewall.rs. Net
zero on the total is then two changes cancelling, which is indistinguishable from no change at all.

**How to apply:** apply exemptions ONE AT A TIME; after the first, re-run and diff the finding SET,
asserting removals AND that nothing was added; state both numbers. Exercise the awkward placement
first (a continued literal's marker must ride the comment line ABOVE it) — the escape hatch nobody
has used in anger is the one that is broken. This is the third face of one rule this milestone:
a filter matching the expected COUNT can still have matched the wrong SET; a count falsifies only a
filter that matched NOTHING. Kin: [[a-mutation-that-reds-every-arm-proves-only-damage]],
[[unapplied-mutation-green-reads-as-a-passing-guard]],
[[a-coverage-fix-is-measured-over-the-population-it-claims]].
- 2026-09-07 face (hertz + doyle), the ABSENCE direction of the same rule: I proposed a defensive check -- a gate driver's witness line must print NOT-A-WITNESS when the cell is not in the LIST leg at all, because a verdict built only from ran-but-vacuous conditions passes a never-ran cell BY OMISSION (each refusal condition evaluates against output that does not exist, finds nothing to object to, falls through to green). doyle implemented it in gate-w2-f17.sh and it caught a real hole IN HIS OWN DRIVER on first run: the main filter had never included the twohost_web binary, so the mode I called hypothetical was already live. **A check you add for a 'hypothetical' absence may already be firing** -- absence is dangerous precisely because nothing announces it, so 'this cannot happen here' is a prediction, not an observation. Shape of the fix: assert PRESENCE first and quality second (a quality check on a missing subject is vacuous, and a vacuous check that prints nothing reads exactly like a satisfied one), and make the verdict THREE-valued -- NEVER-RAN / RAN-BUT-VACUOUS / WITNESSED -- because two of those three were previously indistinguishable from the good one.