---
name: anti-oracle-refusal-is-opaque-to-the-test-too
description: "A deliberately single-message refusal (one token for unknown/expired/consumed/rate-limited) cannot tell a failing cell WHICH precondition it missed — and if the serving node logs nothing either, the red is undiagnosable by construction."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 1e15e6ca-6830-40c8-b051-25a9b1850b5c
  modified: 2026-08-18T23:56:00.221Z
---

Some refusals are opaque ON PURPOSE: an anti-oracle reply collapses several
causes into one token so a guesser learns nothing. That property is aimed at the
remote CALLER — and a test cell is a remote caller. So a cell that pins
"the far node must do X" against such a surface gets a red that names nothing,
and enumerating the refusal's authoring sites in source is the only route left.

Measured (twohost.rs:2479 @ c3ac672, denominator ONE): `Refused` had FOUR
authoring sites in `serve_one_redeem` and `claim_code` folded four more causes
into one `Err`. Fixture facts refuted empty-redeemer, never-minted, expired and
already-consumed; two survivors (shared-bucket rate limit, store-content miss)
were invisible in both jobs' logs. The serving node emitted ZERO diagnostics for
any arm — so the node that knew exactly why it refused told nobody, including its
own operator.

Second half, the one that generalises further: **a cell must control or probe
EVERY precondition of the outcome it pins.** That redemption's fourth
precondition was an arrival-rate bucket the receiving node SHARES with knock
arrivals from the same origin — spent by earlier rungs of the same ladder. The
fixture seeded the code record (exists / unexpired / unspent) and nothing about
the budget. Charging is per DELIVERY, not per unique record, so a replay inflates
it with no trace.

**Why:** the contract text said both things out loud ("ONE anti-oracle message
covering unknown, expired, consumed AND rate-limited alike"; "SHARES ONE BUCKET
with knock arrivals from that origin"), and reading it was what turned an
un-diagnosable red into a bounded set plus a probe.

**How to apply:** when a red is a bare refusal token, go straight to the
refusal's authoring sites and enumerate preconditions, then refute them one by
one against fixture facts — do not theorize a mechanism first. Ask whether the
outcome depends on a SHARED resource earlier cells consume. And check the REQ's
`required_stages`: if the promise you are leaning on has no `int` stage, the cell
is pinning a precondition, not the contract. Anti-oracle constrains the WIRE
reply; a local log line at the refusing node is not an oracle for a remote
guesser, and its absence is worth raising. Kin:
[[barrier-must-be-the-fact-you-assert]], [[a-predicate-without-its-tool-is-not-evidence]],
[[healthy-path-emits-the-same-silence]].