A gate without a must-fail case is not a gate
Context
I added automated guards for unsafe send paths and tenant scope patterns.
What went wrong
A scanner passed every route because it searched a window too large to fail. Green meant decoration, not proof.
What we changed
I require each new gate to ship with a synthetic case that must fail. Evidence windows narrow to the block that must contain the signal.
Result
If the must-fail case does not fail, the gate is unfinished. Automation that cannot fail is not protection.