fix: a refusal that blames another field is not about the value sent

[ShocOne]

Phase 7.2 — and not the shape the plan predicted. Reading the probes before building anything found the actual cause of one of the two known-wrong facts, and it is neither staleness nor a missing gate.

The cause, from the cassette

Five mutating probes — updateStyle, immutability, enumBoundary, normalisation, writeSideEffect — draw their conclusions from sc.Fixture(0) only:

fixture, _ := sc.Fixture(0)
body := fixture.Body
body[f.JSONPath] = candidate

So probing objectType=endpoint-agent sent a static-tag body with the object type swapped. The API answered, and 086-post-v7-tags.json records it verbatim:

type: Static tags are not supported for the provided object type

A refusal about type. The probe was varying objectType.

enumBoundary already had the guard — "a refusal counts as being about this field only when the error says so" — and it passed, because Names() normalises a field to its words and looks for them adjacently. "the provided object type" contains "object type" contiguously. So endpoint-agent became a rejected documented value at Observed confidence, and it is a perfectly good object type for a dynamic tag.

The fix

Adjacency cannot separate those readings. What can is that a validation failure prefixes the offending field and a colon, and prose does not:

value: value for the label cannot be null
accessType: You need to provide the accessType for the tag

Names() now treats those clause names as authoritative where any exist, and falls back to the previous match where none do — so an API answering in unstructured prose still gets a conclusion. Tested against eight strings a live tenant actually returned.

A tool that did not exist

Facts were only ever written by a record run. So a probe that stopped drawing a wrong conclusion made probe -mode verify fail, with no way to update the evidence short of a live run that also replaced it.

probe -mode replay -rederive writes facts back from the committed cassette with the network denied. Legitimate precisely because derivation is a pure function of the transcript — the claim verify exists to keep true. The checksum is verified first, the traffic does not move, and the diff is reviewable against evidence that has not changed. That is the difference between re-deriving and re-recording.

The result, measured

Set difference after re-deriving is exactly one fact withdrawn:

- objectType.rejectedValues = ["endpoint-agent"]

Nothing added, nothing otherwise changed, and a second -rederive is byte-identical. The large textual diff is reordering.

Merge then folded the description change. The stale rejectedValues in Behaviour had to be removed by hand, because merge may only widen — "only the hand-authored override layer may remove". That is the rule working, not a gap.

Two tests changed, and why

TestUnit_Emit_AllowedValuesBecomeAValidator asserted that endpoint-agent was named as refused beside the validator. That assertion rested on the false fact. The mechanism is real, so it moved to accessType, where system was genuinely refused with the field named — plus a new assertion that refuses the withdrawn claim, which is what would have caught this in the first place.

What is deliberately not here

The plan described declaring gate values and crossing them, with cost multiplying by branch count. Crossing declared values into one fixture would manufacture invalid bodies systematically — it is precisely what produced this false fact. A branch has to be a complete body a human declared, which is what a fixture already is. So 7.3's dynamic fixture is the mechanism, and a second one would be a way to generate more wrong facts faster.

Verification

gate	result
probe -mode verify	✅ 38 facts (was 39; one withdrawn)
-rederive idempotence	byte-identical on a second run
merge -check	idempotent
verify	24/24, no orphans
bindings	67 match the SDK
go test ./...	pass
internal/probe coverage	88.2%
gofumpt -l . / golangci-lint	empty / 0 issues
pilot go build && go vet	pass

🤖 Generated with Claude Code