A gate that cannot go red is not a gate

Parent: structure

Ten of the fifty-five check-* entries under infra/scripts/ (counted 2026-09-07) exist only to attack the other forty-five. Their shared opening line is the doctrine: 一个从没红过的闸门不是闸门 — a gate that has never gone red is not a gate.

The shape

Plant the exact thing the gate forbids → assert it goes red → remove it. check-routes-via-dispatcher-test plants a new file under internal/routes (not in the ratchet's baseline) that imports a domain facade directly — the precise escape the gate exists for. The planted file never compiles and never stays in the tree.

Smaller gates carry the self-test inside themselves and print it in their success line, so a green run says what it proved: check-one-corpus-href plants a bad URL, check-secrets plants a key in the allowlisted directory.

Why this is not paranoia

A guard fails silently in ways that look exactly like success:

• It stops seeing. grep --include goes silently blind on Alpine — the scanner returns nothing and reports clean. A scanner has to prove it can see, not merely that it found nothing.
• Its bait stops biting. The image secret-scan planted an aws_secret_access_key, but that rule carries an entropy threshold; a random string sometimes falls below it, so the self-test failed intermittently — and a failing self-test blocks the whole release. Switched to a private-key block, which is structural and has no threshold.
• Its subject moves. A gate scoped to a path stops covering code that moved out of it, and the move reports nothing.
• It scans the wrong thing. A green run says nothing about coverage unless coverage is printed. The image scan now prints scan surface: N text files / M binaries skipped, because the backend image's own COPY'd content is six Go binaries plus one shell script — that gate really scans one shell script, and printed the same word clean as the app image where the whole .next tree is text. Same word, three orders of magnitude apart in evidence.

The general rule

Check what a guard SCANS, not just that it is green. A green light from an instrument that cannot fail carries no information — the verification equivalent of an assertion whose failure is unreachable (judgment-audit). Every guard here is therefore itself audited by a guard, and the audit is an experiment (plant, expect red) rather than an inspection.

This is the same instinct as the owner's audit-the-artifact — read the real artifact, not the claim — applied one level up: the gate's own claim to be working is itself a claim, and it gets the same treatment.