A guard on one verb is not a guard on a noun

What the refusal does

The rule is simple. A model may not be emitted under the project's designation when it is structurally the control arm of its own ablation — one operator across every region, no cross-scale structure. That was a real mistake, made once, and the refusal exists so it cannot be made silently again.

It is tested by mutation: break the config so the condition holds, watch it refuse; restore it, watch it pass. It fires. It is not decoration.

What it did not stop

An evaluation of the new model produced a results file whose model_id read SC-WBD-001-beta — the previous model. A hardcoded string. That file is the one the public model card reads every score from.

Fixing it revealed a second: the comparison table inside the same file ranked the new model's own arm under the label scwbd_001_beta, in four places.

And a third, in a different module: the checkpoint discovery function takes the directory name as the designation and never reads the model_id recorded inside the checkpoint. Rename a folder, rename the model.

site	what it reaches
evaluation model_id	the file the model card reads its scores from
evaluation arm label	the comparison table inside that file
checkpoint discovery	anything that loads a checkpoint by path

Why nothing refused

The guard watches emission. These were writing and discovery. Same wrong state — an artifact carrying a name that is not its own — reached by verbs the guard has no view of.

A guard on one verb is not a guard on a noun. Ask of any refusal: what else can produce this same wrong state by a different verb?

The second defect survived the first fix

This part is the one worth carrying. After fixing model_id, the obvious check was a grep for the designation. It came back clean.

The arm label was lowercase, with underscores.

A literal you fix by grepping is a literal you fix only in the spelling you thought of.

So the repair is not a better grep. It is to derive the name once and let every consumer read it, leaving no spelling to miss. It lives in the config module rather than in any one consumer, because the defect is several consumers each spelling the name themselves:

def _designation(cfg) -> str:
    for obj in (cfg.train, cfg.model, cfg):
        for attr in ("model_id", "designation", "run_name"):
            v = getattr(obj, attr, None)
            if isinstance(v, str) and v:
                return v
    return "SC-WBD-unnamed"

The fallback is deliberate. It never returns a real designation, because an unnamed artifact is a visible defect and a misnamed one is not. If the lookup ever fails, we would rather ship something obviously broken than something quietly wrong.

Then it happened again, in the artifact itself

Everything above is about reports — files describing a model. Weeks later, checking the second model's release path, the same literal turned up in checkpoint.py:

"model_id": "SC-WBD-001-beta",

Every checkpoint the run-2 trainer wrote stamped the run-1 name into its own payload. Not a report about the artifact — the artifact.

The earlier fix had been grepped for. It missed this because the search was scoped to the module that had just been repaired, which is the natural thing to do and the reason the class survives.

The count nobody expected

So this time the fix was a test rather than another grep — one that looks for the class, a designation appearing as an assigned value anywhere in the package. It found five more:

site	what it was
schema/designation.py	the canonical constant
__init__.py	package-level copy
bench/report.py	copy
runtime/provenance.py	copy
foundation/manifest.py	a dataclass default — would misname any manifest built standalone
infer/report.py	an inline value — would misname every inference report

Six places for one name to be wrong, two of which were live defaults rather than constants. Now there is one definition and five imports.

The guard asserts exactly one assignment site — not zero. The name has to be written down somewhere; what makes it a defect is writing it down six times.

It also has to allow prose. These literals are discussed constantly in docstrings and comments, and a test that cannot tell a value from a sentence bans writing about the defect — a mistake this project has already made twice on another suite.

Where it was actually going to bite

None of the above was the real exposure. The model card was.

The run-2 publisher delegates to the run-1 publisher, which builds its card with a function that hardcoded not just the name but the entire framing:

# SC-WBD-001-beta                              <- the H1 title
pretty_name: SC-WBD-001-beta (run-1, ...)      <- the Hub's display name
tags: [..., "control-arm", ...]                <- on every artifact
"It is the control arm of our own ablation,
 shipped under the treatment arm's name."      <- the diagnosis section

Run 2 is the treatment arm. Published through that path it would have appeared on a public hub under the previous model's name, tagged as a control, with several paragraphs explaining that it is not a test of the thesis.

That is the exact state R12 exists to refuse — an artifact carrying a name and an arm that are not its own — reached through the card rather than through the weights. A guard on one verb is not a guard on a noun, for the fourth time.

It was two functions deep behind a missing evaluation file, which is why it took staging a placeholder evaluation to see it at all. The publish path reported one blocker, and one blocker reads as "one thing left" when it actually meant "one thing visible."

The guard that missed it

The class-guard written earlier the same day did not catch this. It looked for a designation as an assigned value:

[:=]\s*["']SC-WBD-\d{3}[-\w]*["']

The verdict line was built by concatenation — "SC-WBD-001-beta is beaten by " + ", ".join(...). The literal is a fragment of a string, not a whole value, so the pattern slid past it — in the single most quoted line on the card.

The replacement parses with ast instead: comments are absent from the tree entirely, and docstrings can be excluded by identity rather than guessed at from indentation.

Its first version swept the whole package and fired on about fifteen sites like "no trained SC-WBD-001-beta checkpoint was loaded" — error messages about run 1's artifact, which name it correctly and on purpose.

Fifteen legitimate hits is evidence the rule is wrong, not that the code is.

So it is scoped to the three modules whose strings become artifacts — the evaluation JSON, the checkpoint payload, the card. In those, a designation is emitted rather than discussed, and the literal has no honest use. Everywhere else it is prose, and prose stays allowed.

The uncomfortable part

Every one of these — the three in the reports, the six in the package — had existed for as long as the code had. They surfaced only because a second model finally existed to be misnamed. A single-artifact project cannot detect a naming bug at all: every name is trivially correct when there is only one thing to name.

Which is a reason to build the second artifact earlier than feels necessary.