Whether an evaluation failure is a BROKEN GUARD rather than absent data.
This is the structural half of R3-6, and it is the one that matters. Enumerating V8 message
strings closes today's holes and leaves tomorrow's open: 'in' and Object were both blessed at
the door while their absence messages went unmatched, and each miss is a permanent silent stall on
a terminal origin whose output can never change.
Since the null-safe envelope guarantees every declared ROOT resolves, a ReferenceError is the
only failure that can mean "this guard names something that does not exist" — everything else is
the expression tripping over data that is not there, whatever operator it tripped over. So the
classification is inverted: name the broken-guard case, and treat the rest as absence. The
signature list above is kept as a fast path and as documentation of the shapes seen in the wild.
A POLICY REFUSAL is the second broken-guard shape.SafeExpressionEvaluator refuses a
construct outside its allowlist before it ever compiles, so the failure is not the expression
meeting absent data — it is a guard this build will never run, on any input. That was nearly
unreachable while the screen was a textual denylist that refused almost nothing; an AST allowlist
makes it reachable for a graph already stored in the database, and without this signature such a
graph would silently REROUTE — drop, with TaskGraphDispatcher logging a reason only on
hold. Holding instead is the visible-and-recoverable reading this file argues for everywhere
else: an upgrade stalls loudly rather than quietly taking a different path.
Whether an evaluation failure is a BROKEN GUARD rather than absent data.
This is the structural half of R3-6, and it is the one that matters. Enumerating V8 message strings closes today's holes and leaves tomorrow's open:
'in'andObjectwere both blessed at the door while their absence messages went unmatched, and each miss is a permanent silent stall on a terminal origin whose output can never change.Since the null-safe envelope guarantees every declared ROOT resolves, a
ReferenceErroris the only failure that can mean "this guard names something that does not exist" — everything else is the expression tripping over data that is not there, whatever operator it tripped over. So the classification is inverted: name the broken-guard case, and treat the rest as absence. The signature list above is kept as a fast path and as documentation of the shapes seen in the wild.A POLICY REFUSAL is the second broken-guard shape.
SafeExpressionEvaluatorrefuses a construct outside its allowlist before it ever compiles, so the failure is not the expression meeting absent data — it is a guard this build will never run, on any input. That was nearly unreachable while the screen was a textual denylist that refused almost nothing; an AST allowlist makes it reachable for a graph already stored in the database, and without this signature such a graph would silently REROUTE —drop, withTaskGraphDispatcherlogging a reason only onhold. Holding instead is the visible-and-recoverable reading this file argues for everywhere else: an upgrade stalls loudly rather than quietly taking a different path.