A negative control written from the guard confirms the guard, not the claim

.github/workflows/ci.yml

@@ -1603,8 +1603,27 @@ jobs:
       - name: CDEB evaluator OCI isolation matrix
         run: npx vitest run test/cdeb-evaluator-oci-matrix.test.ts
 
+  # A guard that does not fail under a mutation does not bind its claimed
+  # property. This deliberately runs separately from `check`: one Vitest
+  # process per control is expensive, and a missing or inert control must be
+  # visible as its own failing job rather than disappearing into the broad
+  # suite. This ratchet fails only when measurement regresses from the recorded
+  # baseline: its current gaps are thirteen exclusion-index kinds, one inert
+  # personal-path scan, and one unavailable exclusion-index control.
+  guard-mutations:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22.23.2'
+          cache: npm
+      - run: npm ci
+      - name: CDEB guard mutations bind their claimed properties
+        run: node scripts/guard-mutations.mjs
+
   # A fan-in so branch protection can require ONE stable context instead of
-  # eleven, several of which are matrix-interpolated.
+  # twelve, several of which are matrix-interpolated.
   #
   # `check (22.23.2)` carries the exact pinned floor, and the comment on that
   # matrix says why: a declared floor must name the exact release CI executes.
@@ -1634,6 +1653,7 @@ jobs:
       - install-script
       - install-ps1
       - oci-matrix
+      - guard-mutations
     runs-on: ubuntu-latest
     steps:
       - name: every job this gate fans in from succeeded
@@ -1647,6 +1667,7 @@ jobs:
             install-script=${{ needs.install-script.result }}
             install-ps1=${{ needs.install-ps1.result }}
             oci-matrix=${{ needs.oci-matrix.result }}
+            guard-mutations=${{ needs.guard-mutations.result }}
         run: |
           set -eu
           failed=0

bench/cdeb/guards/baseline.json

@@ -0,0 +1,86 @@
+{
+  "version": 1,
+  "properties": [
+    { "guard_id": "literature-lock-requires-complete-evidence", "outcome": "bound" },
+    { "guard_id": "literature-lock-refuses-circular-justification", "outcome": "bound" },
+    { "guard_id": "transition-ledger-refuses-cross-study-row", "outcome": "bound" },
+    { "guard_id": "candidate-identity-contract", "outcome": "bound" },
+    {
+      "guard_id": "exclusion-index-blocks-study-id-cdeb-v1",
+      "outcome": "unavailable",
+      "reason": "The census matches exclusion rows by value only, so disabling a study-id kind check cannot change the claim that this candidate is ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-study-id-cdeb-p-01",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this study identity is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-study-id-cdeb-fresh-v3",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this predecessor study identity is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-task-id-pricing-admin-quote",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this task identity is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-task-id-pending-rm-force",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this task identity is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-prompt-hash",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this prompt artifact is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-fixture-hash",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this evaluator fixture artifact is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-candidate-id",
+      "outcome": "uncovered",
+      "reason": "The census can match this candidate identifier by value, but the registry has no mutation that proves the claim makes it ineligible."
+    },
+    { "guard_id": "exclusion-index-blocks-record-id", "outcome": "bound" },
+    {
+      "guard_id": "exclusion-index-blocks-oracle-fixture-hash",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this oracle fixture artifact is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-randomization-id",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this randomization artifact is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-trajectory-id",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this trajectory artifact is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-result-row-id",
+      "outcome": "uncovered",
+      "reason": "The census matches exclusion rows by value only, so this result-row artifact is not represented in the candidate values that the claim would need to make ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-benchmark-authored-record",
+      "outcome": "uncovered",
+      "reason": "The census can match this source-record identity by value, but the registry has no mutation that proves the claim makes its candidate ineligible."
+    },
+    {
+      "guard_id": "exclusion-index-blocks-publicly-answer-exposed-decision",
+      "outcome": "uncovered",
+      "reason": "The census can match this decision's source-record identity by value, but the registry has no mutation that proves the claim makes its candidate ineligible."
+    },
+    { "guard_id": "frozen-bundle-digest-is-verified", "outcome": "bound" },
+    {
+      "guard_id": "personal-paths-are-absent-from-active-material",
+      "outcome": "inert",
+      "reason": "The current clean tree still passes when the personal-path scan is bypassed, so the claim has no constructed personal-path control."
+    }
+  ]
+}