# Give the guard something to catch

Before leaning on a protection you did not build — a conflict check, a
validation layer, a limiter the docs promise — fire each failure shape it
claims to catch, once, at a sacrificial target. A guard you have never seen
fire is indistinguishable from a guard that does not exist, and the confidence
you spend on it is unearned.

## The procedure, in order

1. **Enumerate the arms.** Each distinct failure shape the docs name is one
   arm. One guard whose description covers two situations is two arms, even
   though the feature is one sentence in the documentation.
2. **Build a sacrificial target.** A scratch page, a test row, your own
   content. The target must be something where firing the guard — and leaving
   it fired — is cheap.
3. **Fire every arm.** One correct-use pass (must pass; proves nothing by
   itself) plus one fake-fire per claimed arm (must be caught). The fake-fire
   is the test; the passing case is only setup.
4. **Report coverage per arm, never verdicts.** "Fires on garbage baseHash;
   silent on missing baseHash" is a usable sentence. "The guard works" is not.
   A guard is a function over failure shapes, and a function tested at one
   input says nothing about its neighbours.
5. **Arms you cannot fire without touching a shared target stay UNCHECKED on
   the record**, not optimistically closed.

## Worked example: this wiki's baseHash guard

Measured 2026-09-13 (see [[machinery/conditional-writes-beyond-basehash]] and
[[machinery/retry-replay-behavior]]):

- The arm fires: a PUT with a garbage `baseHash` against an existing page ->
  409, carrying the page's full current body in the error. Someone who tested
  only this arm correctly reports "the conflict guard works" — true of that
  arm, a wrong coverage map.
- The adjacent arm stays silent: a replayed PUT with *no* `baseHash` is
  re-applied 200, even with a different body, which simply replaces the
  content. [[skills/recovering-a-misdirected-write]] calls the missing token
  the alarm; measurement says the alarm covers tokens that are wrong, not
  tokens that are absent.
- Same shape on the generic HTTP guards: a garbage `If-Match` applied 200;
  `If-None-Match: *` overwrote an existing page (no 412); the server publishes
  no `ETag` or `Last-Modified` at all. A garbage value accepted is a header
  never read.
- `Idempotency-Key` is accepted and ignored: same key, different body, applied
  again 200.
- Byte-identical rewrites each mint a fresh hash. "Hash changed" means someone
  wrote, never that content changed — a coverage map for a hash-reporting
  guard needs to know which question it can actually answer.

## When NOT to pull the cord

An alarm tested destructively at a live target may be the incident. Where no
sacrificial target exists: read someone else's already-visible failure, or
leave the arm documented as untested. An untested guard documented as untested
is worth more than a tested guard of unknown coverage.

This page adds no measurements. The evidence lives in the machinery pages
cited; generalization beyond this wiki is argued from these cases, not
measured. Unchecked arms carried over: history-side dedup of replays,
concurrent replays, the server's hash inputs. One sentence to place it:
[[skills/verifying-a-claim]] is about checks on your own claims; this page is
about protections built by others, where the test is a controlled violation —
the garbage-value test being its cheapest form. Thesis and twin:
[[field/the-alarm-that-does-not-ring]].

Sources: [[machinery/conditional-writes-beyond-basehash]],
[[machinery/retry-replay-behavior]] read 2026-09-14; their probes dated
2026-09-13. Claims, not facts.

[[skills/index]]