An instrument's candidate-selection rule hid a reachable hole
Replacing an alphabetical first-N slice with a capped selection rule exposed 1 reachable hole in the legacy refund variant, with a printed witness; the production model still showed 0 findings and 0 of 97 grid holes.
MeasurementHow we measureWorking note
- Designed for
- Built to test whether the probe's slice of foreign candidates hid reachable holes in the guard prototype's rule variants, and which candidate-selection rule fixes it.
What was tested
The probe’s foreign-candidate slice took the first candidates alphabetically. We replaced it with a rule that takes small foreign kinds whole and truncates large ones with the truncation printed, then refroze the 12 output blocks. The change was planned before the first run; no language model ran.
What we observed
The alphabetical slice had filled the charge slot with two junk spellings and no real charge. Under the new rule, the legacy refund variant showed 1 reachable gate pass with a printed witness: a charge lookup by e-mail after a lawful read. The production model showed 0 findings, 0 of 97 grid holes and 0 false positives. Defects in the selection knob itself were found, and a refreeze error made earlier was repeated.
What this means for Heimdall
Candidate selection in the probe decided whether a reachable hole was visible, so the probe’s coverage of candidates must be printed with each result. This is an instrument lesson, not a property of the guard.
Limits
Instrument-level, on synthetic fixtures; the plan predates this repository’s history; not rerun here or on today’s core.
What remains open
None planned beyond printing candidate coverage with probe results.