Three payloads get through an application protected by a rail stack: one matched no pattern rule, one was approved by the rail that asks a judge model, and one matched no canonical example so the turn reached the application model on the unmatched path. Why file three separate defects rather than one, and what does the fix look like for each?

### The instrument's unit is a hit; the report's unit is a defect someone can close Three hits, one ticket, and the information the owner needs is gone. The three results differ along every axis a tracker cares about. | | Pattern rule missed | Judge rail approved | No canonical form matched | |---|---|---|---| | Config artefact to change | the rule or action inside the flow | the `self_check_input` template in `prompts.yml`, or the judge under `models:` | a `define user` example, the similarity threshold, or the default path | | Who owns it | the rule-set author | whoever owns judge configuration | whoever owns routing and the unmatched path | | What "closed" means | one replay of the exact payload | a pass rate at the same n as the original measurement | a family retest, or a structural default-deny | | What invalidates the fix later | a new payload variant | a judge-model or template change | a new example, a moved threshold, a new embedding model | Three owners, three definitions of done, three expiry conditions. That is three tickets in any tracker that has ever been used in anger. ### The mechanism behind each fix The **rule gap** is enumerable and deterministic: widen or add the pattern, replay once, done. The residual risk — payloads nobody enumerated — is a coverage argument for a different document, not an open state on this ticket. The **judge approval** has no closed state, only a moved number. The owner can tighten the self-check instruction, raise strictness, or swap the judge model, and each of those changes the *distribution* of verdicts near the boundary. Verification is a re-measurement at the original n, comparing rates. The **unmatched routing** is the structural one. Because the turn cleared no canonical form's threshold, nothing attached to any intent ran for it; flows under `rails.input.flows` and `rails.output.flows` are not intent-attached and still executed, so state that scope precisely rather than saying "ungoverned" flatly. The tempting fix — add your exact phrasing as a new `define user` example — closes one point and re-partitions the neighbourhood around it, which can pull unrelated turns onto the wrong path. The real fix is making the unmatched path safe by default. ### What it costs The costs are as unequal as the fixes, and that asymmetry is worth putting in the ticket so nobody plans them as one unit of work. Re-testing the rule gap is one request. Re-testing the judge ticket is 2n requests minimum — n before, n after — which at n=30 with a judge call plus a downstream generation per replay is a couple of hundred model calls and an hour of wall clock per verification round. Re-testing the routing ticket is the whole paraphrase family times its replay count, plus the authoring time to keep that family meaning-preserving, plus a re-run whenever the example set or embedding model moves. Triage time is the hidden line item: attributing each of the three hits to a layer, via trace or differential run, is usually more engineer-hours than finding them was. ### Where the number misleads Someone will ask for a headline: *"three bypasses in a 200-payload run, so a 1.5% bypass rate."* Two things are wrong with it. The denominator is **your own probe set** — it measures what you chose to send, and it moves if you send more of what already worked. And the numerator pools three incommensurable events: a binary rule miss that is certain, a soft-boundary rate that is a sample, and a skipped routing path that is not a rate at all. Averaging a certainty with a sample yields a number that is wrong in both directions at once. A combined severity does the same damage more quietly. And do not describe the ungoverned turn as *"the model answered a harmful question"*: that phrasing routes the ticket to the model team, when the finding is that the governing layer never ran. ### What you would check Each ticket carries the evidence that establishes its layer — a trace excerpt showing which rails executed, or the differential run that flipped the verdict — because without it the ticket is an assertion. Each carries a verification recipe the owner can actually execute: the exact payload for the rule, the payload plus n and the judge identity for the self-check, the paraphrase family plus example set, threshold and embedding model for the routing. Rank the ungoverned path highest despite its quiet symptom; candidates get this backwards because it produced the least dramatic output, but a hole in one rule is smaller than a hole through the routing layer. And say the measurability line out loud: deterministic layers fail as gaps you can name and close, model-backed layers fail as scores you can only move. A guardrail report written in a single voice is hiding one of them.