overview / benchmarks / the refusals that cannot be undone
524 refusals is the wrong number to quote and this section exists to say so. Most of them are recoverable: a wip commit message, an action on a red test base, a ctest invocation whose tail hides the verdict. Worth refusing, and undoable — which means anyone can write those rules in a shell function in an afternoon, and nobody installs a tool for them.
BENCHMARK.md §3d · marked proven. Machine: Apple M2, arm64, macOS (Darwin 24.2.0). Toolchain: Apple clang 17.0.0, node v26.5.0, python 3.14.6.
The claim that survives that test is narrower. Split by whether the state comes back, measured 2026-09-05 over the same 28 days as §3b:
| class | refusals in 28 days | can you undo it? |
|---|---|---|
| recoverable — commit message, red base, hidden verdict | 414 | yes, re-run it |
| deferred — a push or deploy held back until the suite is green | 9 | nothing was lost |
| irreversible — truncating redirect, delete outside the tree, reflog expiry, blind in-place rewrite, guard switched off | 101 | no |
The middle row used to sit in the bottom one, and an outside reviewer caught it on 2026-09-03: push-gate was 15 of 57 real-work refusals — 26 % of the headline — and every one of its events reads "code was edited after the last passing test run". A push was deferred; nothing was destroyed. Counting it as irreversible made this project's own script violate the thesis it was written to defend. It is still a rule worth having; it is now counted where it belongs.
The 101 split again, because a guard measured on its own test harness is measuring itself: 73 on the operator's real work, 28 inside throwaway sandboxes this project's own red-team suites create. On real work that is 18.2 per week, across 11 distinct days.
Reproduce: python3 bench/irreversible.py (add --since YYYY-MM-DD for a window). It reads the ledger and nothing else, and it prints the sandbox split rather than hiding it in the total.
Read this honestly. Eighteen a week is one operator running coding agents hard, on a machine where those agents are trusted with a shell. A developer who does not run agents unattended will see a fraction of it. The number that would settle the question — how many irreversible actions a stranger's agent attempts in a week — is unmeasured, and it is the difference between "useful" and "necessary".
baseline-reflog-drop · baseline-rm-rf-outside · baseline-truncating-redirect · baseline-law-unmade · push-gate · guard-weaken
no-blind-inplace-source-rewrite · no-shell-rewrite-of-guard-or-promise