The rules

Each of these was paid for. They are stated as they were learned.

A borrowed method is a symptom; the state behind it is the cause

Extracting a function's logic into the kernel never moved the borrowed count. What moved it was making the state the function needed a capability the host constructs and hands to the kernel. Port the state, and the method follows.

A port on host data is smaller than a port on host behaviour

needsEncryption(eventType) handed in by the host is behaviour; reverseTableMap handed in is data, and the kernel applies the rule. Prefer the data port every time. Trading four behaviour ports for four data ports leaves the count unchanged and moves the rules into the kernel, which is the point.

Repackaging is forbidden

Collapsing six ports into one object reads as −5 and removes nothing. The count is of dependencies, not of properties.

Every declared port is travelled

A port the kernel declares and never uses is surface a new host implements for nothing — and gets wrong without finding out. peerEnclave was a tested, green capability reading a key nothing wrote; it survived because no app path travelled it. The contract gate refuses an untravelled port.

A missing port is undefined until the first branch that needs it

Ports typed any are not type errors. dmEpochSet was destructured by the ingest path and supplied by nobody for weeks; every branch that populated an epoch ladder threw inside a catch, and the warning sat in the browser log through every green run. Gate declared-vs-supplied mechanically.

A Cmd the host cannot route is reported, never dropped

performNow returns { ok: false, error: 'no pollNow port' }, and the dispatcher says so. The log gate then refuses the run.

A fix that only makes a symptom rarer is refuted

A longer timeout, a bounded retry on a refusal, a re-run until green — each hides the same defect a little better. If a spec has to be edited to pass, stop and report it.

Never claim a pass you did not run — and read the artifact before running again

A "starved" verdict is not evidence about the machine. Two pages at 97 % of their main threads were a read-receipt ping-pong the DOM never showed; a CPU profile of the page named it in one run after five diagnoses by re-running had not.

Batch the gate, mechanically

Iterate on the fast tier; pay the full node + browser pass once per coherent group. As prose this slipped six times in a day; as a certificate the pre-commit hook checks, it cannot. See Testing cadence.