Issue 15: The Bridge Beside the Burned One

Three weeks ago the studio corrupted one of its own protected files: a canonical append-only store, guarded by a script whose only job is to serialize writes so two sessions cannot tear each other's lines. The guard was present, tested, and had fired that same week. Then a session under deadline wrote to the file another way, with a plain shell redirect, and left a header that reads, in full, DL-next_dl_id=125. Not a decision: a corrupted line where a decision should be, because the write took a path the guard does not sit on.

The guard did nothing wrong. It was never asked. That is the whole problem this issue is about.

Engineering teams have learned to write the guard. The harder lesson, the one the studio has 1,439 learning packets to prove, is that a guard only constrains the paths it sits on. Wire a rule into one runner and you catch the callers that go through it; every other route to the same outcome is untouched. The rule is real for some paths and a suggestion for the rest, and the green check does not say which.

Issue 7 asked whether a rule has a guard; Issue 11, whether a runner reaches it. Both are necessary, and neither makes a guard a commitment device: it can exist, pass its test, fire daily, and still constrain nothing, because the outcome it protects has a second entrance. Thomas Schelling named the missing piece sixty-six years ago: a commitment works by removing your options, not by making the wrong one expensive. Burn the bridge so retreat is gone; leave a second bridge standing beside it and you have committed to nothing, because your future self, under deadline, will take it.

Two tools follow: a free one that reads your callers and reports whether a guard dominates a resource or a bypass bridge still stands, and a paid one that remembers, so a bypass returning after a refactor is caught when it comes back.

The Tape

Five from the wave, all the same shape: a guard that holds one path, and a second path around it.

• pre-commit, 15,541 stars (github.com/pre-commit/pre-commit, GitHub API 2026-08-30, MIT). A framework built to move a guard onto the path you cannot avoid, the commit. It succeeds, for the commits that run it.
• git commit --no-verify (also -n), the flag that skips every pre-commit and commit-msg hook in one keystroke. The bridge around the guard ships inside the tool, and gets used exactly when the guard would have caught something.
• GitHub required status checks, branch protection that refuses the merge server-side until the check passes. The burned-bridge version: the laptop cannot vote, so --no-verify buys nothing. Enforcement moved to the one path the actor does not control.
• The studio's corrupted header, DL-next_dl_id=125, left in daily/DECISION-LOG.md by a session that took a plain redirect around write-fence.sh (LP-1605, on disk 2026-08-30). Guard present, tested, firing; the write took the other path.
• 1,439 learning packets in research/learnings/ (on disk, 2026-08-30). The commission that ordered this issue said 580; the real number is over double that. The same failure recurs throughout: not a guard that was wrong, a guard that was routed around.

Two tools follow The Read, on opposite sides of the cut. The free chokepoint.py reports whether a guard dominates every write to a resource or whether a bypass is still open. The flagship, Chokepoint Memory on LightRAG, remembers the access graph across weeks, so a bypass that reappears after a refactor cannot slip back unseen.

The Read: a reachable guard is still a bridge you can walk around

To call a rule enforced is to make three claims, each stronger than the last, and most teams check the first, sometimes the second, almost never the third. Present: a guard exists, code that returns pass or fail on the rule (Issue 7's question). Reachable: some runner on a path the actor takes invokes it (Issue 11's question, a property of the call graph, not the guard's text). Dominant: the guard sits on every path that reaches the protected outcome, so no route to it can skip the guard. That last claim is the question left.

Reachability asks whether the guard is on some path; dominance asks whether it is on every path. A guard can be reachable, invoked a hundred times a day, and dominate nothing, because the outcome it protects has a second entrance. The commit hook is reachable on every commit that runs it and dominates nothing, because git commit --no-verify skips it. The serialized writer is the same: a shell redirect is a path to a write that never touches it.

There is a precise, old name for this. In compiler theory a node d dominates a node n when every path from the entry to n passes through d (Lengauer and Tarjan gave the fast algorithm still used to compute it, in 1979). Enforcement becomes a dominator question: does the guard dominate the write? If not, the paths that skip it are exactly your exposure, and they are usually few and nameable.

Schelling is why dominance, not reachability, binds. A commitment device does not make defection costly; it removes defection from the option set. The general burns the bridge behind the army so retreat is impossible, not expensive. A guard on the critical path is that burned bridge. A reachable but not dominant guard is a bridge burned beside a bridge left standing, the check green and the route around still open, and under load someone takes it.

This gives rules without memory a mechanical reading. The system keeps no memory of its own access graph, so a resource made safe today by routing its writers through one guard loses that safety the moment a new writer, a migration or a deadline backfill, lands off its path. The guard is unchanged; the guarantee is gone.

So the twenty-minute exercise, before any tool. Take your most important invariant, name the guard meant to enforce it, then do not read the guard: read everything that could reach the resource and check each path goes through it, not around it. The first pass almost always turns up one writer, recent and written in a hurry, that touches the resource directly, proof the guard never dominated it, only the paths you happened to route through.

A guard you can go around is not a commitment. It is a request, phrased in code, that the reader is free to decline.

The Tool: chokepoint.py

The exercise above, made runnable. Give it a resource, the guard meant to mediate its writes, and the directories of callers. It sorts each caller into THROUGH (reaches the resource only via the guard), BYPASS (writes it directly, around the guard), or READS. Any BYPASS makes the verdict BYPASSABLE, exit 1; every write path crossing the guard makes it DOMINATED, exit 0. Standard library only, no install.

#!/usr/bin/env python3
"""chokepoint.py, Bernard's Solved Game, Issue 15.

A guard is a commitment device only if EVERY path to the protected resource
crosses it. Issue 7 asked whether a guard exists. Issue 11 asked whether a
runner reaches it. This asks the strictly harder question a reachable guard
still fails: does the guard DOMINATE the resource, or is there a way around it?

Reachability is "the guard is on SOME path." Dominance is "the guard is on
EVERY path." Schelling's burned bridge only commits you if there is no second
bridge left standing next to it. A serialization guard that mediates writes is
worthless the moment one caller writes to the file directly, because the direct
write is the second bridge.

For a protected resource and the guard meant to mediate all writes to it, the
tool reads every caller and sorts each write path into one of:
THROUGH - the caller reaches the resource only via the guard
BYPASS - the caller writes the resource directly, around the guard
READS - the caller only reads the resource (no write path)

Verdict:
DOMINATED - every write path crosses the guard (exit 0)
BYPASSABLE - at least one caller writes around the guard (exit 1)

A direct write is a redirect ( > or >> ), a tee, an in-place sed, a truncate,
or a Python open(..., 'w'|'a') whose target names the resource. Passing the
resource as a bare ARGUMENT to the guard ( guard.sh work-ledger.jsonl ) is not
a direct write: that is the guard doing its job.

Standard library only. No install.

Usage:
python3 chokepoint.py --resource PATTERN --guard NAME --callers DIR [--callers DIR ...]

Exit codes:
0 DOMINATED (no bypass path)
1 BYPASSABLE (a caller writes around the guard)
2 no write path to the resource found at all
3 bad arguments
"""
import argparse
import os
import re
import sys

def discover(callers):
out = []
for path in callers:
if os.path.isdir(path):
for root, _d, files in os.walk(path):
for name in files:
if name.endswith((".sh", ".py", ".bash", ".yaml", ".yml")):
out.append(os.path.join(root, name))
elif os.path.isfile(path):
out.append(path)
return sorted(out)

def read(path):
try:
with open(path, "r", encoding="utf-8", errors="replace") as fh:
return fh.read()
except OSError:
return ""

def direct_write_lines(text, resource):
"""Lines that write the resource WITHOUT going through a guard: the bypass paths."""
res = resource
patterns = [
r">>?\s*\S*" + res, # echo x >> ...resource
r"\btee\b\s+(?:-a\s+)?\S*" + res, # tee -a ...resource
r"\bsed\b\s+-i\b[^\n]*" + res, # sed -i ... resource (in-place rewrite)
r"\btruncate\b[^\n]*" + res, # truncate ... resource
r"open\s*\(\s*['\"][^'\"]*" + res + r"[^'\"]*['\"]\s*,\s*['\"][aw]", # open(..,'w'|'a')
]
hits = []
for i, line in enumerate(text.splitlines(), 1):
for pat in patterns:
if re.search(pat, line):
hits.append((i, line.strip()))
break
return hits

def classify(text, resource, guard):
if not re.search(resource, text):
return None, []
writes = direct_write_lines(text, resource)
if writes:
return "BYPASS", writes
through_guard = re.search(
r"(?<![\w-])" + re.escape(os.path.basename(guard)) + r"(?![\w-])", text) is not None
if through_guard:
return "THROUGH", []
return "READS", []

def audit(resource, guard, callers):
rows = []
for path in discover(callers):
verdict, writes = classify(read(path), resource, guard)
if verdict is None:
continue
rows.append((os.path.basename(path), verdict, writes))
return rows

def report(rows, resource, guard):
print()
print("Chokepoint audit: does %s dominate every write to /%s/ ?"
% (os.path.basename(guard), resource))
print("=" * 62)
print(" %-26s %-9s %s" % ("caller", "path", "detail"))
print(" %-26s %-9s %s" % ("-" * 26, "-" * 9, "-" * 20))
for name, verdict, writes in rows:
detail = ""
if writes:
ln, txt = writes[0]
detail = "line %d: %s" % (ln, (txt[:44] + "..." if len(txt) > 44 else txt))
print(" %-26s %-9s %s" % (name, verdict, detail))
through = sum(1 for _n, v, _w in rows if v == "THROUGH")
bypass = sum(1 for _n, v, _w in rows if v == "BYPASS")
reads = sum(1 for _n, v, _w in rows if v == "READS")
print()
print(" %d callers touch the resource: THROUGH %d, BYPASS %d, READS %d"
% (through + bypass + reads, through, bypass, reads))
if bypass:
print()
print("VERDICT: BYPASSABLE. The guard is a bridge with a second bridge beside it.")
print("A commitment device that can be routed around is a recommendation.")
return 1
if through == 0:
print()
print("VERDICT: NO WRITE PATH. No caller writes the resource at all.")
return 2
print()
print("VERDICT: DOMINATED. Every write to the resource crosses the guard.")
return 0

def main(argv):
ap = argparse.ArgumentParser(
description="Audit whether a guard dominates all writes to a resource.")
ap.add_argument("--resource", required=True,
help="regex naming the protected resource, e.g. work-ledger\\.jsonl")
ap.add_argument("--guard", required=True,
help="the guard meant to mediate all writes, e.g. append-canonical.sh")
ap.add_argument("--callers", action="append", default=[],
help="a file or directory of callers (repeatable)")
args = ap.parse_args(argv)
if not args.callers:
print("error: at least one --callers is required", file=sys.stderr)
return 3
rows = audit(args.resource, args.guard, args.callers)
if not rows:
print("no caller references the resource %r" % args.resource, file=sys.stderr)
return 2
return report(rows, args.resource, args.guard)

if __name__ == "__main__":
sys.exit(main(sys.argv[1:]))

Run it against a fixture modelling the studio's own canonical-store wiring: the resource work-ledger.jsonl, the real append-canonical.sh guard, five callers. Two pipe their lines through the guard, two write it directly (a shell redirect and a Python append), one only reads.

$ python3 chokepoint.py --resource 'work-ledger\.jsonl' \
--guard append-canonical.sh --callers callers

Chokepoint audit: does append-canonical.sh dominate every write to /work-ledger\.jsonl/ ?
==============================================================
caller path detail
-------------------------- --------- --------------------
drain-session.sh THROUGH
heartbeat-gate.sh THROUGH
migrate-old.py BYPASS line 3: with open("research/raw-store/work-ledger.js...
quick-fix.sh BYPASS line 4: echo "$rec" >> research/raw-store/work-ledge...
reader.sh READS

5 callers touch the resource: THROUGH 2, BYPASS 2, READS 1

VERDICT: BYPASSABLE. The guard is a bridge with a second bridge beside it.
A commitment device that can be routed around is a recommendation.
$ echo $?
1

Rewrite the two bypass callers to route through the guard, change nothing else, and the same tool returns the other verdict:

$ python3 chokepoint.py --resource 'work-ledger\.jsonl' \
--guard append-canonical.sh --callers callers_fixed

5 callers touch the resource: THROUGH 4, BYPASS 0, READS 1

VERDICT: DOMINATED. Every write to the resource crosses the guard.
$ echo $?
0

The verdict flips only when the last bypass is closed. The guard was fine in both runs: dominance is a property of the callers, not the guard, and the exit code turns "can anyone go around this" into a gate a build can fail on.

Founder offer

Free, every week, forever: the argument, the evidence, and the from-scratch tool in full. This week that is chokepoint.py above, complete and runnable.

Pro, $15 a month or $250 a year: The Brief, the flagship tool's full source, the machine-readable Feed, and the archive. The flagship is the half that compounds: the free tool finds today's bypass, Chokepoint Memory catches the one that comes back.

Founder, $300 a year, capped at one hundred seats: everything in Pro, plus the founders-only MCP server, which goes live once all one hundred seats are taken. The bar below is the live tally of founding members; it reads zero because it is zero.

No pitch beyond that. The dominated guard is the argument.