the safety check that ships switched off

Every guard added to a live path is itself a risk. A guard that misfires under load takes the system down more reliably than the fault it was built for. So a new live cost gate was added the other way round from the obvious one: it ships behind a configuration flag, off by default, with the previous behaviour preserved byte for byte whenever the flag is absent.

Two properties were insisted on before it could be enabled. The gate fails closed — if the measured cost or the model constant it is compared against is missing, the decision is refused rather than allowed through on a guess. And every refusal is written to the ledger with its own reason code, so a quiet afternoon cannot be confused with a silent filter.

The tests came in two layers because the two failure modes are different: arithmetic of the comparison on synthetic inputs, and integration through the decision path proving that flag-off really is the old path and flag-on really refuses.

It was then not enabled, and the commit said so. Being built, tested and correct is a separate decision from being switched on, and that decision belongs to a person looking at the running system rather than to the engineer holding the diff.

It proves safety work is measured by restraint — the ability to build a guard and leave it switched off until someone signs for it.