Eight gates were green because nobody asked them: the readings are in #5277

Re-filed from #2762. An attempt claimed that issue on 2026-09-24 and left an empty branch, and a dispatch row that has spent its retry ceiling keeps its issue for good - so no bee could take it again, however much the brief improved. The work below is carried over unchanged.

tri gates unmeasured named 28 workflows with no default-branch run in 30 days. All 27 that could be were dispatched at master. This is what they said.

Twelve refused to launch: they have no file

Thirteen of 59 workflows GitHub lists as active have no file in the tree — deleted from the repository, never deregistered:

.github/workflows/ci.yml            (CI)
.github/workflows/clara-demo.yml    (CLARA Demo)
.github/workflows/coq-canonical.yml (coq-canonical)
.github/workflows/coq-ci.yml        (Coq Verification)
.github/workflows/formal-yosys.yml  (Formal (Yosys))
.github/workflows/format-check.yml
.github/workflows/iverilog-gate.yml (iverilog -g2005 strict)
.github/workflows/no-js.yml         (No JS Violation)
.github/workflows/test.yml          (t27 CI)
...and four more

They can never run, so they can never be measured. tri gates unmeasured reports them under their own heading now and excludes them from the total: 28 of 58 unmeasured became 13 ghosts and 1 of 46 unmeasured.

They should be deleted in the Actions UI, or their files restored. Either is a decision, not a repair.

Eight that ran, and failed

The first two are one cause and are fixed — the pin is now the floating rust:1, matching what bootstrap/Dockerfile already does.

Brain Seal Refresh is the interesting one: it exists to push refreshed seals to master, and the branch ruleset blocks exactly that. It cannot succeed as written. Either it opens a pull request instead, or it is removed.

Deploy Control Plane API needs a secret that is not set. That is an owner decision — whether the workflow should exist at all.

The remaining three need someone to read their logs; each is a single job with a bare exit code.

Two that were fine

Check Now Freshness and Release Pipeline went red on dispatch correctly:

• The freshness gate reads the docs/now/ entry a pull request adds. A dispatch has no pull request, so it now says NOT APPLICABLE and exits 0 rather than failing at something outside its subject.
• The release pipeline refused on an empty tag and skipped every publishing job. An accidental dispatch of the pipeline that publishes to four registries did nothing — which is the preflight from The release pipeline published the wrong product, unsequenced, and could not package t27c #2753 earning its keep, tested by accident.

The pattern

Eight gates had been reading as fine because nothing had triggered them since June. Not one of these is a new defect; every one had been true and invisible for months. The workflow_dispatch added in #2759 is what made the question askable, and asking it once cost a few minutes.

Boundary

• clara-bridge/.github/workflows/ci.yml

The instruments

Every one of these reads and prints; none of them writes. Run them from the repository root, with <spec> replaced by the file in ## Boundary:

.t27 is not Rust and not Zig, and a bee fluent in either writes one by
accident. Measured 2026-09-20: a bee filled eight bodies in
specs/file/watcher.t27 with return Ok(());, Err(FileError::WatcherNotFound)
and for i in 0..watchers.length. The parse ratchet refused the whole file --
Unexpected token in expression: RParen, line 123 -- and a spec that does not
parse generates nothing, so every test it already carried stopped running.

At the top level the parser accepts exactly these eight forms, with an optional
pub, and no others:

const   var   fn   enum   struct   test   invariant   bench

There is no trait, no impl, no type X = ..., no generics, no macro. What
a bee reaches for from another language, and what happens:

• Rust's result sugar (Ok(()), Err(E::V), ?) is not a construct here.
• Rust macros (println!, format!, vec!) are not constructs here.
• A range loop (for i in 0..n) is Rust and Zig, not this language.
• Zig builtins (catch unreachable, @intCast, @constCast) are not constructs here.
• Cross-module reuse (use other::fn;) parses and then generates a comment and an unqualified call, so the Zig fails with use of undeclared identifier (use a::b; generates no import, so no spec can reuse a function from another spec #4298). It does not work yet.

t27c parse <spec> answers in one line whether what you wrote is the language.
Run it before you report, every time.

• t27c spec-status <spec> - the compiler's one-word verdict: IMPLEMENTED, PARTIAL, UNWRITTEN, NOPARSE, NOFN. Exit code is 0 whatever it says, so read the word.
• t27c symbols <spec> - every name the file declares, with its kind. Answers "does this already exist here?" before you add it.
• t27c outline <spec> - per function: its locals, what it calls, what it returns. The contract you are implementing against.
• t27c coverage <spec> - which functions have a test and which do not. The issue asks for tests; this is how you check you wrote them.
• t27c lint <spec> - style and shape warnings. It OVER-REPORTS has no test or invariant: measured 2026-09-20 over 60 specs it printed 677 of those where coverage found 190 untested functions, disagreeing on 59 of the 60 - it warns about bit_to_trit_pair in specs/base/ternary_encoding.t27, which test bit_to_trit_pair_zero calls on line 249. Read it as a hint; coverage is the answer.
• t27c typecheck <spec> - types, before generation. Prints Typecheck OK (0 errors, 0 warnings) or the errors.
• t27c test-report <spec> - builds this spec and runs its own tests, which is what the oracle does. BLOCKED means the generated Zig does not compile, with the error beside it.
• python3 tools/dupe_scan.py --name <function> - where that function already lives, if it does. 576 of 4021 bodies here are byte-identical copies.

The rest of the toolbelt is in docs/BEE_TOOLBELT.md.