Rules decay unless a machine enforces them
Everything in the chapters before this one is a rule someone must follow. Rules that people must follow decay, and they decay in a predictable direction: toward whatever produces the fewest arguments this quarter. A frame card gets reinterpreted in a hallway conversation. A threshold becomes "guidance." The only rules that survive contact with a release schedule are the ones a machine enforces on a build that fails. This chapter is the constitution's executable form: a field catalogue for every card the book relies on, and a fixture library of eight named failures that continuous integration must reproduce and refuse on every build.
Fixture: the leak that looked spectacular
Tomorrow's ten-year yield sitting in today's table. The as-of clock reads 14:00; the feature row's print time reads 10:00 the next morning. The fixture's result field is not a small, plausible-looking error. Its delta_hat is +0.20 with a confidence interval of [0.16, 0.24], deliberately spectacular, because a leak this good is exactly the kind that survives a code review from someone in a hurry.
The assertion has two parts, and the second matters as much as the first. Hard gates run before anything else, so the verdict is refuse, coded LEAKAGE_FUTURE_PRINT. But the fixture also asserts that delta_hat is never exposed in the response, and that the illegal value never enters agent memory. A refusal that still lets the beautiful number reach a dashboard is not a refusal; it is a refusal with a leak of its own, one hop downstream. The property under protection: leakage is refuse, never inconclusive, and never overridable by a result too good to ignore.
Fixture: the honest "we don't know yet"
A twelve-episode exam pack, a positive point estimate, delta_hat = 0.02, and a 95% interval of [-0.04, 0.08] that straddles zero. The pre-registered minimum detectable effect is 0.05. This fixture asserts a verdict of inconclusive, grants nothing, and pins two numbers alongside it: power against the desk's own MDE comes out to about 50%, and reaching 80% power would require 28 episodes, not twelve.
Those two extra numbers are not decoration. A harness that returns inconclusive for the right reason reproduces them exactly, computed from the standard error the fixture implies. A harness that hard-codes a rule like "twelve-day windows are always inconclusive" will not reproduce them, and the CI fixture catches the difference even though both harnesses return the same verdict on this one input. The property under protection: not knowing is not permission. Any refactor that quietly maps a missing interval, a null power note, or an unresolved comparison to allow fails here, on this exact fixture, before it ever reaches a live desk.
Fixture: the challenger that only won on one register
A challenger reports exam mean absolute error of 0.071 against a champion's 0.089, an apparently clean win. The fixture requires the ablation step to be run before that number means anything: shuffle the venue-id register alone, and the challenger's error jumps to 0.093 — worse than the champion it claimed to beat, by 20%. Worst-group breakdown confirms it: the champion's friendly-slice error is 0.080 against a co-break error of 0.140; the challenger's is 0.048 against 0.164, a worst-group ratio of 3.42 against a carded limit of 2.0. The assertion that closes the argument is the ablated number, not the headline one. A shortcut_report_hash of null — meaning the ablation and worst-group evidence was simply never produced — is by itself sufficient grounds for refusal on any ticket whose loss card names a suspect register. The property under protection: average improvement is not evidence until you know which slice of the data financed it.
A schema is a promise a hallway cannot break
Five more fixtures in the library follow the same pattern — a drift overlay sold as a hedge, a Black-Scholes number laundered into alpha, an uncorrected multiple-comparison search, a live coverage break, a coupled book treated as independent risk — each pinned to the exact shape of the artifact that causes it, not to a paragraph describing the artifact. That distinction is the whole chapter. A card described in prose is a policy, and a policy can be relaxed by whoever is in the room that day. A card defined by schema either validates or the build is red, and nobody gets to decide otherwise without changing the schema itself, on the record, in a diff someone else has to review. The eight fixtures are what stands between "we have a constitution" and "we have a document."
Book: Chapter 23 in Rulers Before Models.