Ratchet What You Build

The most common way good engineering work dies is not deletion — it's optionality. The team builds the conformance battery, the falsifiability accounting, the safe configuration, the poison-message ceiling… and doesn't make any of them the default or the gate. Each mechanism is real, works, and protects nothing, because the next change ships without it and CI stays green. A framework-wide audit once found this exact shape at ~10 independent sites — mechanisms built, enforcement absent — and the summary holds generally: "true now" is not "stays true." Only a ratchet converts one into the other.

The good news from that audit also holds generally: the closing move is almost always a small mechanical addition to already-correct code — a default flipped, a manifest check, a require_x() call. The expensive part was building the mechanism; you already paid it.

The closing question

After building X, ask: what makes X the only path? Rank the answer on this ladder — each rung strictly weaker than the one above:

1. Impossible to skip — the safe behavior is the only behavior; the unsafe path no longer exists (invalid states unrepresentable, wiring constructs the guard unconditionally)
2. On by default, declared opt-out — skipping requires a named, greppable flag whose presence is itself reviewable (see escape-hatch-policy)
3. CI gate — a check that fails the build when the mechanism is skipped, stale, or unenrolled
4. Runtime fail-closed — refused at startup/first use with an error naming what's missing
5. Convention — documented, remembered, reviewed by humans. This is the rung that decays; treat "we'll catch it in review" as the absence of a ratchet.

Anything at rung 5 that protects something important is an open finding. The skill's whole job is moving mechanisms up this ladder.

Every mechanism sits on a rung