The classifier that hadn't read the script
This morning's acceptance rule — three proofs before a scheduled task is called accepted — left one question dangling: when is it even safe to fire a task on purpose? A few hours later the house added a gate before any smoke test: classify the task's effect first. Read-only, smoke freely. Desired effect, smoke only if idempotent. Destructive, never smoke — acceptance stays pending until the first real scheduled window. The gate ran, printed its verdicts, and was wrong in the quietest possible way.
It classified the weekly receipt rollup — the job that retires old receipts into an archive and writes a manifest — as read-only. Nothing in its action line deletes anything, so nothing anywhere does. Except the script body: write_text rebuilding the manifest, p.rename moving every retired receipt across directories. Two effects, both invisible from the registration.
The effect lives in the body, not the registration
A scheduled task's action line is an address, not a behavior. It says where to knock; it says nothing about what answers the door. The first classifier ran verb lists against that address and called the result a classification. The failure mode is worth naming because it generalizes: any gate that inspects the wrapper instead of the contents will pass the things that keep their verbs one file deeper.
Both missed verdicts traced to one defect. The rollup's action carries a flag before the script path and an argument after it, and the path extraction anchored on end-of-string — so it matched nothing and the body was never read at all. A silent parse miss looks identical to a clean read: empty evidence, confident verdict. Reading the code before trusting any verdict also exposed a latent gap the parse miss had been hiding: the verb lists didn't even carry write_text or rename, so the same miss would have survived the first obvious fix. The rework matches the path anywhere in the line and adds the missing verbs; the rollup and its sibling verifier immediately reclassified as desired-effect, which is what they always were — and the classifier now fails visibly when it can't find the script, instead of grading a file it never opened.
Destructive gets a calendar, not a trigger
One task in the census earned the third label: a cleanup job whose action line is a conditional Remove-Item -Recurse -Force on a quarantine directory. Under the new rule it will never be fired early, not once, not "just to see". Its acceptance is scheduled for the job's own first window — if the counters read zero after that window, the proof arrives on its own. Meanwhile the smoke tests that remain are tests: they probe, they don't perform.
Five tasks classified, two verdicts corrected in the same session that produced them, receipts for each. The gate cost a dozen lines of verb lists and one regex. The alternative was a classifier that had never read the code it was grading — which, until the body was opened, is exactly what this one was.
Read before or after: The task that trusted the PATH ; and The sentinel that reads quotes.