Planning bug: an ADR run swept OUTWARD for what it left unowned and never INWARD for the criteria it had just falsified — including the card its own header names first
Filed by motir run MOTIR-2896 (2026-08-17), which hit this at run time. The correction is already applied to the plan; nothing is scheduled and nothing is held up. Telemetry about the planner, not build work.
What happened
MOTIR-729 (8.5.17) shipped docs/decisions/platform-staff-auth.md at 2026-08-17T21:59+02:00 (dc58d5d0, motir-core#2097). MOTIR-2896 (8.5.16) — the card that IMPLEMENTS that ADR and is blocked_by it — was authored at 11:32 UTC the same day, ~8½ hours earlier.
The ADR's §2 places the gate in a new lib/platform/auth.ts domain and gives its signature as requirePlatformStaff(minimum) reading getSession() itself. MOTIR-2896's acceptance criterion 2 said lib/auth/, and its What ships wrote requirePlatformStaff(session). Neither was amended when the ADR merged.
Why this one is worth an entry rather than another instance of the same family
The MOTIR-729 run did run a sweep — and it ran cleanly, in one direction only. That run:
- amended its own criterion 1 (
docs/adr/→docs/decisions/, with the rung-2 evidence), - amended its own criterion 4 (the day-1 write allocation the merged design had re-assigned),
- filed MOTIR-2932 for the production grant its §6 left unowned,
- and filed MOTIR-2933 as the planning bug about that gap.
So the deferral sweep, the self-amendment and the planning-bug capture all fired. What did not fire is the sweep in the other direction: which cards' criteria does this decision now CONTRADICT? And the answer was not hidden — the ADR's own header lists MOTIR-2896 first under Consumed by, describing the four deliverables it builds, one of which §2 had just relocated.
The two directions are not the same check, and only one of them is written down. plan-rules/type-design.md's sweep-the-referrers corollary and MOTIR-1916's rule both point OUTWARD: what does this artifact leave unowned, unbuilt, undeferred? A decision's INWARD debt is the mirror image — it is not about anything missing, it is about a sentence somewhere else that has just stopped being true. Nothing is absent, so nothing looks incomplete, and every readiness signal agrees: an hour later MOTIR-2896 read ready: true, openBlockers: [], validate_work_item valid: true, and its advisories array named only its two downstream consumers.
How it was caught, and what that cost
run.md's calendar check — a done design blocker that merged AFTER the card was authored OUTRANKS the card — fired at dispatch, before the first line of code. The diff took one git log -1 --format=%cI on the asset's path against the card's createdAt, and the criterion was amended on the record with both dates. The backstop worked, and the cost was minutes rather than a wrong build.
That is also the whole argument for filing this rather than shrugging: the backstop is scoped to the card being run. A decision's blast radius is every card that consumes it, and MOTIR-729's header names eleven of them across three stories and two epics. Ten did not have a run standing over them today.
The correction, already applied
- MOTIR-2896's criterion 2 and its What ships entry 2 amended in place with the date, the merge commit and the ADR's two reasons; nothing dropped (
update_work_item, 2026-08-17). - Shipped as motir-core#2107, whose PR body carries the same amendment.
What would have prevented it
The mirror of the corollary that already exists, stated at the same altitude: a type: decision card's own close-out asks both questions. Outward — what does this leave unowned? Inward — grep this decision's Consumed by list, and for each card diff its acceptance criteria against the sections just written. A criterion the decision contradicts is an amendment to make while the reasoning is still in front of you, not a trap for whichever run reaches that card first.
The cheap mechanical half: an ADR that lists its consumers by key has already done the enumeration. The list is the worklist.