The D block opened "Run against a temp dir, never live state", but _log_draw
hardcoded ~/.claude/state/tarbuckle-draws.jsonl and the selftest rebound only
LAST_TICK and SLOT, so D5's fire_tick appended a real-time tick record to the
live log on every run, and every mutant copy did the same. Two strays are
confirmed (2026-09-09T21:48:39, 2026-09-10T18:52:40); nothing in a tick record
separates live from test, so that is a floor.
The path is now a module global DRAWS, rebound and restored with the others.
Two new controls, both behavioural rather than source-string:
D9 the live log is untouched (existence, size, SHA-256, before vs after)
D10 the D block's tick landed in the redirected log. An absence-only check
passes when the write silently vanishes; this is the arm that fails then.
Verified under a throwaway HOME: fixed 34/34 with the fake live log unchanged;
the pre-fix file 32/32 green while writing it; M1 (rebinding deleted) fails
exactly D9+D10; M2 (write vanishes) fails exactly D10 with D9 passing; main()
with a due tick still records its tick. Real HOME: 34/34, live log SHA-256
unchanged, measured outside the selftest. Five-selftest census: none writes.
Tag claim: this addresses the instance. The class census covered the five
Tarbuckle selftests only; fleet-wide the class is unassessed, and pursuing it
would be [HARDENING].
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJM5fwqp456LDGzqiZXsgu
