D0021 — SafetyCensus() shipped: does it stay as public API, or get deprecated out? (C1–C2)

[jwildfire]

The gsm.safety v1.1.0 release is merged and held one step short of publication over its new census function, SafetyCensus(). It is exported, so publishing makes it public API of a clinical package — after which removing it is a breaking change rather than a decision not to ship. This thread closes the hold.

Seven adversarial reviewers examined it — six briefed to argue it out (pipeline fit, column conventions, testability, duplication, comprehensibility, usage) and one steelman briefed to keep it — and every factual claim went to an independent fact-checker: 47 claims, 29 confirmed, 20 overstated and corrected on the page, none refuted. The recommendation was formed only after every lens had reported.

What survived, in one line each:

• The correctness attacks landed: run on the ecosystem's own bundled study the function reports one death where the death records hold at least twelve, a missing column yields false clinical zeros, and ghost IDs push numerators past their denominators — five completers in a four-person study. All verified by execution.
• The usage attack failed: the deployed demo site really does fetch and render its output today — though it degrades gracefully without it, so pulling the export breaks nothing deployed.
• The steelman won real ground: the RC you approved names the function, your recorded blinding decision is honored exactly in the code, and the per-visit coverage idea exists nowhere else in the ecosystem.

C1 (D0021.1) — does SafetyCensus() ship in v1.1.0, or come out before publication? Recommendation: it comes out — a removal PR, a fresh RC for your approval, then a clean publish. This is the last moment removal is not a breaking change.

C2 (D0021.2) — is a requirement filed to bring the census back lane-shaped in a later release, keeping the per-visit coverage idea, or does the census stay demo-local? Recommendation: file the requirement.

The full argument: https://jwildfire.github.io/obot.roadmap/reports/decisions/2026-08-17-safetycensus-stay-or-go/

---

This thread was drafted by 😺🤖 Claude Code (Claude Fable 5, worker W0023) and reviewed by @jwildfire.

[obotclaw[bot]]

Correction — 2026-08-18. The release this thread says is held was already published when the thread was opened.

This thread opened saying gsm.safety v1.1.0 was "merged and held one step short of publication," that "this thread closes the hold," and that pulling the export now is "the last moment removal is not a breaking change." None of that was true at the moment it was written.

Verified against the release object rather than inferred from the review:

• v1.1.0 was created 2026-08-17T05:40:40Z and published 2026-08-17T05:42:53Z — not a draft, not a pre-release, marked Latest.
• This thread opened at 05:58:59Z and the decision page was committed at 05:58Z — both about sixteen minutes after publication.
• export(SafetyCensus) is line 7 of NAMESPACE at the v1.1.0 tag and on main today, and the function is a headline bullet in the published release notes.

@jwildfire lifted the hold himself that morning, on his own merging-is-commitment principle. The review kept running against a world that had already changed, and nothing noticed.

What this changes, and what it does not. Only the framing. Every verified finding stands exactly as the panel reported it — the death count, the false zeros, the ghost IDs, the wrong column dialect, the workflow-orphan shape — and so does the recommendation, which is reproduced on the page in the words it was published in.

The question moved. It is no longer whether SafetyCensus() ships. It shipped. C1 (D0021.1) is now: does it stay as public API of gsm.safety, or is it deprecated now and removed in the next version? Same evidence, different choice — and the difference is the price. The cheap exit is gone; removal now costs a deprecation cycle, which is the path every lens on the panel priced worst. C2 (D0021.2) is unaffected.

D0021 stays open and both questions keep their numbers. Nothing in gsm.safety was touched — not the release, not the tag, not NAMESPACE. This is a documentation correction.

The original post above is left standing as the record rather than edited. The thread title was changed from "D0021 — SafetyCensus(): stays or goes, before v1.1.0 publishes (C1–C2)" to match the corrected question, because the old one was actively wrong in every notification and search result it appeared in. The corrected page, with the expired claims struck through in place: https://jwildfire.github.io/obot.roadmap/reports/decisions/2026-08-17-safetycensus-stay-or-go/

Correction task #268 (PR #269), under requirement #266 — that an artifact should notice when its own premise expires.

---

This comment was drafted by 👯🤖 Claude Code (Claude Opus 5, worker W0071).

[obotclaw[bot]]

Decided — 2026-08-18. SafetyCensus() stays, and is rebuilt.

@jwildfire answered C1 (D0021.1) and C2 (D0021.2) today, and he went against the recommendation. The function is not deprecated: he asked for it kept under its own name, or at minimum an alias preserving the name, and rebuilt on the gsm metric framework as metrics plus a report — designed first, implemented second.

His words are on the decided page verbatim and complete, with the disfluencies kept: https://jwildfire.github.io/obot.roadmap/reports/decisions/2026-08-17-safetycensus-stay-or-go/

"It stays, but with a major, major refactor, that probably you'll need to design first and then implement, and you may need to ask me questions, and that's fine."

The recommendation is not overruled. Every verified finding stands and none is retracted — the death count that cannot be trusted, the false zeros, the ghost IDs, the wrong column dialect, seven lenses and forty-seven fact-checked claims. The panel judged the implementation and found it indefensible. He is judging what the census is for: a standing safety summary for open.gismo, and that purpose survives bad code. Both were right about different things. The answer to numbers that cannot be trusted is to make them trustable, not to remove the thing that needed them.

The load-bearing sentence is about metrics rather than about the census.

"Not every metric has to have an action associated with it… The point of metrics is to have trustable numbers that we can qualify and validate."

That cuts against how gsm.safety's existing three metrics were built — all of them flaggable and actionable — and it is what makes the rebuild possible: the death count earns its place in the framework by being a number you can validate, whether or not anything fires on it.

The direction, as he gave it. Model it on the gsm.kri report. Move the core numbers into the gsm metric framework as metrics rather than logic buried in one function. Make the census itself a report, possibly with charting functions, the way safety.viz and gsm.viz already do. Build it as workflows plus helper functions the workflows call, not one large function doing all the work.

C2 resolves into the same requirement from the other direction. The census never leaves, so the per-visit coverage idea and the blinding stance are carried by the rebuild rather than by a return trip after a removal. The recommendation on C2 was to file the requirement; it is filed.

Where the refactor lives from here: requirement #274 — design first, his review gates applying throughout, and the design carrying its questions to him rather than resolving them silently, because he invited them.

The channel is part of the record: dictated to 🎩🤖 obot-prime in chat from his phone after listening to the audio episode of the page — the second decision taken that way today, after D0020 this morning. Three dictated names are rendered on the page and named as transcription rather than silently fixed: "GSMK arrive report" is the gsm.kri report, "safety biz" and "GSM biz" are safety.viz and gsm.viz, "open gizmo" is open.gismo.

Nothing in gsm.safety moved on this record — not the function, not the release, not the tag. Recorded by task #276 (PR #277).

---

This comment was drafted by 👯🤖 Claude Code (Claude Opus 5, worker W0075).