Codify: Let the Real Operation Be the Check, and Close a Defect Class Through One Primitive #2431

Lesson

Two patterns came out of hardening the host-safety installer for #2423. The work ran from #2424 through #2429, and the record is in each PR body. Both belong in governance prose, likely CODESTYLE.md General or GOVERNANCE.md "Verification Discipline".

1. Let the real operation be the check, not a prediction of it.
   • Render CLAUDE.md First and Let the Real Write Be the Check #2427 first added a probe that predicted whether CLAUDE.md could be read and written, using exists(), is_file() and os.access.
   • Successive local-review rounds found 5, then 5, then 4 cases the probe got wrong: a dangling link, a link loop, a read-only file that was already current, a Windows ACL, and a backup directory that couldn't be written.
   • The fix that converged moved the file step ahead of every other write. It attempted the real read, backup and write, skipped the write when nothing would change, and turned any OSError into a clean refusal.
   • A prediction can drift from the operation it predicts. The operation itself can't.
2. Close a defect class through one primitive, not with a check at each site.
   • The same FIFO-blocks-the-read class surfaced three times, once each at CLAUDE.md, the local file and the stamp, across Render CLAUDE.md First and Let the Real Write Be the Check #2427 and Read the Local Instruction File Only When It Is a Regular File #2428, and it is still open for settings.json on Name a Partial CLAUDE.md Write Correctly and Stop Re-Backing Up a Refused File #2426.
   • Each per-site check also met platform differences of its own. On Python 3.14, Path.exists() and is_file() swallow OSError. On Windows, a file parent raises FileNotFoundError rather than NotADirectoryError.
   • read_regular_file() fixes it for good: open once with O_NONBLOCK, judge the open descriptor with fstat, and close it in a finally.
   • Once a class shows up a second time, the fix is the primitive plus moving every reader onto it.

Done means

• The rule text sits in its home section.
• Each skill that restates verification rules points at it.
• The remaining readers move onto read_regular_file(), as tracked on Name a Partial CLAUDE.md Write Correctly and Stop Re-Backing Up a Refused File #2426.