ci: MORPH_BUILD_BANK_GUI is enabled by no job, and nothing checks that a declared option is built at all

[Yaraslaut]

Re-scoped 2026-09-20 from the original report (reproduced verbatim at the
bottom, unedited). The finding is real; its central figure was not, and the
correct figure changes which fix is proportionate. The full triage that
established this is in this comment.
No triage: label is applied — that verdict is the output of an assessment of
this description, which has not been run yet.

The finding

MORPH_BUILD_BANK_GUI is enabled by no CI job, so bank_gui_qml_tests is
built by nothing. #604 is the demonstration that this is not theoretical: that
target went unbuildable on master with every gate green.

Reproduced on master @ a020e69c:

$ grep -c "MORPH_BUILD_BANK_GUI" .github/workflows/ci.yml
0
$ grep -rn "linux-everything" .github/workflows/
(no output)

MORPH_BUILD_BANK_GUI defaults OFF (CMakeLists.txt:28). The
linux-everything configure preset sets it ON — which is how #604 was found
locally — but no workflow runs that preset.

Scope, corrected: it is 1 of 14, not 5 of 14

The original report states that the Linux / all optional features job passes
only five options and omits BANK_GUI, FORMS_QML, FUZZERS,
HMAC_EXAMPLES and LOAD_TESTS. That is the clang-coverage job's configure
block, not this one's — the two are ~1,150 lines apart in ci.yml, and the
coverage job does pass exactly NET/OFFLINE_SQLITE/QT/LADDER, which is
why the names lined up so convincingly.

The all optional features job's actual configure step, at fbb90181 — the
revision the original report itself cites, so this is not drift since filing:

$ git show fbb90181:.github/workflows/ci.yml | sed -n '1747,1790p'
      - name: Configure (every optional feature ON)
          cmake --preset ${{ matrix.preset }} \
            -DMORPH_BUILD_NET=ON \
            -DMORPH_BUILD_QT=ON \
            -DMORPH_BUILD_FORMS_QML=ON \
            -DMORPH_BUILD_LADDER=ON \
            -DMORPH_LADDER_RUNGS=all \
            -DMORPH_BUILD_OFFLINE_SQLITE=ON \
            -DMORPH_BUILD_LOAD_TESTS=ON \
            -DMORPH_BUILD_HMAC_EXAMPLES=ON \
            -DMORPH_BUILD_FUZZERS=${{ matrix.fuzzers }} \

Byte-identical on today's master. Four of the five named as uncovered are
passed by that job, and have been since d2cb3ae1. BANK_EXAMPLE is the
mirror-image error: the report credits the job with passing it and it does not —
it is built by two other jobs (ci.yml:1233, :2202).

Accounting all 14 declared options against a020e69c:

Covered by all optional features	NET, QT, FORMS_QML, LADDER, OFFLINE_SQLITE, LOAD_TESTS, HMAC_EXAMPLES, FUZZERS (8)
Preset defaults, ON everywhere	EXAMPLES, TESTS (2)
Have their own dedicated job	CLANG_TIDY, DOCUMENTATION (2)
Covered by other jobs	BANK_EXAMPLE (1)
Built by nothing	BANK_GUI (1)

So the job's name is very nearly true rather than broadly false, and the
original report's option 2 — rename the job and stand up a separate periodic
linux-everything build — is a large response to a one-option hole. At this
repository's 26–74 minute cycles a new periodic full build is not cheap to add.

Acceptance — one lane, two commits

(a) Close the hole. Add -DMORPH_BUILD_BANK_GUI=ON (and
-DMORPH_BUILD_BANK_EXAMPLE=ON, which it requires) to the all optional features configure step. That job already has Qt 6.8.1 from aqtinstall and
MORPH_BUILD_FORMS_QML=ON, so it is the one leg that can host it. #604 is
fixed (91515ae5), so this should configure and build green — if it does
not, that is a new finding and gets its own issue; do not fold the fix in.

(b) Make the job's name self-verifying. This is the part that lasts.
AGENTS.md's test is "ask whether the check would still pass if the feature did
nothing", and for (a) alone the answer is yes: nothing stops a fifteenth option
being declared next month and enabled by nobody, and this issue being filed a
third time. Add a check that derives the list rather than asserting it:

enumerate `option(MORPH_BUILD_*` from CMakeLists.txt
  → assert each is either enabled by some job in .github/workflows/,
     or present in an explicit, reasoned exemption set

CLANG_TIDY and DOCUMENTATION go in the exemption set with their reason
("has its own dedicated job"). Requirements on the check:

• Prove it is not vacuous: add a declared MORPH_BUILD_* option that no
  job enables, run the check, and paste the real failure output. A gate that
  reports success while measuring nothing is the failure this issue is about,
  and shipping one here would be the worst available outcome.
• It must be wired into a workflow that actually runs, and the PR must name
  which job invokes it.
• Its failure message should say how to cover the option, not how to exempt
  it.

scripts/check_branch_coverage.py's resolve_allowlist_source_line() is the
in-tree precedent for the discipline (a gate that fails when its own input data
rots), though not for the mechanism — that resolver matches a source text
against a file, whereas this compares two sets. See #614's PR discussion,
where that reuse question was examined and answered.

Contention

Part (b) adds a workflow step. PR #614 currently edits
.github/workflows/drift-guard.yml — check whether it has landed, and if not,
either wait or place the new step in ci.yml. Part (a) touches ci.yml, which
nothing else holds.

What is still not verified

• Nobody has built MORPH_BUILD_BANK_GUI=ON since build: bank_gui_qml_tests does not compile -- testkit_main.cpp's <testkit/log_level.hpp> is not on its include path #604 was fixed, so
  whether bank_gui_qml_tests compiles on a020e69c is an open question —
  answering it is step (a). The original report's worry that the other four
  options might also be broken is narrowed but not eliminated: four of those
  five are built by CI on every push, so they compile; BANK_GUI is the one
  genuinely untested.
• Whether CMakePresets.json's linux-everything preset still configures
  cleanly was not checked.

What would change the verdict

Re-open at the original report's wider scope — rename plus a periodic full
build — if the "built by nothing" set is ever more than one or two options wide
again. Close when BANK_GUI is built by a job and something fails when a
newly declared MORPH_BUILD_* option is enabled by nothing.

Related: #604 (the one broken target, fixed), #608/#614 and #613 (same defect
class — a hand-maintained record with nothing auditing it — different fix
sites; deliberately not consolidated).

---

Original report, verbatim and unedited (filed 2026-09-20, against fbb90181)

Found while triaging #604 (bank_gui_qml_tests does not compile on master). Filed separately per AGENTS.md: #604 is one broken target, this is the reason no gate noticed — different fix, and fixing either leaves the other.

The finding

No CI job builds bank_gui_qml_tests, and the job whose name implies it would does not enable the option that creates it.

$ grep -n "MORPH_BUILD_BANK_GUI" .github/workflows/ci.yml
(no output)

$ grep -n "linux-everything" .github/workflows/ci.yml
(no output)

bank_gui_qml_tests exists only under MORPH_BUILD_BANK_GUI, which defaults OFF:

CMakeLists.txt:28:option(MORPH_BUILD_BANK_GUI "Build the Qt 6 GUI for the bank example" OFF)

The linux-everything configure preset does set it (MORPH_BUILD_BANK_GUI = ON), which is how #604 was found locally — but CI never runs that preset.

The naming problem, measured

The job a reader would expect to cover this is Linux / all optional features (clang and gcc). It does not enable all optional features. The repository declares 14 MORPH_BUILD_* options:

MORPH_BUILD_BANK_EXAMPLE = OFF      MORPH_BUILD_HMAC_EXAMPLES = OFF
MORPH_BUILD_BANK_GUI = OFF          MORPH_BUILD_LADDER = OFF
MORPH_BUILD_CLANG_TIDY = OFF        MORPH_BUILD_LOAD_TESTS = OFF
MORPH_BUILD_DOCUMENTATION = OFF     MORPH_BUILD_NET = OFF
MORPH_BUILD_EXAMPLES = ON           MORPH_BUILD_OFFLINE_SQLITE = OFF
MORPH_BUILD_FORMS_QML = OFF         MORPH_BUILD_QT = OFF
MORPH_BUILD_FUZZERS = OFF           MORPH_BUILD_TESTS = ON

That job's configure line passes five: NET, OFFLINE_SQLITE, QT, LADDER, and (per its own comment) BANK_EXAMPLE. Not passed: BANK_GUI, FORMS_QML, FUZZERS, HMAC_EXAMPLES, LOAD_TESTS. CLANG_TIDY and DOCUMENTATION have their own jobs and are not the concern here.

So five feature options are built by no job, under a job name asserting the opposite. #604 is the demonstration that this is not theoretical: a target went unbuildable on master with every gate green.

Why this is the repository's recurring shape

AGENTS.md opens its "Verify rather than assert" section with exactly this failure — "a control that reports success while measuring nothing" — and lists prior instances: an invalid coverage config, a sanitizer job with no instrumentation, a conformance suite that drove nothing. This is another: a job whose name claims a coverage set it does not have.

Its own test: "Ask whether the check would still pass if the feature did nothing." Here the stronger version applies — the check passes when the feature does not compile.

Verification status

Reproduced by inspection, on master fbb90181. Every claim above is a grep or a file read, quoted verbatim, and is deterministic. I did not run CI, and I did not build any of the five options to see whether the other four are also broken — that is the open question and I am not asserting an answer. #604 establishes that one of the five is broken; the others are untested, which is the point.

I also did not check whether some non-ci.yml workflow builds them. I grepped .github/workflows/ci.yml only.

What would resolve it

Options, not a prescription — which one is right is a cost decision about CI minutes:

1. Add the missing options to the all optional features job, so the name becomes true.
2. Keep the job as-is and rename it to what it actually covers, then add a separate periodic (nightly/weekly) linux-everything build for the full set. A build break found within a day is worth far more than one found by a contributor months later.
3. Gate on the preset directly, so CMakePresets.json and CI cannot drift apart.

Whichever is chosen, the load-bearing requirement is that something builds every declared option, and that no job's name promises coverage it does not deliver.

What would change the verdict

Close this if these five options are deliberately unsupported and not expected to build — but then they should not be declared options, and linux-everything should not claim to enable them.

[Yaraslaut]

Triage: rescope

The finding is real. The number is wrong, and it was wrong at the revision
this issue cites — which changes which fix makes sense.

Taking the two claims separately, because they have different verdicts.

Claim 1 — "bank_gui_qml_tests is built by no job": CONFIRMED

Reproduced on master @ a020e69c:

$ grep -c "MORPH_BUILD_BANK_GUI" .github/workflows/ci.yml
0
$ grep -rn "linux-everything" .github/workflows/
(no output)

MORPH_BUILD_BANK_GUI defaults OFF (CMakeLists.txt:28) and no workflow
turns it on. #604 is the demonstration that this is not theoretical, and the
reasoning in "Why this is the repository's recurring shape" stands unaltered:
a target went unbuildable on master with every gate green.

Claim 2 — "five feature options are built by no job": FALSE

The issue states:

That job's configure line passes five: NET, OFFLINE_SQLITE, QT,
LADDER, and (per its own comment) BANK_EXAMPLE. Not passed: BANK_GUI,
FORMS_QML, FUZZERS, HMAC_EXAMPLES, LOAD_TESTS.

That is the clang-coverage job's configure block, not the
all optional features one. The two are ~1,150 lines apart in ci.yml and the
coverage job does pass exactly NET/OFFLINE_SQLITE/QT/LADDER, which is
how the four names line up so convincingly.

Here is the all optional features job's actual configure step, at
fbb90181 — the revision the issue itself cites, so this is not drift since
filing:

$ git show fbb90181:.github/workflows/ci.yml | sed -n '1747,1790p'
      - name: Configure (every optional feature ON)
          cmake --preset ${{ matrix.preset }} \
            -DMORPH_BUILD_NET=ON \
            -DMORPH_BUILD_QT=ON \
            -DMORPH_BUILD_FORMS_QML=ON \
            -DMORPH_BUILD_LADDER=ON \
            -DMORPH_LADDER_RUNGS=all \
            -DMORPH_BUILD_OFFLINE_SQLITE=ON \
            -DMORPH_BUILD_LOAD_TESTS=ON \
            -DMORPH_BUILD_HMAC_EXAMPLES=ON \
            -DMORPH_BUILD_FUZZERS=${{ matrix.fuzzers }} \

FORMS_QML, LOAD_TESTS, HMAC_EXAMPLES and FUZZERS — four of the five
named as uncovered — are passed by that job, and have been since d2cb3ae1.
The list is byte-identical on today's master.

BANK_EXAMPLE is the mirror-image error: the issue credits that job with
passing it, and it does not. It is built by two other jobs
(ci.yml:1233 and :2202), so it is covered, just not there.

Accounting all 14 declared options against today's master:

| Covered by all optional features | NET, QT, FORMS_QML, LADDER, OFFLINE_SQLITE, LOAD_TESTS, HMAC_EXAMPLES, FUZZERS (8) |
| Preset defaults, ON everywhere | EXAMPLES, TESTS (2) |
| Have their own dedicated job | CLANG_TIDY, DOCUMENTATION (2) |
| Covered by other jobs | BANK_EXAMPLE (1) |
| Built by nothing | BANK_GUI (1) |

So it is 1 of 14, not 5 of 14, and the job's name is very nearly true rather
than broadly false.

Why the count changes the fix

The issue's three options are priced for a job whose name is a wholesale
misrepresentation:

2. Keep the job as-is and rename it to what it actually covers, then add a
   separate periodic (nightly/weekly) linux-everything build for the full set.

Renaming a job that covers 8 of the 10 gateable options, and standing up a new
nightly leg, to close a one-option hole, is a large response to a small gap —
and at this repository's 26–74 minute cycles a new periodic full build is not a
cheap thing to add. Option 1 is now the proportionate one, which it would not
have been at 5.

Option 3 (gate on the preset) remains attractive for a different reason than the
issue gives: not because the coverage gap is wide, but because a hand-maintained
option list is precisely the artefact that rots into this issue again. Which
brings the load-bearing point:

Corrected framing — what to actually build

(a) Close the hole. Add -DMORPH_BUILD_BANK_GUI=ON (and
-DMORPH_BUILD_BANK_EXAMPLE=ON, which it needs) to the all optional features
configure step. That job already has Qt 6.8.1 from aqtinstall and
MORPH_BUILD_FORMS_QML=ON, so it is the one leg that can host it. #604 is
already fixed (91515ae5), so this should configure and build green today — if
it does not, that is a finding and belongs in its own issue, not folded in.

(b) Make the job's name self-verifying, which is the part that lasts.
AGENTS.md's own test is "ask whether the check would still pass if the feature
did nothing" — and the answer for (a) alone is yes: nothing stops option 15
from being declared next month and enabled by nobody, and this issue gets filed
a third time. Add a check that derives the option list rather than asserting
it:

enumerate `option(MORPH_BUILD_*` from CMakeLists.txt
  → assert each is either enabled by some job in ci.yml,
     or listed in an explicit, reasoned exemption set

CLANG_TIDY and DOCUMENTATION go in the exemption set with the reason
("has its own dedicated job"). That check is what makes the name
all optional features a measured claim instead of an aspiration, and it is the
same shape as check_branch_coverage.py's resolver — a gate that fails when its
own input data goes stale, rather than one that quietly narrows.

Note (b) is what #608 is asking for on a different data file, and the two are
the same defect class. They are not being merged — different fix sites,
different files, and AGENTS.md is explicit that sharing a theme is not grounds
for consolidation. Cross-linking only.

What I did not verify

• I did not build MORPH_BUILD_BANK_GUI=ON locally, so I have not confirmed
  that bank_gui_qml_tests compiles on a020e69c post-build: bank_gui_qml_tests does not compile -- testkit_main.cpp's <testkit/log_level.hpp> is not on its include path #604. The issue's open
  question — "I did not build any of the five options to see whether the other
  four are also broken" — is narrowed but not answered: four of those five are
  demonstrably built by CI on every push, so they compile; BANK_GUI is the one
  that is genuinely untested, and it remains untested by me too.
• I grepped .github/workflows/ as a whole for linux-everything (the issue
  grepped ci.yml only) and it is absent from every workflow, so that claim
  generalises.
• I did not check whether CMakePresets.json's linux-everything preset itself
  still configures cleanly.

What would change the verdict

Re-open at valid scope, with the rename-plus-nightly response, if the
enumeration above is ever more than one or two options wide again. Close when
BANK_GUI is built by a job and something fails when a newly declared
MORPH_BUILD_* option is enabled by nothing.

Labels: triage: rescope, area: ci.

[Yaraslaut]

Triage: valid — with a disclosure

I wrote the re-scoped body above. AGENTS.md is explicit that an author labelling their own issue records only that they thought it worth filing, so this verdict needs its scope stated narrowly to be worth anything:

• What this label asserts: the description as it now stands is implementable by a single lane without a further decision, and its acceptance is measurable.
• What it does not assert: that the problem is worth solving. That was established by the original filer, independently, and by build: bank_gui_qml_tests does not compile -- testkit_main.cpp's <testkit/log_level.hpp> is not on its include path #604 — a target that went unbuildable on master with every gate green.

What is an independent assessment, and the reason the body was rewritten at all, is the correction in the triage comment above: the original's "five options built by no job" is the clang-coverage job's configure block, not the all optional features one, and the true figure is 1 of 14. That was measured against fbb90181 — the revision the original itself cites — so it is not drift since filing. Anyone re-triaging should check that first; if it is wrong, this whole re-scope is wrong.

Dispatching it batched with #618

Both touch .github/workflows/ci.yml and the edits are disjoint — this one adds -DMORPH_BUILD_BANK_GUI=ON / -DMORPH_BUILD_BANK_EXAMPLE=ON to one job's configure step and adds a derives-the-list gate; #618 adds if: '!cancelled()' to three later test steps in three other jobs. One branch, one PR, one CI cycle, one commit per ticket so either can be dropped without redoing the other.

One sequencing note for the lane

Part (b) — the gate that enumerates option(MORPH_BUILD_* from CMakeLists.txt and asserts each is enabled by some job — needs somewhere to live. .github/workflows/drift-guard.yml is the natural home, and it is held by PR #614. Either wait for that to land or put the step in ci.yml; do not edit drift-guard.yml.

Related, deliberately not merged: #608/#614 and #613 are the same defect class (a hand-maintained record with nothing auditing it) at different fix sites.

[Yaraslaut]

Implementing this corrected two things in the accounting above

Both were found by writing part (b) rather than by reading, which is the point
of part (b). Recording them here rather than shipping around them.

1. MORPH_BUILD_BANK_GUI was not enabled by nothing

The triage comment's evidence was grep -c "MORPH_BUILD_BANK_GUI" .github/workflows/ci.yml → 0, scoped to ci.yml. Across the whole
directory, on a020e69c:

$ grep -rn "BANK_GUI" .github/workflows/
.github/workflows/wasm-demo.yml:98:            -DMORPH_BUILD_BANK_GUI=ON -DMORPH_BUILD_TESTS=OFF

The conclusion survives, but only because of what that flag does under
Emscripten. examples/bank/CMakeLists.txt:24-29:

if(EMSCRIPTEN)
    if(MORPH_BUILD_BANK_GUI)
        add_subdirectory(gui_wasm)
    endif()
    return()
endif()

It returns before add_subdirectory(gui) at line 160, and wasm-demo.yml builds
only --target bank_gui_wasm. So the same option name selects a disjoint
subtree there, and the native bank_gui / bank_gui_qml_tests targets --
the ones #604 found broken -- were still compiled by no job. "Built by nothing"
should read "built by no native job, and by a WASM job that compiles a
different subtree."

This mattered directly: the first version of the derived check scored
BANK_GUI as covered by wasm-demo.yml, which would have made the gate vacuous
for the one option it was written for. The shipped check classifies Emscripten
workflows apart, derived from the workflow text (emcmake/emsdk/qt-cmake)
rather than a filename list, and its self-test pins that case: dropping the
newly added ci.yml flag must still go red despite wasm-demo.yml.

2. MORPH_BUILD_DOCUMENTATION is not exempt; it is covered

The re-scoped body puts it in the exemption set with CLANG_TIDY ("has its own
dedicated job"). But docs.yml's configure step passes the option literally:

$ grep -rn "MORPH_BUILD_DOCUMENTATION" .github/workflows/
.github/workflows/docs.yml:59:            -DMORPH_BUILD_DOCUMENTATION=ON \

so it is covered by derivation and an exemption for it would be exactly the
hand-maintained falsehood part (b) exists to prevent. MORPH_BUILD_CLANG_TIDY
is the only exemption: no workflow passes it at all, and the clang-tidy job
reaches the same end through clang-tidy-diff.py over the PR diff instead.

To keep that set honest the checker rejects an exemption for an option that
is covered, and one naming an option no CMake file declares. Both are
self-tested.

Also, the declared-option count is 16, not 14

The tree declares two more option(MORPH_BUILD_*) outside the root
CMakeLists.txt -- MORPH_BUILD_HMAC_EXAMPLE_LIBSODIUM and
MORPH_BUILD_HMAC_EXAMPLE_OPENSSL, in examples/vetted_hmac/CMakeLists.txt.
Both default ON, so both are covered without any workflow naming them, and
neither changes the verdict. The check scans every tracked CMake file rather
than the root one, so a sub-option that ever defaults OFF will be caught.

Full derived accounting on the branch:

16 MORPH_BUILD_* option(s) declared, all accounted for:
  MORPH_BUILD_BANK_EXAMPLE: enabled by ci.yml [also under WASM: wasm-demo.yml]
  MORPH_BUILD_BANK_GUI: enabled by ci.yml [also under WASM: wasm-demo.yml]
  MORPH_BUILD_CLANG_TIDY: exempt -- covered by ci.yml's `clang-tidy` job, ...
  MORPH_BUILD_DOCUMENTATION: enabled by docs.yml
  MORPH_BUILD_EXAMPLES: declared default ON (built unless a job turns it off) [also under WASM: wasm-demo.yml]
  MORPH_BUILD_FORMS_QML: enabled by ci.yml [also under WASM: wasm-ladder.yml]
  MORPH_BUILD_FUZZERS: enabled by ci.yml
  MORPH_BUILD_HMAC_EXAMPLES: enabled by ci.yml
  MORPH_BUILD_HMAC_EXAMPLE_LIBSODIUM: declared default ON (built unless a job turns it off)
  MORPH_BUILD_HMAC_EXAMPLE_OPENSSL: declared default ON (built unless a job turns it off)
  MORPH_BUILD_LADDER: enabled by ci.yml [also under WASM: wasm-ladder.yml]
  MORPH_BUILD_LOAD_TESTS: enabled by ci.yml
  MORPH_BUILD_NET: enabled by ci.yml
  MORPH_BUILD_OFFLINE_SQLITE: enabled by ci.yml
  MORPH_BUILD_QT: enabled by ci.yml [also under WASM: wasm-ladder.yml]
  MORPH_BUILD_TESTS: declared default ON (built unless a job turns it off)

Still unverified

Whether bank_gui and bank_gui_qml_tests actually compile on the
all-features leg post-#604. Not built locally (Qt 6.8 + aqtinstall + the
Lightweight/ODBC fetch); the PR's CI run is the first measurement. If it fails,
that is a new issue, not a fold-in, exactly as the re-scoped body says.

[Yaraslaut]

Correction to my own triage above — two errors, both caught by the implementing lane

Independently re-verified on master @ 0e3b8823. The conclusion survives; two pieces of my evidence do not, and one of my instructions would have put a false record into the new gate.

Error 1 — "no workflow turns it on" was wrong

My triage said, and the re-scoped body above repeated:

MORPH_BUILD_BANK_GUI defaults OFF (CMakeLists.txt:28) and no workflow turns it on.

It is turned on:

$ grep -rn "MORPH_BUILD_BANK_GUI" .github/workflows/
.github/workflows/wasm-demo.yml:98:            -DMORPH_BUILD_BANK_GUI=ON -DMORPH_BUILD_TESTS=OFF

The mistake is visible in my own commands: I ran grep -rn "linux-everything" .github/workflows/ across all workflows, and grep -c "MORPH_BUILD_BANK_GUI" .github/workflows/ci.yml across one file — then generalised both results. I inherited ci.yml scoping from the original report while explicitly claiming elsewhere to have widened it. That is precisely the failure I flagged the original report for, committed one step further along.

The finding survives, for a reason I had not established. Under Emscripten the bank example never reaches the native GUI:

examples/bank/CMakeLists.txt
 24:  if(EMSCRIPTEN)
 26:      add_subdirectory(gui_wasm)
 28:      return()
...
160:      add_subdirectory(gui)

So wasm-demo.yml builds gui_wasm/, returns at :28, and add_subdirectory(gui) at :160 — and therefore bank_gui_qml_tests — is reached by no job. #604 remains the demonstration. "Built by nothing" is true of the native target; "enabled by no workflow" is false. The distinction is load-bearing, because a naive coverage gate reading only -D…=ON would score BANK_GUI as covered.

That is not hypothetical: the lane reports its first draft of the gate did exactly that — the gate would have been vacuous for its own founding case. It caught it itself and now classifies Emscripten workflows apart, derived from workflow text and pinned by a self-test case. That is the single most valuable thing to come out of this ticket.

Error 2 — my exemption instruction would have written a false record

My re-scoped body said:

CLANG_TIDY and DOCUMENTATION go in the exemption set with the reason ("has its own dedicated job").

Half of that is false:

$ grep -rn "MORPH_BUILD_DOCUMENTATION" .github/workflows/
.github/workflows/docs.yml:59:            -DMORPH_BUILD_DOCUMENTATION=ON \

$ grep -rn "MORPH_BUILD_CLANG_TIDY" .github/workflows/
(none found)

DOCUMENTATION is covered, literally, by docs.yml:59. Recording it as exempt would have stated that nothing builds it, which is untrue — an exemption list that contains a covered option is exactly the kind of decorative record this ticket exists to prevent. CLANG_TIDY is the only legitimate exemption: no workflow passes it, and the clang-tidy job reaches the same end through clang-tidy-diff.py.

The lane declined the instruction and said why rather than following it. That was the right call, and it is what the "permission to reject the ticket" clause is for.

Error 3 — the option count

Not 14, but 16 declared tree-wide: examples/vetted_hmac/CMakeLists.txt declares MORPH_BUILD_HMAC_EXAMPLE_LIBSODIUM and MORPH_BUILD_HMAC_EXAMPLE_OPENSSL, both defaulting ON. Neither changes the verdict; both mean my "1 of 14" table was counting the wrong denominator. The correct framing is the one the gate now enforces — derive both sides, do not tabulate them by hand — which is, with some irony, the entire point of part (b).

Net

The ticket's direction was right and the work in PR #623 implements it. What was wrong was my evidence for it and one of my instructions, and both are corrected here rather than left to be inherited by the next reader. The table in the body above should be read against this comment; I am not editing it, because the erroneous version is the thing this comment is about.