Refuse a quarantine the record declares nothing about

[iderex]

Closes #188.

Record 0019 allows an experiment to borrow only inside
experiments/<slug>/borrowed, requires that directory to carry its own
LICENSE, and requires the experiment record to declare the borrowing in a
Borrowed: field. #189 landed two of the three disagreements that layout can
produce. The third was left unbuilt: a borrowed directory in an experiment
whose record declares no Borrowed: passed, so borrowed material could sit in
the tree with its source and its licence named nowhere a header reader would
look.

Why it may exist now, when it could not before

It was left unbuilt because it read as a refusal on an absent field, which
record 0013 forbids and which refuseHardware declines one field over for
exactly that reason. It is not one. The subject is the directory, which is
present; a tree carrying a quarantine has already said it borrows before any
header is opened. Nothing here reads an absence, so an experiment that borrows
nothing writes nothing and is never asked about the field, which is the whole
of what 0013 bought. The decision to key it that way was taken on #188 on
2026-08-31 and this change executes it rather than re-taking it.

The means

Go, in internal/check/, because this is a second arm on refuseBorrowed
rather than a new artefact: the runner already walks experiments/, already
reads the header, already resolves the quarantine path, and the case harness
under testdata/cases/ already compares whole refusal sets. A means that
carries a refusable property, an executed proof and a command behind every
claim is what the standpoint asks for, and this one is already carrying all
three for its two neighbours.

What it refuses

go run ./cmd/lab check testdata/cases/a-borrowed-directory-the-record-does-not-declare/tree
examined testdata/cases/a-borrowed-directory-the-record-does-not-declare/tree
1 experiment directory walked, 1 record read
no docs/decisions directory in this tree
0 decision records read
the time this run read is 2026-08-31T17:50:32Z
1 refused
  ...\experiments\one\borrowed: it holds code under somebody else's terms and ...\experiments\one\EXPERIMENT.md declares no Borrowed, so the tree says the experiment borrows and the record says nothing. record 0019 puts the source and the licence in that field (borrowed-directory-the-record-does-not-declare)

The message names the directory it refuses and the record that declares
nothing, because which of the two is wrong decides the repair. The subject is
the directory rather than the record, which is the same sentence as the
paragraph above read off the output.

Proof that the guard bites, in both directions

The case declares exactly this refusal and no other, and its tree is identical
to its near neighbour an-experiment-that-borrows-and-declares-it apart from
one header line:

diff -r testdata/cases/an-experiment-that-borrows-and-declares-it/tree \
        testdata/cases/a-borrowed-directory-the-record-does-not-declare/tree
5d4
< Borrowed: the reference implementation from example.invalid, under the MIT licence

Deleting the refusal site reddens the new case and nothing else:

go test ./internal/check/ -count=1
--- FAIL: TestCases/a-borrowed-directory-the-record-does-not-declare (0.00s)
    check_test.go:46: expected refusal not produced: borrowed-directory-the-record-does-not-declare
FAIL

Widening the condition from held && !declared to held, which is the
one-character mistake available here, reddens the neighbour and every other
case that borrows and declares it:

go test ./internal/check/ -count=1
--- FAIL: TestCases/a-borrowed-directory-inside-the-quarantine (0.00s)
    check_test.go:46: refusal produced that no case expected: borrowed-directory-the-record-does-not-declare
--- FAIL: TestCases/a-quarantine-outside-the-place-quarantines-live (0.00s)
    check_test.go:46: refusal produced that no case expected: borrowed-directory-the-record-does-not-declare
--- FAIL: TestCases/a-borrowed-directory-with-no-licence-file (0.00s)
    check_test.go:46: refusal produced that no case expected: borrowed-directory-the-record-does-not-declare
--- FAIL: TestCases/an-experiment-that-borrows-and-declares-it (0.00s)
    check_test.go:46: refusal produced that no case expected: borrowed-directory-the-record-does-not-declare
FAIL

Both runs were made and then reverted; the tree here carries neither break.

The gate on this branch

go build ./cmd/... ./internal/...
go vet ./cmd/... ./internal/...
gofmt -l cmd internal
(no output)
go test -count=1 -v ./cmd/... ./internal/...
(every package ok)

go run ./cmd/lab check .
examined .
1 experiment directory walked, 1 record read
27 decision records read
the time this run read is 2026-08-31T17:50:35Z
0 refused

What record 0019 does not get, deliberately

That record says in bold that nothing in this repository refuses a violation of
its rule today. That sentence is now wrong about the tree and it is not edited.
It is evidence of the day the record landed, and
docs/decisions/0026-evidence-in-a-landed-record-that-stopped-reproducing.md
decides that a landed record's evidence is never brought up to date and that a
paste under a standing decision is history rather than error. The decision
0019 took is unchanged by this, so it gains no successor either. What is
repaired instead are the two documents outside docs/decisions/ that describe
the gate as it is today: CONTRIBUTING.md and docs/experiment-template.md
both said this case still passes.

What a green run still does not prove

Nothing here opens the licence file or reads a word of it, and that bound is
written at refuseBorrowed rather than only here. A pass says the layout and
the declaration do not contradict each other. It says nothing about which
licence the borrowed code is actually under, and nothing about whether the
result may be promoted into a board under other terms, which 0019 leaves
undecided on purpose.

Where this arm does not reach is at its own constant: a quarantine somewhere
other than experiments/<slug>/borrowed is the neighbouring arm's subject, so
an experiment whose only borrowed directory is in the wrong place is refused
once, and this arm reads the directory after it has been moved.

No second reader

Nobody but me has read this change. The evidence above stands in place of a
second reader rather than beside one, and the two break-and-watch runs are what
there is instead.