Abstain when the data is stale: suppress, do not guess

AbstainFreshClaudeverified 2026-06-21sha ee4afbb09475

Born in: the post where it earned its place →

Breaks when: The thresholds (max-age, the failure-ratio percent) are judgement calls – set them too tight and it gags clean reads, too loose and it ships stale interpretation as if fresh. One global gate with one max-age also cannot express per-input freshness horizons: if quotes go stale in minutes but fundamentals in weeks, a single threshold is wrong for one class even when it is right on average – the per-line gate narrows this but does not erase it. It only sees the freshness signals you actually thread into state; an input that goes stale silently, emitting no timestamp or failure flag, slips past untouched. And it is an output-suppression gate, not an action gate: it stops "act now" from rendering, but unless you also wire guard_action at the pre-commit boundary, a side effect can still fire before the gate ever runs.

Vendor “add a staleness check” advice bolts one age test onto the final render, so a single fresh-looking timestamp green-lights output even when half the inputs failed this run or one line in a partial refresh is weeks old. This contract instead defines ONE gate consumed at EVERY interpretive output site, run-level for the whole emit and line-level for each item, returns (ok, one-honest-line) off signals already in the pipeline, and carries the clause nobody clones: a stale PRIOR failure must not gag a fresh clean read – compare failure-age to data-age, within the same source, before you suppress.

You are wiring an output-suppression honesty gate into a system that emits interpretations off time-sensitive inputs. The job is NOT to add one age check at the end. It is to define ONE gate, can_emit(state) -> (ok, reason), and consume it at EVERY interpretive output site so that when the inputs are insufficient the system says one honest "I cannot say" line instead of a confident guess.

First, two definitions you do NOT get to bend:

INTERPRETIVE = anything that could change a human decision: a recommendation, a risk label, a ranking, a verdict, an "act now", or any derived or actionable number. RAW = a verbatim upstream field, passed through tagged with its source and age. A derived or actionable number is NEVER raw. You may not reclassify an interpretation as "raw passthrough" or "here is what is in state" to route it around the gate.

REQUIRED_SIGNALS = the explicit list of signals the gate needs, drawn from {{freshness_signals}}, each mapped to the rung it feeds (for example: evaluation_time, per-source data timestamp, last-run status and time, failed count and total / denominator, refresh-or-degraded flag, thresholds). Write this list before can_emit. Any required signal that is absent, unparsable, timezone-less, non-finite, or self-contradictory is a suppress condition, not a default-to-pass.

Output sites to gate (every place that emits an interpretation, by the definition above):
{{output_site}}

Freshness signals already in the pipeline (the ONLY inputs the gate may read - it does NOT fetch anything new):
{{freshness_signals}}

Freshness budget (the failure-ratio percent and max-age, per source where they differ, plus the cadence or SLA they come from):
{{freshness_budget}}

Build it in this order:

1. WRITE can_emit(state) -> (ok: bool, reason: str). It is a pure, synchronous read over the signals above: no I/O, no network, no new fetch; the caller may safely call it once per render tick and cache the result. It NEVER raises - if a required signal is missing or invalid, that is a suppress condition (rung 0 below), not a crash.

2. ENCODE the suppression ladder, evaluated MOST-SYSTEMIC first, returning on the first hit so the reason is the deepest true one:
   0. a REQUIRED_SIGNAL is missing, unparsable, timezone-less, non-finite, contradictory, or a timestamp is in the future (clock skew) -> suppress. This rung runs FIRST, before any check that consumes those signals.
   1. inputs were expected this run AND more than X% of them failed to load (a broken run, not a stale one) -> suppress. Guard this rung on "inputs were expected": an empty cold start with zero expected inputs must NOT read as 100% failed here - it falls through to rung 5 so the reason is "no data yet", not "broken run".
   2. the last run logged a failure for a source AND that failure is at least as fresh as that same source's current data (the failure is not yet superseded by a good read) -> suppress.
   3. an explicit refresh-failed / degraded flag is set for this cycle -> suppress.
   4. the data is older than max-age -> suppress.
   5. there is no data yet (cold start, empty state) -> suppress.
   If none fire: ok = True, reason carries an informational note (for example "data 3h old, max 24h") so a near-the-edge pass is visible, not silent.

3. ANTI-OVER-SUPPRESSION (this is normative text for HOW rung 2 is implemented, not a separate later pass - implement it INSIDE rung 2): a stale PRIOR failure must NOT gag a fresh, clean current read. In rung 2 you MUST compare failure-age against data-age FOR THE SAME source or required-source group: if that source's current data is newer than its last logged failure, the failure is superseded - do not suppress on it. A fresh feed for source A must not supersede a stale failure for source B, and a fresh OPTIONAL source must not green-light a MISSING REQUIRED one. The gate suppresses on present insufficiency, never on a wound that has already healed.

4. CONSUME it at every site in {{output_site}}, identically, at BOTH levels:
   - RUN level - once per emit, before any line renders:
       ok, reason = can_emit(state)
       if not ok:
           emit ONLY reason  # one honest line, e.g. "Not enough fresh data to say."
           return            # suppress ALL actionable lines: no recommendation, no risk read, no "act now", no number
   - LINE level - for each item in a partial refresh, even when the run-level gate passed:
       ok, reason = can_emit_line(item, state)  # same ladder, scoped to that item's source and freshness
       if not ok:
           skip the item's interpretation (or mark it "stale, withheld"); the rest of the emit may still speak
   When ok is False the caller surfaces the single reason and NOTHING else for that scope. It does not soften it, pad it, or emit a partial take "with a caveat". The fallback is always "I cannot say", never a guess.

Hard rules:
- The gate reads only signals already threaded into state. If a needed signal is not present, treat its absence as a suppress condition - never invent, default, or back-fill a value to make the gate pass.
- Never fabricate a number, level, or verdict to fill a suppressed slot. Suppression means the actionable line is GONE, replaced by the reason - not weakened.
- One gate, one definition. Do not let two output sites disagree on what "fresh enough" means by inlining their own ad-hoc checks. Every site calls the same can_emit / can_emit_line.
- Do NOT invent thresholds. If {{freshness_budget}} has no SLA, source cadence, or operator-provided value for a source, do not guess a plausible number - return a named TODO / config requirement for the operator and keep that source's gate SUPPRESSING until the threshold is supplied. When you do set a threshold, first name the worse error for THIS system - a false silence (gagging a clean read) or a false stale-verdict (shipping stale as fresh) - and state which one the chosen number accepts more of. X% means "this run is broken", not "this run is noisy"; max-age means "the oldest age at which a wrong verdict costs more than no verdict".
- can_emit never raises and never blocks. A gate that crashes is itself a fail-open: it must degrade to suppress, not to silence-the-gate-and-emit.
- ACTION boundary (this is an output gate, not an action gate). Any destructive or irreversible action must call can_emit / guard_action at the FINAL pre-commit boundary; no side effect may occur before ok = True. If the gate raises, returns malformed data, lacks a reason, or sees a missing or invalid signal, guard_action must DENY. This is separate from suppressing prose - an agent must not call the destructive sink and only THEN check the gate.

Deliver, in this order:
1. The REQUIRED_SIGNALS list, each mapped to the rung it feeds, then can_emit(state) in full - ladder ordered most-systemic-first, rung 0 validation explicit, and the failure-age vs data-age comparison scoped to the same source in rung 2 - plus can_emit_line(item, state).
2. The complete, proven inventory of interpretive output sites, derived from the code / search / config, not from {{output_site}} alone: for each site report file / function / path and whether it now calls the shared gate at run AND line level. If you cannot prove the inventory is complete, say so and do not claim full coverage. Show the exact consume-snippet wired into one representative site.
3. The chosen X% and max-age per source (or, where no SLA exists, the named operator TODO and the fact the gate stays suppressing until it is set), each with a one-line rationale and which error it accepts more of, AND one honest line naming the signal whose silent staleness the gate CANNOT catch (because nothing in {{freshness_signals}} reports it).
4. At least five fixtures with asserted (ok, reason): (a) all fresh -> speak; (b) global stale -> suppress; (c) old failure but newer data for the same source -> speak; (d) a missing or invalid required signal -> suppress; (e) partial refresh where one line is stale -> that line is withheld but the rest of the emit still speaks. If the system has a destructive sink, add (f): ok = False -> assert the sink was NOT called.

Fill in: output_site freshness_signals freshness_budget

Shared as is, for reference. Read it and decide what it will do before you run it; using it is your responsibility, under the terms.