lgray
diff --git a/‎crates/phase-ai/src/bin/ai_gate.rs‎
Lines changed: 55 additions & 3 deletions b/‎crates/phase-ai/src/bin/ai_gate.rs‎
Lines changed: 55 additions & 3 deletions
diff --git a/‎crates/phase-ai/src/duel_suite/run.rs‎
Lines changed: 167 additions & 0 deletions b/‎crates/phase-ai/src/duel_suite/run.rs‎
Lines changed: 167 additions & 0 deletions
@@ -72,6 +72,53 @@ fn main() {
     };
 
     if args.refresh_baseline {
+        // A baseline is what every later run is judged against, so refreshing from a run
+        // that failed its own `Expected` check blesses that failure permanently: the next
+        // run compares equal to it and exits 0 forever, and the gate goes quiet about a
+        // matchup that is still broken. Refuse. A matchup that genuinely has no verdict
+        // yet says so with `Expected::Open` in the suite definition — that is the place
+        // to express it, not a red baseline.
+        //
+        // ORDER MATTERS, and this one is strictly better on every input. The two conditions
+        // are not exclusive: `failed_result` builds a matchup with an empty `games` vector
+        // AND `SuiteStatus::Fail`, so a run whose deck payloads all failed to load satisfies
+        // both. Reporting the failures names each matchup and its `setup error: …`; reporting
+        // gamelessness first would replace that with a sentence about seeds. Nothing is lost
+        // by checking failures first, because a run that is merely gameless — a
+        // `--suite-filter` matching nothing — has no failing matchups to report.
+        let failing: Vec<_> = current.failing_matchups().collect();
+        if !failing.is_empty() {
+            eprintln!(
+                "refusing to refresh {}: {} matchup(s) failed their own suite check",
+                args.baseline.display(),
+                failing.len()
+            );
+            for result in failing {
+                eprintln!(
+                    "  {}: {}",
+                    result.matchup_id,
+                    result
+                        .fail_reason
+                        .as_deref()
+                        .unwrap_or("no reason recorded")
+                );
+            }
+            eprintln!(
+                "fix the regression, or declare the matchup `Expected::Open` if it has no verdict yet"
+            );
+            std::process::exit(1);
+        }
+        // A run that measured nothing is unfit for the same reason a red one is, reached from
+        // the other side: comparison pairs by seed, so a gameless baseline scores zero on the
+        // outcome axes forever and the drift signal dies quietly. Reached by a `--suite-filter`
+        // that selects no matchups; `--games 0` is refused earlier, at parse time.
+        if current.recorded_games() == 0 {
+            eprintln!(
+                "refusing to refresh {}: the run recorded no games, so every later comparison would score zero",
+                args.baseline.display()
+            );
+            std::process::exit(1);
+        }
         if args.baseline.exists() {
             match load_report(&args.baseline)
                 .and_then(|baseline| compare(&baseline, &current, &CompareOptions))
@@ -137,9 +184,14 @@ fn parse_args() -> Result<Args, String> {
                 current_output = next_path(&mut iter, "--current-output")?;
             }
             "--games" => {
-                games = next_value(&mut iter, "--games")?
-                    .parse()
-                    .map_err(|_| "--games must be a positive integer".to_string())?;
+                // `usize` alone accepts 0, which the error string already promised it would
+                // not. A zero-game run classifies every matchup `Open` and produces a
+                // baseline that can never detect drift, so reject it here rather than
+                // burning a whole suite run to refuse it later.
+                games = match next_value(&mut iter, "--games")?.parse() {
+                    Ok(0) | Err(_) => return Err("--games must be a positive integer".to_string()),
+                    Ok(value) => value,
+                };
             }
             "--seed" => {
                 seed = next_value(&mut iter, "--seed")?
 
@@ -146,6 +146,51 @@ impl SuiteReport {
                 .collect(),
         }
     }
+
+    /// Matchups that failed their own `Expected` check, judged without reference to any
+    /// baseline.
+    ///
+    /// This is a different question from `CompareReport::any_fail`, which asks "did this
+    /// change make things worse than the baseline". This one asks "is this run fit to
+    /// *become* the baseline" — and only `SuiteStatus::Fail` disqualifies it.
+    ///
+    /// `SuiteStatus::Open` does not, and it has two producers, not one: `Expected::Open`
+    /// is how a matchup declares it has no verdict yet, and `classify` also returns `Open`
+    /// for any matchup with zero games before it ever inspects `Expected`. Neither is a
+    /// failure, so anything keyed on `!= Pass` would conflate a declared no-verdict with a
+    /// regression. The zero-game case is disqualifying for a different reason and is caught
+    /// by `recorded_games`, not here.
+    pub fn failing_matchups(&self) -> impl Iterator<Item = &MatchupResult> {
+        self.results
+            .iter()
+            .filter(|result| result.status == SuiteStatus::Fail)
+    }
+
+    /// Games actually recorded across every matchup.
+    ///
+    /// A report with none is unfit to become a baseline whatever its statuses say:
+    /// comparison pairs by seed, so a baseline holding no games makes every later
+    /// comparison score zero on every axis and the drift signal dies silently — the same
+    /// false-green this guard exists to prevent, arrived at from the other side.
+    ///
+    /// Deliberately counts games rather than checking for all-`Open`: a suite whose
+    /// matchups are all declared `Expected::Open` still records real games, and such a
+    /// report *is* a usable baseline, because the paired-comparison arm decides on `games`,
+    /// not on `status` — an all-`Open` pair therefore still detects outcome drift. (Stated
+    /// as "decides on games" rather than "never reads status": the paired arm gained status
+    /// tiers in #7026, so the stronger wording would have been false the day that merged.)
+    /// Zero games is the property that makes a baseline inert; all-`Open` is not.
+    ///
+    /// Not an exhaustive list of routes, so it does not claim to be one: `--games 0` is
+    /// refused at parse time, a `--suite-filter` matching no matchups lands here, and
+    /// `failed_result` yields an empty `games` vector alongside `SuiteStatus::Fail`, which
+    /// `failing_matchups` reports first because it names the actual setup error. And this is
+    /// a `pub` method, so its audience includes library callers: `SuiteOptions::new` does not
+    /// validate `games_per_matchup`, so a caller can construct a zero-game run without going
+    /// through the CLI at all.
+    pub fn recorded_games(&self) -> usize {
+        self.results.iter().map(|result| result.games.len()).sum()
+    }
 }
 
 /// Controls decision-trace attribution capture during a suite run. When set
@@ -1082,6 +1127,128 @@ mod tests {
         }
     }
 
+    /// Reuses `report_with_timing`'s matchup as the field template so these tests state
+    /// only the axes they exercise: each matchup's status and reason.
+    fn report_with_statuses(statuses: &[(&str, SuiteStatus, Option<&str>)]) -> SuiteReport {
+        let mut report = report_with_timing(1, 100);
+        let template = report.results[0].clone();
+        report.results = statuses
+            .iter()
+            .map(|(id, status, reason)| MatchupResult {
+                matchup_id: (*id).to_string(),
+                status: *status,
+                fail_reason: reason.map(str::to_string),
+                ..template.clone()
+            })
+            .collect();
+        report
+    }
+
+    #[test]
+    fn a_clean_run_has_no_failing_matchups() {
+        let report = report_with_statuses(&[
+            ("red-mirror", SuiteStatus::Pass, None),
+            ("affinity-mirror", SuiteStatus::Pass, None),
+        ]);
+
+        assert_eq!(report.failing_matchups().count(), 0);
+    }
+
+    /// Transcribed from the recorded gate run that motivated this guard (`.ab/noC-1.json`,
+    /// the A+B+D leg of #6969): the statuses and the verbatim `fail_reason` are that run's,
+    /// not invented. Refreshing the baseline from this exact report is what would have
+    /// blessed a broken matchup permanently. The artifact is untracked, so it is
+    /// transcribed rather than loaded — a test that read the file would fail in CI.
+    #[test]
+    fn the_recorded_failing_run_is_disqualified_as_a_baseline() {
+        let report = report_with_statuses(&[
+            ("red-mirror", SuiteStatus::Pass, None),
+            ("affinity-mirror", SuiteStatus::Pass, None),
+            (
+                "enchantress-mirror",
+                SuiteStatus::Fail,
+                Some("mirror imbalance: p0=0.10, Wilson 95% CI [0.02, 0.40] excludes 0.50"),
+            ),
+        ]);
+
+        let failing: Vec<_> = report.failing_matchups().collect();
+        assert_eq!(failing.len(), 1, "the one Fail, not every matchup");
+        assert_eq!(failing[0].matchup_id, "enchantress-mirror");
+        // The reason travels with the matchup: the refusal is only actionable if it can say
+        // *why* the run is unfit, not merely that it is.
+        assert_eq!(
+            failing[0].fail_reason.as_deref(),
+            Some("mirror imbalance: p0=0.10, Wilson 95% CI [0.02, 0.40] excludes 0.50")
+        );
+    }
+
+    /// The discriminating case for `recorded_games`: a suite whose matchups are all
+    /// declared `Expected::Open` still played real games, and that report IS a usable
+    /// baseline, because seed-paired drift detection never consults `status`. An
+    /// implementation that disqualified all-`Open` reports instead of gameless ones would
+    /// pass every other test here and fail this one.
+    #[test]
+    fn an_all_open_run_that_played_games_is_still_a_usable_baseline() {
+        let mut report = report_with_statuses(&[
+            ("experimental-a", SuiteStatus::Open, None),
+            ("experimental-b", SuiteStatus::Open, None),
+        ]);
+        // Uneven on purpose. With one game each, the total (2) equals the MATCHUP count, so
+        // "sum of games" and "number of matchups that played" are indistinguishable — two
+        // mutants with that wrong contract survived the earlier version of this test. Three
+        // games across two matchups separates them.
+        let extra = report.results[0].games[0].clone();
+        report.results[0].games.push(GameResult {
+            seed: extra.seed + 1,
+            ..extra
+        });
+
+        assert_eq!(report.failing_matchups().count(), 0);
+        assert_eq!(
+            report.recorded_games(),
+            3,
+            "two games in the first matchup plus one in the second — a SUM, not a matchup count"
+        );
+    }
+
+    #[test]
+    fn a_gameless_run_records_nothing_however_many_matchups_it_has() {
+        let mut report = report_with_statuses(&[
+            ("red-mirror", SuiteStatus::Open, None),
+            ("affinity-mirror", SuiteStatus::Open, None),
+        ]);
+        // What `--games 0` produces: matchups exist, none of them played anything.
+        for result in &mut report.results {
+            result.games.clear();
+        }
+
+        assert_eq!(report.recorded_games(), 0);
+        // And it is NOT a failure — the two disqualifiers are independent, so a guard that
+        // conflated them would let one of the two holes back open.
+        assert_eq!(report.failing_matchups().count(), 0);
+    }
+
+    #[test]
+    fn a_run_that_selected_no_matchups_records_nothing() {
+        // What a `--suite-filter` matching nothing produces: no matchups at all.
+        let report = report_with_statuses(&[]);
+
+        assert_eq!(report.recorded_games(), 0);
+    }
+
+    #[test]
+    fn an_open_matchup_is_not_a_failure() {
+        // `Expected::Open` classifies as `SuiteStatus::Open`: a matchup that has no verdict
+        // yet, which must not block a refresh. This is the test that dies if the filter is
+        // ever written as the plausible `!= SuiteStatus::Pass` — the other two survive it.
+        let report = report_with_statuses(&[
+            ("red-mirror", SuiteStatus::Pass, None),
+            ("experimental-mirror", SuiteStatus::Open, None),
+        ]);
+
+        assert_eq!(report.failing_matchups().count(), 0);
+    }
+
     #[test]
     fn deterministic_core_excludes_wall_clock_fields() {
         let first = report_with_timing(1, 100);