Audit the population, not the sample: the exclusion your AI sweep inherited

Point an AI session at a repository and ask it to fix something everywhere, and it will fix it everywhere it was told to look. The set it was told to look at was defined by somebody, at some point, for a reason that may have stopped being true. That set is the thing to audit, and almost nobody audits it.

PRIME-2. AI builds what you asked and nothing you didn’t.

The method in one line: audit the population, not the sample, and make the distance between the two part of every report the sweep prints.

The failure mode has no error in it

Absence produces no error. A test that was never written never fails. A generated system arrives without backups, without rate limiting, without accessibility, without mail deliverability, without a retention policy, and nothing anywhere goes red, because none of it was in the ask and nothing in the process notices an absence.

Scoped sweeps are the same failure wearing a report. Every audit script that grows past its first week acquires a line like this one, and the line outlives the reason for it:

const LEGAL = new Set(['/terms','/privacy','/cookies',
                       '/dpa','/acceptable-use','/subprocessors'])
const routes = process.argv[2].split(',').filter(r => !LEGAL.has(r))

Whatever that filter removes is removed from the measurement, and therefore from the fix, and therefore from the report that says the work is done. The report is not lying. It describes a smaller system than the one you ship, and nothing on its face tells you which one you are reading.

That is why a green report is a weak signal on AI-assisted work. It proves the checks that ran. It says nothing about the checks nobody asked to run, and at report time a scope set correctly is indistinguishable from a scope set months ago by somebody who has since left.

Make the gap report itself

The remedy is not vigilance, which does not survive contact with a busy week. It is one line of output. Any sweep able to exclude anything states, in the same report as the passing numbers, how many it skipped and which ones:

const skipped = all.filter(r => EXCLUDE.has(r))
const covered = all.filter(r => !EXCLUDE.has(r))
console.log(`[sweep] ${covered.length} measured, ${skipped.length} skipped`)
if (skipped.length) console.log(`[sweep] NOT MEASURED: ${skipped.join(', ')}`)

A skipped count printed beside a passing count is a question every reader of that report answers in one second: should anything be skipped at all? Naming the skipped routes turns it into a question they can answer without opening the script. Neither line costs anything, and between them they convert a silent exclusion into a standing prompt.

Apply the same rule to anything else that narrows a set on its way to a machine: a glob that skips a directory, a test runner with a pattern argument, a linter with an ignore file, a retrieval step with a filter. Each one is a population reduced to a sample, and each one can print the difference.

Three rules that generalise

1. Audit the population, not the sample. A sweep carrying an exclusion list is not a sweep, it is a sample with good manners. Where things must be skipped, the report names them and counts them beside the passing numbers.
2. Make the count the deliverable, not the impression. "The typography looks better" is not a finding. "153 blocks over 80 characters, now 24, measured on the served pages at four viewports" is a finding, and anyone can falsify it by rerunning it.
3. Measure the output, never the input. Verify on the served page with computed styles and the real fonts loaded, never on the source just edited. Font readiness is the classic trap here: the readiness hook returns true while zero faces have actually loaded, and widths measured after it come back around twenty per cent wrong.

None of this is specialised work. It is the discipline the law describes: every requirement the machine was not asked for is demanded explicitly and audited explicitly, and the quality gate belongs to the person directing the machine. The machine will not widen the scope on your behalf. It was not asked to.

This post argues PRIME-2 from THE PLATFORM LAWS, the standing rules for anything Wavn, Inc. builds. Related reading: our principles, how we handle AI output and the record.