The committed hold-out registration carried two absolute paths of the machine
it was written on, in a public repository, and its `bundle_ref` was read by no
line: other bytes at the registered bundle path would have been measured as
the registered bundle.
- A registered path must be `~/...` and is expanded when read; an absolute or
otherwise relative path is a NO with its reason and is never followed.
- A twelfth check, "the bundle is the registered tree", measures the bundle
with `consume.bundle_ref` against the pinned ref; a mismatch, an absent
bundle or no pinned ref is a NO, and the hold-out is then NOT run.
- An absent set is reported with its registered `~/` path.
Chose `~/` over an environment variable because the file then explains
itself and the gate needs no extra setup. The change is in
`tools/okf_retrieval_gate.py` only; `src/` is untouched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kjell Tore Guttormsen
90cc463cd9