the guard placed wider than the rule it guarded

Allocation and protection were written by different hands at different times, and they had drifted apart. A decision was given a size computed from one distance, and its protective exit was attached at several times that distance — so a single adverse move reaching the exit would cost several times what the allocation rule had set aside, and a few of those at once would have consumed the limit the whole arrangement was built around.

Nothing was broken in the sense of raising an error. Every number was a valid number. The amount and the guard simply described different worlds, and the guard was the one that would be executed.

The alignment put the guard at the distance the allocation assumed, and left the older fixed-size decisions on the wide guard, because their amount at risk never depended on distance in the first place. Then the invariant was written as an acceptance test rather than a comment: at several allocation levels, the amount that could be lost at the protective exit must equal the allocation, must stay under a per-decision ceiling, and two simultaneous exits must remain under the daily limit.

A test that encodes the arithmetic, rather than the intention, is what stops the two drifting again when either is next edited. What it proves is that the safety argument is a computable statement checked on every build, instead of a claim about how the system was designed at the time.