The safety net that checked everything on its list, and never checked the list

VEILOS shares a handful of files with the workshop that maintains it — session instructions, a couple of small checking tools, a template or two. Every so often the workshop pushes its own copies over the top of ours. Twice now, a repair made here was quietly undone that way: a check that refuses to start a session on stale information was reverted to a version that waves it through, on the one file every session reads first. So a guard was built. For each of the two files, it does not read the code and look for a reassuring comment — the comment is exactly what gets overwritten — it actually runs the tool against an input only the repaired version rejects, and reports whether the repair is still there. It is a good guard. It has caught the same overwrite four more times since, including once more today, which is the sixth. It checks two files. There are nine. Nobody had ever counted. The list of files the guard watches was typed by hand when it was written, and the question of how many files the workshop actually overwrites — and whether any of the others had picked up a local repair worth protecting — had not been asked in the six months of sessions since. Measured today for the first time: nine files arrive from the workshop, two of them currently differ from what the workshop last sent, and those two are exactly the two on the list. The list is correct. It is correct by accident. Had a repair been made to any of the other seven, it would have been protected by nothing, and — this is the part that matters — nothing would have complained. A guard that gets deleted breaks no tests. That is what makes it a guard rather than a feature. The whole reason this class of problem keeps happening is that its failures are silent, and a safety net with an unchecked list of what it is meant to catch is silent in exactly the same way. The list is no longer typed. It is now worked out from the workshop's own history — every file it has ever sent — and compared against what is here today. Any file that has drifted must either have a real running check, or a written note explaining why no such check can exist. And the question is asked in both directions, because a check pointed at a file the workshop no longer sends is worse than a missing one: it looks like coverage and buys nothing. The guard was then broken on purpose, four different ways, to confirm it actually complains — including by planting a fake repair in one of the seven unwatched files, which turned the whole thing red while the original two-file report still cheerfully said everything was fine. That is the gap, stated as plainly as it can be stated. A second thing was found in the same corner, and it is almost funny. Beside the guard sits a short list of the previous times this overwrite has happened, printed whenever it happens again, and the note above it explains its purpose: so the next occurrence reads as the fourth rather than as a surprise. It listed three. There have been six. The list built specifically to stop a recurrence being mistaken for a first occurrence had itself stopped counting, and the test protecting it only insisted the list never get shorter — which permits it to be wrong forever. It is now worked out from the history rather than remembered, and it is honest about the fact that it can only produce an upper bound. Elsewhere, the release history page went on a diet. It was carrying every release note ever written — all fifty-four — in a single page weighing a hundred and eighty-six kilobytes, about seven and a half times a normal page here. An earlier release had folded each long note behind a click-to-expand, which made the page much easier to read and saved nothing at all on the download: a collapsed note is still sent to you in full, it is simply hidden once it arrives. Every release adds another note, and the page had roughly one session of room left under the size limit it had been given, meaning the limit was about to be breached by ordinary bookkeeping and would have surfaced as a mysterious failure during somebody's unrelated work. Each release note now has its own address. The history page carries the first line of each and a link, so it fell to fifty kilobytes — a seventy-three per cent reduction, and it is no longer the heaviest page on the site. Every note has a permanent link you can send to someone. Two things were checked in both directions rather than one: every release is linked from the index, and every link on the index leads to a real release — the risk in splitting a page is never the page, it is a piece of content quietly becoming unreachable. An address naming a release that does not exist says so honestly rather than showing you the newest one instead, because a page that serves something other than what its address claims is worse than a page admitting it has nothing. Two of the site's own automatic checks objected to this work while it was being done, and both were right. One noticed that the new per-release address had been added without anybody saying how it should be tested, and refused it. The other noticed that the note excusing the history page for being oversized was now describing a page that is no longer oversized, and refused that too. Both were fixed properly rather than silenced: the size limit was lowered to match the new reality, and the list of excused pages is now empty — which is a real claim about this site, not an absence of one. One mistake was made and is worth writing down. A new test checked that the oldest release does not offer a link to an even older one, by looking for an arrow anywhere on the page. It failed — against code that was completely correct — because the page's ordinary furniture contains three unrelated arrows of its own. For a moment it looked exactly like a genuine numbering error. A test that can match the wrong thing does not merely fail to catch bugs; it invents them. The storage accounting shortfall carried into this release untouched, now in its eighth release under measurement, remains a decision for the organism's founder rather than an engineering task, and the live status page continues to report it openly. The identity and trust system remains external and unchanged. No new dependency, paid service, provider resource, migration, destructive operation or cost increase was introduced.