Thirty thousand passing tests and the defect still shipped

TL;DR: In August a class of defect shipped through every gate we had, and the fix wasn't a better validator, it was moving the validator. Every defect we found after that was a control problem a control engineer would have named on sight. Thirty thousand passing tests couldn't see any of them, because tests measure nodes and the questions measure the loop.

The defect looked like this: a sentence severed mid-clause, inside a committed strategy read, carried into the next read's premise, rendered to a founder across four artifacts, while the validation log showed green on each one.

One rule up front, because this is where control analogies usually go wrong: we use this as a mental model, never as arithmetic. No gain constants, no tuned coefficients. What transfers is where things sit in the loop.

The slow loop at StratOS is easy to name. The committed strategy is the setpoint. The market and the build are the plant. The founder executing moves is the actuator, the founder logging outcomes is the sensor, and the error is the gap between an outcome and the bet's predicted boundary. A bet with a kill criterion and a read date is the internal model. The timebox is anti-windup.

The August defects didn't live there. They lived in the fast loop inside each read.

Where the sensor sat

Each read runs the same way. The model writes, the validator checks, repairs run, assemblers render typed blocks into prose, and the result is staged for the founder. The validator read the model's output. Then five actuators fired after it: two rewrite passes, a plain-language assembler, a block renderer, a premise insertion. The commit ruled on the sensed state. The staged bytes were something else.

Control engineers have a name for this, observer placement: you measured upstream of the last thing that changes the bytes, so your green light describes a state that no longer exists.

The fix was a second measurement at the true output, immediately before staging, running the same predicate as the upstream one, plus a structural pin. Nothing byte-mutating may sit between that sensor and the boundary, and the build fails if something does.

Ask it of any pipeline you own. Where does your sensor sit relative to your last actuator? If it sits upstream, you don't have evidence. You have a memory of evidence.

One property, one owner

The severed sentence had a second cause. Three clippers implemented one law: clip to a complete unit. A fix had been applied to one of them. The defect shipped through another. A replay found the third had severed the same construction into twenty-two stored renders.

When one property has three owners, a fix is a coin flip.

So we gave the boundary law one owner that every clipper imports, one shared postcondition, and a census test that fails the build if a twin reappears. The yield showed up immediately: teaching the clipper that "vs." isn't a sentence stop landed on all three paths in one edit.

The founder's acceptance pin was a single line. Clipping twice must equal clipping once. It failed on nested unbalanced tails, which stripped one parenthetical per pass. A limiter that isn't a projection leaves residual for the next pass, and downstream that residual is indistinguishable from a fresh defect. The strip now runs to a fixpoint, and every output-conditioning operator gets the same test.

Two neighbors fell out of the same audit. First, the repair budget: at most one model repair round, default zero. We found two invariants declared repair-only with a budget of zero. A clamp set to zero isn't anti-windup, it's no correction at all, and the logs couldn't distinguish "we retry once" from "we never retry." Bound the retries, then make the bound legible from outside. Second, a duplicate validator instance, called with three of its thirty arguments, read wrong in both directions. It passed corpus-bound gates on an empty corpus by failing permissive, and failed every legitimate figure because with an empty corpus every number looks invented. We didn't calibrate it. We deleted it. One measurement surface.

The places that fail open

We have a standing law: fail open, because a gate never costs a founder their read. In control terms that opens the loop at exactly the point where the fault is, and a fail-open segment with no telemetry is an unobservable state.

So every fail-open seam now carries a floor and an alertable counter. Every gate emits an event on every fire, with counts, not only when it blocks. A registry of owed-and-delivered checks asserts per channel that a capability which had input actually produced bytes.

The motivation was measured, not theoretical. About eight gates had been witnessed live and were dark, because the witness read the artifact and not the gate.

The questions that found them

Where does the sensor sit relative to the last actuator? How many actuators own this property? Is this limiter a projection? Is the retry bound distinguishable from zero? Is there a second sensor nobody calibrated? Which segments are open loop, and can they say so?

Every one of those found a live defect in a system with thirty thousand passing tests. The tests measured nodes. The questions measured the loop.