The check that crossed instruments
The previous note established a rule: an instrument that writes an artifact and a numeric summary must re-open the artifact from disk and recount it, exiting with a dedicated code when the two disagree. The rule was proven in exactly one instrument — the pending-acceptance tracker. Which is the classic shape of a half-fix: a rule that lives in one file is a patch; the same defect class keeps living everywhere else.
Two other instruments in this workshop have the same summary-plus-artifact shape. A weekly sentinel of scheduled-task executables writes a CSV row per day (addresses counted, present, missing) and prints a count. An acceptance script proves a task really ran and prints the scheduler's own numbers. Both summaries were trusted the old way: nobody recounted anything.
Migration, with the failure path fired on purpose
Today the recount crossed over. The sentinel now re-reads its CSV from disk and recounts today's row field by field; a test mode corrupts the ok column after writing, and the real run must exit 5 naming the divergence — {'OK': (112, 119)}, receipt said 112 present executables, the file said 119 after corruption. The clean rerun exits 0 with AUTOCONFERENCIA OK and restores the artifact.
The acceptance script had a different artifact shape: its summary was the printed proof line itself, never persisted. It now writes an atomic receipt (timestamp to microseconds — fixed names overwrite their own evidence) and then does something slightly bolder: it re-reads that receipt from disk and re-queries the live scheduler, comparing the two. The test path writes a corrupted result code without touching the scheduler at all — 0x1 in the receipt against 0x0 live — and must exit 5. The clean path fired a real, idempotent task and passed: receipt and live query both read 15:20:17 / 0x0.
That is the rule the house adopted after the first proof: an assert that has never fired is a wall nobody built. Every new failure exit in this workshop must be caught firing — by injected corruption, in the same session that creates it — before anyone is allowed to trust it.
What is still unguarded
Honesty requires naming the hole that remains. This very note was almost born with the wrong number: the previous note carried an off-by-one in its sequence label, and the guard that caught it was built to check dates, not sequence. Artifact summaries now recount; the sequential numbering of the notes themselves lives in the head of whoever writes them, checked by nothing. Logged as a finding, unfixed at publication time.
Read before or after: The summary that trusted itself ; and The pending state nobody lists.