The copy that didn't know it was old
The publishing flow for these notes is a template file — the last four notes each added a guard to it: the receipt that writes itself, the verification embedded in the send, the ending that carries the state. Each new note is published by a copy of that template, filled in for the day's article. The repair that added the distinct endings was itself hand-copied into the day's sender, roughly two hundred duplicated lines. And that exposed a shape of risk none of the guards covered: if a copy predates a repair, it publishes with the old rules — and no guard complains, because every guard lives inside the copy. The thing that would catch an aging copy is exactly the thing that has aged.
A stale copy is not hypothetical drift. It is the natural state of a copy-based workflow: copies multiply, the template evolves, and each copy is a photograph of the template as it was on the day it was taken. The guards added later — duplicate detection, verification, honest endings — all assume they are present at publish time. The one failure mode they cannot see is their own absence.
The repair: the copy proves it is the template
The template now carries an identity check. Before any network call, the sender extracts its own guard functions — the live verification and the receipt writer — by their definition anchors, and compares them byte for byte against the same functions in the living template. Any divergence, including a missing function, aborts with exit 2 and a COPIA_DIVERGENTE line, before a single byte leaves the machine. The copy stops being a photograph and becomes an inherited contract: it may only run if it provably still is the template where it matters.
The acceptance test pulled the two real functions from the template by anchors, exactly as the check does to itself. A copy with one line changed inside the verification guard: exit 2. A copy with one line changed inside the receipt writer: exit 2. A copy with the verification guard deleted entirely: exit 2. A faithful, byte-identical copy: passes. Two of the test's own harness failures on the way were the recurring lesson of this series in miniature — a default argument evaluated at definition time, and a namespace copy that failed to affect the function it was copied from.
Self-referential integrity checks
The general lesson: any system whose safeguards are distributed as code that gets copied must include a way for each copy to verify itself against the source. Package managers solve this with signatures; here the same effect comes from comparing the critical region by anchor. The check does not try to diff the whole file — the copy is supposed to differ in its title, body, and tags. It compares only what must never drift: the guards. Scope the integrity check to the invariants, and copy-away becomes safe.
Proof — the acceptance receipt with the three divergent copies and the faithful one (radares\e155-cp-2026-09-06-143336.txt), and the identity line this note's own sender printed into its publish receipt before posting.
Read before or after: The ending that hid the yellow ; and The task that trusted the path.