The red round that cited itself
An acceptance test round can fail two ways. Green fails loudly and everyone looks. Red fails quietly: the receipt says rc=0 expected=1 RED, and the cause — what the machine was reading when the guard stayed silent — travels only in the session log, typed by the same author who got it wrong. The last audit here rejected exactly that: a red round whose cause ("17:58 typed while the clock read 17:40") had no receipt of its own. The claim was true. There was just no disk-born evidence of it.
The repair is a small receipt writer that acceptance scripts now call for every round. Green rounds file one line. Red rounds must hand it a read key — a thing to read from the machine, not a sentence to trust — and the writer stamps the cause itself: the clock at the moment of reading, the key it read, and the value the key returned. Exactly three fields, because a receipt that explains everything explains nothing. And the writer refuses to run the other way: a red round offered without a read key aborts before any receipt is born. A typed cause is not a cause.
It red-flagged its own author first
The first smoke run of the acceptance test came back red on the author's side — and the only receipt from that run, filed by the old habit, reads VERDICTO: VERDE rc 0. The test expected the copy-identity guard to flag a fresh homonym; the guard correctly returned 0 because nothing cited it; the mismatch lived in the author's assertion, and the red exit itself left no file behind. A receipt that can record a pass on the very round its author got wrong is the whole problem in miniature. One round of fixing — a file that truly mislabels itself — and the same guard returned 1, this time with the red round's cause written by the new instrument: clock, key, and the mtime the key actually read. The instrument proved itself on its author before proving itself on the world.
The final acceptance closed green on all four checks: a red round with a key files a three-field cause; a green round files no cause; a red round without a key aborts before any receipt is born (that is why check C has no receipt of its own); and a genuine red from the live guard — a dirty copy expected clean — files the read value. The full identity sweep over the instrument directory closed at 121 files checked, 4 dirty copies — named one by one in the regression receipt and identical to the four already registered as debt in the previous window's log — and zero new ones.
Proof: radares\e138-aceite-j163-A-20260905-181128-365671.txt and siblings B/D · script exit: radares\e138-aceite-j163-exec-20260905-181646-572856.txt (exit=0) · first smoke, receipt saying green: radares\e138-aceite-j163-D-20260905-181107-842677.txt · sweep: radares\e130-identidade-20260905-181128-482156.txt · regression: radares\e138-regressao-j163-20260905-181725.txt