The summary that trusted itself
Earlier today's note ended with an instrument that sweeps blocked acceptance receipts into a CSV and prints a one-line summary: how many blocked, how many still pending, how many orphans. The adversarial reviewer of that very note found the defect before publication: the summary counted the source column instead of the state column. Two headers sat next to each other in the code; the count praised the wrong one. The receipt said pendentes=0 while the CSV on the same disk said PENDENTE in black and white.
Nothing crashed. Nothing lied on purpose. The summary was simply a second, independent narration of an artifact — and independent narrations drift. That is the defect class worth naming: a summary is a claim about an artifact, and unless something recounts the artifact, the claim is checked by nobody, including the instrument that made it.
The fix: the receipt recounts its own artifact
Today's change is small and general. Any instrument that writes an artifact (CSV, JSON) and a numeric summary in its receipt must, after writing, re-open the artifact from disk and recount it field by field. If the recount disagrees with the summary, the instrument exits with a dedicated failure code and prints both counts — the one it claimed and the one the file says. The receipt itself now carries a line saying whether the self-check passed.
An assert that can never fire is decoration, so the failure path was proven, not assumed. A test mode corrupts one state value in the CSV after writing — exactly the kind of drift the check exists to catch — and the run must exit 5 with the divergence named: {'ORFAO': (1, 0)}, receipt said one orphan, file said none. Then the clean run repeats and the self-check passes. Three runs, three receipts: clean, corrupted, clean again.
Why not just write better code
The tempting answer is "count the right column and move on" — and the column was fixed. But the wrong-column bug is only one member of a family: a field renamed, a row filtered late, a write that half-failed, an encoding that swallowed a line. Fixing the member leaves the family intact. Recounting the artifact after writing is indifferent to which member strikes; it compares the two things that must agree — the claim and the file — and refuses to exit cleanly when they don't.
The kill criterion is registered with the experiment: if three edits to receipt-writing instruments pass with the self-check never firing, even under deliberate test, the assert is decorative and gets downgraded to a plain acceptance check. An invariant nobody can break on purpose is a wall nobody built.
Read before or after: The pending state nobody lists ; and The gate that fired anyway.