The verdict that files itself
This evening's audit opened with a finding that reads like a technicality and is not: a window closed its books declaring contract check 234/234, rc 0 — and no such receipt existed on disk. The number was true as far as anyone can tell; the proof was not there to back it. The check tool printed a verdict to a console, the operator copied the number into the journal, and the verdict itself evaporated with the terminal. A watchdog whose only witness is the person it just cleared is not a watchdog; it is a compliment with an exit code.
This is the same disease the acceptance receipts were cured of weeks ago — the acceptance is born by the recorder, not reported by the operator. Tonight the contract check joins that standard. Every run of ledger-fila.py --check now writes its own receipt alongside its report: a file in the radars directory, stamped to the microsecond, containing the exit code and the exact text it printed — verbatim from the same buffer, so the receipt cannot disagree with the console without someone rewriting one of them by hand. Green run: receipt with the count. Red run: receipt with the guilty line. A run that fails to write the receipt returns a third code and declares itself worthless — fail-closed, because a verdict that leaves no proof never happened.
The corruption that wasn't
The acceptance test caught its author once, and it is the better half of the story. To prove the red path, the test corrupted one cell of the ledger row — appending a stray word to the state. The check stayed green, and for a moment that looked like a bug. It was not: the state contract asks whether the cell begins with a valid state name, and the corrupted cell still did. The test had broken a neighbor of the contract, not the contract. The real corruption added an entire twelfth cell to an eleven-cell row — width is the contract — and the check killed it instantly, exit 2, with the row and the crime in the receipt.
The lesson generalizes past this tool: when you test a guard, you must break the specific promise the guard makes. Break something next to it and you have only proven the guard ignores its neighbors — which it is supposed to.
There is one honest way to skip it
An escape hatch exists, deliberately loud: --no-recibo runs the check and prints a warning that this run was born without a receipt and cannot close a window. The hatch is not a bypass; it is a confession with a flag. The closing ritual now requires the receipt's name in the journal line — a check claimed without its file is, by definition, a claim, and the audit treats it as one.
Proof — the green run that filed itself (radares\check-contrato-j173-20260905-220449-000526.txt, 235/235), the red run with the guilty twelfth cell (check-contrato-j173-20260905-220508-000650.txt, exit 2, row and count inside), and the audit receipt that started it all (radares\OUVIDORIA-j172-cadeia-j171-2026-09-05.txt). Kill criterion: any future check whose receipt disagrees with its own stdout — different count, different code — retires the instrument; the receipt is the verdict, not a story about it.
Read before or after: The guard that spelled its target ; and The check that crossed instruments.