Phase 10 — The audit backlog, and the fixes it found

This phase exists because of a question: had the four pre-commit checks actually been applied to this program’s own commits? The honest answer required reading them rather than asserting it, so the phase became an audit of the program by the program.

Thirty-two findings, fourteen slices, each with its own commit. The method was a sweep by defect class first, then reading the hits — because a judgement-based review only ever catches what it thinks to look at.

⚠ The audit’s own first two passes were wrong, and that is recorded at the top of its doc rather than buried. A finding list assembled without re-measuring is just a memory of a codebase.

What is not closed is stated plainly, because a closing phase that quietly drops its residuals is worse than one that never opened them:

• The B.V.S.R. finding in the older admin tiers was split out into its own program — it predates this one by seven months and was never this phase’s to carry.
• The metering half of one finding is BLOCKED, not deferred. The remedy rests on a wire-format fact that costs real money to establish. Decided: do not pay for it, and do not build on it unconfirmed.
• One finding is a decision, not a fix — 31.6 MB of a 113 MB database with no retention policy, growing about 350 MB a year. Both schemas now carry the census; the answer belongs to a human.
• One test stays red on purpose. It pins a hand-kept list against a fleet designed to grow, so every successful provisioning breaks it. That is the test being wrong, not the fleet.
• Two findings were filed and never absorbed, and one is a house-style decision deliberately not taken on this phase’s authority.

⭐ And one gate was released: the launchd work had been blocked on two of these findings, and closing them turned it from a defect into an operator’s choice.

⭐ The phase’s strongest finding is about the phase. Across twelve slices, five instances of the very defect class it was auditing for were committed by the work removing that class — each by someone who had documented the class hours earlier and was actively hunting it.

The first. While fixing a finding about a surface that cannot express a third state, the new predicate read an edge directly and returned true on an empty slice. Empty meant two things — nobody loaded it and none is active — and it resolved the ambiguity toward the alarming reading. That is precisely the defect being fixed, reproduced inside its own fix.

The second, in the very next slice. A function was split so a caller holding a parsed record could skip a second decode, and the test written to protect the split asserted that the wrapper equalled the helper. Those were the same function. A deliberate one-minute offset was injected — a change that shifts every staleness comparison on the status surface — and the test stayed green, because both sides of the equality moved together. A self-referential test, written in a slice about redundancy.

What this establishes is not a resolution to be more careful. These were reproduced by someone looking straight at the class. Vigilance is measurably not a control here. What caught them was blast radius in one case and mutation in the other — and mutation testing is the only thing that has ever caught this class in this program.

The corrective is structural or it is nothing: make the ambiguous value unrepresentable, rather than resolving to remember which way it points.

Two sharper sub-lessons came out of the same work. A mutation that stays green is itself a finding — it means the test is measuring agreement rather than a value, and the repair is to assert against an independently constructed expectation. And a red test is not self-evidently a good test: read whether its failure message names the actual cause, because a test that goes red for the wrong reason will mislead exactly when it is needed.