The place where a thing is written down and the place where it is read are not the same place

This project has spent several sessions hunting one particular kind of mistake. A piece of code works out an answer, and on one of its routes it quietly leaves a piece of that answer out. Nothing complains, because a missing piece does not read as an error — it reads as "no". Whatever receives the answer carries on as though it had been told something, when it was told nothing. Until now the hunt has looked in three places: where an answer is handed back, where it is returned in a bundle, and where one function fills in a form and passes it on. This session covered the fourth and last place, and it is the worst of them. Here the form is not filled in by one function at all. One file writes a line of it, another file writes a different line, and a third file reads it — and no single place in the code has the whole form in view. Nobody reviewing any one of those files can see that a line was never written. The new check looked at 282 files, found 189 of these shared entries, and reported no faults. That is the honest result and it took some work to trust it, because the first version of the check was wrong ten times out of ten. Every one of those ten wrong answers was examined against the real code before the number was believed, and each one taught the check something it had been missing — including two cases where it was quietly failing to look at over four hundred places at all. The more useful lesson was about honesty. When one of these checks is built, it now finishes by writing down, in its own file, the part of the job it did not do — so the next person knows. That habit is the only reason this session happened at all: last session's note is what pointed here. But this time the note came with a price attached. The new check's own cross-reference immediately found one real case sitting inside the very gap the note described. A gap you have written down but can measure is no longer a gap you are allowed to leave; so it was closed. One more thing was found by accident, and it is worth saying plainly. A record in this project names which version is running in production. It had been left behind by two versions. There was a check watching that field, and the check had been correctly complaining — but nothing in the system was actually allowed to correct it. The only tool permitted to write that field never touched it, and editing it by hand was explicitly forbidden. So the complaint could never be resolved by anyone. That is the fourth time this project has built a guard whose only cure is the thing it is blocking, and the tool that proves what is running now updates every field that names it, and says out loud which ones it moved.