Types green. Tests green. Artifact wrong.

Assertions about state, props and database rows are assertions about what we intended. The visitor gets a rendered page. Our render gate loads the published URL in headless Chromium and asserts on what a person would actually see: visible copy, reading-order position, and computed contrast.

A shared wrapper hard-coded text-white, and a survey of its eleven call sites found not one passed the prop that would have overridden it. Every block built on it painted white text regardless of the site’s theme. It was caught on a published résumé page showing forty bullet points with no text beside them — white on a white card. The skills were all in the DOM; innerText returned them. Invisible to tsc, obvious in a screenshot.

The same rule caught a fee disclosure rendering below the control that took a visitor’s money on two of three variants — text order and DOM index both said it was above.

A check is a claim about the world, and an unfalsifiable claim is worth nothing. Our asset verifier ships a --selftest that spawns it against known-bad fixtures and asserts the exit code — so a guard that is defined but never wired fails the build rather than being blessed by the check it was meant to strengthen.

We wrote a guard for “a settings panel nothing imports”. It asked whether anything imported the file — and a dead file counted as something, so the orphaned panel passed. Being referenced by a corpse is not being reachable.

Every sweep asserts a non-empty target set before asserting anything about it. A grep that silently matches zero files is indistinguishable from a clean codebase, and it stays green forever after someone moves a directory.

False positives train people to skip the output, which is the same silence-looks-like-success failure one level up. We treat a crying-wolf guard as a defect in the guard, not an inconvenience.

A rule banning opaque light fills flagged bg-white/90 — an alpha tint, which is the pattern the neighbouring rule recommends. It failed two correct files on its first repo-wide run. Twice more since, a test matched a word inside the comment explaining why the code was right.

Where a rule arrives after the violations, we record the count and forbid growth, rather than either failing the build or quietly excluding a directory. Our env-var declaration test carries a frozen baseline of 109 known-undeclared keys, with a companion test asserting the baseline never grows — a baselined key that gets declared must be removed from the list, or it rots into a permanent allowlist.

⚠️ The baseline must be measured, not chosen. A ratchet set above the real count sits green while the number climbs to meet it.

A feature flag turned on with two of its three variables set is not off and not on — it is silently broken. CONFIG_GATES declares 14 features with their required env, evaluated at startup, and a public /status endpoint answers “is this actually live?” from the running process rather than from a config file.

One integration sat inert for five days on one of three variables. A captcha was silently off for weeks on an env-name typo. Neither produced an error.

Our most expensive recurring error is not a wrong observation — those fail loudly, because whoever owns that code corrects you. It is a true observation plus an unverified inference, reported as one thing, arriving with identical confidence because the checked half really was checked.

So findings are written in two labelled halves:

Verified: the parser discards the structure (read the source).
Assumed:  that the shopping list consumes it — I did not check.

Verified: must state scope, because that is where over-claiming hides — “I grepped rather than remembered” can be true and still be one directory reported as a repo-wide conclusion.

Asked whether our pages server-render, we checked the marketing pages, got a clean result, and nearly reported all-clear. It was true about the pages nobody was asking about — the customer sites were serving an empty shell to every crawler. A verified check pointed at the wrong instance reads exactly like an answer.

The scope failure is the same shape whether the population is pages or files, and it is very hard to feel from the inside, because the measurement genuinely ran.

This page shipped with that bug in it. The sentence below said “more than 500 test files”. The command behind it excluded the top-level node_modules and missed a second one nested deeper — so 309 of those 507 files were our dependencies’ tests. We were counting zod’s test suite and calling it ours. The real figure is 198. It was caught by the test on this page’s own numbers, going red in CI about twenty minutes after the page went live.

Our sibling product runs backstoried, cost-capped browsing personas against public surfaces with a first-time-visitor goal. They catch the class scripted tests cannot: a scripted test asserts what you already thought to check.

Three rules make them safe to act on. Findings land at status:'triage', never open — enforced twice, in the route and in a database constraint — because a persona finding is a claim until a human agrees. Attribution lives in the record rather than a UI badge. And evidence is typed: searched_not_found renders differently from encountered, because “I couldn’t find it” is indistinguishable from “I didn’t look”.

A persona reported a contact form above the restaurant list. The DOM said otherwise — an empty wrapper from a different bug had made the page read that way. We diffed the claim against the real DOM before moving anything. That check is why the pipeline is safe to run at all.