Reachability

The Shape

Every signal a project watches is a signal from something that ran. A test that ran and passed. A linter that ran and found nothing. A merge that ran and reported success. The signals from things that did not run are not red. They are absent, and absence renders as the background colour of the dashboard — which, on a healthy project, is green.

So a fix with no callers, a guard that cannot fail and a stamp nobody reads are not three bugs. They are one bug seen from three angles: the mechanism exists, the code that would exercise it does not, and nothing in the system can tell the difference between checked and fine and never checked. You cannot grep for a missing call. You cannot see a test that was never collected. The only thing that can report on an absence is a check that was designed, in advance, to be present.

1.1.2 had already closed four gates that could not fail. 1.1.3 is what happened when we kept pulling that thread, and its name is literal. What follows is the five defects in the order the stories are worth telling, and then the four habits they left behind — which are the part I actually want you to take.

A Fix That Merged and Changed Nothing

The defect underneath is simple to state. When two Maxims share what they have learned, the Hivemind merge aligns the donor's memory clusters onto the receiver's, then folds the donor's reward biases in. The alignment step computed the right map and discarded it. The fold step matched on exact string keys. So every want the donor had learned landed under a cluster id the receiver could never look up. No crash. No warning. A merged foreign want read out as exactly 0.0, and the merge reported success.

The fix shipped three functions: align and return the map, re-key the donor through it, fold N substrates in one pass. Each was correct. Each was unit-tested. And the pull request left their composition to call sites — of which there were zero. Every shipped consumer still called the old fold. Through every real path, the want still read out as 0.0.

What caught it was a ship gate that had been written red before the fix existed: three behavioural arms marked xfail(strict=True), expected to flip to an unexpected pass once the fix merged and force the marker's removal. They kept failing. That is the entire finding. A non-strict marker would have stayed quietly yellow through both merges, and the fix would have shipped as a green fix nobody called.

The reflex at that moment is to delete the markers and get green — the fix is merged, after all. The second reflex, barely better, is to re-point the arms at the hand-composed sequence, which turns a ship gate into a test of a recipe. Both produce a green suite over a system where the defect is live. The actual remedy was to make the composition one callable thing, in the seam where the bug lived, and to discover in doing so that the receiver had no way to load merged clusters at all — the registration path hard-coded every node's evidence count to one, which would have erased the merge's weighting on every federation round. An ingestion has two halves, and the second is easy to forget because the first returns a value that looks like the answer.

A Success Number That Moved the Wrong Way

The merge did report something. It reported the size of the combined bias table, and the table grew every time, so the command printed success. But the size of a union of two keyed tables is maximal exactly when nothing aligned: if every donor key had matched a receiver key, the table would not have grown at all. The number people read as health was inversely correlated with it.

len(left ∪ right)  =  len(left) + len(right)      # nothing aligned: "maximal success"
len(left ∪ right)  =  len(left)                    # everything aligned: "no change"

A metric that cannot go down when the thing it measures fails is not a metric. The merge now reports how many biases were re-keyed and how many were dropped, which are numbers that can embarrass it.

There was a second half to this one that appeared in no plan document. The alignment threshold was tuned for paraphrase text embeddings; the interoception clusters that actually carry reward biases form at a much stricter similarity. Returning the map without retuning would have collapsed every donor cluster onto whichever receiver node happened to score highest — a confidently wrong alignment replacing an honestly missing one, which is strictly worse. Reachable is not sufficient. Reachable and comparable is the bar, and the second word is the one the plan forgot.

A Guard That Passed Against return left

The sound-orienting result has three arms, and the third — two independently trained substrates merge into a policy at least as good as either — sits in the graduation ledger as an earned row. Earned rows carry a contract: a Re-run on: trigger naming what would invalidate them, and a regression guard that re-validates on demand. This row's trigger was “merge semantics change,” and its guard was the merge gauntlet script.

Replace the merge with return left and the gauntlet passes. Replace it with return right and it passes. Only return {} fails. You could have gutted the function the guard existed to protect and the trigger would have fired, the guard would have run, and the ledger would have recorded Maintained.

The row's sentence was true as written. Its evidential status was not. The guard now has a guard: a flag that re-runs the gauntlet with the merge replaced by each stub in turn and exits non-zero if any of them still passes. On the original recorded parents it correctly reports the gate as vacuous. That distinction — a claim being true versus a claim being defended — is what the ledger is for, and the ledger is only as falsifiable as its guards.

A Stamp Nobody Read

Every memory cluster the substrate stores is a centroid in an embedding space, and the space depends on the encoder that produced it. Swap the encoder, and old centroids are not slightly wrong — they are vectors in a different coordinate system that happen to have the same length. The project knew this. It recorded an encoder provenance stamp on the store, persisted it, and reloaded it on every start.

Nothing compared it to anything. Its only readers were the bundle export. The recorder itself treated divergence as a finding to merge rather than an error to raise. So a geometry change loaded old-geometry centroids and cosine-scanned them against new embeddings, and the one check that did exist — refuse a dimension mismatch — could not see a same-dimension change: a place code that adds sensor names changes the basis set and not the length. Because audio clusters are frozen-centroid by design, the centroid never even drifted. The only symptom was inflated counts.

Clusters now carry a geometry tag derived from what actually makes two vectors comparable, and two clusters declaring different geometries never fold — at cosine 1.0 included, because similarity across spaces is not a small number, it is undefined. That cannot be a threshold.

A Test That Could Not Run, Beside Two That Could Not Fail

1.1.2 added a nightly lane for slow-marked tests because forty-one of them had been running nowhere. The lane's first real catch was a failing integration test: two fire-related concepts should share a memory cluster, and they did not. It failed identically with and without the fix that was suspected, so it was pre-existing, so it went on the ledger.

The investigation found no code failure. The test harness deliberately forces the model hub offline and points the model cache at an isolated directory. That is correct — no network in tests, no polluting the developer's cache. But it means the linguistic encoder can never load its sentence model under the test runner. It always falls back to a bag-of-words encoder whose own docstring says paraphrase collapse will not work with it. The test was structurally impossible, not broken. It had been asserting a capability that the environment it ran in had removed before the first line executed.

Its siblings were the mirror image. Two negative controls asserted that water does not share a cluster with fire. A hash encoder satisfies that trivially — a degraded encoder is very good at telling things apart — so they were passing for the wrong reason. And both wrapped their assertion in an if on the concept existing, so the likeliest outcome under a degraded encoder, a missing concept, meant passing having checked nothing at all.

The four semantic-dependent tests now skip with a reason that names the cause, and the two guards became assertions. That is the honest state, not the fixed one: a skipped test is not a passing test. The real remedy is pre-seeding the model into the isolated cache so the nightly lane can run what it was built to run, and that is still owed.

The Practice

The war stories are the evidence. These are the rules, and they are what the release actually shipped.

One corollary earned its own line. Every mechanism you add to a gate's path needs its own null arm. Wiring the merge composition made cluster ingestion part of the behavioural gate, which introduced a fresh way to pass hollowly: ingesting the donor's clusters relocates which cluster the receiver lands on, so “the score went up” could be relocation rather than transfer. The gate now also asserts that ingesting the donor's clusters without its rewards changes nothing. Anti-vacuity guards must cover the fix's own new degrees of freedom, not just the old ones.

This is the same project as the honest benchmark, one layer down. The ledgers — defects, measurement limits, and the behavioural claims with their re-run triggers — are a working system for not fooling yourself, and they are only as falsifiable as the guards they cite. A vacuous guard on an earned row under a live trigger is the exact failure the ledger exists to prevent: the trigger fires, the guard runs, the row reads Maintained, and the claim has not been tested since the day it was earned. Making the guard able to fail is what makes the trigger mean anything.

Still Owed

The geometry guard's specification says reject or migrate incompatible state. Only reject shipped; the re-encode path does not exist yet, and the warning text currently promises a remedy it cannot deliver. The impossible test is skipped, not running. Both are on the ledger with their triggers, which is where a reader should check rather than here — the defect ledger wins over this essay wherever they disagree, and it is supposed to.