Case 69/58: the mirror that reverted its own work

🩺 Show the full clinical history → 📋 Session protocol →

Clinical history · Software Pathology

The patient had no symptoms. It published without errors, the tool confirmed success, the logs came back green. It had been publishing into the void for four weeks.

The double ledger — what it cost, and what it left

The point of abandonment — what the table doesn't show

This case’s point of abandonment did not arrive with an error, but with a sentence: “I’ve gone crate by crate through a complex codegen system and I’m well past the reasonable point to keep going blind.” That is what a machine says when it runs out of map and keeps walking. And the answer that unblocked it was not technical: it was someone drawing the hierarchy of levels —rustelo → website-htmx-rustelo → outreach/site— that existed in one head and in no file. That is the whole diagnosis, spoken before it was had: whatever is not declared, someone is holding up with their memory. And memory tires.

Differential diagnosis — what was ruled out

Etiology — the cause — The mirror that decided by direction, not by ownership

# The `content` recipe, exactly as it stood:
content_processor                                     # writes the indexes into site/r
rsync -a "site/public/r/" "site/r/"                   # ← the weapon

# Two trees. Each one the OWNER of different files:
#   site/r         ← content_processor writes here (the server reads it)
#   site/public/r  ← the nu generators write here (and this is what the deploy SHIPS)
#
# The rsync ran one way, and in the wrong way:
#   · it trampled the freshly generated indexes with fossils from the deploy tree
#   · and it NEVER carried the new content to the tree that travels to production
#
# rsync -a without --update does not honour "the destination is newer": it compares size
# and mtime, and if they differ, IT COPIES THE SOURCE. A mirror whose source has fossilised
# is not a no-op: it is a machine for resurrecting old state.
#
# The tool printed "Generated index.json with 69 posts".
# The disk kept 58.
# Nobody compared the two.

just — the content recipe

Treatment — The mirror is typed by ownership, and the check reads the disk

content_processor
# Content indexes → deploy tree. --delete: without it, a renamed slug
# survives as a live URL IN PRODUCTION.
rsync -a --delete \
    --exclude about.json --exclude adr-map.json \
    --exclude taglines.json --exclude content_graph.json \
    "site/r/" "site/public/r/"
# The four nu artifacts → served tree. They are excluded from the outbound leg, or the
# stale copies in site/r would clobber the freshly generated originals.
for f in about.json adr-map.json taglines.json content_graph.json; do
    cp -f "site/public/r/$f" "site/r/$f"
done

# And three gates that ASSERT AGAINST THE DISK, never against the tool's stdout:
#   adr-check        the spine holds no ADR the site does not publish
#   templates-check  the assembled tree reproduces exactly from its declared source
#   posts-check      linkify + graph coverage
#
# All three can be run WHILE the damage is still hypothetical.
# A check you can only run after the destructive step is not a gate:
# it is an autopsy.

just — the content recipe

Prognosis

The series asks one question: with ontoref, would it not have gone like this? Almost always the answer is yes, and that is why there is a series. This case file is the one that answers NO — and that is why it is worth the most. This happened INSIDE ontoref, with the ontology loaded, the gates written and ADR-066 —“the check decides, never the reporter”— accepted a week earlier and proven with an eight-path falsification run. The rule that names this exact pathology already existed, while the pipeline that publishes ontoref to the world went on letting the reporter decide. The protocol did not fail: outreach was the blind spot, the one surface the protocol did not govern. Every mechanism that would have caught each one of these failures already existed and was accepted in this very repo. Not one of them was pointed here. And that is the useful answer, the one a comfortable case never gives: having the mechanism is not enough — you have to point it at the surface that hurts. An enforcement you cannot trust to fail is indistinguishable from having no enforcement, and it is more dangerous, because it gets believed.

Prophylaxis — what enforces the lesson today

• ✓
  Every delivery tree declares its owner and witness; a mirror runs by ownership, never by addressadr:070/mirror-typed-by-ownership
• ✓
  A generator no recipe calls does not exist: it enters the chainadr:070/generator-in-the-chain
• ✓
  The contract lives outside the instance tree it typesadr:070/contract-in-the-instance-tree
• ✓
  The served tree is the only one that exists, and the check compares the twoadr:072/the-served-tree-is-the-only-one-that-exists
• ✓
  In the chain, with its negative case per axisgate:just expedientes-check