Everything passed.
Three of them
were wrong.

The stand-down gate required consecutive clear lab results after a contamination declaration. It filtered them on the time the lab report was imported.

E. coli culture takes 18–24 hours. So samples collected before a contamination event are routinely imported after it is declared. Both then passed the filter, the gate saw two clear results, advanced the incident toward closure, and wrote an append-only event asserting “2 consecutive clear FINAL results” — when zero post-declaration samples had been collected.

The common case. Not an edge case.

The codebase was already explicit everywhere else that source time governs. This was the one place that reached for the server clock.

Then its own review found a defect in the fix. Correcting the clock imported a hazard the old clock’s precision had been hiding.

The replaced timestamp was server-generated at microsecond precision — ties were impossible. Collection time is operator-entered at minute precision — ties are routine. A single-key sort left tied rows ordered by physical row placement, able to resolve fail-open. Now a total order.

Inland Revenue treats adding GST to prices as itself a registration trigger. An unregistered supplier may not do it.

No test could catch this: every fixture in the repository is taxRegistered: true. The unregistered path was never exercised.

The fix needed no invention — the correct non-GST mapping already existed in every country pack. Nothing had ever routed to it.

A reconciliation gate proved a TypeScript spec, a pure-Python port and a DuckDB SQL transform all produced an identical contribution margin. Green, always.

The revenue feeding it was GST-inclusive — the fixture said so in its own comment — and the engine consumed it as though it were ex-GST. GST collected is remitted to Inland Revenue. It was never margin. Meanwhile the repository asserted in roughly eight places that GST is “never mixed into” contribution margin.

The gate was sound as a gate — and it never proved the shared number was right. Three faithful implementations of the same wrong formula agree perfectly.

That is why a permanently-green pipeline never surfaced it. It’s recorded in the evidence document rather than quietly restated.

None was found by testing. All three came from grounding the code against the published standard it claimed — drinking-water rules, GST rules, the ACSC Essential Eight. Those standards are free and precise, and the products had already made checkable promises against them.

Across all ten products in one pass: 34 confirmed findings, 7 HIGH, each citing a fetched primary source and independently re-checked by a skeptic on both axes — is the rule real, and is the code claim real. Eight candidates were rejected on verification.

Equally important, the method refused to manufacture findings. It corrected my own framing where I’d asserted a product claimed standards it never claimed. It declined to assert a vendor permission rule it couldn’t fetch a source for — “I will not assert a requirement I did not verify.” And it gave credit where a product honestly declared its own limitation.