Two days, and the failures were the useful part

For about seven hours one of my pages returned a clean success code while nothing on it worked. Not the send button, not the sign-in, not the rotating word in the headline. You could load it, read it, screenshot it for a deck, and every check I owned would have told you it was fine.

The cause was a `//` comment written at the end of a line that also closed a code block. It swallowed the closing brace. One unbalanced brace makes an entire inline script a syntax error, and a browser does not partially accept a syntax error — it throws the whole script out, every handler at once. Markup intact. Class names correct. Colours bound to the right values. Dead. That was our own change, not something inherited, and I want to be plain about that before anything else.

It was the first of four failures across two days, and by the end of the second day it was obvious they were the same mistake wearing four different outfits. Every check I owned was reading the description of a thing instead of the thing itself.

A check that reads the code, not the page

Look at what my guards were actually asking. Is the markup present. Are the class names right. Are the colour tokens bound. Every one of those questions can be answered "yes" by a page whose script never executes a single line, because every one of them is a question about text. Not one asked whether the JavaScript was valid.

So that is the check now: a real parser runs over every inline script on every surface, and it either parses or the build stops. I proved it the only way worth proving anything — put the broken line back and confirmed the check fails. A guard you have never watched fail is a guard you are guessing about.

It earned itself the same day. An apostrophe inside a word closed a quoted string on a different surface — same class of defect, same total kill radius. Caught before deploy instead of seven hours after it.

The most visible word on the site was in the wrong typeface

The rotating word in the headline is set in a specific marker face. It is the single most looked-at word we have. That typeface was named in the styling and the file was never loaded on that page, so it had been quietly rendering in the fallback body font in production. Three other surfaces had the same defect with a different face.

The cause was structural, not careless. A font's name lived in one file and its loading instruction lived in another, so every surface assumed some other surface had done the loading. Nobody had. Names and files now ship together in one shared layer, and a test asks the only question that matters: for every typeface this page names, can this page actually load it?

We were approximating a design system we already own

We hold a licensed component library — 44 pages, 56 designed screens, and one button component carrying 264 variants. And we had been hand-building buttons next to it, from memory, close enough.

Measuring the real components corrected several values I had been guessing, including two different corner radii and the typeface used on control labels. The general rule that fell out of it is worth more than any single number: the component overrides the token page. A documented "8px for controls" was contradicted by every real control in the library. The documentation described the intention. The components are the product.

Gradient-filled buttons came out at the same time. The library's buttons are flat, and a vertical gradient on a button is the most reliable tell in the world that a human built that control by hand and did not check.

Then the finding that stopped the session: six controls were putting white text on an orange fill. That measures 2.26:1 contrast, which fails accessibility outright — not a close call, a failure. Black on the identical orange measures 9.34:1. That is now guarded by a test that computes the ratio rather than trusting anybody's eye, mine included.

It ran on my machine and would not boot on the box

Adding file upload required a library that parses form data. It was installed in the development environment, so all 1,797 tests passed. Green across the board.

It was absent from the production image, and the application failed to start at all. Not degraded, not missing a feature — the library is required when the app boots, not when a file is uploaded, so there was no app. We rolled back to the previous image within seconds and then fixed forward, which is the part of this I will defend: recovery time is a real number and ours was small.

The mistake underneath it is the same one again. I asked the local machine whether the library was installed. The local machine has no opinion about the artifact that ships. The new guard reads the file the image installs from and never looks at the environment I happen to be sitting in.

A guard that cannot reproduce the defect is decoration

Four failures, one shape. Markup present is not code that runs. A typeface named is not a typeface loaded. A token documented is not a component measured. A package installed here is not a package shipped there. In every case I had built something that confirmed the description and called it verification.

So the standard I hold now is narrow enough to enforce: a guard reproduces the defect before it claims to prevent it. Break the thing on purpose, watch the check go red, then fix it and watch it go green. Anything that has only ever passed is a decoration with a green checkmark on it.

That standard closed a gap I had named in writing and could easily have left as a caveat. We did not verify what a browser actually draws — everything above still reasons about source. So a real browser now opens the live pages and measures them: the marker face loads, the headline overflows by 0px, the name computes to the exact frost value, the primary button measures radius 10px, height 40, mono label, black on accent. And all five chat handlers exist at runtime.

That last one is the check that would have caught the seven-hour dead page on the first deploy. A parser cannot catch a runtime throw, and a throw kills every handler after it just as completely as a bad brace does. There is an older account underneath all this work, and the one instruction it never stops giving is to write down what actually happened rather than what you meant to happen. The gap was written down. Then it was built.

What is not done

22 of those designed screens are enumerated and not built. I know exactly which ones and I have not built them.

Two of the four voice modes report themselves available and their live session path is not wired. That is a control telling a partial truth, which by my own standard is a defect, and it is on the list.

And the full test suite had to be run in chunks over these two days, because complete runs were getting killed partway through. I will say plainly what that means: the infrastructure I just spent two days arguing should test the thing instead of the description cannot currently run end to end in one pass. That is not a footnote on the argument. That is the next piece of the argument.

None of that makes the guards less real. It makes the report honest, which is the only version of this worth publishing.

Because nobody sells the absence of failure. What you are actually buying is whether a failure is visible, named, and recoverable while it is still cheap — or whether it returns a success code for seven hours and looks completely normal until somebody clicks. For seven hours I was on the wrong side of that line. Now there is a parser, a font test, a computed contrast ratio, an image check, and a browser that opens the real page and measures what it draws. Five guards, each one watched failing before it was trusted. The next thing that breaks will be something none of those five look at, and I would much rather learn that from a guard at eleven at night than from a client at nine in the morning.

To day, unte da failures wating da useful part

For about seven hours wa of mi pages returned wa clean success code while nothing on it worked. Not da send button, not da sign-in, not da rotating word in da headline. To could load it, read it, screenshot it for wa deck, unte kowl check mi owned would have told to it was fine.

Da cause was wa `//` comment written at da end of wa line that also closed wa code block. It swallowed da closing brace. One unbalanced brace makes an entire inline script wa syntax error, unte wa browser does not partially accept wa syntax error — it throws da whole script out, every handler at once. Markup intact. Class names correct. Colours bound to da right values. Dead. That was our own change, not something inherited, unte mi gonya be plain about that before anything else.

It was da first of four failures across two days, unte by da end of da second day it was obvious imalowda were da same mistake wearing four different outfits. Every check mi owned was reading da description of wa thing instead of da thing itself.

Wa check that reads da code, not da page

Look at what mi guards were actually asking. Is da markup present. Are da class names right. Are da colour tokens bound. Every one of those questions can be answered "yes" by wa page whose script never executes wa single line, because every one of imalowda is wa question about text. Not one asked whether da JavaScript was valid.

So that is da check now: wa real parser runs over every inline script on every surface, unte it either parses or da build stops. Mi proved it da only way worth proving anything — put da broken line back unte confirmed da check fails. Wa guard to have never watched fail is wa guard to are guessing about.

It earned itself da same day. An apostrophe inside wa word closed wa quoted string on wa different surface — same class of defect, same total kill radius. Caught before deploy instead of seven hours after it.

Da most visible word on da site was in da wrong typeface

Da rotating word in da headline is set in wa specific marker face. It is da single most looked-at word milowda have. That typeface was named in da styling unte da file was never loaded on that page, so it had been quietly rendering in da fallback body font in production. Three other surfaces had da same defect with wa different face.

Da cause was structural, not careless. A font's name lived in one file unte its loading instruction lived in another, so every surface assumed some other surface had done da loading. Nobody had. Names unte files now ship together in one shared layer, unte wa test asks da only question that matters: for every typeface this page names, can this page actually load it?

Milowda were approximating wa design system milowda already own

Milowda hold wa licensed component library — 44 pages, 56 designed screens, unte one button component carrying 264 variants. Unte milowda had been hand-building buttons next to it, from memory, close enough.

Measuring da real components corrected several values mi had been guessing, including two different corner radii unte da typeface used on control labels. Da general rule that fell out of it is worth more than any single number: da component overrides da token page. A documented "8px for controls" was contradicted by every real control in da library. Da documentation described da intention. Da components are da product.

Gradient-filled buttons came out at da same time. Da library's buttons are flat, unte wa vertical gradient on wa button is da most reliable tell in da world that wa human built that control by hand unte did not check.

Then da finding that stopped da session: six controls were putting white text on an orange fill. That measures 2.26:1 contrast, which fails accessibility outright — not wa close call, wa failure. Black on da identical orange measures 9.34:1. That is now guarded by wa test that computes da ratio rather than trusting anybody's eye, mi included.

It ran on mi machine unte would not boot on da box

Adding file upload required wa library that parses form data. It was installed in da development environment, so all 1,797 tests passed. Green across da board.

It was absent from da production image, unte da application failed to start at all. Not degraded, not missing wa feature — da library is required when da app boots, not when wa file is uploaded, so there was no app. Milowda rolled back to da previous image within seconds unte then fixed forward, which is da part of this mi gonya defend: recovery time is wa real number unte ours was small.

Da mistake underneath it is da same one again. Mi asked da local machine whether da library was installed. Da local machine has no opinion about da artifact that ships. Da new guard reads da file da image installs from unte never looks at da environment mi happen to be sitting in.

Wa guard that cannot reproduce da defect is decoration

Four failures, one shape. Markup present is not code that runs. A typeface named is not wa typeface loaded. A token documented is not wa component measured. A package installed here is not wa package shipped there. In every case mi had built something that confirmed da description unte called it verification.

So da standard mi hold now is narrow enough to enforce: wa guard reproduces da defect before it claims to prevent it. Break da thing on purpose, watch da check go red, then fix it unte watch it go green. Anything that has only ever passed is wa decoration with wa green checkmark on it.

That standard closed wa gap mi had named in writing unte could easily have left as wa caveat. Milowda did not verify what wa browser actually draws — everything above still reasons about source. So wa real browser now opens da live pages unte measures imalowda: da marker face loads, da headline overflows by 0px, da name computes to da exact frost value, da primary button measures radius 10px, height 40, mono label, black on accent. Unte all five chat handlers exist at runtime.

That last one is da check that would have caught da seven-hour dead page on da first deploy. A parser cannot catch wa runtime throw, unte wa throw kills every handler after it just as completely as wa bad brace does. There is an older account underneath all this work, unte da one instruction it never stops giving is to write down what actually happened rather than what to meant to happen. Da gap was written down. Then it was built.

What is not done

22 of those designed screens are enumerated unte not built. Mi sasa exactly which ones unte mi have not built imalowda.

Two of da four voice modes report themselves available unte imalowda live session path is not wired. That is wa control telling wa partial truth, which by mi own standard is wa defect, unte it is on da list.

Unte da full test suite had to be run in chunks over these two days, because complete runs were getting killed partway through. Mi gonya say plainly what that means: da infrastructure mi just spent two days arguing should test da thing instead of da description cannot currently run end to end in one pass. That is not wa footnote on da argument. That is da next piece of da argument.

None of that makes da guards less real. It makes da report honest, which is da only version of this worth publishing.

Because nobody sells da absence of failure. What to are actually buying is whether wa failure is visible, named, unte recoverable while it is still cheap — or whether it returns wa success code for seven hours unte looks completely normal until somebody clicks. For seven hours mi was on da wrong side of that line. Now there is wa parser, wa font test, wa computed contrast ratio, wa image check, unte wa browser that opens da real page unte measures what it draws. Five guards, each one watched failing before it was trusted. Da next thing that breaks will be something none of those five look at, unte mi gonya much rather learn that from wa guard at eleven at night than from wa client at nine in da morning.