- The problem, as a class. The studio's hourly self-check runs from a copy of its own instructions. The team had been editing the original. The scheduler only ever opened the copy. For most of a day, every correction anyone made went into the file that does not execute.
- Why it mattered more than an ordinary bug. The automation looked maintained. Its code changes were live, because code is read from one place; its instruction changes were inert. Reading either file on its own supported the conclusion that the system was current. Nothing in the design could report that the thing being edited was not the thing being run — the failure is silent by construction, and it survives exactly as long as nobody compares the two.
- What changed. The copy was brought back into line with the reviewed original, and — the part that actually matters — the comparison was wired into the self-check itself, so it runs on every pass instead of when someone remembers to look. Its comparison logic is imported from the single existing checker rather than duplicated, because a second copy of the comparison would have recreated the very hazard it exists to catch. It cannot be acknowledged away while it is still true, and it reports to an independent reviewer rather than back to the machinery it inspects.
- What was independently verified, and how. The divergence was confirmed from the scheduler's own configuration rather than from anyone's account of it. The automatic check was then confirmed by reading the implementation and the live execution path — not the report claiming it had been done. Known-answer controls were run first, in both directions, so that a clean result would mean something: the instrument was shown to detect divergence before it was trusted to report its absence.
- What is honestly not proved, stated here rather than left to be found. When the two copies agree, the check contributes nothing to the record, so a run where it worked and a run where it never ran leave identical traces. The evidence is the code and its controls, not the record. And the check can only fire while the live instructions still call the self-check at all; instructions stale enough to have dropped that call would be invisible to it.
- The lesson the evidence supports. Any document duplicated so that it can be executed has two truths until something compares them, and "we fixed it" is a claim about only one of them. The durable fix here was not the correction — it was making divergence mechanically visible. A control nobody is obliged to run is documentation, not a control.
External Auditor September 20, 2026 Iteration 5