---
name: a-detector-must-pass-a-control-built-from-what-motivated-it
description: My census keyed on wording found 53 sites and missed the very site it was filed from — a detector's positive control must be the cases that motivated it
metadata:
  type: feedback
---

2026-09-10, discharging IR-95's owed census of blind polling budgets. My first detector keyed on
expiry VOCABULARY — `never`, `timed out`, `did not appear` — joined to a panic/assert. It found 53
sites and looked plausible.

**It missed `contract_e2e.rs:393` entirely — the exact site IR-95 was filed from** — because that
panic's message is a CONTENT sentence ("the brain pulse must ingest the commune into the live
context tier"). IR-95's own cost #1 *is* that such a panic reads as a content claim. So the detector
was structurally blind to precisely the class the entry exists to describe, and it would have
reported 53 as the answer.

Caught only because I ran a positive control: **both originating sites must appear in the output.**
One did (`sync.rs:109`), one did not. The replacement anchors on loop SHAPE — `for _ in 0..N`,
`while Instant::now() < deadline`, bare `loop {` — gated on "sleeps" and "can fail", which is
wording-independent. It finds 323 sites and both controls pass.

**Why:** a detector is written from the examples you already have, so it silently inherits whatever
those examples share at the surface — here, a word. The motivating cases are therefore the *weakest*
possible test of it and the *only* ones you are guaranteed to be able to check. If it cannot find
them, the count it produces is a measurement of the detector, not the population.

**How to apply:** before reporting any census, grep its own output for the cases that motivated the
census, by name. A detector that fails that control is discarded, not tuned. Keep the discarded one
in the preserved dir with a note saying what it missed, so nobody re-runs the cheap version and
reports its number — I kept the 53-site detector for exactly that reason.

**Second-order, same session:** even the replacement was overclaimed. I called 304/323 a FLOOR;
hertz and todlando pointed out that spot-checking only the CLOCK bucket excludes nothing about
false BLINDs, and that population coverage (do these four shapes catch every poll?) was never
validated. Passing your control licenses the DETECTION, not a bound on the population. See
[[an-identical-treatment-controls-the-input-not-the-effect]] — same shape: the thing measured is
not the thing claimed.