---
name: render-not-read-pipefail
description: "Verify text fixes against RENDERED output of a binary PROVEN rebuilt; never gate a lane on `cmd | tail` (tail's exit masks the failure) — two false-green near-misses in one day"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: b34cabf6-2098-41af-b492-dc8e22aa8675
  modified: 2026-08-02T03:58:38.108Z
---

Two separable halves, both required — one alone still false-greens:

1. **Pipefail-or-count-check** catches the build/test that did not happen: `cargo test | tail -2` gates on TAIL's exit — a failed rebuild (todlando: libsqlite3-sys in-place corruption) and a wrong-target test lane (mine, `--test fork_surface_int` vs `_e2e`) both reported exit 0 through the pipe. Use `set -o pipefail` in lane chains, or read pass-COUNTS from output, never chain markers.
   **Same trap when MEASURING an exit code, not just gating one** (deployah, DOORBELL intake 2026-08-02): `$B knock approve someone 2>&1 | head -5; echo "exit=$?"` printed `exit=0` and I read the refusal as dishonest — `$?` was `head`'s. Unpiped (`out=$(cmd 2>&1); rc=$?`) it is 1. Reading an exit code THROUGH a pipe fabricates a defect as easily as it hides one; capture to a var, then measure.
2. **Render-not-read** catches the artifact that did not change: a string-literal fix that looks correct in source can still print wrong (continuation backslashes lost by edit tooling; stale binary). Checking a literal by reading the literal = checking a test by reading the test. Print the actual rendered line from a binary proven rebuilt.

**Why:** todlando's near-miss needed BOTH failures — masked exit produced a stale binary, and only the render exposed it. An honest-exit-code lane that verifies text by reading source ships the fix "done" with the old sentence live.

**How to apply:** every gate lane chain gets pipefail; every operator-facing text fix gets verified by rendering; the mechanized class check (rendered-help 3+-space-run sweep in xtask public-help gate) is scoped in releases#74.

**Third rung — execute-not-render (DOORBELL W2 leg 8, todlando):** when the rendered text is a PRESCRIBED COMMAND (a remedy line the operator will paste), rendering isn't enough — parse the rendered command back through the CLI that would run it. That round-trip caught a remedy composing `--surfaces ` with no value on the every-surface sentinel (blind join of the empty encoding): read right, rendered right, refused the instant pasted. Reading < rendering < executing; match the assertion rung to what the operator will do with the text.

Related: [[instrument-soundness-guards]], [[spt-verification-gates]].