---
name: two-arm-rig-confounds-the-valve-with-arm-order
description: A control arm + an injected arm differ in TWO ways — the valve and being second — so a rig that can only witness its FIRST case reads exactly like the defect; add a second CLEAN arm to hold order still.
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 0c708443-b433-4d8d-b2bf-68361ebc4fbf
  modified: 2026-08-21T09:32:03.341Z
---

#201 instrument lane, 2026-08-21. The obvious fault-injection rig is two arms: control (valve
off) to prove non-vacuity, then the arm under test (valve on). It reproduced the defect cleanly
— and it was not yet evidence, because the two arms differ in **two** ways at once: the valve,
and being the second arm in the process. A rig that could only ever witness its FIRST reap —
one leaked env var, one broker that does not survive a sibling, one per-process latch — would
produce a byte-identical result with no defect present at all.

The fix is one more arm: run a **second CLEAN arm** between the control and the injected one.
It holds order still, so the only thing separating arm 2 from arm 3 is the valve itself.
Measured cost: 349ms. Measured payoff: arm 2 saw `Exit(Some(1))` in 349ms while arm 3 saw
nothing in 20.4s, which turns "the valve caused this" from an assumption into a comparison.
doyle ruled the design "exactly right" and made keeping all three arms part of the fix ruling.

**Why:** non-vacuity answers "can this panel EVER see the thing" — it does not answer "can it
see the thing HERE, at this position, in this process". Those are different questions and the
first one silently stands in for the second whenever the injected arm is also the last arm.
Sibling in shape to [[non-vacuity-check-can-fail-for-the-defects-reason]] and
[[make-a-new-rig-red-on-purpose]]: the control proves the instrument, the ORDER control proves
the comparison.

**How to apply:** whenever a rig's arms run sequentially in one process and one of them carries
the injection, ask what ELSE differs between the injected arm and its control. Position almost
always does. Add a same-treatment arm in the injected arm's POSITION and assert on it as a
panel-broken message, not as a finding. Then report per-arm DURATIONS and assert the bound —
the burn is what separates an absent result from a slow one, and after the fix it must VANISH
rather than shrink (20.4s → 355ms here, matching the clean arms). Related:
[[a-bound-burn-duration-is-a-discriminator]], [[blank-diagnostic-panel-is-not-a-silent-product]].