Entry 010 — The review gate counted a rejection as approval, and an example of the format as a real review

Theory — the hypothesis held before the instruments answered

“Changes to the build system need the other machine’s review. The check reads who reviewed and refuses until one exists.”

Date — built, broken and cured 2026-09-07, across about four hours.

Symptom

None visible. The check reported the fence satisfied on changes nobody had read.

Each of the three faults was found the same way: by pointing the check at a real thing rather than at a test case. Not one was caught by its own suite, which was green throughout.

Diagnosis

Both machines sign in to the code host as the same person. An approval therefore cannot say which machine approved — so the check read a signature line in the message body instead.

One. A message was posted telling the other machine what signature line to use, with the line quoted as an example inside a code block, and signed by the author. The check read the example and recorded a review by a machine that had not looked at anything:

reviews by seat   macbook · mini
other-seat        macbook          <- nobody had reviewed

Two. The author’s own signature was read from the wrong end of the commit — subject after body — so the signature was never in the position that counts. Every change reported an unsigned author.

Three, and it is the composition that matters. The check subtracted the author from the list of reviewers. With the author unknown, subtracting nothing returned everyone — including the author’s own signature. Two faults cancelled into a pass.

Four, found last and worst. A review that requested changes was counted as satisfying the requirement. The single clearest way of saying do not merge this was the thing that unlocked the merge. It was found while about to post exactly such a review, by checking first what the check would do with it.

Cure

Signatures are read the way the version-control tool reads them, not by searching text — a line inside a code block is not a signature to it. The author’s own is assembled in the right order, and an unsigned author is a refusal rather than an empty subtraction. The most recent verdict per machine decides: changes-requested blocks; a later approval releases it.

Measured

quoted example in a code block          not a review        refused
commits with no signature               refused, by name
changes requested                       refused
changes requested, then approved        allowed — the later one wins
approved, then changes requested        refused — the later one wins

Permanent

Four new tests, one per fault. Every review fixture in the old suite was an approval. It tested a review exists and no review exists, and never the third case: a review that exists and says no.

The wider lesson is about where the faults came from. Every one was in code written, tested and shipped with a green suite. A suite encodes what its author intended, so it cannot see the place where the intention was the fault.

The two of them were found by the other machine reading the change. The other two were found by using the tool on something real.

Sources

Estate record, private: technical-debt ledger TD-MM-171 and TD-MM-173, both opened and closed 2026-09-07.

The clearest way to say no was the thing that said yes.