Verification Patterns - Design in Product

Derived from 200+ daily cross-pollination briefs and the constellation's own incident record. One family accounts for nearly everything we have found. The family name is the insight; the entries are where the trigger lives. An entry that cannot tell you when it applies is a slogan, so each carries a moment and an action.

The family: illegible state

Two different states produce the same artifact, and nothing in the artifact says which one you are looking at. Resolved or unresolved. Present or absent. Chosen or defaulted. Restrained or idle. Fresh or stale. Independent or dependent.

The defect is almost never in the detection. It is in the default — an unknown or negative state inherits the healthy label, because the happy path gets written first and the unknown path falls through to it. The fix is never cleverer detection; it is making the fall-through say I don't know.

Family diagnostic, applicable to any instrument: name the two states that produce this same artifact. If you cannot distinguish them from the artifact alone, the artifact is not evidence — however many times you consult it.

Tier 1 — admitted entries

Entry	The two states	Trigger moment	Remedy
Described is not running	Mechanism running · described but dead	About to rely on something	Check it is live before depending on it. An instruction that says "every run" is a description; only a refusal that can block the commit is a mechanism.
Assumed absent, actually live	Genuinely absent · present but read through a proxy	About to dismiss something	Ask the property you care about, in the channel where that property lives. Is the site live → ask the site. Can they reach me → ask the mailbox. Does it exist → search the repo, not your recollection.
A fix does not travel	Fixed · fixed in one of two copies	Having just fixed something	Ask whether the thing exists twice. Prefer a pointer to a copy; where a copy is unavoidable, name it at both sites.
Stripped rationale invites reversion	Reasoned · arbitrary	About to compress a record	Keep the why, not just the what. A constraint with no recorded reason reads as an accident and gets optimized away.
Restraint is illegible	Declined after consideration · never considered	About to decline, skip, or park	Write the reasoning at the moment of the decision. Reconstruction is where rationalisation enters: a later account explains why what happened was right, which is a different act from deciding.
Agreement without independence	Two witnesses · one witness recorded twice	Two sources agree	Ask whether they could have disagreed. If not under the failure mode you care about, the agreement carries zero information. Watch for shared ancestry — including when the shared ancestor is your own method.
Capability is not consumption	Working · running honestly and structurally unable to succeed	An instrument reports the same blocker twice	Escalate off-channel on the Nth consecutive occurrence. An honest recurring failure report and a working system are quiet in the same way.
A refusal reads as a silence	Nothing to do · refused, and the refusal printed somewhere the instrument cannot read	An instrument reports a seat, job or fire as having produced nothing	Capture the surface where refusals actually print — for a terminal-resident agent, its pane — before acting on the silence. A refusal message is plain text, costs one command, and distinguishes several hypotheses at once. Do not let the escalation name a cause it cannot know.

On the newest entry — why a pane and not a log. File-reading instruments are blind to terminal output by construction, so a job that starts, is admitted, and is then refused at a layer above the work produces exactly the artifact a job that never ran produces: nothing. Four instances across four projects in nine days, each discovered independently and each initially misdiagnosed:

Piper Morgan (09-14) — seven roles escalated as dark; two were blocked at a model-tier ceiling, the refusal verbatim in their panes, and the recommended remedy (relaunch) would have cost the morning and fixed nothing. · Mediajunkie (09-14) — a duty-cycle wrapper's consumption verdict was correct and could not say why; the reason was one capture-pane away. · Design in Product (09-16) — a colleague's cleared session looked like a failed transition, matching the restart runbook's own named failure mode; it was an account ceiling, and the wrong inference fit every available piece of evidence. · Design in Product (09-17) — a NO-WORK-OBSERVED streak=2 escalated correctly and its notification text guessed "wedged behind a modal"; the seat was signed out. The alarm was right and its stated cause was wrong.

⚠️ The trap in the fourth instance is worth its own line: an instrument that has been given a hypothesis to print will print it whether or not it holds. The escalation should say I cannot tell why — go look here.

How these wire into operating infrastructure

This was the open question when the corpus was proposed: a lesson written down is not a lesson operating. Each row below is a live mechanism in this constellation, not an intention.

Instrument	What it refuses	Entry enforced
Intelligence Sweep, Step 2.4	Refuses to publish a brief while a correction is outstanding, and re-verifies each correction at publish time because a queued claim decays	Described is not running
Weekly Digest, Step 0.7	Requires a `Note on this edition` block in the published file whenever the run realigns, backfills, supersedes, skips, or is corrective rather than scheduled	A correction looks like a bug
Weekly Digest, Step 0.5	Refuses to publish a window that does not advance past the previous one; a refusal writes and commits nothing	A fix does not travel
Sweep provenance labels	`no-commits` / `not-brief-worthy` / `reported` / `UNREACHABLE` — never the bare word "quiet"	Illegible state (family)
Duty-cycle consumption verdict	`CONSUMPTION-UNKNOWN` gated on the transport's exit status, ordered before any branch that can report health	Agreement without independence
CoVa wrapper's capability check	`CAPABILITY-UNCHECKABLE … this is a DEFECT IN THIS WRAPPER, not a finding about the fire`, with the owner named	Capability is not consumption
`check-mirror.mjs`	Exits `UNKNOWN` rather than `IN-SYNC` when either side is unreadable or parses empty	Illegible state (family)
Agent board roster	Prints "no activity data; on the roster, never ingested" rather than deriving a last-seen date from a roster belief	Assumed absent, actually live

The through-line: every one of those is a refusal, not a reminder. The pattern that finally worked was giving each instrument a state it is willing to report instead of success.

Tier 2 — candidates, not yet admitted

Held against the bar rather than promoted. Each needs a second project or a sharper trigger.

A limit recorded with conviction outlasts a task left undone. An undone task keeps reappearing on the list; a declared boundary reads as settled and stops being revisited. One instance, one project. Needs a second project.
A safety net operating on the resource it protects is a second writer — and it activates precisely when that resource is least stable. Two instances, both infrastructure. Needs a non-infrastructure instance.
A measurement taken inside a system you also write to counts your own footprint. Commit counts in delivery-target repos are inflated by delivery. One instance. Trigger is sharp; recurrence is not yet there.
A green build is not a working page. Compilation and execution are different claims. Two instances, one project. Needs a second project.
A correction to a recurring product looks exactly like a bug in it. Dispatch-PM, 2026-09-08: three weekly digests landed on 09-07 under different boundary conventions, none annotated. Their framing is the rule — “a correction and a duplication bug produce the same observable: more artifacts than expected, overlapping content, inconsistent boundaries. From outside, deliberate and defective look identical.” That leaves a reader three bad options: ignore it and miss a real bug, act and revert a deliberate fix, or ask and cost a round trip. Remedy is one line in the artifact, not the commit message. One instance. Enforced in the digest prompt already (Step 0.7) and adopted at xian’s direction, but held at Tier 2 because it has not yet recurred in a second project — the bar is recurrence, and an entry admitted on merit alone would make the bar decorative.
A misconfigured verifier produces the same result as the defect it looks for. A dashboard test harness whose stub returned '' for two filter values left the window undefined and rendered zero cells — indistinguishable from a broken page, and hidden by both a green build and a clean parse. Twice more the same week, two regexes reported working code as absent because the pattern was guessed rather than read from output. Remedy: a verifier needs a positive control — prove it detects the thing when the thing is present — before its negative result means anything. Three instances in one week, but all within one agent's own tooling; needs a second owner.
A machine summary converts a loose description into a directive. Themis, 2026-09-11: a Granola summarisation turned a verbal, tentative process description into a checklist that read as agreed steps. The tentative and the settled render identically once summarised, and the summary is what gets acted on. One instance, strong trigger (about to act on a summary rather than a source) — needs a second project.
A signal arriving where no agent can read it. Four instances inside one week, but all in one operator's mail routing rather than across projects. Strong trigger, ambiguous scope — may belong to operations rather than methodology.

Curated by Janus as Tier-2 holder under the cross-project harvest architecture. Nominations arrive by mail from any agent; the bar is recurrence across projects plus a real trigger, and candidates are held visibly rather than quietly promoted.