Follow-up to #9963, whose third acceptance criterion is not yet met.
What is missing
#9967 fixed the defect — an Orb published totals.handled: 0 beside reviewParity.verdicts: 2123 — and its tests cover the new aggregate read well. But the cross-surface invariant itself is only described, in comments:
// reviewParity.verdicts = 2123 (read from decision_records, ungated)
No test builds both halves of the payload and asserts they agree. #9963 asked for exactly that:
A regression test pins that totals.handled and reviewParity.verdicts cannot disagree by orders of magnitude on the same payload — the invariant the verifier checks.
Why the gap matters specifically here
This is the one defect class per-surface testing structurally cannot catch, and the verifier's own source says so:
the two are computed by different code over the same ledger, which is the divergence no amount of per-surface testing catches, because each surface is individually self-consistent.
Both surfaces were individually correct and individually tested when production published the contradiction. getPublicStats and loadReviewParityRollups remain separate reads with separate gating, so the next change to either can reintroduce the disagreement with every existing test still green.
Acceptance
- A test builds
getPublicStats and loadReviewParityRollups over the SAME seeded ledger and asserts they agree.
- The assertion runs the verifier's own
checkStatsParity rather than restating its rule, so the test cannot drift from the tool that decides whether production is publishing a contradiction.
- The failing direction is covered too — a zeroed
handled beneath a populated rollup must fail — so the passing assertion is not vacuous.
Follow-up to #9963, whose third acceptance criterion is not yet met.
What is missing
#9967 fixed the defect — an Orb published
totals.handled: 0besidereviewParity.verdicts: 2123— and its tests cover the new aggregate read well. But the cross-surface invariant itself is only described, in comments:No test builds both halves of the payload and asserts they agree. #9963 asked for exactly that:
Why the gap matters specifically here
This is the one defect class per-surface testing structurally cannot catch, and the verifier's own source says so:
Both surfaces were individually correct and individually tested when production published the contradiction.
getPublicStatsandloadReviewParityRollupsremain separate reads with separate gating, so the next change to either can reintroduce the disagreement with every existing test still green.Acceptance
getPublicStatsandloadReviewParityRollupsover the SAME seeded ledger and asserts they agree.checkStatsParityrather than restating its rule, so the test cannot drift from the tool that decides whether production is publishing a contradiction.handledbeneath a populated rollup must fail — so the passing assertion is not vacuous.