What this looks like in code

1. An illegal state, and its removal

A conventional time entry. The states are implied by which fields are set:

type TimeEntry = {
  id: string
  active: boolean
  voidedAt: string | null
  supersededBy: string[] | null
  splitFrom: string | null
}

Four fields, sixteen combinations, three of which mean anything. Nothing prevents { active: true, voidedAt: "...", supersededBy: ["..."] }, and every function reading this record has to decide what that would mean.

The same domain with the state named, as one of the two independent builds modelled it:

type TimeEntry =
  | Recorded   of Common
  | Voided     of Common * voidedAt: Instant
  | Superseded of Common * supersededBy: EntryId list

supersededBy now type-exists only where it means something. The illegal combination is not rejected at runtime; it cannot be written down.

Rendered here in a neutral syntax. The build this is drawn from is TypeScript and uses a discriminated union keyed on status; the other independent build of the same requirements chose the flat shape above and prevented the combination with construction discipline plus a load-time validator instead. Both are covered on the state page.

2. A transition, end to end

Applied to splitting a time entry, as the measured build implements it:

Current state       Recorded
Requested action    split at minute 43
Capability check    is split legal from Recorded?         yes
                    (same predicate the transition uses as a precondition)
Evidence check      is minute 43 strictly inside the interval?
Policy check        is the resulting duration above the minimum?
                    is the referenced project still active?
                    is the referenced person still active?
Legal transition    Recorded -> Superseded
New state           the original entry, Superseded, with supersededBy set
                    two new entries, each Recorded
Obligations         the day's attestation, if any, is no longer current
Effects             one write to the record store, returned as data

Each check refuses with a named reason. A split at an interval endpoint is refused with a specific diagnostic — and both independent builds produced semantically identical refusals for that case, under different names, confirmed by running both systems.

3. What constrained agent action means

The difference is not politeness. It is the size of the space the agent is choosing from.

The measured build reports capabilities per entry and per project, computed from the same predicates the transitions enforce. An agent that asks the domain what is legal cannot construct an illegal request, because the illegal request is not in the answer.

4. Finding the change surface without reading the codebase

A request arrives: the minimum splittable duration changes. Under Ordo the route is deterministic — repository map to semantic area, semantic area to authority, authority to the single predicate that decides it. The predicate is named, it is called by the transition as a precondition and by the capability projection as a report, and changing it changes both.

The measured alternative is what happens without that route. In the baseline condition of the paired trial, finding the sites for one change took 38 to 14Search operations repository search operations, against 14 in the hardened condition.

One paired trial, two agents whose investigation strategies differed. Unique files inspected did not drop the way search operations did. Classified provisional (CL-005).

5. A boundary defect, reproduced deliberately

A new case is added to a closed set of observation kinds. The domain type gains a case, and the compiler names the sites that must handle it — eight of twelve. The other four are outside its reach:

domain     type ObservedValue = ... | VitalSignObserved of ...   compiler names it
database   CHECK (kind IN ('lab','imaging','procedure'))        silence
wire       "kind": "vital_sign"                                  silence
fixtures   sampleFor : ObservedValue -> Sample                   silence until enumerated

Each silent site is a copy of the same fact with nothing checking that the copies agree. Experiment 1 measured one such fact duplicated four times and another twice. The hardening built in Experiment 2 closed each of these individually — a constraint-agreement test for the first, a single-source discriminator for the second, a fixture forced to a compile error for the fourth.

6. The semantic no-op

The failure this programme has never managed to catch mechanically, in any trial.

let fanOut observation =
    match observation with
    | Lab value       -> writeLab value
    | Imaging value   -> writeImaging value
    | VitalSign _     -> ()        // the arm exists. it does nothing.

The compiler is satisfied: the arm is present, exhaustiveness holds. The architecture check passes. The contract tests pass. The candidate is durably recorded as accepted, and the fact it represents is never written anywhere retrievable.

Experiment 1 removed such an arm on purpose: 0 of 3Checks that objected to a deliberately removed boundary arm objected. Experiment 2 built five mechanisms and re-created the shape against them: 0 of 4Mechanical checks that caught a present-but-inert boundary arm caught it. Experiment 3 saw the identical outcome in both of its conditions. In every case, only a live integration test found it.

This is the single strongest argument on this site for heterogeneous verification, and it is an argument made entirely out of things that did not work.

7. A declared outcome that could not happen

A reconciliation result declaring four outcomes, of which the code could construct three:

type ReconciliationOutcome =
    | Applied
    | NotApplied
    | StillUnknown
    | Conflict        // declared. no code path constructs it.

Every caller handles four cases. One of them will never arrive, and every reader downstream believes the conflict case is covered.

A 90-test suite did not find this. An adversarial self-review including three mutation tests did not find this. A fresh agent reviewing the finished build found it in one pass, along with four other things, of which 0 of 5Independent-verification findings the builder's own checks had already caught were already covered.

8. What the effort experiment found, by language

The same requirement set built three ways, with every mistake classified by what caught it:

Read naively, the JavaScript rebuild wins on raw count. The log that produced these numbers refuses that reading and explains why: that trial had already built the identical requirement set once, and the advantage shows up precisely in the two places where a failure mode from the earlier trial was consciously checked for and avoided.

The number the log considers important is not the total. It is that zero of the JavaScript trial's mistakes, real or narrowly avoided, were ever caught by the language itself — where the C# rebuild's compiler caught four. What differs is not how many mistakes happen. It is which ones require a person to notice.