What it does, and what it refuses to do.

Two mistakes can cancel. Two cases short of one product and two cases over on another is a receipt with two wrong lines and a money difference of exactly zero, and a check that compares two money totals passes it. The comparison counts lines and quantities before it looks at money, so a short, an over and a wrong unit price are three separate findings instead of one silence.

Pressing a button twice used to conjure inventory. The floor of the ledger is now enforced in the database, so the second press is refused there rather than guarded for in each screen that might write.

A sign-off used to survive the thing it signed off. Reopening a built order to change it left the previous check in place, so the paperwork certified a pallet that no longer existed. The signature is now bound to the build it was given for, and reopening voids it.

"Being built" and "on tomorrow's truck" are different days, and one dashboard number used to cover both while its link opened only one of them. They are two numbers now, because an order sitting on a truck overnight is a state the office needs to see as itself.

Deriving the unit price by dividing the case price was measured wrong and dropped: for many items the cheapest way to buy is a ten-pack, not a single. Every purchase unit carries its own price.

A credit reduces what is owed, not what has been paid. Writing it as a payment would have let a store earn credit terms by sending goods back, because the rule that grants terms reads payments as evidence.

The batch total is typed, not computed. A computed total agrees with itself and therefore checks nothing. The database refuses to confirm a batch whose ticked payments do not add up to the figure on the statement, and it refuses at commit — so two tabs cannot each read a set that balances and commit a pair that does not.

There is no default credit limit anywhere in the code, and a gate proves it — including the spellings that are easy to miss, like a local variable initialised to a number inside the very function the rule lives in. Blank means no ceiling, which is what the system did before anybody typed one.

Blacklisted has to win, and it did not. An order already picked passed the credit hold because the blacklist was only checked where orders are created, and an existing order never goes through that door again. It is refused at the loading bay now, and that refusal was watched happening.

If the totals do not agree, the hand-off is refused. Eight months of reconciliations closed at a difference of exactly 0.00 — not because somebody was careful, but because there is no path that closes a month while the difference is anything else.

A push that dies halfway used to mark documents sent against a file it had thrown away. The log row is written before the send, a crash leaves the document pending rather than sent, and the batch that went out is kept — so "it was sent" can be checked by opening the file it was sent in.

The rule is the file, not a list of fields. A fingerprint repaired by naming the three fields somebody had forgotten still could not see two more; it now covers everything the export writes, and the check renders the file twice and fails if the bytes move while the fingerprint does not.

Enforced in the database, not in a form. Two transactions could otherwise walk through one check each and commit a state where both were on at once; the constraint is deferred to commit, and it was measured refusing exactly that.

A gate reads every page and every server action and refuses the build when one guards nothing, or guards the wrong capability. It has been made to go red on purpose — moving a guard below the write it protects, or removing the negation, is caught.

Handing out the pools was the easy half. The hard half was that six decisions still asked for the one role somebody was hired into — including whether they clock in, which would have meant a rep who also works the warehouse never having a shift recorded.

An audit line is only worth the write underneath it. A conditional update that matched no rows still came back successful — nothing changed, nobody was told, and the audit line written on top of it would have recorded a decision that never happened. The write now reports how many rows it touched, and zero is a failure rather than a success with nothing in it.

"Stops changing" is a database rule, not a disabled button — including the case where an order number would pass ninety-nine thousand, which is refused in the same statement that would have issued it.

An import with no size limit took away the screen you would need to undo it. Measured through the form: 20,001 rows accepted in 215 seconds, then every unmatched row rendered with a dropdown of the whole queue — 820,000 options on one page, which no browser finishes. The rows stay until somebody resolves them on the screen they can no longer open. The same file is now refused in 0.6 seconds with nothing written, and the exception list is bounded.

Sending twice is prevented by a unique constraint on the parcel, not by a flag somebody has to remember to check. The same parcel attached four different ways produces one email.

A carrier bill was being joined to whether the customer had been invoiced, so three real bills worth six thousand dollars were missing from the export while the screen showed zero owing.

A table this size is where a quiet defect lives. The database layer returns at most a thousand rows and sets no error, so asking for all 40,979 postcodes comes back as 1,000 rows and a clean result — indistinguishable from a complete answer, and it never raises anything. A check now reads every query against a table that grows and refuses the build when one is unpaged. It was written after that exact read was measured returning 1,000 of 40,979.

Stores were updating and coming back on the old version. The installer was remembering the first folder it had ever been given. A release now cannot be uploaded without a record of that file having been installed over the previous version and the version re-read afterwards — and the record is tied to the installer's hash, so rebuilding invalidates it.

One item has four different names across the label, the wall chart and the workbook. The catalogue was set to match the printed label — the one already in a customer's hand — and the test comparing it to the chart was left red on purpose, with the reason written next to it. It turns green when the client re-exports the chart. That is the red one in the count above.

The whole upload path was proved without touching the real account: the server taken down mid-send, the browser put offline, and the case where the reply is lost after the row was already written — where naive code sends it twice. Sixty records in one batch, and the record count was read from the endpoint rather than from the screen that reports success.

Which tenant a request belongs to used to be inferred from the hostname it arrived on, which means an unfamiliar hostname had to be guessed about. The application's own hosts are a declared list now, and a name that is not on it resolves to no tenant at all. Found by an adversarial review before it shipped.

The tool that creates those tenants could delete a live customer's book: its guard passed on "belongs to the probe organisation", and the rows it was asked about were selected by that same condition, so the guard could never refuse. An adversarial review demonstrated it on a stand-in and it is now refused three different ways.

The button carries the screen, the tenant, the login and the browser with no typing. The paste box cannot know those, and leaves them as "not known" in words rather than guessing — the guess is what makes a ticket unusable six weeks later.

Marking a ticket as handled automatically requires a recorded reason, so the figure cannot be improved by relabelling. Back-dating a ticket out of the window was possible and is now clamped.

Seven themes only cost what one costs while no component can tell which theme it is in. A screen that names a colour directly is wrong in six of them and right in one — and it type-checks, lints, builds and renders, so nothing would ever say so. One check refuses a palette colour named anywhere in the source; a second opens each screen in a browser and asks what it was actually painted in, theme by theme, because the source and the screen have disagreed here before.

A tenant whose ledger is this portal has nowhere to push invoices out to, so that capability is withheld from it rather than greyed out in a menu: pushing anyway would record the same invoice twice. Permission is answered by one function that is handed the roles, the organisation kind and the switch together, because a check that reads only the role stays right until the day a switch moves.

Matching an upload against what the customer already has read only the first 1,000 records, and a record the list does not contain is not an error — it is a new one. A catalogue of 1,992 would therefore have had 992 duplicates created by re-importing the same file, with no failure anywhere. Reads are paged now and a check re-measures it, because this was invisible to five reviews.

It shipped looking correct and was not. The panel's open class was applied, its transform was set, and it still did not move — a transform transition does not run in the same frame an element stops being hidden. Nothing was wrong in the markup and the console was clean, so the only thing that showed it was opening the real page and seeing a nineteen-pixel sliver. The repair was one line; finding it was not available from any test we had.

A rename is where a shop quietly loses its traffic. The handle — the part of the address every existing link and every search result depends on — is not the title, and rewriting titles while leaving handles alone is a choice somebody has to make deliberately. Nothing redirected, nothing 404'd, and the only visible change was on the shelf.