Each of the fifty tests could only fail on a narrow set of things. The Galois-field tests compare arithmetic against values printed in the standard [13]. The Reed-Solomon test compares codewords byte for byte against the standard's own worked example, "01234567" at version 1, level M, from Annex I [14]. Those are genuine external oracles, and they passed, because the arithmetic was right. The matrix test is an invariant on counts: total modules minus fixed-pattern modules equals the data-bit count, for every version [15]. Counts are indifferent to placement. Move fifteen bits out of a column and into a row and the invariant still holds.
The round trip is the test most engineers would have trusted: decode(encode(text)) === text, across every text, every error level, every mask [17]. It could not fail here. Its decoder walks the data path, and format information is not on the data path [19][21]. The payload round-tripped fine, but the bug was never in the payload [21].
The defect is one transposed subscript, modules[8][i] where the specification wants modules[i][8], repeated in both redundant copies [20]. Those fifteen bits carry the mask, the error level and ten bits of BCH check, and a scanner reads them before it reads anything else [19]. There was a test against the standard's BCH tables [16], but a table of bit strings tells you the bits are correct; where they were written is a separate assertion, and nobody made it.
A phone shares no ancestry with the code under test. Different decoder, different author, different reading of the same document, and it enforces precisely the modules the test-file decoder skipped. It gave a verdict on day three, the first time the author tried it [4]. He writes that a tool one command away would have found both bugs on the first afternoon, and that he would not run it because running it felt like cheating [5]. First afternoon to day three is about two days spent building on an encoder no scanner could read [23].
That is the decision worth arguing with, because the rule as described is a check on the dependency manifest at submission [1]. An npm install in a scratch directory, used once to decode a PNG, never reaches that manifest. The deliverable stayed pure by the letter of the rule, and the verification cost showed up anyway.
The encoder side, for what it is worth, is good work. Reed-Solomon over GF(2^8) is two lookup tables and polynomial division, and none of the specification needs anything outside the standard library [11]. The single exception is DEFLATE, taken from node:zlib and wrapped in a PNG written by hand, signature and chunks and CRCs [12]. Reading the library he was replacing, the author found that npm install qrcode writes 29 packages and 2.4 MB [7], of which three do the work [8] and twenty-six are yargs and its tree, present so the library can also be a command-line program [9]. That is roughly 90 percent of the installed package count serving an interface a require() call never touches [10]. It is a widely used library at 24 million downloads a week [6]; it just puts an internationalized argument parser on your server as a matter of course [9].
The lesson transfers only under one condition. Your artefact needs a reader you did not write. QR codes have billions of them. Where the only implementation of your format is yours, there is no free phone camera, and you are back to worked examples from the spec and invariants that cannot see placement [14][15].
