Five cheap controls caught all nine broken checks in a single working day

The positive control is two lines of shell, and it fails closed. `hits=$(grep -c "$TARGET" known_positive.txt)` counts matches in a file picked because it must contain the target, and `[ "$hits" -ge 1 ] || die "positive control failed: this search cannot see its own target"` aborts the run when that count is zero ^[4]. The fixture chosen on the day was the tool's own source file, which looked safe right up until it turned out the file never writes the tool's name ^[3]. The author wrote that "a zero is only evidence if the same instrument has just shown you a one" ^[5].

The negative control inverts it: search for something that must not match, and demand zero ^[6]. A hand-picked placeholder in the `zzz-nope` style came back 39, because other documents in the same corpus had reached for the same obviously absent string for the same reason ^[6]. The replacement generates the sentinel at run time out of `/dev/urandom` ^[7]. "A string you invented a second ago cannot already be in anyone's file," the author wrote ^[8]. Randomness only helps where the corpus is text. When the check was a pattern match over running processes, the negative control used a process name that should not exist and returned 2, because the checking command's own command line contained the pattern ^[9].

Three of the nine defects surfaced only when the same quantity was counted two unrelated ways and the numbers disagreed ^[10]. `grep -c` counts lines, `grep -o` piped to `wc -l` counts occurrences, and listing files counts files ^[11]. One count of the word "table" ran high because the pattern matched inside "uncomfortable" and "accountable", which word boundaries fixed ^[12]. A literal search for `5/5` found nothing, because the document had written it as `*5/5*` ^[13]. The author wrote that when two instruments measure the same thing and disagree, that disagreement is the most valuable output of the day ^[21].

Cheaper still is the relationship a measurement cannot violate. A uniqueness check reported 10 unique keys in a table of 7 rows, and the pattern was also matching bold numbers outside the table ^[14]. If a row holds at most one key, at least three of those ten matches came from somewhere else ^[22]. The check is one line, `assert unique_keys <= rows` ^[15]. The same shape covers a part against its whole, a failure count against an attempt count, and an end time against a start time, at a line each ^[16].

Controls cover what you thought to name. The predecessor of the author's delivery tool copied files into place and overwrote same-named files without a word, eighteen times before anyone noticed ^[17]. The replacement reserves the destination atomically, fails loudly when something is already there, and passed eleven controls ^[18]. On its first day in use the author delivered one real file, then delivered it again on purpose; the recipient's copy was untouched, but the receipt for the first delivery was gone, because receipts were named by file name alone and opened in overwrite mode, so the second run's receipt of "delivered: nobody" replaced it ^[19].

For the pattern-matching defects to show up in your stack, your instruments have to be searches over prose that other people format, which is where word boundaries and `*5/5*` bite ^[12][13]. A check that parses structured data will not meet those two. The positive control applies to any query that can return zero, and the impossibility assert applies to any count with a denominator. Nine is a count and not a rate: the post does not say how many checks ran that day ^[20].