Five gates read the same data structure, and none of them could have found this. `assert len(dots) == 100` walks a list [6]. The constant check confirms that `samples_per_gap=(10,10,10,10,60)` was computed at import time rather than typed in [5]. Those two are nearly the same proposition, since the tuple sums to 100, so the length assert restates the constant check one step downstream [1]. Both are true of the scene graph, and the defect was in the rendered pixels, one transformation past everything the five gates could reach [12]. The author says every line of the report was accurate [4], which is the awkward part.
The bug is one line: `color = LONG_AMBER if idx == LONG_IDX else SHORT_GRAY` [9]. Each dot was then built at radius 0.045 and placed at `TIMELINE_Y`, dead centre of the band whose colour it had just been assigned [10]. A disc that small, centred in a band it matches, has uniform background beneath its entire area. Contrast is zero across the whole disc, not merely low. The only dots with a background edge under them are the ones straddling a colour boundary, which is exactly the pair that stayed identifiable [11]. The 12-minute gap is 60 percent of the 20-minute cycle, so 60 of the 100 passenger dots belonged on the long band [2][3]: 60 amber on amber, 40 gray on gray [2], a 2 percent yield on a count that passed [3].
Read the report the way you would read someone else's benchmark table. It is accurate about object existence and coordinates [12]. For it to also mean "countable on screen", which was the episode's one requirement [1], something would have to assert the composite of dot colour against the band fill under it. Nothing did.
The defense written after the first incident is good work. `serves_line` makes a shot's contract declare which sentence it enacts and throws at load time if that contract bans the sentence's core nouns, two deterministic rules with no model call [17]. It blocks an exact repeat of the dice-pip case, where the contract had been rewritten to ask for a blank face and QC passed the blank [18][15]. It was silent here, because sentence and contract agreed completely and the defect sat a layer below where `serves_line` can see [19]. That is the recursion the author names: push a defense down one layer, and the next defect moves down with it [20].
The two invariants planted afterward are pixel-layer statements. Every dot's colour must differ from whatever it sits on [22], and `assert_no_overlap(a, b)` forbids bounding-box intersection between text elements sharing the screen [23]. Both exist because a human opened the frame first and wrote the assertion second [21]. That also sets their coverage. The pixel layer is now guarded exactly as far as one person happened to look, and the three overlapping text elements in the same render show how much a well-named check can be trusted to cover on its own [14].
