The only gate that ran was a hand-typed enum, and it had never heard of the new value

A team added a seventh theme, `birthday`, to a picture-book generator: type union, the metadata map the create form renders from, the access table, the shelf that fills landing pages, the sitemap, plus sample content ^[1]. According to a postmortem published on dev.to, the suite was green, and then every user who picked the new option got `400 Invalid input`, every time, all day ^[2].

The thing that rejected it was one hand-written schema inside `POST /api/generate`: `theme: z.enum([...])` with six string literals, typed out by hand months earlier ^[3]. The selector offered seven ^[1][3]. One in seven of the visible options was unreachable through the API ^[13].

The reason nobody caught it is worth more than the bug. Every book produced that day came out of a script that called `insertStory` directly and pushed the job onto the queue: six books, six good renders, six reviewed illustration sets, none of which touched the HTTP route ^[4]. The unit suite runs with no database and no network by design, so it never loads that route at all ^[5]. The pipeline worked; the product did not; testing the back half only ever proves the first ^[6].

The same six literals had been copy-pasted around. The internal seed endpoint carried the same list with the same omission ^[7]. The back-office story filter in `admin/stories` could not find a birthday story at all ^[8]. A dev-only loading preview held a drifting copy ^[9]. In `lib/seo/landingCatalog` the comment above the list read "themes that ship today" and listed six, so every generated landing page had been silently skipping the new theme ^[10]. Counting the route handler, that is six separate places holding the stale list ^[14].

The worst one was a test. `tests/landingCombos.test.ts` asserts that every landing combination uses a valid theme, and carries its own definition of valid: the same stale six ^[11]. So the theme was broken and the test was green; fix the omission, add birthday combinations, and the test goes red ^[11]. That is a test passing because reality has not reached it yet.

Somebody had already solved this and stopped. The adjacent field in the same schema read `language: z.enum(STORY_INPUT_LANGUAGES)`, with a comment explaining that it is derived so the API gate cannot drift from the create form ^[12]. The fix existed, was documented, and had been applied to exactly one field ^[12].

The repair was to derive `STORY_THEMES` from the metadata map the create form already renders, import it everywhere, and add a test that scans `src/` and fails any file quoting three or more theme literals in a row ^[15]. Curated subsets are the honest exception: age-band recommendations and the random default pool should not grow with every theme, so they now carry a `THEME-SUBSET:` marker stating why, because without it deliberate and forgot look identical in a diff ^[16].

Verification moved to the front door, in threes: `theme=birthday` returned 403 `premium_theme`, `theme=wisdom` returned the same 403 as a positive control, and `theme=nonsense` still returned `400 Invalid input` as a negative control ^[17]. Read alone, the first line cannot distinguish a fixed theme from a deleted validator ^[17].

Two things to watch. The scanner threshold of three consecutive literals is a heuristic, and subsets are exactly where the next drift will enter, marker or not ^[15][16]. And the published check stops at a paywall response, not a 200, so the paid generation path through that route remains the next door nobody has opened ^[17]. The team's closing note about presents left on a party table is labelled as an observation with no sample and no control group, and should be read that way ^[18].