Failure catalogue · The number is plausible, and wrong · 8 of 51

OBSERVED FAILURE MODE

The wrong column that reconciles.

Two columns can share a shape: same type, same scale, same plausible range. Read the wrong one and every total still ties, because the arithmetic is faultless on the values it was handed. The number is internally perfect and answers a question nobody asked, and no amount of checking the addition will say so.

What we saw

In our own audits a read pinned to a column position rather than a column name picked up its neighbour after an export's layout shifted by one. Every check downstream passed. The sums tied, the row count was right, and the figure was a real sum of a real column, which is why nothing objected. What caught it was a second read that located the same value by the label printed next to it and disagreed with the first. One method cannot fool two when the two share no logic between the bytes and the figure.

Why it passes a glance

Every guarantee in the build is about arithmetic, and the arithmetic is correct. A glance sees a plausible figure of the right magnitude. A total check compares the sum against a stated total the wrong column happens to satisfy, or against a recomputation from that same wrong column. Position is invisible on the page, so nothing a reader can see is out of place.

What addresses it

Doctrine principle 2, two independent reads beat one careful one, requires every published value to be found twice by methods sharing no logic, once by where it sits and once by the label beside it, with disagreement investigated rather than tuned away. The verification-practice skill takes independence down to the parse: two paths that reconverge on one parsing routine are a single path wearing two names, and any shared step is disclosed and counted as one read.

Check your own file in two minutes

1. Take your headline figure and find it a second way, by the column's header text rather than by its position.
2. Compare the two values, and write down the tolerance you will accept before you look at the gap.
3. If they disagree, investigate the read; never widen the tolerance until they agree.
4. Record which figures got two genuinely independent reads and which got one, and print that on the page.

What this does not catch

Two reads prove one file was read the same way twice. They cannot tell you the column you chose means what you assume, because a symmetric mistake, the same wrong column pinned in both paths, agrees perfectly with itself and reconciles to the cent.

Quick answers

Does a tie to the file's own total catch a wrong column?

Only when the wrong column fails to match that total, and columns that share a shape often match it.

What counts as independent?

Two paths that share no logic between the raw bytes and the figure, including the parsing and type coercion steps, not just the step that locates the value.

What if the two reads disagree by only a little?

You investigate the disagreement, because widening the tolerance until it disappears converts a finding into a certification.

Nearby failures

Last updated 2026-09-02 · Dylan, founder · one of 51 observed failure modes, every one seen in a real build or in our own audits, none invented.