Six documents that passed every check.

The pipeline turns a 36×24 architectural construction set into an 11×17 study set: the $75 sample that gets credited in full against a $1,500 plan. Nine plans had been built through it. A rebuild loop reused one temporary filename against a step that cannot overwrite, so six finished documents ended up carrying a seventh plan's contents. None of the six reached a buyer.

The verifier passed all six. It checked the page format, the absence of any buyer identity, the watermark invariants and that the text layer had been stripped. Every one of those assertions was true of every one of those documents.

The build script had a bug, which is ordinary. The verifier had none. It did what it was written to do, on six artifacts that were completely wrong, and returned ALL CHECKS PASSED on each of them. A check that cannot fail on identity is not checking identity.

So the fix treated the verifier as the defect rather than the build script. Unique output paths stopped the overwrite, and title and page-count assertions went into the verifier. Those catch a document carrying the wrong plan's cover and a document of the wrong length. Neither one reads the drawings, so a file whose cover and page count happened to match would still get through. The check is narrower than the failure it is named after, and a write-up about checks that look wider than they are should say so. Fixing only the loop would have left the more dangerous thing exactly where it was: a green light that says nothing about identity, trusted for another nine plans.

The general form

When something passes a check it should have failed, the check is the more important find. Ask what the suite asserts, and then ask what it would take for the artifact to be badly wrong while every one of those assertions stays true. If that state exists, a pass covers what the suite asserts and no more. The format and privacy checks here were real and stayed useful. They did not test which plan was in the file.