The green path that checked the wrong finish line.

Software can finish the visible job and still miss the outcome that matters. This field report follows one such failure from a private dogfood cohort. The public record keeps the normalized failure class, control behavior, measurements, and limits; names, transaction details, account identifiers, and raw private paths are withheld. Disclosure record

Incident

A real payment path completed checkout, fulfillment, and shipment tracking. Those signals made the order look finished. A separate reconciliation later showed that settlement ownership—the destination that should receive the proceeds—did not match the selected outcome. The public evidence ledger records one observed real occurrence, not a second one inferred from repetition. Incident evidence · C-01

The failure was not “payment failed.” The payment succeeded. The mismatch was between the apparent outcome—paid and shipped—and the actual outcome—settled to the wrong owner. Outcome evidence · C-02

Escape behavior

The system checked the milestones closest to the customer and stopped there. Checkout success, fulfillment, and tracking all remained green while the destination-owner field was outside the completion contract. That gap allowed a locally plausible result to escape as a globally incorrect one. Escape-path evidence · C-03

The recurrence basis was deterministic but bounded: at the historical observation, destination routing was absent. A later payment under that unchanged state would take the same route. That supports a recurrence basis; it does not manufacture a second incident or prove that the configuration is still unchanged. Recurrence evidence · C-04

Adaptation

The smallest response was a detector, not a production block. In shadow mode it compares the expected destination owner with the observed destination owner. A mismatch becomes would_reject; a match becomes would_allow; missing destination evidence becomes would_defer; unrelated observations are not_applicable. Control evidence · C-05

That decision shape matters. Treating missing evidence as a mismatch would create false alarms. Treating it as an allow would recreate the original blind spot. Deferral preserves UNKNOWN until the required evidence exists. Negative-control evidence · C-06

Artifact

The reusable artifact is the vendor-neutral incident schema produced by the program’s first contract pass. It forces an incident to separate intended, apparent, and actual outcomes; name the escape behavior and selector; preserve recurrence basis; and record recovery burden and source provenance. Download incident.schema.json · Artifact provenance

The schema is intentionally not tied to this payment path, repository layout, or agent harness. It can describe a deployment that never reached production, a queue that never sent, or a successful transaction that violated its ownership contract. Schema scope evidence · C-07

Measured effect

The shadow replay caught the one labeled historical mismatch. It also left two labeled negative cases unrejected, deferred one incomplete case, and recorded zero false positives and zero false negatives within that small labeled set. Replay evidence · C-08

The evaluation added zero recorded human minutes, made zero production mutations, and incurred zero external service cost. Evaluation runtime was not persisted, so runtime remains unavailable rather than being reported as zero. Burden evidence · C-09

Those are detector-calibration results, not an outcome improvement. The post-control window contained zero eligible real observations. With no denominator, the report cannot claim a lower mismatch rate, a prevented loss, or a recovery-time improvement. Post-window evidence · C-10

Limit

The control remains in shadow mode. It cannot block or repair production. The source proves one historical real mismatch and a recurrence basis at that observation; it does not prove a second occurrence, current routing state, portability, or external replication. Limits evidence · C-11

The next selection event is deliberately concrete: dated source evidence from an eligible real payment. Until that exists, the only honest result is insufficient post-window. Promotion-policy evidence · C-12

---

Evidence package: ledger · failure card · 90-second video script · 4:5 social variant · 9:16 social variant · social copy