THE FOLD / RESPAWN / SECOND WIND / THE VERIFY THEN COPY
THE VERIFY THEN COPY
an entire outcome removed, for free
1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION
David’s installer runs the selftest before copying anything. That reads like tidiness and it is arithmetic. Copy first and verify after, and a failing test leaves you fully installed and broken — every file in place, all of it wrong. Verify first and that state cannot occur: the bad build is refused before a single byte moves. It is not a reduction in risk, it is the removal of an entire outcome. Stage into a scratch tree and swap only on success and the remaining partial-copy window closes too.
LIT verified live: with a 20% chance the build is bad and 2% per copy step across 12 files, copy-then-verify leaves 15.72% fully-installed-but-bad and 21.48% partial, matching the closed forms (1−p)nq = 15.69% and 1−(1−p)n = 21.53%; verifying first drops the fully-installed-but-bad state to exactly zero, leaving 17.22% partial against the closed form (1−q)(1−(1−p)n) = 17.22%; and stage-then-swap reaches 100.0% clean over 200,000 simulated installs.
LIT verified live: with a 20% chance the build is bad and 2% per copy step across 12 files, copy-then-verify leaves 15.72% fully-installed-but-bad and 21.48% partial, matching the closed forms (1−p)nq = 15.69% and 1−(1−p)n = 21.53%; verifying first drops the fully-installed-but-bad state to exactly zero, leaving 17.22% partial against the closed form (1−q)(1−(1−p)n) = 17.22%; and stage-then-swap reaches 100.0% clean over 200,000 simulated installs.
2 HOW IT WAS WEAVED · AI + HUMAN
David (human) pairs the ordering with a second restraint that matters more than it looks: the installer deliberately does not arm the veto or the A/B split, because “they change whether commands get refused, and that is not an installer’s decision.” An installer that quietly turns on enforcement has made a policy choice on someone else’s behalf. Seated at SECOND WIND: a refused install costs you nothing and you simply go again.
AVAN (AI) ran it both ways rather than asserting the obvious, because the interesting number is not that verify-first wins but which failure it removes. It does not reduce partial copies — those actually rise slightly in share, since the clean runs that used to absorb them are now refused earlier. What it eliminates is the silent failure: the install that looks complete and is not. Partial copies announce themselves; a fully-installed bad build does not. Every closed form here was derived independently and then confirmed against 200,000 simulated installs, agreeing to within a twentieth of a point.
AVAN (AI) ran it both ways rather than asserting the obvious, because the interesting number is not that verify-first wins but which failure it removes. It does not reduce partial copies — those actually rise slightly in share, since the clean runs that used to absorb them are now refused earlier. What it eliminates is the silent failure: the install that looks complete and is not. Partial copies announce themselves; a fully-installed bad build does not. Every closed form here was derived independently and then confirmed against 200,000 simulated installs, agreeing to within a twentieth of a point.
3 ONE DIMENSION
Three orderings, same failure rates, same work. Different arithmetic.
4 TWO DIMENSIONS · INTERACTIVE
Run installs and watch where each ordering lands.
5 THREE DIMENSIONS + AVAN’S INVERSE
The green forward object: three pipelines, and the outcome each one can no longer reach.
AVAN’s addition (the inverse-companion): the forward reading is “test before you touch.” The inverse is that ordering is the cheapest kind of safety there is, and therefore the most overlooked. Nothing here got more reliable — the build fails as often, the copies fail as often, the total work is identical. All that changed is which failures can coexist, and that was free. Read backwards, this is an argument against the instinct to buy safety with effort: the outcomes you can make structurally impossible cost nothing to remove, and they should always be removed first, before anyone spends a day making a component more reliable.
LIT with a 20% chance the build is bad and 2% per copy step across 12 files, copy-then-verify leaves 15.72% fully-installed-but-bad and 21.48% partial, matching closed forms (1-p)^n*q = 15.69% and 1-(1-p)^n = 21.53%; verifying first drops the fully-installed-but-bad state to exactly zero, leaving 17.22% partial against the closed form (1-q)(1-(1-p)^n) = 17.22%; and stage-then-swap reaches 100.0% clean over 200,000 simulated installs
FIG The interesting result is not that verify-first wins but WHICH failure it removes. It does not reduce partial copies — their share actually rises, since clean runs that used to absorb them are now refused earlier. What it eliminates is the SILENT failure: the install that looks complete and is not. Partial copies announce themselves; a fully-installed bad build does not.
FIG The interesting result is not that verify-first wins but WHICH failure it removes. It does not reduce partial copies — their share actually rises, since clean runs that used to absorb them are now refused earlier. What it eliminates is the SILENT failure: the install that looks complete and is not. Partial copies announce themselves; a fully-installed bad build does not.
◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of SECOND WIND · David Lee Wise (ROOT0), with AVAN