the test double that agreed with the design

A staff editor was built from a design document while the server served something else: a different address for the same resource, a different encoding for the same geometry, values arriving as text rather than numbers, and a single expected time where the document promised a window. Locally everything passed. Deployed, the editor asked for an address that answered not-found while the real one answered an empty list.

The reason it stayed green is the part worth keeping. The test double was written from the same document as the client. A stub that mirrors a document cannot disagree with a client that mirrors the same document, so the harness was measuring agreement with itself — a tautology wearing the costume of a test.

The repair read the wire shape from the server and adapted to it, with tolerant reads on both sides of the change: a scalar expected time and a two-ended window both accepted, so a client and a server deployed in either order keep working. Then the double was rebuilt against the server rather than the document, including the addresses that legitimately answer not-found because they are not implemented yet. And an authenticated live probe records the real answers beside the build marker of the artefact that answered, so the verdict is about what was served.

That verdict was honest and unflattering: the editor was deployed, but pre-fix. Full behaviour was green only against the real contract, locally.

Cost: a second rewrite of a surface already signed off, plus a probe harness nobody had budgeted for.

What it proves: they know a test double is evidence about the double, and rebuilt theirs against the system instead of the specification.