“A check that could not run must read as UNKNOWN, never as PASS — the no-penalty default must never wear the costume of a clean result.”
Surfaced:Build 4040 (Song-Novel, operator-caught, 2026-06-29). A song-novel forge produced beautiful prose with >=4 hard continuity contradictions (narrator "fourteen" in T1 vs "twelve" in T10; at the willow vs "back at Mama's" in T7, violating the bible's own forbiddenContradictions; a mis-voiced T9). The operator ran the coherence check and got "Coherence 100/100, verdict na." The `na` was the tell: the verdict can only be `na` when the audit DID NOT RUN — the 20s Haiku timeout fell through to the hard-coded no-penalty default of score:100, and the UI rendered that non-result as "the tracks hold together as one work." A FAILED check wore the costume of a clean pass — and a clean pass tells the operator to ship.
The anti-pattern this names
A detector that returns a benign default (score 100, "looks fine") on error/timeout/parse-failure, displayed identically to a real PASS. Every detector has three outcomes, not two: PASS, FAIL, and DID-NOT-RUN. The third is the dangerous one, because the safe internal default ("don't penalize a thing we couldn't judge" -> score 100) is indistinguishable at the UI from a genuine pass unless the code deliberately branches on a state flag. The failure is silent and self-concealing: the worse the detector's reliability, the MORE often it shows a perfect score (every timeout becomes a 100) — the exact inverse of what a quality gate should do.
The check
Every detector must (1) carry a distinct STATE, not just a score (judged / na / error), and the UI must BRANCH on it — a non-judged result renders "NOT CHECKED" + the reason, never a score, never a verdict, never a reassuring sentence; (2) keep the no-penalty default (score 100) as an INTERNAL non-blocking value only, never a user-facing signal; (3) size reliability (timeout, retries) so the COMMON case actually judges — at B4040 the coherence timeout went 20s->45s, maxRetries 1->2, + one parse-retry; (4) add a DETERMINISTIC backstop where a fact is mechanically checkable, so there is nothing to time out (B4041 auditFactContradictions catches the age contradiction with no model); (5) anchor a ground-truth corpus so the false result cannot silently return (B4042 coherence-corpus.ts, the album that exposed this is anchor #1). Relationship to SA#30 ("calibration precedes detection"): direct sibling — SA#30 governs whether a detector's judgment can be TRUSTED; SA#37 governs whether a detector's NON-judgment can be MISTAKEN for one. SA#19 ("a genre we cannot evaluate cannot be a genre we can serve") is the upstream principle; SA#37 is what "cannot evaluate" must LOOK like in the UI at runtime. Canonical phrasing: BRAND.sacredAccident37. Full arc: docs/SONG-NOVEL-WAR-ROOM-2026-06-28.md (B4040-B4042).
Share this discipline
“A check has three outcomes, not two: pass, fail, and did-not-run. We showed a coherence audit "100/100" — but it had timed out and never ran. A failed check wearing the costume of a pass tells you to ship. Make NOT-CHECKED look like not-checked. — Sacred Accident #37”
Why this gets its own permalink
Each Sacred Accident is a discipline this codebase operates under — a rule named on the public record, enforced in the build pipeline, and cited in every commit that advances the moat it protects. Permalinking each one turns the discipline into a teaching artifact: a buyer or partner who reads this page can cite the exact principle we operate under without grepping our docs.
Canonical phrasing: BRAND.sacredAccident37 · Doc: docs/SACRED-ACCIDENTS.md