A two-week audit specimen for an established company whose orders move from email to spreadsheet to fulfilment by copying, memory and follow-up.
The audit design below is ready to use. The worked numbers are invented and labelled H1. No client has bought or run this audit. The code-legibility proof later on this page was run once on our own system.
Decision: fund an incremental replacement, repair the current process first, or stop. The sponsor must be the owner, CEO or board-mandated managing director. The process owner supplies access and facts; they do not control the verdict.
Boundary: one order type from first complete email to a fulfilment-ready row. Payroll, customer messaging and the fulfilment system remain outside the audit.
Select 20 consecutive recent orders before building anything: 12 routine, four incomplete, two duplicates and two later changed by the customer. Keep the source email, spreadsheet history and final accepted record for each case. Use timestamps, screen capture or system history as evidence.
| Measure | Start | Stop / test |
|---|---|---|
| Elapsed time | complete email | accepted row |
| Human touch time | timer starts | active work ends |
| Rework | first entry | later corrections |
| Exceptions | all 20 | human decision needed |
| Traceability | sample a field | source + actor found |
| Recovery | delete a copy | restore verified state |
Build a narrow shadow path: a structured intake record, deterministic validation for required fields and duplicates, a work queue, and an append-only event log. An AI may extract proposed fields from email, but a person accepts exceptions. Every accepted field retains its source, actor and time. The existing spreadsheet remains the recoverable system of record.
Replay the frozen 20 cases without changing their inputs. Then force four faults: missing customer ID, duplicate order, AI extraction unavailable, and queue worker stopped. Each must refuse, route to a named human, or recover without silently losing an order.
Use the same definitions and case pack. Publish every case, including regressions. Report medians plus the slowest case; a fast routine majority cannot hide a failed exception. The handoff includes the evidence pack, runnable fault checks, rollback steps, named daytime owner, 2 a.m. escalation path and a recommendation with a stop option.
| Worked H1 example | Before | After |
|---|---|---|
| Median elapsed time | 47 min | 11 min |
| Median human touch | 12 min | 4 min |
| Orders corrected later | 5 / 20 | 2 / 20 |
| Field source found | 9 / 20 | 20 / 20 |
| Forced faults contained | 1 / 4 | 4 / 4 |
H1 is hypothetical. These numbers demonstrate the completed report's shape. They are not a forecast, benchmark or client outcome.
The specimen above has not met a client yet. The following before-and-after did run on a system we own: one source file whose cross-file claims had become unreadable to a machine.
The commit at 17:31 corrected nine of these by re-reading every cited line, which is as careful as a person gets. Read back the same evening, several were false again. Anything inserted above a cited line moves it, and the comment goes on looking right.
The costly one pointed the other way. A watchdog that wakes Oleg's phone keeps its own copy of this script's verdict words, documented as read verbatim off two named lines. Those lines now hold an unrelated remark about daemons. Anyone checking whether the copy was still correct landed nowhere.
Same instrument at both ends, run on the script and the two files that consume it.
| Measured | Before | After |
|---|---|---|
| Claims about other files | 46 | 47 |
| Line numbers asserted | 65 | 0 |
| Claims a machine can verify | 0 | 47 |
| Stale pointers in consuming code | 3 of 4 | 0 of 4 |
| Consumers named in the file | 0 | 3 |
The claim count rose by one. Two citations that asserted several positions at once became one anchor each, and two naming adjacent lines of one crash handler became a single anchor. Nothing was deleted to move a number.
A guard is worth what it has been seen to refuse. Each of these is forced against a fixture through the shipped command, and the whole set runs in 17 named cases.
The checker searched two directories, one of which contained the other, so every local file was found twice and condemned for matching two files that were the same file. It manufactured the fault it reports.
Repairing it moved the headline split from 10 and 27 to 19 and 18. The earlier pair is absent from the before column above, because it was never a measurement. A regression case now pins both directions: a name matching one file must resolve, and a name matching two genuinely different files must still be refused.
Then it fired for real, the same evening. Someone working in the other repo renamed an argument, so one anchor stopped matching. The check went red on the next run and named the exact text that had gone. Two anchors in files that also moved kept resolving, which is the whole difference: one pointer broke loudly and the rest tracked the change in silence. Under line numbers all three would have gone quietly false and the suite would have stayed green.
The second question an agent cannot answer by reading. This script exports seven symbols and nothing anywhere imports it, because loading it runs the whole audit. Its real interface is a command line and an exit code, held by one caller that pages a phone.
It is one measure of one file, on a codebase we wrote. It says nothing about what your system would score, because it has never been run on one.
Nothing here improves the program. No verdict, no probe and no behaviour changed. The file grew by 134 lines, nearly all of it comment, so the legibility was bought with characters. And nothing schedules these two checks: they fail inside a test suite that runs when a person runs it, which is the same footing as the 354 cases that were already there.
The repository is private, so here is the whole method. It needs no library and took a few hundred lines.
path/to/file.js @"const ENTRY_RE ="
Choose anchors a rename would break honestly: a declaration, a signature, a distinctive string. Anchors sitting inside quoted code need characters your own quoting survives.
Corrections and questions go to oleg@mlkv.org. If something on this page is wrong, it gets fixed here with the mistake left visible.