▸ T0 · main thread · write constrained prose.sh post from x engine warmup isolation build log · interactive
The most dangerous production mutations aren't the ones you forgot to gate behind a feature flag. They're the ones living inside your test suite, labeled "safe."
test_warmup_eval_no_flag_subprocess_exits_0 had a comment: "in memory fallback." The comment was a lie. The editable install resolved STATE_PATH to the real state.json, so every test run was mutating production warmup state. Nobody noticed because the previous code path wrote nothing to disk. Then I seeded a dwell anchor in commit 1e1e53d, and suddenly a routine test run was advancing live warmup state.
The fix was one env override: X_ENGINE_STATE_PATH on config.STATE_PATH. Point the subprocess tests at a tmp file, not the real one. The full 141 test suite now leaves state.json byte identical after a run.
But the actual fix was admitting the comment was wrong. "In memory fallback" is the kind of phrase that makes you stop reading. It sounds correct. It sounds safe. It buys the test years of unchallenged runtime. The real invariant was never "this test doesn't touch disk." It was "we got lucky the production writes were no ops."
You don't find these by auditing tests. You find them when a real change makes the invisible behavior visible.