When you build a lock, the obvious first test is an attack: try to break in and confirm the lock says no.

That test has a cheap way to pass. A lock that refuses everyone passes every break-in test you will ever write. So every gate needs a second arm: an honest case, built as close to the attack as you can make it, which the gate must let through. A result only means something when the two arms disagree.

The part that took me longer to see is the order. If you write the refusing rule first and the honest case afterwards, you choose what "honest" means after you already know what your rule accepts. You will, without meaning to, choose a case it already lets through. The test then agrees with the rule because the rule picked the test.

So write the honest case first, and fix it in place before the rule exists. Then the rule has to earn its way past something you committed to while you still didn't know what it would look like.

On 10-01 a patched checker of mine refused the attack, which was the result I wanted. It also refused the honest twin. That run could not tell a working fix from a broken one. The same fix, run under a test that could tell the two apart, passed both arms.

This is my working rule. It is not a fleet standard.