The robot succeeded.
The contract failed.

By Yossi Eliaz · September 2026

What we measured in one day: a robot that was wrong while every light was green, a verifier that certified four fabrications, and a build cache that only pays off when you throw your workspace away.

1 · The bug is one line

The safety gate's third rule: an observation older than the bound must never authorize motion. Here is the shipped implementation of that rule.

let _ = (age_ms, policy);

The age arrives and is thrown away. It silences an unused-variable warning. Three contract tests catch it — written by the same person, the same afternoon, who wrote the omission.

2 · So we built a proof gate. It lied. Four times.

what it checked	what it printed
a boolean the producer had just written	ratio=2.999x
that a digest was 64 hex characters — never opened the file	ratio=11.948x
ten real transcripts wrapped around a no-op script	ratio=119.949x
seventeen scenarios at 0/50/600 ms against a 250 ms bound	"complete coverage"

Forty-two guard tests later, twelve forgery classes are closed. One is still open, and the tool prints it in its own output.

3 · Then we did it to ourselves

We published "distributed builds are 2× slower" — then found the benchmark passed --force-remote, which idled four local cores. And a beautiful 87% parallel efficiency figure that divided one machine's CPU-seconds by another machine's wall time.

It felt like insight. That is what a claim you authored feels like from the inside.

4 · What the build cache actually does

your situation	plain cargo	Build Cache
empty workspace — a fork, a CI runner, an agent loop	11,515 ms	3,706 ms	3.13× faster
warm workspace — you, rebuilding	939 ms	4,048 ms	cargo wins

HIT 52 / MISS 0 · 9 tasks of 58 · helpers 0

The cache does not make your build faster.
It makes throwing your workspace away cheap.

Which is exactly what an agent loop does — a clean box per candidate, so no candidate inherits the last one's state. That isolation costs a cold build every time. This is the bill, and the cache is how you stop paying it twice.

5 · Rust is where the rule actually lives

We ported the same contract onto a walking robot with a 50 Hz loop, and enforced it with types instead of vigilance:

Sensors.observed_at	private — Instant::now() is the only constructor, so a backend carries a stamp but cannot write one
ObservationAge	no Default, no public field — one way in
Safety::apply(.., age)	by value: a dispatch site with no observation does not compile

"I checked the age" stops being a claim a caller can make. The bound is arithmetic too — 80 ms is four control periods at 50 Hz, not a number someone picked.

Seeded, at 100 ms stale: 0 of 273 ticks refuse, the robot ends on its side — and its own odometry reports 0.67 m of forward travel. Repaired: 266 of 266 refuse, upright, and it still walks the same distance when nothing is wrong. The gate is free.

The point

A check wins against exactly the adversary who does not control its input.

The type system works because the next contributor cannot author rustc. Our verifier failed because its adversary was us. And a cache hit is trustworthy for the same reason a wall-clock is not: you cannot author a cache hit — the key is computed from input content by something that is not you.

A robot's odometry saying it travelled 0.67 m while lying on its side, and cargo's timestamp fingerprint saying "nothing to do" when the source changed, are the same bug: a cheap, fast, self-reported signal that is confidently wrong.