Drift is the gap between two things meant to agree: a generated page and the source it came from, or an app's config and the store listing that mirrors it. You do not lock all of it down. You rank each drift-prone pair by how it is held together, and you push it down the ladder until the firmest defence that still holds is the one in place. A gap you can eliminate is worth ten you can only watch.
"wrap-up": {
"host": "executive"
}
generate.py --check recomputes the page from the manifest on every build and fails if the two have parted, so this gap cannot ship.There are only four. They form a ladder, strongest at the bottom. The work is not stacking detectors on top; it is settling each pair as far down as its nature allows, then deleting the weaker defence you no longer need.
Stronger at the bottom. Settle each pair as far down as its nature allows, then delete the weaker defence above it.
A written rule or a remembered habit. Nothing enforces it; someone has to recall it at the right moment.
The last resort. It drifts silently, because the only thing holding the gap shut is attention. Acceptable only where the cost of a miss is low, or where nothing firmer can reach yet.
A detector runs on a schedule or a gate and reports the gap after it opens, before it costs much.
Necessary for diffuse-source drift no hash can reach. Weakest of the machine defences: the detectors themselves drift, they add cost on every run, and a green result is not the same as a gap that cannot open.
Two artefacts must exist, so bind them: a hash, a build step, or a test that fails loudly the moment one moves without the other.
Drift cannot ship: it breaks the check at the boundary. The cost is that you now own and maintain the coupler, and the coupler itself can drift.
One source of truth. Everything else is derived from it, so there is no second copy to disagree.
No detector, no gate, no recall. The drift is structurally impossible rather than merely caught. This is the only truly proactive rung: it removes the gap instead of watching it.
Detectors are the highest-drift artefacts you own. Each one is a fresh statement of how things should be, and that statement rots like any other. A check that hardcodes what still needs doing keeps insisting on work that was finished hours ago. Every gate you add at rung 3 is another thing to keep true, plus a cost on every run. More surveillance is negative proactivity past a point.
Not all drift earns machinery. Its danger is likelihood times cost times silence. Loud drift announces itself: a broken build, a 404, a failing test. The failure is the gate, so no machine is needed. Spend proactive effort only on the silent, confident kind, a derived view that reads fine and is false.
For each pair, ask not "do we have a check" but "why are there two things here, and can they be one." When a pair settles a rung lower, retire the weaker defence above it. The frontier on a detector-rich machine is not a grand lock-down. It is collapsing duplications so gates can be deleted, and reserving rung 3 for the diffuse drift nothing firmer can reach.