Language · We run it ourselves
A typed layer over JavaScript: shapes are checked when the code is compiled, and erased before it runs.
A type system is normally sold as a defect filter, which undersells it. What a type actually does is refuse a document — it decides which sentences can exist before anyone argues about whether they are good ones. The page being read is the demonstration: the rules this ledger publishes about evidence and limits are not editorial policy, they are required fields, and an entry that breaks them fails the build rather than a review.
01
The rule that survives is the one that does not compile when broken. In lib/stack.ts, `evidence` is a non-empty tuple and `limit` is a required string, so an entry that cannot point at something a stranger can open, or that will not name where the thing stops working, cannot be added at all. The identical rule written in a style guide is obeyed until the first deadline, and every marketing page on the internet is evidence of what happens next.
02
A figure that can go out of date cannot be written as a bare number. `Sourced<T>` in lib/knowledge.ts takes the value, the ISO date it was actually read, and the address where a reader checks it — and because the date is a field rather than a habit, the corpus gets an enforceable notion of decay: STALE_AFTER_DAYS is 183, and scripts/check-knowledge.ts fails the build on anything older. The failure being engineered against is specific. A wrong definition gets argued with; a price that was true in August and is quoted in March is simply believed.
03
A union with no vague variant forces the awkward decision at authoring time. `Standing` here is partner, operated, delivered or declined, and nothing else — a partner variant demands the vendor's own words for role and tier, and the declined variant carries a required `instead`, so refusing a technology obliges the entry to name what is used in its place. There is no field in which a relationship with a vendor can be left implied, because the type does not offer one.
04
Discriminated unions make the set of admissible claims finite and the renderer exhaustive. `Evidence` has six shapes — case, product, repo, command, instrument, constraint — and the switch that renders them returns a value for each, so adding a seventh kind breaks every surface that must display it instead of silently dropping it. The editorial consequence is that a new sort of proof cannot be invented by writing a more confident sentence; it has to be added as a variant, and then taught to every page.
05
Types are the contract between services, not decoration inside one file. In the mozg monorepo the contracts package holds the versioned Prisma migrations and the embedding contract, so a change to what a content record is fails at the compiler in every consumer at once — rather than in whichever service was not redeployed, at the hour when nobody is reading logs.
06
The value is in the configuration, not the file extension. With `strict` off, TypeScript is a documentation format that agrees with whatever it is told; with `strict: true`, an absent value is a case that must be written down, which is where most of the defects worth catching actually live. A codebase full of .ts files and loose compiler options has paid the tax and bought nothing.
07
The gates are ordinary TypeScript programs, and that is what makes them trustworthy. scripts/check-knowledge.ts imports lib/glossary and lib/checks directly instead of parsing the source, so the objects it validates are the objects the site renders; check-schema.ts fails the build on a dangling @id in structured data and check-markdown.ts fails it when content negotiation and the routes disagree. A validator written against a type, in the same language as the type, cannot quietly drift away from it the way a regex does.
An entry that cannot point at something you can open, run or read does not compile. That is a property of the type, not a promise in a paragraph.
Invariant
Types are erased before the code runs, so the compiler guarantees nothing about data arriving from outside — a JSON response cast to an interface is an assertion, and every boundary needs a runtime check the type system will not write. It also polices shape and never content: `Sourced<T>` can force an asOf field to exist and cannot tell whether it holds a real date or whether anybody actually reopened the source, which is precisely why the gates in scripts/ are runtime programs rather than cleverer types. And the discipline stops paying at both ends of the scale — a migration script that runs twice costs more in type plumbing than the bugs it prevents, while an invariant pushed deep enough into generics becomes a private dialect that only its author can edit, which is a maintenance problem wearing a correctness costume.