46 Documents.
One Was Stale in 32 Minutes.

Ashaveth is a free browser role-playing game: 50 levels across five biomes, 72 monsters, four gate bosses and a final boss, three endings, and live AI-written dialogue for the three residents of the last town. The world is a palimpsest — a page written on before, being scraped clean — and something has reached the last town.

All four of those numbers are measured, and I will come back to two of them, because the project's own documents give different ones.

Start with the thing that makes this interesting: this is not a badly documented project. MEASURED on 2026-09-01, excluding dependencies and build output, the repository carries 46 markdown documents totalling 441,416 bytes — an architecture doc, a save-format spec, a testing strategy, a deploy topology, a monster-art plan, a claims register, a build dossier, three separate audits, and a self-declared canonical fact sheet.

That is more written record than most commercial projects carry. It is also why the result is worth your time. A badly documented project having bad documentation teaches nothing. A carefully documented project whose documents are nearly all wrong within weeks teaches something structural.

The self-declared source of truth

One document opens by calling itself the "single source of truth for all Ashaveth marketing." Measured against the code it describes:

Every one of those was true of version 1.0.0. The game shipped 1.2.0. The document was never re-run. A document that calls itself the single source of truth and is not regenerated is the most dangerous artifact in a repository, because its title discourages exactly the check that would catch it.

Six claims. Which hold?

Before reading on, work these yourself. Each is a real sentence from a real document in this repository.

LAUNCH.md line 11, written 2026-07-12
the fix landed 2026-07-13

cloudflare-worker.js lines 97-100

npx vitest run
Test Files 32 passed · Tests 667 passed

repo-wide search: no such file

ipClearance.test.ts
9 assertions, currently passing

qa-images.py — one sys.exit, at line 7

The repository contains a balance audit — a careful, specific document that names defects with file references and proposes fixes. Two of its findings concern exploits:

• A character conversation offers a free, repeatable full heal, which undercuts the inn as a gold sink because talking costs no fights.
• Forest encounter gates roll unseeded randomness while the outcome is seeded, so a player can reload the page to re-roll the gate.

Now the timestamps. MEASURED from file modification times:

Thirty-two minutes. The developer read the audit, fixed both defects immediately, wrote comments in the code quoting the audit's own language — and did not go back to the document, because at that moment the document had already done its job. It had communicated. Its remaining life as a record was nobody's task.

The same shape, four more times

Once you look for it, the pattern is everywhere in this repository, and every instance is innocent:

That last one is worth sitting with. The largest document in the repository has exactly one commit — the first one — and has never been touched across 54 subsequent commits. It reads as a live defect list. Eleven of its findings were sampled against current source; eleven were already fixed or described code that no longer exists. Its subject is a 1,543-line component. That component is now 185 lines.

The public page states, twice, that Ashaveth's 370 kB entry bundle "compresses to 122 kB gzipped." That figure came from the build output, where it is printed in a tidy column next to the raw size. It is exactly right about what the bundler did.

Here is the same file, fetched from the live server:

curl -s -o /dev/null -w '%{size_download}' \
     https://ashaveth.ddsboston.com/assets/index-DdQpyQ8e.js
371388

curl -s -H 'Accept-Encoding: gzip' -o e.gz \
     https://ashaveth.ddsboston.com/assets/index-DdQpyQ8e.js && wc -c < e.gz
140856          # content-encoding: gzip

gzip on;
gzip_types text/plain text/css application/javascript application/json image/svg+xml;
gzip_min_length 1024;
# no gzip_comp_level — so nginx uses level 1: fastest, weakest

Nobody lied. A number was copied out of a build log into marketing copy, and the build log was measuring something the server does not do. Build-time output describes what a tool did. It does not describe what a user receives. The only way to know the second is to fetch the artifact from production and weigh it.

four numbers exist for the same file

uploaded byte-identical to a CDN

the project claims full coverage

The game was rebuilt under a new name. A rename is exactly the kind of fact that gets written down once and then rots — and here it very nearly did. The file that fixed it opens by stating the failure plainly:

"The rebrand changed the marketing and the metadata — and stopped before the code. So the FINAL BOSS still rendered under the pre-rebrand name, in two places a player could see... Meanwhile Wren and Vosk's dialogue said 'Ashaveth', and the in-game Almanac said 'ASHAVETH, THE RED'. The game's own fiction and its own UI disagreed about the name of its final boss."

And then the trap that made it expensive:

"the image cache key for a monster is derived from its name... A naive rename ORPHANS THE SHIPPED PORTRAIT — assets are pre-baked into the repo and keyed by string. The fix is to PIN the art key in the data, so the display name is free to change and the image still resolves."

A markdown file saying "we renamed the boss; remember to pin the art key" would have been accurate on the day it was written and silent forever afterwards. Instead the fact was written as nine assertions:

the final boss displays as Ashaveth, the Red
no banned name appears in any monster's display name
their ability names are grimdark too — no Pixel Bite, no Taser
every renamed monster pins an art key, and the pin != the display name
no provider rebuilds the art key from the display name   ← reads SOURCE
a save that killed the old-named boss is migrated on load
other boss kills are left alone
a save with no kills does not explode
every forge-stage boss still exists — the rename orphaned no gate

That is a complete, executable specification of a rename: the display rule, the art-key invariant, the transit invariant, the save migration, and the progression gate. It is about 7.6 KB. It replaces a paragraph that would have been wrong within a month, and it fails the moment any of those facts stops being true.

// IP-CLEARANCE REGRESSION SUITE.//// The rebrand changed the marketing and the metadata — and stopped before the code.?// So the FINAL BOSS still rendered under the pre-rebrand name.const BANNED_DISPLAY_NAMES = [ /* six retired strings, redacted here */ ];?

The same pattern, four more times

Once you have the idea, this repository is full of it — each one a fact somebody refused to leave in prose:

What stops a bad rename

Push a change through this project's actual pipeline and see which check catches it.

A class that only criticised prose would be half a class. The same repository shows the opposite failure just as clearly: a green suite that is narrower than it looks.

The balance harness that cannot fail

The combat engine's three tuning constants carry comments saying they were "tuned in the harness." The harness is real: it drives the shipped engine through 30,000 simulated fights and prints a win-rate table. Here is every assertion in it:

line 185:    expect(true).toBe(true);
line 199:      expect(true).toBe(true);
line 237:    expect(true).toBe(true);

Three tests, three assertions, all tautologies. The file is structurally incapable of failing regardless of what the simulation produces — the balance signal exists only in console output a human has to read. And it is excluded from the test run by name, so even the printing does not happen unless someone invokes it directly.

This is not laziness. It is a scratch tool that was useful once and then sat in the tree looking like a test. The word test in a filename is not a guarantee.

Three more that look like gates

• Two browser verification scripts — correctly written, with genuine non-zero exits — import their browser library from a hardcoded temporary directory path that appears in neither the dependency list nor the lockfile. They only ever worked on one machine, and a clean checkout cannot run them.
• A performance script shells out to a tool nobody installs.
• The image quality checker prints failures and exits successfully. Its only exit call guards a missing library, not a failed check.

And the gap inside the passing suite

667 tests pass. They are logic-only — no browser rendering — which the project's own testing document states honestly. But 17 of the 34 state-machine actions have no dedicated test anywhere, including the ones that heal you at the inn, buy a drink, revive you after death, and apply damage. A reader seeing "667 passing" would reasonably assume the inn's gold and health arithmetic is pinned down. It is not.

Still open in the repository

• Two governing documents have no supersession marker. The claims register and the canonical fact sheet are both stale against the shipped version. The retraction, where it exists at all, lives in a different file. The next reader opens the stale one.
• The largest document has no banner saying it describes a deleted prototype.
• There is no continuous integration. Five real gates exist and all of them run on whoever remembers to type the command.
• Two verification scripts cannot run on a clean checkout — hardcoded path, undeclared dependency.
• Seventeen state actions are untested, including four that move gold or health.
• The handover note is 15× off on the AI spend ceiling, and contradicts a correct measurement in a sibling file.
• The project calls itself open source with no licence file. The readme still carries a to-do to choose one. That claim is not currently true.

Four corrections this class made to itself

A class about verification that hides its own misses is worth less than one that shows them. All four were caught by measuring rather than reading.

The last row is the one I would keep. That figure came from my own handoff note, written days earlier, and I nearly published it. The pattern does not spare the people who are looking for it.

Write one now

Pick a fact in your own project that you cannot afford to be wrong about, and turn it into something that fails. Fill this in and download the result.

The five that would have caught all of this