What each sensor proves

Reading the edges

The misread edge is deliberately narrow. Every sensor that does not close a doubt leaves it open, which is nearly the whole catalog for any one doubt and not worth drawing. What the dashed edges mark is the specific mistake: 90% coverage taken as tested, a green canary taken as a safe release, "formally proven" taken as correct. That is the misreading each entry's "What it cannot detect" section was written to head off.

A solid edge does not mean the sensor settles the doubt outright. It settles it only for what the sensor was pointed at. A proof rules out wrong logic for the property someone wrote down, and for nothing else. A test rules it out for the examples it was given. A canary rules out an unsafe release for the metrics it compares. Outside that, the doubt is still open. That is the composition rule in one sentence, and it is why two sensors that close the same doubt count once.

Retrospective sensors get their own edge. Escaped defect rate cannot close late effects before shipping; it is the sensor that shows, months later, that the doubt was real. The catalog's predictive versus retrospective dimension is the same distinction.

What the shape says

The doubts are not the families under another name. If each family closed one doubt and no other, this page would be the catalog page again. Instead the edges cut across the families. Unasserted execution splits one family: the coverage sensors are misread as closing it, and mutation testing, in the same family, closes it. Wrong specification draws its closers from two families and its misreadings from three. Three doubts, nobody knows where the coupling is, nobody knows where the risk sits and nobody can find out why, are about the codebase's future rather than its correctness, and they are what the evolution and comprehension families exist for.

Two doubts are nearly unclosable from inside the catalog. Missing behavior and wrong specification both end at human review and outcome sensors. And wrong logic has an empty left side: nobody reads a clean compile or type check as correct code. The belief engineers actually hold is that a class of bugs is gone, which is true.

Where the vocabulary came from

Ten of the doubts were mined from the "What it cannot detect" section of every entry, which is where the catalog names what it leaves open. That method finds the catalog's residue, not its coverage: a doubt the catalog closes well never appears there, because no entry is worse at it than the sensor that owns it. The other nine came from asking every sensor the first pass left with nothing to close what it does close.

Every edge was then stated as a plain assertion, "most engineers think a passing X shows Y" or "X ensures Y", and judged true, partly true, or false by reviewers who saw only the assertion. The false ones were removed, and they were mostly misreadings: the reviewers' repeated finding was that engineers know what a compiler does not prove. No closing edge was judged fully true.