A reporting export was producing dates that were wrong, but only sometimes. Investigation gave the pattern quickly and the pattern explained everything: only days of the month at twelve or below were affected.
Why twelve
The export wrote dates as text in day-first order. The consumer read them month-first. For the thirteenth onwards this is self-correcting — there is no thirteenth month, so the parse either fails loudly or falls back correctly. For the first twelve days of any month, both readings are valid dates, and the wrong one is accepted silently.
So roughly forty per cent of rows were silently transposed and sixty per cent were perfect. Any spot check had a better-than-even chance of looking fine, which is precisely how a bug survives a year of people glancing at it.
The bug was not that dates were wrong. It was that most of them were right.
The repair had to survive re-import
Correcting the stored rows was straightforward. Keeping them correct was not, because the nightly job re-pulls the same source and would re-corrupt everything it touched.
A one-off migration would have been undone within twenty-four hours, and would have looked like it worked for exactly as long as it took anyone to stop watching. So the correction lives in the ingest path rather than in a migration — regime-aware, applied at read, idempotent under repeated application. Running it twice produces the same result as running it once.
What we verified before believing it
- The repaired rows against the original source, not against our own corrected copy.
- The nightly job run end to end, then the same rows checked again the next morning.
- A date at the boundary — the twelfth and the thirteenth of the same month — through the full path.
That last one mattered most. Boundary conditions in a bug defined by a boundary are the only test that would have caught the original defect, and it is the test nobody writes because the failure is invisible on either side of the line if you only look at one.
The general shape
Anywhere a date crosses a system boundary as text, the format is an assumption held by two parties who have never spoken. Store the unambiguous form, transmit the unambiguous form, and treat any date-shaped string arriving from outside as a claim requiring a stated format rather than a value.