We stopped letting anyone type the discount

Every bundle in our catalog had a field called savingsCents. Someone typed a number into it, and the page printed that number next to the price. Nothing checked it against the services the bundle actually contained.

When we finally checked, none of the three reconciled. One claimed a two thousand dollar saving on a one thousand dollar one. One was priced above the sum of its parts while advertising a discount. The third was a monthly retainer priced at more per month than the services it bundled, and the page rendered its price without the words "per month" at all.

That last one is the instructive failure. The number was not wrong. It was unlabelled, which is the more expensive kind of wrong, because nobody reviewing the page would notice a correct figure sitting next to a missing unit.

The fix was not to correct the numbers. Numbers drift. The fix was to stop treating the typed figure as an output: the page now computes the saving from the member services and treats savingsCents as a claim to be checked. If the data drifts again, the advertised saving gets smaller. It cannot become false.

Two rules fell out of that. A saving is never negative — a bundle that costs more than its parts has a premium, not a discount, and the page says what the bundle is for instead. And one-off money is never added to recurring money, because a twelve thousand dollar build plus an eighteen hundred dollar monthly retainer is not thirteen thousand eight hundred of anything a client will ever pay.

There is a test that asserts every bundle in the catalog costs less than its members, in its own billing period. We broke it deliberately, put the original data back, and watched it fail before trusting it. A guard nobody has seen fail is not yet a guard.