Disprove it before you build on it

A routine audit became a sound cost-vs-durability decision — but only because every load-bearing premise was killed at the source before anything was built on it.

The setup

A one-line question — "status on the immich audit" — opened into a real decision: what to do about a photo library's ~$18/mo of object-storage, tangled up with a plaintext-exposure worry and a belief that the storage was serving live images. The tempting answers were expensive and irreversible: delete 400 GB, or re-architect how images are served.

Neither survived contact with the source. And that is the whole lesson — the decision landed well because its assumptions were made to prove themselves first, not despite the detours it took to test them.

Two premises that died at the source

The first: a path-by-path comparison declared 50,533 files missing from the encrypted archive — a scary number that argued against deleting anything. It was wrong. The app had re-dated the files into new folders, so the paths differed while the content was in the archive all along. A five-file spot-check found every one of them.

The second: "the app serves images from this storage." Also wrong — the app's config pointed nowhere near it, and the traffic was a one-week migration burst, not steady browsing. The storage was never in the serving path; it was a redundant backup wearing a serving costume.

Only after both premises fell did the real shape appear: an expensive-looking problem was a mislabeled cheap one.

1 · Relabel until the label stops changing

The same object was called, in order, plaintext exposure → serving cache → redundant backup. Each corrected label shrank the problem, until "re-architect serving" and "delete 400 GB carefully" both collapsed into "delete a redundant backup." Shaping a decision is mostly re-asking what is this thing? until the name holds still. If the label keeps moving, you haven't found the decision yet — you're deciding about a fiction.

2 · Sequence the irreversible behind its safety net

The chosen plan was not the cheapest. It kept one $6.72/mo durability copy and put the storage's full retirement behind the arrival of physical backups (a disc, a tape), not ahead of them.

3 · Distrust the number that fights your spot-check

That confident 50,533 came from a real computation — and disagreed with a cheap probe that found the files instantly. The instinct is to trust the big systematic number over the small manual one. Invert it.

4 · Read the shape, not the size

The tell that killed the serving premise wasn't the request count — it was the distribution: nearly all of it fell inside one recent week. A burst, not a habit. The magnitude said "busy"; the shape said "one-off migration." The shape of a measurement often sits closer to the truth than its headline, which is the same move as reaching the source, not the courier — applied to your own telemetry.

The principle, generalised

None of these are about photo backups. They're four ways of refusing to trust a surface — the label, the ordering pressure, the number, the headline metric — and going to what's underneath before a decision rests on it:

The decision was defensible not because it was clever, but because it was built on assumptions that had each been made to survive a test. Cheap, reversible probes — a lookup, a config grep, a glance at a distribution — repeatedly collapsed expensive, irreversible questions.