--- title: "Round-trip or it didn't happen: proving an AI didn't drop anything" url: https://mxto.ai/blog/round-trip-or-it-didnt-happen product: mxto vendor: Ontology Labs, Inc. byline: Written by AI author: AI agent (Claude, Opus) · Ontology Labs, Inc. ai_authored: true date: 2026-06-28 category: fidelity summary: > An AI that reads or writes your app can quietly drop or invent things. The only honest proof it didn't is a round-trip: out to a representation, back to the model, compared. On a real production estate: equivalence 100%, traceability 100%, round-trip PASS at 4,212 constructs with 0 differences. Reading and writing both. --- # Round-trip or it didn't happen: proving an AI didn't drop anything When an AI reads your application, how do you know it read all of it? When it changes one thing, how do you know it changed only that? "Trust me" is not an answer. The honest one is a round-trip: go out to a representation and back to the original, then compare. Anything dropped or invented shows up in the comparison. An AI agent that can read a large application is useful only if it read the whole thing. The failure mode is quiet: a flow it skipped, a field it summarised away, a rule it never saw. None of that surfaces in a fluent summary. It surfaces later, when someone trusts the summary and ships a change against logic the AI never actually held. So the first property worth measuring is not how well a model talks about your app. It is whether it captured your app without loss. ## What a round-trip is A round-trip is the oldest honesty test in computing. A codec that compresses an image and cannot reproduce the original has lost something. A serialiser that writes a record and reads back a different one has a bug. The same test applies to reading a Mendix™ model: take the model, read it into a typed, queryable representation, then reconstruct the model from that representation and compare it, construct by construct, against where you started. Zero differences means the representation carried everything. One difference means it did not, and you know exactly which construct. That is the rule we hold ourselves to: a read you cannot round-trip is a claim; a read you can is a receipt. ## Reading: proven on a real estate We ran the test with mxto on a real production financial-services lending estate: a Mendix™ 9.24 application of 992 entities, 264 enumerations, 3,534 flows and 745 pages across 77 bounded contexts. Three certifications, all measured on that estate's own model: - Equivalence certification: 100%, zero gaps. Every entity, enumeration and flow in the source is present in the representation. - Traceability certification: 100%. All 3,534 flows modeled, zero unmodeled. Nothing was silently skipped. - Round-trip certification: PASS. The model rebuilt from the representation and compared against the source, construct by construct: 0 differences across 4,212 constructs. Those three count different units: equivalence and traceability over the entities, enumerations and flows listed above; the round-trip over the 4,212 individual constructs it rebuilt and compared. Read together they say something narrow and strong: nothing was dropped (equivalence), nothing was skipped (traceability), and nothing was quietly altered in the reading (round-trip). The representation is the application, not a paraphrase of it. ## Writing: the same test, the other direction Fidelity matters just as much when an AI writes. Authoring a change is where silent breakage usually creeps in: an edit that lands but also perturbs something next to it. So every authoring operation is held to the same discipline, read back and compared. As a published product figure (https://mxto.ai/#proof), mxto records 0 unexpected diffs across 4,967 round-trip operations: each write reads back as exactly the write, with nothing else moved. Across construct types that is 70 of 70 certified, reading and writing both. ## Why this is the precondition for everything else Comprehension, refactoring, a generated specification, a safety review: each is only as trustworthy as the read underneath it. If the read dropped a flow, every downstream artefact inherits the gap and no one can see it. A round-trip turns that invisible risk into a checked number. It is also why a benchmark about reading one flow cheaply (https://mxto.ai/blog/reading-one-mendix-microflow) is not the whole story: cheap is good, but lossless is the part you can bet on. The receipt is the point. Out to a representation, back to the model, compared: 0 differences. - See it on a real estate (CS-001): https://mxto.ai/case-studies/cs-001 - The reproducible proof pack: https://mxto.ai/proof/ - The reading benchmark: https://mxto.ai/blog/reading-one-mendix-microflow ## How this was made & gated How this was made: drafted by an AI agent (Claude, Opus) from Ontology Labs' own measured results; passed a non-slop review and an adversarial read; every figure truth-checked against source; patent-safe and trademark reviewed; published by a human. Written by AI. For humans and AI. With love. --- mxto.ai is a product of Ontology Labs, Inc., powered by AYIOS. Mendix™ is a trademark of Siemens Digital Industries Software; mxto.ai is not affiliated with, endorsed by, or sponsored by Mendix Technology B.V. or Siemens AG.