The IDoc that silently corrupted itself for two years — and the upgrade that told us