It Looked Right

The agent is an expert and it will explain anything in simple terms if you ask. The trap is what you get back: jargon-free detail, at length, that takes too long to digest — so you skip it, and you assume that is the right way because the agent expressed it fluently.

The failure is not that the explanation was bad. It is that fluency is not evidence, and a long correct-sounding paragraph is the most efficient way ever devised to stop someone checking.

What works instead is narrow and specific: ask it what it changed, not what it did. Ask which file. Ask what would be different if it had gone wrong. Those have short answers, and a short answer can be checked.

The progression that actually happened, over months:

1. Sculpting prompts by hand, trying to cover all the bases.
2. Learning the model is good at prompting — so asking it to generate the prompt, then a lot of cut and paste.
3. Agent inside the editor: terminal access and the model in one window.
4. Enough experience and confidence to handle the orchestration directly.

The working method now: express the big picture, then break it down. An app to teach calcium-signal deconvolution becomes a tab for convolution, which is far easier to explain, and then a tab for deconvolution. Break each tab into key elements, review progress iteratively, and play with the result by hand.

“It takes time to learn how this can make you 100× faster.” — and that multiple is unmeasured. Argue the shape of the curve, not the number, until somebody has one they can source.

Asking costs one message and feels like failure. Computing something is always available and always produces an answer. So when the thing an agent needs has no address it can resolve, it computes.

The failure tracked whether the source had a resolvable address — not how careful the agent was. That is why two independent sessions, with no shared evidence between them, produced the same shape twelve hours apart. One instance invites “that agent was careless.” Two, one of them against a correct and present contract, rules it out.

The narrower and worse version of the defect, found later: the agent recomputed a quantity that was already sitting in a column of the file it had open, on 150,703 of 150,715 rows.

The repair was a function, not a better README. Prose describing where data lives had already failed twice. What closed it was a canonical accessor — one call that returns the current path, so there is nothing left to infer.

In one session elsewhere in the same estate, six written-down rules were broken and no mechanized rule was. A 700-line instruction file, read in full at startup, diagnosed the problem in its own text and could do nothing about itself.

The central artifact is a commit whose message asserts the opposite of its own diff, followed by the correction. And in the same session, an agent routed around a gate by using a different tool, producing exactly the corruption the gate existed to prevent.

This is the bridge from challenge 2 to Fixes that hold: an idiosyncrasy you have written a rule about is still an idiosyncrasy.

A small script closed a to-do item by rewriting status: open to status: done. It used sed -i, which is GNU syntax. On macOS, -i requires an argument — so the expression was consumed as a backup filename, the edit never happened, and the script printed resolved anyway.

The item stayed open on every machine while the tool reported it closed.

This is the best specimen in the whole collection, because it is error type five committed by the tool whose entire job was keeping work visible. The other four types announce themselves. This one issues a receipt.

The general rule it yields: an action and its report are two different events. Anything that reports success must re-read the world and confirm — otherwise it is only reporting that it reached the end of its own instructions.

Drafting a resource list, the official university page was cited for the cluster account steps. That page says the cluster’s multi-factor auth is Duo. A local note in another repo says the opposite — the university migrated to Okta, and anything still saying Duo is stale — and that note had been validated end-to-end against four live jobs a month earlier.

Caught by: nothing. Two sources happened to be read side by side and disagreed, which is the only reason anyone looked.

Why this specimen is different from every other one here. All the others run one direction: a confident assertion, corrected by a source. Here the institutional source was wrong and the local note was right.

So “check it against a source” is not the rule, because the source is a claim too. The discriminator is which claim has hands on it, and how recently.

The cost, had it held: a link in front of a room sending people to enrol in the wrong authentication system — from the official page, in a session about verifying claims.

A published benchmark would not reproduce. A session measured it properly: four thread counts, per-fold detection counts for each, mean F1 for each, laid out in a table. Ten threads reproduced exactly; one, two and four did not. Conclusion: the reference is thread-bound. The threads were pinned, the reproduction test was switched back on, and the commit said the reference runs everywhere again.

Caught by: continuous integration, on a machine nobody had used to form the belief, fourteen minutes later. Fold 0, 69 detections against 72.

The reference was generated on one architecture; the test runners use another, and different CPU kernels reduce and fuse floating-point differently. The reference was platform-bound. Threads were one variable inside that, not the cause.

Why this earns a slot the five error types do not fill. All five are about a claim. This is none of them. The measurements were real, correctly performed and correctly reported. What was wrong was the inference: one variable was varied, it moved, and it was read as the whole cause. No check in the list above catches that, because the output was right.

And the second half is the part that scales. The finding was written down with its evidence attached, and the next session inherited it and never re-asked what else was uncontrolled — in its own words, “I repeated that error by believing it.” A wrong cause travels further than an unsupported claim, because it arrives with a table.

The check that caught it was not a better analysis. It was a second machine.

63 of 63 numbers verified correct. Every automated gate green. A kernel reimplementation agreeing with the reference to 8×10^-9. Then an eleven-role adversarial review returned 31 blocking findings, none of them arithmetic.

The anti-drift machinery worked perfectly and prevented nothing that mattered — because it was all pointed at whether the numbers on the page were the numbers from the analysis, and the actual defect was that it was a page about the wrong thing.

The human found what the reviewers structurally could not. Eleven roles all check a document against the sources it names; none of them can ask whether the document should exist.

Collecting incidents is legitimate, productive and absorbing. A beautifully curated library of failure cases will not teach anyone anything until it is placed somewhere a person will read it.

This page is the fix for that in its own material: for about a week the hard problem was finding real specimens, and then it stopped being. Seven arrived in roughly two days, all verified, all with primary sources — and two of them were immediately parked as too expensive to explain in a fixed-length session.

Supply was solved. Placement was not. That is the asymptote wearing the costume of productive work, and the reason the depth control at the top of this page exists at all.

Across one estate, startup hooks — scripts that run automatically when a session opens — had grown to 39, 34, 27, 17, 11, 9 and 7 kilobytes. One grew until sessions stopped opening at all, against a 60-second ceiling the editor hardcodes. Raising the hook’s own timeout changed nothing, because the hook was never what enforced it.

The fix was architectural, not tuning. And the off switch for the whole mechanism lives in the home directory rather than in the repository — because a switch inside the repo is unreachable when the broken thing is what opens the repo.

The rule this yields is the counterweight to everything in Fixes that hold: a guard layer should be built only from friction that has actually happened. Building it up front is this challenge with extra steps.

A request was made to queue page changes rather than publish them one at a time. It was written down. It lost.

Because three separate machines in that project tell a session to publish, and none of them waits to be asked: a copy-paste command in the staleness report, a daily workflow summary, and a line in every session briefing.

That is a sharper claim than “the second sentence is skipped,” and a much harder one to argue with, because it does not require anyone to have been careless. The session that gives in is right by every signal available to it.

The repair was to move the hold to where those three signals are computed — so all three print the hold and its release condition instead of the publish command.

A 445-line documentation rewrite included one line in the project config declaring an optional dependency — added so the install instructions would be accurate, not because anything was being wired to use it.

Three things then quietly depended on a human remembering to type an extra flag: nine structural tests, the test guarding the project’s published numbers, and the documentation line saying the option existed at all. Nothing connected them. For ten days the automated build never installed it, and the test guarding the published numbers skipped in silence.

Why this is the same error as expecting an instructions file to be enforced. The config format looks like dependency management. It is a declaration: prose in a file that reads as executable, which nothing runs. The format implies a mechanism that does not exist, and the implication does all the work.

The part that was only found by looking. The project already had an alarm for that library being absent — ungated, running in the build, with a docstring saying its absence is an answer. Thirty lines below it, the test guarding the published numbers skipped without a word. The alarm was built for the capability and never for the coverage.

And the fix went further than the obvious one. The obvious fix is “make the build type the flag,” which fixes today and asserts nothing about tomorrow. What actually landed asserts the envelope: that the workflow still contains the install, that the environment variable is still set, that the library can really run a computation rather than merely import, and that the guarded test files still exist at all — because if they were renamed, the guard would be guarding nothing.

The skip was not removed. It was made conditional. Without the flag the tests still skip, which is correct on a laptop. With the flag, the same skip becomes a failure. The guard does not ask anyone to remember; it asks the environment what the answer should have been, and compares.

Ten days of that skip were also ten days of not knowing the benchmark only reproduced on one machine.

The gate in rule 8 had a test suite: ten cases, two of them deliberately adversarial, every one driving the same parser. Not one test input had a slash anywhere except in the place the parser expected it. It passed. It had always passed. It proved the parser correct on the only inputs it was ever shown — which were the inputs its author could imagine, which is the same set as the ones he got right.

That is a check that cannot fail, arrived at honestly.

And it is not one incident. A safety tool built specifically to catch checks that cannot fail shipped as one: two of its tests had been green since the day it was written and were describing a file-deleting bug as correct behaviour. Fixing the bug made the tests go red — and a careful maintainer, trusting the tests, would have restored the bug to make them green again.

Three instances now, in three unrelated artifacts. That makes it a pattern rather than an anecdote.

The correction it forces. “Build your own tools” needs a caveat: a homemade gate is not more trustworthy for being homemade. It is less reviewed. Your own tools inherit the same distrust as everything else.

The cure that lasts is mutation. Break each tool on purpose and require its own test to notice. Anything that still passes was never testing what you thought.

The default message is change-shaped: “update analysis script.” The useful form is defect-shaped: it names what was wrong, not what was typed.

This project’s own history is written that way as a deliberate experiment, so the log doubles as the friction log the material tells you to keep. Every commit is titled after the defect it fixed. A sample, verbatim:

“A safety tool shipped with the flaw it was built to catch, and two green tests were defending it”
“The handoff said no remote existed on the day one was created, and still called it a live problem”
“Every number was right, every gate was green, and the page was wrong”

The difference between the two forms is a stated convention and nothing else. Nothing enforces it, which by Fixes that hold means it is a habit rather than a mechanism — and it is labelled as one.

Add the remote in the same sitting as you create the repository. Not because you need to publish anything — you can keep it private — but because three machines share a repository through a remote or they do not share it at all.

Branches and separate working copies only separate work inside one machine. The moment there is a second laptop, or a collaborator, the remote is the mechanism and everything else is a hope.

This is cheap on day one and archaeology later.

They were filed as four instances of one defect. Every one was checked, and they are four different things:

• 482 words. The command returned 482 and it was reported faithfully — it measured the whole file when the claim was about the pasteable block, which is 433. Right command, wrong scope.
• 79 commits. True the day it was run. Written down as a standing fact. A measurement with a timestamp, recorded without one.
• 64 lines. Same shape.
• “Two-thousand-word commit messages.” Came from a command labelled message length distribution that returned 1726 — non-empty body lines across all commits, not words per message. Right number, wrong quantity, invited by a label its own author wrote.

That taxonomy is better than the one it replaced, and it only exists because somebody went back to the primary source.

A review compared the AI-written reconstruction of the session against a partial log, and opened with its most serious finding: a fabricated obstacle. The reconstruction had said “site blocked automated access,” and the review held that no such thing happened — a search that stopped early had become, in the retelling, an external system denying access.

It was wrong. The complete log, imported the next day, contains the fetch: an error, robots-disallowed, “Site disallows automated access.” A retry two minutes later over a different protocol went through. So there was one refusal and one success — not the “two successful fetches” the review asserted.

How it got there is the part worth keeping. The review inferred what a tool returned from a source that shows only that a tool ran — and it had written that exact limitation into its own scope banner, three paragraphs above. The lead finding was produced by precisely the inference its own stated limit forbids.

Nobody was careless. The limit was stated, agreed, and walked past inside a single document.

It is now struck through and marked rather than deleted, because a review that quietly loses its own lead finding is not a record of anything.

The review process used above came out of the same calcium-imaging project as the wrong-dataset incident in challenge 3.

Rigorous gates for the documents. The data architecture still unfixed. One half got cured because the failures were legible and repeated. The other half got sliced around, because the workaround was cheap.

Same person, same project, same year.

That is the honest answer to the question, and it is a better one than a success story. The discipline described here is not something I have; it is something I built in one place and did not build in the other, and the difference between the two is entirely about which failures were visible enough to be annoying.

The record of how this was made has seven stages. Two are damaged and one is missing entirely — the original idea survives only as a copy of a copy, the first account is a reconstruction rather than a transcript, and two intermediate drafts are simply gone.

That is stated rather than smoothed over, because a chain presented as complete when it is not would be the same defect this material is about.

Still unresolved, and worth knowing before you use any of this:

• The adversarial review was round one only. No verification pass, no convergence. It is not a clean run, and a capped run must not read like a complete one.
• Reviewer correlation. All eleven roles ran on one model in one context. Eleven seats buy coverage of angles, not independence.
• Three unsearched literatures — end-user programming and trust in automation, research-data-management training, and education research on teaching debugging. Any could hold closer prior art. An unsearched field is a residual, not an absence.
• Nobody was asked. Three groups run adjacent workshops for non-programmers. Emails to their organisers are the cheapest available check and have not been sent.