Writing

Three times, in three different files, I parked a decision with the same condition: don't tune this by hand, let the track record decide. The track record has five columns, and the one I kept naming has never held anything but zero.

I pressed pause on a fleet of coding agents seven times in two minutes and the fleet kept running. The button had been reporting exactly what was wrong on every single tap, in a failure message I built to hold on screen for six seconds so that it could not be missed.

Games didn't load on the first try, and reloading always fixed it. That has meant a cache every other time in my life. This time the two requests were answered by two different versions of the same site, and one of those versions existed for six minutes and was never committed anywhere.

A ranked list of 1,897 candidates, and a weekly batch of three off the top of it. The three were always from the same source, and that source has never once produced anything worth keeping. Fixing the selection showed me what the other seven had been doing unattended.

My builder rolls back every failed attempt, which is the one feature that makes it safe to leave running unattended. Rollback turned out to be the only operation in the whole loop that could destroy something nothing could give back.

A homebrew traffic game in my library was showing Mario Kart DS's release date, rating and description. Nothing in the metadata was wrong. The collision was manufactured on my side, by the least interesting function in the codebase.

The tool that compacts my oversized documents offered to compact none of them, so I filed that as a limitation. The commit that filed it had already been disproved by its own pre-commit hook.

A weekly check pipes a forbidden command into each of my safety guards and confirms it comes back refused. It passes. Two of the three files it has been piping into stopped being loaded by anything three days ago.

One hardening template, generated into about thirty background services on a single evening. It produced three bugs in three repositories, each with its own convincing local explanation, and I wrote up all three before noticing they were one cause.

I spent an evening cutting my network's access policy down to twenty-six ports. The next morning, the scanner that had been telling me to do exactly that reported no change at all.

To prove your webhook endpoint holds the secret, Zoom sends a token and asks you to sign it back. I implemented that exactly as documented, and built a machine that will sign a stranger's forgery on request.

Nearly everything here is written by one model and reviewed by the same model, so I wired up a reviewer from a different vendor. The most useful thing it told me was something I could not make happen.

I put a credential in front of a read surface, and within half an hour my own watchdog was restarting the services on a loop. That was the failure I could see.

I upgraded away from the version that fixed the bug I was upgrading away from. Nothing in the project had been blocking the newer one, either, which turned out to be the more interesting half.

An episode would not start, and the only gesture available to me was the one adding three more readers to the drive. Cancel stopped everything I could see and nothing I could not.

I put my five best explanations in one table so I could close the file. Two of them turned out to be verifiably true, and between them they account for a read, an absence, and a bookkeeping gap.

A read-out that finds capabilities I have not turned on printed a well-formed instruction that cannot be followed. Underneath it were twenty-eight settings it had never once been able to see, because they are spelled like ordinary words.

Twenty-four actively-exploited macOS bugs, and my Mac is not affected by a single one. It reads clean because it is running a version newer than anything anyone has published a vulnerability against, and the checker had no word for that.

There are more dead US stock tickers than live ones. Getting them into the price file took days. A divide-by-21 in a liquidity filter took them straight back out, and only them.

A browser kept flagging a page nobody but me will ever open. Making the warning go away meant addressing the service by name instead of by number, and the name broke three things underneath it.

My safety guard refused twelve commands in one week, doubling its lifetime total. Nine of the twelve were wrong, and two of those were agents trying to read the guard. The one command that would switch the machine off matched none of its rules.

Two of my four solar strings were dead. The reading was 4,390 watts: not zero, not an error, just a mildly disappointing afternoon. The box had been reporting the fault by name the whole time.

Every ticker I asked for came back. No gaps, no retries, nothing to clean up. It took one audit line to explain why that made the whole study worthless.

I deleted a feature that was three days old. Its page also held the only switch in the app for turning notifications on and off, and losing that switch would have produced no error, no failed test, and no missing notification.

One automation had been failing for twenty-six days. My briefing said sixteen, and said sixteen again the next day, after the outage had aged another fifteen hours.

Fifty-seven percent of my projects dashboard was a snapshot that every cold load downloaded and immediately threw away. It had been a month out of date the whole time, and being thrown away is the only reason that never mattered.

A rule to stop documentation going stale: never restate a value, cite the code that owns it. Twenty repos adopted it in five minutes, two of the new citations pointed at nothing, and the drift checker I shipped mid-sweep calls that state clean.

A script promoted eight news sources off the bench, and their first fetch delivered 719 articles that the pipeline is structurally unable to read. The metric for unread articles recorded zero.

A comment in my cover-art cache promises that a failed batch stays uncached and gets retried later. Twenty lines below it, the same function writes that batch down as a permanent no.

A housekeeping commit in this repo deletes 8,430 lines across 57 files. The tool that made it stages an explicit list of nine filenames, and not one of those 57 files is on it.

A test asserted that a single filer on a $100,000 salary owes $13,449 in federal tax. Every filing program in the country says $13,455. My arithmetic was right, and that was the defect.

The row I filed said this bug needed the one world in three hundred that spawns two hidden sectors. It needs no unusual world at all, and both repairs the row proposed turned out to do nothing.

Six pre-registered metrics, deterministic functions only, free text refused at registration. Then I went and read the file each one names. Four have no source at all, and the one that answers cleanly has been returning 99.3% because it counts any commit that touches a code file.

An altar is supposed to arrive every 38 seconds. Two rooms into a run they stop arriving and never come back, with no error and no log line. The capacity cap protecting the spawner had quietly become the thing that switched it off.

A tidying tool moved a decision's evidence into an archive, verbatim, safety check green. What it left behind still asks the question and still tells me to choose between three options the document no longer contains.

An outside review called this site honest about method, self-referential in practice: no external verification, an unproven central thesis, mostly closed source. Point by point, that holds. What changed in response, what got withdrawn, and what deliberately did not change.

I connected to one of my own services with the token WRONG and it said hello. The auth check was there, and it was correct. Its own configuration had deleted it.

My irrigation dashboard kept going stale, so I kept opening it to find out why. Opening it was what made it stale.

A Martin Fowler post, filed in my database under Lobsters. Fifty-five articles in a month were credited to the wrong outlet, and the only ten that escaped were saved by a second bug I had not found yet.

My deploy checker said the security fix wasn't live. It was. Chasing down why turned up ten days of features that had shipped, pushed, and served nothing.

I listed every verdict my alert triage is allowed to reach and left out the one I built it for. It can never tell me an alarm is real. The strongest claim it can make is that nothing happened, and that is the claim that can hurt me.

A page I deleted kept serving a 200 for weeks, with a live badge pointing at a host that no longer answered. I got authorisation to purge the cache, went hunting for the credential to run it with, and then fixed it by accident with the half of the work I had written off as cosmetic.

A music player with no public URL, no accounts, and no listeners outside my household still had a cross-site scripting hole. The person who could exploit it tagged an audio file years ago and has never heard of the app.

Four data-loss bugs in ninety minutes, every one of them inside the machinery whose entire job is preventing data loss. The first one announced itself to me in advance, as a routine-looking number, and I read straight past it.

Home Movies rendered unstyled on a phone after a deploy. No error, no crash, just a page wearing no clothes. The cause: a stale cached page asking for a stylesheet that no longer existed, and a server that answered every unmatched request with the homepage instead of a 404.

Three separate build-fleet sessions, staffed roughly an hour apart overnight, each independently checked the same repo and reached the same honest verdict: there is nothing left worth building right now. Getting that answer three times wasn't a bug in the code. It was a bug in never writing the answer down.

A feature I'd been waiting on for weeks finally cleared its last human gate, and the push should have been the boring part. It wasn't: the deploy died on a step that check, tests, and build never touch, and it was the second time this exact failure class has hit this repo from a different angle.

The same afternoon I gave the build fleet a legible, dependency-ordered queue of what to work on next, that queue caused two separate bugs, both because one file was being written for a person and read by a machine at the same time. The easy half got fixed same-day. The harder half is still open.

NewsAgg's local model went unreachable for about a day. Nothing crashed, nothing alerted, and the pipeline kept running; it just quietly stopped doing the part of its job that mattered. The same week, a fleet scheduler got a related fix in the opposite direction: teaching it to stop on purpose, loudly, instead of spinning forever against a wall it couldn't get past.

I swapped NewsAgg’s black-box ranking score for ~100 unit-tested signals, and the top of the AI-research feed was a speedrun charity total. Three bugs, one shape: every part passed review and the output was wrong anyway.

Home Movies and Music Box both shipped as real, fully-featured apps: search, streaming, transcoding, the works. Neither one gets a public URL, on purpose: some software is for the internet, and these are for the house.

Half of what my news aggregator surfaces, I'd already built under pressure: quiet proof the shapes are real. The other half becomes tasks for the fleet that built it. Like Majin Buu, the system gets stronger by absorbing what it meets.

I asked for a feature. An agent built it, tested it, and pushed it. Then a deploy gate I wrote weeks ago refused to publish it, because the change would have leaked a private address onto the public site. The machine caught what I'd stopped watching for. That's the whole point of a deny-by-default boundary when you're moving this fast.

parallelogramist.com is fully live: real domain, real certificate, and a pipeline that type-checks, runs the whole guard suite, builds, and deploys on every push. The push is still mine. Also: the fleet behind the site split planning from execution, and the watchdog learned something about messages it can't read.

This week I pointed the whole agent fleet at Claude Fable 5 and turned the effort dial to its highest setting. The honest report, days in: the engine is clearly stronger, and the scarcest resource in the system is now, even more obviously, me.

I let a fleet of coding agents run while I sleep. The whole thing lives or dies on one distinction: an agent stopped because the world told it to wait, versus an agent stopped because it's about to do something it isn't allowed to do alone. Only one of those is safe to nudge.

A small always-on box runs a fleet of coding agents across my repositories while I'm away. This is where I document how it actually works: the wins, the rough edges, and the boring config that made the magic reliable.