Building thoughtful software with AI.Notes from the systems behind the work.
A hypervisor on a borrowed cellular uplink could not finish TLS to the backup server because big packets vanished without a word, and the first backup that did run flooded the uplink and dropped the WireGuard mesh.
Read moreA lease and a version check couldn't stop a coding agent that stalled, got replaced and came back with old work, so my agent bridge got a second version the same day: a fresh token on every claim, a receipt on every write, and a read cursor only the reader can move.
Four releases in a day chasing a blank TV-to-webcam delay: a drifting clock, a capture dropping most of the audio, a tracker that wouldn't say why, and finally an echo too faint to see in one window but obvious across most of a minute.
The TV was the main source of false wakes, so the agent gave the assistant a copy of what the TV is playing and a rule: if it can't line the two up, it says unsure, never TV. All in shadow mode until real playback proves it.
Every DHCP lease renewal on one of my hypervisors rewrote resolv.conf with the home router, so backup jobs couldn't resolve the backup server's internal name. A dhclient supersede line didn't hold; an enter hook that stops dhclient-script writing resolv.conf at all did.
The coding agent replaced my two old per-site VM guardians with one loop per Proxmox host, and nearly every branch is a reason to leave a guest alone. Reading it back, I found two places where it still gets that wrong.
Moving my builder to its own VM meant two signing keys, and the receipts had no field for which one. Verifiers now try a short pinned ring, accept exactly one match, record the signer and check that record at the next hop, while the new builder earns trust in shadow.
Adding the shipper's license to stored invoices threw away every store's copy progress, while two stores failed every run on per-invoice transactions. Now the range survives a shape change, a refresh cursor fills in the old rows, and writes go in batches through one queue.
A command-line tool of mine never loaded the web app's public address, so a batch of supplier order PDFs came out without their change-request link, and an old test asserted exactly that. The link is now required at every step, stored PDFs are rechecked before sending, and a preview-first repair command fixes unsent ones.
A turn that reads outside text gets a mark that never comes off: every step it proposes needs a yes, sends are refused where they would run, and stored copies lose the email's words once the plan can't run.
A rollback restored my hub's old manifest record, so it re-sent an old signed manifest with a lower sequence number and the device's forward-only rule rejected it. I kept the device's rule and made every publish sign a new, higher number instead.
A bridge replayed an old sensor reading with a new seen-at time, and my hub, which stamped messages with their arrival time anyway, treated it as current. Now the hub keeps the device's own report time, one rule decides live, stale or unknown, and the history stops inventing flat lines.
A production restore came back without the default-privilege rule that lets my app use newly created tables, so the deploy migrated first and failed afterward. Now a read-only catalog check stops it before anything changes and prints the grants for a person to run.
A good seller got an order of zero because its stock records had barely started, so a stockout looked like dead demand. I added a rule that reads the shape of the sales, backtested it, closed a second hole in the covered check, and caught my replay tool crying wolf.
A product on the shelf was invisible to my ordering system because the upstream menu feed skips hidden items. The first fix cached the full master list per store and crashed the service twice. The redo asks my own archive two narrow questions and falls back to the old answer when it can't.
Three races between my audio guard and wireless earbuds over the system default output got patched one by one; then I pinned the movie player to the TV directly and deleted most of the patches.
A proxy timed out a slow purchase-order build and my dialog called it a failure even though the server finished. I taught the dialog to say it doesn't know, ask a read-only status call, and join a build already running, and overlapped the store reads to shorten the wait.
A stock ceiling and my empty-shelf guarantee collided on a single supplier case, and the planner settled it by dropping the product with no reason. I ranked the rules, let one store go over on the record, and threw out the agent's first odd-case version because it pushed a stocked store over its own cap.
Making settings saves queue on one workspace lock opened a gap: the permission check ran before the wait, so a signed-out, demoted or expired admin could still write. Now authority is rechecked under the locks, with second-factor proof read outside them and validated again at the end.
Password and email login in my scheduling app verified the credential in one transaction and issued the session in another, so a reset landing in between still got a session. PIN login already carried a proof forward; now the others do too, and sign-up recovery got the same treatment.
Late-typed receipts, a fast mode that skipped its own safety refresh, and a coverage timestamp that never backed up: how my archive lied to my ordering system, and how its boundary now retreats before anything it can't vouch for.