Building thoughtful software with AI.Notes from the systems behind the work.
Restarting a stopped machine is one command; a trustworthy auto-healer is defined by its refusals: deliberate stops, locks, storage errors, retry budgets, and a rehearsal mode, all published as metrics.
Read moreA proxy timed out a slow purchase-order build and my dialog called it a failure even though the server finished. I taught the dialog to say it doesn't know, ask a read-only status call, and join a build already running, and overlapped the store reads to shorten the wait.
A stock ceiling and my empty-shelf guarantee collided on a single supplier case, and the planner settled it by dropping the product with no reason. I ranked the rules, let one store go over on the record, and threw out the agent's first odd-case version because it pushed a stocked store over its own cap.
Late-typed receipts, a fast mode that skipped its own safety refresh, and a coverage timestamp that never backed up: how my archive lied to my ordering system, and how its boundary now retreats before anything it can't vouch for.
At my request, the agent ran a language model beside my ordering engine, picking from a menu of legal quantities into tables no order ever reads. Its first timer only stopped the waiting, not the work, so it got a short budget and a real cancel signal.
The agent's first audit of my new case planner diffed it against a fresh run of the old allocator, which only proved two formulas disagree. Replaying real accepted orders showed the planner doesn't cover most of what the stores buy yet.
A failed upload would have left its partial archive behind because the cleanup only learned the file's name from a return value. I fixed that, then built a scheduled cleanup that decides what it must keep before it deletes anything, checks every target on its own, uses a lock that dies with its owner, and retries an upload exactly once, only when it runs out of disk space or quota.
Tuning into one of my home-made channels always played the first item from the top. Now a channel is a half-hour clock: the hub works out what would be on and how far in, starts there, then reads back where the player really landed and seeks once if it didn't listen. Long movies are still stuck in their first half hour.
The slowest assistant job, building a reorder, ran inside the request on an in-memory approval token, so a timeout or restart left nobody knowing whether a draft order existed. Now apply writes a synced journal entry before it answers, workers hold fenced leases, an old approval can never restart a job, and an expired lease reads as interrupted rather than failed.
Reviewed purchasing plans were stamped by the database clock and checked against the app server's clock, so a few seconds of skew could make a brand-new plan look like it hadn't been made yet. The authority checks now read the database clock once, in the same transaction (right under the locks, for approval), with no fallback.
A helper in the relay feeding my ordering system made an empty list out of error objects and blank bodies, and passed partial pages on as complete; now it rejects the malformed and partial answers it can detect, keeps honest empties, and says plainly what it still can't detect.
A vendor too big for my own import guard forced me to split the catalog lookup into slices. Cutting the question up was a loop; joining the answers was where it could lie, so every slice now has to agree on scope, store state and product facts or the import stops.
A nightly copy of this box's backup repositories now goes to my NAS and proves where it's writing before it writes, and I also fixed a checksum that would always fail for the wrong reason and an install guard that could never fire.
The one worker that drives a headless browser only learned at job time whether a browser existed, because the browser lived in a user cache instead of the release. I sealed it into the release with a manifest, made health refuse promotion without it, and then caught my own guard looking for it in the wrong folder.
The remote and movie launcher were built to resend a press that came back unclear, which turns a lost answer into a second command. I ripped the retries out, made the remote look before it sends, and gave the server a receipt for every press where "not sure" is a wall, not a reason to try again.
The production deploy could only start over after an interruption. Now it pins one exact commit, records each phase on the production host, checks the database early without writing, waits for other people's runs instead of quitting, and keeps waiting time off the release clock.
A single tap on the media panel could send one title several start commands. I removed every retry, then brought them back the same day with a check of what's already playing before each send.
A browser test accepted an unattended confirmation and cascaded a delete through a shared seed store in my local test database. Now every destructive test request has to prove the database is disposable and that its run owns the exact record it touches.
The lease guarding my long supplier setup job only checked the owner's name, judged expiry by each worker's clock, and never renewed during slow phases. Now every claim bumps a fencing token, every write checks it against the database's clock, the phase-advancing writes also check the phase they expect to leave, and a heartbeat keeps slow work alive.
The nightly audit job read back each task's due date and could flag correct handoffs as failures, because the task tool fills a date-only due date with a local morning hour whose UTC hour shifts with daylight saving. The check now compares by day when only a day was sent, and a tightly gated command can finish handoffs that were wrongly marked failed.
A guard that rejects suddenly shrunken stock snapshots had no way to accept a real drop, so I made a failing feed ask its sibling feeds to agree on size and items before it gives up.
A deleted-and-recreated cart line looked identical to my snapshot check, so reviewed checkout now trusts a database-owned version number and a one-time receipt instead of a comparison.