We had a shared secret scanner. We had a comment saying it covered every path that assembled context and sent it to an external model. Both were true right up until they weren't: one assembly path had quietly grown up without ever inheriting the scanner. Nothing detected the gap, because the claim o...

When a secret scanner rejects a symbolic environment-variable name instead of a credential value, the visible bug looks like a false positive. It usually is not. The durable defect is duplicated security policy—the same rule implemented independently in several paths—creating inconsistent behaviour,...

Making parallel work safe is not just creating a branch earlier. The durable fix is a lifecycle isolation model: reserve identity before the first durable write, give each item its own worktree, treat the active worktree as execution truth, and prove ownership before any rollback deletion.

The prob...

A governed workflow can block premature execution and still record a lie. When durable state says you have reached the next stage while a human gate is still pending, dispatch protection alone is not enough. The fix is to align three truths: the recorded lifecycle stage, the gate status, and who is ...

A request to "add a spinner" often hides a distributed-state problem. If the object stays on screen while the action runs, the product needs task-scoped pending feedback, blocked repeat actions, settlement through refreshed data, and a single clear progress indicator—not just a visual loading state ...

A command that stops for human review can look like a failure if you read only the process exit code. The durable fix is to classify structured outcomes deliberately, preserve evidence on every path, and assign exactly one owner for failure output.

The problem

The symptom was familiar: an interact...

When a worker occasionally returns malformed Markdown, the visible bug looks like a formatting mistake. It usually is not. The durable fix is to align the worker prompt, canonical grammar, parser, writer, diagnostics, and documentation as one contract family—and to classify every rejection with a de...

When an operator types a repository path and the system disagrees about spelling, the visible bug looks like a casing or formatting problem. It usually is not. The durable fix is to reconcile Git's registered worktree identity against the filesystem object identity at the shared authority boundary —...

When a framework removes a familiar developer command, the visible failure often looks like a one-line script fix. It rarely is. The real work is usually a small tooling migration with several coupled defects—and a design decision about what "fixed" actually means.

The problem

The symptom was simp...

When a package manager or launcher injects environment variables that look like user preferences, your CLI may honour a choice the operator never made. Treat wrapper provenance as part of the product path—and test through the wrapper that broke you.

The problem

The symptom was familiar: an operato...

Week-specific columns looked empty while a new period loaded. The instinct was to add a spinner. The real problem was state correctness: the interface could filter old data against a newly selected week, accept obsolete fetch results, and leave stale controls actionable.

The problem

The surface sy...

Restoring a clean high-severity dependency gate sounds like a package upgrade. Often the code change is tiny—a lockfile override, a regenerated lock, two files touched. The hard part is proving you fixed the right thing without weakening CI policy, broadening scope, or writing acceptance criteria fo...