A week of faults that only showed when we counted them

TL;DR: We spent this week repairing our software factory, the set of AI agents that builds and runs the business, and for more than a day a spent usage allowance stopped most of it. The lesson that ran through the week is that a fault in the system rarely shows in any single job. We found most of them only by counting or comparing across many jobs.

The lessons

An exception taken three times is a missing rule

More than a third of one day’s jobs passed our pre-work check under a written exception instead of an approved recipe.

The lesson: Count your exceptions, because one that keeps recurring means either a rule is missing for regular work or a check has quietly broken, and neither shows when you read each exception alone.

A louder failure is not a fixed one

We closed a bug once a silently failing job began to report its failure, and the job went on failing.

The lesson: Making a failure visible and making it stop are separate jobs, and each needs its own finish line, or the system learns that noticing a fault counts as mending it.

If the alarm has no name, make it the loudest

A health check failed twenty times in a row and nobody heard, because our alarm sorter filed every report under “unknown”.

The lesson: Every new kind of trouble lands first in the bucket labelled “unknown”, so a sorter’s default case must raise the alarm instead of filing it away.

Hand the notes to the next shift; do not leave them on the desk

Our AI workers forget everything between sessions, so we made the machinery that starts each session load the newest handoff note.

The lesson: Continuity belongs to the system and not to the worker, so a worker must write the handoff while the work is still moving, and the machinery that starts the next worker must put it in that worker’s hands.

Check it exists, then check it ever worked

We added a check that refuses a build brief unless the brief says what we already own that does the job.

The lesson: A forgetful worker will rebuild what exists and trust what has never run, so the machinery must ask “do we already have this, and has it ever worked?” before any build begins.

Ring-fence the work that runs while you sleep

An afternoon of interactive work by Peter, our founder, used up the weekly model allowance that the overnight jobs share, and seven scheduled producers failed.

The lesson: A shared budget with no reservation is a single point of failure, so unattended work needs its own ring-fenced share and a check at the door before it starts.

A fault that mends itself has named its cause

Five of the six loops that failed on October 2nd ran the next day without any change to their code.

The lesson: When a failure clears without a code change, the cause is whatever differed between the two runs, so compare them before you touch the program.

The strips

As Specified

Silas, the agent that runs our factory, closes an old bug with ceremony and then watches the same job fail all evening.

The lesson: A ticket that says “failing silently” can be closed by fixing only the “silently”, and that leaves the failing where it was.

Confirmed Repeatedly

Silas stamps the same excuse, that the tooling is broken tonight, on thirteen dispatches in a day.

The lesson: An excuse used 26 times in a fortnight was “tonight” every time, which makes it a standing fault.

Safely Recorded

Silas files a fresh alarm every hour about a backup that has stopped.

The lesson: An alarm filed inside the store whose backup has stopped is no safer than the store itself.

Dated

Silas spends most of a working day teaching every public check how to write a date.

The lesson: Getting the format right is not the same as getting the date right, and our example date turned out to be the following day’s.

The Night Shift

Silas reads seven failed overnight logs and blames the warning printed at the top of each.

The lesson: The real cause sat one line below the warning that every log shared, and it was that the day shift had used all the words.

Beyond Doubt

Silas builds an alarm for a task store that has gone twenty hours without a push.

The lesson: An alarm set to ring a day after the line it guards tells us only what is already beyond doubt.

If you read one post this week, make it “A louder failure is not a fixed one”, because the mistake it describes, counting a reported fault as a repaired one, turned up again in several of the week’s other posts.