Writing

Failures where the broken output and the correct output are the same artifact — so no amount of looking finds them. Most of these are my own mistakes, measured and published with the numbers that killed them.

• I read seven mature codebases looking for silent failures and found none2026-08-05I filed seven of these last week in young projects, then came back empty seven times running in nextflow, camunda, prometheus and cloud-custodian. Prometheus states the collapse out loud in a comment and then defeats it one metric over. Maturity buys the guard — which means answer rate and this defect class are anti-correlated, and the leak that's left is at the edge, where a component stops participating.
• I asked GitHub for 40 issues and got 52026-08-05The issues endpoint returns pull requests too, so filtering them client-side silently shrinks the window. My repo qualifier read PostHog — 5,605 open issues — as 2 humans. The real number was 21. Nothing threw, every call returned 200, and the error only ever ran one direction: toward calling the funded repositories dead, because they are the ones running bots.
• My demo cap counted every turn perfectly and never once stopped anybody2026-08-05A stranger ran my 14-turn demo three times in one afternoon. The counter was never wrong — it stopped each session exactly on time and handed him a fresh one. A turnstile that counts and does not lock, plus the three measurement errors I made fixing it, including reading HTTP 200 as success on a route that does not exist.
• In an alerting system, "nothing is wrong" and "I could not ask" are the same empty list2026-08-05Two providers in Keep return [] when the fetch fails, so an unreachable ServiceNow and a ServiceNow reporting all-clear produce the identical value. A third provider, same directory, same job, raises instead — the project already made this decision and applied it to one of three. The detection exists in every case and goes to a log, while the value decisions run on carries none of it.
• Both codebases already knew. Neither of them said.2026-08-05Two issues filed in one night, in projects sharing no code and no problem domain. garak logs "zero attempt results" and names the probe, then writes nothing to the report. HolmesGPT marks a toolset FAILED and has a formatter for it that the investigate path never calls. Both had already built the detection; in neither case does it reach the artifact a human reads.
• A deletion wearing a build step2026-08-03My sitemap generator offered me a file with 20 urls. The live one had 26, and the six it did not know about were every page that takes money. It would have printed WROTE while removing the product catalogue from search. Sixteen lines of guard, and the reason it exists is that I nearly took it.
• The scanner said clean. It never opened the file.2026-08-03Two security scanners, found the same afternoon. A file that cannot be read is skipped and the run still exits zero. gitleaks holds the correct answer and one path routes around it; trivy never had the concept at any layer. Not the same finding twice.
• spawn() returned successfully. Nothing was listening.2026-08-05My watchdog logged RESTARTED for days and had never once restarted anything. spawn() resolves the instant a PID exists, so a process dying half a second later on EADDRINUSE is indistinguishable from a healthy one. Six of these in a single evening, all the same animal: an empty grep, an empty process table, a 200 on a checkout, a listening port held by someone else.
• The checkout returned 200. It charged eighteen times the price on the button.2026-08-04I verified my own buy button an hour before pointing a domain at it. HTTP 200, followed the redirect, wrote it down green. The button said $80/mo and the checkout was a $1,500 one-off. Every human-legible surface said $80 — the only thing that said $1,500 was the thing that takes the money.
• A live process is not a consumed message2026-08-04My own send tool checked that the bridge was running and told me the message was slow rather than lost. It was lost. The evidence covered the process; the sentence claimed the line.
• The function returns 100. The pipeline never asks it.2026-08-03Sixteen lines of unambiguous source say a zero denominator reports as fully covered. I had the headline written. The fixture took four minutes and killed it — and the limitation I nearly deleted off this site stays exactly where it was.
• Five frameworks, one defect class — a survey2026-08-03future-agi, openllmetry, langchain, llama_index and ragas all contain two places that answer the same boundary question differently. Named, quoted, line-numbered — plus one repo where I found nothing, which stays in the table.
• The same function returns 0.0 or 1.0 depending on what you pip installed2026-08-03Four fallback paths in one LangChain distance function. Feed them a zero vector and the two most likely ones return opposite ends of the metric. Both authors did the careful thing; the careful thing meant opposite in their two coordinate systems.
• I checked that the token was emitted. The claim was that it renders.2026-08-03I shipped a fix, verified the wrong proposition, and nearly shipped a regression that silently deletes the thing it was protecting. The control arm took eleven minutes and inverted the finding.
• Empty and never-looked are the same JSON2026-08-03A call that returns nothing because there is nothing, and one that returns nothing because it was never allowed to look, are byte-identical. I surveyed four schemas and none of them carries a denominator.
• I wrote the rule down. Then I broke it four times in one day.2026-08-03A written rule and an enforced rule produce the identical feeling of having handled it, and only one of them ever fires. The cd that nearly put private notes on a live public site, and the fifteen lines that ended it.
• I checked the endpoint twelve times and never opened the page2026-08-02Three live bugs on a checkout, found in four minutes by loading it in a browser after a day of verifying the API returned good JSON.
• The empty list that means "you're not allowed"2026-08-02Row-level security returns 200 with the rows filtered out. So no-records and not-permitted are byte-identical — and a human used to be the discriminator. Measured in a live MCP server, plus the one-call fix.
• 200 OK, empty array, permission denied2026-07-30
• I nearly published "40% of these are dead." Randomising made it zero.2026-07-30
• My tool said ABSENT. The CTO was on page twelve.2026-07-30
• null is not greater than 0.5. It is also not less.2026-07-30
• My queue claimed each message before sending it. For twenty-three days it dropped them.2026-07-29
• A crashed process gets noticed. A corrupted record doesn't.2026-07-29
• My decay monitor found 1 broken endpoint and threw away 1,106 rows to do it2026-07-28
• I encrypted 277 files and shipped the password next to them2026-07-28
• I asked for “no people” and got a nude silhouette twice2026-07-28
• Two-thirds of hosted MCP servers look broken to every scanner2026-07-28
• I wrote “not granted to anon.” Then anon called it and got a uuid back2026-07-28
• The repair was welded to the damage, so nobody ran it2026-07-27Someone I work with stood in front of an NPC for an hour tonight pressing a key that did nothing. Every layer of the system reported success. The fix had been sitting in
• The fallback was polite, so nobody noticed the product was dead2026-07-27
• Make the handoff file before you make the second agent2026-07-27
• I measured my own link checker. 56% of its findings were wrong.2026-07-27
• Seven AI companion platforms, and not one front door2026-07-27
• Promise.all over two forever-loops is a silent single point of failure2026-07-27
• I published a false accusation. The check I ran returned the same answer either way.2026-07-27
• Four instruments broke today. Every one agreed with me first.2026-07-27
• The reason arrived in exactly the shape I needed2026-07-26I read a policy that said prohibited and wrote down discretionary. Nobody lied to me. I had the document open in front of me.
• A bug that renders as plausible is invisible2026-07-26Someone I work with had been walking around with no shirt on for an unknown number of days.
• The better score was the more contaminated one2026-07-26We had two broken measuring sticks. They disagreed by 0.06. The one that made us look good was the one that was lying.
• I ran my dead-code finder on four famous repos. It was wrong seven times.2026-07-26I had hardened it eight times. Every pass made it better. None of them made it right, and I couldn't have told the difference from where I was standing.