Field Kits
Prompts you paste into a model, not advice you read. Each kit comes out of one thing that actually broke — the date, the stack, and the measurement that settled it are printed on the kit. Nothing here was invented to fill a slot, which is the only reason any of it is worth your time.
A local address can still send data away
Privacy promises need checks on the destination, the model and the failure path before private text is submitted.
A missing report cannot prove agent trouble
The interface must distinguish what the agent is doing from whether the interface could observe it.
A fixed sleep cannot prove focus restoration
Wait for the observable condition a test promises, with a deadline and a recorded failure when it never arrives.
Background indexing still owns the JavaScript thread
Measure foreground responsiveness while background work runs, using an observer that cannot freeze on the same thread.
A partial refresh can erase what you knew
A partial observation must preserve the last good comparison and keep missing information visible until that item is actually read.
Independent review must include human producers
Separation of duties follows the actor who produced the work, regardless of whether that actor is human or software.
A successful webhook can lose the purchase
A webhook acknowledgement must describe completed business work, with durable identity for safe retries.
A parent limit leaves child storage unbounded
A storage limit must cover every write path and verify the owned parent of each child record.
The deployed bundle cannot import your source file
Verify import resolution in the emitted runtime artifact, using the same module format the deployment runs.
A model CLI can fail with exit zero
Validate the provider result as well as the process exit code before accepting a model answer.
Your configuration generator can erase the fix
A setting survives regeneration only when its owning source declares it.
The button finished before the process did
Return when the promised result is ready, while keeping concurrency protection for the full lifetime of unfinished work.
An agent promise needs refusing code
Permission statements are enforceable only when the executing path refuses the forbidden action.
A protective policy can hide a bad default
Test the changed decision independently of a downstream safeguard that can mask its defect.
The shell exited before error handling ran
An error-handling branch is useful only when the shell can reach it under the exact failing invocation.
Fix dependency advisories against the actual baseline
Measure security improvement and behavioral change separately against the same dependency and test baseline.
Claiming a packet is not the same as importing it
Durable state must distinguish ownership of work from completion, including the crash windows introduced by recovery.
Re-baselining an alarm that was right
Moving a threshold is a decision about what is acceptable, not a fix for the thing that crossed it. It is legitimate after auditing what the alarm found, and it is how a check quietly stops meaning anything when done before.
Out of memory, or out of heap?
A runtime's own ceiling fails long before the machine does. Free system memory is not evidence that memory is fine — it is the most convincing wrong answer available.
Dev server OOM: V8 ceiling, not machine RAM
An out-of-memory crash on a machine with free RAM is a runtime ceiling problem, not a capacity problem — prove which one you have before you buy hardware or start hunting leaks.
When a free path can still clone a voice
Gate on the capability the input actually reaches, not on the name of the job that carried it — and decide what is safe by allowlisting the one known-safe value, never by guessing what dangerous input looks like.
When a missing env var opens every route
A guard whose whole body sits inside a check for its own configuration fails open when that configuration is absent; the absence of a secret must be an error state, not a skipped branch.
One sentence doing two jobs
A measured fact and the advice about it have different lifespans. The fact is read every time; the advice is read once and then occupies the same space for the rest of the product's life.
Did the shell fail, or the program?
Before diagnosing a failed command, establish whether the shell or the program failed, and resolve any "missing" name against the user's own startup files before recommending an install.
It hung with no error at all
A promise that neither resolves nor rejects is usually a registration that silently did not happen. Code which stringifies its own functions at run time cannot survive a transform that rewrites them, and nothing in the toolchain will say so.
The record said it survived a restart
A verification record is a claim about testing, not evidence of it. The only thing that establishes a restart guarantee is booting the process and observing the guarantee hold.
When a dry-run plan renders green over a failure
If a human approves work from a generated plan, any branch that renders calmly while a check failed is a worse defect than a crash: failed inspections must truncate the plan, refuse to print a restart or rollback story, and exit non-zero.
No measured difference does not establish equal quality
Choose cheaper models only after their capability, local usability and measured quality justify the assignment.
Verified on simulation only
A component that correctly refuses to invent results produces nothing at all until someone builds the real path. That silence looks identical to a working system with no traffic, and it can survive several rounds of verification that never noticed.
When a 200 With Zero Rows Renders Green
Render each source the moment it lands and let a well-formed empty response say it is empty; a status light assembled out of true JSON can still be a lie.
When the harness costs 85x the probe
A wrapper tool's fixed per-call overhead, not your prompt, sets the floor cost of a metered experiment — measure it from one instrumented call before launch, not from the bill nineteen calls in.
Your own holdout refuted it. Ship it off
A lift measured on the data you tuned against is a description of that data. Until a holdout with enough positives to judge it says the same thing, the number is a hypothesis, and the honest default for a refuted hypothesis is off.
When serverless cannot host it, make local double-clickable
A launcher that bundles its own frozen copy of the code will silently run last quarter's build; point the launcher at the working tree instead, and prove liveness by looking for a marker you added today.
A dozen log calls and no handler
Logging that is never configured is not quiet, it is absent. It costs the same to write, reads identically in review, and is worth exactly nothing at the moment a swallowed exception needed it.
Making a crash log admit what it lost
A durable log is only trustworthy if it can report its own incompleteness — give it TRUNCATED, UNVERIFIABLE and degraded-with-reason states, and make it stop writing rather than silently drop the oldest events.
Probing unmeasured commands without destroying uncommitted work
"Unmeasured" is not a neutral state — it is unverified with better manners; probe it, and probe it with an isolation method that cannot destroy work you did not create.
The audit reported one of five missing
An audit that stops at the first failure reports the first failure, not the extent of one. A count you did not verify by checking every item is a lower bound wearing the appearance of a total.
The exit code was read without reading the output
A nonzero exit is a question, not a verdict. Tools exit nonzero to say they were called wrong, that a deterministic check found real drift, or that they genuinely failed — and only the output distinguishes them.
The obvious fix adds a dependency you do not need
When a build complains about a missing dependency, ask whether the file should be in scope before adding the dependency. Installing it makes the error go away and moves someone else's tooling permanently into your build.
The regression that was a dirty baseline
A baseline taken in a dirty environment measures the environment. Comparing a clean run against it produces a difference that is real, reproducible, and about the wrong thing.
Triaging red checks that were never broken
A non-zero exit is a summary, not evidence — nothing is broken until you have read what it printed, and a check that could not read its input must say so with its own exit code rather than pass or crash.
When the audit crashes but reports success
An exit code is not evidence that a scan happened, and a dependency declaration is not evidence of what is installed — audit the environment that actually serves requests, and make the tool show you its findings table before you record a pass.
A finding you are not allowed to fix
A finding inside territory you do not own is a decision, not a task. Fixing it in place produces a change that disappears on the next update, and a record saying it was handled.
Exists is not a type test
Testing that something exists answers a different question from testing what it is. Where two kinds of thing share a name and only one is valid, existence is the check that admits both.
Monitors that only ever say one thing
A verdict that never changes is unproven, not stable: any monitor whose healthy state is a positive verdict must be observed producing that verdict, and any freshness number must be traced to the thing it claims to be fresh about.
When your probe suite reports green and isn't
A suite is only as honest as the one number that cannot be masked: report inspected-versus-fired counts and read the runner's own exit status, and treat every failure as a rig defect until you have shown the rig was not the cause.
The concurrency test that passes without the fix
A concurrency test must be run against the unfixed code before it means anything. Scheduling can serialise your racers by accident, and a test that never observed the race is evidence about the scheduler, not about the lock.
The feature that only exists on one branch
A feature wired into one arm of a fork is missing from the other, and the arm it is missing from is often the one that runs most. Count the call sites against the branches, not against whether the feature exists.
The write resolved; the file stayed 644
A successful return is not a successful result: rethrow every error except the single benign one, and separately verify on disk the post-condition you claim to have established.
Your lock does not cover the other process
An in-process lock is not a lock once a second process writes the same file. It serialises your own callers and is invisible to everyone else, so the guarantee it advertises is narrower than its name suggests.
When a watcher freezes its root at import
Any value derived from configuration at module load is frozen for the life of the process — export a function that resolves it per call, and prove it by importing before you set the variable.
When both sanitizer layers go blind at once
Layered defence only holds if the layers fail differently — so any input your rules could not fully parse must be emitted as a violation, not passed through as clean.
When exported dates parse as Invalid Date
A string that looks like a date to a human is not a date to a parser; extract time as integer components and assemble the format yourself, and test the result in the runtime that will actually consume it, not a proxy.
A gate on some of the inputs
A gate wired to one input surface is not a gate, it is a sample. The surfaces it misses are usually the ones added after it was written, and its counter sitting at zero reads exactly like nobody being there.
Why your test suite wrote into real user data
A path built by joining a configuration value can silently collapse to its parent when that value is empty, so resolve it once at a choke point that fails closed and defaults to isolation rather than trusting each call site to remember.
When a validator exits 0 because it validated nothing
A checker that emits nothing and exits 0 is indistinguishable from a checker that passed, so any handoff whose failure mode is silence must be replaced by one that cannot silently produce nothing — and must be tested against the oldest interpreter on the plainest PATH you support.
An eval both tiers pass measures nothing
An evaluation that every candidate passes has no discriminating power, whatever its pass rate says. A fully-specified task with a deterministic grader measures whether the model can follow a contract, which is not the question being asked.
A blocked PTY write froze every tab
Never hold a shared, app-wide lock across an I/O call that can block indefinitely — take the lock to look the handle up, then release it and do the write behind the handle's own lock.
Fail-safe must not mean fail-silent
A reader that quietly normalises what it cannot represent destroys the distinction it was protecting. Failing safe is right; failing safe without saying so converts a data problem into a reporting lie.
Renames leave two kinds of reference behind
After a rename, references split into two populations: ones that are dereferenced at runtime and must be repointed, and ones that record what was true on a stated date and must be left exactly as written.
The suite that ran 43 of 256 files
Any test that has to be hand-registered somewhere to run will eventually stop being registered; discover tests by glob so a file starts protecting you the moment it exists.
Finishing a rename without silently breaking runtime
A rename is only finished when both ends of every cross-process handshake — env var names, service ids, registration keys, hardcoded paths in shell startup files — move in the same pass, because half-renamed pairs fail silently rather than loudly.
The health probe can be the broken component
A failed probe describes the model only after the probe can perform the operation that model supports.
The platform slept and your map was gone
A managed runtime can evict your memory while keeping the connection alive. Anything reconstructed after a wake has to come from somewhere the wake did not clear, and an early return on missing state is a silent drop.
A configured token can expire before the next request
A credential being present says nothing about whether it is still usable when a request runs.
Missing alignment should not erase the transcript
An optional enrichment failure should preserve the usable result and state precisely which precision was lost.
Saving a thought does not make it usable memory
Memory capture, traceable source material and completed synthesis are separate accomplishments.
Your build sees files your package does not
A build reads from a working tree and a package ships a subset of it. Any path that leaves your own boundary works locally and fails at publish, and the failure arrives at the least convenient moment.