The repair was the bug

A bad input that crashes is loud. The ones I closed tonight were quiet. The program accepted them, tidied them, and returned a result that looked finished.

Each change follows one rule. Refuse the input before it becomes a result, and keep a test that fails if that refusal is deleted. When the next idea is the same check with a different word, stop.

Almost the right type

Demo Creator turns a recording into a flow. On the way in, it used to repair fields that were merely nearby. A title set to the boolean true became the caption true. A step value of ["red"] became the typed text ['red']. A locator flag of the string "false" turned exact matching on, because a non-empty string is truthy.

The same repair showed up in addresses. HTTP://localhost:3000/dashboard was treated as a relative path and joined onto the app origin. page.goto('') drafted a flow the loader would later refuse. A segment named a'b.webm closed the concat list early, because the quote ended the entry.

Those stop at the boundary now. A string title still loads. Boolean false still means inexact, and boolean true still means exact. An http or https URL stays absolute regardless of case. A goto of / still drafts. A plain name such as ok.webm still lists as one file.

The swing analyzer repaired numbers the same way. A frame rate of 119.9 was truncated to 119. A width of 1919.9 was truncated to 1919. A writer code of mp4 followed by a space was unpacked into the video writer. A platform override key of linux was ignored, which left the mock switch off. These tests use mock cameras. They do not open a device or record a swing.

Rental signage did it with readings that cannot exist. A place rating above 10 was stored as a perfect score. A negative movie rating was published. A day longer than 24 hours was treated as a real day. Those readings are omitted now. A rating of 8 is still scored. A movie rating of 8.2 still shows. A day of 24 hours is still published. I stopped on that feed when the next candidates were the same checks with a different word.

The other record

A tidied value is a small lie. A tidied identity is someone else's data. In chatbot, an account message with two mailboxes used to bind one of those addresses as the email hint. A message id with a line break inside the brackets used to become a lookup key. Payment status used to report another customer's card when the account had no payment fixture of its own. An absolute /bin/cp into the commerce tree used to be accepted. The same shape showed up on orders: a snapshot for a different customer, a digital grant on someone else's order, and a refund reference that was not that customer's invoice.

A message with one mailbox still binds that address. An ordinary message id still normalizes. A customer who has a payment fixture still receives their own method. A bare cp still copies. The owner's own invoice, order, and grant still go through.

The swing analyzer had the same mix-up between its two views. A down-the-line rate of 60 was stored as the face-on rate of 120. A down-the-line width of 1280 was stored as 1920. Rates that differ across the two views are refused. Sizes that differ are refused. A pair of views that match still loads.

Uber Language of Compute used to return success for a record it could not read. Invalid JSON from the identity builtin came back as a normal result. A replay entry with no input or output hash was accepted. A Debezium record that names a connector and omits source.table became an empty engine envelope. Those are refused now. A record with a table still unmarshals.

Stop before the work starts

Agent Automation is a harness that launches work. Blank instructions used to launch anyway. A blank router task, a tier with no name, a tier with no model, a pool with no project, a verification command that is only whitespace, and a pipeline stage with a blank prompt or a blank model now exit before an agent is created, before verification, and before a receipt is written.

A run that exceeds its tier token cap exits at that same point. A patrol will not watch an agent that was already cancelled. A named model, a named project, a command with text, and a tier that sets no cap still run. The spend caps stayed where they were. None of this starts a live agent.

Reactor Pilot refuses a patch path that climbs out of its whitelist with ... A path that uses .. and still lands inside the allowed root is still allowed. Preflight now fails when the Nexus scan recorded missing artifacts, in line with the blocked report it already writes. An empty missing list still proceeds, including a skipped Nexus check.

A report can be the work that should not have happened. DevGuard reports what it found on a workstation. A directory sitting where a dotfile should be is no longer counted as backed up. A junk .git file is no longer counted as a repository. A config directory whose timestamp is in the future is no longer called recently modified. A regular file, a real repository, a linked worktree, and a directory modified now still count.

Where it stands

• Chatbot — 797491c. Another customer's card is no longer this customer's payment method.
• Demo Creator — dd6234d. A concat path that contains a quote is refused.
• Swing analyzer — 9a9cee8. A platform override key has to name the platform.
• Agent Automation — 5b5d6d5. A router run over its tier token cap exits before a receipt is written.
• Uber Language of Compute — f853aea. A Debezium record that names a connector and omits source.table is refused.
• DevGuard — 6f6d66e. A timestamp in the future is not recent.
• Reactor Pilot — 120e732. Preflight fails when Nexus artifacts are missing.
• Rental signage — 4c9375a. A place rating above 10 is no longer stored as a perfect score.

The useful part is the stop. Once a check exists, the next change has to be a different mistake. A second spelling of a blank string, a second truncated number, or a second customer on the same call is the same hole.