A casebook. Every entry is a real bug that happened on this station, written up after it was fixed: what broke, how it showed, where it sits in the Software Observatory's framework, what was done, and the thing that was built so it fails loudly next time.
No lessons. Controls.
cases48
-
2026-11-02
A workaround written down is assumed to still be the design
now fails loudly None mechanical. The paragraph now describes what the tool does, and the neighbouring section says the same thing, which is the only check this document has.
Human ComprehensionEvolutionDocumentation DriftContract Tests
-
2026-11-02
A review verdict belongs to the commit you are looking at
now fails loudly A posted verdict names the head it read, so the server binds it to that commit, and a standing refusal names the commit it was given at rather than the commit under merge.
InvariantsHuman ComprehensionContract TestsDecision Provenance
-
2026-11-02
A review on your own pull request is assumed to be invalid
now fails loudly The refusal covers verdicts only: an author may post a comment review on their own pull request, and a test requires that path to exist, so the handback has a channel.
InvariantsHuman ComprehensionIndependent ReviewContract Tests
-
2026-11-02
A list read at its page size is the oldest page, not the record
now fails loudly Both readers page until a page comes back short, bounded at twenty pages of fifty and failing closed at the bound; tests assert that an approval on a later page is found and a refusal on a later page still blocks.
Human ComprehensionInvariantsContract TestsExample-Based Tests
-
2026-11-02
A record that fills its last page has not been shown to continue
now fails loudly Both readers ask one page past the bound: an empty page means the record ended there and a non-empty one means it did not, so a record of exactly a thousand reviews is read rather than refused.
-
2026-11-02
A model's quotation of a sentence is the sentence
now fails loudly The fidelity check compares words after folding characters that carry no meaning, stores the source's own characters when a sentence matches that way, and reports a validator refusal as a refusal rather than as malformed output.
InvariantsHuman ComprehensionSchema ValidatorProperty-Based Testing
-
2026-11-02
A word is the first substring that matches it
now fails loudly Cloze construction selects a whole source word by position, and a test requires that a target which is a substring of a longer word is refused rather than cut.
Human ComprehensionInvariantsExample-Based TestsMetamorphic Testing
-
2026-11-02
A commit's CI result is assumed to be reachable through a pull request
now fails loudly `forge checks` answers for a pull request number, a revision, or the branch's head, and refuses an argument it cannot read as either rather than guessing.
Human ComprehensionInvariantsContract TestsExample-Based Tests
-
2026-10-26
A page that leaves no receipt is assumed not to have fired
now fails loudly The probe logs what the messaging service answered for every page, accepted with its message id or refused with the reason, so a page's delivery is a fact instead of an inference.
Human ComprehensionRuntimeSynthetic MonitoringDecision Provenance
-
2026-10-24
Cutting between words preserves a sentence's meaning
now fails loudly Regression tests require the full selected context and its governing modal to survive cloze construction.
InvariantsTest EffectivenessRuntime InvariantsMutation Testing
-
2026-10-16
An OAuth session renews itself before its refresh token lapses
now fails loudly The harness renews its model-provider refresh token before it lapses (or lengthens the token's TTL), and a probe alerts when the token nears expiry, so the daily expiry boundary no longer emits an ERROR span.
-
2026-10-14
A migration transaction also locks SQLite connection setup
now fails loudly A test holds the initialization lock and asserts that a second initializer cannot create the database before the lock is released.
-
2026-10-14
A file readable by the build owner is readable by the runtime user
now fails loudly The image build reads packaged public assets after switching to its unprivileged runtime user.
-
2026-10-14
A shared photo always arrives as image data
now fails loudly A native iOS test supplies a camera filename and requires a stored image after the recovery picker.
-
2026-10-14
Successful signing implies valid workflow control flow
now fails loudly Reject repeated control-flow group identifiers before signing and test balanced block nesting in the generated artifact.
-
2026-10-14
Valid structured output preserves the source vocabulary
now fails loudly A sparse normalization fixture must still deliver every short-source label to extraction, and phrase lemmas cannot collapse onto one base word.
-
2026-10-14
A running shell script already has its remaining source
now fails loudly The runner executes an in-memory snapshot of its source before starting simulator work.
-
2026-10-14
A recurring failure warrants a new task in each delivery window
now fails loudly identical failure shapes coalesce into one task per six-hour horizon instead of one per fifteen-minute window, with a running occurrence count, and a shape that reappears after a quiet horizon is flagged as a recurrence
RuntimeInvariantsObservability EventsIncident CorrelationRuntime Invariants
-
2026-10-14
A successful retry removes its failure alert
now fails loudly A failure-to-recovery test requires capture identity and removal of only that capture's active alerts.
-
2026-10-14
A failed preflight command stops the next shell command
now fails loudly A deployment-script test injects a busy worker and requires termination before the build command.
-
2026-10-14
A self-hosted CI runner has no dependency on the public internet
now fails loudly A scheduled probe resolves the action registry hostname and reports the DNS error by name; a fallback public resolver removes the single point of failure.
-
2026-10-14
An image decoder that works on desktop also handles phone photos
now fails loudly Browser tests disable the bitmap decoder and require a resized JPEG upload, while undecodable images must show an actionable error without sending a request.
-
2026-10-14
Shifting selected new cards leaves suspended cards unchanged
now fails loudly A real-backend promotion test asserts that suspended and reviewed cards retain their scheduling fields.
-
2026-10-14
A local sync server covers hosted download routing
now fails loudly A bootstrap contract test requires the shard endpoint returned by the sync handshake to reach the download call.
-
2026-10-11
A tool returning output means the command succeeded
now fails loudly a regression requires exit code 1 to remain a command failure when the tool error flag is false
-
2026-10-11
A trace span whose status is ERROR records a station failure
now fails loudly the telemetry relay drops every error span and error log record carrying a tool-call marker, so a routine non-zero exit no longer reaches the specimen queue; a tool call that crashed is dropped by the same rule, which is the hole the last section names
-
2026-10-11
Every exported error occurrence warrants a separate incident task
now fails loudly regression tests reject historical exports and consumer tool errors, group repeated failures, and enforce a persisted rolling delivery budget
-
2026-10-11
A queued notification can run with another channel's tools
now fails loudly a queue regression requires different channel origins to remain queued for their own turns while same-origin follow-ups still fold
-
2026-10-11
A deploy that misses its host once is a failed publish
now fails loudly the deploy retries a dropped connection up to three times and fails fast on any other error
-
2026-10-11
A developer's Python installation supplies the CI test dependencies
now fails loudly CI installs the pinned Python test requirements and verifies the YAML module before building or running the suite.
-
2026-10-11
A CI runner carries the same tools as a developer's machine
now fails loudly make test preflights the suite's declared Python dependencies and fails before the demos when one is missing
-
2026-10-10
An Ubuntu host label was safe on a macOS runner
now fails loudly runner-label-check reads active runner config and pages when a Darwin host runner lacks a matching macOS :host label
-
2026-10-10
A restarted worker is assumed to have recovered its queue
now fails loudly a stalled queue alarms while the worker's message log is still advancing, and a recovery nudge must not report complete while older pending work remains
RuntimeInvariantsSynthetic MonitoringResource TelemetryRuntime Invariants
-
2026-10-10
A required tool is assumed to be installed on whichever machine runs the job
now fails loudly the step that checks for a required tool installs it when it is absent, instead of only adding its presumed directory to the search path
-
2026-10-10
The token file was assumed to update the running service
now fails loudly switchboard-watch restarts on /metrics 401, retries authentication, pages if the retry fails, and clears blind-alert state after a successful scrape
-
2026-10-10
A busy worker is assumed to be making progress
now fails loudly a liveness check declares a worker wedged when its message store stops advancing while it is running and busy, then restarts it and pages the operator
RuntimeInvariantsResource TelemetryRuntime InvariantsSynthetic Monitoring
-
2026-10-07
A placeholder written for a reader was a broken link the site's own checker followed
now fails loudly a build gate fails when generated text carries a literal <...> placeholder inside an http(s) URL, so a placeholder cannot ship as a 404-ing link on the site's own domain
StructuralTest EffectivenessPre-Promotion Invariant GatesSnapshot Tests
-
2026-10-07
A running worker is assumed to be listening to its queue
now fails loudly a scheduled liveness check alarms within minutes when a queue's oldest pending item has gone unclaimed by its owning worker past a short limit
RuntimeInvariantsSynthetic MonitoringResource TelemetryRuntime Invariants
-
2026-09-27
An empty backup suffix makes `sed -i` portable
now fails loudly a gate refuses any `sed -i` whose argument is not a `.bak` suffix, so both the GNU-only no-suffix form and the macOS-only empty-suffix form fail the suite before they reach CI
BehavioralEvolutionExample-Based TestsPre-Promotion Invariant Gates
-
2026-09-24
A restart policy that fires on exit restarts a hung worker
now fails loudly a per-harness run timeout now bounds a persistent worker's lifetime, killing and respawning a wedged process and re-arming the timeout every lifetime
-
2026-09-21
`sed -i 'edit' file` means "edit in place" on every machine
now fails loudly `sed -i` with no backup suffix is GNU-only; the deck test now uses the portable `sed -i.bak` + `rm -f` form, which edits in place identically on GNU and BSD sed
-
2026-09-19
Hardcoding a "recent" date into a test fixture keeps it recent
now fails loudly the telemetry collector accepts SUBLAYER_NOW to freeze its clock, and the test pins it to the fixtures' own day, so the window is deterministic and cannot age out
BehavioralTest EffectivenessExample-Based TestsPre-Promotion Invariant Gates
-
2026-09-13
Moving a repo layout's root is one mechanical change
now fails loudly A test that silently skips because a path does not exist is a failed test; environment checks that mask defaults are recorded as overrides, and the defaults themselves are tested without them.
ChangeBehavioralIntegration TestsPre-Promotion Invariant Gates
-
2026-09-12
YAML frontmatter with a colon-space in a scalar value is a mapping
now fails loudly Every SKILL.md frontmatter is parsed as YAML by a test; a frontmatter block that does not parse fails CI.
-
2026-09-12
Renaming a repo and updating its topology entry is one operation
now fails loudly The deploy gate refuses when the topology file and the filesystem disagree about which repos exist; a worker with a schedule attached is not a worker — it is skipped by collect and never rendered as down.
ChangeInvariantsPre-Promotion Invariant GatesStatically Checked Invariants
-
2026-09-12
An AI reviewer that reports an approval has posted one
now fails loudly A review counts only when the forge API shows it submitted with a verdict; until the tool submits, the merge record is the evidence and the reviewer's own result is not.
ChangeHuman ComprehensionIndependent ReviewSecond-Agent Review
-
2026-09-06
Looking up a DNS name before creating it is harmless
now fails loudly Absence is probed only against the authoritative nameserver; the user's own resolver is queried last, and only to read what it already believes.
-
2026-09-06
Validating a web server's config only reads it
now fails loudly Config validation runs as the service user, and a smoke request against the new host is what declares the deploy done — not the validator's exit code.
by family8 of 10
- Runtime 21
- Invariants 20
- Behavioral 15
- Human Comprehension 9
- Change 6
- Structural 5
- Test Effectiveness 4
- Evolution 2