What broke

Wortling collects German text and photos from phone users for flashcard generation. A generated Apple Shortcut chooses separate request bodies for images, web pages, and text. Its compiler's deterministic UUID option assigned the same identifier to every anonymous conditional and loop. The signing command accepted the resulting workflow.

How it showed

A user shared a photo and saw a report that the capture was not German. The server had stored only a camera filename as text, with no image payload. Inspection of the generated workflow found identical group identifiers on separate control-flow blocks. A new regression test failed on the previous artifact with Separate control-flow blocks share an identifier. The relationship between those duplicates and the phone's choice of text request still requires a device retry.

What was watching

Host integration tests verified the signature marker, artifact checksums, request fields, and action presence. They did not validate relationships between control-flow actions. Mobile browser tests covered downloading the file, not execution inside the phone's Shortcuts runtime. The signing command was treated as additional validation but did not reject duplicate groups. The user's first reported photo trial exposed incorrect capture behavior.

Where it sits

This is a behavioral failure in a generated workflow. Integration tests covered server requests and artifact delivery while omitting the generated control-flow structure. A valid signature established integrity without establishing executable branch relationships.

What we did

The builder no longer requests deterministic UUIDs from this pinned compiler. It rejects duplicate block identifiers and mismatched nesting before signing. The template was rebuilt and signed. The phone capture remains unverified until the user replaces the installed template and retries the photo.

What now fails loudly

A regression scans the generated workflow and requires a distinct identifier for each opened block. Each continuation and closing action must match the top of a nesting stack. Action output identifiers must also be unique. The test rejects the previous artifact and passes on the rebuilt one.