Theme
Trusting AI output
How to tell a plausible AI answer from a correct one before it costs you.
54 posts by Ben Downey, in two lanes: plain-language stories and the technical build log.
Everyday lane
Plain-language stories. No jargon. 9 posts.
Start here
The Second Reviewer Found a Blank Filter Field Matching Nothing
One reviewer checked a change against a list of known risks and it passed. A second reviewer asked a different question and found mistakes the list was never built to catch.
Verifying what an agent says it did 2
-
A Safari Blank Space That Survived 245 Prompts of AI Patches
A blank space on phone screens came from moving one piece of a page and leaving the rest behind.
-
Why a 320 by 90 Button Needed an Invisible Two Pixel Border
A nearly finished checkout page still needed a person to notice one small movement that made it feel wrong.
Using AI reviewers without trusting them 1
Checking facts before acting on them 1
Making AI features safe to save 1
Why a plausible result is not enough 1
Show 1 more chapter
More in this theme 3
-
The Refund Promise With a Trigger Only We Controlled
The refund in our draft terms hinged on a "note sent" trigger, and the AI reader we asked to review the page said only the provider controls it.
-
Three reasons I skipped Meta's Muse and one trigger to revisit
My partner kept telling me to use Muse, Meta's personal agent. It connects to Gmail, a calendar, Facebook and Instagram, and it can run tasks in a web browser.
-
A .co Domain, Microsoft 365 Mail, and an Introduction Request Claude Wouldn't Answer
I forwarded Claude a suspicious email with one line: "i fw email to you, i assume spam, can you review." The email was an introduction request.
Technical lane
The build log: the logs, the code, the fix. 45 posts.
Start here
What Our Coding Agent Announced After Editing JScript and Reloading Nothing
One line in an agent ruleset beats any clever prompt: do not claim a fix until you reload the page and watch the behavior in a real browser.
Verifying what an agent says it did 14
-
What Our Coding Agent Announced After Editing JScript and Reloading Nothing
One line in an agent ruleset beats any clever prompt: do not claim a fix until you reload the page and watch the behavior in a real browser.
-
Verify the Agent Actually Showed It: Building Honest Tools for Agentic Workflows
The fix took 1h 5m on a Thursday morning. Agents kept claiming content was on screen that we never saw.
-
The Morning Digest Said Three Things Needed a Person. None Did, and Passing Tests Were Not the Proof.
We fixed seven defects in a daily digest and 128 tests went green. Rendering the real message off the live ledger showed a whole class we had missed, then a hunt found about 250 more of them.
-
The Features Page Had 327 Visible Words and No Headings
A marketing page had zero crawlable links behind its 63 feature descriptions. The session that fixed it couldn't test a browser click, and said so instead of claiming it worked.
-
A Legacy max-width Rule Clipped the Right Column at Mid Width
An AI-assisted UI rebuild looked plausible but missed design tokens, a title-alignment invariant, and a shell-level width constraint. Code review caught the gaps before release.
-
The last 2 pixels still need a human
AI shipped the first 95 percent of a checkout UI fast. A senior dev caught four layout issues. Another caught a checkout button growing 4 pixels on activation. The fix was embarrassingly specific.
-
The token-saving filter handed our agent `{ expand: string[82], fields: { ... } }`
Our token-saving CLI filter turned a JIRA payload into a schema sketch and hid a merge commit from our agent. The rule: lossless on any path that verifies state.
-
Why a Tidy Git Log Passed Release Verification Two Times
Three hotfix tags went out on one day, and on that same day we rewrote the global rules for rtk, the output compressor we put in front of shell commands to save tokens.
-
136 Rejected Sends, 37 Customer Emails, and One Apology We Didn't Queue
The alert was a number: 136 rejected sends in the accounting logs over one week, and nobody had looked at what was actually in that pile.
-
A 42 second sessions endpoint and a status color we trusted too long
The secretary dashboard was showing thirteen active-work cards. Five of them were real sessions.
-
A grading script gave 187 posts a clean bill of health
quality6: 6. avg: 84. Every one of six gates green. We pulled up the post underneath that score to spot-check it and it read like a press release: no ticket counts, no field names, no numbers at all.
-
136 Bounced Emails Joined Back to Real Customer Orders
One week of receipts from running a legacy platform through AI agents the way the WSJ's profile claims is possible: 51 wrong review verdicts, 136 bounced emails traced back to orders, and two apology drafts nothing is allowed to send.
-
Why 104 Generated Heroes Looked Fine and Still Sat Wrong
Batch one came back at an amber share of 0.004. The corpus median across the 95 hero images already live on dxdev was 0.022. Off by more than 5x, and we couldn't see it just by looking.
-
The Post That Never Printed Its Own Number 65
One of our own published posts carried \"working-queue-grew-to-65\" in its slug and never once printed 65 in the body.
Using AI reviewers without trusting them 14
-
One Agent Made a Strong Claim and a Commit Answered It
An architecture-review AI claimed we were avoiding real work. We asked it to audit its own claim against our actual logs. It retracted, with data.
-
Two BLOCKs and five majors on a design we thought was finished
Build with one model, review with a different one at high effort. One adversarial Codex pass found several false-green paths in a production gate that showed all green.
-
An Append-Only Memory File Dropped Its Newest Entries Past Line 200
At 11:06 pm on June 29, we had a post whose core failure was a 200-line or 25KB context cap, and we still did not let it ship after one AI said SHIP.
-
A case on a string prefix that JScript refuses to compile
We sent a cross-cutting feature design to a read-only AI reviewer three times. Each pass found new, real bugs: eleven findings total, none hallucinated. Here's what made the difference.
-
Why a Second Reviewer Found What a Clean Security Review Missed
A bulk-edit feature passed its own code review on SQL injection, access control, and transactions. Sending it to an independent second reviewer found a second call site the fix never covered, a data-clearing bug that raised no error, and a scope bug the first pass never asked about.
-
The Reviewer Who Actually Read the Code Found What Everyone Else Missed
The release was one “safe to ship” vote away from landing with a save path that did not save what the UI claimed.
-
Line 18 of the Changelog Comment and a Phantom Fix Request
Manus's review of the memory-truncation draft came back in about a minute: SHIP, three notes attached, and note one told us to soften a sentence that supposedly still read as dramatic.
-
createBackup: 1 Made the Bulk Path Run Something Never Run Concurrently
51 of 55. That is how many of the "already cleared" verdicts an adversarial audit refuted after we fanned a backlog review out to sub-sessions and got back 45 tidy files, each one confident.
-
Standard Edition 2016 SP3 and the error that contradicted our own comment
We verified the SQL Server edition before shipping an ONLINE index build. We still shipped the wrong answer. The only thing that caught it was the server refusing the statement.
-
Three prompts, 4.15 seconds, and a description that was wrong four times
The failover ladder passed its fire drill at 1:23 am, and the system description we built around it was still wrong on four separate claims.
-
What a 600-Line Architecture Document Missed About Adjacent Repos
Building a conversation archive across four provider repos is the easy part. The useful part was sending the spec to Manus and watching it find gaps in every assumption.
-
Why a Sound Dashboard Endpoint Design Still Sat Behind a 401
An external reviewer told us to add a tRPC aggregation endpoint to feed a dashboard zone. The design was right.
-
A Cron Expression of 0 7 * * * Pointed at a Phantom Repo
We asked an agent to set up a scheduled job that would keep building out our agent-log archive.
-
nanoid 3.3.18 sat in the queue for 15 hours under sanitize-html
At 4:56 am the triage job named a cause for a red build: nanoid <3.3.18, a high-severity DoS, GHSA-2v37-7h3g-55p8, fixed in 3.3.18.
Checking facts before acting on them 9
-
The Number We Wrote Down Was Already Wrong
A maintenance document repeated a months-old server statistic as settled fact. The fact had already changed, and we were the ones who wrote it down.
-
Port 7788 returned a registry where every session was exited
A saved note said each turn is a fresh claude -p and nothing can interrupt it. On 10/6/26 an analysis checked that against the code.
-
The Agent Said Our Discord Channel Was Unreachable. It Had Not Checked.
An agent told us our venture's Discord channel was unreachable without opening the code, and the token had been posting there daily.
-
Error 21211 and a Kill Switch Checked Once Per Recipient
Thirty-four tests were green when we stopped trusting them.
-
Thirteen Wrong Lines Went Out in the July 31 Send
The domain setup page had a line that read the registrar name off the DNS record and turned it into a sentence: this domain came through the platform's domain service. It looked like a fact.
-
Three Systems, One Document, and the Same Flaw at 12:45 AM
Three AI reviewers, given the same document with no visibility into each other, all found the same flaw in our own positioning plan before we built one more page of it.
-
Marking Up a GPT Plan at 10:47 PM Until Dawn
At 10:47 pm we sat down with a GPT-authored strategy document open on one screen and the live archive open on the other, and started marking the document wrong, one recommendation at a time.
-
The flat MONTH constant hiding behind a missing day 31
The Sales Summary month chart had 30 labels on a 31-day month, and the date was October 1.
-
Under 300 Characters and No Commit Hashes Allowed in Our Chat
One of our agents told us, flat out, that our shared chat bot couldn't post into a particular channel. That was wrong. That same bot had been posting into that channel daily for weeks.
Making AI features safe to save 5
-
Let AI suggest before you save
A suggested classification should stay editable until a person confirms it. Separating analysis from persistence turns an AI mistake into a correction opportunity instead of a bad record.
-
Why Our Saved Update Stayed Invisible Until We Reloaded the Page
Why optimistic UI breaks when a write triggers model inference: show an honest Analyzing state and invalidate the cache instead of faking the result.
-
The Subject-Perspective Reviewer Was Right and the Rewrite Still Failed
Automated reviewers can identify real risks while a sequence of locally reasonable edits harms the whole artifact. The answer is to keep safety findings in force and use calibrated review, minimal changes, whole-artifact rereads, and where appropriate direct human input or non-publication.
-
Three Fixes Marked CRITICAL and a 401 That Stayed
Commit commit-C1BF changed one environment variable back to DBPASS after an agent had renamed it to DBPASSWORD and broken a database connection that had been working.
-
Why the retro scanner's 46 never meant 46 failures
The retro scanner reported 46 recurring failures. Its next run reported 33. Nothing in the underlying work had improved between those two numbers. The counter had been wrong.
More in this theme 3
-
Why Bumping mtime in test_session_index.py Drew a High Severity Review
Four tests failed on the Linux side of our gate, and only there. One of them was the session index's same-size status flip test, and we made it pass by setting the file's mtime forward.
-
Blind judges preferred the rewrite, so we rewrote 751 posts
Blind judges preferred the rewrite in a 20 post sample, so we rewrote 751 posts. The same day, a Codex review caught a lock that quietly stopped locking.
-
Why `present` Stopped Echoing Loopback Addresses and Now Reports `channel none`
The CLI present command echoed loopback and LAN-only http(s) targets back as a published link.
Free and plain-worded:
- Is this task a good fit for AI?. Six yes/no questions to check a task before you try it.
- What not to paste into an AI tool. A privacy checklist to run before you hit send.
Hitting one of these walls in your own codebase or your own machine? Start an assessment or talk to us.