Everything Was Green

I came back to a permit pre-review tool after seven weeks and ran everything. Everything passed.

The backend suite was green. The evaluation harness was green. Then I ran the production build, and it failed outright, on a charting library that a component package declared as a peer and nobody had installed.

181 tests had passed. None of them could see the bundler.

The tests were never asked about the build

Nothing failed here. Every test did its job. They test the units, and the units work. The question "does this ship" was never put to any of them.

The same session produced two more false greens. A change-detection tool reported zero drift in the code index, because it compares git refs and this repo's main branch was the branch being worked on. The real staleness showed up only in an index file timestamp that sat behind the last commit. And the database schema that the whole retrieval layer depends on had never been executed against a database. Not once.

So I did not wire the retrieval layer in, though it was the obvious next step. A suite of 181 tests says nothing about whether retrieval finds the right code section. That needs a real corpus and a measured recall first. Wiring it first would have meant debugging recall through the interface.

The reader worked and nothing wrote the value

A broadcast platform I built for a volunteer organization sends WhatsApp messages. WhatsApp allows free-form replies only inside a 24-hour window after the contact last wrote to you, so the system stamps that moment on the contact record.

Two lines of work forked from the same commit on August 9. One added the stamp. The other carried a security-audit fix to the same file, from a copy that predated the stamp. When the hardening work landed thirteen days later, the committed route had no line that wrote the timestamp. The code that read it was correct. It looked, found nothing, and concluded that no window was open. No window could ever open.

Nothing failed. Every contact simply looked as if they had never written.

A gap audit found it in early September, along with a second regression from the same hardening, a renamed error code whose test never learned the new name. Ten days before that, a review of a new workflow step had caught two blockers that green tests had hidden. A worker could not read its own settings under row-level security, so every live step quietly fell back. And a node in one mode emitted a handle with no id, so the compiler rejected every workflow that used it.

No gate measures the thing that moved

A marketing site for a design tool got a motion pass. One AI coding agent, working from a frozen plan, all gates green. The plan itself had warned that the first line of the headline was the largest-contentful-paint element and must not be animated.

So the executor left that line alone. It wrapped the second line in an inline-block so it could take a transform. That made the second line the largest text block in view, and the page's largest paint. Starting it transparent pushed local paint time from roughly 164 milliseconds to roughly 592.

The executor's report was accurate. The gates were green. None of them measured paint time, and the gate script still has no mention of it. It was caught only when I verified the page myself.

The fix was to start the line fully opaque and let it sharpen into place. The lesson was plain: the plan had named the right risk and pointed at the wrong element.

Nothing on screen said the delivery was fake

A community app I built lets people write a letter and send it by fax. Its backend has two delivery modes. The default is a mock that simulates a successful delivery, so developers can work without keys.

The owner used the production app and reported faxes marked delivered that could not have been. I traced it. The mock was on in production. Nothing in the interface said so.

The fix was a banner on the operations screen, shown whenever the provider is the mock. The cause was that the mode had been tribal knowledge. Now it was visible.

Of the four failures this is the cheapest to understand and the easiest to repeat. The mock worked exactly as designed. The design had no place for the operator to learn that.

Verify the artifact, not the report

A green signal answers the question someone remembered to ask. Each of these four answered honestly. A passing suite, a clean gate list, a delivered status, a correct reader. None of them lied. Each reported on a thing that was adjacent to the thing that mattered.

That changes the job. Reading the signal is not verification. Verification is going to the artifact and asking the question the signal skipped: build it, time it, look at the diff, open the screen in the mode the user sees.

Two habits came out of this. When something bites, add a gate for that thing, or say that no gate exists. A mode that changes what is real gets a banner, not a README line. On delegated work the same rule holds, for the reasons in Agents Do Not Push Back.