Coding

A linked set of documents with defined sections and relationships, rather than one long file that narrates the code.

A stateful fake plus a control API, so a real app runs a full journey with no live calls — and the isolation you must build before the first run.

Four ratios used to score code quality, and four different reasons each one measured something other than what it claimed.

Two independent causes of a false-positive block, only one of which you can do anything about.

Getting a credential from its store into its destination without it ever appearing as text the assistant emits.

Why process-selection commands over-select silently, and the inspect-then-kill pattern that catches it.

Four checks that passed because they had no subjects — three in a scoring tool, and one set that caught this document's own author an hour after he went looking for them.

Stop the bleeding before diagnosing, record while acting, and the autonomy rules that matter most when they are under pressure.

Free platform subdomains are blocked as a category by security filters, so a subset of real users silently fails.

Wiring an updater keypair, a version manifest and a public bucket, and the flags that make uploads silently do nothing.

The certificate types, the notarisation flow, and the build setting that silently ships an unnotarised DMG.

What an agent should check before installing a dependency, and which files it must never modify without a shown diff.

Where people get help, which versions are supported, and what an error message, a log line and a diagnostic bundle must and must never contain.

A file format verified only by the reader you wrote is verified against your own assumptions.

Driving an interactive Windows session over SSH, and why testing as an admin proves nothing about permissions.

A controlled study finds context files do not improve task success and cost 20% more — and its detailed findings are closer to this library's own rule than its headline suggests.

Drive interfaces by stable identity rather than pixels, in tiers, so tests are headless, deterministic and fan out.

Three ways a passing check reports success without ever being able to report anything else.

Three attempts to validate a scoring tool against human judgement, and why all three failing was evidence for the tool's premise rather than against it.

What to do when a tool built to outrank your judgement is wrong, given that overruling it destroys the only property it had.

An eligibility gate the sandbox does not enforce, a signature scheme that deviates from the spec it cites, and the webhook orderings that zero a live subscription.

What may be run without asking, what must stop first, and how to report what actually happened.

Six ways a code scanner mistook writing about a practice for following it, and a seventh found inside the check built to prevent the other six.

Four cases where a description and the thing it described drifted apart, none of which was discoverable by reading the description again.

Two ways text scanning silently misses what it exists to find — soft line wraps, and identifiers in an unexpected form.