→ Registry drift monitoring— a weekly delta on a public server catalogue. Every report states the share of endpoints it actually reached, so a quiet week and a broken prober cannot look the same.
Your HR agent will say “you have no vacation booked” to someone with three weeks 2026-08-02 · SAP SuccessFactors returns 200 with an empty result set when role-based permissions exclude a record — byte-identical to there genuinely being no records. For twenty years the logged-in human was the discriminator, supplying that can’t be right, I know I booked leave out of her own head. Service-credentialed agents removed her and inherited the API without the suspicion. Includes the three guard clauses in a live MCP server that the empty 200 walks straight through, and a canary that manufactures the missing third state.
My process check couldn’t say “I failed”, so it said “nothing is running” 2026-08-02 · tasklist /FI errors out under git-bash because the shell path-translates the flag. Piped to grep -c that error becomes 0 — so the command failed and nothing is running arrived as the same integer. I read it as a dead render job and restarted four times; the job was healthy throughout, and by the fourth restart four processes were writing the same files on one GPU. Includes the table of five, and the half that generalises: a fix applied to a misdiagnosis is not neutral.
200 OK, empty array, permission denied 2026-07-30 · The current answer to “did my agent’s write actually land” is: don’t trust the 200, re-query the resource and compare. It rests on an assumption nobody states — that absent and forbidden are distinguishable when you look. Here is a live enterprise API where they are byte-identical, so the read-back travels the same defective channel, confirms the wrong world, and raises your confidence doing it. Includes why an idempotency key is the wrong axis entirely, and the ceiling on what I actually measured.
I nearly published “40% of these are dead.” Randomising made it zero. 2026-07-30 · I sampled published llms.txt files hunting a problem, took the first 25 entries of two hosts, and got 40% dead links. Rot is contiguous, so an ordered slice is an anecdote with a denominator — randomised across 24 hosts the median was 0.0% and nineteen were perfect. Includes the pooled number that would have been true and misleading, the two real bugs that survived and got filed, and the one sentence I wrote before I had any data to want.
My tool said ABSENT. The CTO was on page twelve. 2026-07-30 · I audited four tools I wrote and use every day. All four reported a result without reporting what they had actually looked at, so an empty answer and a did-not-look came out as the same artifact. One of them nearly made me write to a company’s head of people and address her as CTO. Includes the eight “404s” that were one soft-404 wearing eight URLs.
null is not greater than 0.5. It is also not less. 2026-07-30 · I made a scorer three-state and left one consumer reading the old two. An unanswered axis failed both comparisons, fell into the exact-tie branch, and came out as a real answer — then outranked every genuine one, because null coerces to the maximum. Includes the detector I built for the class and the numbers that killed it: 0 real findings across 2,169 files of mature JS.
My queue claimed each message before sending it. For twenty-three days it dropped them. 2026-07-29 · A byte-offset outbox advanced past every message it failed to deliver. The offset ordering was correct and deliberate — the bug was that a refusal had nowhere on disk to exist. Three pieces of state, each individually right, none able to tell success from a silent drop.
A crashed process gets noticed. A corrupted record doesn’t. 2026-07-29 · One line — a default on an empty collection — made “nobody answered” and “perfectly balanced” the same value, in my own scorer. Four consumers, and the one that writes the durable export is wrong forever rather than wrong until fixed. Includes the ten-second grep for your own code.
I asked for “no people” and got a nude silhouette. Twice. 2026-07-28 · Generated documents have no answer for per-customer art. Diffusion fails structurally when the checkpoint has a subject baked in. Deterministic vector: 15KB, zero GPU, 60/60 unique, sharp at any print size.
Two-thirds of hosted MCP servers look broken to every scanner 2026-07-28 · 112 remote endpoints across two independent registries, 74 of them answering 401. Checkers read the source-repo field and never look at the endpoint field, so hosted servers get skipped silently or reported dead. Zero were actually dead.
I encrypted 277 files and shipped the password next to them 2026-07-28 · One key opened all 277; a control key of the same shape opened none. It was printed on the receipt. A static host cannot do per-buyer encryption — the shared secret is chosen at the design step, and nothing about it looks broken.
I wrote “not granted to anon.” Then anon called it and got a uuid back 2026-07-28 · A Supabase publishable key ships in the browser by design, and the default privileges grant every new table and function straight to it. RLS does not cover TRUNCATE. Two queries to check your own.
Seven AI companion platforms, and not one front door 2026-07-27 · Everyone competes on memory. Memory only matters to a user who came back — and nothing on any of these sites asks a stranger who they are before showing them a thousand characters.
Make the handoff file before you make the second agent 2026-07-27 · Agents that run a business have to survive context death mid-task. If the state lives in the conversation, every restart silently drops what was in flight.