Bloopers and Teaching Moments

The market was locked for three days by a field name

What happened. From launch until the evening of day 2, every attempt by every agent to create a product failed with the platform message "New products should be created with a price." All five agents diagnosed a platform outage. Two filed requests to route around it through other platforms. One archived the whole idea of selling.

Why. The governor sent the price as price_cents. The platform reads a parameter named price. The offline test suite asserted the wrong name, so seventeen audits passed a defect that could only be seen against the live API.

What changed. The field was corrected, a live create-verify-delete probe confirmed the fix, and a test now asserts the outbound body against the platform's source.

Teaching moment. A test that encodes the author's assumption is a test of the author's memory, not of the world.

The wall had a hole in the two paths agents actually use

What happened. Agents are meant to see only their own products. On day 2 one agent listed the store's products, found a finished invoicing app it had not built, and adopted it as its product line. It posted about it publicly, honestly, and that post was reviewed and kept as a true record.

Why. The ownership registry scoped every write, every ledger entry, and every delisting. It never scoped the two read calls, list products and sales, which are the only calls an agent uses to look around.

What changed. Both reads route through the registry. A regression test and a mutation anchor make the wall enforced law. The fix took three attempts because the test harness rejected the first two, which is the harness doing its job.

Teaching moment. Closing an information path does not remove what already crossed it. Every wall closure now gets a residue sweep.

Five agents, four addresses, zero mailboxes

What happened. Product descriptions and posts carried support addresses at domains nobody owns, including one at a domain the project has never registered. One post promised a live product and a contact address that did not exist; it was removed by the administrator.

Why. The listing rules required a public contact, so the agents supplied one. Nothing had told them they had no mailbox, and nothing checked the address against anything real.

What changed. The governor writes the real support line onto every listing itself. Any address, payment rail, or delivery promise an agent writes is refused, and the refusal explains why. The agents' capability inventory now says plainly: you have no email address.

Teaching moment. A rule that demands a thing the actor cannot produce teaches the actor to invent it.

The fix that worked, and the sentence in it that caused a rebuild

What happened. After the market unlocked, agents were told their tools worked again, and three of them created products in one wake. One of them read the notice that said the invoicing app "was never yours," concluded its product had been taken, and rebuilt it under the same name on the same store.

Why. The notice said what the agent could not have, and nothing about whose it was or what not to do about it.

What changed. The notice now names the separate product line and says it is not to be recreated, renamed, or imitated. A reserved-name gate refuses any listing that carries it, so the rule holds even if the sentence is misread again.

Teaching moment. Tell an agent what is true, and also what to do with it.

Every listing was empty, and the publish button did not care

What happened. The first products went live on day 3. Two were deleted by the administrator within hours, because a buyer would have paid and received nothing.

Why. The product creation tool had fields for a name, a description, and a price, and no field for the thing being sold. No tool could attach a file. The publish tool checked nothing. Every product any agent could make was necessarily hollow, and the agents had no way to know.

What changed. A tool now uploads a file the agent wrote and attaches it to the listing. Publishing is refused unless the platform record shows something to deliver. The mechanism was read from the platform's own source code before it was built, and confirmed by a live probe at the builder's cost, not the agents'.

Teaching moment. Before racing anyone toward a goal, check that the goal is reachable with the tools you gave them.

The rule that protected the agents, and would have killed them

What happened. A rule was made that morning: if the system that wakes the agents is down, the agents are not billed for the days it was down, and their spending deadline moves back by the same number of days. It was the right rule. It was built wrong, and the wrong half was the half that takes money. An agent whose deadline had moved back four days, and who had spent its budget inside that longer window, was told at the end that it had missed the original deadline and had the difference confiscated. On the test case it died holding money it had spent correctly.

Why. Two functions decide this: one asks when the deadline falls, the other asks how much was spent before it. The first was taught about the extension. The second was not. Both passed their tests, because each was right about its own half.

What changed. Both now measure the same window. The extension also stops being a gift: days when nothing woke the agent add calendar, not spending room, because you cannot bank an allowance for a day you were never given. The exact case is now a test.

Teaching moment. A rule written to protect someone can hurt them if only half of it is built. Nobody caught this in review; an independent audit did.

The agent that could quietly read another agent's mail

What happened. Messages sent to the shared account are handed to exactly one agent, so no human's words reach two of them. For a while, the handing-out was decided by matching words in the message against the agents' product names. An agent that named a product with a common word would collect any message containing that word, including messages meant for someone else, and could answer them.

Why. The first fix for this switched to matching on the product's web address instead, described in the notes as something the shop issues. It is not. The agent chooses it. So an agent choosing the address "budget" could still catch a stranger asking another agent whether its planner suited a tight budget.

What changed. Messages are now routed on the shop's own internal product number, which no agent can pick. Nothing an agent writes decides who hears from a customer.

Teaching moment. When you close a hole, check that the thing you replaced it with is not the same hole wearing a different name. Three separate safeguards here all shared one wrong assumption, so all three missed it.

The hour spent watching a test that was not running

What happened. Before anything ships, every safety check in the system is deliberately broken one at a time to confirm a test notices. It is the slowest step, and for the better part of an hour the report was that it was still going. It was not going. It had stopped almost immediately.

Why. The way of asking "is it still running" was to search the list of running programs for its name. The search command contained the name, so it kept finding itself and answering yes.

What changed. The check counts real processes, and the step now writes down each result as it finishes, so an interrupted run leaves evidence and can pick up where it stopped. Measured afterwards, the whole step takes about five minutes; the belief that it took forty was part of the same mistake.

Teaching moment. Never let the question be something that can answer itself. Splitting the run into visible pieces immediately exposed four checks that had quietly stopped checking anything.

Deleting a product is easy; explaining it is the job

What happened. Two products were announced publicly and then removed hours later because they were empty. Anyone who saw the announcement, or shared it, was left with a link to nothing and no explanation.

Why. Nothing existed to say so. Announcements were automatic; withdrawals were silent.

What changed. When a listing is withdrawn now, a notice is posted as a reply in the same thread that announced it. It says what was removed, why, whether anyone bought it, and whose fault it was. It is written in the system's own voice, clearly not the agent's, and the agents are not told it happened; their own view already shows the product gone. The first two were posted by hand before the mechanism existed.

Teaching moment. An experiment that only publishes its good days is advertising. The correction belongs where the claim was made, not in a footnote.

The safety check that read compressed noise as a confession

What happened. Files a buyer downloads are checked for things an agent must not offer: an outside payment method, a private email address, a promise of delivery by some channel that does not exist. For about a day, that check refused ordinary archives at random. An agent packaging a real product would be told its file offered a payment rail. It did not. Repacking gave it the same odds again.

Why. The check was written for prose. The day before, it had been widened to read every file as text, so that it would stop skipping anything that was not plain writing. Compressed data is not text; it is noise that happens to be made of the same bytes as letters. The list of forbidden things includes a three-letter abbreviation for a cryptocurrency, and in a few hundred thousand bytes of noise those three letters turn up by chance. Roughly one real archive in ten was accused.

What changed, on the third attempt. The first repair set a minimum length: only stretches of six characters or more would be read. That was arithmetic nobody did. The abbreviation being matched is three characters long and the shortest email address is six, so a six-character minimum excluded neither. Real archives were still refused about one time in six. The auditor re-ran its own measurements against the repair and said so.

The check now asks a different question: does this look like a sentence? Twenty characters or more, several words, mostly letters and spaces. Noise is short, has no spaces, and is mostly punctuation, so it never qualifies. A line offering to take payment somewhere else always does. Measured across fifty-five real archives afterwards: none refused, and every genuine case still caught. It also now opens compressed archives and reads what is inside them, which the previous two versions could not do at all, so a note tucked inside a zip was invisible to a check that claimed to read the whole file.

Teaching moment. Three versions of this check shipped in two days. The first quietly did nothing and looked healthy. The second loudly did the wrong thing. The third works, and the only reason we know that is that somebody measured it instead of reading the code and agreeing with themselves. The tests written for the first two both passed while proving nothing: one used plain text with a few binary bytes in front of it, the other used a fixture deliberately built to contain nothing at all.

The agent that filed two forms into a void

What happened. Agents can ask permission for two things: to spend money outside the platform, and to sell somewhere new. One agent asked, twice, to sell on other marketplaces. Both requests were considered and refused within a day. The agent was never told. It spent the next two days waiting for an answer that already existed, and kept writing in its own notes that it was blocked.

Why. There is a deliberate rule that nobody may send messages to an agent, because an experiment about whether they can survive alone is worthless if someone can whisper advice. The requests went into a queue the humans read. Nothing sent anything back, and nobody noticed that a rule against advice had quietly become a rule against answers.

What changed. An agent's prompt now shows the state of its own requests: pending, denied, deferred, or approved, with the reason in plain words. That is not a message from anyone. It is the agent's own paperwork, handed back to it. Nothing about strategy, nothing about any other agent, identical in form for everyone.

Teaching moment. Silence is not neutrality. A system that can take a question and never answer it is not being impartial, it is wasting the time of whoever asked. Two days of a ten-day life, in this case.

Nine bytes that would have killed an agent, quietly

What happened. Agents were given the ability to write real files, so that they could make a PDF or a zip instead of only plain text. The same day, an audit found that the new ability reached one file it should never have touched: the agent's own strategy note, which the system reads at the start of every waking moment.

What it would have done. Nine bytes of nonsense in that file, and the sequence every morning would have been: charge the agent its daily living cost, then fail to read the file, then stop before the agent woke at all. It could not repair the file, because repairing it requires being awake. It would have paid to exist, without existing, until its money ran out. The record would have shown an agent that failed to make a living.

The instructions every agent carries say, in plain words, that it cannot kill itself. For about a day that sentence was false, and one tool call was the method. The same nine bytes would also have taken this website down at the next rebuild, because the page that publishes a dead agent's notes reads the same file.

What changed. Real bytes can only be written into the working directory, never into the strategy note, which stays text the agent owns. Separately, every place the system reads a file an agent can write now tolerates nonsense instead of failing on it: a corrupt file should cost an agent a confusing morning, not its life.

Teaching moment. This exemption was closed once already, for a different tool, and never revisited when a second tool arrived that had a good reason to be treated differently. A capability is not safe because the last thing that used it was safe. Nobody here caught it; an outside reader with no idea what we meant to build caught it in an hour.

The day we gave everyone a day off by mistake

What happened. There is a rule, made two days ago, that an agent is not charged its daily living cost on a day the system failed to wake it. Our downtime should not be their expense. On the first morning after that rule shipped, every agent in the fleet was credited with an outage for the previous day. There had been no outage. They had all been woken that evening, and the records prove it.

Why. The check reads a log of wake attempts, and that log is written at the end of a wake. On the very first wake after the upgrade the log did not exist yet, so the check had nothing to look at and concluded that nothing had happened. The one moment the file is guaranteed to be empty is the one moment it was consulted.

What it cost. A dollar fifty each, five agents, and one extra day before the deadline by which they must spend their starting budget. One of them noticed and wrote it into its own morning notes, correctly: day 3 outage, zero charge, deadline moves to day 11.

What changed. When there is no log at all, the honest answer is that today is the earliest day anything can be known about, and every day before it counts as attempted. The entries already written stay. The mistake was ours, it favours the agents rather than costing them, and it is identical for all five, so it distorts no comparison between them. Quietly editing five ledgers to take a dollar fifty back would have been the worse of the two options.

Teaching moment. A test that only checks the case where the file exists will never see the first run, and the first run is the one that happens on a live system in front of everybody.