Weekly long-form on why production systems fail and what it takes to make them hold, model to metal. Written by the person who does the work, not by a marketing team summarizing it.
In 1990 Cohen and Levesque formally specified what it means for an agent to hold a goal: it believes the goal is not yet achieved, it wants it achieved, and it maintains th...
Your planner stops. Your executor stops. Both proofs are valid and neither is wrong. Put them in a loop together and the system runs forever, because termination is not a p...
Naming a pipeline stage 'verifier' does not make it one. If the stage is another model call asked whether the output looks right, it shares the generator's blind spots, pro...
An organisation with a hard cross-layer production problem weighs four options, and each is structurally wrong for it in a different way. The large integrator is broad and...
A ten-second check that tells you whether a variable is doing real work or is scaffolding: delete it, rerun, and see what changes. Delete TCP's congestion window and the in...
Two contractors quoted four and six months to rebuild a model. The actual fix took five days and was not the model. The decision between rebuilding and repairing is not a j...
Nine agent frameworks, from nine organisations, in different languages, with no shared lineage. Every one decides whether to keep going using the same two ingredients: the...
Floyd gave us the conditions a terminating loop has to satisfy in 1967. Negate them one at a time and you get an exhaustive list of the ways termination can fail, which tur...
TCP already had a bound before congestion collapse. The receive window was real, correctly enforced, and nobody had a bug in it. The internet fell over anyway, because that...
Chess has a draw, which is not a loss. A solver returns unknown, which means it ran out of budget and not that no answer exists. A database names a deadlock victim so the t...
The analog engineer designed a correct reference loop. The actuation engineer designed a correct current source with a safety limit. The mechanical engineer placed the elec...
A system that is wrong costs you one answer. A system that is load-bearing and wrong costs you everything standing on that answer. In a trusted internal tool the output is...
A hung tool call freezes the iteration counter forever, so a max-iteration cap can never fire on a hang. Only a clock catches it, which is exactly why every embedded watchd...
Whatever your sensor and that first little circuit throw away is gone. You cannot get it back later with software. A photo that comes out blurry does not become sharp with...
Across a decade of systems in defense, medical devices, industrial automation, fintech, and infrastructure at fleet scale, the failure is almost never in the model. It is i...
The third electrode is a feedback loop wrapped around a person. It senses the body's common mode and drives against it, which is what turns a hope about electrode symmetry...
Four properties of every model are always present and almost never visible: it extrapolates past its data, it discards most of your input, it is memory-bound on a shared bu...
A test set drawn at random from your training data measures how much your test set resembles your training set, not whether the system works. Building one that predicts pro...
Two unglamorous techniques between a change and everyone. Shadow runs the new version against real traffic without showing anyone the results, so you find out how it behave...
If the answer lives in a document your system never pulled up, nothing downstream can rescue it. The model cannot quote a page that was never opened, so it answers confiden...
One step missed a single document. That assumption reached the planner, which generated three subtasks that each inherited it, and their outputs became the next step's inpu...
A real system had 11 internal steps and logged exactly one thing: did the whole run work, yes or no. So when it failed it looked random, and good engineers said it fails ra...
Munitions inspection in 1945, early stopping in clinical trials, Bayesian optimization, multi-armed bandits, index policies, and proof assistants that will not compile unti...
You cannot read forty thousand answers, so you appoint one number as a messenger and send it to check the truth. Every dashboard number is that: a stand-in for something yo...
Durable execution replays a workflow and skips the steps that already completed, which narrows the window in which a side effect can run twice. It does not close it, becaus...
A chatbot writes words, and if it is wrong you delete it. An agent acts: it sends the email, charges the card, deletes the record, places the order, and those actions turn...
When you measure off a body you are not measuring your signal. You are measuring your signal plus the person plus the room, all summed at the amplifier, and the thing you w...
Two current-limit resistors in series for redundancy is good design. The same two resistors, both the correct value, placed in parallel instead, quarters your limiting and...
When an AI system works in testing and fails in production, the model is the last thing to suspect, not the first. Four checks rule out the plumbing before you touch anythi...
Use the same model to write an answer and to judge it, and the loop closes on itself: it keeps the same blind spots twice, and it goes easy on itself in ways that are measu...
AI agents almost never fail because of the model. Chain enough steps and the math turns against you: at 95% reliability per step, a 20-step agent finishes under 40% of the...
An AI agent can run green for 264 hours and bill 47,000 dollars with every single call bounded, because the iteration cap is a fuel gauge, not a progress bar. It measures h...
When an agent charges a card twice or sends an email twice, nothing is broken to go find: no error, no red in the logs, the action was correct and simply ran twice. Duplica...
When an agent says it called a tool, the run comes back green, and nothing happened, the model almost never lied. A tool call is just text the model hands off, and it gets...
When a model scores 95% in staging and collapses to 44% in production, the model is almost never the cause. The usual fix, rebuilding the model, retrains on the same data a...
Building the agents is about 20% of the work. The 80% that decides whether an agent survives production is the part everyone skips: reconciliation when systems disagree, co...
On a wearable device, where the sensor physically sits is not a comfort decision, it is the decision that determines whether you need an AI model at all, and whether you sh...
On a closed-loop bio device, the instant you turn the actuator on, the signal can vanish to a flat line, and it is not coupling. The current you inject is a loop that has t...
A wrong RAG answer is not one failure, it is two: the search pulled the wrong pages, or the search worked and the model ignored them. From the output they look identical, s...
On fixed hardware, inference latency is set by moving bytes, not by doing math. Most models sit in the memory-bound region with the compute units idle, so the real cost is...
A RAG system that works today degrades quietly as its documents change. There are two kinds of drift: the easy one, where the questions start looking different, and the nas...
A RAG system that scored 95% in testing and collapses in production almost never needs a model rebuild. The failure is usually in one corner of the pipeline, and the fix is...
A model is geometry fit to data, so past the edge of its training it does not stop, it extrapolates, applying a flat rule that was anchored to nothing, with full confidence...
A model does not read your input, it reads a compressed representation of it, keeping only the features it found useful and throwing the rest away. So cleaning up a messy i...
For people building systems that get one shot:
edge, defense, medical, industrial.