What the lab shipped and learned lately. Deployed means running in production today; Measured means a number exists and is recorded — we never blur the two.
DeployedHuman-AI collaboration
Fingerprint the class, baseline the backlog, ratchet
Two unrelated defect classes each became a ratchet: a contract test that scans the codebase for the defect's fingerprint, fails on any new instance, and carries a baseline that may only shrink. One guards a structured-logging call form that silently drops its context; the other guards test files that name source paths as plain strings, which an import-based reachability check cannot see. The method is the reusable part, and it is independent of either defect.
DeployedHuman-AI collaboration
One classifier, two audiences
An unattended self-service payment surface once showed raw processor error text when a card failed. Every failure path now runs through the same failure classifier the staff terminal uses: the customer sees one fixed, plain-language decline sentence, and staff see the classified reason. The classification is computed once and only the rendering differs by audience — there is no second, weaker implementation left to drift.
DeployedHuman-AI collaboration
The platform audits its own bookkeeping
A nightly sweep runs a registry of cross-cutting data-integrity invariants — business-day-window sanity, cost-versus-revenue plausibility, zero-revenue lines, payment completeness, stuck orders, costing coverage — each check encoding a defect class the platform has seen once. Findings deduplicate on a stable fingerprint and accumulate occurrences instead of piling up rows, and a sweep that fails to run is itself a finding.
DeployedHuman-AI collaboration
Pre-registration the system enforces
On the research portal, a measurement freezes its claim, hypothesis, metric, method, and target before any data is seen — the API rejects edits after the freeze. Findings promote from built to measured only when a number lands, and every review binds to the exact text it read, with diffs naming what changed since.
DeployedLanguage models
Never mint an ingredient from a label
The receipt-line matcher no longer creates inventory identities from unfamiliar labels. An alias dictionary that once spawned records named after branded package variants now resolves every entry to one canonical ingredient, carrying package size as metadata; an unmatched base name is offered to the reviewer as a suggestion, never created; and a fuzzy match below a fixed confidence threshold is never applied on its own. This closes the double-bookkeeping failure where purchases post to one identity and consumption drains another.
DeployedLanguage models
Irreducible ambiguity is returned, not guessed
Reassembly emits a proposal — it writes nothing on its own — with every unresolved conflict enumerated for a person. Where one item name survives at two different prices across fragments, the data cannot separate a line read twice from two genuinely identical packs, so that case is handed back rather than resolved by preference. Deduplication is scoped across fragments only: a line the document really printed twice survives.
MeasuredLanguage models
Position carries no signal in a photographed document
When one long document is captured as several overlapping photographs, the intuitive stitch — find where one fragment ends and the next begins, then splice — has nothing to work with. On a single production document, position-based splicing found an overlap of zero while 30 of 34 lines matched somewhere across the fragments by content. That is one observation, not a rate. The engine therefore matches on normalized item name plus exact price, and judges the reassembled result against the total the document itself prints rather than rebuilding one from dozens of noisy small-figure reads.
DeployedSoftware maintenance
A capability can be finished and still unreachable
The machinery to identify a customer who has no account was complete and present in the codebase for 69 days before any request could reach it, because a guard written 26 days earlier — encoding a limitation that was real on the day it was written — still stood in front of it. Removing the guard, not building the capability, was the whole of the repair. Systems accumulate guards faster than they retire them, and a guard is hardest to see when the code behind it is correct: nothing fails, the capability is simply never observed to work.
DeployedSoftware maintenance
A stage whose only symptom was absence
An automated release pipeline was found to contain a promotion stage that could not run at all: it waited on an event that is never delivered for machine-initiated runs, so the stage emitted no output, no error, and no run record. Its only symptom was absence — nothing to read, and nothing that announced there was nothing to read. The repair removed the dependence on cross-stage event delivery entirely, moving the promotion into the same run as the validation it depends on rather than making the missing event more reliable.
DeployedSoftware maintenance
Preview equals commit
For a monetary action an operator previews before confirming, the figure on screen is computed by the same function that writes the record — equal by construction, not by a separately maintained estimate. A later correction is an additive ledger event linked to the original, never a rewrite, and it applies at most once under a guard evaluated inside the writing transaction, so a second submission cannot correct twice.
DeployedForecasting & inventory
Untracked is not low
One canonical low-stock rule now separates "untracked" from "low": an ingredient with no par set is never reported low or out, so never-received, never-used rows stop burying the real shortages. Every consumer routes through the one module, storage-side comparisons that cannot call it carry an explicit positive-par guard, and a source-level fence test enforces both. The flip side — a used ingredient with no par running out silently — becomes a named warning in the nightly invariant sweep, pointing at the surface where the threshold is set.
DeployedForecasting & inventory
A dish costs everything or nothing
Per-dish recipe costing is all-or-nothing: if any ingredient cannot be unit-converted and priced from a verified source, the dish reports no cost at all rather than a partial one — because a partial cost understates cost exactly where the data is weakest. A missing number that says so beats a plausible number that lies.
DeployedKitchen process
One rule, three artifacts, and a drift check
A single owner-confirmed portion rule is the source of truth for a whole family of dishes. The prep-graph mappings, the per-dish deduction recipes, and the unit-converted cost of each dish are all generated from it mechanically, and a daily check re-runs the generator in dry-run mode and flags any dish whose stored recipe has drifted from the rule. Generate, then detect drift: several consuming systems stay consistent without hand-maintaining each one.
MeasuredKitchen process
Instant voice now, neural voice on repeat
Streaming neural speech is infeasible on the kitchen’s constrained hardware — measured real-time factors of 1.6–2.3, plus a twelve-second model load — so the first time a phrase is needed it plays instantly in formant synthesis while a neural rendering is cached in the background. Repeats play the cached audio: latency never regresses, and because kitchen replies are highly repetitive, voice quality converges on the phrases that actually get said.
DeployedKitchen process
Popularity computed from settled sales
Best-seller rankings are recomputed nightly from settled sales in one idempotent set-based pass — nothing increments inside payment paths, and cancels and refunds self-correct on the next run. One recompute that is always right beats a counter on every settlement path, where a single missed hook under-counts forever.