
I came back from a match with two phones and one usable file. A retake had reused the filename of the first period and written straight over it. Every screen in the app had shown a green tick, and the test suite was green too: 283 tests at the time, 425 by the end of that week, passing the whole way with the bug sitting in the code. So the tests were not the check. Nothing that only runs the code an agent wrote for me is going to catch the thing the agent and I were both wrong about. What worked was running review as an attack, over and over. Each round, two or three agents, each given a different lens and told to assume the code is broken and report only concrete failure scenarios. One on data loss. One on integration. One asked to walk a real Sunday morning: the tablet dies at half-time, there is no signal at the pitch, somebody calls a false start, the game goes to extra time. Five rounds turned up 21 more ways to lose footage without anyone noticing. Rounds two and three each found bugs introduced by the previous round's fixes, which I had not expected and should have. The match-day lens caught things no amount of code reading would have. The worst find was already shipped: a check that would have refused to record the third period of a 3×30 match on a pitch with no signal, guarding against a problem that is completely fixable at home, by destroying footage that can never be taken again. That one became a rule at the top of the project doc. Never block recording. Refuse at processing time instead, hours later, at home, and make every refusal carry a remedy you can reach from the screen that shows it. The other rule is about tests. A fix without a regression test that provably fails without it has not been fixed, so now I make the agent revert its own fix and show me the test going red before I accept it. Green on its own means nothing. I want to have watched it be red for the right reason.



