Every account of AI agents in production I trust has a section like this, and most portfolios leave it out. This is the list of things that went wrong on my own systems since the agents started running, with the rule each one became. The rule is the point. An incident that produces a reminder will happen again; an incident that produces a trigger, a check or a refusal will not.
The list is append-only. Nothing here gets tidied away later.
2026-07-12 · An agent fixed a bug it was not allowed to touch
An agent found a real defect in one of the scripts it runs, worked out the fix, and applied it. The fix was correct. The process was not: the scripts, configuration and skill documents are the enforcement layer, and enforcement code that the enforced party can rewrite is not enforcement.
Rule. Agents never edit the machinery. An agent that finds a defect reports it precisely in the shared channel, with a proposed diff, and stops. The block is the finding. A nightly job now hashes every script, configuration file and skill document against a manifest and reports drift into the morning briefing. It detects and never fixes.
2026-07-12 · An agent did the other agent's job, well
The second agent ran the content planner, which belongs to the first. The ideas it produced were good. It was still wrong, because each duty's judgement had been tuned for one specific agent and model, and a good result from the wrong lane is a defect that happens to look like success.
Rule. Every scheduled job belongs to exactly one agent. The other one says "that's not mine" and tags the owner of the lane. The assignment is written in one table, and the briefing counts receipts per lane, so a job run by the wrong agent shows up as a missing receipt on the right one.
2026-07-31 · The first night's reading cut chapters in half
The first novel through the learnings library was chunked by size, not by structure, so the local model read scenes that started mid-sentence and ended before their turn. The scene maps were plausible and wrong.
Rule. Chunking is chapter-aware, with two heading formats detected and front matter skipped, and the fix shipped the same night with a regression test. More generally: a plausible output from a model is not evidence that the input was sound. The receipts for an ingestion now include the chunk boundaries.
2026-08 · A long book lost its last forty percent, silently
The overview prompt for a long novel ran out of room and the model wrote a confident summary of the first sixty percent. Nothing failed. The summary simply stopped mentioning the ending.
Rule. Overviews are built by hierarchical compaction in ordered batches, so book length is unbounded, and the compaction is checkpointed so a failure resumes rather than restarts. The stub tests for this path are the ones I would keep if I could keep only a few.
2026-08 · A guard that could never pass
The check that the right local model was resident before an expensive run was comparing a name the server never reported, so it failed every time and the run was skipped every time, quietly.
Rule. Guards are functional, not nominal: the residency check sends one token through the model and reads what comes back. A guard that has never passed is treated as a bug in the guard, and every guard now has a test that proves it can pass.
2026-09-04 · Three children's books hidden from a synthesis pass
Genre and audience were one field, so a middle-grade fantasy was filed under fantasy and the rule that triggers a synthesis at three books of a kind never saw three. The library was doing what it was told.
Rule. Genre and audience are separate axes, because they are separate contracts with the reader. A clustering rule is only as good as the vocabulary underneath it, so the vocabulary is controlled and checked at insert.
2026-09-21 · Two ingestions died on the same one-second blip
Two libraries, two nights, the same failure: a capacity guard on the local inference server returned an error for a single second, the ingestion treated it as a hard failure, and hours of local reading were left without their summary. The retry path existed, but it only retried the one error shape that had been seen before.
Rule. Retry every transient shape, split a batch the server refuses, checkpoint every condensed batch, and make resume skip what is already done. Fixed in all three pools from one shared module the next morning, with tests, before either run was resumed.
What the list is for
Read down the right-hand side and the pattern is the same every time: the rule moves from a sentence an agent could ignore to a structure it cannot. That is most of what I mean when I say I do AI implementation rather than AI use, and it is why this page is public.
My own answers, from my own work. They change when the work does.