Learnings Ledger

Factory bypassed its own tools

Orchestrator wrote scripts instead of orchestrating

Orchestrator bypassed its own review score target

Per-tenant email uniqueness breaks login

Discussion logs not saved -- training data lost

Email case sensitivity in SQLite UNIQUE constraint

Bootstrap admin registration pattern

Validate event_type matches device_type

CORS wide-open despite known factory trap

Silent Error Swallowing Epidemic

Hardcoded Secrets in Source Code

Zero or False-Positive Test Coverage

No measurable success criteria defined

Vague requirements without numerical spec

No explicit OUT-OF-SCOPE list

No Day 0 smoke test on target environment

Config files required but not created

Multi-provider architecture without cost analysis

Path traversal vulnerability in file uploads

Unrestricted CORS configuration

hot_state rebuild uses wrong column names

Task assigned without valid route

Sync sqlite3 in async FastAPI blocks event loop

Frontend/backend field name mismatch -- renders empty

Claude declares "complete" with backend only

Frontend/Backend field name mismatch (extended)

WebSocket broadcasts never called -- dead code

Claude claims "fixed" without running verification

HotState must be integrated into routes, not just exist

List endpoints need pagination from day one

Putaway tasks must auto-generate on receiving completion

Pack tasks must auto-create when all picks complete

FK validation missing on INSERT causes 500s

Blueprint claims not enforced as tests -- spec fidelity gap

gRPC services need command queues -- not inline yields

Task assignment needs a background loop

Task completion must be triggered by robot state

gRPC must use TLS + auth interceptor

Dead code subsystems -- functions never called from main flow

gRPC proto must use string-encoded decimals for billing

Claude --print returns prose instead of code

validate_code() rejects tiny files as "prose"

Wrong import paths -- flat vs package

No provider fallback on repeated failure

LLM adds self-import in config file

Gemini not given contracts for contract review

passlib+bcrypt incompatibility on Python 3.12+

Pasting file contents into CLI prompts instead of using workdir

Local LLMs (phi4, Qwen) never called -- Claude does everything

Python hash() is non-deterministic across processes

Claude writes files it was told to delegate

config.DB_PATH must be read dynamically for test isolation

PyJWT requires sub claim as string, not integer

Partial unique index for soft-delete patterns

from app.config import VALUE captures at import time

Kimi generates false positive CRITICAL findings

Playwright E2E promised in blueprint but never built

Missing "my items" endpoint for CRUD owners

IntegrityError on duplicate crashes instead of 409

FTS5 contentless tables need application-level sync

updated_at must update on ALL mutations

FTS5 injection repeated despite P11 learning

Trip end coordinates should use stationary position

Timing attack on password comparison

Always add final distance segment when closing trips

Response format mismatch -- code vs contract

PMO Gate 10 too weak -- checks existence not content

Race Conditions in Concurrent File Operations

Technology selection without alternatives

Missing Architecture Decision Records

Missing edge case planning

No performance benchmarks defined

ML classification without accuracy threshold

No dependency budget -- install size bloat

Corrupted .gitignore allows secrets committed

Weak password hashing (SHA256 no salt)

Permission system fail-open

Subprocess pipes not cleaned on exception paths

Database connections without context managers

File uploads without size limits

Database schema missing indexes from blueprint

E2E fixture scope mismatch -- tests exist but don't run

Collision avoidance at assignment only -- no runtime

Battery service exists but never called

WebSocket events incomplete -- only 2 of 6+ broadcast

datetime.utcnow() deprecated

142 tests pass but 5 CRITICAL bugs in code

Battery management not wired into ping flow

WebSocket URL hardcoded to wrong port

Inventory status must transition after putaway

Order status must transition through full lifecycle

Negative values silently accepted -- validate numeric inputs

No requirements.txt -- project not reproducible

Route planning must cover full trip -- not just first leg

Map data must persist to database -- not in-memory dict

WebSocket broadcast shape must match frontend types

Contract shape mismatches -- 11 fields don't match blueprint

Emergency stop must be immediate -- clear queue first

WebSocket command handler is a stub

Analytics events mostly never logged -- dashboard shows zeros

Contract Alignment -- JWT payload missing tenant_id

Test files must test what their name claims

Tests must use correct auth roles

Security gates must fail closed not open

Blueprint models must be wired or removed

WebSocket broadcast must be wired into ingestion flow

Qwen Coder outputs "python" on first line

pytest-asyncio fixture API changed

DaC parser fails on real LLM output

No runtime validation -- only syntax check

Prompts not built from blueprint contracts

Kimi QC penalizes out-of-scope features

Qwen Coder still generates self-imports

Kimi falsely flags valid SQLite datetime syntax

Column name whitelisting for dynamic UPDATE queries

Gemini can't find files without absolute paths

/health endpoint missing from blueprints

SQLite does not auto-update updated_at

httpx.AsyncClient per request wastes connections

Soft-delete checks needed on referenced entities

Retry endpoint must validate parent entity is active

Trailing slash redirects break httpx tests

Kimi penalizes single-process design as "critical"

Whitespace-only usernames pass validation

Generator-based DB access in WebSocket handlers

JWT payload sub must be guarded with int() conversion

Offset-based pagination required for ranked search

cursor pagination must guard `is not None` not truthy

FTS5 malformed queries crash without catch

Tag creation race condition -- use INSERT OR IGNORE

Clamp Haversine formula input to prevent float errors

WebSocket broadcast not connected to activity logging

DELETE status code inconsistency (200 vs 204)

Hardcoded Configuration Values

AI-hallucinated features without user stories

Phantom dependencies in requirements.txt

Documentation drift -- references to non-existent files

Codex scores oscillate -- contract consistency iterative

SQLite check_same_thread with FastAPI TestClient

Hardcoded WebSocket URL

Factory fixes symptoms not causes -- structural debt

Dock lifecycle incomplete -- receiving must release dock

Pack before picks complete -- add cross-entity guards

PostgreSQL column names may differ from API field names

Redis KEYS command blocks server -- use SCAN

Dead Code -- analytics markers never called

Duplicate function definitions across services

Pydantic schemas must constrain string lengths

CORS wildcards are a security risk

FastAPI on_event deprecated -- use lifespan

WebSocket requires accept() before close

PMO False Positive -- "proto" in "prototype"

OUT-OF-SCOPE "frontend" keyword triggers UI check

PMO extracts field names as event types -- false positives

Orchestrator followed workflow correctly (POSITIVE)

Qwen Coder generates clean code with precise specs (POSITIVE)

Qwen Coder handles WebSocket contracts cleanly (POSITIVE)

Kimi score deflation is consistent -- push back firmly

Codex sandbox cannot make HTTP requests

Codex danger-full-access sandbox enables HTTP but slow