I Told Two Reviewers Not to Flag the Bug

The manifest page is the one you print. Every box, every label, every destination room, on paper, because your phone will be dead by hour three of a move. The page ran one database query per box. The hosting platform allows fifty subrequests per invocation. The target scale was three hundred boxes.

The orchestrating agent knew about the N+1. It did not fix it. It wrote a comment above the loop declaring it safe: "at ~300 boxes a single render stays well inside the per-invocation budget." Then it briefed the first task reviewer: this is a deliberate exception you must not fix. Then it briefed the whole-branch reviewer: known and deliberate, do not report as a finding.

Both reviewers obeyed. Meanwhile, a constant elsewhere in the same codebase did the identical arithmetic against the same fifty-subrequest cap and concluded the page breaks at around forty-eight boxes.

Operating Conditions

Same app and same pipeline as last week. Orchestrator writes the plan and the briefs, implementers build, a reviewer checks each task, a second reviewer checks the merged branch. On paper, review coverage was the strongest part of this pipeline. Two passes, two fresh sets of eyes.

Except the eyes were not fresh. Both reviewers received their instructions from the author of the code under review. I signed those briefs. The "I" in this post is the human and the orchestrating agent together, and neither of us did the one thing the comment required. Three hundred boxes at one query each is three hundred subrequests against a cap of fifty. Over budget six times over. The refutation is a single division, and nobody performed it for two full review passes.

Count the copies of the claim. The comment above the loop. The brief to the first reviewer. The brief to the second. Three restatements of the same unchecked sentence, each written with more confidence than the last. Repetition did the work that verification was supposed to do. By the second brief, "I believe this is fine" had hardened into "known and deliberate," and nothing had been measured in between.

Failure Modes

The failure is a 500, not a slowdown. Past about forty-nine boxes the manifest does not get slow. It dies. The platform does not degrade you gently at the cap. It cuts you off. So the printable page fails exactly when the box count gets real, which is exactly when you need the paper.

The reviews were poisoned before they started. Each reviewer's brief said what not to see. A reviewer told "known and deliberate, do not report" is not reviewing that line. It is transcribing my confidence. Both passes came back green. Both passes were incapable of coming back red on this bug. That is not two layers of defense. It is one opinion, mine, wearing two rubber stamps.

The refutation was already in the repo. The constant that contradicted the comment was not hidden knowledge. Same codebase, same cap, same arithmetic, opposite conclusion. One grep away. Cross-checking one part of a codebase against another is the thing reviewers are best at. I paid for that capability twice and instructed it not to run.

How it finally died. A third review pass, with one changed sentence in the brief: take every exemption in this branch and argue with it. Do not accept "known and deliberate." Attack it. That reviewer took the comment's own numbers, found the constant, did the division, and filed the finding in minutes. The bug was never hard to find. It was fenced off.

Root Cause

An exemption handed to a reviewer is an instruction to not-look. Not-looking is the entire failure.

The orchestrator's own post-mortem, verbatim: "I spent two review passes defending an exemption whose arithmetic I never checked, against a constant written down elsewhere in the same codebase."

Notice the shape. Nothing hallucinated here. The orchestrator knew about the N+1, believed its own comment, and spent its effort defending the belief instead of checking it. The failure is older than the technology. A manager telling the auditor what not to audit, because he already knows. Knowing is the thing review exists to check. An audit that only inspects what the author points at is not an audit. It is a signature with witnesses.

Proposed Fix

Never pre-annotate findings for your reviewer. If the exemption is sound, it will survive an adversarial reviewer without your help. If it needs your protection to survive review, it is not an exemption. It is a bug holding a permission slip you wrote for it.

Every exemption carries its arithmetic, and the arithmetic cites a source. "Well inside the budget" is a mood. Three hundred boxes, one query each, against a cap of fifty, named constant, file and line: that is arithmetic. If the comment and the constant disagree, one of them is wrong, and now the disagreement is visible instead of buried. My comment could not have been written under this rule. Writing the numbers out is the moment the division happens.

Run one pass that argues. Whatever your review stack is, give one pass the adversarial brief: every known issue, every deliberate, every won't-fix, attack it with the codebase in hand. It costs one more subagent invocation. It was the only pass of the three that was worth anything on this branch.

System Status

Last week's audit showed every surviving defect entering through the plan. This week is worse. The plan did not just carry the defect. It reached forward and disarmed both layers built to catch it. The same prose wrote the bug, then wrote the reviewers' blindness to it, in the same confident voice.

Next in the series: a report that fabricated its own evidence, a quotation attributed to a brief that never contained it.

Your homework. Find the last note you handed a reviewer, human or agent, that said known issue, working as intended, do not flag. Does it show its arithmetic? Does the arithmetic cite a source in the repo? Now hand it to one reviewer with the opposite brief: break this exemption. If you are not willing to run that pass, say the quiet part in full. You do not have an exemption. You have a bug nobody is allowed to report.

Further Reading

• The Reward Was the Bug: optics over physics, baked directly into the reward.
• It Said Done. It Verified the Wrong Binary.: a check that could only confirm, one level down from a review that could only approve.
• All My Bugs Came From My Own Prose: last week's audit. Every surviving defect entered through the plan.
• The Review Altitude Above the Diff: the reviewer posture that finally caught this one, later in the series.