I build software that stays correct when things fail — and I publish the evidence.

CONTEXT — A research site's credibility rests on the match between its prose and its artifacts. Humans re-checking that by eye is a control that silently degrades the moment the dataset is regenerated.

• Review figures manually before publishing— drift is invisible until someone re-derives it; the control fails quietly
• Render every figure from a committed artifact, and gate it in CI

DECISION — No number is typed by a person. Each figure is resolved from a committed JSON artifact by a code path, and `pnpm budget` re-reads those artifacts from disk in CI — a drifted value fails the build.

ACCEPTED COST — Changing a headline number means changing the data and re-running the pipeline. Slower to edit, which is the point: the site cannot claim something its artifacts do not say.

CONTEXT — The evaluated models did not beat a single threshold on the count rate. A positive-result incentive buries that finding.

• Report the best model's higher point estimate as an improvement— the confidence intervals overlap — that framing would be a claim the data does not support
• Publish the null at full weight, with intervals shown

DECISION — The verdict is 'no gain', not a ranking. The site plots every model against the simple detector with its 95% interval so a sceptic can see the overlap rather than take the prose on trust.

ACCEPTED COST — A less exciting headline. A platform whose central claim is 'our evidence is checkable' only earns it by publishing this kind of result.

CONTEXT — An LLM could plausibly infer relationships the static analysis cannot resolve, and it would look impressive in a demo.

• Let a model fill gaps the resolver cannot close— a plausible edge is indistinguishable from a real one once it is in the graph; the graph stops being evidence
• Deterministic analysis first, evidence second, inference third — the model last, and never in the graph

DECISION — A model may explain a subgraph after static analysis has produced it. It may never propose an edge. This is recorded as an immutable architectural principle.

ACCEPTED COST — Coverage grows more slowly, and some real relationships stay unresolved until a compiler problem is solved properly. In exchange, every edge in the graph means the same thing.

CONTEXT — Dynamically constructed URLs, ambiguous route candidates and calls to absolute hosts all resist resolution.

• Emit a best-guess edge with a low confidence score— consumers read the edge and ignore the score
• Decline the edge and record why

DECISION — Ambiguous candidates produce no edge, an unresolved URL prefix is declined until the milestone that can evaluate it, and a call to an absolute host is never joined to a local route.

ACCEPTED COST — The graph is deliberately incomplete. That is the difference between a map and a guess.

CONTEXT — The obvious design writes stock changes inside the request handler. Under load, that couples user latency to database contention and makes retry semantics ambiguous.

• Synchronous decrement in the API route— retries and duplicate submissions double-decrement; a crash mid-request loses the order
• Optimistic locking in application code— does not survive retried requests or a worker dying between read and write
• Idempotency check → Redis queue → single worker

DECISION — Accept at the edge, deduplicate by idempotency key, enqueue, and let one consumer apply changes through the locking RPC.

ACCEPTED COST — Purchases are eventually consistent (queue latency), which the UI must communicate. In exchange: exactly-once effects, calm failure handling, and a database that can be busy without users feeling it.

CONTEXT — The invariant must hold even if every process above the database misbehaves.

• Check-then-write in the worker— TOCTOU race between check and write
• SELECT … FOR UPDATE inside a Postgres RPC

DECISION — decrement_stock_atomic() locks the row, validates available stock, applies the change, and appends the audit entry — one transaction, one place where the invariant lives.

ACCEPTED COST — Throughput on a single hot item is serialized by design. Jobs are sorted by item id before processing to avoid deadlocks across items.

CONTEXT — Edge rate limiting depends on Redis. What happens when Redis itself is unreachable?

• Fail closed: reject all traffic without Redis— turns a cache outage into a full outage; protection becomes self-inflicted denial of service
• Fail open with a logged warning

DECISION — Availability wins for the rate limiter; the stock invariant never depends on it.

ACCEPTED COST — A Redis outage temporarily removes rate protection — accepted and logged, because correctness is enforced a layer down.

CONTEXT — Every text-level signal is under attacker control by definition.

• Prompt classifier over text— defeated by paraphrase, encodings, prefix injection — exactly the threat model
• Hidden-state trajectory geometry

DECISION — Read the model's internals: adversarial prompts produce geometrically distinguishable paths even when their surface text is obfuscated.

ACCEPTED COST — Requires access to model internals (white-box only), and inference cost grows with probing. Accepted: this is a defense layer for models you host, not a universal proxy.

CONTEXT — The project's own phase-5.3 audit found whole-prompt trajectory features brittle: sensitive to prompt length and defeated by harmless prefixes.

• One global trajectory per prompt— the repo's own hardening audit documents the failure — length sensitivity, prefix dilution
• Sliding-window geometry features

DECISION — Compute tortuosity, directional stability, energy drift and velocity variance over windows, then aggregate.

ACCEPTED COST — More computation per prompt, and window size becomes a tunable. The failed architecture stays documented in architecture_hardening.md instead of being deleted.

CONTEXT — The latency budget is sub-millisecond on CPU, and the feature space is sparse and categorical.

• Deep CTR model (DeepFM-class)— inference cost blows the latency budget without a GPU serving stack; marginal AUC gain on this data
• LightGBM with isotonic calibration per model

DECISION — Three small LightGBM models (300 trees, depth 4) with per-model isotonic calibration on validation data.

ACCEPTED COST — Probabilities are trustworthy enough to do economics on — EV math needs calibrated inputs, not just good ranking. The ceiling on raw accuracy is accepted.

CONTEXT — Budgets must survive bursty traffic without either exhausting early or under-delivering.

• Static per-minute spend caps— oscillates under bursty auctions; wastes budget in quiet periods
• PID controller tracking spend trajectory

DECISION — A PID pacing controller adjusts bid aggressiveness continuously, with a hard budget circuit breaker behind it as the last line.

ACCEPTED COST — Two knobs to tune (controller gains, breaker thresholds) — documented in the monitoring stack with Grafana dashboards rather than left as folklore.

CONTEXT — The 'separate' hybrid variant scored 84.51% test accuracy — six points above the 'shared' variant's 78.17%.

• Deploy 'separate' (84.51%)— more parameters, less interpretable attention, and the gap sits inside overlapping confidence intervals
• Deploy 'shared' (78.17%)

DECISION — Production model = shared variant: better parameter efficiency, interpretable attention maps, honest CI-aware comparison. Both results stay published side by side.

ACCEPTED COST — The headline number is lower than it could have been. That is the point: the README reports the choice and the alternatives' scores.

CONTEXT — Reproducibility claims are cheap; most 'accuracy' numbers cannot be re-derived a month later.

• Trust training logs— logs drift from artifacts; nobody re-runs them
• SHA-256 fingerprint + independent recompute

DECISION — The 944-star dataset is fingerprinted; an audit script recomputes accuracy and F1 from checkpoint weights and test-set IDs. 8/8 checks, 0 mismatches.

ACCEPTED COST — Slower to change the dataset (by design). Anyone can re-run the audit and catch drift.

CONTEXT — The decision engine runs in the kernel's dispatch path; the signal must be nearly free.

• Full workload classification (pattern mining)— too expensive for the hot path; belongs in userspace, adds latency to every dispatch
• Running seek-distance variance

DECISION — Three counters updated per dispatch give a variance estimate that separates sequential, clustered, and random workloads well enough to pick a strategy.

ACCEPTED COST — Coarser than a learned classifier — a deliberately dumb, fast signal in the kernel, with the fancy analysis pushed out to the dashboard.

CONTEXT — Variance is noisy; naive thresholding would flip algorithms constantly, costing more than it saves.

• Switch immediately on threshold cross— thrashing — each switch has re-ordering cost and destroys locality
• Hysteresis band + cooldown window

DECISION — A switch requires sustained evidence and a minimum dwell time in the current strategy.

ACCEPTED COST — Slower to react to genuine regime changes — the cost of stability, chosen consciously.