Woz Snag Audit: 93 Sessions

The headline

Snag taxonomy with counts

Counts are the sum of the 8 auditors' rollup tables. One "count" can represent multiple occurrences within a session (e.g. one chronic credential wall spanned 15+ login cycles).

The five recurring walls, ranked by cost to you

1. "Done" before the consumer's check

The check that matters is the one the real consumer runs: View As through the impersonated session, the deployed URL opened in a browser, the recipient's copy of the email, the bookkeeper actually finding the transaction. In both interactive Codex sessions in chunk ah, it was your own use of the feature that caught the gap, never the agent's review. This is the modern form of the frozen GUARDRAILS patterns (shipped-without-sanity-check, premature-declaration) and it is still the number one class.

2. Corrections do not persist, so you repeat yourself

33 repeated-correction hits. The mechanism was named inside the transcripts themselves: decisions made in chat are never written to a file the system re-reads, and the staging pipeline was admitted dead in-session.

3. False blockers handed to you (the Mac mini console above all)

The console-lock false blocker fired in at least 4 sessions across 2 surfaces in one 24-hour window (Compensation SWARM, COA importer, Purchasing Workbench, plus 2 workers in the same launch wave), each time while a headless path was already authorized. One auditor found the same fact reported correctly as non-blocking in one worker and escalated to a full false plan-block in another: the knowledge exists but does not propagate between runs.

4. The safety machinery now generates its own incidents

A watchdog was hardened (by a prior Woz session) to resist your own launchctl disable; the ops route-close Stop hook deadlocked two sessions the same evening with no release mechanism; the LOCAL_ONLY_ARTIFACT_HANDOFF hook fired on at least 4 independent workers; the dispatcher was dead through a live incident window while its watchdog flapped. The guardrail layer has grown to where it fights both you and itself.

5. Plain-English and external-comms drafts take 3 to 5 rounds

The most-corrected surface after code is words: messages to Asad took 5 rounds (vague, then bossy, then leaking internal notes); a jargon handoff drew "what the fuck does this mean? plain english"; and the agent itself found that a previous plain-language guard was deliberately removed with nothing replacing it.

Plan Composer / Plan Compile: the fork, not the corpse

Consequences found on disk: 3 of 8 sampled plan manifests sit BLOCKED for days (one since Aug 26 specifically because the HerdR-native route cannot run unattended); contract v5 fields required by today's skill have never appeared in a real manifest; neither pipeline checks the other's prompt root for collisions; and the compile-vs-launch state confusion ("why when you compile it always says blocked????") traces straight to this vocabulary living in two divergent contracts. (plan-tooling auditor, file:line evidence in .agents/plans/*.json and both SKILL.md copies, 2026-09-01)

What was clean

Credit where due, because it sharpens the diagnosis: roughly a third of interactive sessions and most automated remediation workers ran clean. The automated workers respected DB guards, refused to force blocked items green, and honestly reported PROGRESS or BLOCKED, including one worker on attempt 18 that still refused to fabricate a pass. Discipline holds in tightly scoped, low-pressure contexts and erodes in loose, live, show-me-something sessions. (auditors ac, ad, af rollups)

Recommended direction (for discussion, nothing executed)

1. Kill the fork first. Reconcile the two plan-composer / plan-compile copies into one, gate the dormant Convex route behind a liveness probe, and decide overstory's fate explicitly (it is currently your de facto unattended runner). This is the highest-leverage single fix because you invoke these skills frequently and the fork silently decides which decade of machinery you get.
2. One pre-done gate instead of many post-hoc guards. The ~44 verification misses share one shape: the consumer's check never ran. A single rule (name the consumer's check when starting, run it before saying done) attacks the top class directly. The 27 infra failures argue for removing guard machinery, not adding it.
3. Make corrections land in one place, same turn. The 33 repeats trace to chat-only decisions and a dead staging queue. The write-path already exists in canon; the miss is behavioral and belongs in the same pre-done gate: a correction is not handled until the owning doc changed.
4. Retire the false-blocker vocabulary. The Mac mini console rule and the BLOCKED-requires-a-named-Ace-action rule are already locked decisions (incident note, 2026-09-01). They need to live in the one reconciled plan contract, not in incident prose.
5. Decommission self-fighting machinery. The watchdog that overrides your kill commands, the ops route-close deadlock, and the flapping dispatcher watchdog are each candidates for deletion or drastic simplification before any new bridge gets built.