The Scar Room

Thirteen generated assets across seven brands were flagged as having truncated text. They looked fine.

By the shape of the failures rather than by any one of them. Thirteen flags, all the same kind, across brands with nothing else in common, that is a pattern in the instrument, not in the subject. The confirmation was a two-line deck measuring as nearly five lines.

The element being measured is a grown flex item, `flex: 1 1 auto`, so inside a tall panel it stretches to fill the space. Its `scrollHeight` therefore reports the stretched box, not the text inside it. Every sixteen-by-nine module with a tall panel was a guaranteed false positive, and the measurement was most wrong exactly where the layout had the most room.

The inspector now releases the stretch before it measures, sets the item to `flex: 0 0 auto; height: auto`, takes the reading, puts it back. And the deck clamp that had been widened on the bad evidence was reverted. The headline clamp stayed where it was, because that one had been seen clipping in an actual rendered image first.

// before: measuring a stretched box
const lines = el.scrollHeight / lineHeight;   // 4.87 for a two-line deck

// after: release the stretch, then measure
el.style.flex = '0 0 auto';
el.style.height = 'auto';

Two changes to production layout made on a false reading. After the fix six flags survived and were real, and they pointed at a genuine content law, past about a hundred and fifteen characters, a deck overflows the panel. That got fixed by trimming the copy rather than widening the clamp, because the format is the constraint.

The Commit Wall, before it had ever been seen. Of a hundred and forty-one lines that cleared every other check, a hundred and eleven were being withheld as "private matter", and the room was quietly not worth building.

By adding a flag to the ingest that prints what it withheld and under which rule. The first line in the output was `docs: journal + memory handoff for the alpha run`, filed under "names a person". That is not a person.

Two separate mistakes, and the second one hid the first. The rule meant to catch a named individual was `for [A-Z][a-z]+ [A-Z][a-z]+`, "for Firstname Surname", and it was compiled into a regex built with the case-insensitive flag, alongside a dozen rules that genuinely needed it. Under `i`, `[A-Z]` matches lowercase. The rule was really "the word for, followed by any two words", which is most English sentences. Separately, a second filter was matching the topic of security rather than the disclosure of it, and was throwing away road-sign codes (`R111`, `R118`) as if they were salary figures.

// the bug, in one line
new RegExp('for [A-Z][a-z]+ [A-Z][a-z]+', 'i')
// under /i, [A-Z] matches lowercase.
// matches "for Firstname Surname", and "for the alpha run".

Split the expression. Anything whose meaning depends on capitalisation gets its own case-sensitive regex and cannot be folded in with the rest. The security rule was narrowed from nouns to disclosure (an exposure, a leak, a key that needs rotating) so that "trim the passphrase before verifying the signature" survives and "four live exposures closed" does not.

Nothing shipped wrong, because the flag was added before the room was. The interesting part is the failure mode: an over-blocking filter produces no error, no warning and no visible symptom. It looks like caution. The pressure it creates is to loosen the whole thing at once, which is how a filter that was too strict on Monday is switched off on Tuesday.

Every mobile capture of K53 Drill Master, silently, the screenshots were clean, well-composed and missing the product's main navigation.

By looking at the pictures. There is no automated check for "this screenshot is missing something that should be in it", which is the whole difficulty with generated visual assets.

The widget stripper identifies floating corner elements by size: anything under a threshold is chat bubbles, cookie bars, feedback tabs. On a 390-pixel viewport a bottom navigation bar is under that threshold. The heuristic was written on desktop, where the assumption holds, and mobile was never a different code path so nothing flagged the change of context.

The size threshold became relative (capped at a fraction of the viewport width rather than an absolute pixel count) so it scales with the device instead of assuming one.

A batch of unusable assets, and four more findings from the same session that are worth as much as the fix: screenshots hang forever on infinite CSS animations unless animations are disabled; heavy pages exhaust a shared renderer on this machine, so each capture needs its own browser context; live schema drift means the seeded data a capture depends on can be silently wrong; and two routes that were being captured as product pages were actually auth-gated, so every "public" capture of them was a photograph of the login screen.