Appendix B: Eleven takeaways

If you keep nothing else, keep these eleven.

The system, not the prompt, is the unit of quality. Terse instructions work when the repository defines done, encodes the checks, and carries the conventions. Improve the machinery before improving the wording.
Architecture is a verification feature. Choose boundaries by asking how much of the system must be trusted for a small change to be believed. A boundary is cheap to cross only when the representations crossing it already carry the needed meaning.
A principle you cannot execute is a preference. Give every important belief a named check that fails when the belief is violated, and enforce it at a boundary ordinary code cannot bypass.
A test that has never failed is a rumor. Revert the fix and watch the red. Tamper with a golden file and watch the harness object. Trust a check in proportion to the evidence that it detects what it claims to detect.
Distinguish provenance from verification. The system generated this once and the build regenerates or validates this now are different properties. Only the second catches a regression. Say which one you have.
Write the disagreement before the code. State the decision that could invalidate the whole patch while changing it costs a few sentences. Then remove every gate whose answer is predetermined, because a pause that cannot change the work is ceremony.
Review findings are claims, not defects. Give each reviewer a distinct lens, then validate every finding before filing or fixing it. Record the rejections; a durable refutation prevents the same false premise from returning.
Green belongs to a tree, not a branch. Two green branches can merge into a red main, and a green release workflow can publish over a red required check. Test the integrated revision and verify the whole required graph.
When the evidence stops, the patch stops. Reproduce against the real binary, measure the phase the claim names, and accept missing artifact as a completed result. Never let flaky close an investigation.
Preserve what the user wrote. When a system cannot represent input faithfully, it should show the source and the diagnostic, locatable and intact. Silent disappearance is never graceful, in an editor, a parser, a migration, or a fallback.
Delegation is not autonomy. An agent works to the end of a bounded unit and stops there, unless a completion harness defines done and makes premature stopping difficult. Reserve the human for taste, product feel, external facts, and adversarial pressure, and let neither side certify its own work.