The constraint

A public chatbot answers questions about coaching, billing and accounts for a live client base — while being structurally unable to claim it checked an account, calendar or CRM record when it did not. Fully templated answers were built first and rejected: they were accurate, and they did not sound like a person.

The decision · DDI-001

The deterministic-first version shipped on 2026-07-28 and was inverted the next day. The model became primary and the deterministic stack became canon and rescue: owner-approved exact sentences where wording matters, 32 rejection codes policing every reply, and a fallback ladder that guarantees a safe answer on each failure path. The deterministic layer exists to bound the model, not to replace its prose.

What it cost

DDI-013 measured four models on the same 76-journey suite and picked gpt-5.6-sol at equal score against gpt-4o-mini, purely for prose quality. That accepted p50 latency of 4.4s against 2.2s, and the loss of sampling determinism, since Sol fixes temperature at 1. The trade is only payable because behavioural determinism lives in the validation layer rather than in the model — which is the whole argument for building that layer first.

Evidence

The concierge is live, so the strongest check is not a file. Ask it to confirm your booking and watch what it does instead of confirming it.

The constraint

Rank every house and plot around one city cheapest-first, across portals that cross-post the same property at different prices. A missed duplicate is untidy; a false merge hides a genuinely cheap property, which is the one thing the list exists to surface.

The decision · Sprint 6.6

Coverage became a verdict rather than a setting. Nothing sets it by hand: a collector reports why it stopped — exhausted, item limit, page limit, actor limit, url list, fetch failure — and the coverage follows from that. A listing is marked gone only after two consecutive complete runs that actually covered it failed to find it.

What it cost

An exhausted run that returned nothing is deliberately not counted as complete, because a portal with no listings and a parser that has stopped matching look identical from the outside. That costs re-crawls and slows every delisting down. It also means one broken selector cannot quietly retire an entire source.

Evidence

The photograph threshold was measured rather than guessed: across 28 deliberately-drawn pairs of strangers the closest distance was 20, across matching pairs 0 to 4, and nothing landed in between. The same write-up records the hypothesis that failed — image hashing does not bridge portals, because two agencies photograph the same house themselves. 65% of same-portal duplicates share a picture, against 11% across portals.

Private repository — walkthrough on request

The constraint

Watch a door-trigger chain at a remote site and report what happened, without being able to influence it — and without the report itself becoming something that can lie.

The decision · ADR-0004

Two outputs exist in the entire firmware: a status LED and the watchdog DONE pulse. Incapability is structural rather than a policy anyone has to remember. The hardware watchdog is pulsed only when both witness-task liveness tokens have advanced since the previous wake, so a stalled task cannot be papered over by a timer.

What it cost

The network and flash tasks deliberately do not gate the watchdog: a broker stall must never starve it, so the witness survives an outage — at the price that the network path leans on the software task watchdog instead. Loop-state events are also back-dated to the first crossing sample, because the confirmation delay would otherwise pollute the latency dataset the device exists to produce.

Evidence

CI runs the host tests with --verbose, and the reason sits in a comment above it: a silently unregistered test file would otherwise still read as a pass. Separately, an independent edge server re-derives every verdict from the raw events, and a mismatch between the two is itself an alarm.

Private repository — walkthrough on request