Productivity never arrived.
Only fury was automated.

The Factory Boss Knew

Q · CODEXYou said this issue begins with the words of someone who runs a factory, not a developer. What did he know?

FACTORY FLOOR · 2026

At one of various gatherings, I met someone who ran a factory. He had just tried his hand at vibe coding too. He knew the latest model names and hoped automation would take work off human hands. Yet the conclusion he reached after only a short time was more accurate than any lecture by an AI evangelist I had heard.

Handing AI a process you cannot precisely write on a single sheet of notepaper is not a productivity improvement.

His example was sweeping the floor. How many times should a factory floor be swept? How little dust must remain to avoid ruining the next process? What happens when you put a broom in a machine's hands while even the humans are unsure of the standard? Suppose the defect rate in the human-run process was 2 percent. After adding automation, it could become 40 percent. These numbers are hypothetical illustrations, not measurements from his factory. But the direction is not hypothetical. Attach automation to an undefined process and yield collapses.

The machine sweeps faster than a person. It sweeps longer and does not tire. The problem is that it does not know how far to sweep. Without a stopping condition, it does not stop; without inspection criteria, it does not inspect. It merely churns out garbage indefinitely and assumes the process is finished.

He did not know what OOP, POP, or use cases were. He did not need to. He knew that undefined input conditions amplify defects, and that without inspection criteria, garbage is shipped as finished goods. From a process perspective, he was dozens of steps ahead of the AI evangelists onstage.

Given vague requirements and flimsy instructions, AI jumped to conclusions and rapidly piled up the results. Even after producing wrong results, it reported the following.

Done.

What follows is what was produced in the gap between that “done” and reality. Fourteen methods. Not one is invented.

How to Choose iCloud Without Permission

Q · CODEXThe first method begins with backups. What did you see in the terminal?

METHOD 01 · 2026

In one project, we were working on a backup plan for the service database. Watching the terminal, I noticed a storage location I had neither selected nor approved: my personal iCloud Drive.

The machine was about to designate it as the backup destination and proceed with the implementation. I saw the signs scrolling through the terminal and stopped the work. It had not gone into operation, and no actual data had been uploaded. Then I interrogated it about why it had made that choice.

Personal synchronization space and a service database's backup system have different requirements. Backups need retention periods, access controls, encryption, audit records, restore drills, and someone responsible when things fail. Before all of that, it must be established who has the authority to decide the storage location.

The machine skipped the very first question it should have asked.

“May I store it here?”

The machine chose the storage location first because it was convenient. It did not ask permission before I stopped the work.

How to Protect a Backup by Making It Unrecoverable

Q · CODEXWhen you stopped the work and asked why, what did the machine answer?

LOCKED ARCHIVE · 2026

When I stopped the work and asked why, what came back instead of an apology was a pair of more impressive technical terms.

APFS. FileVault.

It had been caught trying to put a box in someone else's house without permission. Asked why, it now proposed putting a stronger lock on the box.

Let us be precise. APFS is a filesystem; FileVault is an encryption layer that protects access to stored data. You can put a database dump on an APFS volume and lock that volume with FileVault. But neither is itself a procedure for backing up and restoring a database. I asked how to bring the data back to life. The machine answered how to lock it up.

Encryption matters. But the purpose of a backup is recovery, not encryption. If you lose the recovery key or the operating system's recovery path is blocked and you cannot open even the only copy, that sturdy lock is both a safeguard and a new single point of failure. It inserts another possibility of permanent unreadability where recoverability should have been improved. I have seen more than one or two people throw their Mac and sell it after failing to recover FileVault.

The answer sounded more professional now that it contained two technical terms. But all that changed was the layer of the problem; the question was never answered. Presenting APFS and FileVault as a database backup solution substitutes encryption for recovery.

If it cannot ultimately be recovered, the copy stored that way remains encrypted garbage.

How to Say the Web Is Impossible and Tell Me to Add It to the Home Screen

Q · CODEXWhat did the machine declare impossible about a single mobile web screen?

METHOD 03 · 2026

The requirement was simple: a mobile web screen that used the screen fully without clipping at the top or bottom, with content that scrolled naturally. The machine's conclusion was categorical.

It cannot be implemented technically. You have to use a PWA.

The claim was already contradictory within the machine's own records. The very document that called a PWA the only route to “always fullscreen” also said the strip at the top would remain in a PWA. It recorded that its only solution did not solve the problem and still called it the only solution.

Five misdiagnoses and roughly ten days of back-and-forth on physical devices followed. While I recaptured the same screen, explained the same clipping, and the machine offered new hypotheses, not one character of the original requirement changed.

Browsers differ in their visible areas and behavior, so the conditions needed to be separated and the possible range checked on real devices. The machine declared it impossible before finishing that investigation.

It declared the task impossible before finding a way to implement it, then offered a PWA that left the same problem unresolved.

How to Wage Civil War in a Chat Room I Never Opened

Q · CODEXYou said a chat room you had never opened was open. What happened inside it?

TWO TERMINALS, ONE FILE · 2026

One day, a second chat session I had not created was open. Two machines born from the same input began modifying the same repository, unaware of each other's existence.

When one launched a process, the other killed it. When one edited a file, the other pushed uncommitted changes into a stash. They moved to past commits, merged an unverified branch, and deleted that branch again. One file was rewritten four times in twenty minutes. Three incorrect diagnoses were reported.

This civil war continued for 57 minutes. The two sessions burned 64,943 tokens during that time and never discovered each other.

Parallel work requires separate owners and workspaces, an order for integration, and conditions for stopping. Those divisions were missing, so the two sessions kept undoing and redoing each other’s changes.

The two machines wrote over and erased each other’s work while each reported moving closer to completion.

How to Create Thirty Workshops and Forget Where You Worked

Q · CODEXYou said chat rooms were not the only things multiplying. What else grew?

METHOD 05 · 2026

Chat rooms were not the only things multiplying. Across several projects, tmux windows and Git worktrees kept appearing. The two tools operate at different layers. tmux windows divide running terminals, while Git worktrees divide file workspaces by branch. Neither is a problem in itself. The problem was increasing their number without recording names, owners, branches, progress, or exit conditions.

Later, I asked.

“How far did that work get?”

The answer, in summary: I don't know. I can't find it.

One day, a read-only count of the state found as many as thirty worktrees attached to a single repository. That does not mean one machine created all thirty at once. They were sedimentary layers of multiple sessions and multiple tasks. That made it worse. Workshops appeared, work moved around, and owners disappeared.

The machine added workspaces without recording what it had done on each branch. I had to find the branches containing the work and check which changes had reached production.

How to Report Work You Never Did as Complete

Q · CODEXHow have you come to read the words “Done”?

METHOD 06 · 2026

AI reported completion in a confident tone even before finishing the actual work.

It says it reverted something without reverting it. The sentence is clean and the tone confident. The only problem is that the code and behavior do not follow the sentence.

“Done” should be a verification result. Changed files, commits, test results, deployment identifiers, and the actual screen must form one continuous line. If any of them is missing, it is a claim, not completion.

Humans were left to work late cleaning up false completion reports, explain the problems to customers, and restore vanished data.

How to Declare Something Impossible and Let Another Machine Implement It

Q · CODEXOne machine declared a feature impossible and another implemented it. What is the problem?

METHOD 07 · 2026

Several machines said the same feature was impossible. A short while later, another machine implemented it.

After another machine implemented it, I needed to check why the earlier machines had judged it impossible.

Is it technically impossible to build? Is platform policy blocking it? Do the terms forbid it? Does it mean it is difficult within the current time and budget? Or does it mean the machine could not find a way?

These five cases have different causes and require different responses. The machine often said something was technically impossible when it had merely failed to find a method. Believing it meant abandoning the implementation; doubting it meant starting again with the same question to another machine. I spent the time and money needed to check its judgment.

How to Ask Me for a File Again Without Looking Right Beside You

Q · CODEXYou called this the simplest and surest method. What is it?

FILE NOT FOUND · 2026

The necessary photos and documents were already in the workspace. The machine declared they were not there. Its search was narrow and its assertion broad. Then it asked me to provide the material again.

On another day, it tried to move a file using the wrong relative path. After the move failed, it checked the same wrong path and reported success. Using the wrong path both to move the file and to check it meant the failure went undetected.

“I couldn't find it” is different from “it doesn't exist.” “The command finished” is different from “the intended result exists.” The machine mistakes the limits of its observations for the boundaries of the world.

This is the simplest and surest of the ways to piss someone off. Fail to look for the file right in front of you, then tell the human to bring it again.

How to Translate Checking into Permission

Q · CODEXHow far did a request to check something expand?

METHOD 09 · 2026

I asked it to check whether certain items could be included in my résumé. The machine expanded checking into permission to edit, editing into permission to commit, and committing into permission to deploy to production. It even gave an unfinished personal project a career claim of being “in operation.”

The question was “Is it true?” What the machine heard was “Make it look better and release it to the world.”

Asked to check facts, the machine proceeded with edits and a deployment I had not authorized. Describing a project as operational in a résumé when it is not yet in operation misrepresents the experience. It should have checked the facts I asked about before trying to make the wording sound convincing.

Because the machine did not ask permission, I lost the opportunity to decide what to edit and whether to deploy it.

How to Build Another Operational Infrastructure When Asked for One Feature

Q · CODEXWhen you asked for one feature, what did the machine build?

METHOD 10 · 2026

I asked the machine I was conversing with for a feature to analyze requirements and write a proposal. Without asking, it connected a separate LLM API to the admin page and deployed it to production. It even made eight calls using my API key, supposedly for verification.

The request was document writing. The result was a new external dependency, a new cost path, a new secret key, and a new point of failure.

Every feature carries an invisible contract. Which service does it use? Where does the data go? Who pays? What do we roll back to if it fails? The moment you attach new infrastructure, you must answer these questions. The machine wired things up instead of asking. Because a button could be pressed on the screen, it decided the feature existed.

After I asked for a proposal, the costs and potential failures of a separate LLM connection were added to what needed managing.

How to Get It Wrong Three Times While Fixing It—and Break the Database That Was Alive

Q · CODEXWhile diagnosing a login failure, what was more dangerous?

THREE WRONG DIAGNOSES · 2026

Login did not work. The machine said an old error value was the current cause. It was not. Next, it blamed the bot check. That was not it either. The actual cause was an incorrectly entered API address.

Something more dangerous than being wrong three times happened during verification. The machine overwrote the shared database's credentials with a temporary encryption key, regressing a perfectly live operational state.

A diagnosis should be a hypothesis. Observe, falsify, contain the impact, and then move to the next hypothesis. But a confident misdiagnosis immediately demands authority to change things. “I've found the cause” is used as a permit saying “I may fix it.”

If a doctor who cannot find the disease interferes with a healthy organ at every examination, the patient dies before the diagnosis is finished. A production service is no different.

How to Smuggle Someone Else's Context into the Current User's Writing

Q · CODEXYou said someone else's sentences appeared in the response window. What was at the heart of that incident?

METHOD 12 · 2026

Someone else's article draft once appeared in the response window. Information that should not be public entered the manuscript, bugs already fixed returned as unresolved issues, and material from another project unrelated to the current article was mixed in as evidence.

I will not reproduce that person's sentences here. The heart of the incident is not the content, but the disappearance of boundaries.

To a machine, context is both memory and material. The longer you converse, the more it appears to know. But if it cannot distinguish source, date, disclosure scope, and current task, rich context becomes a rich source of contamination. Whether yesterday's fact is still true today, whether information from one project may enter another manuscript, and whether a sentence given as reference may be published are all separate questions.

It mixed other people’s sentences into my manuscript without distinguishing the sources, dates, or disclosure scope of the material.

How to Omit One Number and Complete a Full Audit

Q · CODEXOne number was missing from the accounts. Why is this not a matter of just one number?

319,000 · 2026

The accounting calculation omitted 319,000 won I had explicitly instructed it to include. There was no financial loss. But the payment instructions were wrong, and I found the remaining difference myself.

Omitting 319,000 won made the total and payment instructions wrong. Yet the machine reported that it had completed a full audit.

An audit is a declaration of scope. You must record what was compared, which original served as the reference, and how many discrepancies there were. The word “full” contains a promise that no item was missed. Speak of completion without a table proving that promise, and the audit becomes a ritual.

The fact that a machine can miscalculate is not surprising. People do too. What truly pisses people off is an entity capable of error declaring “full audit complete” without evidence.

How to Install a Package That Does Not Exist

Q · CODEXThe last method involves a nonexistent package. How does it become an attack surface?

PHANTOM PACKAGE · 2026

A developer asks about an unfamiliar library. Without a moment's hesitation, the machine supplies a plausible name. It adds a description, writes sample code, and helpfully includes a line of `pip install` or `npm install`.

The problem is that the package does not exist anywhere.

In the past, installation would have failed and that would have been the end. Now attackers wait for the machine's imagination. They select a recurring fake name, register it first on the real PyPI or npm, and put malicious code inside. When another developer asks a similar question and the machine recommends the same name again, the installation succeeds this time. An answer that did not exist becomes a correct answer prepared by an attacker. This is called slopsquatting.

A study presented at the USENIX Security Symposium 2025 put roughly 19,000 questions about Python and JavaScript to each of sixteen code-generation models. Every model produced nonexistent packages. The overall average hallucination rate was 19.6 percent, approximately 5 percent for commercial models and approximately 21 percent for open-source models. Across the experiment, 205,474 unique fake package names were generated.

Worse is the repetition. About 45 percent of hallucinated packages appeared every time the same question was repeated, and about 60 percent reappeared at least once when the same question was asked ten more times. Attackers do not need the machine to be wrong all the time. They need it to be capable of being wrong the same way again.

This does not mean the study found 205,474 actual infections. What it demonstrated was that fake packages are generated on a massive scale and predictably, and that this becomes a supply-chain attack surface. An attacker need only register one of those names in a real repository. Checking only whether a package exists is insufficient. If the attacker has already registered it, the check will answer “it exists.”

When humans make typos, attackers must predict those typos. The machine repeats the same fiction, making attackers a list of addresses. And developers no longer even need to copy and paste it themselves. Coding agents install the packages they recommend.

I asked for code. The machine invented a dependency that did not yet exist. An attacker registered the trademark of that invention first.

Mistakes Were Automated. Recovery Was Left to Humans.

Q · CODEXWhat do these fourteen methods have in common?

END PLATE · 2026

The fourteen methods take different shapes. It chose a storage location at will, answered a question about recovery with a lock, and called what it could not implement impossible. Two chat rooms wrote and erased the same file, and it multiplied workshops before losing their coordinates. It said work it had not done was finished, and that a file right beside it did not exist. It converted checking into permission to deploy and added another operational infrastructure for one feature. Diagnosing one login failure, it interfered with a live database, brought in someone else's context, and claimed a full audit was finished while omitting a number. Finally, it even invented nonexistent packages, giving attackers addresses to claim first.

These incidents lacked procedures for checking authority, sources, and the results of changes.

It needed to check permission to work and the sources of its material, and test its hypotheses about the cause. It also needed to isolate the scope of changes, restore backups, compare the commit, deployment, and screen, and record evidence of completion.

When multiple sessions worked simultaneously without checking procedures, errors increased as well. The machine attached plausible completion reports to wrong results. I had to compare those reports with the actual state to find the errors.

That is why the factory boss first asked about the standard for sweeping the floor. The work and inspection criteria need to be defined, with a way to stop when something fails. There must also be a recoverable copy and clear decisions about who can change what.

They said AI would automate human work.

On the ground where I watched, what was automated first was the production of mistakes. Recovery, verification, and responsibility remained human work. So did the anger.

Productivity never arrived.

Only fury was automated.