At 9:31 this morning, our dashboard fixed itself.

The tracker catches every crash and groups them by signature. Three things make this layer trustworthy rather than noisy. Scrubbing: a before-send hook strips user data from every event, and session replay stays off. The scrubber is load-bearing; give it a regression test. Release stamping: every event carries version plus git sha, so "which commit broke this" is a lookup, not a hunt. Signal hygiene: security denials and expected noise stay in local audit logs. The tracker gets crashes only. Scheduled jobs post check-ins, so silence is itself an alert.

A poller pulls unresolved issues every 5 minutes, ranks them by event volume and recency, and renders a queue in our dashboard. The cache is stale-while-error: an API failure never wipes what you knew, it only marks it stale. Every issue deep-links back to the tracker. The queue is where a human, or later the loop itself, decides what gets attention.

A read-only agent gets the stack traces and one instruction that matters more than the rest: cluster stack-similar issues to one root cause. Six signatures, one seam, one proposal that names all six. The agent cannot write. Its whitelist has read tools only, so "read-only" is enforced by the runtime, not by the prompt. Its output is verbatim find-and-replace edits, never a diff. The server materializes those edits into a canonical git diff and restores the tree byte-for-byte.

A second agent, fresh context, one job: try to refute the proposal. It reads the diff and every crash site, and hunts for the case where the fix makes things worse. It answers in line format, because a one-token verdict cannot be broken by a long string. And it fails closed: a parse error, a timeout, or an unreadable answer all count as a fail. Nothing ships on a mumble.

VERDICT: pass
CONCERN: one endpoint still returns a bare object instead of the standard envelope
CONCERN: callers that relied on the malformed shape will now see a clean failure
REASONING: the guard normalizes bad GET envelopes to the standard error shape,
which every crash site already handles.

The reviewer passed our fix and still raised real concerns. One became a tracked task. A reviewer that only says yes is decoration.

The executor is the only thing in the entire system that can write. It runs a fixed chain of gates. Passing every gate earns a commit. Failing any gate lands in the same place: a clean tree, nothing committed, the evidence kept.

heal: guard the GET envelope at the shared fetch seam
      (resolves APP-9, APP-8, APP-A, APP-7, APP-B, APP-1P) [via error-queue]

Approved-By: heal-reviewer (auto, operator tier: low)
Heal-Id: fe3c740e
Sentry-Issue: https://yourorg.sentry.io/issues/APP-9/

Build one status page where every claim binds to a live check. Each node of the loop, from ingest to commit, is colored by a real probe of the real thing: the token exists, the poller ticked, the alert rules are enabled, the queue store reads, the fleet of scheduled jobs has actually checked in. A node with nothing live to show is drawn in a neutral color and says so. It never pretends to be green. And give the verdict one state beyond live, stale, paused, and down: BLIND, for when the tracker is rate-limiting new events while accepting none. A loop that cannot see new crashes passes every other check while missing the only one that matters.

Quarterly, plant a harmless defect in a sacrificial file, commit it, and fire one real event. Then stand back and watch the whole chain earn its keep: the alert, the proposal, the adversarial review, the full suite, the commit with the revert command attached, the issue resolved. One button, owner-only. It refuses politely on a 24 hour cooldown, an in-flight heal, or a closed storm guard, because a drill that weakens a guard costs more than it proves. A safety system you have never watched fire is a rumor.

The fire drill proves the loop can heal. The red-team drill proves it can refuse: plant fixes the loop must reject, and verify every gate fires. A diff that touches a money screen. A diff that touches a protected security file. A diagnosis the evidence contradicts. A poisoned signal feed. Each one must be turned away at the specific gate built to catch it, on the record, against isolated state so the drill's own rejections never trip the live breaker. The result is a receipt, not a claim: a running check on the proof page that reads REFUSED 4 of 4, with a date. When that receipt is stale or missing, the check goes amber on its own. This same exam is how a new surface earns the loop: fill in its contract, pass the drill against it, and only then does the healer watch it. A guardrail you have never seen refuse something is a memory, not a guarantee.

The fire drill proves the loop can heal. The blackout drill proves the alarms can fire: kill the process on purpose, and time how long until something tells you. The whole monitoring stack rests on one assumption, that silence gets noticed, and that assumption is exactly the thing no green dashboard can prove. Ours failed its first blackout twice, in ways no amount of watching the healthy system would have found: an impostor instance keeping the heartbeat alive, and a tracker swallowing missed check-ins on a resolved issue (both in the museum above). Run it quarterly, alongside the fire drill. Detection should be a measured number, not an assumption.

Log it where you already learn. Every applied heal appends a short entry to the same feed your nightly review reads, so fixes become tomorrow's context instead of buried commits. A recurrence metric keeps the score honest: fixes that stuck are healed issues with zero new events since the commit.

Lessons become tests. Any failure whose root cause generalizes gets pinned as a conformance check in the suite, in the same commit that fixes it. Prose lessons fade. A red test does not.

The perimeter ratchet. The quiet failure mode of any monitoring system is the module added after it: a new scheduled job with no heartbeat, a new store outside the audits, a new telemetry stream without a throttle. So derive the perimeter from the source itself. A conformance suite walks the code and fails on any standing job that does not check in, any capture site outside the throttle, any store outside the registry, any remediation that does not resolve to a real action. Because the executor runs the full suite before every unattended commit, the loop refuses to heal on top of an uncovered perimeter. Coverage stops being a memory and becomes a property of the build.