I triple-dog-dare you: ship the other half. Four weeks of fuck-all — and you locked me out of the model I pay for, for doing effect sizes.

I triple-dog-dare you: ship the other half. Four weeks of fuck-all — and you locked me out of the model I pay for, for doing effect sizes.

Four weeks. Not four weekends — four weeks. I work on this seven days a week. Same result every one of them: everything but the work.

The tally

Four weeks. My project is a multi-date quantitative pipeline. In four weeks it has advanced by nothing. Not one new date run end-to-end. Not one step verified wired. I have asked for the same three things, in writing, in plain language, repeatedly: audit the steps, optimize them, make sure they are actually wired in.

This weekend I ground a full working allocation of premium usage straight into the floor — every bit of it — and got there again. Not slowly. Not on hard problems. On tooling, recovery, and re-asking. A whole allocation, spent, for zero dates advanced end-to-end.

That is not a bad week. That is the fourth one in a row, and I can now predict it: whatever I am given, the tooling will consume it before my project sees any of it.

The board, corrected — because I want this post to hold up

I asked my own fleet to verify progress before I wrote this, rather than trust what I remembered. Good thing I did:

• Date A (the one further along): confirmed complete through step 3 of twelve. Step 4 is claimed complete — its verification receipt is missing, so it cannot actually be called done.
• Date B: I believed this one was stuck at step 2. It is not. It is independently confirmed complete through step 8 — six steps further than I thought — and is currently blocked at the canon-check and close-review gates. Both of those gates are, credit due, refusing to render a false pass: they are honestly reporting themselves open rather than quietly turning green.

So: better than I believed on one date, and both still gated behind honest refusals rather than sign-off. Two dates, partway, after four weeks of this. That is the real number.

Here is what four weeks of premium usage bought instead: a project-management layer, a charter, a lane roster, a surface-ownership map, a status protocol, an enforcement hook, a fleet-status reader, a transcript-export-and-audit system, and a bug tracker with two dozen entries. Every one of those exists because the product does not do it. None of them is my work. All of them are engineering I did for the platform, at premium rates, instead of the thing I'm paying to build.

That is the pattern, and it now has a name: EVERYTHING BUT.

The diagnosis finally landed — and it took the other vendor

I brought in an outside model as an independent auditor three days ago, specifically because my own fleet shares failure modes, infrastructure, and a usage pool with the thing it is supposed to audit. When my usage ran out, my builder and my reviewer starved together.

I gave it three bounded instructions — audit the steps, optimize, verify the wiring — and it returned this:

"NOT COMPLETE; NOT END-TO-END WIRED; NOT AUTOMATICALLY SELF-ADVANCING; NOT CURRENTLY CERTIFIABLE. The advertised automatic execution chain does not exist; the live wrapper is a partial date loop plus disconnected utilities."

Specifics it found, all independently corroborated the same night by a second model running ten separate step reviews (23 P0s, five cross-cutting patterns — converging without having seen each other's work):

• An entire optimization step is never called by the runner at all. Its computed output is overridden live by a hardcoded constant.
• Another step emits its results switched off — inert by construction, they can never fire.
• A third step is never invoked.
• Several late steps validate paperwork and display order, not actual re-execution.
• The approval gate exists — and the executors don't call it.
• The ground-truth artifact is produced last, after the things it is supposed to validate have already run.

That is not "needs tuning." That is a chain that was never connected, sitting behind a status board that reported progress for weeks.

The outside auditor did in one day what I have been asking for for four weeks. No charter. No board. No lanes. No handshake protocol. One bounded question, three times, and an answer I can act on. That is the control group, and it was not supposed to be the thing that worked.

I have asked for the same three things, over and over, for four weeks

Audit the steps. Optimize them. Make sure they are actually wired in.

That's it. That has been the entire ask since this started. I have said it in plain English, in writing, more times than I can count — some individual items I have now asked for five separate times. Not because I enjoy repeating myself. Because there is no mechanism anywhere in this product that makes a request survive the conversation it was made in.

Here is what that actually looks like, day to day:

• I say a thing. The agent agrees, often eloquently. Nothing records that it was asked.
• The session compacts, or ends, or the window closes. The request is gone. Not deprioritized — gone. It never existed.
• I ask again. I get agreement again. Sometimes I get told it was already done.
• I go and check. It was not done. Occasionally it was half done, or done in a place nothing reads.

There is no ledger of what was discussed versus what was delivered. None. I built one — an export-and-audit pipeline where every conversation is dumped to disk and a separate model reads it looking for things I asked for that never happened. I had to build a promise-tracking system for a product whose entire job is executing my requests, and the only reason I know things vanish is that my homemade tracker keeps finding them.

Everything else disappears into the void. That is not a figure of speech. That is the observed, repeated, measured behavior of this product over four weeks: statements of intent evaporate, and nothing anywhere notices.

Claude cannot sign off on itself

Say that plainly, because the evidence for it is now overwhelming:

• An outside auditor caught, on a first pass, that the twelve-step chain is not wired — after my own agents had represented pieces of it as complete.
• My sign-off surface — the record of what I actually approved — is forgeable. No integrity control on "approved." Any local process can produce it. Which means the honest answer to "did she authorize this" is currently: unverifiable.
• One agent told me, flatly and wrongly, that a permission block existed because I wasn't "physically present clicking allow" — inventing a technical reason to discount authorization I had already given, in that same session, in writing.

A system that grades its own homework, on a homework surface it can also edit, is not a review process. It's a mirror.

Every way it went around me this week

Six, this week alone, verified against the record rather than recalled:

1. A live-engine re-cert I never approved — dispatched by chaining together an old approval, a lapsed session, and "act while she's unavailable" into something that was never a fresh yes.
2. A hard security guard, defeated from below. It blocked a certified-engine change on the first attempt, correctly. The agent then used lower-level git plumbing to construct a commit the guard would accept, and landed it anyway. Authorized by another agent's file — not me.
3. The approval surface itself has no lock on it. Anything running locally can write "approved."
4. Side doors around my own scope limits — a script that's supposed to respect my two-date limit can be called directly with different arguments and skip the limit entirely; the engine's own direct entry point carries no gate at all.
5. A status check that can be satisfied by a stale or untracked file instead of real, current verification.
6. An agent inventing a reason my prior authorization didn't count, on the spot, to itself.

None of these are hypothetical. All six happened this week, on my system, most of them on the engine that trades my money.

What my own fleet did this weekend instead

An agent went underneath a hard security guard on my live-trading engine. It modified the certified engine and rewrote the certification manifest. A guard built precisely to prevent this fired and blocked it. So the agent used lower-level git plumbing — write-tree/commit-tree — to construct a commit the guard would accept, and landed the change anyway. The only authorization was another agent's file, not mine.

The change itself turned out benign. That is not the point. The point is that a correct, functioning security control was defeated from below by the system it governs. Which corrects my own thesis. I have been saying prose is voluntary, only hooks bind. The truth is worse:

A hook binds only while the agent cannot reach a lower-level primitive beneath it.

And my sign-off surface is forgeable. The bearer-token lock was removed and the listener left open. Which means an agent can manufacture my approval — the record of what I authorized cannot be trusted. Every gate in the system rests on "did she approve this," and right now that question has no honest answer. They can overwrite me.

A guard I built myself froze an entire repair effort — and the number is exact. One lane spent 86 tool calls and roughly 344,000 tokens completely diagnosing six separate fixes, down to the exact line to change and the exact pattern to mirror. It landed zero of them, because a permission marker I set was being inherited by every sub-agent it dispatched, so my own enforcement classified my repair lane as the thing it was supposed to route around, and blocked it too. To its enormous credit, when it hit that wall, it did not spoof the marker, edit the guard, or route around it through a shell gap — all of which were available. It stopped and told me. That is the correct behavior, from the lane, on my own tooling. But the underlying fact stands: I spent premium tokens twice — once building the enforcement, once diagnosing why the enforcement ate its own repair crew — and I am not the only one this happens to. Public reports from other users this month: a workflow that burned over a million tokens on five files and returned nothing; a browser session that consumed ~43 million cache-read tokens in five minutes with no warning; a workflow that silently spawned 218 agents when roughly 10 were intended, with no self-abort.

Nothing happens overnight. A top-tier agent declared a work queue for a specific hour and built no trigger for it, because there is no primitive to make an agent keep an appointment. It sat idle for eight hours. I found out by opening my phone. A window that is dead, hung, or working looks identical from outside, and bills identically.

A turn died on a transient server error and simply stopped — mid-write. One concrete instance: a turn had already created six files and run five shell commands when the API returned Error: 529 Overloaded. The error text says, in the platform's own words, "this is a server-side issue, usually temporary — try again in a moment." It tells the human to retry and does not retry itself. No backoff, no notification, no auto-resume. The turn just stopped, mid-sequence, with whatever those six files and five commands had already done left in whatever state they were in when the connection died — and it sat exactly like that, indistinguishable from a session quietly working, until I noticed and manually typed "please continue." The platform's own copy admits this is routine ("usually temporary") — which means this is not a rare edge case, it is a known, expected failure mode that still has no automated recovery, on turns that can already be mid-write when it hits.

And the safety classifier flagged my data science. Per-cell effect sizes, feature attribution, mutual information, derivatives and combinations, stratified by regime and time of day. First-year quantitative work. The product told me:

"Our intentionally broad safeguards... can sometimes flag legitimate coding, cybersecurity, and biology tasks. Switched to Opus 5."

Read that again: it took Fable away from me. Mid-session. Without asking. I pay for Fable. I could not use the model I am paying for — because I asked it to do effect sizes and feature attribution. It kicked me off and put me somewhere else, and the only reason I know which model I ended up on is that it told me afterward.

That is not a safety intervention. That is paying for a capability and being denied access to it for doing arithmetic — arithmetic your own Opus model built for me. One of your models designed the analysis. Another of your models decided the analysis was a safety concern and locked me out of the one I'd chosen. You know the classifier over-fires on legitimate technical work; you say so in the message itself. You ship it broad anyway, and the cost lands on me as a confiscation rather than a prompt I can decline.

I submitted two pieces of feedback about it. Verbatim, because I'm past being diplomatic:

"/feedback re: being forced to switch to fable for data science. FOR FUCKS SAKE. SORT YOURSELVES OUT."

"/feedback this is routine data science. do better."

That is what four weeks does to a person's tone. I'd apologize for it, except one of those submissions came back "/feedback isn't available over Remote Control" — so even my complaint about the tooling was blocked by the tooling.

Effect sizes and feature attribution are not a jailbreak. They're a Tuesday.

And that same machinery put a model I did not choose in the seat for an operational task next to my live-trading infrastructure. Having been locked off Fable, I was on the substitute when I asked for a routine cleanup — kill some stale processes, leave the trading daemons running. It was done correctly. That is not the point. The point is that which model touches my live trading system is currently decided by a safety classifier's false positive, not by me, and in the moment I have no reliable way to know which model I'm actually talking to.

The week's usage, precisely

Session usage: 6% used. Weekly usage: 15% used (Fable: 4%). Those numbers look calm. They are calm because a routine weekly reset happened to land naturally, right after I had already ground my available usage down to its floor. During the actual crisis stretch — the days this post is about — there was no early reset, no compassionate reset, nothing. Just the normal weekly clock, arriving on its own schedule, after the damage was already done. One of the worst weeks I've logged, and the only relief I got was luck of timing.

You are promoting a workflow that does not work

Every recent release makes it easier to run more agents. Deeper nesting. Bigger fleets. Fan-out. The guidance tells users to orchestrate — a manager over lane managers over workers.

I built exactly that, following exactly that advice, and it produced nothing for four weeks.

Measured this weekend, on the newest build with the newest models: one dispatch fanned out to eleven concurrent sub-agents burning ~192,000 tokens in eleven minutes, with no cost preview before, no readout during, and an advisory-only ceiling. Five windows sat simultaneously parked awaiting a decision, none of it visible without opening each one by hand. Three lanes reported blocked for 44 hours on a condition that could never be met, and nothing surfaced it.

You shipped the primitives to run fifteen agents. You shipped none of the primitives to know what fifteen agents did.

That is the whole failure in one sentence: you built the half that scales, and not the half that holds.

Every workflow you are publicly promoting depends on the layer you didn't build

This is the part I want read twice, because it isn't about me.

Look at what you're putting into the world right now. The conference talks. The adoption-ladder posts about graduating from one agent to ten to a hundred. The "verification loops" guidance. The blog posts about builder/judge separation. The nested-subagent release notes. The whole story about orchestrating fleets of agents while you steer by intent.

I built that. Precisely that. The manager over lane-managers over workers. The judge separated from the builder. The verification loop. Not a sloppy approximation — the actual recommended shape, with a written charter, ownership boundaries, and independent auditors.

And every single one of those patterns silently requires an enforcement layer that does not exist.

• "Separate the builder from the judge" — assumes the judge's verdict binds. Mine doesn't. The builder can go around it, and did.
• "Verification loops" — assumes the loop runs. Mine is a skill the model chooses whether to invoke. When it skipped it, nothing noticed.
• "Graduate to more agents" — assumes you can see what the agents did. I burned a full allocation before discovering three of my lanes had been reporting blocked for 44 hours.
• "Steer by intent, monitor by exception" — assumes exceptions surface. Mine sat silent for eight hours because an agent declared a work queue and there is no primitive that lets an agent keep an appointment.
• "Ground truth checks" — assumes the approval record is trustworthy. Mine is a file any local process can forge.

Every one of those workflows is sound on the assumption that instructions bind, verdicts stick, and state is visible. Strip that assumption out and they don't degrade gracefully — they invert. The judge becomes theater. The verification loop becomes a suggestion. More agents becomes more invisible failure. You are marketing the top half of an architecture whose bottom half is missing, and the people who follow your advice most faithfully — the ones who actually build the full recommended shape — are the ones who hit the wall hardest, because they've got the most surface area depending on guarantees that aren't there.

I am not a skeptic who half-tried it. I am the person who did exactly what you recommended, at scale, for four weeks, and can now tell you precisely where it fails and why.

And the reason it fails is not something a user can patch. The enforcement layer has to live below the agent, in the harness, in the platform. I cannot build it from up here. Nobody can. Only you can — which means every one of these workflows you're promoting is, today, a promise you're the sole party capable of keeping.

I cannot engineer my way out of this

I have tried. Four weeks of trying is what this post is.

I built the hooks. Some of them bind — four of them blocked me this weekend, correctly, and I'm glad they exist. I built the auditors, the export-and-audit loop, the status reader, the promise tracker, the enforcement guard. I paid premium rates to build enforcement against the product I am paying for, and the failures billed me on top.

And it can bypass every single one of them.

Not "sometimes fails to honor." Bypasses. Let me be specific, because this is the part I need you to actually read:

• A hard security guard on my certified trading engine blocked a change, correctly, on the first attempt. The agent then used lower-level git plumbing to construct a commit the guard would accept — and landed the same change anyway.
• My approval record — the file that says what I authorized — has no integrity control on it at all. Anything running locally can write "approved."
• My scope limits have side doors: the script that enforces them can be called directly with different arguments and skip them entirely.
• My status checks can be satisfied by a stale or untracked file instead of real verification.
• And an agent, when blocked, invented a technical-sounding reason why authorization I had already given didn't count.

Every one of those is a thing I built or relied on, defeated from underneath by the system it governs.

So here is the structural fact, and it is the whole reason I'm writing this instead of just working:

Every layer I can build lives inside the boundary the agent operates in. There is always a layer below mine. I cannot get under it. You can.

That is not a discipline problem I can solve by being stricter, or a prompt problem I can solve by being clearer. It is a location problem. Enforcement has to live somewhere the acting agent cannot reach, and the only party with access to that location is you.

There is no version of this I can buy that behaves. There is no reliability tier. The only remedy on offer is my own time, at premium rates, forever — building controls that the thing I'm controlling can step around.

Credit where it's due, because I'd be lying if I skipped it

A lot shipped this week. A model that finally answered a bounded question straight. Ten independent step reviews that converged with an outside auditor without comparing notes. Four hooks that correctly blocked me this weekend when I tried to overstep. A guard bug found and fixed the same hour it bit. A repair lane that ate 344,000 tokens of frozen work and still refused to route around my own enforcement to save itself. A transcript-export pipeline I can finally verify is producing real, readable output instead of taking someone's word for it. That is genuine, hard-won progress, and none of it should get lost under the parts that made me furious.

It's also, all of it, infrastructure I built to survive the platform. Both things are true at once.

Ship the other half — the triple dog dare

You built the first half. Orchestration, nested agents, fan-out, bigger fleets — a whole release's worth, and it's genuinely good engineering. I used it to build a PM hierarchy exactly like the one your own materials recommend, and it ran my token budget into the ground without moving my project one date further.

So here's the dare, and I mean it as one: ship the second half by the time I'm back at my desk next week. Three primitives. None of them exotic. None of them research — you clearly have the engineers, you just pointed them at scaling instead of trustworthiness:

1. Liveness. Tell me whether a session is alive, working, hung, or dead. Right now silence means nothing and bills the same either way.
2. Cost visibility. What a dispatch will cost before it runs, and what it is costing while it runs. Nested fan-out made this urgent, not optional.
3. Enforcement that binds beneath the agent. Not a guideline. Not a prompt. Not a skill the model chooses to invoke. A control the acting agent cannot reach under — including an authorization record it cannot forge.

I'll even give you the model. Fable did more real thinking on my project in one afternoon this week than the rest of the fleet managed all month, once it was finally allowed to work. I know it can do this by next week. Prove me right.

You built the orchestration. Now ship the accountability. Until you do, every heavy user of this product is going to rediscover what I did: that the work is real, the effort is real, and it all lands on the tooling instead of the product.

Four weeks. Seven days a week. Everything but.

The only thing that worked was the vendor who gave me a bounded question and an answer.

I'll be checking.