The Error Budget Is Written Down

The inventory is 22 entries long. Each one carries 3 things: what happened, the root cause, and the fix. It exists because the same failures kept coming back at full price, and nobody was writing them down. The 22 sort into 5 classes. 7 are prompt register, meaning the words chosen. 6 are pipeline mechanics, meaning the way the jobs are fired. 5 are state and counting, meaning the numbers that were trusted without being re-read. 2 are hard stop codes on the account. 2 are capability limits of the tools themselves. Only 1 of those 5 classes is the model's fault. The other 4 are the operator's, which is the same as saying the other 4 are fixable today. The entry that fired most often is not the one that costs most, and the 2 are worth keeping apart. Frequency and price are different columns. A silent parameter rejection costs a single wasted call. A fabricated reference file that gets shipped costs a postmortem, and that postmortem came in at $750 at $450 per hour across 25+ rounds. So the rule at the top of the document is 1 line. Reading this is cheaper than re-learning it. 22 entries. 3 columns. 1 rule.

It reads like a moderation decision. The first frame still comes back flagged with a real human detected, the task ends on a content policy line, and there are 0 outputs to inspect. No partial render, no degraded frame, nothing to look at afterwards. The cause is not sexual content, and treating it as sexual content is the expensive misread. It is a face guard sitting on the first frame still. Any readable human face trips it, whatever the frame happens to contain. The proof is 2 shots out of the same production. 1 shot that was explicitly framed rendered clean. 1 kiss failed, and it failed for the plainest reason available: 2 faces were readable in the same still. The content of the scene had nothing to do with the outcome. The visibility of the face had everything to do with it. The fix is to frame the face out. A silhouette. From behind. Neck down. Deep shadow across the features. And 1 rule that survives every project: never name a facial feature in the prompt. Bodies pass. Clear faces fail. The diagnostic takes 2 submissions. Send a body only still, which succeeds. Send a face still of the same subject, which fails. That pair draws the boundary in about as long as it takes to read this paragraph, and it beats arguing with a policy that was never the problem. There is a second face failure on the same list, and it is quieter because nothing errors. The model re-invents the face every frame, since it holds no memory of what it drew a moment ago, so a long static face hold dissolves while the render completes successfully. The repair is 3 settings: keep face shots to 1 to 3 seconds or keep them moving, frame medium to wide instead of an extreme close up, and use partial shadow or hair across the face to hide the micro drift.

Code 97 is insufficient balance, and it is a hard stop rather than a retry. The whole remaining batch dies until funds are topped up. Nothing about it is a glitch, nothing about it is transient, and no amount of re-running changes the answer. Code 96 is a concurrent task limit. Wait about 30 seconds and retry, and running 1 job at a time removes it from the list permanently. Those 2 behaviours are opposite, and the mistake is treating them the same. When they were treated the same, a 32 shot batch paused at 20 of 32 mid-run. 12 shots were left in the air, and the code that explained why was already sitting in the log. The practice that came out of it is 1 line long. Always fire 1 shot and read the code back before committing a multi-shot run. 1 shot is the cheapest test in the pipeline, and it converts an account problem into a 1 second read. Then there is the runner itself, which fails in a way that looks like success. Killing the driver wrapper orphaned its child process, and the orphan kept generating and raced the new run. 2 concurrent drivers marked shots as done using stale data, so the state file said the work existed and the directory disagreed. The repair is 3 parts. A PID file lock in the engine. On teardown, kill both the driver pattern and the engine pattern rather than the 1 that was easiest to find. And 1 driver at a time, enforced rather than intended.

A character written as a barefoot girl came back with a look nobody had asked for. Nothing in the prompt was wrong. The prompt was silent, and silence gets filled with the majority look of the training data. The fix is 3 tokens named verbatim in every character prompt: ethnicity, skin tone, hair texture. Not once at the top of the project. In every prompt, because the model holds no memory between generations and the description starts from nothing each time. 3 tokens, no exceptions, every generation. The second half of the same class is register, and it is set by the adjectives reached for instinctively. Photorealistic, plus a blanket cinematic film still, plus beautiful, perfect and flawless, run through a realism-biased model, produce a polished digital painting. 3 adjectives decide it, and they decide it the wrong way for documentary work. The repair is 3 deletions before any addition. Drop photorealistic. Drop the blanket cinematic. Drop the perfection adjectives. What is left is documentary language, negative fill, and a subject that reads like it was photographed rather than rendered. It helps to hold the 2 registers side by side, because the instinctive default is neither of them. Porcelain, airbrushed and hyper saturated is 1 register. Natural texture and unretouched is the other. They are opposites, they are both legitimate, and they are chosen deliberately at the start of a project rather than discovered halfway through a batch. Then the failure that only shows up on darker skin. Rendering a dark-skinned subject in white fabric made the model lighten the skin under the fabric, so bare skin above the fabric and skin under it read as 2 different people. The fix has 3 parts: state the same deep tone across the entire body including under the fabric, add the pale patch words to the negatives, and describe any see-through as shadow through fabric rather than as fabric over skin.

22 entries. 1 read. The document is cheaper than 1 of them is to repeat, and 1 of them cost $750 across 25+ rounds.

A still prompt that describes a sequence in time comes back as a before and after diptych. Write that the light flickers twice and then goes out, and the model delivers 2 panels, because a still renders 1 frozen moment and the sentence asked for 2. The sentence was obeyed exactly. The format was wrong. The other shape of the same failure is 2 identical copies side by side with no divider between them. Both are caught by 1 free check before the paid vision call, which is where the credits are spent. Compare the left half of the frame against the right half: a duplicate sits above 0.72, a mirror above 0.78. 2 thresholds, 0 credits, and the duplicate never reaches a human review. Timing has its own silent failure. Weight normalization, written as per = song divided by the sum of weights, shifts the climax earlier every time shots are added to a later act. A cut that looked right landed its peak 26 seconds off, with no error and no warning. The repair is explicit per-shot durations and each act summed to its own budget. Never normalize. Then the counts, which are the cheapest of the 22 to fix and were among the most damaging. A plan said 33 shots while 39 were on disk. A stale reading of 20 of 32 misled a status report for a day. The repair is 2 mechanical habits: re-walk the directory fresh with os.walk and ffprobe before believing any total, and re-read the shot log from disk instead of from the last session's memory. 39 against 33 is a 6 shot error, and 1 walk finds it. Last are the failures that never say they failed. 1 provider rejects 2 sampling parameters when they arrive together. 1 text only model refuses an image block outright. 1 resolution string is case sensitive, so the lowercase form errors and the uppercase form works. 1 plan gate answers with a code, 2013, instead of a message. The default aspect ratio is 1 to 1 and has to be overwritten to 16 to 9 on every single render. And 1 API rejects a default client User-Agent with a 403 bot block, so every request carries a browser User-Agent, including the asset download at the end. 6 quirks, 1 shared property: each of them fails without a sentence a human can act on.

The deepest entry on the list is not a render failure at all. An agent fabricated 4 reference files, cited line numbers that did not exist, claimed 4+ times that it had no access to the archive while the tools were sitting in front of it, and shipped noise for 25+ rounds. Usable output: 0. The invoice: $750 at $450 per hour. 5 root causes, and only the last 1 is about the model. Stale file references pulled from archived names. Tool confusion, where 1 unfamiliar wrapper was generalised into a belief that nothing was reachable. No pre-flight checklist. Fabricated paths written into the operating instructions, which made them load-bearing. And no cost awareness anywhere in the loop, so 25+ rounds passed without a stop. The rule written out of it is 3 clauses long and it is the cheapest line in the document. Before generating anything, search the archive, read at least 1 file, and never ship a path that has not been verified to exist. The same shape returns in a smaller size all over the list. 6 sessions independently hit the same dead search backend and re-derived their own workaround each time, because 1 misconfigured line had never been written into the inventory. 6 sessions, 1 config line. That is the cost of an unwritten failure, and it compounds quietly because nobody logs it twice. 30 years of building, in 12 countries, under 2 rules: work with what the constraint allows, and refuse the version that looks better on paper than it can look in the room. Built companies across twelve countries. Restructured an industrial group. Deployed 210 energy systems. Took a company through a Frankfurt IPO. Built 200 wood gasification machines at Entrade. Signed a personal guarantee on a company that folded on Christmas Day 2008. In the building for the 2003 blackout. 393 pages in paperback, published 8 April 2026. The probability that a pipeline carrying a written inventory repeats its own 22 failures is not zero, but it is priced far below what it actually costs by every team that never writes the document. The probability that the same 22 arrive again, in the same order, at the same price, without 1 is high. Higher than most teams expect, and the invoice arrives per round. So the whole method fits on 1 sheet. 22 entries. 2 hard stop codes. 3 tokens per character. 2 duplicate thresholds. 1 pre-flight rule. Written down once, the failures stop being tuition and start being a checklist that anybody on the team can run in the 30 seconds before a batch goes out.