AI writes the code; these rules are what make it safe to ship for a real business. Each one exists because something went wrong once and was written down so it cannot go wrong the same way twice.
AI writes the code. The gate is what makes that safe to ship for a real business: a fixed sequence in which the three human steps and the one hard stop cannot be moved.
A request does not become a build. This record shows an idea becoming a ruled, scheduled change in one afternoon, and the database catching that the idea reversed an earlier ruling. The request: the studio owner, the afternoon the new admin screens went live, wants a phone number on trial-class bookings so she can call when a class is cancelled.
Thirteen minutes from raised to planned, and another ninety to find out I had ruled it out nine days earlier. Zero minutes of code. That gap is the point: deciding is cheap, undoing is not.
What this establishes: nothing enters the gate unrecorded, and a reversal is caught before a build. What it does not: that the change is a good one. That is decided at the gate.
The row that is still “Idea” two weeks from now is the one to worry about, not the one that took thirteen minutes.
The other list. Not everything owed is a feature. A restore rehearsal, a password rotation, a privacy text, one real test booking — none of them belong on the ideas board, and each of them used to live in a chat log or in my head. Since 24 September they are rows in a second database, Plugin Chores: area, owner, status, and the version they block. Three of thirteen block something today. A version with an open blocking chore does not leave the gate.
What this establishes: that owed non-feature work is written down with an owner and a stop. What it does not: that the chores get done — the status column is the only proof, and today it reads eleven “to do” and two “waiting”.
Asked before the plan review runs, for any version that changes what is stored. The answers become rulings the build has to honour.
None of these was planned. Each is the shape of one thing that went wrong, written down so it cannot go wrong the same way twice.
Quick Edit wrote a teacher's id as 0 and a class lost its teacher without an error. The fix touched exactly the failing path, so every acceptance test was re-run the next morning before it shipped.
A reviewer reported the sign-up tables missing. It had checked plural names; the plugin's are singular — a confident wrong claim from a model that had never queried the database.
A mobile layout was ruled, given a version number and never built. The ruling lived in a document nobody re-read until the owner asked where it was.
Step 07 of the gate for version 1.11.17, the cancellation mail, the evening before the site went live. I checked the flow against the booking table and the mail markers, step by step. The record, as written that night; only the test addresses are shortened.
Installed after a database backup. Plugins page reads 1.11.17, active. Fixture: class 174 „Ballett für Kinder“, date 19.10.2026 — far future, 0 bookings before and after.
No PHP notice, no admin error anywhere in the flow.
R4, R5, R8 and N1 are the rulings the spec carried; the read-back checks each one by name. What it establishes: the four rulings behaved as ruled, on staging, with real bookings. What it does not: that a failed send recovers, or that the mails read well — neither was tested that night, and the record says so.
Steps 05 to 08 of the gate for version 1.11.18, the new settings overview, the day after the site went live. The release was a backup, a decided undo, a read of the changed code, an upload and five checks. Times are the tools' own timestamps; nothing is rounded.
Live was running 1.11.17. The host's own daily backup existed (23.09, 17:49, kept 14 days). What follows is the version's own backup and the undo, then the upload.
On the live site, from upload click to last check: under two minutes. Before that: thirty.
Backup, undo, read, upload, check: the order is the gate's. What it establishes: the version can be taken back without loss, and the public pages survived it. What it does not: that booking works on the new version — no booking was made. The third “not verified” item is a substitution I made on purpose and dated, so the next version cannot inherit it silently.
AI wrote the implementation. My part was to define what should happen, check what did, and decide whether it could run in a business. In use on a scheduling plugin live since 23 Sep 2026: eleven versions in September, nine defects caught before code existed, zero rollbacks.
The plugin case study ↗︎
