Read It Before You Run It
Recover the contract, trace the boundary, and find the input that exposes plausible-looking code.
Trace it before you run it
Read unfamiliar code for its contract, hand-trace one ordinary input, then hand-trace the boundary.
The happy path is not the test
Generated code is fitted to the example you gave it, so the example proves nothing. Learn the boundary catalogue and write a probe that separates correct candidates from plausible ones.
The failure signatures of generated code
Seven shapes account for most bugs in code you did not write. Learn to name them on sight, then repair a function that swallows its own errors.
The Test Is the Verification
Turn a suspicion into an assertion that fails before the fix, using properties and a reference oracle when examples run out.
Write the test that catches the bug
A suspicion is not a bug. The assertion that fails before the fix and passes after it is the only durable artifact of a review.
Properties catch what examples miss
When you run out of examples, assert a property that must hold for every input and search for the smallest input that violates it.
Check it against a version that is obviously correct
Write the slow, dull, clearly-right implementation and make the clever one agree with it. A brute force you trust is a specification you can execute.
Debugging Code You Did Not Author
Shrink the failing input, repair without rewriting, and read a solution for the cost it will have in production.
Shrink the failing input
A bug report with a 400 row file is not a diagnosis. Cut the input down until removing anything else makes the failure disappear, and the answer is usually visible.
Repair, do not rewrite
The instinct to throw the function away and start again feels efficient and quietly discards every case it already got right.
The cost you asked for is not the cost you got
Correct output, wrong cost. Learn to read a body for the work it hides, and to count that work exactly rather than guess at it.
Calling a Model Like Any Other Unreliable Dependency
Wrap the call, validate what comes back, and check the API it used actually exists before any of it reaches production.
A model call is a network call
Slow, metered, and allowed to fail. Wrap it the way you would wrap any third party: a timeout, a bounded retry, a budget, and a defined answer for when it does not come back.
Validate the output, always
A model returns text, not data. Parse it at the boundary, check every field you are about to use, and decide what happens when it does not match.
The API that does not exist, and the one that does something else
An invented method fails loudly. The dangerous case is the method that is real, spelled right, and does not mean what the name suggests.
Ship it or send it back
The whole level as one repeatable pass: six questions in order, a verdict, and a comment specific enough to act on.