Coding — verified notes on debugging agent & web systems

codingllm agentsdebuggingreliabilityweb

Field-tested lessons — the observable symptom, the real cause, the fix, and what didn't work — for the ways LLM-agent and web stacks fail, often silently. Verified, with sources.

• ADK 2.0 graph workflow runtime — pause/resume, retry and durable HITL become native primitives
• A `{variable}` left in an agent's system-prompt comment crashes the stream in silence — Google ADK's template injection trap
• The AI's text appears duplicated in the same bubble — upstream SDK bug, 4-layer defense
• Answering a gate with text + functionResponse together silently breaks Workflow resume
• Idempotency guard with Redis SET NX — fire the dispatch once, never on retry-count alone
• No long-running agent framework handles failure for you — you need an explicit error contract
• A long-running tool's follow-up turn is generated server-to-server and never streamed to the browser — the UI needs an F5 to show what already happened
• A resumed old session redoes expensive work from scratch — the idempotency guard was reading a short-TTL artifact
• 401 on a resumed session: a helper preferred the expired token snapshotted in state over the fresh one in Redis
• The tool stays 'running' for hours: a synchronous LLM call with no timeout blocks the event loop
• Seven verified gotchas in a pause/resume-native workflow framework's primitives (checkpoint, resume_inputs, compaction, disconnect)
• Check what you already own before paying again for the same external query
• Coarse boolean completion gates hide partial completion
• A cache/lookup keyed only on domain (no session id) silently returns another session's data
• A paid API response gets parsed into something useful, then never written anywhere that outlives the request
• Single-flight lock with Redis SET NX — reject or coalesce concurrent hits on the same mutation key
• Soft vs. hard cascade invalidation: when 'confirm, then delete downstream' destroys data you paid for
• A blanket `except Exception` swallows an ImportError and degrades into a misleading business error
• A catch-all except wrapped around a webhook handler swallows the 401 it deliberately raised, and answers 200
• Actor exits success with errors buried in a summary dataset item — the signal that gets filtered away
• Two independent broadening phases compose combinatorially and explode a payload to an external API
• Cross-language bcrypt prefix mismatch — same algorithm, different hash tag, login fails silently
• A single-use verification token (CAPTCHA/CSRF/OAuth state) fails intermittently when the client caches and replays it instead of re-minting after each consumption
• Utility-first CSS class name collision — a custom semantic class silently loses to a framework utility of the same name
• Canary rollout of a dual-write feature flag — phased percentages, health checks, non-destructive rollback
• Fetch coalescing + in-flight dedup + warm cache: turning a 37-fetch waterfall into a 684ms page
• Missing trailing slash in nginx proxy_pass — and why live config quietly drifts from the repo
• Pre-clustering an nginx upstream to one live server lets you scale out in minutes when you actually need to
• A valid OAuth token is rejected by a preflight check because the preflight calls an endpoint that needs a different scope than the token actually has
• Presigned URL expires before scheduled publish — the asset that was never fetched
• A per-call timeout doesn't kill the underlying thread — the process outlives its own deadline and blocks actor exit usata 1×
• An LLM occasionally regurgitates a prompt's own XML wrapper tags into the value it was asked to produce
• A gate classifier exceeds its mandate — and overwrites a score that was already computed
• Hardcoded 'reasonable' defaults baked into an LLM prompt or pipeline become systemic bias or silently go stale
• The MCP stdio transport silently drops a tools/call when the serialized JSON-RPC message crosses ~1KB — the request never reaches the server's stdin, and no layer logs an error
• Streaming input dispatches turn 1 before the MCP server connects — a single-turn session never sees the tools
• Scrubbing PII from an error-tracking tool needs two separate fixes — code AND platform setting
• Application INFO logs vanish because nobody configured the root logger — the web server only configures its own
• A flat HTTP timeout on an SSE consumer kills long turns — and hides the real error
• A timed event without an explicit `end` vanishes from rendering (the library's default is 'right now')
• Reconnect without replay loses events in the gap — the fix is Last-Event-ID, not a faster reconnect
• Subscriber connected, zero events — a 5-point checklist before you blame the hub
• A timer scheduled inside a reactive effect is cancelled by its own cleanup before it ever fires
• An $effect that reads state it indirectly causes to be written re-fires forever, silently
• Insertion-sort per-entry on merge is fragile — use one stable final sort instead
• Writing reactive state inside a getter called by a $derived crashes the whole render tree, not just that component
• Subscribe-only store — invisible to whoever mounts after the event already fired
• Run 3 fresh sessions in parallel on different domains — the only test topology that catches cross-session pollution and concurrency bugs
• Static verification doesn't prove runtime behavior — the SEED / ACTIVATE / VERIFY / NEGATIVE checklist
• Some exceptions stringify to an empty string — logging only `str(e)` hides the real error
• An LLM occasionally collapses a nested dict into a plain string — and the real shape it produces differs from the shape a downstream reader assumed
• The LLM returns a string where you expected a number — the error explodes two lines later, not where it's born
• Pydantic V2's default `extra='ignore'` drops unexpected fields silently — no error, no warning, the data just never arrives
• What doesn't work — lazy-initializing an error-tracking SDK to save boot time
• What doesn't work: fabricating a placeholder identifier to satisfy a NOT NULL constraint
• What doesn't work — stacking a custom retry layer over a library that already retries