8 parts, in order.
An adversarial review of a conference workshop's build plan found a genuine structural flaw in its Auth0 FGA model, not a polish problem. The check it ran on a citizen's own record was trivially always true, which meant the demo's actual premise - authorising an AI agent acting on someone's behalf - was never being tested at all.
Part two of the apidays workshop series moves from planning to building. Claude reversed a hosting decision that turned out to be solving a problem that never existed, then quietly let a fourth infrastructure provider into a build I'd explicitly ruled out - twice.
Part three of building the apidays workshop demo with Claude Code. Three separate times in one session I went back to the original brief and found real drift - and each time I described it to myself as though it were a fresh insight, rather than noticing I'd said the same thing before.
Claude Code built the caseworker admin console for my apidays workshop demo and every check it ran passed - type check, lint, build, direct FGA queries. The first time I actually clicked the button, we found five separate bugs, one in each layer of the stack.
On-behalf-of token exchange for the apidays demo's MCP server failed with the same generic error no matter what I tried. Six separate, individually correct verification passes across two sessions all checked the wrong property of the one field that mattered.
A live user hit a broken appeal submission on an error from the exact family the previous post had just spent two sessions solving. It wasn't the same bug - the earlier fix's own assumption didn't hold for a second hop, and two more unrelated bugs were stacked underneath it.
Two new capabilities shipped in the same session, wired into the backend correctly and invisible to the chat model anyway - because registering a tool and telling the model it exists turned out to be two separate, separately-forgettable steps.
A live-event monitoring dashboard went through six rounds of adversarial review before a line of code shipped - and every one of them was reviewing an argument, not the actual files, for four rounds running.