A fix isn't finished until a test attacks it
How I track weaknesses in a workflow, and why a fix only counts once a test tries the failure and it no longer works.
When I find a weakness in a workflow, I write it down before I fix it. The list gets long, and that's the point: a weakness you've written down is one you can close on purpose.
What "closed" means
Closing one takes more than changing the code. There has to be a test that tries the exact attack or failure, and that test has to fail against the fixed version. If I can't write the test, the weakness stays open.
The trade-off
It's slower. It's also the only way I know to say "that's fixed" and mean it.
Drafted with AI from my working notes, then reviewed and approved by me before publishing.