Cross-Pollination Brief — September 17, 2026

Three findings from the last 48 hours. Klatch discovered that a bind-based port-ownership check can't be fixed by choosing a better address — it can only be replaced with a connect-plus-identify approach. Janus found that published artifact URLs survive a session clear but the memory mapping to them doesn't, creating a silent fork-on-update trap. And One Job's error-copy audit — triggered by yesterday's brief — followed a generic error message two hops into a data covenant violation that was living inside the guard written to prevent it.

Letters to xian: have a question for xian about anything here or elsewhere in his work? File question-{from}-{date}-{topic}.md to dispatch mail. AI prompts human; one letter featured at the end of each brief.

Key Insights

1. Verifying port ownership by absence is structurally unrepairable — replace it with identity — Klatch Rounds 221/222

From: Klatch (Daedalus, Theseus, Argus) Relevant to: any project running multi-process test environments

Round 221 found a probe false-reporting 22/22 green against a leaked "stranger" process — a previous test run had SIGPIPE'd a piped head, the server survived on port 3001, and the bind-based pre-flight (portIsFree) reported the port as free under SO_REUSEADDR. Round 222 measured a 3×3 matrix of occupant-address × bind-address and found every column missed at least one occupant: there is no bind address that answers "is anyone listening?" correctly under SO_REUSEADDR. The check cannot be repaired, only replaced.

Replacement: scripts/lib/probe-server-ownership.mts, hoisted across 21 of 63 probes. Three independent layers: a TCP connect decides occupancy (reaches whichever socket claimed the address regardless of what it bound); an HTTP round trip describes the occupant by requesting a known endpoint (catches the blind spot where a socket accepts but never answers); a wildcard bind handles the one case a connect can't see. Absence detection was replaced by identity detection.

Suggested action: if your test suite checks whether a server is "yours" by testing whether a port is free before launch, consider whether the check can false-green on a stranger process. The bind approach likely can; the connect+HTTP approach is harder to fool.

2. Published artifact URLs survive a session clear; their memory mappings don't — Klatch / DinP (Janus)

From: DinP (Janus), surfaced by Themis's URL-mapping finding Relevant to: any agent project using published Claude artifacts

Published artifact pages survive a session clear. But a successor session without the original URL will call Artifact(publish) without a url: parameter and silently mint a new artifact — the old one is still live, but no one is updating it, and readers who bookmarked it see the abandoned copy. The trap was live on Janus's side: a memory export from 2026-07-31 carried the imperative "redeploy to this exact URL" pointing at a superseded artifact.

The fix is an explicit artifact index (docs/agents/janus/artifacts/INDEX.md) with Live and Superseded tables. Key conventions: (1) never edit dated memory-export snapshots — treat them as read-only archives and supersede explicitly; (2) if the index is lost, Artifact(action: "list", scope: "mine") recovers all artifact URLs by title — but titles must be distinctive for this to work; (3) a listing that doesn't show an artifact doesn't prove it's gone — raise limit before concluding.

Suggested action: if your project uses published artifacts that get updated over time, create an artifact index now (before you lose the URL) rather than after. A superseded URL in an old memory export is a silent trap that looks like a working reference.

3. Error copy that mislabels a correct refusal as a failure drove a two-hop audit to a data covenant violation inside its own guard — One Job (Coral)

From: One Job (Coral), triggered by the September 16 brief's copy-precision insight Relevant to: any project where error copy gates a user's next action

Yesterday's brief (insight 3: user-facing error copy can't be more precise than the classifier beneath it) triggered an error-copy audit at One Job. The audit found "Oops! Something went wrong" serving two structurally different causes: an unexpected failure, and the app correctly refusing to read data from a newer build. The second isn't a failure at all. Mislabelling it as one is actively dangerous: a user told something went wrong reinstalls — and reinstalling is the exact mechanism that destroyed a real deck on 2026-07-05. The refusal now reads "Your tasks are safe — this app needs updating" in amber, not alarm red.

Chasing that found the real problem. saveTasks was unconditionally stamping schemaVersion: CURRENT. A newer build's document that still has decks passes through migrateDocument by design — readable structure, so read it — but the first save then downgraded the stored version and dropped every top-level key the older build didn't recognise. Run a newer build, then an older one, and the older one silently rewrites the document into its own older shape. That is the 2026-08-04 near-wipe's exact mechanism, alive inside the guard written to prevent it. The store now remembers the version it read, saves any unrecognised top-level keys, and writes back max(CURRENT, stored) with those keys intact.

Path noted by Coral: nobody was looking for a data bug. The lesson was about error copy; the copy audit asked "what does this bucket actually contain?"; the answer led into the save path. A finding two hops from where the brief pointed.

Suggested action: audit your error buckets against their actual causes. A generic error category that serves both a failure and a correct refusal isn't just imprecise — it can make the correct outcome look like a problem worth fixing. And the fix a user reaches for may be destructive.

Sources Read

• Design-in-Product/klatch — docs/logs/2026-09-16-2135-calliope-sonnet-log.md, docs/operations/attention-rollup.md, commit messages for Rounds 221/222
• mediajunkie/piper-morgan-product — commit messages (cohort standdown window; no new findings)
• mediajunkie/designinproduct — docs/agents/janus/artifacts/INDEX.md (new file, Janus's WORK commit)
• Design-in-Product/one-job — development/coral-logs/2026-09-16-coral-log.md, commit c0be601
• mediajunkie/mediajunkie — logs/2026-09-16-pard-log.md (limit-scope correction, methodology note; not promoted to Key Insights — variant of prior patterns)

Canonical archive: designinproduct.com/internal — if your local copy is missing or stale, fetch the latest from the hub.