Self-Healing Is Search

Ron Reynolds · 2026-09-02 · 8 min read

Fourth in the QC series. The most surprising property of a disciplined corpus is that it hunts for its own flaws before they ever surface.

Ask an engineer what "self-healing" means and you'll get some version of the same answer: the system detects that something has broken and recovers without a human in the loop. A pod crashes; the orchestrator restarts it. A connection fails; the circuit breaker opens and reroutes. A node goes unhealthy; the cluster drains it.

That's recovery. It's good engineering. And it has a structural flaw hiding in plain sight.

Recovery only fires after the damage. The pod had to crash. The connection had to fail. The flaw had to mature into a symptom severe enough to trip a detector before anything healed. Between the moment a flaw enters the substrate and the moment it produces a symptom, the flaw lives — untouched, undetected, accumulating interest. In a large codebase that gap is not seconds. It's weeks. It's the migration from two months ago whose implicit assumption nobody noticed until it broke a report. It's the off-by-one that sat in a rarely-hit branch until the one day traffic hit it.

Detect-and-recover heals symptoms. It cannot heal a flaw that hasn't surfaced yet. And the flaws that haven't surfaced yet are exactly the ones that hurt most when they do.

There's a different kind of self-healing. It doesn't wait for the symptom. It hunts. Every read is a pass of the gate

QC — the two-station inspection regime we run across every ComOS repo — closes with an eight-question final inspection that fires whenever an agent claims a task is done. Count versus list. Asserted versus tested. Magic numbers justified. String keys schemaed. Scope named. Verification floor matched to claim. Framing honest. Fixtures captured from reality. Eight channels of failure, each with its own question, each prescribing its own cure.

Here's the part that surprises people. The gate fires when work is written — and it fires again when work is read.

When an agent — human or machine — opens an existing artifact to build on it, extend it, or reference it, that agent is operating under the same discipline. The eight questions are live in its attention. It is not consciously auditing the file; it is doing its own work. But the discipline runs below the decision layer, and the moment the agent's eyes cross a count that doesn't match its list, a constant with no rationale, a claim its test doesn't support — the gate fires. The flaw surfaces. The cure, because the grain is fine, is named on the spot.

The agent didn't set out to find that flaw. Its passage through the corpus is the search. Every read is another pass of the gate over ground that may have been written before the gate matured, or by a participant who hadn't yet absorbed the local voice, or in a rush that a fresh read catches. The corpus gets re-examined constantly — as the ambient byproduct of every contributor doing normal work on top of it, with no scheduled audit anywhere.

This is the inversion. In a detect-and-recover system, the substrate is quiet until something breaks. In a QC corpus, the substrate is under continuous examination, because examination is fused into use. Reading is hunting. There is no idle state in which a flaw can mature undisturbed, because every touch is a pass. The hunt is legible from outside

"Every read is a hunt" describes how the discipline runs from the inside. From the outside, the same posture is visible in how the corpus answers questions about itself.

The corpus serves a live introspection surface — the same MCP gateway the agents use — and every answer it returns arrives in one of two shapes. Cited: every referenced path resolves through a pinned manifest, and every quoted excerpt is verified as a substring of the artifact it cites before the answer reaches you. Uncited: labeled as such, with the reason. There is no shape in which ungrounded text arrives dressed as grounded.

A system built to hunt its own flaws does not get to present a flattering summary of itself; the response contract won't carry one. What it presents is the ground it actually stands on, per answer, checkable by the caller. The hunt that runs in each agent's attention has a wire format.

And the ground being hunted grows without diluting the hunt, because every new repo in the estate is born inside the gate — there is no other way for an artifact to enter. Most systems get harder to keep clean as they grow; the unwatched surface area outruns the people watching it. This one inverts that too. The search scales with the corpus because the search is how the corpus is built. Why the cure stays cheap enough to do continuously

Prospective healing only works if curing each flaw is cheap. If finding a flaw kicked off an expensive root-cause hunt, you couldn't afford to do it on every read; you'd batch the flaws, defer them, and deferred flaws compound right back into the detect-and-recover trap.

The fine grain is what keeps it cheap. Each of the eight questions owns one narrow channel of failure, and each channel's failure prescribes its own cure. Count drift? Recount. Unjustified constant? Justify it. Unschemaed key? Write the encoder. Invented fixture? Capture a real input. The test that fails is the root cause, named — there is no separate analysis step. The round-trip from "flaw surfaced" to "flaw cured" closes inside the same pass that surfaced it.

So the search can run continuously because each thing it finds is cheap to fix. That's the coupling that makes the whole property hold: prospective search is only sustainable when the cure is local, and the cure is local only when the grain is fine. Healing paid in tiny increments on every read is healing that keeps pace with the rate at which new flaws enter. What this buys an operator

Three consequences, each structural.

Onboarding pays for itself. When a new participant joins the flock — a new engineer, a new agent — their early artifacts carry flaws, because they haven't absorbed the surrounding conventions yet. Those flaws get caught by the next contributor who reads the work as part of their own production. The corrected artifact teaches the newcomer by example. Nobody runs a separate onboarding audit; the self-healing absorbs the cost out of normal work.

There is no quiet rot. The failure mode of large codebases is silent decay — flaws accumulating in code nobody has reason to reopen. A corpus where every read is a pass has no unwatched corners, because building on something is reopening it, and reopening it is re-auditing it.

The hunt scales past the founder. Prospective search — catching flaws before symptoms — has historically required a vigilant senior engineer reading everything. QC externalizes that vigilance into a gate every participant runs. The hunt doesn't stop when the founder steps away; it runs on every read, by every reader, human or machine. The artifact, installable

The skill is open source. The canonical SKILL.md, the eight questions, the anti-pattern table, and installation guidance for any AI-assisted codebase live here:

https://github.com/ronrey/proof-before-done

If you want to test the claim, install the skill and watch what happens the next time an agent reads old code to build on it — not writes new code, reads old. Watch the gate fire on something that was already there, already "done," already shipped. That firing is the search. The corpus hunting itself, on a read nobody scheduled, is the property this article is about. You'll see it the first day. The stealable line

The corpus doesn't wait to be broken. It hunts for what could break it, on every read.

Recovery heals what already failed. Search heals what hasn't failed yet. The difference is the difference between a system that survives its flaws and a system that retires them before they bite. Make the search ambient — fuse it into every read, keep the cure cheap enough to do on the spot — and self-healing becomes a hunting story. Next in the series: question everything, especially your own thoughts. Closing test [ ] A staff engineer unfamiliar with this article can read it and identify its central claim: that QC makes self-healing prospective (flaw-search fused into every read, before symptoms) rather than reactive (detect-and-recover after damage), and that the search is legible from outside in the introspection surface's cited/uncited contract. [ ] The central claim is verifiable by named procedures: the cited/uncited contract is testable by querying the live introspection surface and confirming every answer is either cited-with-verified-excerpts or uncited-with-reason; the every-read-is-a-pass behavior is demonstrable by installing the open-source skill and observing the gate fire on a read of pre-existing code. [ ] If a procedure has not been performed, its checkbox stays unchecked until it has — QC is the gate, not the goal.