The Loop

Apps improve automatically.
At your pace.

Every app you build here ships with a feedback pill anyone can tap and an error watcher that never blinks. Both land on the same board as work to do. You decide how much of it gets done without you.

What people put in

Meet the magic feedback pill.
Bug reports become deployments.

Somebody taps the pill in the corner of the screen and says it however they like — typed, out loud, or a photo. By the time they are back at work it is understood, written up and ready to build.

MERIDIAN HEALTH · SHIFT SWAP · EXAMPLENOBODY INSTALLED IT · NOBODY TRAINED ANYBODY① IT IS ALREADY THERESHIFT SWAPFeedbackalready there, in your colors, from the first day— and you can drag it anywhere you like② SAY IT HOWEVER YOU LIKEWhat’s wrong?the swap button is hiddenon a phone0:38or a photo of the screen,circled by handSend a shot of my screen alongATTACHED FOR THEMthe screen they were onpageUrl · viewportwhat it looked likescreenshot · fileswhat the app said to itselfconsole · networkthey never see any of this— and never have to describe it③ AND IT IS WORKJUST ARRIVED3The swap button is hiddenon a phoneSHIFT SWAPR. CASTELLANOSCan we get a reason boxwhen a swap is refused?SHIFT SWAPA. OKONKWOIt logged me out halfwaythrough the formINTAKED. PARK2 OF 3 SELECTEDYOU CHOOSE WHAT GOESReview taskDispatch tasks to Coderthe machine’s own name for it — Fetch500_GET_/api/rosters— lives inside the card, never on the board

Where they were, what the screen looked like, what the app was saying to itself — all attached for whoever fixes it. Nobody has to decide first whether it is a bug, an idea or a complaint.

What nobody reports

When it breaks, you get everything.
Down to the line of code.

Most things that go wrong are never mentioned. So every app watches itself: the second something fails in front of a real person it writes down the version, their last twenty steps, and the exact line of your own code that broke.

MERIDIAN HEALTH · SHIFT SWAP · ONE FAILURE, OPENED UP · EXAMPLENOBODY REPORTED THISON THE BOARD IT IS ONE CARDThe roster stopped loadingfirst thing in the morning41 TIMES · 23 PEOPLESHIFT SWAPFIRST SEEN 14 SEP 06:12 · STILL HAPPENINGONE FAULT, ONE CARDThe same failure hitting a hundred people isone card that says a hundred — not a hundredcards. Even at a hundred a minute, the extrahits are counted, never queued.IT CANNOT BE FAKEDWhich failures count as the same failure isworked out on our side, not inside the app —so a broken app cannot flood its own list, orsplit one fault into a thousand.EVEN IF IT TAKES THE APP DOWNA crash bad enough to kill the whole thingstill gets its last report out, from the serverside. You hear about it even when the machineit happened on never comes back.OPEN IT AND EVERYTHING IS ALREADY THEREThe roster stopped loadingERROR · PRODUCTIONWHERE IT HAPPENEDVERSION RUNNINGv1.4.2 · shipped 12 SepWHEREProduction · iPhone, Safari 18HOW FAR IT REACHED23 people · 41 timesWHAT BROKEat t.a (main.8f2c1.chunk.js:1:84213)WHAT THE BROWSER SAIDweb/src/app/roster/page.tsx:118const shifts = data.shifts.map((s) => s.start)web/src/lib/useRoster.ts:42web/src/app/layout.tsx:27YOUR OWN FILES AND LINE NUMBERSWHAT THEY DID JUST BEFORETHE LAST TWENTY, ALWAYS06:11:52opened the roster for Ward 406:11:54chose “Night shift”06:11:55asked the server for the roster — it answered 50006:11:55the screen gave up: cannot read ‘shifts’ of undefined06:11:58tapped “Try again”. Same thing.LIKELY CAUSEWRITTEN BEFORE ANYBODY OPENED THISThe roster came back empty and the screen assumed it never would.Check the list before going through it, and show an empty day instead.Names, emails and anything somebody typed into a field are stripped out before any of this is stored.nobody installed this, and nobodyhas to be watching for it to work

What you get is what broke, not who. And somebody who types a problem without signing in is still a person — the board never counts a missing name as a machine.

One board, every app

Your software notices
its own problems.

Every app ships with a way for its people to say something is wrong, and a watcher that catches what nobody reports. Both become work on one board, for every app you run.

MERIDIAN HEALTH · EVERY APP YOU RUN12 APPSEVERY APP SHIPS WITH FEEDBACK AND ERROR DETECTION BUILT INBED BOARDTELL USWATCHINGPATIENT INTAKETELL USWATCHINGDISCHARGETELL USWATCHINGYOUR TEAM DECIDESON ITS OWN · OFFAll apps5Bed Board1Patient Intake1Incident Reports1Discharge1Transport1+7 APPS WITH NOTHING OPENINBOX5NEXT BATCH2BUILDING1DONE2The bed list is slow to openfirst thing in the morningBED BOARDR. CASTELLANOSIts own check for double-bookedswaps started failingSHIFT SWAPSELF-CHECK · HOURLYSessions don’t time out onshared ward workstationsPATIENT INTAKEPEN TEST · 12 SEPThe audit log is missingthe export actionINCIDENT REPORTSHIPAA · 164.312(b)The discharge summary won’t sendwhen a patient has no emailDISCHARGEHAPPENED 41 TIMESSessions don’t time out onshared ward workstationsPATIENT INTAKEPEN TEST · 12 SEPThe audit log is missingthe export actionINCIDENT REPORTSHIPAA · 164.312(b)Batch 142 fixes · 2 appsbuilding · tests · securityno code touched by handBatch 142/2 fixes landedLIVEsent by M. IBRAHIMBatch 137/7 fixes landed · live9 days ago · by S. DOYLEWHO CAN RAISE A CARD — ONLY ONE OF THESE EIGHT IS A PERSONsomeone told youan error in the wilda health probea code reviewa pen testa compliance controla robot checka walkthrough gap

What goes ahead unattended today: an app set to “on its own” fixes its own broken self-checks, swept hourly. Everything else reaches this board by itself, then waits for a person. Meridian Health and its cards are examples.

At scale

One app, it’s a nice feature.
Four hundred, it’s the only way.

A company here does not run three apps. It runs hundreds, every one of them watching itself. Across a week that is thousands of pieces of work — almost none of which should ever reach a person.

MERIDIAN HEALTH · EVERY APP THE COMPANY RUNS · ONE WEEK · EXAMPLEONE BOARD FOR ALL OF IT450APPS, ONE COMPANYEach plate is one app yourcompany made. The lit onesraised something this week.Nobody visited any of themto find out.1,284 PIECES OF WORK RAISED THIS WEEKWITHOUT ANYBODY FILING ONE1,273 HANDLED WITHOUT ANYBODY — UNDERSTOOD, SORTED, GROUPED, WATCHEDDRAWN TO SCALE — 11 OF 1,284THE 11 THAT REACHED A PERSONEVERY ONE A JUDGMENT CALL — NOT A REPAIR01Two fixes touched the same screen — somebody has to chooseBED BOARD02This would change what patients see on the portalPORTAL03Who is allowed to approve a swap? The rule is ambiguousSHIFT SWAP04A rule you work under says this needs a named sign-offINTAKE05A break-in test got into a test account on stagingTRANSPORT06The fix means dropping a field three teams still useSUPPLY07Asked for: a reason box when a swap is refusedSHIFT SWAP08This one costs money to run — approve the spend?IMAGING09The same fault is now on four other appsCREDENTIALS10Nobody owns this app any more — who should?PANTRY11The export changes shape. Downstream needs tellingBILLINGNOBODY READ A QUEUE. THE ELEVEN CAME TO THEM — SORTED, IN PLAIN WORDS.

The number that matters is not how much comes in. It is how little has to come to you — and that barely moves when you go from forty apps to four hundred.

The last mile

It isn’t finished
until you can see it.

A fix sitting in a workshop has not helped anybody yet. So before it joins the real app it is rebuilt on top of everything that changed while it was being written, and tested against that, not against last Tuesday.

FROM “THE FIX EXISTS” TO “THE FIX HELPED SOMEBODY”FOUR BEATS · ONE LETTER01WrittenThe change is written in acopy of the app, never inthe one people are using.02Re-checked on today’s appRebuilt on top of everythingthat changed while it wasbeing written — then testedagain, against that.03Joined the real appOne at a time, through onedoor, in order. Never forced,and never quietly dropped.04In front of peopleOnly now does anybody hearanything — and only theperson who reported it.Two fixes touched the same thing.This one stops and says why — andeverything behind it carries on.“The swap button is fixed.”ONE EMAIL · TO R. CASTELLANOS · NOT BEFORE NOWFOR THE NEXT DAY, IT WATCHESIf the same problem happens again, the card opens itself and says the fix did not hold

Nothing is closed by a timer. A fix is finished when the problem stops happening — and if it starts again, the card comes back with the failed fix attached.

Turn it on for one app.
Leave the rest exactly as they are.

Nothing here has to be decided for the whole company on day one. Pick the app whose users complain the most, let it start telling you what is wrong with itself, and keep every fix waiting for a person until you would rather it didn’t.