You can't see a refactor. So try to break the machine. 重构看不见?那就试着弄坏机器

You paid for a refactor. The arm runs the same path. The screens look the same. Your engineer says the architecture is cleaner and the code is safer. From where you sit, nothing changed — did you just buy nothing? If you build machines for a living, sooner or later you will sit in front of exactly this question, and you'll have every right to ask it. This note is how I answer it — because making invisible work perceivable is part of what I sell. 你为一次重构付了钱。机械臂走的还是原来的轨迹,界面看上去一模一样。工程师告诉你"架构更干净了、代码更安全了"。可从你坐的位置看,什么都没变——这钱是不是白花了?只要你是做设备的,早晚会坐到这个问题面前,而且你完全有权这么问。这篇笔记是我的回答方式——因为"让不可见的工作变得可感知",本身就是我卖的东西的一部分。

Good deep work is invisible on a good day好的深层工作,在顺利的日子里就是看不见的

A refactor doesn't add motions or buttons. Its output is the absence of disasters: the crash that doesn't happen when a sensor drops out, the ruined workpiece that never gets made, the hour of downtime that never starts. You didn't buy new behavior on the happy path — you bought behavior under failure. And failure, by definition, is never on the demo script. 重构不会新增动作,也不会多出按钮。它的产出是"没有发生的事故":传感器掉线时没有发生的撞机,永远不会被做废的那个工件,永远不会开始的那一小时停机。你买的不是顺利路径上的新行为——你买的是故障之下的行为。而故障,从定义上就不会出现在演示脚本里。

Don't read the code. Break the machine.别读代码,去弄坏机器

So when I deliver deep work, I don't ask you to review code. I hand you a checklist for breaking the machine, and you run it with your own hands: 所以当我交付深层工作时,我不会请你审查代码。我会递给你一份"弄坏机器"的清单,由你亲手去跑:

• Pull a sensor mid-run — or block it. The machine must come to a clean, immediate safe-stop, with an error message that says exactly what happened. Not freeze, not guess, not keep moving.运行中拔掉一个传感器——或者遮住它。机器必须立刻、干净地安停,并给出一条说清到底发生了什么的报错。不是卡死,不是瞎猜,更不是继续动。
• Feed it an out-of-range workpiece. The system must refuse to start the motion at all — a machine should never move while blind to what it's holding.喂给它一个超出范围的工件。系统必须直接拒绝启动运动——一台机器,绝不该在看不清自己抓着什么的时候动起来。
• Make it wait on something that never arrives. It must time out in seconds and report, instead of hanging forever.让它等一个永远不会到来的信号。它必须在几秒内超时并上报,而不是永远挂在那里死等。

When the machine survives everything you can throw at it and fails safe every single time, you have seen the refactor. That's what the money bought: not prettier code — a machine that has lost the capability to hurt itself, the workpiece, or the person standing next to it. 当你能想到的招都用尽,而机器每一次都安全地停下来,你就已经"看见"这次重构了。这就是钱买到的东西:不是更好看的代码——而是一台失去了"伤害自己、伤害工件、伤害旁边那个人"之能力的机器。

Your own engineer's easy tweaks are evidence, not a refutation你自己的工程师改得动,是证据,不是反驳

"Our field engineer adjusted tool parameters and renamed points himself — so what exactly did the refactor buy?" The opposite of what that question implies. Field configuration going in easily, without touching the core, is precisely what a decoupled foundation looks like. Before, a tweak like that meant editing tangled logic and hoping; now it lands in a slot the architecture left open on purpose. The foundation and the day-to-day adjustments aren't rivals — one is the building, the other is the furniture. "我们现场工程师自己就把工具参数改了、点位也重命名了——那这次重构到底买了什么?"答案和这个问题暗示的恰恰相反。现场配置能轻松塞进去、又碰不到核心,这正是"地基解耦到位"该有的样子。以前,这样一个微调意味着在纠缠的逻辑里动刀,然后祈祷;现在,它落进的是架构刻意留出的一个参数槽。地基和日常调整不是竞争关系——一个是房子,一个是家具。

One rule keeps this honest: every field tweak flows back and gets merged into a single clean mainline. No forked copies drifting on the shop floor, no black box only one person understands. 有一条规矩让这一切保持诚实:所有现场改动都要回流,统一合并进唯一一条干净的主线。车间里不留渐行渐远的分叉副本,也不留只有一个人看得懂的黑盒。

What this converts to这换来什么

Three things, all of them commercial. You can demo destructively in front of your own buyers — block a sensor while they watch, feed a wrong part, let the machine prove it can't be fooled; that kind of confidence sells better than any brochure. After-sales gets quieter, because the mistakes operators actually make get intercepted at the source instead of turning into warranty fights. And the next product variant becomes configuration on top of the same foundation, not a rebuild. 三样东西,全是商业上的。你敢当着你自己的买家做破坏性演示——当着他们的面遮住传感器、放一个错的工件,让机器证明它骗不了;这种底气,比任何宣传册都好卖。售后会变安静,因为操作工真正会犯的那些错,在源头就被拦下了,不会演变成质保扯皮。而下一个产品型号,变成了在同一个地基上加配置,而不是推倒重来。

The sign-off checklist签字前的验货清单

If you're about to sign off a refactor you can't see, ask for these four things and watch them happen: 如果你正要为一次"看不见"的重构签字验收,把下面四件事要过来,亲眼看它们发生:

• Break-and-stop — cut a sensor signal; the system safe-stops with a clear error.破坏即安停——切断一路传感器信号;系统安停,报错清晰。
• Boundary rejection — enter out-of-range part parameters; the system refuses to start.越界即拒绝——输入超范围的工件参数;系统拒绝启动。
• One mainline — every field tweak has been merged back into a single standard version; no forks.唯一主线——所有现场改动都已合并回唯一的标准版本;没有分叉。
• Room to grow — the configuration pages have space for the next size, the next tool, the next variant.留有余地——配置页面为下一种尺寸、下一把工具、下一个型号留好了位置。

Acceptance by destruction is my standard way of delivering work you can't see — written from real industrial practice, not theory. Everything here is generalized: no specific client, machine or process is described, and no numbers appear that I didn't measure. "破坏性验收"是我交付不可见工作的标准方式——写自真实的工业实践,不是理论。此处一切都已一般化:不描述任何具体的客户、机器或工艺,文中也没有任何我未实测过的数字。

Companion notes: the design method behind those safe-stops — Industrial reliability: change the denominator; why the same gates make heavy AI use safe — I use AI heavily. The machine still can't hurt you.; and the same trust logic at project scale — One email per milestone. 姊妹笔记:这些安停背后的设计方法——工业可靠性:换掉分母;同一套闸门为什么让重度用 AI 也安全——我大量用 AI,机器依然伤不了人;以及同一套信任逻辑在项目尺度上的样子——每个里程碑,一封邮件。

← All notes← 全部笔记