You can't see a refactor. So try to break the machine. 重构看不见?那就试着弄坏机器
6 Aug 20262026年8月6日
You paid for a refactor. The arm runs the same path. The screens look the same. Your engineer says the architecture is cleaner and the code is safer. From where you sit, nothing changed — did you just buy nothing? If you build machines for a living, sooner or later you will sit in front of exactly this question, and you'll have every right to ask it. This note is how I answer it — because making invisible work perceivable is part of what I sell. 你为一次重构付了钱。机械臂走的还是原来的轨迹,界面看上去一模一样。工程师告诉你"架构更干净了、代码更安全了"。可从你坐的位置看,什么都没变——这钱是不是白花了?只要你是做设备的,早晚会坐到这个问题面前,而且你完全有权这么问。这篇笔记是我的回答方式——因为"让不可见的工作变得可感知",本身就是我卖的东西的一部分。
Good deep work is invisible on a good day好的深层工作,在顺利的日子里就是看不见的
A refactor doesn't add motions or buttons. Its output is the absence of disasters: the crash that doesn't happen when a sensor drops out, the ruined workpiece that never gets made, the hour of downtime that never starts. You didn't buy new behavior on the happy path — you bought behavior under failure. And failure, by definition, is never on the demo script. 重构不会新增动作,也不会多出按钮。它的产出是"没有发生的事故":传感器掉线时没有发生的撞机,永远不会被做废的那个工件,永远不会开始的那一小时停机。你买的不是顺利路径上的新行为——你买的是故障之下的行为。而故障,从定义上就不会出现在演示脚本里。
Don't read the code. Break the machine.别读代码,去弄坏机器
So when I deliver deep work, I don't ask you to review code. I hand you a checklist for breaking the machine, and you run it with your own hands: 所以当我交付深层工作时,我不会请你审查代码。我会递给你一份"弄坏机器"的清单,由你亲手去跑:
- Pull a sensor mid-run — or block it. The machine must come to a clean, immediate safe-stop, with an error message that says exactly what happened. Not freeze, not guess, not keep moving.运行中拔掉一个传感器——或者遮住它。机器必须立刻、干净地安停,并给出一条说清到底发生了什么的报错。不是卡死,不是瞎猜,更不是继续动。
- Feed it an out-of-range workpiece. The system must refuse to start the motion at all — a machine should never move while blind to what it's holding.喂给它一个超出范围的工件。系统必须直接拒绝启动运动——一台机器,绝不该在看不清自己抓着什么的时候动起来。
- Make it wait on something that never arrives. It must time out in seconds and report, instead of hanging forever.让它等一个永远不会到来的信号。它必须在几秒内超时并上报,而不是永远挂在那里死等。
When the machine survives everything you can throw at it and fails safe every single time, you have seen the refactor. That's what the money bought: not prettier code — a machine that has lost the capability to hurt itself, the workpiece, or the person standing next to it. 当你能想到的招都用尽,而机器每一次都安全地停下来,你就已经"看见"这次重构了。这就是钱买到的东西:不是更好看的代码——而是一台失去了"伤害自己、伤害工件、伤害旁边那个人"之能力的机器。
Your own engineer's easy tweaks are evidence, not a refutation你自己的工程师改得动,是证据,不是反驳
"Our field engineer adjusted tool parameters and renamed points himself — so what exactly did the refactor buy?" The opposite of what that question implies. Field configuration going in easily, without touching the core, is precisely what a decoupled foundation looks like. Before, a tweak like that meant editing tangled logic and hoping; now it lands in a slot the architecture left open on purpose. The foundation and the day-to-day adjustments aren't rivals — one is the building, the other is the furniture. "我们现场工程师自己就把工具参数改了、点位也重命名了——那这次重构到底买了什么?"答案和这个问题暗示的恰恰相反。现场配置能轻松塞进去、又碰不到核心,这正是"地基解耦到位"该有的样子。以前,这样一个微调意味着在纠缠的逻辑里动刀,然后祈祷;现在,它落进的是架构刻意留出的一个参数槽。地基和日常调整不是竞争关系——一个是房子,一个是家具。
One rule keeps this honest: every field tweak flows back and gets merged into a single clean mainline. No forked copies drifting on the shop floor, no black box only one person understands. 有一条规矩让这一切保持诚实:所有现场改动都要回流,统一合并进唯一一条干净的主线。车间里不留渐行渐远的分叉副本,也不留只有一个人看得懂的黑盒。
What this converts to这换来什么
Three things, all of them commercial. You can demo destructively in front of your own buyers — block a sensor while they watch, feed a wrong part, let the machine prove it can't be fooled; that kind of confidence sells better than any brochure. After-sales gets quieter, because the mistakes operators actually make get intercepted at the source instead of turning into warranty fights. And the next product variant becomes configuration on top of the same foundation, not a rebuild. 三样东西,全是商业上的。你敢当着你自己的买家做破坏性演示——当着他们的面遮住传感器、放一个错的工件,让机器证明它骗不了;这种底气,比任何宣传册都好卖。售后会变安静,因为操作工真正会犯的那些错,在源头就被拦下了,不会演变成质保扯皮。而下一个产品型号,变成了在同一个地基上加配置,而不是推倒重来。
The sign-off checklist签字前的验货清单
If you're about to sign off a refactor you can't see, ask for these four things and watch them happen: 如果你正要为一次"看不见"的重构签字验收,把下面四件事要过来,亲眼看它们发生:
- Break-and-stop — cut a sensor signal; the system safe-stops with a clear error.破坏即安停——切断一路传感器信号;系统安停,报错清晰。
- Boundary rejection — enter out-of-range part parameters; the system refuses to start.越界即拒绝——输入超范围的工件参数;系统拒绝启动。
- One mainline — every field tweak has been merged back into a single standard version; no forks.唯一主线——所有现场改动都已合并回唯一的标准版本;没有分叉。
- Room to grow — the configuration pages have space for the next size, the next tool, the next variant.留有余地——配置页面为下一种尺寸、下一把工具、下一个型号留好了位置。
You don't have to take this on faith — the checklist is runnable. I put the method in a public repo: a machine you command over MQTT, a gate layer that classifies every command by what it could do wrong, and an acceptance harness that runs the break-it attempts above. About a second, nothing to install. Eight attempts, eight refusals — and the same harness runs in CI on every push, so the safety property can't quietly rot. There's a browser HMI too, if you'd rather pull the sensor mid-move yourself and watch it stop. Code → 这些你不必只听我说——那份清单是可运行的。我把方法做成了公开仓库:一台用 MQTT 指挥的机器、一个把每条指令按"可能出什么错"分类的闸门层,以及一个跑完上述破坏尝试的验收 harness。约一秒,无需安装任何东西。八次尝试、八次拒绝——同一个 harness 每次推送都在 CI 里跑,所以这条安全性质不会悄悄烂掉。还有浏览器 HMI,如果你更想自己在运动中拔掉传感器、看它停下来。 代码 →
Acceptance by destruction is my standard way of delivering work you can't see — written from real industrial practice, not theory. Everything here is generalized: no specific client, machine or process is described, and no numbers appear that I didn't measure. "破坏性验收"是我交付不可见工作的标准方式——写自真实的工业实践,不是理论。此处一切都已一般化:不描述任何具体的客户、机器或工艺,文中也没有任何我未实测过的数字。
Companion notes: the design method behind those safe-stops — Industrial reliability: change the denominator; why the same gates make heavy AI use safe — I use AI heavily. The machine still can't hurt you.; and the same trust logic at project scale — One email per milestone. 姊妹笔记:这些安停背后的设计方法——工业可靠性:换掉分母;同一套闸门为什么让重度用 AI 也安全——我大量用 AI,机器依然伤不了人;以及同一套信任逻辑在项目尺度上的样子——每个里程碑,一封邮件。
If a machine you build needs an interface, a device connection, or data that has to land somewhere else — tell me what it's costing you now. You'll get an honest read on whether it's solvable, and usually something running to look at. Start here →如果你造的机器需要一套界面、一个设备连接,或者数据必须落到别处去——告诉我它现在正让你付出什么代价。你会得到一个诚实的判断:能不能解;通常还会收到一个能跑的东西。从这里开始 →