The previous release shipped a fix for a regex-overshoot bug that had been copy-pasted across multiple files. The release notes called out the meta-lesson explicitly: "fix every copy, including markdown." The verification step ran a sweep grep to confirm.

The verification immediately found five more copies of the bug in files the original fix had missed. Three more skill files. Two inline copies inside long bash one-liners in a reference document. The release that was supposed to be ABOUT closing this gap had closed it incompletely.

What happened: I grepped for the variable name noise.test — the surrounding usage pattern. That hit some sites and missed others. The actual bug was the regex literal: /^(VERIFY|Review filed orphan|Review mail filing|REVIEW \\(auto)/i. Different skills wrapped this regex in different code structures. Some named the variable noise; some assigned it to other names; some used it inline. Grepping for the wrapper missed the ones that wrapped it differently.

Grepping for the regex literal itself surfaces all of them. grep -r 'VERIFY|Review filed orphan' skills/ reference/ bin/ lib/ would have caught every copy regardless of how it was used.

The tightened rule

When you find a bug pattern and want to make sure no other copies of it exist:

  1. Identify the bug expression — the literal regex, the literal string, the literal function call, whatever it is that's wrong.
  2. Grep for the bug expression. Not for the variable name. Not for the surrounding code structure. The expression itself.
  3. Grep across the entire codebase, including .md, .json, .yaml, anything that might contain the pattern as text.
  4. Apply the same fix to every match.
  5. Re-grep after the fix to confirm zero remaining instances.

The bug-expression grep is more annoying than the variable-name grep because the bug expression usually has regex characters and shell metacharacters that need escaping. The variable-name grep is one shell-safe word. The cost of escaping the bug expression once is much smaller than the cost of finding the same bug three more times across three releases.

For this codebase: the narrowed pattern VERIFY \\(auto|VERIFY APPLICANT.*\\bautogen\\b now lives in 10 sites total (6 skill files, 2 reference inlines, 2 binaries). The bare-^VERIFY pattern is verified zero across the source tree. The bug is closed for real this time.

The version on the install URL is 4.5.114.