This summer I had the school holidays. One of those days I stood behind my children in a seaside arcade while they fed 2p coins into a coin pusher. I was the adult watching. What I was watching, it turns out, was a word: the one I had been using all year about a code editor, doing the opposite job.
The coin pusher dates to the 1960s, sold as Penny Falls by Alfred Crompton Ltd. A motor drives a shelf backwards and forwards beneath a fixed barricade. Coins land on the shelf, the shelf shunts the pile towards an overhanging edge, and gravity is invited to finish the job. The pile sits at the edge. Not now and then. Always. The geometry is the product.
In Great Britain that is a Category D gaming machine, the one class with no minimum age, so children may lawfully play it. The Gambling Act 2005 defines a gaming machine as one designed for individuals to gamble. Thirty per cent of the eleven to seventeen year olds the Gambling Commission surveyed in 2024 had played a penny pusher or a claw grab. It is the gambling machine British children actually play. Not an oversight. Somebody chose it.
The want the machine feeds is not the want to win money. It is the want to see a thing completed. The children were playing. I was the one recognising something.
The words are near miss. In the arcade they name the thing that keeps the coins going in. In aviation they name the thing that keeps the aeroplane in the air.
Before anyone reaches for the obvious: yes, AI coding tools are slot machines, variable-reward loops where the payoff arrives on a schedule you cannot predict. Cory Doctorow wrote that up in August 2025, a good many have since, and I made it myself in May 2026 while admitting I use these tools and like them. I am not building it again. What I did not do in May was name the mechanism, and forbit.dev named it on 3 July 2026, off the same papers I am about to cite. Their answer is better personal process: verify in phases, commit in small pieces, put a type-check between you and the next prompt. Good advice. All of it happens inside one person's head, and nothing survives the afternoon.
The word's other job
On 15 April 1976, NASA opened a letterbox. The Aviation Safety Reporting System invites anybody in the system to write down the accident that did not happen. Over 2.3 million so far, and more than 120,000 a year. Your name is taken at intake so an analyst can ring you back, then struck off before the report joins the pool anybody studies. It sits at NASA, not at the Federal Aviation Administration, which can take your licence. File an accidental violation that caused no accident and you get immunity, once in five years.
Six years later Britain built its own, CHIRP, for aviation. The railways got CIRAS in 1996, which became the industry standard after Ladbroke Grove through pressure rather than statute. Medicine's National Reporting and Learning System took over twenty million reports before it closed on 30 June 2024 and handed over to a successor.
In 2000, Paul Barach and Stephen D. Small went through the systems that worked and wrote down what they shared: immunity, confidentiality, independence from the employer, rapid feedback, ease of filing, leadership that keeps backing it. Six features. Twenty-six years ago. In the BMJ.
Aviation did not get a better class of near miss. The event on the flight deck and the event on the shelf are the same event: the bad outcome that did not occur. Aviation built an afterwards.
The arcade built a ledge.
The afterwards, and who does it
Left alone, that event can teach the wrong thing. Catherine H. Tinsley and Robin L. Dillon published the result in Management Science in 2008: people given near-miss information went on to take more risk than people given none. What they had been told about ended fine, so they read it as a success and discounted the probability inside it.
That knife cuts towards me too. The paper does not say unrecorded near-misses make people bold; what it varied was the presence of the information, not its absence. The harder version is mine. Transmission is not interpretation, and a stream of accounts of things that turned out fine is a machine for raising an industry's tolerance. It is what aviation would have built had it stopped at the form.
Peter M. Sandman put the condition in one line in 2015: a near-miss must be reported and actively interpreted to be worth anything. Reporting is the precondition. Reading is the mechanism.
If you have ever taken a suggestion, run it, watched it fail in a way you half expected, and prompted again without writing anything down, you produced a near-miss in the aviation sense and disposed of it in the arcade sense.
Sixty-six per cent of respondents to the Stack Overflow 2025 Developer Survey named "AI solutions that are almost right, but not quite" as their biggest frustration. Second, on 45.2 per cent: debugging the AI's code takes longer than writing it. The industry described the near-miss in its own words, in its own survey, and filed it under annoyance.
An almost-right answer is not a defect a better model removes. It is what the tool is. The older kind of programming tool gives the same answer to the same question every time; this kind does not, and making it better never deletes the tail of plausible-and-wrong. I argued the anti-gatekeeping side of that in June and walk none of it back. This is an argument about a reward schedule, not about the people running it.
I have argued that the buddy check cannot be automated or delegated to a bot, and that a gate which never closes is a hole in the wall. I had the product wrong. The product of the second pair of eyes was never the save. It was the trace the save left behind. Take the person out and you do not merely lose a catch. The event stops happening to anybody, so it never becomes data. Agarwal, Miller, Kästner and Vasilescu read 3,100 sampled pieces of practitioner writing in July and named review, where a person reads a change before it ships, as the control point. Their remedy is better reviewers. Mine is a record, because a better reviewer leaves nothing behind.
Now the objection that ought to finish this off. Software catches more defects than human review ever did. Static analysis reads code without running it. Continuous integration builds and tests every change as it lands. Fuzzing throws malformed input at a program to see what breaks, and one study of Google's fuzzing service followed 1.12 million of those campaigns across 878 projects, while an earlier one counted 23,907 bugs in 316 of them. Anybody telling you defects go undetected is wrong.
Three things that record does not do. It stores the artefact and not the event: the fuzzer keeps the crash and nothing about the minute in which a person nearly shipped it. The assistant keeps its own record, and that record belongs to a vendor rather than a profession: it counts what you accepted and keeps no reason for what you dismissed, reverted or quietly rewrote. And nobody reads any of it as a safety signal, which by Tinsley and Dillon is the step that decides the sign.
The defect is in the log. The understanding is not.
Bolt a gauge to a wall, wire it to nothing, and it will read zero honestly for as long as you leave it there. An empty log and a safe system give the same reading. One of them is a fact and the other is a cupboard nobody has opened, and after a year of walking past it every morning you will have quietly stopped being able to tell which one you are looking at. Zero near-misses this quarter is not a safety record.
About the arcade. The argument does not run on it. The literature separates the two cases, and Mark D. Griffiths drew the line: in a game of skill a near-miss is a valid signal, in a game of chance a counterfeit one, and nobody has shown transfer between them. Pisklak, Yong and Spetch reviewed sixty-six years of work in 2019 and could not find the behavioural effect; their own experiments in humans and pigeons returned nulls. Clark and colleagues showed in 2009 that near-misses recruit reward circuitry comparably to wins, which is neurobiology, not behaviour.
Give it all away and the argument gets worse, not better. A gambler's almost is a lie, and a lie can be argued with: the machine owes you nothing, and somebody can say so. Your almost is not a lie. You are genuinely steering, the next attempt can be better, and the pull is reported strongest exactly where the player believes the outcome is theirs to influence. There is nothing to talk you out of. That is not a reason to feel safe.
It is a reason to distrust your own calibration. An IEEE-ISTAS study ran ten rounds of asking a model to improve its own code, four times over with four different prompts, and watched 387 distinct vulnerabilities emerge across the forty, critical ones up 37.6 per cent by round five, including when the model was told to improve security. Round five is measurably worse than round one. It does not feel worse.
Training works. Marquardt and colleagues found that safety training lifts explicit safety attitudes. Implicit attitudes, not at all. And none of the interventions they reviewed was still working after a delay measured in hours and days, with follow-up effects close to zero. Awareness is not useless. Awareness is perishable, and it perishes faster than anybody selling training will tell you.
What awareness buys you, and for how long
You are ahead of me. You are thinking that you know about this now, and that knowing is most of the job.
In April I wrote that awareness of a bias does not debias you, that it lays a coat of false security on top, then asked what does debias and walked away from the question. I will answer it here for this one bias, and only this one.
There is a clue inside Tinsley and Dillon's own work, and it looks at first like a defeat for me. They report that the bias disappears when probability information is made salient and decision-makers attend to it as the basis for the decision. Nobody in that experiment was taught about near-miss psychology. Somebody put the number in front of them at the moment they chose.
That is not a lesson. That is furniture.
And the number is already in the building. Sixty-six per cent is not a product review. It is a base rate, sitting in plain sight in the industry's own survey, and I have never once seen anybody use it as one. A base rate is the background odds any single event should be read against. It tells us how many people meet this, not how often. Nobody has published that, and not the vendors either: a dismissal is machine-visible, almost-right is a judgement. An industry that quotes its slowest response times to three decimal places has no number for the thing its people do all day.
So: build the afterwards. Not a form for every almost. The letterbox was never a census. Those 120,000 reports a year are a sample, and a pilot generally files when something crossed a personal threshold of alarm. The value is in the reading, not the completeness. Somebody has to decide whose threshold counts, publish it, and defend it.
Tinsley, Dillon, Madsen and Rogers found in 2016 that safety climate raises the attention people pay to the process behind an outcome that looked fine, and that climate and stakes each raise near-miss reporting rates. The same authors are candid that the warnings still get ignored, because they still look like successes. The instrument reduces the bias. It does not abolish it.
The hard part was never the software. Barach and Small wrote the specification, and the difficulty is the third item. Independence from the employer. ASRS sits at NASA because it cannot sit at the regulator: the body that can ground you cannot read your confession. A developer has no licence to lose, which sounds like an easier problem and is a harder one. The pilot's immunity buys back something specific. Ours would have to buy back the performance review, and the person who writes that sits closer than any regulator ever has.
Aviation has already solved that, and it did not solve it with a letterbox. Its Safety Action Program seats the airline, the pilots' union and the regulator on one committee, and all three have to agree before anything a pilot reported about themselves can be used to discipline them. Rail runs its own version for close calls. The protection is not a promise. It is a person in the room with the standing to block a manager, which in both industries has meant a union. And even then the immunity has a boundary: honest error is covered, recklessness is not, and somebody has to sit down and rule on which side a given report falls. That judgement is the most trust-destroying job in the whole apparatus, and it never stops needing to be made.
Software has vendors, employers and a conference circuit, each either the employer or selling to one, and in most of the rooms where this would have to be agreed, nobody at the table works for the person filing. Nobody is suppressing this record. It is simply that the two parties who could fund it are the two the record would be about, and an absence that convenient does not need a conspiracy to keep going. A vendor whose acceptance rate is its headline metric has no reason to publish the denominator. As far as I can find, and I have looked, no confidential, non-punitive, employer-independent channel for the almost-went-wrong exists anywhere in this profession. The AI Incident Database logs harms, not practice. Ebert and colleagues went looking in cybersecurity a year ago and reported the same absence, then proposed building one on the letterbox model. Nobody has.
The collecting half is cheap. It is a rota, a letterbox and somebody paid to read what arrives. Notice how little of that we would have to build, and then notice that we have not. The protecting half is not cheap at all, and pretending otherwise is how you get a reporting system nobody files into.
So ask a different question at your next review. Not how many defects did we catch. How many times did somebody nearly not, and where is that written down?
Three more you can answer at your desk. How many almost-right generations did you take yesterday? Which of them would you have written down, if writing it down were free and untraceable? And who, precisely, would you have written it down for?
You cannot answer the third one. Neither can I, and that is duller than the finding I wanted.
The ledge is not the villain. The ledge is honest: it has done what it was built to do for sixty years, in daylight, for tuppence a go, in a category the law lets a child play. What NASA added in 1976 was a letterbox, a promise to strike the name off after reading, and somebody paid to read what came in. We have the events. Nobody has been given the job of reading them, and nobody has been asked to take it.
(Views in this article are my own.)