The Model Fixed Its Own Mistake Before You Saw It. Now Prove It Was Right.

Figma shipped a feature this month that removes a checkpoint most teams did not know they relied on. In the July 2026 announcement for GPT-5.6 in Figma Make, Gui Seiz, the company’s Design Director of AI, writes that the model can “automatically investigate and fix errors during prototype generation without user intervention.” The example is specific: “GPT-5.6 identified the source of a blank build and fixed it on its own.” A build broke. The model diagnosed it. The model repaired it. You saw none of that. You saw a working prototype.

That is a real capability, and it is useful. It is also the moment the audit trail goes dark.

The checkpoint that just disappeared

Before this, an error during generation was a visible event. The build came back blank, or broken, or wrong, and a human noticed. That noticing was a checkpoint, even when nobody called it one. The person who saw the failure got to ask the next question: did the tool misunderstand what I asked, or did it hit a transient bug? The blank build was information. It told you something about whether the model had actually understood your intent or had merely produced output shaped like intent.

Self-healing removes the blank build from your field of view. The failure still happens. The diagnosis still happens. The repair still happens. All of it happens below the surface, and what surfaces is a clean result. You lose the chance to judge the repair because you never learn a repair occurred.

Here is what that costs. When the model fixes a genuine transient glitch, healing it silently is exactly right and you want no interruption. When the model papers over a symptom it did not understand, healing it silently hands you a prototype that looks correct and rests on a repair nobody evaluated. From the outside, those two cases are identical. Both produce a working build with no visible history. You cannot tell the good heal from the lucky patch, because the mechanism that produced both erased the evidence you would need to tell them apart.

What self-correction actually is

The mechanism is not mysterious, and naming it precisely matters for governing it. Arthur AI, a guardrails vendor, described the shape of it in June 2026: a self-correction loop detects a problem with a post-output verifier, revises the output in place with a correction request, then retries and re-checks until the result passes or a retry limit stops it. Generate, check, fix, check again. Close the loop when it passes.

The academic root goes back further. Self-Refine, published by Madaan and colleagues at NeurIPS 2023 and cited roughly four thousand nine hundred times, established that a model can alternate between giving itself feedback and refining its own output, looping until quality clears a bar. Stronger variants pair the generator with a separate step-level verifier that checks the work rather than trusting the generator to grade itself. The technique is well studied and it works. That is precisely why it is now shipping inside a mainstream design tool with no ceremony.

None of this is the problem. Self-correction is a legitimate and powerful mechanism. The problem is what the loop emits when it runs in production. By default, it emits the final result and nothing else. The trigger that fired, the retries it took, whether it passed cleanly or hit the retry limit and gave up: all of that stays inside the loop. The design ships clean. The reasoning that made it clean is unrecoverable.

The audit trail is the governance layer

We have written before that governing AI output means owning its review, and that someone must be named as the reviewer of what agents write. Self-healing generation raises the stakes on both. You cannot review what you cannot see. When the loop absorbs the failure and the fix, there is nothing left to assign a reviewer to. The record that review depends on was never written.

Consider what a designer loses across a week of this. Ten prototypes generate. Three of them silently self-healed during the build. The designer ships all ten, unaware that three carried a repaired defect. One of those repairs was a genuine fix. Two were patches over a misread intent that will resurface downstream, in a handoff to engineering or in a component that behaves wrong under a condition nobody tested. There is no log to consult, no diff to inspect, no retry count to flag the two risky builds out of the three. The information that would have separated them was generated and discarded inside the same second.

Notice that Arthur’s own guidance already names the fix. Cap the retries, they advise, and emit every trigger and every retry as telemetry. That is the exact governance layer production self-healing tends to omit. A vendor that sells guardrails is telling you the loop needs an audit surface, in the same month a vendor that sells design tools shipped the loop without announcing one. Figma’s post describes the healing as a benefit. It does not claim a log, a diff, or a retry count. Read the announcement for what it promises and what it stays silent on. The silence is the governance layer.

What a governed self-correcting generator looks like

The fix is not to turn self-healing off. Silent recovery from transient glitches is genuinely good, and a designer interrupted by every retry would be worse off. The fix is to make the loop leave a trace. Three properties turn an opaque self-healer into a governed one.

Emitted telemetry. Every time the loop triggers, it records what triggered it, how many retries it took, and whether it passed or exhausted the limit. This does not interrupt the designer. It writes a line the designer, or a reviewer, or a later audit can read. A self-heal that emits nothing is a decision made by your tooling that no one can revisit.

Capped retries with a visible ceiling. A loop that retries without a hard limit can burn cost and, worse, can converge on an output that passes the verifier without satisfying the intent. Cap it, and surface when the cap is hit. A build that healed on the seventh try is a build that deserves a second look, and you only know it took seven if the count is emitted.

Retained before-and-after diffs. The original defective output and the repaired output should both be recoverable. The diff between them is the single most useful artifact for judging a heal. It shows whether the model corrected a real error or reshaped a symptom. Discard the pre-heal state and you have thrown away the one thing that lets a human evaluate the fix.

A generator with these three properties still heals silently in the common case. The difference is that the silence is now recoverable. When a shipped design turns out wrong, someone can pull the trail and see that the build self-healed twice, that the diff shows a symptom reshaped rather than a cause fixed, and that the retry count was pinned at the ceiling. That is the difference between a clean output and an explainable one.

Do this now

For any self-correcting generator your team ships or adopts, require three things before it touches production work. First, telemetry on every heal: trigger, retry count, pass or fail, emitted to a log a human can read. Second, a hard cap on retries with a visible signal when the cap is hit. Third, retained before-and-after diffs so the pre-heal state is recoverable for review.

If a tool self-heals and cannot show you any of the three, treat its clean output as unverified. The build looks correct. Whether it is correct, and whether the model understood you or patched around you, is a question the tool has answered and then hidden. Governance is getting the answer back on the record.

---

This analysis synthesizes GPT-5.6 is now available in Figma Make (Figma, July 2026), Self-Correction Loops for AI Agents, Explained (Arthur AI, June 2026), Self-Refine (Madaan et al., NeurIPS 2023).

Victorino Group helps teams keep an audit trail on self-correcting AI, so a clean output is also an explainable one. Let’s talk.