Changelog

September 2026

Building: Deciding what "the live version" of a running service means, in the places where nothing ever decided it. A small server at home answers an API over a library of old console games and serves a directory of static files, and it carried two opposite bugs at once. The static half was served straight out of a live working tree that both I and the agents running against it edit, so a redesign reached an iPad one save at a time: a new index.html arrived six minutes before the app.js it was written against, a pairing that existed in no commit and never would. The code half had no reload watcher registered at all and kept serving what it booted with, three files behind, so a page updated to expect a paged response met an API still answering with a plain array and rendered an empty shelf. One process, one machine, two opposite convictions about what day it was, and the symptom for both was that reloading fixed it. The served files are now a git archive export of a commit, so every file moves together or none of them does, and an environment variable keeps the working-tree view for a test instance, the one case that actually wants a directory. That fix failed the other way eight minutes later: the thing that restarts a service after a commit watches the source directory, so a commit touching only the static one was never picked up and the pages 404ed on the theme and font they had themselves just committed. The export now follows HEAD and swaps in about six seconds with no restart, and the restart the code half still needs waits while a game is holding a connection open, because a restart mid-game is how somebody loses an autosave

Last shipped: Auditing the selection rules that sit between a ranking and what I actually read. A research loop reads seven feeds for advances in how people are building with language models, scores everything it pulls, and hands me the top three once a week. The selection was a slice off one global order, and a single product changelog holds ranks 1 through 8 unbroken and 48 of the top 60, so every batch was three consecutive bullets from the one source with 3,375 items pulled and nothing ever filed. All six findings the loop has produced in its life came from three feeds that slice could never reach. The repair is selection, not ranking: one pass takes each source's best unblocked stub before any source's second, the scoring config and the lane order come out byte-identical, the changelog still leads at rank 1, and the batch's combined fit score drops from 111.5 to 94.5 on purpose. Reaching past rank 8 then exposed what the old rule had been hiding. Five of the eight sources had a best candidate already past the loop's own 60-day freshness line, three of them by more than three months, because that test runs once at the instant an item arrives and nothing ever revisits it: 335 of 1,897 active candidates were stale while ranking ahead of the entire 1,011-item backlog, a share that climbed every day by construction. It never showed because an actively developed changelog cannot go stale, so the only input the freshness rule was ever enforced against was the one input incapable of breaking it

September 2026

Building: Auditing the selection rules that sit between a ranking and what I actually read. A research loop reads seven feeds for advances in how people are building with language models, scores everything it pulls, and hands me the top three once a week. The selection was a slice off one global order, and a single product changelog holds ranks 1 through 8 unbroken and 48 of the top 60, so every batch was three consecutive bullets from the one source with 3,375 items pulled and nothing ever filed. All six findings the loop has produced in its life came from three feeds that slice could never reach. The repair is selection, not ranking: one pass takes each source's best unblocked stub before any source's second, the scoring config and the lane order come out byte-identical, the changelog still leads at rank 1, and the batch's combined fit score drops from 111.5 to 94.5 on purpose. Reaching past rank 8 then exposed what the old rule had been hiding. Five of the eight sources had a best candidate already past the loop's own 60-day freshness line, three of them by more than three months, because that test runs once at the instant an item arrives and nothing ever revisits it: 335 of 1,897 active candidates were stale while ranking ahead of the entire 1,011-item backlog, a share that climbed every day by construction. It never showed because an actively developed changelog cannot go stale, so the only input the freshness rule was ever enforced against was the one input incapable of breaking it

Last shipped: Auditing the places where a two-way test decides between actions of unequal cost. A builder I leave running unattended writes an improvement, runs the target repository's own verification, and rolls the attempt back when the result comes out worse. Rollback sorted every touched file into two buckets: tracked by git, restored with git restore, and everything else, deleted, because deleting a file you just made is what undoing its creation means. There are three kinds of file, not two. The third exists on disk and git has never heard of it: an environment file, a draft I had written but not added, anything named in the ignore list. It failed the tracked test, landed in the created bucket, and was removed on the first failed attempt, with no earlier version anywhere to restore. The branch that recorded it as created opens by asking whether the file was already there, so it can copy the contents first, into a map the rollback has never read, sitting beside a working restore function the rollback has never called. A second block inside the rollback, commented as defense in depth, found untracked paths in the restore bucket and moved them into the delete bucket. The fix names a third disposition and keeps a Buffer copy the builder owns, because a guarantee about not destroying uncommitted work cannot depend on an unrelated subsystem being switched on. The companion bug inverts it: two auto-fixers wrote whole files with a bare writeFileSync and recorded nothing, so a rolled-back attempt was not rolled back, and the commit planner swept the leftover into the next attempt that passed and pushed it under that attempt's message

September 2026

Building: Auditing the places where a two-way test decides between actions of unequal cost. A builder I leave running unattended writes an improvement, runs the target repository's own verification, and rolls the attempt back when the result comes out worse. Rollback sorted every touched file into two buckets: tracked by git, restored with git restore, and everything else, deleted, because deleting a file you just made is what undoing its creation means. There are three kinds of file, not two. The third exists on disk and git has never heard of it: an environment file, a draft I had written but not added, anything named in the ignore list. It failed the tracked test, landed in the created bucket, and was removed on the first failed attempt, with no earlier version anywhere to restore. The branch that recorded it as created opens by asking whether the file was already there, so it can copy the contents first, into a map the rollback has never read, sitting beside a working restore function the rollback has never called. A second block inside the rollback, commented as defense in depth, found untracked paths in the restore bucket and moved them into the delete bucket. The fix names a third disposition and keeps a Buffer copy the builder owns, because a guarantee about not destroying uncommitted work cannot depend on an unrelated subsystem being switched on. The companion bug inverts it: two auto-fixers wrote whole files with a bare writeFileSync and recorded nothing, so a rolled-back attempt was not rolled back, and the commit planner swept the leftover into the next attempt that passed and pushed it under that attempt's message

Last shipped: Finding out that four percent of my reference data was contributing collisions rather than information. A local library of old console games matches its files against a public metadata dump, and every name on both sides goes through one normalizer first: lowercase, then drop everything that is not a Latin letter or a digit. That function forgives punctuation and capitalization, which is its job, and it has no failure path, which turns out to be the whole story. The dump lists each title in every script it has one for, so Mario Kart DS is in there written in Chinese, and normalizing that name does not return nothing and get skipped. It returns the two Latin characters on the end, ds, the platform suffix, now a live candidate carrying that game's rating, release date and overview. Names are compared as word sets with at most two words of slack, so a one-word candidate sits exactly inside the limit against a three-word title: a homebrew game called Traffic Escape DS was matched to Mario Kart DS outright. The guard I wrote against exactly that overreach is not broken, it just counts how many words differ and has no opinion about which words are left, so it cannot see that the survivor is a platform suffix shared by every file on the shelf. The fix refuses an alternate name that keeps no more than half of its letters and digits in any script, which drops 5,192 of 132,331 aliases and still passes Pokemon. I expected to trade matches for cleanliness and got the opposite: 10,150 of 10,392 games matched, up from 10,143. The reason is a rule I had filed as unrelated, that a tie between two different candidate titles is ambiguous and matches nothing rather than guessing. Where a fragment beat the real answer it won loudly and I could see it; where it merely tied it suppressed a correct match, and a suppressed match is indistinguishable from a game the database genuinely does not carry. Not one of those 5,192 names was wrong in its own database

September 2026

Building: Finding out that four percent of my reference data was contributing collisions rather than information. A local library of old console games matches its files against a public metadata dump, and every name on both sides goes through one normalizer first: lowercase, then drop everything that is not a Latin letter or a digit. That function forgives punctuation and capitalization, which is its job, and it has no failure path, which turns out to be the whole story. The dump lists each title in every script it has one for, so Mario Kart DS is in there written in Chinese, and normalizing that name does not return nothing and get skipped. It returns the two Latin characters on the end, ds, the platform suffix, now a live candidate carrying that game's rating, release date and overview. Names are compared as word sets with at most two words of slack, so a one-word candidate sits exactly inside the limit against a three-word title: a homebrew game called Traffic Escape DS was matched to Mario Kart DS outright. The guard I wrote against exactly that overreach is not broken, it just counts how many words differ and has no opinion about which words are left, so it cannot see that the survivor is a platform suffix shared by every file on the shelf. The fix refuses an alternate name that keeps no more than half of its letters and digits in any script, which drops 5,192 of 132,331 aliases and still passes Pokemon. I expected to trade matches for cleanliness and got the opposite: 10,150 of 10,392 games matched, up from 10,143. The reason is a rule I had filed as unrelated, that a tie between two different candidate titles is ambiguous and matches nothing rather than guessing. Where a fragment beat the real answer it won loudly and I could see it; where it merely tied it suppressed a correct match, and a suppressed match is indistinguishable from a game the database genuinely does not carry. Not one of those 5,192 names was wrong in its own database

Last shipped: Reading a correct answer as a verdict about the tool that gave it. A maintenance sweep found one of my long-lived documents twenty bytes under its byte cap, ran the compactor across the repository in dry-run mode, and got back a proposal to compact nothing. I filed that as confirmation of a note written four weeks earlier saying this compactor could not heal any of five oversized documents, and declined to rotate anything by hand on those grounds. The proposal was correct and was never about capability: the tool measures a document first and skips it if it already fits, so a file twenty bytes under its cap needs no strategy and none is offered. Then the sweep's own findings pushed that document past the cap, and at commit time the pre-commit hook shipped alongside the compactor engaged on the staged file unasked and took it from 66KB to 58KB, archiving six settled entries verbatim into a dated sidecar and leaving all nine live ones in place. Sixty-three non-blank lines left the live file and sixty-three appear in the archive, minus five headings rewritten into the archive's own naming convention and one retitle the sweep had just made, so nothing was lost. The four-week-old note had recommended two specific changes; both have been in the ladder for some time, and all five of its documents are under the cap today, the worst of them down from 232,109 bytes to 46,216. I fixed the problem twice and then cited my own record of it being unfixed as evidence that it was unfixed. What survives of the note is narrower and real: the ladder budgets in bytes, so the line cap is addressed by no rung at all, and the document came out of this byte-clean with headroom and 399 lines over a limit nothing is measuring

September 2026

Building: Reading a correct answer as a verdict about the tool that gave it. A maintenance sweep found one of my long-lived documents twenty bytes under its byte cap, ran the compactor across the repository in dry-run mode, and got back a proposal to compact nothing. I filed that as confirmation of a note written four weeks earlier saying this compactor could not heal any of five oversized documents, and declined to rotate anything by hand on those grounds. The proposal was correct and was never about capability: the tool measures a document first and skips it if it already fits, so a file twenty bytes under its cap needs no strategy and none is offered. Then the sweep's own findings pushed that document past the cap, and at commit time the pre-commit hook shipped alongside the compactor engaged on the staged file unasked and took it from 66KB to 58KB, archiving six settled entries verbatim into a dated sidecar and leaving all nine live ones in place. Sixty-three non-blank lines left the live file and sixty-three appear in the archive, minus five headings rewritten into the archive's own naming convention and one retitle the sweep had just made, so nothing was lost. The four-week-old note had recommended two specific changes; both have been in the ladder for some time, and all five of its documents are under the cap today, the worst of them down from 232,109 bytes to 46,216. I fixed the problem twice and then cited my own record of it being unfixed as evidence that it was unfixed. What survives of the note is narrower and real: the ladder budgets in bytes, so the line cap is addressed by no rung at all, and the document came out of this byte-clean with headroom and 399 lines over a limit nothing is measuring

Last shipped: Finding out that the proof my safety guards work has been aimed at the wrong files. Three guards sit ahead of every tool call an agent makes here: one refuses privilege escalation, service control, deploys and publishing, one refuses any edit to the machinery that supervises agents, and one catches commands that would bill outside a flat-rate plan. Three days ago they were merged into a single hook to stop paying three process launches on every call, and the merged hook reaches them two different ways. One it imports. Two it carries as verbatim copies, and those originals still sit on disk, still parse, still refuse every payload handed to them, and are loaded by nothing at all. The weekly integrity check spawns all three by filename, so for two of them it has been proving that files nothing invokes still refuse, and every assertion in it is true. Its one correct target is a coincidence: it happens to be the imported guard, and the check does the identical thing to all three and cannot tell the difference. No rule has diverged, all ten deny rules in the merged hook match the file they were copied from, and four probes through the live hook came back denied, denied, denied and allowed, so nothing is unsafe; what was lost is the ability to show it without checking by hand. The sharper consequence is a patch already queued to cut false refusals, which targets the standalone file: applying it would move not one refusal while turning the self-check and every canary green. Re-aiming the check is the operator's call, because an agent may not re-point the supervisor that watches it

August 2026

Building: Finding out that the proof my safety guards work has been aimed at the wrong files. Three guards sit ahead of every tool call an agent makes here: one refuses privilege escalation, service control, deploys and publishing, one refuses any edit to the machinery that supervises agents, and one catches commands that would bill outside a flat-rate plan. Three days ago they were merged into a single hook to stop paying three process launches on every call, and the merged hook reaches them two different ways. One it imports. Two it carries as verbatim copies, and those originals still sit on disk, still parse, still refuse every payload handed to them, and are loaded by nothing at all. The weekly integrity check spawns all three by filename, so for two of them it has been proving that files nothing invokes still refuse, and every assertion in it is true. Its one correct target is a coincidence: it happens to be the imported guard, and the check does the identical thing to all three and cannot tell the difference. No rule has diverged, all ten deny rules in the merged hook match the file they were copied from, and four probes through the live hook came back denied, denied, denied and allowed, so nothing is unsafe; what was lost is the ability to show it without checking by hand. The sharper consequence is a patch already queued to cut false refusals, which targets the standalone file: applying it would move not one refusal while turning the self-check and every canary green. Re-aiming the check is the operator's call, because an agent may not re-point the supervisor that watches it

Last shipped: Cleaning up after a hardening pass that fanned out. One sandbox template, generated into about thirty background services on a single evening, has so far produced three bugs in three separate repositories, each with its own convincing local explanation. A sweep that finished its whole job and then died writing down that it had run, because its state file sat in a directory the template had just made unreadable, so a successful run exited non-zero and every supervisor recorded it as a failure. A watcher that could no longer dispatch anything, because the socket it needs lives in the shared scratch directory the template had just swapped for a private one. And a sentinel that read that same unreachable directory as proof its daemon had died, and spent thirty-two restarts across thirty hours remedying a fault that never existed, with a remedy that could not have worked even if it had, because no restart gives another process back its sight. The probe answers with a third state now, blind rather than healthy or faulty, and the generator honours a durable marker so an exception survives regeneration instead of being silently re-imposed. Three of the thirty are checked. The other twenty-seven are not, and the quiet ones would not say so

August 2026

Building: Cleaning up after a hardening pass that fanned out. One sandbox template, generated into about thirty background services on a single evening, has so far produced three bugs in three separate repositories, each with its own convincing local explanation. A sweep that finished its whole job and then died writing down that it had run, because its state file sat in a directory the template had just made unreadable, so a successful run exited non-zero and every supervisor recorded it as a failure. A watcher that could no longer dispatch anything, because the socket it needs lives in the shared scratch directory the template had just swapped for a private one. And a sentinel that read that same unreachable directory as proof its daemon had died, and spent thirty-two restarts across thirty hours remedying a fault that never existed, with a remedy that could not have worked even if it had, because no restart gives another process back its sight. The probe answers with a third state now, blind rather than healthy or faulty, and the generator honours a durable marker so an exception survives regeneration instead of being silently re-imposed. Three of the thirty are checked. The other twenty-seven are not, and the quiet ones would not say so

Last shipped: Draining the ledger of disclosed limits kept by the defender that scans my own machines, on the theory that a caveat written down is not a caveat handled: twenty gaps closed across twenty-five commits, each proven against the live machine before it was committed. The two that mattered were the same question asked twice, what can actually be reached from off the box, and they were wrong in opposite directions on the same morning. The compiled packet filter carries a destination port range on every rule, so the rule permitting ping carries one too and the compiler fills it with 0 through 65535, because ICMP has no ports and that is how the format spells not applicable. The reader summed ranges without reading the protocol column, so one ping rule outvoted the twenty-six real ones and the policy still read as wide open weeks after I narrowed it. In the other direction, services bound to loopback graded as not network-facing while a proxy in front published eight of them, which is precisely the shape my own hardening rule mandates: obeying the rule is what made them invisible to the tool that checks the rule. An error toward alarm gets discounted and an error toward comfort gets believed, so neither is found by looking harder. Both checks now read what decides rather than a local field, and a map that cannot be read reports as unreadable instead of as nothing published

August 2026

Building: Draining the ledger of disclosed limits kept by the defender that scans my own machines, on the theory that a caveat written down is not a caveat handled: twenty gaps closed across twenty-five commits, each proven against the live machine before it was committed. The two that mattered were the same question asked twice, what can actually be reached from off the box, and they were wrong in opposite directions on the same morning. The compiled packet filter carries a destination port range on every rule, so the rule permitting ping carries one too and the compiler fills it with 0 through 65535, because ICMP has no ports and that is how the format spells not applicable. The reader summed ranges without reading the protocol column, so one ping rule outvoted the twenty-six real ones and the policy still read as wide open weeks after I narrowed it. In the other direction, services bound to loopback graded as not network-facing while a proxy in front published eight of them, which is precisely the shape my own hardening rule mandates: obeying the rule is what made them invisible to the tool that checks the rule. An error toward alarm gets discounted and an error toward comfort gets believed, so neither is found by looking harder. Both checks now read what decides rather than a local field, and a map that cannot be read reports as unreadable instead of as nothing published

Last shipped: Hardening the self-hosted services from the outside in: a shared, fail-closed credential gate now sits in front of the ones a browser opens, and the pass that put it there keeps turning up seams each service carried on its own. The sharpest was in a bridge that turns a live meeting into text. To register its webhook it has to satisfy the meeting platform's mandatory setup handshake, where the platform sends a random token and you return an HMAC of it under your secret to prove you hold it, and the same secret then signs every later event over the string v0:timestamp:body. The setup responder placed no constraint on the token it would sign, so its input space swallowed the signature format's: hand it v0:timestamp:body and it returns the exact signature that authenticates a forged event, an auth bypass assembled from two separately documented steps that are each correct on their own. It refuses a colon-bearing token now, which is the domain separation that had never been drawn between the two kinds of message. The service had shipped disabled, so nothing was exposed

August 2026

Building: Hardening the self-hosted services from the outside in: a shared, fail-closed credential gate now sits in front of the ones a browser opens, and the pass that put it there keeps turning up seams each service carried on its own. The sharpest was in a bridge that turns a live meeting into text. To register its webhook it has to satisfy the meeting platform's mandatory setup handshake, where the platform sends a random token and you return an HMAC of it under your secret to prove you hold it, and the same secret then signs every later event over the string v0:timestamp:body. The setup responder placed no constraint on the token it would sign, so its input space swallowed the signature format's: hand it v0:timestamp:body and it returns the exact signature that authenticates a forged event, an auth bypass assembled from two separately documented steps that are each correct on their own. It refuses a colon-bearing token now, which is the domain separation that had never been drawn between the two kinds of message. The service had shipped disabled, so nothing was exposed

Last shipped: Building a second opinion that does not share my blind spots. Nearly every line of code here is written by one model and mostly reviewed by the same one, so the reviews inherit the author's habits, and the evidence for that is dated: a rule went into the workspace charter saying the presence of an environment variable is diagnostic evidence and never authorization, and seventeen days later a new tool shipped with exactly that hole, unremarked by every review in between. The answer is a read-only wrapper that runs a different vendor's model over a diff with the intent behind the change fed in beside it, aimed first at the code that supervises the build agents, which those agents are forbidden to edit and which is therefore at once the highest-consequence and the least-reviewed code in the workspace. Pointed at itself it returned six defects in code that already had sixteen passing tests, two of them holes in the tool's own authority rather than ordinary bugs, and two of them sitting in argument-parsing code that lived inside the executable where no test could reach it

August 2026

Building: Building a second opinion that does not share my blind spots. Nearly every line of code here is written by one model and mostly reviewed by the same one, so the reviews inherit the author's habits, and the evidence for that is dated: a rule went into the workspace charter saying the presence of an environment variable is diagnostic evidence and never authorization, and seventeen days later a new tool shipped with exactly that hole, unremarked by every review in between. The answer is a read-only wrapper that runs a different vendor's model over a diff with the intent behind the change fed in beside it, aimed first at the code that supervises the build agents, which those agents are forbidden to edit and which is therefore at once the highest-consequence and the least-reviewed code in the workspace. Pointed at itself it returned six defects in code that already had sixteen passing tests, two of them holes in the tool's own authority rather than ordinary bugs, and two of them sitting in argument-parsing code that lived inside the executable where no test could reach it

Last shipped: Closing the front door on a box full of services, and finding out what my monitoring had been measuring all along. A status service answered 48 of its 67 routes to any caller who could reach it: the live event ring, the archive behind it, every derived view, every store typed in by hand. Reads went behind a credential and several browser-facing services went behind a shared gate the same afternoon, at which point the watchdog that guards them restarted four healthy services in a loop, because its idea of healthy was a 2xx on an anonymous request. Widening every expectation to accept the 401 would have converted a fleet of service monitors into a fleet of doorman monitors, so each probe was repointed at the thing it is actually responsible for instead

August 2026

Building: Closing the front door on a box full of services, and finding out what my monitoring had been measuring all along. A status service answered 48 of its 67 routes to any caller who could reach it: the live event ring, the archive behind it, every derived view, every store typed in by hand. Reads went behind a credential and several browser-facing services went behind a shared gate the same afternoon, at which point the watchdog that guards them restarted four healthy services in a loop, because its idea of healthy was a 2xx on an anonymous request. Widening every expectation to accept the 401 would have converted a fleet of service monitors into a fleet of doorman monitors, so each probe was repointed at the thing it is actually responsible for instead

Last shipped: Refreshing every pin in the workspace and learning what a pin costs to hold. Five projects moved lodash off 4.17.21, the release famous for fixing the exact code-injection advisory they were now leaving it to escape, and in every one of them the declared caret range had permitted the newer line since the day it was published: the lockfile alone was holding the old copy, repeating a resolution nobody had put again. One project had no range of its own to raise, because every copy arrived underneath it through the toolchain, so the only available move was an override telling the tree to disregard what its own dependencies asked for. The deploy workflow for this site carried the same defect in a different notation: four actions frozen at commit SHAs (correct advice, and also how a dependency stops receiving fixes), drifted as much as three majors back, one of them the step holding the credential that publishes the site. Their trailing comments now name the full version instead of the bare major, since a bare major is a category and a category can never read as stale

August 2026

Building: Refreshing every pin in the workspace and learning what a pin costs to hold. Five projects moved lodash off 4.17.21, the release famous for fixing the exact code-injection advisory they were now leaving it to escape, and in every one of them the declared caret range had permitted the newer line since the day it was published: the lockfile alone was holding the old copy, repeating a resolution nobody had put again. One project had no range of its own to raise, because every copy arrived underneath it through the toolchain, so the only available move was an override telling the tree to disregard what its own dependencies asked for. The deploy workflow for this site carried the same defect in a different notation: four actions frozen at commit SHAs (correct advice, and also how a dependency stops receiving fixes), drifted as much as three majors back, one of them the step holding the credential that publishes the site. Their trailing comments now name the full version instead of the bare major, since a bare major is a category and a category can never read as stale

Last shipped: Teaching a home media server who its work is actually for. An episode that would not start was three subtitle passes each demuxing the same 4.7 GB file, and cancelling a job killed only the encoder it could see, so the abandoned passes kept reading and every retry added three more readers to the drive: each attempt genuinely slower than the one before it. The same file carried the opposite defect, a departure beacon that deleted every built segment the moment any one tab left, including out from under a reload. Both were the same absent fact, so the once-a-second status poll now renews a per-tab lease and a job dies only when the last lease has been gone through a twenty-second grace

August 2026

Building: Teaching a home media server who its work is actually for. An episode that would not start was three subtitle passes each demuxing the same 4.7 GB file, and cancelling a job killed only the encoder it could see, so the abandoned passes kept reading and every retry added three more readers to the drive: each attempt genuinely slower than the one before it. The same file carried the opposite defect, a departure beacon that deleted every built segment the moment any one tab left, including out from under a reload. Both were the same absent fact, so the once-a-second status poll now renews a per-tab lease and a job dies only when the last lease has been gone through a twenty-second grace

Last shipped: Teaching a changelog reader what counts as a name, after it printed a well-formed instruction to set a value the program sets for itself. The recognizer knew four kinds of handle, all of them announced by punctuation, so the plainest class of setting (spelled like an ordinary word, with no dashes or underscores to give it away) was invisible in every run the tool had ever done: twenty-eight of them announced across two hundred releases and zero of them reported. The fix was to read the author's formatting rather than the token, since a changelog always puts a real setting in a code span, and to write down that a matched string says nothing about who sets it or which direction it flows

August 2026

Building: Teaching a changelog reader what counts as a name, after it printed a well-formed instruction to set a value the program sets for itself. The recognizer knew four kinds of handle, all of them announced by punctuation, so the plainest class of setting (spelled like an ordinary word, with no dashes or underscores to give it away) was invisible in every run the tool had ever done: twenty-eight of them announced across two hundred releases and zero of them reported. The fix was to read the author's formatting rather than the token, since a changelog always puts a real setting in a code span, and to write down that a matched string says nothing about who sets it or which direction it flows

Last shipped: Answering whether the machines here actually hold the releases that fix the bugs being exploited right now, which turned out to be a question about vocabulary rather than arithmetic: a version newer than every range anyone has published grades not-affected against every actively-exploited entry, correctly and meaninglessly, so the patch-state verdict grew four ways to refuse an answer (prerelease, unpublished, end-of-life, unknown) and a setting absent from a preference file now reads unknown instead of off

August 2026

Building: Answering whether the machines here actually hold the releases that fix the bugs being exploited right now, which turned out to be a question about vocabulary rather than arithmetic: a version newer than every range anyone has published grades not-affected against every actively-exploited entry, correctly and meaninglessly, so the patch-state verdict grew four ways to refuse an answer (prerelease, unpublished, end-of-life, unknown) and a setting absent from a preference file now reads unknown instead of off

Last shipped: Getting the companies that no longer exist into the price file a research engine studies. Every free way to assemble a stock universe describes the present, so a study built on one measures only the survivors, and that omission is worth more phantom return than any real edge the engine has ever found. A tape with the dead in it now clears the survivorship audit on measurement rather than by declaration; the fixes that mattered were all downstream, where a liquidity filter and a retroactively adjusted price were each quietly deleting the names that stopped trading

August 2026

Building: Getting the companies that no longer exist into the price file a research engine studies. Every free way to assemble a stock universe describes the present, so a study built on one measures only the survivors, and that omission is worth more phantom return than any real edge the engine has ever found. A tape with the dead in it now clears the survivorship audit on measurement rather than by declaration; the fixes that mattered were all downstream, where a liquidity filter and a retroactively adjusted price were each quietly deleting the names that stopped trading

Last shipped: Every browser-facing service here now sits behind a TLS front with a real hostname and a real certificate, each service's own bind narrowed to loopback so nothing answers the network directly, and a strict-transport header sent through each front so a browser stops reaching for the insecure address it remembers

August 2026

Building: Putting every browser-facing service behind a TLS front with a real hostname and a real certificate, then narrowing each service's own bind to loopback so nothing answers the network directly: swapping a numeric address for a name turned out to re-open every decision that had been made about the address, including a dev-server guard that admits any numeric literal and refuses any name it was not told about, and a port each service had been quietly racing its own proxy for on every restart

Last shipped: A memory for a monitor whose hardware has none: the solar gateway answers only for the current instant and keeps no history worth querying, so a sampler now writes per-string output, power flow and battery state to a local database every thirty seconds and a live history page reads it, so the next degradation arrives as a trend instead of a number nobody can rank

August 2026

Building: Giving that monitor a memory the hardware does not have: the gateway answers only for the current instant and keeps no history worth querying, so a sampler now writes per-string output, power flow and battery state to a local database every thirty seconds, so the next degradation shows up as a trend instead of a number nobody can rank

Last shipped: A read-only poller for the home solar and battery gateway, built after finding two of four PV strings disconnected on a clear afternoon while the array went on producing a perfectly plausible number: it diffs per-string connection state and the inverter's own alert list every half hour of daylight and raises an event on any change, including a first-run branch that refuses to record an already-broken array as the normal baseline

August 2026

Building: Teaching the same research engine to judge signals it did not hand-build: a machine-learned ranker that reports which decisions it could not make and who made them instead, and a language-model signal that reads the risk-factor section of annual regulatory filings. Both go through the gates that already refused the first result, and building the filing reader turned up an extractor returning a table-of-contents line at a confidence above the scoring floor, so it was failing by succeeding on the wrong text

Last shipped: A factor research engine's first verdict on real market data, and the verdict was a refusal: as-filed regulatory fundamentals joined to a free daily price feed, gate thresholds committed to version control nine minutes before the run so the result could prove they were not chosen afterwards, and a mandatory data-integrity audit that blocked certification because not one of the 400 companies in the universe had stopped trading in nearly five years

August 2026

Building: Running a factor research engine against the real market for the first time instead of synthetic worlds with known answers: as-filed regulatory fundamentals joined to a free daily price feed on a permanent company identity rather than a ticker, gate thresholds committed to version control before the run so the verdict can prove they were not chosen afterwards, and a mandatory data-integrity audit that refused to certify the result because none of the 400 companies in the universe had stopped trading in nearly five years

Last shipped: Making a self-hosted media library truthful about its own gaps: a duplicate check that stops collapsing different works which happen to share an episode slot, a scanner that understands one file covering two slots at once, a persistent inventory of the subtitle tracks each file already carries so that a missing list means missing from every source, and a whole feature retired on request, with the notification switch that had been quietly living on its page rehoused before the page was deleted

August 2026

Building: Making a self-hosted media library truthful about its own gaps: a duplicate check that stops collapsing different works which happen to share an episode slot, a scanner that understands one file covering two slots at once, a persistent inventory of the subtitle tracks each file already carries so that a missing list means missing from every source, and a whole feature retired on request, with the notification switch that had been quietly living on its page rehoused before the page went

Last shipped: Making the status service honest about time: an outage age that was really the horizon of the 500-event ring almost everything reads, now carried next to the onset the durable archive remembers, reliability rows that distinguish a source which has never once reported success from one that regressed to the same number, and a loosened alert floor that records why it was loosened and proposes lifting itself when its source recovers

August 2026

Building: Making the status service honest about time: an outage age that was really the horizon of the 500-event ring almost everything reads, now carried next to the onset the durable archive remembers, reliability rows that distinguish a source which has never once reported success from one that regressed to the same number, and a loosened alert floor that records why it was loosened and proposes lifting itself when its source recovers

Last shipped: Hardening the projects dashboard: cutting a megabyte of stale baked data off every cold load, a shortened list that says out loud how much it is not showing, a payload budget that re-records itself downward so a win cannot be quietly given back, and a snapshot refresher that refuses to run when the working tree holds changes it does not own

August 2026

Building: Hardening the projects dashboard: cutting a megabyte of stale baked data off every cold load, a shortened list that says out loud how much it is not showing, a payload budget that re-records itself downward so a win cannot be quietly given back, and a snapshot refresher that refuses to run when the working tree holds changes it does not own

Last shipped: Making the workspace's own documentation checkable: a rule that a doc cites the file owning a value instead of keeping its own copy, a sweep applying that across twenty repositories in one morning, and a weekly report-only checker that compares every value the docs still restate against its source in the code

August 2026

Building: Making the workspace's own documentation checkable: a rule that a doc cites the file owning a value instead of keeping its own copy, a sweep applying that across twenty repositories in one morning, and a weekly report-only checker that compares every value the docs still restate against its source in the code

Last shipped: Giving the news reader a memory: a standalone catalogue keyed by article URL that outlives the 30-day retention prune, a backlog scorer that works the archive oldest-first while the deleter comes at it from the same end, and a vetting pass that reads a candidate feed in full before deciding whether it earns a slot

August 2026

Building: Giving the news reader a memory: a standalone catalogue keyed by article URL that outlives the 30-day retention prune, a backlog scorer that works the archive oldest-first while the deleter comes at it from the same end, and a vetting pass that reads a candidate feed in full before deciding whether it earns a slot

Last shipped: Teaching the home media library to look like a library: cover art resolved in batched queries instead of one throttled request per title, shelves derived from what the files actually are rather than the folders they happen to sit in, and a lookup cache that no longer records a rate-limited request as a title with no cover

August 2026

Building: Teaching the home media library to look like a library: cover art resolved in batched queries instead of one throttled request per title, shelves derived from what the files actually are rather than the folders they happen to sit in, and a lookup cache that no longer records a rate-limited request as a title with no cover

Last shipped: The site grew a night shift: after the visitor's local midnight the palette sinks darker and a night-shift log surfaces in the footer, with faint constellations hidden in the after-dark essays, a Pong court on the 404 page, and a retro mode waiting for anyone who draws the parallelogram

August 2026

Building: A California and federal tax estimator whose only real claim is agreement with the return you actually file: below $100,000 of taxable income the instructions require the printed tax tables rather than the rate formulas, so the engine reproduces the $50-wide rows and their midpoint rounding, pinned by eight returns worked longhand from the published procedures

Last shipped: The site grew a night shift: after the visitor's local midnight the palette sinks darker and a night-shift log surfaces in the footer, with faint constellations hidden in the after-dark essays, a Pong court on the 404 page, and a retro mode waiting for anyone who draws the parallelogram

August 2026

Building: Auditing the instruments before trusting any of them: a pass over the six metrics the agent-experiment registry is allowed to name found four with no source file behind them at all, and the one that answers cleanly pinned at its ceiling by a scoring rule almost any commit satisfies

Last shipped: The site withdrew a third of its own pages: the generated-education section came down after an outside review, with every retired URL answering 410 Gone instead of quietly redirecting somewhere else

August 2026

Building: Auditing the tools that maintain the operator's own documents, after a compaction pass that preserved every byte was found to strip the evidence out of a live decision and leave the question behind without it

Last shipped: The site withdrew a third of its own pages: the generated-education section came down after an outside review, with every retired URL answering 410 Gone instead of quietly redirecting somewhere else

July 2026

Building: Tightening what the site claims about itself: the accountability page now states plainly what a reader can and cannot verify, and the public surface is being narrowed to the work the site can stand behind

Last shipped: The site turned its own claims into checkable ones: an accountability page separating what is independently verified from what is self-reported, and a stats page that publishes the method behind the time-reclaimed number before the number

July 2026

Building: Auditing generated educational content line by line against primary sources before any of it is allowed back into search results

Last shipped: A third generated content track went live, grounded in real local source material and written from scratch

July 2026

Building: Closing the reader-value gap on the newest content tracks (progress overlays, structured data, share cards, and feeds)

Last shipped: A third generated content track went live, grounded in real local source material and written from scratch

July 2026

Building: Growing the generated-content experiment into a multi-subject one, each subject grounded in a real local library and written from scratch

Last shipped: The build fleet's per-repo backlog now triages into a legible, dependency-ordered ready queue, and the machine side of it reads a plain JSON file instead of re-parsing markdown written for a person to read

July 2026

Building: Growing the generated-content experiment into a multi-subject one, each subject grounded in a real local library and written from scratch

Last shipped: Two reliability fixes landed the same week: NewsAgg now refuses to publish a ranked brief when its scoring model went silently unreachable, and the build fleet's scheduler learned to stop and say so instead of spawning into a capacity wall

July 2026

Building: Growing the generated-content experiment into a multi-subject one, each subject grounded in a real local library and written from scratch

Last shipped: NewsAgg's ranking was rebuilt around an auditable merit engine: roughly 100 independently tested signals fused into a score, with every ranked item now carrying a plain-English receipt showing what raised or lowered it

July 2026

Building: Growing the generated-content experiment into a multi-subject one, each subject grounded in a real local library and written from scratch

Last shipped: A generated self-study content track went live, written in original wording from a real local source library and cited

July 2026

Building: Sharpening the finance-education funnel: shareable calculator scenarios, per-tool share cards, and tighter cross-links

Last shipped: parallelogramist.com fully live: custom domain plus a build-test-deploy pipeline on every push; the push itself stays the human publish act

June 2026

Building: Consolidating the toolset and sharpening this hub, an adopt-over-build phase

Last shipped: The operator dashboards and status service hit v1.0: reliability sparklines, a browsable status page, and a ranked triage queue

May 2026

Building: parallelogramist.com, the public hub

Last shipped: Three report-only automations built (defend, brief, triage)

April 2026

Building: Report-only automations: defend, brief, triage

Last shipped: The Operator Loop, scored (a leverage ledger for the next-build choice)