- The production database was filling up at nearly three gigabytes a day, and almost all of it was one thing. Of the roughly nine and a half gigabytes in use, eight and a half were the recorded working of the agents: every prompt we send a model and every word it sends back, kept in the database beside the small facts about the call. That is the right thing to keep and the wrong place to keep it. The heavy part now goes to cheap bulk storage, compressed, and the database keeps a light row pointing at it, about forty times smaller. Nothing that reads it changed, because reading now quietly fetches the heavy part back, and anything already written is being moved across in the background a batch at a time. It is also now organised by month and thrown away after ninety days, on both sides, so the size stops being a one-way ratchet. Around it, the disk itself finally got watched: a chart of what is using the space table by table, a warning as it grows, and a page-a-human alarm before it can ever fill. This one change went through ten rounds of review, most of them about the same thing said ten different ways, which is what happens when a change can destroy the only copy of something: a failed upload must never delete the original, a person exercising their right to erasure must never race the mover, and a row already past its ninety days should be deleted rather than lovingly copied somewhere first.
- Background jobs were being sorted into fast and slow by accident. Every background job runs on one of two lanes, and the fast lane carries a promise: ninety-five percent finish within thirty seconds. The code that chose a lane ended with "otherwise, fast", so any job nobody had explicitly classified was enrolled in that promise without its author ever seeing it. Six had arrived that way and all six break it: the insights sweep finishes late in eighty-eight percent of runs, a proactive client message in eighty-four percent, the erasure sweep in fifty-nine. Five moved to the slow lane. The erasure sweep deliberately did not, and the reason is worth stating: the two lanes have different retry budgets, and for a legal erasure with nothing behind it that budget is the guarantee. Three attempts at deleting somebody's data is a worse thing to save than a little of an error budget. Lane membership is now exhaustive and a new job type fails the build until somebody picks one, which caught a seventh on its very first run.
- An alarm that fired four times a day was counting people closing tabs. "Requests dropped before reaching us" watched everything except two known-harmless cases, and since the launch that set has been, in practice, entirely clients disconnecting: 640 in seven days, against zero actual faults. The top offenders are the beacons a browser fires as somebody navigates away, and the burst of image tiles the brief's files panel loads. One worked example: seven file requests from one buyer, cancelled within sixty milliseconds of each other as a single connection closed, every one of them already answered successfully. That produced fifteen incidents in four days, each one or two over the threshold and each resolving itself within minutes. The threshold had been calibrated on an idle test environment, which is exactly the mistake the counter's own comment warns about. Client disconnects stay in the measurement and on the chart; they are simply no longer an alarm.
- The Insights assistant learned to see across agents, and to point. It could previously only see the tab you were looking at, so on the client tab it could not compare against the talent-side or search-side findings and had to infer. It now sees every agent's findings for the run, grouped by project so the links between them are explicit, which means it can answer things like "of the talent conversations that failed, what share had this upstream tag", and say plainly when a question was simply never asked rather than guessing at it. Every finding it reads carries a handle, so when it refers to rows it can now put a button under its answer that pins the table to exactly those rows, one button per agent so a project's client row and its search row are not silently collapsed into one. Long answers no longer come back blank, which they did when the reply outgrew its size limit and was cut off mid-sentence; the limit is raised and a truncated answer is salvaged and shown with a note. There is a Reset button, pressing Enter sends, adding a suggested question confirms on the card instead of popping a toast that let you add it twice, and switching between reports no longer shows you the previous report's conversation and then overwrite the new one with it.
- A report over a hundred projects used to never finish at all. The sweep tagged projects strictly one after another, so a hundred-project run took about half an hour, and the lane it was on kills a job at ten minutes and retries it from the beginning, with no memory of what it had already done, up to eight times. So the big runs, the only ones worth doing, could never complete. They now tag eight projects at a time, well within the limits of the model connection, and land in minutes. A separate fix covers the other way a report could hang: if the machine running it is killed mid-sweep, by a deploy or otherwise, nothing was left to mark the report as failed and it sat saying "running" forever; anything still running past its own deadline is now swept up and marked honestly.
- Every alert now carries a button that writes the investigation for you. Working out what an alarm means starts with the same mechanical few paragraphs every time: what fired, on what, when, with what numbers. Each alert in the room now carries a second button that opens a page with that briefing already written and a copy button. It holds no state and no credentials by design, because the entire contents of the page are in the link itself, so it can only ever show a person what that person's own link already contained.
- A deploy went green having shipped nothing, and then no amount of pushing could fix it. The day's last find, and the most uncomfortable. GitHub had an outage, our deploys ran out of order, and one of them worked out what had changed by comparing itself against a commit that came after it rather than before. Almost nothing looked changed, so every backend step was skipped, and the run finished green having deployed none of the work it was carrying. The bad part is what came next: every later run took that empty success as its own starting point, so no ordinary push could ever ship that code again, and the test environment quietly served the older version until a person rolled it over by hand. Two assumptions had been holding the whole thing up, and both turned out to be false: that the commit you compare against always comes before you, and that a run finishing green means it actually deployed anything. Now a run may only compare against a commit that genuinely precedes it, and each part of the system, backend, on-call, front end and docs, is measured against the last run that really deployed that part rather than merely finished, because a skipped step proves nothing about what is live. Where there is no trustworthy point of comparison it now deploys everything rather than nothing: a redundant deploy is cheap and quietly skipping one is the incident. Four rounds of review went into it, each closing off another way the safe-sounding fallback could strand a deploy all over again.
A shorter Friday, 16 commits, and the theme is capacity. The production database had been filling at nearly three gigabytes a day, and eight and a half of the nine and a half gigabytes in use turned out to be one thing: the full text of every exchange with a model. That heavy part moved out to cheap bulk storage with the database keeping a light pointer, everything already written is being carried across in the background, and both sides now expire after ninety days, with the disk itself finally charted and alarmed. Background jobs stopped being sorted into the fast lane by fallthrough, which had quietly enrolled six job types in a thirty-second promise that all six break. An alarm that had fired fifteen times in four days turned out to be counting buyers closing browser tabs. And the Insights assistant learned to see every agent at once, to point at the exact rows it means, and to survive an answer longer than its own size limit. The day closed on the most uncomfortable find of it: during a GitHub outage a deploy compared itself against a commit that came after it, skipped every backend step, and finished green having shipped nothing, after which no ordinary push could ever ship that work again until a person rolled it by hand.