- Nearly nine in ten clients were recorded as having arrived from nowhere in particular. Eighty eight percent of projects said the client came in "direct", which is not how people behave, it is data we destroyed on the way in. Fiverr labels its handovers correctly: about twenty buttons across the company's own pages send people to us with a note saying which page they came from. Only three of those buttons carry a typed question with them, and the branch that handled all the others quietly threw the note away before anything recorded it, so by the time the project existed the origin was gone and everything fell back to the word "direct". Now every arrival is recorded, whether it carried a question or not, and the origin is carried through the sign in and then held in the browser, which is the load bearing part: somebody who arrives by clicking a button creates their project minutes later, in their own browser, so there is no single moment on our side where the origin and the project are both in hand. Two smaller repairs came with it. An origin we do not recognise is folded into "other" and counted, rather than accepted silently, because the buttons live in seven codebases we do not deploy alongside and a new one must never be able to turn a real client away. And a signed in person is now stamped on the event that records them opening the product, which had been counting page loads rather than people, at about one and eight tenths opens each.
- The team can now read our own conversations back through the assistant, and cross two things that have never crossed. Every report anyone has asked for has failed in the same place: what we learn from reading conversations, and what actually happened afterwards, live in two systems that do not meet. One of the most requested tables, service type against price band, turns out to need neither of them joined, because both halves are answers we already hold. So it was built as a table anyone can ask for, and its rules are all lessons from reports that went wrong here before. Every cell carries the number it was counted out of, because a percentage quoted without its denominator is the recurring mistake in every report produced here. Narrowing the table reports how many it dropped, because twelve of twenty two conversations read by hand were not buyers at all, they were talent pitching or people wanting a profile written, so any rate over all of them is watered down. And somebody who answered neither question is counted as unanswered rather than dropped, since dropping them quietly shrinks the denominator and lifts every rate in the table with nothing looking wrong. Six read only tools now expose all of this to the assistant directly, including the one that makes the rest checkable: reading the actual conversation an answer was about. Nothing there spends money or writes anything; the tools that would are deliberately held back until a confirmation step exists.
- Signing in to that assistant now means opening a browser, not copying a secret out of developer tools. One command opens a real browser at the address, waits while you sign in with your own company account, password manager, second factor and all, and then picks up the session that sign in produced. The tool never sees a password and never types one, which is deliberate rather than merely convenient: anything that asks you for a password is the shape of a phishing attack, and anything that types your password is one mistake away from writing it into a log. What it does keep is treated as the credential it is, stored outside the repository with locked down permissions that are rechecked on every read and refused rather than warned about if they have loosened, never printed, never returned by a tool, never put in an error message, and expired after seven days so a stale session says "sign in again" instead of producing a confusing failure from somewhere deeper.
- The tool that reads our numbers back to us got a lock on its door. Access to it was "any company Google account", which is a fence rather than a decision. It is now a named permission, granted per person from the same admin screen that grants every other area, and it was a clean cutover: nobody was carried across, so everybody who needs it gets an explicit grant. Alongside it, that tool and the admin console stopped riding the product's release. Until now a dashboard tweak rebuilt and republished the client facing app, the talent app and everything else, and a broken dashboard build could strand a client fix behind it. Each now has its own track in daily deploys and its own button for staging and production, keeping the full pre release checks and dropping only the parts that cannot possibly apply.
- A board that answers the one question none of the others could: how much room is left. Seven boards watch whether each part of the system is healthy. None of them answered "what breaks first if traffic doubles", and for the limit that binds soonest they could not: the model provider's allowance is quoted per minute, our chart drew it per second, and comparing the two was arithmetic in your head. The new board is twenty four panels read top to bottom, each one showing a live number against the actual ceiling it will hit, with a stated reading rule. The part that keeps it honest is that every ceiling line is drawn from the same setting that provisions the capacity rather than a number typed in beside it, so resizing something moves its line automatically. A board whose lines drift is worse than no board, because it reports headroom that was spent months ago. The model spend panels deliberately ignore which environment they are in, because staging, testing and production all draw on one shared allowance and an environment specific chart understates the only number that matters. A follow up the same day fixed something the whole review missed because it does not fail: the monitoring service quietly rewrites parts of what you send it, so every subsequent infrastructure check reported the board as changed, forever, for a file nobody had edited. A check that is never clean is where genuine drift goes to hide.
- Production can now be put back. Until today a bad release could only be fixed by rolling forward, which during an incident is the slowest possible option. Rolling back code and rolling back a database are different problems, so they are treated differently: code goes back, the database stays where it is, and every schema change is now either proven safe to run against the previous version or explicitly declared a point of no return, checked automatically on every change so the next one cannot be forgotten. On top of that sits a single operation that re pins every service to a chosen earlier release, restores each front end from the copy every deploy now archives, and runs the same live health check that guards a normal release. There is a written procedure with rehearsal steps and timings, and the database's own backup and point in time recovery windows are now written down in the infrastructure rather than assumed. Review of it caught the defect that would have mattered most: a failed re pin was being swallowed, so the rollback could report success while still serving the exact release it existed to remove.
- The running service could not reliably say which version it was. Every infrastructure run planned to delete the stamp that records which build a service is running, and the value only came back on the next deploy, so in between a service asked what it was running gave a fallback answer meant for very old deploys. The neat fix does not exist: the tooling cannot be told to ignore one setting, only all of them, which would mean a genuinely new setting silently never reaching the service, a quieter failure than the one being fixed. So the stamp moved instead of being argued over. It is a property of the build rather than of the deployment, and the build is already labelled with it, so it is now baked into the image itself where the infrastructure is structurally incapable of removing it. The half that would have silently defeated this is that the deploy command merges settings and never removes them, so simply dropping the old one would have left the stale value sitting in place, shadowing the correct one, in all six services, looking exactly like success.
- Every deleted guest was being counted as a signed in client. Somebody browsing without an account is given a placeholder address, and "is this a guest?" was worked out by looking at that address every time it was asked. Deleting an account overwrites the address with a tombstone, which matches nothing, so the answer silently came back "no" for a row that was a guest: both sides of the count were wrong and nothing was missing to notice. That deletion behaviour has been live since the fourth of August, so this was a wrong number being read, not a pending one. Whether somebody is a guest is a fact about the account, so it is now stored as one, written at the single moment an account is created while the address is still intact. The repair has a hard limit and the fix admits it rather than papering over it: an account deleted in the eight days between the two changes lost its address before anything recorded the answer, and nothing else on the row can recover it. Those read "unknown", never "no", they are excluded from the count, and the number of them is published on the page so the denominator shrinking is visible rather than silent.
- A talent search that found nobody stopped giving up without asking. The search runs up to three rounds and hands the pool to the agent to judge between them, except in one case: if nothing at all survived, it stopped immediately and returned an empty shortlist with the reason "reached iteration cap". The single situation that most needs somebody to think about it was the one where nobody was asked. Two staging briefs died exactly that way and neither was short of talent. A two hundred dollar careers page brief pulled two hundred and fifteen people and then deleted one thousand three hundred and fifty eight of two thousand eight hundred and sixty four priced options for sitting below the price floor. A one thousand dollar copywriting brief deleted ninety five percent of them the same way. The higher the client's budget, the harder the floor punished them for it. An empty pool now goes to the judge like any other, carrying the counts so it can tell a price problem from a country problem, and the judge is told the order to loosen things in: widen the money first, then something the client never asked for, then at most one thing they did. Somebody capable charging two hundred dollars on a thousand dollar brief is a real option the client wants to see, cheaper than expected rather than worse, and the ranking already places them below an in budget pick, so widening costs nothing. Both briefs went from zero finalists to eighteen.
- One deck of talent at every screen width, and one press that reveals all of them. The shortlist was showing the same twelve people three different ways, and the desktop version had no minimum card width, so opening the job description panel beside it squeezed three cards into unreadable slivers. There is now one deck at every width: cards stay a fixed size and the available space decides how many you see, three with the next peeking, or two, or one. You can drag it with a mouse, swipe it on a phone, or use the arrows, which move out of the way and float over the deck's edges when there is not enough room for them. The "show more" button changed meaning: it was adding three at a time and then scrolling, which read as a button that loads nothing, and it now unlocks the whole remaining list in one press and jumps you to the first newly revealed person. Four separate follow ups closed the awkward edges: a drag that ended over a card no longer opens that person's profile, a pause before letting go is no longer read as a flick, the jump is no longer wasted on cards that have not appeared yet, and grabbing the deck again mid settle no longer fights the deck's own snapping. And a card only counts as seen when it is actually more than half on screen, so the rate at which people drop off down the list finally has a denominator that means something.
- On a phone, the job description bar was sitting on top of the message box. The progress strip that hovers above the keyboard is supposed to slide away whenever a question card takes its place, and it did move, just nowhere near far enough: about ninety pixels of a two hundred pixel journey. So it landed squarely on the text box, an opaque bar over the place you type, hiding both the prompt text and the cursor. Taps still went through to the box underneath, which is worse than blocking them, because somebody looking at a covered input concludes that typing is not allowed while a card is open. It now clears the bottom of the screen completely and fades out on the way, so its shadow cannot bleed back over the input either.
- Deploying to staging and production stopped costing fifty five dollars and forty minutes of model tests nobody was reading. The live behavioural suite ran as a blocking gate ahead of every ship, including the nightly staging one. It is a genuinely valuable suite and it is now what it should have been: something a person runs deliberately against any version, on demand. Separately, the warehouse can finally build the funnel everyone actually uses. Three of its eight stages could not be reconstructed there at all because their tables were not visible to it, which is the real reason nobody queried that copy. They are now visible, with a deliberately tight carve out: only whether a job description exists and its structural shape crosses over. None of its text does, not the title, not the content, not a single block, and the carve out re imposes a narrower ban than the one it lifts, so a future change that starts pulling the words fails here rather than shipping.
- A page call in one voice, and a way to hear it without waking eight people. An alert call mixed two voices: the incident briefing was the good one and every line around it, the instructions, the goodbyes, the confirmation, was the flat built in robot. Two voices in a twenty second call sounds broken, and the robot half was reading the instructions, the part a half asleep person most needs to understand first. Every fixed line is now spoken in the same voice, rendered once and reused, addressed by its own content so editing a line or changing the voice cannot serve stale audio. It is prepared in the background during the five minute window before the first call, so it never delays the call it is preparing for. And there is now a way to ring one phone immediately with the real pipeline, keeping everything that shapes what a human hears and dropping the roster, the messages and the wait. It cannot disturb a real incident: pressing a key on a test call is explicitly refused as an acknowledgement, because without that a voice test would quietly take ownership of a live page and stop everybody else's phones ringing.
- Forty seven more names on the recommended talent list, and clearer words on the approve button. The refreshed recommended list carried one hundred and sixty five people, forty seven of whom were not in ours; their ids were resolved against the company's own records and every id already in the file was rechecked at the same time, with no mismatches. Nothing existing moved. And the popup that confirms a client is ready now says plainly what pressing the button does, sending the job description off so we can find the right talent, and what it costs, which is the ability to keep editing it.
A Wednesday, 31 commits, mostly about knowing things. Nearly nine in ten clients were recorded as arriving from nowhere in particular, which is not behaviour, it is a note we threw away at the door: about twenty buttons across Fiverr's own pages tell us where somebody came from, and the branch handling all but three of them discarded the label before anything recorded it. The team can now read our own conversations back through the assistant itself, and cross two things that have never crossed, with every cell carrying the number it was counted out of and every exclusion stated. The number reader got a lock on its door, a named permission per person rather than a company wide fence, and stopped riding the product's release. A new board answers what none of the others could, how much room is left before the next step in traffic hurts, with every ceiling line drawn from the setting that provisions it so it cannot drift. Production can be put back now, code rolling back while the database stays put. Every deleted guest had been counted as a signed in client since the fourth of August. A talent search that found nobody stopped giving up in silence and went from zero finalists to eighteen on both of the staging briefs that had died that way. And the shortlist became one scrolling deck at every width, with one press to reveal everybody.