- Every message we send about a project linked at the front door instead of at the project. Three notifications go out through the marketplace inbox, the shortlist being ready, the questions opening, and the hour nudge, and the builder behind them took no argument at all, so every ping in every run shipped the same bare address. A client who tapped review shortlist landed on the home page rather than on the shortlist we had just announced. The inbox is read wherever somebody happens to be, which is usually not the browser they signed in on, so that bare address lost two things at once, no session and no project, and a signed-out tap booted a fresh guest workspace and showed a blank home. Every one of them now goes through the same arrival hop the marketing emails have used since they stopped linking the document: it reads the session and decides, signed in straight to the project, signed out through sign-in while CARRYING the project so the round trip lands them inside it. The two channels had quietly drifted apart, marketing linking into the project while the product's own ping linked to the lobby, and one client gets both.
- The text message would have shipped with no link in it at all, and nothing would have said so. The away channels are three and the fix above covered one, so the phone still got the lobby while the inbox got the project. The reason the text could not simply reuse the same hop is invisible by inspection: when a message runs past one segment the composer gives up the LINK rather than bill for a second segment, so a link that is merely too long does not raise an error, it VANISHES, and the text still sends and still reads perfectly well. Measured against the real configured addresses, the long form pushed both bodies over the limit in every environment, production included, so every text would have gone out linkless. The hop therefore gained a short spelling: the project's sixteen bytes written as twenty-two characters, decoded by a route that runs the SAME arrival logic, one decision, so a text and an email cannot land the same client differently. The long spelling still resolves, so a link minted at any age still works. Browser push keeps its attribution key through the hop, which matters because that key feeds the funnel. Push was the weakest of the three anyway, since restoring from the server restores the ACTIVE project, so a client waiting on two runs got the banner for one and the workspace of the other. Both job payloads gained the project as an optional field, so a job already queued when the deploy rolls still parses and an older worker ignores the new one, safe in both directions. And a test now asserts the link SURVIVES one segment for the addresses that actually send texts, with a twin asserting the long form would not have, so if the copy ever shrinks enough to make the packing unnecessary, a test says so.
- A new public door was cut into the wall, and the ledger that exists to notice caught it within minutes. The short arrival route resolves no identity, deliberately, exactly like the long one it is the short spelling of, because a browser navigation out of a text carries no identity header and an auth requirement would refuse the very visitor the route exists for. But deliberately identity-less is precisely what the ledger is FOR: a registry test makes every such route state in one place the reason it is safe, so the set can be read at a glance instead of inferred from twenty handlers. It is stated now: the reference decodes to a project or to nothing, then runs the same safety check and the same sign-in bounce as the long form, and it grants nothing, because the read behind the landing is still scoped to the client, so a stranger's reference lands on a blank home. Only the fast test tier went red and every deploy job skipped, so nothing shipped. Alongside it, a description claiming a non-standard project reference still round-trips was corrected to say what actually happens, which is that packing leaves it alone so a link can still be BUILT while unpacking refuses it. Harmless today, and exactly the wrong answer for the next reader sizing up where such an id could come from.
- Tapping I am here to offer my services paged two chat rooms about a queue somebody already works. Both cards are gone. The argument for keeping the second one was the consequence rather than the confidence: the tap closes that conversation, so a genuine client who mis-tapped has lost the chat holding their brief, and support owns the undo. But the undo lives in the console, and the flag reaches the console whether or not a message fired, so the pages were announcing, once per tap and in two rooms at once, a worklist that was already visible. The detection itself is untouched, and this is deliberately not the same as the tag-only case from earlier in the month: the flag row stays a real worklist item, so the alerts list, the project's own open flags and the launch tile all still carry it. Only the fan-out went. The alert can no longer even be constructed, which is what makes the deletion safe rather than a latent crash waiting on one code path, and a new test pins that every kind of alert has copy and nothing else does.
- Correcting one line in the brief let the agent rearrange everything around the correction. Editing a block already made THAT block the client's: the route stamps it as theirs and the agent's gates refuse to touch it. Nothing protected the section around it, though, so the agent stayed free to rewrite the neighbouring block, delete a third, append a fourth and re-title the card. A client who fixed one line came back to a section that had moved around underneath their fix, which reads as being overruled. The unit of ownership people actually feel is the SECTION, so that is what is locked now: any hand edit inside one, a block added, edited or deleted, or the section renamed or rewritten, closes it, and from then on the agent may not add, update, delete, rename or re-span anything in it. Changing only a card's width deliberately does not lock it, because width is layout, not content. It is enforced where the writing actually lands rather than only in the plan check, because that check judges the workspace as it looked when the turn began while a client can lock mid-turn, and updates are judged by where a block ACTUALLY lives rather than by the section the plan claims, so pairing a real block with the wrong section cannot walk through. The agent is told, so its work in a closed section comes back as visible reference material it cannot edit, and the image generator asks the same question BEFORE it pays for an image. The client can hand a section back, and is the only one who can, since no agent lifts its own lock: without that way out, one early correction in budget and timeline would freeze that section for the life of the project and a budget agreed later in conversation could never reach the page. It shipped, came straight back out on a red test tier, and re-landed the same hour with the cause fixed, which was three image tests reaching a real database because the guard is a call with its own binding that the usual patch never touched. The live read stays, because weakening it to the turn's own snapshot would let an image land in a section the client closed while the turn was still running.
A Friday of 9 commits, and the through-line is the link that knows where you were. Every ping we send about a project, in the inbox, on the phone and in the browser, was linking at the front door rather than at the project, so somebody tapping review shortlist landed on the lobby and, if they were signed out, on a blank guest home. All three go through one arrival hop now that reads the session and either lands them or carries the project through sign-in. The text needed a short spelling of that hop for a reason worth stating: past one segment the composer gives up the LINK rather than bill twice, so every text would have gone out linkless and nothing would have errored. The new public route was caught by the ledger that exists to notice one, within minutes of the push, and only the fast tier went red. Two chat-room pages about somebody confirming they sell rather than hire came out, while the worklist flag they announced stayed exactly where support already works it. And correcting one line of the brief now closes that whole SECTION to the agent, with the client the only one who can hand it back.