- The card that books a call could not reach almost anybody, and the reason is that we had never written the address down. A signed-in Fiverr buyer is a number to us, never an address, and this codebase had deliberately never kept the address the sign-in itself attests to, on an identity-hygiene policy written long before anyone needed to send a client a calendar invitation. So the question the card asks before it offers to book, do we have somewhere to deliver this, was answering NO for very nearly every real signed-in buyer and not only for guests, and every one of them got the vendor's pop-up window instead of booking inside the conversation. That is the bug that was reported. The exception is now legally cleared and scoped to exactly this one use: a new table of its own, one row per person, written on every sign-in, and deliberately NOT a column on the identity table, because that table carries a blanket read grant to the warehouse that this address must never ride. A guest, who by construction can never have one, is now sent to sign in rather than to the vendor's page, so we stop recording a booking claim for a booking that could not have happened.
- Then the address turned out not to be arriving at all, and the fix for that went in and came straight back out within twelve minutes. Every recent sign-in was logging an empty address, and not an unverified or an untrusted one either, which is a different and more embarrassing fact: the sign-in request had never ASKED for it. Requesting it is safe in both directions, because a permission this client is not registered for is silently dropped rather than refused, so it is a no-op until Fiverr's platform team grants it. It was reverted the same hour regardless, so the live path is the other two sources rather than this one. The address now resolves from three places in order: the identifier itself where that happens to be an address, the attested capture at sign-in, and the profile the gateway hands over. Where NO source has one, the card asks in the conversation, plainly, instead of quietly opening a vendor page, and the answer is kept only when the booking actually succeeds, so a mistyped or refused address never gets into the store. The ordering bug that would have made Confirm fall through to the pop-up anyway, in exactly the case the inline question exists to prevent, was caught before it shipped rather than after.
- A card is frozen the instant it is written, so signing in could never change the one already on the screen. A guest is redirected into sign-in mid-booking, exactly as designed, comes back to the same conversation, and the card in front of them STILL pops the vendor window, because the message was written once and nothing about signing in has any way to rewrite it. Cards carry a version now: a sign-in mints a genuinely new one, a second sign-in mints another, and every older version still recognises a click, so nothing already on screen breaks. And the refresh was racing the very fetch it depends on. Confirmed live on preprod, the refreshed card landed 2.2 seconds BEFORE the profile fetch that carries one of its three addresses, so a buyer whose address was sitting in that profile a moment later still got an unbookable card and the pop-up. The refresh moved to run after that fetch, whether it succeeded, failed, or was skipped for want of a token.
- And the meeting invitation itself was addressed to a number. A signed-in Fiverr buyer's display name is minted from their numeric id, and the booking handed that to the calendar vendor verbatim, so the meeting in both calendars read as seven digits and the host. The invitee name now resolves the way every talent-facing message already resolves it, through the About You profile, then the account name guarded against that minted default, then the gateway identity, then the Fiverr handle, with the real address as the honest last fallback.
- A talent search put a Rhode Island photographer on an on-site job in Fox Island, Washington, inside a ten-mile commute. The country filter had held perfectly, all three rounds, US throughout. A country is not a place. The seller's time zone had been sitting on the candidate unused, resolved for 113 of 113 US sellers probed that day, while the grader's own instructions have promised to show country AND time zone on the evidence line since 14 August, so the on-site condition came back "unknown" every single time and nothing ever failed loudly. The seller line prints the zone beside the country now, or says the zone is unknown so that silence reads as silence; the on-site rule spells out what a zone means, that being somewhere else is a NO and being inside or unreadable stays a question to confirm; and the gig description on the card grows from 420 to 2,000 characters, because the half that was being cut is exactly where sellers say where they shoot and whether they travel. It shipped, was reverted twenty minutes later because a second byte-for-byte copy of the same instructions lives in a generated file and a test caught the drift, and re-landed with both copies regenerated together.
- Measured on production: 98.5% of the database was being spent on the reports, and 1.5% on the people using the product. On an instance already sitting at 90% CPU. The read-only reporting aggregates plus the warehouse export were the 98.5%, so a second read-only copy of the database now carries them, which is the one capacity change that costs the original nothing and no downtime to make. Underneath it, four measured cuts. The rollout board's since-launch spend tile had been re-adding every model call ever made, once a minute, 6.4% of the entire database on its own; it keeps a running total now and adds only the last hour, which also makes it honest again, since the ninety-day cleanup had quietly been taking rows out from under a number labelled all-time. The boards recompute every fifteen minutes rather than every minute. The log line written for every model call had been carrying the whole prompt, roughly 7 of production's 10 gigabytes of logging a day, with the fattest calls rejected outright at the 256KB ceiling so their cost and token counts were lost entirely; the sizes stay on the log and the text lives where an operator actually reads it. Around all of that: a maintenance window with the experiment period denied, since a restart on a high-availability instance is a minute of failover at whatever hour it picks; per-service query time limits, applied per connection rather than to the role, because the role is also the one that runs multi-minute migrations; request rate limiting switched on; and a daily model-spend page at $18,000 with quiet warnings at 8, 12 and 15 thousand.
- On my own side: an entire admin page and the five-minute job feeding it were deleted, because nobody needs it enough to pay for it. Seven whole-population group-bys over ninety days of trace data, every five minutes, the heaviest recurring load on the database; two overlapping copies of it pinned production's CPU at 0.999 on 2 September, and the guard added since only bounded the worst case. Gone end to end: the aggregate, the snapshot, the grade, both routes and their wire models, the worker cron and its endpoint, the scheduled tick, the metric, the degrade seam, the permission area on both sides of the wire, and the console page with its route, queries, icon and tests. About 6,900 lines removed against 95 added. A migration deletes the permission rows as well, and they had to go rather than linger, because the permissions audit types every stored row against the list of areas, so one leftover row would have turned that endpoint into a 500 the moment its value left the list. The small 24-hour health tile on the Launch board is a different thing and stays.
- Where a project came from is one column and one grouping now. Fiverr's own surfaces hand a buyer over with the name of the experiment arm they were in, beside the source they arrived from. It lands in three places: a creation stamp on the project row, exactly like the device and the country already there; the server-side journey lines for landing, get-started and completed-login; and every client-side event, so the warehouse can slice by arm. Deliberately NOT a fixed list of names, because the arms belong to the sender and a new one has to keep working with no release on this side, so the value is only sanitised and never folded into something we already know. It survives the awkward arrival too, where somebody clicks a link, is redirected, and only creates their project minutes later.
- The console got a money bound on the funnel and a meetings column on the listing. The funnel can now be read for the projects whose committed budget sits between two figures, the same way it can already be read for one device or one origin country, and over the same figure the money funnel itself sums, so "projects between $500 and $5,000" and "the budget flowing through the funnel" agree on what a project is worth. A project with no readable budget is KEPT by any bound, since it is neither over it nor under it, and dropping it would silently shrink the count to the subset that happened to state a number. An inverted pair is a refusal rather than an empty chart, and a control left at its default is not a bound at all, so an untouched page stays on the cheap precomputed lane. Separately, the project listing gained a meeting column and a filter by verification tier, so finding which projects have a meeting stopped meaning opening them one at a time.
- A refresh in the middle of a search stopped rewinding the waiting page to step one. One of the paths that paints the page on the very first frame, the one taken by a refresh inside the discovery window before the first progress snapshot has been written, was seeding the stage but not the stored copy of the search's own progress. So frame one drew the step-one checklist and headline and then jumped to the real step about a second later, once the slower bootstrap caught up. Every other path already seeded it; this one now does too.
- And the housekeeping, which on this day was most of the infrastructure: a partitioned history table, and a backfill that has been shipped and idle since the day it landed. The event history became partitioned, the second half of a two-release split, which is safe to roll back to precisely because the previous release already writes the new column and runs against both shapes. Nothing is backfilled: reads span both tables while the old one exists, and the maintenance tick drops the old 8.8 GiB whole about two weeks later. Review took out a redundant second copy of an index and corrected a claim the file made about itself, that the drain never sorts, which it does and must. Meanwhile the firmographics backfill, which recovers a client's company size and stage from records we already hold, had never run once: it is driven by a switch that defaults off and had been set in no environment at all. Measured rather than assumed, 157 of 155,321 buyer records carried a company size, one tenth of one percent against an expected twenty-one, and it is on a clock, because the source ages out after ninety days and the earliest band expires around 1 November. Switched on in production. Around it, preprod got the dataset its warehouse reads, which is empty exactly as production's is and that is the point, since the views need to compile and return no rows rather than fail the whole run; preprod's reporting path was pointed at the extracted service; one named Fiverr analyst can read dev's warehouse, named rather than the 35-member group because one person was asked for by name; and two tables were declared for the Mira-versus-job-post comparison, hand-created before the producer ships because a merge into a missing table would fail that producer's whole hourly run.
A Monday of 25 commits, and the through-line is that an identifier is not the thing it identifies. Eight of the twenty five are one story: the card that books a call could not reach almost anybody, because a signed-in buyer is a number to us and this codebase had deliberately never kept the address their sign-in attests to, so nearly every real client got a vendor pop-up instead of booking in the chat. That got a table of its own, then three sources read in order, then an inline question for the case where no source has one, then a version on the card so signing in can actually replace the frozen one already on screen, then a move of the refresh to after the fetch it had been racing by 2.2 seconds, and finally a name on the calendar invitation, which until now read as seven digits and the host. The same shape ran through the talent search, where a country filter held perfectly and a country is not a place, so a Rhode Island photographer was shortlisted for a ten-mile commute in Washington State. Underneath all of it, the day's heaviest work was measurement turned on itself: 98.5% of the production database was the reports and 1.5% was the product, so the reports moved to a second copy, a spend tile stopped re-adding every model call ever made once a minute, the log stopped carrying seven of ten gigabytes a day of prompt text, and an entire admin page went away for costing more than anyone wanted it. Plus, first thing that morning, the previous day's page on this site rewritten against the 48 commits that had landed after it was published.