- Mira inside Claude stopped asking anybody to log in, and the whole login machinery was deleted rather than switched off. No authorisation server, no registration step, no consent page, no token, no discovery document. A host connects by URL and starts working. What identifies a person instead is the only thing that can on an open door: a key written into the connector address itself, which folds into an account exactly as the old sign-in address did. This is stated plainly rather than dressed up, because a key is an identifier and not a credential, and that is the accepted cost of a door with no lock on it. The one thing that does NOT happen is pooling: a call carrying no key is refused, with a sentence written for the assistant to read out, because sharing one account between strangers would mean any one of them could erase everybody's work with a single delete. The connection itself still succeeds without a key on purpose, since failing at the handshake shows up in a host as "connection failed", which tells the person nothing at all.
- On the same surface, asking to see the market now actually starts a look. Until today the tool that shows live matches was read only: it handed back whatever the agent had last decided to refresh, so somebody could only see real people if the agent happened to have gone looking. Asking now starts the search itself, from the very first message, with no finished and no approved brief, which is the entire point: a person who is hesitating should be shown real talent and real prices rather than asked another question. The refresh claims the same twenty-second slot the workspace uses, so a client asking "who is out there?" and a brief edit landing in the same window buy ONE search between them and not two. In the other direction, the outreach lane left this surface: four tools, the step meter, the finalist cards and a twenty-second poll are gone, twenty one tools down to seventeen, and the approve step now says where that conversation lives instead of offering a tool that no longer exists here.
- WHERE the work happens finally got a name, and it was proven on five hundred real conversations before it was allowed to matter. An on-site brief in Israel had shipped a seller in Greece; an on-site photographer in Washington had been graded "unknown". The cause was that "this work happens at a place" existed nowhere: it was re-guessed per package by the grader, and the country could be relaxed like any other preference. It is now a fact with a home, settled at brief approval and read every turn: at a place, partly at a place, or not at all, plus the place in the client's own words. Before promoting it, it was run twice over five hundred real conversations through the classifier's own path: eleven on-site, none hybrid, four hundred and eighty-nine remote, four hundred and ninety-eight of five hundred identical between the two passes, every non-remote verdict and every keyword candidate read by hand, ten of twelve genuinely on-site jobs caught, the two misses both thin ambiguous chats, and zero false alarms, since "US-based", "prefer local" and "based in Canada" are all preferences about a person rather than places the work happens. It cost $3.31. When the answer is on-site, the client's countries stop being a preference: the search is re-locked to them after the opening filters and after every single round, the agent is told at the top of the brief that the location is the system's and not a lever it can pull, and a talent whose country we do not know is KEPT and marked unknown rather than quietly dropped. It is the one deliberate exception to "no hard gate decides fit", on the grounds that a place the work needs is a capability and not a taste.
- And the same fact was being thrown away at the door. The list of things allowed to travel with an exported brief named four keys, and neither of the two that decide where the work happens, so every imported on-site brief arrived remote no matter what its own text said. Measured on three real imported briefs the same day, a Dallas photography job, a Paris showreel and a Toronto booth: the on-site rule fired zero times on all three, while a hundred and fifty-one sellers were dropped under the ORDINARY country reason. In other words the countries had held only because the model happened to choose them, and it could have let them go on any round with nothing to stop it. The tests written for it deliberately cross both filters rather than checking the wire, because the wire carries the whole blob and a wire-only test passes on the broken code.
- The talent dashboard stopped downloading the warehouse and started asking it a question, and then took fourteen review findings on the chin. Yesterday's fix re-packed the same table more tightly and bought about seventy days; this removes the reason it needed buying. The page now sends what it wants, a range, some filters, an order and a page, and the warehouse answers with about two hundred rows plus the totals over everything that matched. It stays bounded however large the warehouse gets, which nothing that ships a whole table can. Every number is proven unchanged rather than asserted: a script re-implements the old in-browser arithmetic and runs both over the same live rows, and all five cases match. Then the review found fourteen real defects, and almost all of them were one shape wearing different clothes, a page told an answer is coming when none is. A dropped socket, a subscription bound a moment too late, a cursor left pointing into an emptied list, a queue that quietly refused the job, an idempotency key that never rotated so a failed query could never be retried at all. Since there is deliberately no timer anywhere in that path, each one is a spinner that never stops. The response was not another fix: the decisions were pulled out of the plumbing into plain functions, and every one of those cases is now a named test, including the invariant underneath them all, that "waiting" and "failed" can never both be true at once.
- The worst of that batch is a lesson about what used to be free. The seller search box fired a full warehouse round trip PER KEYSTROKE: typing a nine-letter name was nine queries, eighteen warehouse statements, and nine collapses of the whole page to a skeleton and back. Nothing deduplicated them, because the search text is part of what is being asked. Folding the table in the browser had made that free; it is not free any more. A three hundred millisecond delay that has existed in the codebase the whole time, with a comment saying every page sending a search term shares it, now actually does. Typing stays instant; only the QUESTION waits.
- Yesterday's outage became instrumentation, and the theme is that nothing could say who it was. When the production database sat at eighty-one per cent yesterday, working out which page caused it took an hour of matching timing charts by hand, because no statement said which service or which page had issued it. Every statement now carries both, as a small tag the database groups on, and anything running longer than five seconds is written down, which it never was before: of the six loads that took the site down yesterday only the two that were killed left any trace, and the four that finished, at thirty-five to forty-six seconds each, left nothing. On top of that a five-minute tick names the three most expensive statements of each window with the page read back out of the tag. Two claims underneath it were proven against a real database rather than assumed, because both are properties of Postgres and not of our code.
- The sick machine got a name too, which is what nobody could give it yesterday. One machine in ten ran four to ten times slower than its nine siblings and froze for up to a minute and a half, and it read as a problem with the whole release, because every platform measurement is an average across the fleet. The two halves could not be joined: the measurements for a machine and the log lines for the same machine had no shared identifier, since one used the platform's id and the other a number invented at boot. They are the same string now, byte for byte, and two new alarms compare each machine against its own fleet's MEDIAN rather than against a fixed number, so a bad release stays quiet and one drifting machine gets named. The floor on one of them is deliberately not a round number: yesterday's sick instance sat just under where a round number would have been, and would have been watched in silence.
- The tracing was not broken either, it was simply not telling the truth. Only about one request in seven is actually recorded, which is on purpose, but every log line carried a "view trace" link regardless. Measured: four of thirty consecutive links resolved and twenty-six led nowhere. The line now says whether this particular request was recorded, so a reader can tell "not traced" from "trace missing" before spending twenty minutes on it. And a recorded trace could not have answered yesterday's question anyway, because it contained no database step at all: the wrong database library had been instrumented, so a two hundred millisecond page showed a server step and nothing underneath it.
- Two more unbounded reads turned up, and the page that woke somebody at three in the morning was measuring the wrong thing. The per-agent debug feed had exactly the shape that took the site down yesterday, sitting twenty lines below the function that had just been rewritten, hidden by a filter that made it LOOK narrow: 1.7 seconds a call becomes 24 to 98 milliseconds. A missing index turned the account-deletion purge into a full scan of every partition while holding a lock, 545 milliseconds down to one. And an alarm paged at half past eleven on a database that was seventy-one per cent full of a thirty-one gigabyte disk with room to grow to two hundred and fifty: nothing was near full, the threshold was, calibrated a month ago against a prediction of growth that never happened. Left alone it would have re-crossed permanently within a day and a half and stayed red for eleven days, which is eleven three-in-the-morning phone calls that mean nothing.
- The waiting field went through four more QA rounds in a single day, and the arrow that kept coming loose finally gave up its real cause. Rounds three through six, with the designer's own prototype as the reference. Questions became draggable floating windows, stacked by recency like a real desktop, each one named and faced with the talent who actually asked it, which needed the wire to attribute a question to a person for the first time; then the designer looked at it and the question went back to being a card anchored beside its asker, and the whole window system was deleted again the next round. The two columns for searching and reviewing became one, as the design always had them, with the pool drawn as anonymous silhouettes that open into real portraits as the sweep reaches them. And the arrow: it had been blamed on animation twice and re-aimed twice, and the actual cause was that the card anchored itself to the BUTTON rather than to the face, so a caption made the button taller than the circle and put the point on the avatar's lower rim.
- Every behaviour change became something you can dial, read per arm and switch off. Three separate systems for deciding who gets what, cohorts, prompt variants and the little fragments injected into agents, became one thing to set, one thing to watch and one thing to list. Each injected fragment now has three independent dials rather than two fixed modes, every decision is recorded including the ones where nothing was sent, and a version stamp rides every model call, every trace and every log line, so any error, cost or funnel number can be split by arm with no cross-referencing. On top of that foundation, all sixteen conversation handlers, every trigger, every product experiment, the admin console and the connector tools moved onto it in one go, with five coverage checks that stop the next agent quietly stepping off. The reason a change this size could ship without a behavioural test run is that not one prompt byte changed, and that is pinned by a test comparing every template byte for byte.
- Talents were being asked for a quote with no idea there was a clock on it. The client picks how long they will wait, and today the offered set became two, four and twelve hours, per the spec rather than the mock-up. The opening message now tells each talent how long they have, which is the one fact that changes what they do next: a window you cannot see is one you miss for no reason. It is phrased relative to now rather than as a clock time, because talents are all over the world and no timezone travels with the run, and the later wave is told what is LEFT rather than what the window originally was. It also deliberately does not say the opportunity closes, because for anyone who gets a quote in, it does not. That forced one ordering change, arming the window BEFORE the first messages go out, or the whole first wave would have quoted a deadline it did not have. And testers got a live countdown with a control that moves the real deadline to a few minutes, so what they watch is the production close rather than a simulation of it, moving only the deadline and never the client's recorded choice, because faking that would put a decision in the reporting that no client ever made.
- The rest are small, and two of them had been silently wrong for a while. Every scorecard behind a re-run shortlist was blank, forty picks out of forty, because the step that builds them emitted eight fields where the chain below reads sixteen, and every hop mapped the missing ones correctly, so nothing ever complained. They are derived from the grading pass that produced the pick now, rather than by asking the model twice, and the three that genuinely have no source are left empty and documented as such rather than filled with something circular. Our concierge can now answer a talent who asks whether the client picked them, from the recorded fact rather than from a guess, and a conversation that has closed no longer implies somebody else was chosen. The brief-building agent can see saved rates, which it could not, so it read "empty" while another agent was busy protecting a stored yearly rate from deletion. Development deploys had been failing at the migration step since yesterday afternoon, because the migrator imported a name from a module that pulls in the whole database library while the deploy runs on almost nothing. And a preprod infrastructure plan would have silently revoked a working analyst's access to all three datasets, because a permission that lives in the cloud but in no committed file reads as a deletion rather than as nothing at all.
A Wednesday of 34 commits, and nearly all of it is the same idea from different angles: nothing can be measured, matched or trusted until it says who it is. Every database statement now names the service and the page that issued it, and anything slow gets written down, which is exactly what nobody could establish during yesterday's outage. A sick machine's measurements and its log lines finally share one identifier, so a single bad machine can be named instead of reading as a bad release. Every question on the waiting field carries the face of the talent who asked it. Where the work physically happens became a fact with a name, proven on five hundred real conversations before it was allowed to change anything, and locked so the search cannot let it go. A shortlist scorecard is filled from the grade that produced it instead of arriving blank forty times out of forty. And the connector inside Claude deleted its entire login apparatus in favour of one thing that says who the person is, refusing to serve anybody it cannot name rather than quietly pooling strangers into a shared account.