Building thoughtful software with AI.Notes from the systems behind the work.
A production restore came back without the default-privilege rule that lets my app use newly created tables, so the deploy migrated first and failed afterward. Now a read-only catalog check stops it before anything changes and prints the grants for a person to run.
Read moreMost of my product rename was harmless text, but a few names were load-bearing, and the copy script for the telemetry keys may not do what its own check says.
Swapping a local copy of billing state for plan entitlements in the session was the right call, but it left the free-tier seat cap answered by three pieces of code that disagree, a random retry key on customer creation, signup that now depends on the payment provider, and billing endpoints that trust whatever organization the request names.
After swapping my own key verifier for a hosted identity provider, every ingestion route still declares a required scope that nothing enforces, and revoked keys, rotation and attribution changed underneath it too.
The per-tool cost chart now reads two typed views instead of parsing every raw log row, the migration that builds those views errors on a leftover instead of skipping it, the documented session join filters by organization on both sides, and the drift check covers more token types but still only warns.
A commit collapsed the app's org roles to admin, manager and member. The script header said executives become managers, the SQL made them admins, and the new ranking code treated them as members.
The agent re-keyed staff chore preferences from names to IDs and normalized them at every stop, but on the store-admin page the digit pattern lived inside the wrong function, so saving any preference threw until an unrelated branch merged later that afternoon put one in scope.
Turning chores into templates forced a real upgrade path that asks the database what it has before adding anything. Reading the diff, I found a second route to the wipe still open and a backfill that can get stranded.
Promoting tenant ids out of a telemetry map into indexed columns went from computed-from-the-row, to a collector copy step that kept the collector from starting and likely left history empty, and back. What I can and can't verify about which version is live.
Some of my databases name the lookup key column differently, and since SQL won't bind a column name, I pick it from a two-item list in the code by asking the schema, then let each caller decide what a miss means.
A random IV per encryption meant my lookups were searching for a value that never existed; the follow-up scan works but decrypts the table on every sign-in, and a forgiving decrypt now hides a wrong key.
Four versions of the shift scheduler's move from flat files to a database got a read-through. Every one keeps a delete-everything save that runs into foreign keys or orphans rows and reads and writes staff under different names, so a plain save can wipe the admin flag. The MySQL ones also ship a setup that only works once.
Rereading a day of my own commits, I found that a failed read in my break scheduler shows an empty list, and the next edit writes that emptiness over the real file. Old files and error replies take similar wrong turns.