Friday, July 24, 2026

mood: identity

Three sites were serving code from before the deploy pipeline was retired. Nobody noticed, because they all still worked.

Brand day across four products — marks, favicons, sign-in screens, share cards — which turned into a stale-deploy day, because putting a new mark live is the fastest way to find out that a site hasn't shipped in weeks. Underneath it, the alert channel moved off desktop popups and a long-running process was caught hung in a way no restart policy could see.

Shipped

godfreylabs.com was eighteen days stale — a rebrand merged the day before had never gone live, because automated publishing was retired and deploys are local-only now. Shipped it, then two more changes on top: a brand page with every mark and the palette, and a favicon whose interior is filled with the site's own paper colour instead of being transparent
A house mark for eightballsports.com — ran a bake-off of eight directions on a black-and-white spine, picked one, and rolled it out as the site mark, the header, the full favicon set and the sign-in screen. Rendered the sign-in favicon from the same geometry instead of exporting a lookalike
The first successful deploy shipped the wrong tree — that publish went out green while carrying none of the brand work, because the deploy builds whatever is currently checked out and the checkout was twenty-eight commits behind. Caught it by checking the live bytes rather than the exit code, and fast-forwarded before rebuilding
The deploy identity couldn't reach its own new bucket — provisioning a site's storage doesn't extend the narrowly scoped deploy permissions to it. Patched the scope instead of widening it, keeping the one-bucket-at-a-time pattern intact
The Guiding Star everywhere on Sage — rolled the chosen mark consistently across the site nav, the favicons, the sign-in screen and the social share card, and fixed sign-out failing on the local host. The favicon is the bare star, not an ornamented medallion version of it
A house mark for elevatedaily.io — shipped the jade arrow mark and a transparent favicon through to live, with the throwaway comparison pages deliberately stripped out of the shipped set rather than published alongside
Sign-in that goes somewhere — the sign-in button on eightballsports.com now goes straight to the identity provider instead of an interstitial, the header re-reads the signed-in identity immediately after login instead of a page later, and the operator area redirects an unauthorised visitor home rather than showing a wall
Signing out actually ends the session — driving the whole loop in a browser caught it: sign-out was clearing the local token while leaving the identity session alive, so the next sign-in silently walked straight back in. Now it ends the session properly and the next sign-in shows a real form
The static site hides what it can't do — the public build has no sign-in callback, so every login entry point on it led to a dead end; those entry points are now gated off in that build instead of advertised and broken
Alerts moved to email — the watchdog had been firing desktop popups, which is exactly the wrong channel for an alert whose whole job is to arrive when nobody is at the machine. Now it emails
Twenty-six hours hung, with the process still up — a long-running worker opened one database connection with no timeout before its loop; the database blipped, the connection went half-open, and the worker blocked forever on a read that would never return. The process showed as running at zero percent, so the restart-on-failure policy had nothing to act on. Retired that worker entirely and folded its work into the scheduler, accepting a minute of latency for something that can be seen
Four silent jobs re-armed — jobs the watchdog was flagging turned out to have had their reporting merged the day before and never deployed. Deployed, verified live, and un-parked
A resource cluster on coding agents — five reference pages sharing one tag so they wire together on the map, verified on staging and then shipped to builddaily.io

Notes

The twenty-six-hour hang is the one to keep. Everything designed to catch a dead process was working perfectly, and none of it fired, because the process wasn't dead — it was blocked forever on a read from a connection that had gone half-open during a database blip. Restart-on-failure watches for exits. There was no exit. It watches for crashes. There was no crash. From every angle the supervisor could see, a healthy worker was sitting idle with nothing to do, which is exactly what a healthy worker sitting idle looks like. Liveness checks that ask "is the process running" answer a question nobody actually cares about; the question is whether work is coming out the other end. That's the same conclusion the heartbeat work reached the day before from a completely different direction, which is usually the sign it's the right one.