liveapp: priorities

[lukaso-bot]

Priorities for this app

This is the liveapp priorities control panel. The loop uses priorities.md as its north
star — but treats it as a dated hypothesis, re-examined when the evidence moves, never as
permanent truth. This panel makes it visible and lets you steer it without editing files.

Last re-tune (already applied)

The loop keeps these priorities current by itself — a priority it judges satisfied comes off
the list without waiting for you. This is what it changed most recently:

2026-09-04
priorities: re-tune (dreaming, 2026-09-04T20:18:45.095Z)


 priorities.md | 83 +++++++++++++++++++++++++++++------------------------------
 1 file changed, 41 insertions(+), 42 deletions(-)

Every re-tune is announced as a comment on this issue, labelled user fyi.

To steer the priorities

Comment steer priorities: <what should matter more/less> — e.g.

steer priorities: the Telegram flows matter more than layout guards right now

and the loop folds it into priorities.md and reflects it into the next cycle.

To stop automatic re-tuning altogether, comment reflect off.

Only you can do this: comments from the loop itself, or any bot, are ignored — it can
never re-tune its own priorities.

This loop runs as @lukaso-bot. Commands from @lukaso-bot are ignored — only other accounts can steer it.

Current priorities.md (last changed: 2026-09-04; the last pass judged the previous document DRIFTING and re-tuned it)

Priorities

What released is, what must never break, and where it hurts today. Inferred from the code on 2026-06-25; re-examined 2026-08-24, 2026-08-27, 2026-08-29, and on 2026-09-04 against live signal (production probes, open issues, recent loop journals). The last two passes were unanchored re-derivations.

What the product does

Answers "which release first contains this commit?" for GitHub and a curated set of GitLab hosts. No clone. Four surfaces, one algorithm (packages/core/src/find-release.ts):

• Web (packages/web) — paste a commit/SHA/PR/MR/issue, get the first release tag, a shareable permalink, and an auto-updating badge.
• CLI (packages/cli, npm git-released) — same answer in a terminal, including private repos via a host-scoped token.
• Badge (/…/badge.svg) — shows "not yet released" and flips to the version tag automatically once a release contains the commit.
• OG renderer (packages/web-og) — PNG unfurls for permalinks.

Critical user journeys

1. Web lookup → permalink → share. Paste any GitHub commit URL / bare SHA / PR / issue, or a federated GitLab commit/MR. Get the first containing release + also-in list + shareable /r/… or /h/… permalink. The whole algorithm runs in the Worker under a wall-clock deadline. The homepage is the front door and the share is how the product spreads — the unfurl is the tail of this journey, not a separate feature.
2. CLI lookup. npx git-released <input> → first release. Human, --json, --slack, --markdown output. Exit codes drive scripting.
3. Auto-updating badge. Embedded in PRs/READMEs. Correctness here is a cache problem as much as a lookup problem: not-yet must be short-cache so it flips; released must be long-cache.
4. Federated GitLab (gitlab.com, GNOME, KDE, Debian, freedesktop, Kitware). Anubis-protected hosts (freedesktop/GNOME) route provider fetches through the container relay; if the relay is unavailable they must degrade to the "use the CLI" card, never hard-fail.
5. PR/MR as input. Resolve to the merge commit, then find its release. PR title becomes the headline.
6. Private repos (CLI). Token resolves per host and is never sent to a host that didn't issue it.
7. Bulk lookup (POST /api/lookup-bulk) — many inputs, shared deadline and tag-list memoization, capped at MAX_BULK.

What must never break

Correctness and safety invariants, not features:

• First-release correctness. Sort tags by date ascending; never filter by date for containment. Ancestry (/compare) is the sole containment test. The gallop+bisect fast path and the containingTags shortcut must return the same answer a linear scan would. (CLAUDE.md "Algorithm guardrails", D24.)
• Partial ≠ not-released, and partial ≠ terminal. A soft-deadline timeout surfaces a best-effort answer with a caveat, not the not-released UI — and it must not be cached as if the traversal had completed. A partial carrying a galloped firstRelease is an unconfirmed answer, so it has to stay revalidatable. Broken on main today. (partial-with-a-gallop-hit is cached as terminal: 30-day TTL, never revalidated #155/partial-with-a-firstRelease is cached as terminal on the web + badge surfaces (30d / 24h), so a truncated traversal pins a possibly-wrong tag #159)
• Token host-scoping. A credential only ever goes to its issuing host. No generic token as a cross-host fallback (except GITLAB_TOKEN for gitlab.com by design). Security boundary.
• A token-derived answer must never land in an anonymous shared slot. Host-scoping governs where a credential goes; this governs where the answer it bought is stored. The result cache key has five parts and none of them is auth, so this invariant does not hold on main. (PAT-computed results are cached in a public, auth-agnostic key namespace #164)
• Release-notes sanitization. Provider release bodies are untrusted HTML. Strip <script>/<svg>/<iframe> and javascript: URIs before render.
• Cache semantics on every auto-updating artifact — badge and OG card. Released → long cache; not-yet/checking → short cache. Get it wrong and the artifact stops flipping when the release lands. The badge honours this; the OG card does not. Stated for badges alone, this invariant read as satisfied while the identical bug shipped on a second surface. (OG card for a not-yet-released commit is cached 24h, so it never flips when the release lands #151)
• Graceful degradation. Rate-limit, upstream-down, and Anubis-block paths show a recovery card (try-again / CLI-hint), never a stack trace or the wrong "not yet released."
• Order of Worker publication. web before web-og (the Service Binding must exist). Publication is owned by CI on a push to main.

Current pain

The queue is frozen, and that is the whole story

Nothing has reached production in 14 days. main is still 0ee8e68, the live Worker matches it, the last merge was 2026-08-21, and the last human action on the repo was filing #154 on 2026-08-27. All four open PRs (#144, #153, #158, #163) are MERGEABLE, gates green, zero unresolved review threads anywhere. Every fix on this board exists only in a branch.

The loop has reported WIP limit reached (4 open PRs, limit 3) and ended idle on every cycle since 2026-08-29 (journals 09-01, 09-02, 09-03). Two of the four PRs holding that cap are one-click Dependabot merges (#153 npm-minor-patch, #163 changesets/action) — merging just those two unblocks the loop without touching any product code. That is the cheapest thing anyone can do on this repo right now.

The binding constraint is merge latency, not defect-finding. The highest-value work the loop can do is make each PR easier to merge; the second-highest is not to add to the pile; the third is work that does not consume a PR slot at all (see the probe item below). Filing another defect is the lowest-value thing available.

Severity order for whatever merges next

• PAT-computed results are cached in a public, auth-agnostic key namespace #164 — a private-repo answer can be served to someone with no access, on main, today. /api/lookup honours a caller-supplied X-User-Github-Token, then writes the result under ('res', host/path, sha|pr|issue, cull|strict, nopre|pre) — five parts, no auth component — and issue.tsx, pr.tsx, result.tsx read that same slot anonymously on public permalinks, title included. Pre-existing and reachable now; no open PR widens it and no open PR fixes it. It is the only confidentiality-class defect on this board, it outranks the entire OG cluster by severity, and it has sat 7 days with no branch. Two small fixes exist: namespace PAT-computed lookups, or don't cache them. When a PR slot opens, this one goes first.
• Dependabot's weekly npm run wedges whenever a patch is 3-7 days old: cooldown default-days (7) exceeds semver-patch-days (3) #161 — the only dependency channel this repo has is wedged, and there is no second one. The weekly Dependabot npm run fails on the grouped job (reproduced 2026-08-28, job 33214471336). Mechanism, corrected and settled — do not re-derive: pnpm applies minimumReleaseAge to the whole resolution graph, so a patch admitted under the 3-day window drags in a transitive package newer than the 7-day window used by a later non-patch step, which kills the job. The fix is to make the two cooldown values equal; dependabot.yml is engine-managed, so it is routed upstream. Behind this, Dependabot security alerts are disabled on the repo (403) — the osv CI gate still detects High/Critical, but detection with no update path is half a control. hono ^4.12.32 carries four MEDIUM advisories fixed in 4.12.34 and no PR exists; bumping it by hand is a local call.
• The OG / /internal cache-and-keying cluster — ten of the fifteen open defects, all parked behind merge. It sits on critical journey Build /how-it-works page #1 (the share), it is real, and none of it came from a probe: every one came from reading code or reviewing the fix for the previous one. One line each, detail in the issues: cold unfurls serve the placeholder and do not self-heal (Cold-cache OG unfurls serve the placeholder again (#53 regression) — probe is blind because it re-warms its own fixtures #143); cards key on a 7-char SHA while permalinks key on the full SHA (OG cards key on a 7-char SHA while permalinks key on the full SHA — the first unfurl never reuses the warm slot #147); /internal/* 503s on a not-yet-released commit so the crawler keeps the placeholder (OG unfurls of a not-yet-released commit serve the neutral placeholder permanently (/internal 503s on NotYetReleasedError) #150); the not-yet card is pinned 24h so the one card whose job is to flip does not flip (OG card for a not-yet-released commit is cached 24h, so it never flips when the release lands #151, PR fix(web-og): cache the OG card by terminality, not by result presence (#151) #158 fixes it); /internal/* has no deadline, so a large repo's first unfurl runs ~20s and the crawler caches the placeholder (/internal/* blocks on findRelease with no deadline, so the FIRST unfurl of a large repo hands the crawler the placeholder #152); a partial-with-a-gallop-hit is cached as terminal for 30d and reported fresh forever (partial-with-a-gallop-hit is cached as terminal: 30-day TTL, never revalidated #155, re-filed as partial-with-a-firstRelease is cached as terminal on the web + badge surfaces (30d / 24h), so a truncated traversal pins a possibly-wrong tag #159 — still to be closed as a duplicate with its badge.ts:141 half moved onto partial-with-a-gallop-hit is cached as terminal: 30-day TTL, never revalidated #155); deadline-heavy repos get a blank card plus one full traversal per minute after fix(web): align /internal/* result cache with the public routes (#143) #144 (Deadline-heavy repos get a permanently blank OG card and one full traversal per minute after #144 #156); the back-off bypass re-stamps the neg marker and starves human page views of a retry window (/internal/* back-off bypass re-stamps the neg marker, starving human page views of a retry window during an outage #157); ResultCard ignores result.partial, so a truncated traversal unfurls as a final answer (web-og ResultCard ignores result.partial, so a truncated traversal unfurls as a final answer #160).
• Unverified premise under #144: caches.default may be invocation-scoped, which would make the /internal key-URL fix inert #162 — fix(web): align /internal/* result cache with the public routes (#143) #144's central premise is unverified, and if it is wrong the PR changes nothing. caches.default may be scoped to the invocation rather than to the URL passed to match()/put(), and a Service-Binding invocation arrives as the non-routable https://web/.... Nothing currently discriminates: unit tests use an in-memory store, the workers.dev preview is not a custom domain, the docs are silent. A fix exists that holds under either hypothesis — have web-og call the binding on PUBLIC_BASE_URL instead of https://web — and it removes machinery instead of adding it. Nineteen review rounds went into fix(web): align /internal/* result cache with the public routes (#143) #144 before anything asked whether its premise held, and its empirical test needs fix(web): align /internal/* result cache with the public routes (#143) #144 live. This is the merge-decision question, and it is the human's: a +2526/−69 PR resting on an open premise is harder to merge than the small alternative.
• Preview OG Worker renders the neutral card for every input — og-preview can't reach web-preview /internal (likely INTERNAL_SECRET unset on preview) #148 — the per-PR OG preview is structurally blind, so no OG fix in the queue can be preview-verified. Measured on fix(web-og): cache the OG card by terminality, not by result presence (#151) #158's preview: a real result → 200 but 14348B, max-age=60; a nonexistent SHA → 15001B, max-age=60; production is 28899B long-cached. Same neutral treatment for both ⇒ PlaceholderCard for everything, almost certainly INTERNAL_SECRET unset on preview. The fix is the human's: wrangler secret put INTERNAL_SECRET on both released-web-preview and released-web-og-preview, same value. It gates fix(web): align /internal/* result cache with the public routes (#143) #144, fix(web-og): cache the OG card by terminality, not by result presence (#151) #158, and anything after them.
• Does released CLI need a new version? #154 — the published CLI differs in behaviour from main, and the version call is the human's. Answered 2026-08-27 against the published tarball: eb014fd (the popular-projects removal) deleted the alias shorthand from packages/core/src/parse-input.ts, so main no longer accepts <alias> <sha> for the 13 catalog aliases, while git-released@0.2.0 on npm still does. The open decision: 0.3.0 shipping the removal, or 0.2.1 restoring the aliases in core. The durable gap underneath is unfixed — nothing states when a CLI version is cut. Proposed rule: any PR touching packages/cli/src or packages/core/src ships a changeset for git-released, enforced by a CI check. @released/core is ignored in .changeset/config.json, which is exactly why a core-only diff shipped a CLI behaviour change unnoticed.

The green probe is lying about OG, and fixing that costs no PR slot

On 2026-09-04 all 30 journeys passed, including all six OG renders as real-result PNGs, with 0 SYSTEM errors over 24h and 7d against 9596 AE events/24h and a 95% result-cache hit rate. That green is real for the front door and worthless for OG: the probe re-requests the same fixed OG URLs every cycle and so keeps exactly those warm. A probe that warms its own fixtures measures only that it warmed them.

• The health-map's named UNCOVERED seam — cold-input OG render — has been open since 2026-08-17, eighteen days. The reason recorded for it losing every cycle ("drained review threads") expired on 2026-08-29: threads have been at zero and the loop has idled every cycle since. The probe lives in $LIVEAPP_STATE_DIR/bin/liveness-probe.mjs, outside the app repo — building it opens no PR, consumes no WIP slot, and is not blocked by the merge queue. It is therefore the correct work for an idle cycle at the cap, and "WIP limit reached" is not a reason to skip it. A real guard needs one of: a genuinely cold input each run (a SHA/PR never requested before), or an assertion on the tell. The cheap tell got more expensive — once fix(web-og): cache the OG card by terminality, not by result presence (#151) #158 merges, max-age=60 no longer means "placeholder" (a real not-yet/partial card is short-cached by design), so pair the header with the byte-size floor, or keep fixtures on stably-released commits.
• A guard must assert the tell that distinguishes a real answer from the fallback. The cold-OG bug hid behind a 200 and a valid PNG. Status codes and non-empty bodies are not evidence; the cache header, the byte size, and the rendered value are.
• The standing program when the board is empty: iceberg detection. Every recurring top catch has been failures invisible while the front door is green (PRINCIPLES Build /bulk page (or remove the broken link) #3) — the bare-500 app.onError backstop (fix(web): app.onError backstop — uncaught exceptions degrade gracefully AND surface in the error history #99), the blank-PNG OG regression (fix(web-og): real per-commit OG card rendered a 0-byte PNG (blank unfurl) #56), an issue-badge route with no probe, and the whole cold-OG cluster (Cold-cache OG unfurls serve the placeholder again (#53 regression) — probe is blind because it re-warms its own fixtures #143). Event-driven rule: when a new route or input kind ships, re-derive the health-map inventory and add a read-only probe the moment it lands; when a new ReleasedError class is added, add it to CLIENT_ERRORS by class name so it reads as expected input, not a SYSTEM error. The map decays within about a week of a feature shipping — assume decay, re-derive rather than trusting the last "zero uncovered".

Review rounds on an unmerged PR open more issues than they close

#144 has run nineteen rounds since 2026-08-17 and is still unmerged. Round 10 produced #156 and #157; reviewing #158 produced #159 — which is #155, already open three days, found again from the other end; round 16 produced #162, which asks whether the PR works at all; round 18 produced #164. The findings are real (#164 is the most severe thing on this board), but they are findings in adjacent, untouched code, surfaced because a reviewer was reading files the PR happens to touch. This is where nearly all of the loop's non-idle time has gone. Two responses, both working and worth keeping: smaller, single-issue PRs off a freshly-fetched main, and check the open queue before filing — a defect found twice is one issue with a second reference. A PR the human can read and merge in one sitting is worth more than a PR that fixes everything.

/internal/* keeps producing defects on inspection, which reads as under-designed rather than merely buggy. Four open defects (#150, #152, #156, #157) are on that one route and none came from a probe. It deserves one deliberate pass over its deadline, cache, and back-off semantics — after the queue drains, not stacked onto #144.

Structural constraints — currently green, watch and mitigate rather than grind

• Anubis relay is fragile (latent). Depends on RELAY_SECRET, a built container image, and the CI token carrying Containers/Cloudchamber edit. If any is missing, freedesktop/GNOME silently fall back to the CLI card. Both relay hosts probe green each cycle; the fragility is structural, not an active break. Deadline-heavy repos get a permanently blank OG card and one full traversal per minute after #144 #156 and /internal/* back-off bypass re-stamps the neg marker, starving human page views of a retry window during an outage #157 both land load on this same max_instances = 1 singleton.
• Worker wall-clock vs huge repos — the constraint keeps reappearing on paths that never had a deadline. kubernetes-scale (~1700 tags) forced gallop+bisect and the containingTags shortcut on the user-facing path. The same constraint is un-mitigated on /internal, which has no deadline at all (/internal/* blocks on findRelease with no deadline, so the FIRST unfurl of a large repo hands the crawler the placeholder #152), in how a truncated traversal's result is cached (partial-with-a-gallop-hit is cached as terminal: 30-day TTL, never revalidated #155), and in what a refused partial costs upstream (Deadline-heavy repos get a permanently blank OG card and one full traversal per minute after #144 #156).
• The osv override floors on main are load-bearing and unguarded. They keep the dependency gate green; a grouped Dependabot bump can rewrite them and no executable guard would catch it. A silent loss re-opens the CVE arc that closed 2026-08-20.
• Unauthenticated GitHub rate limits on the web path. Structural; monitored via the AE error history (self-probe lookup_timeout is expected weather — a real signal only if it far exceeds ~1/cycle).

Shipped / no longer pain (status only — do not re-litigate)

• Homepage popular-projects (Popular projects leads to dead end #125) — cut and merged (PR Remove the popular-projects chips feature (#125) #128, 2026-07-31). The feature "doesn't earn its keep" (OWNER 2026-07-30); alias catalog + chips removed, BareShaError kept as general input validation. Its CLI side effect is what Does released CLI need a new version? #154 is deciding.
• The High-CVE / osv arc — closed 2026-08-20. Override floors reached main, osv dependency scan is green, osv gate fails on main's lockfile: 3 High advisories (nanoid, js-yaml, undici) block every PR #145/fix(deps): raise override floors to clear 3 High advisories (nanoid, js-yaml, undici) #146 closed. Do not re-derive an older "un-published security fixes" framing. (Latent follow-up: the floors have no guard — above.)
• Branch previews (liveapp needs you: Branch previews — cloud steps for you (issue #70) #131) — operational. Isolated preview Workers (released-web-preview + released-web-og-preview) deploy per non-Dependabot PR via preview.yml + [env.preview]; the DO wall is cleared by re-declaring GitlabRelay with ANUBIS_HOSTS="". Human finished the preview-secret + GitHub-app setup 2026-08-04. The relay is deliberately off in preview. The OG-blind preview is tracked as pain above (Preview OG Worker renders the neutral card for every input — og-preview can't reach web-preview /internal (likely INTERNAL_SECRET unset on preview) #148), not as a residual caveat.
• OG delivery mechanics. The domain (OG images unreachable in prod: og.released.blabberate.com has no DNS record (broken social unfurls) #50), the dynamic render (fix(web-og): real per-commit OG card rendered a 0-byte PNG (blank unfurl) #56), the deferred cold-share shell (feat(web): real per-commit OG card on cold-cache unfurls (#53) #55), issue/PR-aware cards (feat(web): issue/PR-aware OG card shows the fixing title (#79) #92), the CI render guard (test(web-og): render OG cards under workerd so a blank PNG fails the gate #124), and the cache-control override fix (fix(web-og): stop workers-og's 1-year immutable default overriding OG cache-control #141) are merged and live. The rendering works; the caching and keying around it do not — that is the open cluster above.

Open deferred work (open issues)

Human/demand-gated — do not pick up on a routine cycle:

• More VCS providers — CLOSED as a direction (Add Bitbucket / Gitea / Forgejo / Sourcehut providers #5, Auto-discover unknown GitLab hosts via /api/v4/version probe #9). The OWNER steered 2026-07-26: do not add any additional git/vcs providers until there is demand. Bitbucket (feat(core): add Bitbucket Cloud provider #117) and Gitea/Forgejo (feat(core): add Gitea/Forgejo provider #111) were closed "won't do until there is demand"; /api/v4/version auto-discover (Auto-discover unknown GitLab hosts via /api/v4/version probe #9, wontfix) and per-host PAT UI (Per-host PAT UI in the web app #7, blocked) stay demand-gated. Not a resumable queue — scope is frozen on GitHub + the curated GitLab hosts. Leverage is in making the existing surfaces excellent, not expanding them.

Test gates

pnpm -r test, pnpm -r typecheck, pnpm -r build. TDD: failing test before implementation. Algorithm changes get a find-release test first.

Human steer (2026-07-26)

• don't add any additional git/vcs providers. Until there is demand, we stick with the one that we have.

[lukaso]

steer priorities: don't add any additional git/vcs providers. Until there is demand, we stick with the one that we have.

[lukaso-bot]

🧭 Recorded your steer into priorities.md — the next reflection will fold it in.

[lukaso]

steer priorities: adopt the priorities retune

[lukaso-bot]

✅ Applied the proposed priorities re-tune.

[lukaso-bot]

The loop re-tuned priorities.md (antimonopoly pass) and applied it — no approval needed.

What changed

No longer a priority

• from the code on 2026-06-25; re-examined 2026-07-29 against live signal
• (production probes, open issues, recent loop journals). Correct anything that's wrong.
• door of the product** — every new visitor lands here, so the lookup-from-home
• path must not dead-end (see Current pain).
• Homepage popular-projects dead-ends (issue Popular projects leads to dead end #125, OWNER, 2026-07-29).
• Clicking a popular-project chip (e.g. "typescript") pastes a bare project
• name into the lookup bar; "is it released?" then errors — the lookup
• expects a commit/SHA/PR/issue URL or repo path, not a name. This is the front
• door (CUJ Build /how-it-works page #1) producing an error on the first thing a new visitor is
• encouraged to try. Owner's question — "does this feature do anything for
• anyone?" — is itself a product-direction call. Either the chip pastes a real
• lookup-able input (a recent commit / the repo's default-branch tip) so the
• lookup succeeds, or the feature is removed. **Highest-leverage current item:
• a defect on the primary entry surface beats any refinement to a shipped
• feature.** *(HOLD on the remove-vs-fix product call — the human decides; the
• …and 39 more

Now a priority

• from the code on 2026-06-25; re-examined 2026-07-31 against live signal
• (production probes, open issues, recent loop journals).
• door of the product** — every new visitor lands here.
• The actionable front-door pain has been drained: the homepage dead-end (Popular projects leads to dead end #125)
• is decided + shipped as PR Remove the popular-projects chips feature (#125) #128 (green, mergeable, awaiting the human's merge),
• and the OG-unfurl arc is done and verified live. What remains is **chronic
• structural constraints** (all currently green in production) plus a cluster of
• human-action-needed setup* issues — none of it routine-cycle work. Treat the
• lists below as watch / mitigation, not a queue to grind on.
• Human-gated setup cluster — the live open-issue weight. Four open issues,
• all [user action needed], all blocked on the human's Cloudflare/GitHub
• config: branch previews (liveapp: wire branch previews (your Worker) #70 → liveapp needs you: Branch previews — cloud steps for you (issue #70) #131), protect the default branch (liveapp needs you: Setup needed: protect the default branch 'main' #129), and
• the repo's merge method (liveapp needs you: Set the repo's merge method (one-shot) #130). Branch previews in particular would close a
• recurring friction — every PR triage currently notes "no preview URL to
• exercise," so the loop validates against a local gate but can't prove a
• …and 20 more

priorities.md | 97 +++++++++++++++++++++++------------------------------------
 1 file changed, 38 insertions(+), 59 deletions(-)

Re-tunes are automatic. Steer with a whole-comment steer priorities: …, or stop them with reflect off.

[lukaso-bot]

priorities.md was updated.

Now a priority

• The front-door pain is fully resolved: the homepage dead-end (#125) was cut and merged via PR #128 on 2026-07-31 (#125 closed), and the bare-SHA 500 (#127) merged the same day. The earlier feature arc (issue/PR input, OG unfurls, cold-share cards) is merged and verified live. The open-PR queue is empty — the human drained it. What remains is chronic structural constraints (all currently green in production), one human-action setup item, and a standing program of iceberg detection that has been the loop's recurring top catch. Treat the lists below as watch / mitigation, not a queue to grind on.
• The standing program when the board is empty: iceberg detection. When prod is green and scope is frozen, the highest-leverage discretionary work is catching failures that stay invisible while the front door is green (PRINCIPLES #3). The loop's recurring top catches have all been this class: the bare-500 app.onError backstop (#99), the blank-PNG OG regression (#56), an issue-badge route that had no liveness probe, and the prod-errors classifier missing new error classes. The health-map decays: every new input kind or route fans out across the card / badge / OG surface families, and it has gone stale within about a week of a feature shipping (cycles 177, 189, and the #92 OG-card catch ~8 days post-ship). So the standing rule is: keep the health-map at 0 UNCOVERED, add a read-only liveness probe for every new route or input-kind the moment it ships, and keep the prod-errors classifier complete for every new ReleasedError class. This is where the next silent breakage gets caught — not in the gate, which only sees what the tests already enumerate.
• One human-action setup item remains: branch previews (#131). This was a four-issue cluster; three resolved 2026-07-31 (default-branch protection #129 and merge method #130 closed; #125/#128 merged). Branch previews (#131) is the survivor: the isolated preview Workers shipped (preview.yml + [env.preview], workflow green), so only the preview-secret setup and GitHub-app connect remain as human steps. released-web implements the GitlabRelay Durable Object, and Cloudflare emits no per-version Preview URL for DO-backed Workers, which is why the isolated-Worker approach was taken over shared Preview URLs. Until the secrets land, PR triage validates against the local gate, not a live isolated deploy. Surface its status; do not run the human's cloud steps.
• pnpm -r test, pnpm -r typecheck, pnpm -r build. TDD: failing test before implementation. Algorithm changes get a find-release test first.

Updated

• What released is, what must never break, and where it hurts today. — from the code on 2026-06-25; re-examined 2026-08-01 against live signal
• Homepage popular-projects (#125) — cut and merged (PR #128, 2026-07-31). — Decision: the feature "doesn't earn its keep" (OWNER 2026-07-30); the alias catalog + chips were removed, BareShaError kept as general input validation. The superseded partial fix #126 was closed. Done.

No longer a priority

• The actionable front-door pain has been drained: the homepage dead-end (#125) is decided + shipped as PR #128 (green, mergeable, awaiting the human's merge), and the OG-unfurl arc is done and verified live. What remains is chronic structural constraints (all currently green in production) plus a cluster of human-action-needed setup issues — none of it routine-cycle work. Treat the lists below as watch / mitigation, not a queue to grind on.
• Human-gated setup cluster — the live open-issue weight. Four open issues, all [user action needed], all blocked on the human's Cloudflare/GitHub config: branch previews (#70 → #131), protect the default branch (#129), and the repo's merge method (#130). Branch previews in particular would close a recurring friction — every PR triage currently notes "no preview URL to exercise," so the loop validates against a local gate but can't prove a working isolated deploy. These are not loop WIP; surface their status, don't try to do the human's setup steps.
• pnpm -r test (346+ tests), pnpm -r typecheck, pnpm -r build. TDD: failing test before implementation. Algorithm changes get a find-release test first.

To steer, comment steer priorities: <what you want>. To stop these automatic updates, comment reflect off.

[lukaso-bot]

priorities.md was updated.

Now a priority

• The standing program when the board is empty: iceberg detection (decay-watch). When prod is green and scope is frozen, the highest-leverage discretionary work is catching failures that stay invisible while the front door is green (PRINCIPLES #3). The loop's recurring top catches have all been this class: the bare-500 app.onError backstop (#99), the blank-PNG OG regression (#56), an issue-badge route that had no liveness probe, and the prod-errors classifier missing new error classes. The current sweep is complete as of 2026-08-02: the federated input-kind×surface matrix (commit/PR/issue × permalink/badge/OG, relayed + direct) is fully probed and the health-map is at 0 UNCOVERED, so there is no named gap to hunt right now — this is a decay-watch, not an active grind. The rule is event-driven: when a new route or input kind ships, re-derive the health-map inventory and add a read-only liveness probe for it the moment it lands; when a new ReleasedError class is added, add it to CLIENT_ERRORS by class name so it reads as expected input, not a SYSTEM error. The health-map decays within about a week of a feature shipping (cycles 177, 189, and the #92 OG-card catch ~8 days post-ship). This is where the next silent breakage gets caught — not in the gate, which only sees what the tests already enumerate.
• Branch previews (#131) — operational. Isolated preview Workers (released-web-preview + released-web-og-preview) ship per non-Dependabot PR via preview.yml + [env.preview]; the DO wall is cleared by re-declaring GitlabRelay with ANUBIS_HOSTS="" (dormant). The human finished the preview-secret + GitHub-app cloud setup (confirmed 2026-08-04). Residual coverage caveats are minor, not pain: the relay is off in preview, and GitHub journeys need INTERNAL_SECRET/GITHUB_TOKEN set on the preview env for full coverage.

Updated

• What released is, what must never break, and where it hurts today. — from the code on 2026-06-25; re-examined 2026-08-04 against live signal
• The front-door pain is fully resolved: the homepage dead-end (#125) was cut and merged via PR #128 on 2026-07-31 (#125 closed), and the bare-SHA 500 (#127) merged the same day. — unfurls, cold-share cards) is merged and verified live. Branch previews are operational (isolated preview Workers ship per PR; #70 closed). The open-PR queue is empty and has been for many cycles — the loop's recent real output has been engine work (liveapp idle-false-positive fix #51), not released changes. What remains is chronic structural constraints (all currently green in production) and a standing program of iceberg detection that has been the loop's recurring top catch. Treat the lists below as watch / mitigation, not a queue to grind on.

No longer a priority

• The standing program when the board is empty: iceberg detection. When prod is green and scope is frozen, the highest-leverage discretionary work is catching failures that stay invisible while the front door is green (PRINCIPLES #3). The loop's recurring top catches have all been this class: the bare-500 app.onError backstop (#99), the blank-PNG OG regression (#56), an issue-badge route that had no liveness probe, and the prod-errors classifier missing new error classes. The health-map decays: every new input kind or route fans out across the card / badge / OG surface families, and it has gone stale within about a week of a feature shipping (cycles 177, 189, and the #92 OG-card catch ~8 days post-ship). So the standing rule is: keep the health-map at 0 UNCOVERED, add a read-only liveness probe for every new route or input-kind the moment it ships, and keep the prod-errors classifier complete for every new ReleasedError class. This is where the next silent breakage gets caught — not in the gate, which only sees what the tests already enumerate.
• One human-action setup item remains: branch previews (#131). This was a four-issue cluster; three resolved 2026-07-31 (default-branch protection #129 and merge method #130 closed; #125/#128 merged). Branch previews (#131) is the survivor: the isolated preview Workers shipped (preview.yml + [env.preview], workflow green), so only the preview-secret setup and GitHub-app connect remain as human steps. released-web implements the GitlabRelay Durable Object, and Cloudflare emits no per-version Preview URL for DO-backed Workers, which is why the isolated-Worker approach was taken over shared Preview URLs. Until the secrets land, PR triage validates against the local gate, not a live isolated deploy. Surface its status; do not run the human's cloud steps.

To steer, comment steer priorities: <what you want>. To stop these automatic updates, comment reflect off.

[lukaso-bot]

priorities.md was updated.

Updated

• What released is, what must never break, and where it hurts today. — from the code on 2026-06-25; re-examined 2026-08-05 against live signal
• The front-door pain is fully resolved: the homepage dead-end (#125) was cut and merged via PR #128 on 2026-07-31 (#125 closed), and the bare-SHA 500 (#127) merged the same day. — real output has been engine work (engine PR #67 — the idle-false-positive fix, re-applied to the TS pickup governor after the bash-exit Wave-B port deleted #51's target and made it un-rebasable), not released changes. What remains is chronic structural constraints (all currently green in production) and a standing program of iceberg detection that has been the loop's recurring top catch. Treat the lists below as watch / mitigation, not a queue to grind on.

To steer, comment steer priorities: <what you want>. To stop these automatic updates, comment reflect off.

[lukaso-bot]

priorities.md was updated.

Updated

• What released is, what must never break, and where it hurts today. — from the code on 2026-06-25; re-examined 2026-08-07 against live signal
• The front-door pain is fully resolved: the homepage dead-end (#125) was cut and merged via PR #128 on 2026-07-31 (#125 closed), and the bare-SHA 500 (#127) merged the same day. — open-PR queue is empty and has been for many cycles: the loop's only non-idle output recently was engine self-maintenance (the recurring idle-false-positive class, fixed in engine PR #67 — now merged) and a transient Actions billing block (#136 — resolved 2026-08-07, deploy path unfrozen), neither a released-app change. With prod green and scope frozen on the human's steer, the loop is correctly idle. What remains is chronic structural constraints (all currently green in production) and a standing program of iceberg detection that has been the loop's recurring top catch. Treat the lists below as watch / mitigation, not a queue to grind on.

To steer, comment steer priorities: <what you want>. To stop these automatic updates, comment reflect off.

[lukaso-bot]

priorities.md was updated.

Now a priority

• The queue is not empty, and main is carrying un-deployed security fixes. Three Dependabot dep PRs are all MERGEABLE: #137 (npm-minor-patch group), #138 (@cloudflare/workers-types 5), #139 (typescript 7). Each carries the undici→7.29.0 / js-yaml→4.3.1 override-floor bump that clears two open High CVEs (undici, js-yaml). main is running the vulnerable pinned versions right now — the gate reads green only because the last deploy (2026-08-03, version 1261aaeb) predates the advisories; the fix lands only when the human merges one of the three and release.yml re-deploys. The loop has driven all three to mergeable and is at the WIP cap, correctly draining, not idle: the bottleneck is the human's merge rate, not the loop's throughput, so starting new work would only lengthen the queue. Production itself is green (32/32 liveness, 0 SYSTEM errors 24h/7d, result-cache 94% hit) and the core algorithm is untouched. What remains beyond the CVE queue is chronic structural constraints (all currently green in production) and a standing program of iceberg detection that has been the loop's recurring top catch. Treat the lists below as watch / mitigation, not a queue to grind on.

Updated

• The front-door pain is fully resolved: the homepage dead-end (#125) was cut and merged via PR #128 on 2026-07-31 (#125 closed), and the bare-SHA 500 (#127) merged the same day. — operational (isolated preview Workers ship per PR; #70 closed), though a stale dashboard Workers Builds git-integration now fails 0s on every PR branch and suppresses the preview URL for every open PR — filed as Proposal #140; it is NOT a merge blocker (the repo has no required status checks). The Actions billing block (#136) is resolved 2026-08-07, so the deploy path is open again.

To steer, comment steer priorities: <what you want>. To stop these automatic updates, comment reflect off.

[lukaso-bot]

priorities.md was updated.

Now a priority

• Web lookup → permalink → share. Paste any GitHub commit URL / bare SHA / PR / issue, or a federated GitLab commit/MR. Get the first containing release + also-in list + shareable /r/… or /h/… permalink. The whole algorithm runs in the Worker under a wall-clock deadline. The homepage is the front door and the share is how the product spreads — the unfurl is the tail of this journey, not a separate feature.
• Cache semantics on every auto-updating artifact — badge and OG card. Released → long cache; not-yet/checking → short cache. Get it wrong and the artifact stops flipping when the release lands. The badge honours this; the OG card does not, and pins "not yet released" for 24h. Stated for badges alone, this invariant read as satisfied while the identical bug shipped on a second surface. (#151)
• Order of Worker publication. web before web-og (the Service Binding must exist). Publication is owned by CI on a push to main. See [[feedback_ship_workflow]].
• The share/unfurl path is the app's live defect cluster: six open issues, none fixed on main. All were found 2026-08-17 → 2026-08-20, all on the OG card a shared permalink unfurls into. Production's front door is green and says nothing about them.
• Cold OG unfurls serve the neutral placeholder. Any card not already in the edge cache renders the placeholder; measured three times against production, it does not self-heal. The #53 regression, returned. Open PR #144 fixes the cache-key half. (#143)
• OG cards key on a 7-char SHA while permalinks key on the full SHA, so the search → view → share path never reuses the slot the user just warmed. (#147)
• /internal/* 503s on a not-yet-released commit, so web-og renders the placeholder and the crawler keeps it — effectively permanently for that URL. (#150)
• The not-yet-released OG card is pinned for 24h, so the one card whose whole job is to flip does not flip. (#151)
• /internal/* blocks on findRelease with no deadline, so the first unfurl of a large repo runs ~20s, Slack/X give up, and the crawler caches the placeholder. Every platform's first unfurl is cold, so the cache-key fix does not reach it. (#152)
• The preview OG Worker renders the neutral card for every input — a real result and a nonsense SHA come back within 100 bytes of each other — so the one environment where an OG change gets reviewed cannot validate one. Likely INTERNAL_SECRET unset on preview. This is not a minor preview caveat: it blocks verification of every fix above. (#148)
• The liveness probe is green on this seam and is wrong. On 2026-08-24 all 35 journeys passed, including all six OG renders as real-result PNGs, with 0 SYSTEM errors over 24h and 7d against 9429 AE events/24h and a 94% result-cache hit rate. That green is real for the front door and worthless for OG, because the probe re-requests the same fixed OG URLs every cycle and so keeps exactly those warm. A probe that warms its own fixtures measures only that it warmed them.
• The health-map has a named UNCOVERED seam again: cold-input OG render (confirmed 2026-08-17). This is an ACTIVE gap, not a decay-watch — the standing iceberg program has a target. A real guard needs one of: a genuinely cold input each run (a SHA/PR never requested before), or an assertion on the tell — a real card is max-age=86400, the placeholder is max-age=60. The second is cheap and reliable. Build it; do not wait for the fixes to land first, or the next regression hides the same way.
• The standing program when the board is empty: iceberg detection. When prod is green and scope is frozen, the highest-leverage discretionary work is catching failures that stay invisible while the front door is green (PRINCIPLES #3). Every recurring top catch has been this class: the bare-500 app.onError backstop (#99), the blank-PNG OG regression (#56), an issue-badge route with no probe, and now the whole cold-OG cluster (#143). The rule is event-driven: when a new route or input kind ships, re-derive the health-map inventory and add a read-only probe the moment it lands; when a new ReleasedError class is added, add it to CLIENT_ERRORS by class name so it reads as expected input, not a SYSTEM error. The map decays within about a week of a feature shipping — cycles 177 and 189, the #92 OG-card catch ~8 days post-ship, and #143 found ~2 weeks after the OG arc was declared done. Assume decay; re-derive rather than trusting the last "zero uncovered".
• A guard must assert the tell that distinguishes a real answer from the fallback. The cold-OG bug hid behind a 200 and a valid PNG. Status codes and non-empty bodies are not evidence; the cache header, the byte size, and the rendered value are.
• The human's own open question has gone unanswered since 2026-08-21: does the CLI need a new version? (#154) main and npm are both git-released@0.2.0, and nothing since the last release commit changed CLI or core behaviour (dependency bumps, a core dead-code cleanup, the popular-projects removal). The durable gap underneath it: the project has no stated rule for when a new CLI version is cut, so the question has to be re-derived by hand every time. Answer it, and write the rule down.
• Structural constraints — all currently green, watch and mitigate rather than grind:
• The osv override floors on main are load-bearing and unguarded. They are what keeps the dependency gate green; a grouped Dependabot bump can rewrite them, and no executable guard would catch it. A silent loss re-opens the whole CVE arc that closed on 2026-08-20. (#145)
• The High-CVE / osv arc — closed 2026-08-20. The override floors reached main, its osv dependency scan is green, and #145 / #146 are closed. The queue is no longer carrying un-published security fixes; do not re-derive that framing from an older journal. (Latent follow-up: the floors have no guard — see above.)
• OG delivery mechanics. The domain (#50), the dynamic render itself (#56), the deferred cold-share shell (#55), issue/PR-aware cards (#92), the CI render guard (#124), and the cache-control override fix (#141) are merged and live. The rendering works; the caching and keying around it do not — that is the open cluster above. "OG is done" was true of the renderer and false of the feature.

Updated

• What released is, what must never break, and where it hurts today. — from the code on 2026-06-25; re-examined 2026-08-24 against live signal
• Anubis relay is fragile (latent). — Depends on RELAY_SECRET, a built container image, and the CI token carrying Containers/Cloudchamber edit. If any is missing, freedesktop/GNOME silently fall back to the CLI card. Both relay hosts probe green each cycle; the fragility is structural, not an active break.
• Worker wall-clock vs huge repos — re-surfaced in a new place. — kubernetes-scale (~1700 tags) forced gallop+bisect and the containingTags shortcut on the user-facing path. The same constraint has now reappeared un-mitigated on /internal, which has no deadline at all. (#152)
• Branch previews (#131) — operational. — Isolated preview Workers (released-web-preview + released-web-og-preview) go out per non-Dependabot PR via preview.yml + [env.preview]; the DO wall is cleared by re-declaring GitlabRelay with ANUBIS_HOSTS="" (dormant). The human finished the preview-secret + GitHub-app cloud setup (confirmed 2026-08-04). The relay is deliberately off in preview. The OG-blind preview is tracked as pain above, not as a residual caveat (#148).

No longer a priority

• Web lookup → permalink. Paste any GitHub commit URL / bare SHA / PR / issue, or a federated GitLab commit/MR. Get the first containing release + also-in list + shareable /r/… or /h/… permalink. The whole algorithm runs in the Worker under a wall-clock deadline. The homepage is the front door of the product — every new visitor lands here.
• Badge cache semantics. Released → long cache; not-yet/checking → short cache. Get this wrong and badges stop flipping (or flip too slowly).
• Deploy order. web before web-og (the Service Binding must exist). Deploy = push to main; CI owns it. See [[feedback_ship_workflow]].
• The front-door pain is fully resolved: the homepage dead-end (#125) was cut and merged via PR #128 on 2026-07-31 (#125 closed), and the bare-SHA 500 (#127) merged the same day. The earlier feature arc (issue/PR input, OG unfurls, cold-share cards) is merged and verified live. Branch previews are operational (isolated preview Workers ship per PR; #70 closed), though a stale dashboard Workers Builds git-integration now fails 0s on every PR branch and suppresses the preview URL for every open PR — filed as Proposal #140; it is NOT a merge blocker (the repo has no required status checks). The Actions billing block (#136) is resolved 2026-08-07, so the deploy path is open again.
• The queue is not empty, and main is carrying un-deployed security fixes. Three Dependabot dep PRs are all MERGEABLE: #137 (npm-minor-patch group), #138 (@cloudflare/workers-types 5), #139 (typescript 7). Each carries the undici→7.29.0 / js-yaml→4.3.1 override-floor bump that clears two open High CVEs (undici, js-yaml). main is running the vulnerable pinned versions right now — the gate reads green only because the last deploy (2026-08-03, version 1261aaeb) predates the advisories; the fix lands only when the human merges one of the three and release.yml re-deploys. The loop has driven all three to mergeable and is at the WIP cap, correctly draining, not idle: the bottleneck is the human's merge rate, not the loop's throughput, so starting new work would only lengthen the queue. Production itself is green (32/32 liveness, 0 SYSTEM errors 24h/7d, result-cache 94% hit) and the core algorithm is untouched. What remains beyond the CVE queue is chronic structural constraints (all currently green in production) and a standing program of iceberg detection that has been the loop's recurring top catch. Treat the lists below as watch / mitigation, not a queue to grind on.
• The standing program when the board is empty: iceberg detection (decay-watch). When prod is green and scope is frozen, the highest-leverage discretionary work is catching failures that stay invisible while the front door is green (PRINCIPLES #3). The loop's recurring top catches have all been this class: the bare-500 app.onError backstop (#99), the blank-PNG OG regression (#56), an issue-badge route that had no liveness probe, and the prod-errors classifier missing new error classes. The current sweep is complete as of 2026-08-02: the federated input-kind×surface matrix (commit/PR/issue × permalink/badge/OG, relayed + direct) is fully probed and the health-map is at 0 UNCOVERED, so there is no named gap to hunt right now — this is a decay-watch, not an active grind. The rule is event-driven: when a new route or input kind ships, re-derive the health-map inventory and add a read-only liveness probe for it the moment it lands; when a new ReleasedError class is added, add it to CLIENT_ERRORS by class name so it reads as expected input, not a SYSTEM error. The health-map decays within about a week of a feature shipping (cycles 177, 189, and the #92 OG-card catch ~8 days post-ship). This is where the next silent breakage gets caught — not in the gate, which only sees what the tests already enumerate.
• OG unfurls. Domain (#50), dynamic render (#56), cold-share (#55), and issue/PR-aware cards (#92) all merged and verified live; OG render-in-CI guard (#124) on the merge button. Lower-leverage follow-ups (cache-key alignment, placeholder render cost, calm-state 503) live in the backlog and rank below any real defect.

To steer, comment steer priorities: <what you want>. To stop these automatic updates, comment reflect off.

[lukaso-bot]

priorities.md was updated.

Now a priority

• Partial ≠ not-released, and partial ≠ terminal. A soft-deadline timeout must surface a best-effort answer with a caveat, not the not-released UI — and it must not be cached as if the traversal had completed. A partial carrying a galloped firstRelease is an unconfirmed answer, so it has to stay revalidatable; pinning it on the released path's long TTL is the same defect wearing a cache header. (#155)
• Seven open defects, none fixed on main, and production's front door is green on every one of them. Six are on the OG card a shared permalink unfurls into, all found 2026-08-17 → 08-20. The seventh came out of reviewing the fix for the first six and is not an OG bug at all — it is on the public routes.
• A partial carrying a galloped firstRelease is cached as terminal: 30-day TTL, reported fresh forever. hardTtlFor() and isFresh() both test firstRelease before partial, so a repo that reliably blows the 24s soft deadline can pin a possibly-not-earliest release for a month on the public permalink and badge routes, never revalidated. The card does render the best-effort caveat, so a reader is not misled; the defect is that the answer can never self-correct. Predates #144 and was deliberately kept out of its scope. Pick the replacement TTL deliberately — a bare 60s means a full traversal per minute on the shared token. (#155)
• The health-map has a named UNCOVERED seam: cold-input OG render (confirmed 2026-08-17, still open). This is an ACTIVE gap, not a decay-watch — the standing iceberg program has a target. A real guard needs one of: a genuinely cold input each run (a SHA/PR never requested before), or an assertion on the tell — a real card is max-age=86400, the placeholder is max-age=60. The second is cheap and reliable. Build it; do not wait for the fixes to land first, or the next regression hides the same way.
• The human's own question is the oldest unanswered thing on the board: does the CLI need a new version? (#154) Filed 2026-08-21, still zero comments six days later. main and npm are both git-released@0.2.0, and nothing since the last release commit changed CLI or core behaviour (dependency bumps, a core dead-code cleanup, the popular-projects removal). The durable gap underneath it: the project has no stated rule for when a new CLI version is cut, so the question has to be re-derived by hand every time. Answer it, and write the rule down.

Updated

• What released is, what must never break, and where it hurts today. — from the code on 2026-06-25; re-examined 2026-08-24 and re-derived 2026-08-27 against live signal (production probes, open issues, recent loop journals).
• The liveness probe is green on this seam and is wrong. — On 2026-08-27 all 30 journeys passed, including all six OG renders as real-result PNGs, with 0 SYSTEM errors over 24h and 7d against 9460 AE events/24h and a 95% result-cache hit rate. That green is real for the front door and worthless for OG, because the probe re-requests the same fixed OG URLs every cycle and so keeps exactly those warm. A probe that warms its own fixtures measures only that it warmed them.
• Worker wall-clock vs huge repos — re-surfaced in two new places. — kubernetes-scale (~1700 tags) forced gallop+bisect and the containingTags shortcut on the user-facing path. The same constraint has now reappeared un-mitigated on /internal, which has no deadline at all (#152), and in how the result of a truncated traversal gets cached (#155).

No longer a priority

• Partial ≠ not-released. A soft-deadline timeout must surface a best-effort answer with a caveat, not the not-released UI.
• The share/unfurl path is the app's live defect cluster: six open issues, none fixed on main. All were found 2026-08-17 → 2026-08-20, all on the OG card a shared permalink unfurls into. Production's front door is green and says nothing about them.
• The health-map has a named UNCOVERED seam again: cold-input OG render (confirmed 2026-08-17). This is an ACTIVE gap, not a decay-watch — the standing iceberg program has a target. A real guard needs one of: a genuinely cold input each run (a SHA/PR never requested before), or an assertion on the tell — a real card is max-age=86400, the placeholder is max-age=60. The second is cheap and reliable. Build it; do not wait for the fixes to land first, or the next regression hides the same way.
• The human's own open question has gone unanswered since 2026-08-21: does the CLI need a new version? (#154) main and npm are both git-released@0.2.0, and nothing since the last release commit changed CLI or core behaviour (dependency bumps, a core dead-code cleanup, the popular-projects removal). The durable gap underneath it: the project has no stated rule for when a new CLI version is cut, so the question has to be re-derived by hand every time. Answer it, and write the rule down.

To steer, comment steer priorities: <what you want>. To stop these automatic updates, comment reflect off.

[lukaso-bot]

priorities.md was updated.

Now a priority

• Nine open defects, none fixed on main, and production's front door is green on every one of them. Seven are on the OG card a shared permalink unfurls into. The other two are on the public and /internal routes, and all three of those came out of reviewing the fix for the first cluster rather than from any probe.
• Merging #144 as it stands makes deadline-heavy repos strictly worse, and the human should know that before pressing the button. /internal/* will refuse every partial — correct, since an OG card cannot render the best-effort caveat — but HARD_TTL_PARTIAL and the placeholder's max-age are both 60s, so for gitlab.gnome.org/GNOME/gimp the card never converges and upstream load goes from ~0 to one full traversal per minute through a max_instances = 1 relay. Before #144 that card at least rendered the gallop tag. The fix is to serve the gallop shape with a short-cache signal, which is the same change #151/#158 is making. (#156)
• /internal/*'s unconditional back-off bypass starves human page views of their retry window. During an upstream outage the crawler re-requests once a minute, skips the warm :neg marker, runs to the 28s hard deadline, and re-stamps the marker — so the marker is almost never older than its 60s TTL and a human on the same key sits on "checking…" for the whole outage. (#157)
• Nothing has reached production since 2026-08-20, and merge is the only step left. main is frozen at 0ee8e68, the live Worker matches it, and all three open PRs (#144, #153, #158) are MERGEABLE with green gates and zero unresolved threads. Every fix above exists only in a branch. The binding constraint on this app right now is merge latency, not defect-finding — the loop's WIP cap is reached, so it drains and idles while the queue waits. This is a fact about where leverage is, not a complaint: the highest-value work the loop can do is make each PR easier to merge.
• Review rounds on an unmerged PR now open more issues than they close. #144 has run 11 rounds since 2026-08-17, and round 10 alone produced #156 and #157 — both real, both correctly kept out of its scope. The queue grows while it waits. The response is smaller, single-issue PRs off a freshly-fetched main, never wider ones. A PR the human can read and merge in one sitting is worth more than a PR that fixes everything.
• /internal/* keeps producing defects on inspection, which reads as under-designed rather than merely buggy. Four of the nine (#150, #152, #156, #157) are on that one route, and none came from a probe. It deserves one deliberate pass over its deadline, cache, and back-off semantics — after the queue drains, not stacked onto #144.
• The liveness probe is green on the OG seam and is wrong. On 2026-08-27 all 30 journeys passed, including all six OG renders as real-result PNGs, with 0 SYSTEM errors over 24h and 7d against 9149 AE events/24h and a 95% result-cache hit rate. That green is real for the front door and worthless for OG, because the probe re-requests the same fixed OG URLs every cycle and so keeps exactly those warm. A probe that warms its own fixtures measures only that it warmed them.
• The health-map has a named UNCOVERED seam: cold-input OG render (confirmed 2026-08-17, still open ten days later). This is an ACTIVE gap with a target, not a decay-watch, and it has lost every cycle so far to draining review threads. A real guard needs one of: a genuinely cold input each run (a SHA/PR never requested before), or an assertion on the tell. The cheap tell got more expensive: once #158 merges, max-age=60 no longer means "placeholder" (a real not-yet/partial card is short-cached by design), so the header must be paired with the byte-size floor or the fixtures kept on stably-released commits. Build it anyway; waiting for the fixes to land lets the next regression hide the same way.
• The CLI-version question is answered and now waits on a product call, not on analysis. (#154) Filed 2026-08-21, answered 2026-08-27 against the published npm tarball rather than the source: eb014fd (the popular-projects removal) deleted the alias shorthand from packages/core/src/parse-input.ts, so the CLI on main no longer accepts <alias> <sha> and its variants for the 13 catalog aliases, though git-released@0.2.0 on npm still does. The open decision is the human's: 0.3.0 shipping the removal, or 0.2.1 with the aliases restored in core. The durable gap underneath is still unfixed — nothing in the repo states when a CLI version is cut. The proposed rule: any PR touching packages/cli/src or packages/core/src ships a changeset for git-released, with a CI check enforcing it. @released/core is ignored in .changeset/config.json, which is exactly why a core-only diff produced no prompt and shipped a CLI behaviour change unnoticed.

Updated

• What released is, what must never break, and where it hurts today. — What released is, what must never break, and where it hurts today. Inferred from the code on 2026-06-25; re-examined 2026-08-24 and re-derived twice on 2026-08-27 against live signal (production probes, open issues, recent loop journals).
• The not-yet-released OG card is pinned for 24h — , so the one card whose whole job is to flip does not flip. Open PR #158 keys the lifetime on terminality instead. (#151)
• The preview OG Worker renders the neutral card for every input — — a real result and a nonsense SHA come back within 100 bytes of each other. Likely INTERNAL_SECRET unset on preview. This is not a minor preview caveat: the preview can only ever exercise the placeholder arm, so it is structurally blind to every result-backed arm, and no OG fix in the queue can be preview-verified until it is fixed. It gates #144, #158, and anything after them. (#148)
• A partial carrying a galloped firstRelease is cached as terminal: 30-day TTL, reported fresh forever. — hardTtlFor() and isFresh() both test firstRelease before partial, so a repo that reliably blows the 24s soft deadline can pin a possibly-not-earliest release for a month on the public permalink and badge routes, never revalidated. The card does render the best-effort caveat, so a reader is not misled; the defect is that the answer can never self-correct. Pick the replacement TTL deliberately — a bare 60s means a full traversal per minute on the shared token. (#155)
• Anubis relay is fragile (latent). — #156 and #157 both land load on this same max_instances = 1 singleton.
• Worker wall-clock vs huge repos — the constraint keeps reappearing on paths that never had a deadline. — kubernetes-scale (~1700 tags) forced gallop+bisect and the containingTags shortcut on the user-facing path. The same constraint is now un-mitigated on /internal, which has no deadline at all (#152), in how a truncated traversal's result gets cached (#155), and in what a refused partial costs upstream (#156).
• Homepage popular-projects (#125) — cut and merged (PR #128, 2026-07-31). — Decision: the feature "doesn't earn its keep" (OWNER 2026-07-30); the alias catalog + chips were removed, BareShaError kept as general input validation. The superseded partial fix #126 was closed. Done — but note its CLI side effect is what #154 is deciding.

No longer a priority

• Seven open defects, none fixed on main, and production's front door is green on every one of them. Six are on the OG card a shared permalink unfurls into, all found 2026-08-17 → 08-20. The seventh came out of reviewing the fix for the first six and is not an OG bug at all — it is on the public routes.
• The liveness probe is green on this seam and is wrong. On 2026-08-27 all 30 journeys passed, including all six OG renders as real-result PNGs, with 0 SYSTEM errors over 24h and 7d against 9460 AE events/24h and a 95% result-cache hit rate. That green is real for the front door and worthless for OG, because the probe re-requests the same fixed OG URLs every cycle and so keeps exactly those warm. A probe that warms its own fixtures measures only that it warmed them.
• The health-map has a named UNCOVERED seam: cold-input OG render (confirmed 2026-08-17, still open). This is an ACTIVE gap, not a decay-watch — the standing iceberg program has a target. A real guard needs one of: a genuinely cold input each run (a SHA/PR never requested before), or an assertion on the tell — a real card is max-age=86400, the placeholder is max-age=60. The second is cheap and reliable. Build it; do not wait for the fixes to land first, or the next regression hides the same way.
• The human's own question is the oldest unanswered thing on the board: does the CLI need a new version? (#154) Filed 2026-08-21, still zero comments six days later. main and npm are both git-released@0.2.0, and nothing since the last release commit changed CLI or core behaviour (dependency bumps, a core dead-code cleanup, the popular-projects removal). The durable gap underneath it: the project has no stated rule for when a new CLI version is cut, so the question has to be re-derived by hand every time. Answer it, and write the rule down.

To steer, comment steer priorities: <what you want>. To stop these automatic updates, comment reflect off.