Changelog — 2.197–2.210

Releases 2.197.0 through 2.210.0. Current releases are on the main changelog, and every band is listed in the release archive.

Loading audio...

Version 2.210.0

August 24, 2026

One of our story videos read the artist’s instructions aloud instead of the story

  • If you watched the video for one of our recent stories, the narrator described the pictures rather than telling the tale. Every scene of a story video is written twice over: once as prose for the narrator to read, and once as a short note describing what the illustration should show. The video used the second one. The subtitles agreed with it, because they are made from the same words that are spoken.
  • The story itself was never lost. It was on the page, complete and correct, the whole time. Only the video’s narration was affected, and the written story is where most people read it.
  • The cause was a rescue that dropped something while saving something else. Earlier this month we added a feature that offers back work which finished while your browser tab was closed. To make that hand-back safe we started rebuilding each scene piece by piece — and quietly left two pieces behind. One of them was the narration.
  • Nothing failed, and that is exactly why it reached you. With no narration to read, the video quietly used the illustration note instead. It rendered, finished, and published, reporting success at every step. A silent substitution is more dangerous than an outright failure, because there is nothing for anyone to notice.
  • It now refuses instead of improvising. A video with nothing to narrate stops before it starts, and says which scenes are missing their words. There is no sensible stand-in for a story, and a video that takes several minutes to make is one nobody listens back to once it has succeeded.
  • The lasting fix is that the same mistake can no longer be made quietly. The missing piece is now something our build refuses to accept rather than something a person has to spot. We proved that by deliberately reintroducing the fault and confirming the build rejects it — a check you have never seen fail is not yet a check.
  • We also found that one of our own tests had been protecting the bug. It compared the rebuilt scene against an example that was itself missing the narration, so it passed because the field was being dropped. A test can quietly write a mistake down as a requirement, and then confirm it forever.
  • One published story video was affected, and we checked every one of them rather than a sample. It was the most recent — which is the trap, because looking at a handful of older ones would have found nothing wrong and closed the matter. We are remaking it.
  • Nothing to do at your end.

Version 2.209.0

August 24, 2026

A note in our own records said a job was done and checked. It had only ever been planned.

  • Nothing you can see changed. This is about our own record-keeping, and a habit it exposed that we think is worth naming.
  • We had written down that a piece of protective work was complete and verified. It was not. It had been planned, begun, and then set aside when we found a better way of doing the same job — and the note describing it as finished stayed exactly as it was.
  • The word that did the damage was “confirmed”. A sentence saying something is confirmed working reads as a completed check, so nobody checks it again. A sentence saying “planned, not done yet” would have been just as true, would have nagged at whoever read it, and would have cost exactly the same effort to write.
  • So we now write the state, not the plan. If something is intended but outstanding, the note says so. A record that describes intentions in the past tense removes the only signal that the intention is still open — and the better idea that replaced the original plan is now tracked as work rather than as something already handled.
  • Separately, another of our notes gave a correct answer for the wrong reason. It explained why two systems should be moved together, and the explanation turned out to be factually wrong even though the advice was right. Being right is precisely why nobody re-read the reasoning — and a wrong reason quietly justifies the next decision, which is where it would eventually have cost us.
  • Nothing to do at your end.

Version 2.208.0

August 24, 2026

Backing things up more often made our safety net shorter, and nothing anywhere said so

  • We increased how often we take backups, and that quietly reduced how far back we could go. Our retention was set as a number of copies to keep rather than a length of time to cover. Take copies twice as often and you still keep the same number of them — so they span half as long. Nothing failed, every backup succeeded, and the number that shrank was the one nobody was reading.
  • Our own notes said we kept several months. We were keeping little more than a day. That sentence had been written down and trusted for weeks. Retention is now expressed in days, weeks and months, so how often we take a copy and how far back we can reach are no longer tied to each other.
  • A second copy had been quietly saving us, by accident. It was set up earlier this month for an unrelated reason, and it happens never to delete anything — so it had been holding the history the main one was dropping, including copies of things that no longer exist at all. We have now written down how to reach it, because it turns out not to appear in the place anyone would look for it under pressure.
  • Separately, the store that holds the site’s images and audio now refuses to start if its configuration is incomplete. Before this it would have fallen back to its own built-in defaults, started, and reported itself perfectly healthy. Refusing outright is the only one of those behaviours you can actually notice.
  • We had also recorded that it was locked to a specific version — and it wasn’t, quite. The version was written down correctly but had never actually been fetched onto the machine, so the next restart would have had to go out to the internet in the middle of restarting to find it. We fetched it first as its own separate step, confirmed it was byte-for-byte identical to what was already running, and only then restarted. The interruption was two seconds.
  • And a check we wrote to find a piece of configuration found one, where there were two. It searched by the name we expected that setting to have; a second place used a completely different name for exactly the same thing. It surfaced only by comparing the values rather than the labels. Searching for the name you would have chosen finds the copies you would have written.
  • Five of our own measuring tools were wrong during this work, and four of them made things look worse than they were. That direction is not bad luck — a broken instrument returns nothing, and nothing looks like failure. So a negative result now gets the instrument checked before it gets believed.
  • Nothing to do at your end.

Version 2.207.0

August 23, 2026

A disk failed without ever admitting it, and a test of ours went red because we’d made something better

  • A storage device inside our own systems failed this morning. The site stayed up throughout, the only interruption anyone could have noticed was a few minutes late in the day, and nothing was lost.
  • What makes it worth writing up is that it gave no warning whatsoever. The standard health summary these devices report said “healthy” that morning. It says “healthy” now. It said “healthy” every day of the months it had quietly been misbehaving.
  • The evidence was there the whole time, in numbers nobody was reading. How often it had restarted itself, how often it had done so unexpectedly, and how many entries sat in its own error log. Against comparable devices it had been an obvious outlier for months. We now watch those numbers.
  • We had already written down an explanation for its unusual slowness, and that explanation was wrong. We had blamed a design characteristic of the device — and another device in the very same notes has that identical characteristic while being several times faster with a spotless record. That fact was sitting in front of us as we wrote the wrong conclusion. We had used the second device to rule out one explanation and never thought to check it against the other. A comparison only rules out the thing you point it at.
  • Several parts of the system had no real self-check, and now they do. Each one makes the service do actual work and inspects the result, rather than asking it whether it feels well. One of the new ones would have gone red within five minutes of the failure — while the check we already had went on reporting “healthy” for another hour and a half, because that check never tries to write anything.
  • And one of our release tests went red because we improved something. Its job was to prove our deploy instructions read what is actually present rather than a list somebody typed out, and it proved it by naming a component that had no self-check and confirming it wasn’t told to run one. Then we wrote that component a self-check. The quickest way back to green was to delete the new check — so the test was quietly pushing against its own purpose. We rewrote it to work out its own example instead, so it can no longer be made to fail by us doing something right.
  • Nothing to do at your end.

Version 2.206.0

August 23, 2026

A note in our own code said “nothing uses this”. Something did.

  • Nothing you can see changed. This is about a comment we had written to ourselves, and what it quietly implied to anyone who read it.
  • Beside a list of places we keep files, a note said some of them had “no code references at all”. That was perfectly true — of the project the note was written in. What it read like was a statement about the files themselves.
  • Another of our projects has been writing to them the whole time. Nothing was lost, because nobody had acted on it. But a clear-out reasoned entirely from that note would have deleted work that is in daily use, and every check we had would have agreed it was safe.
  • The fix is the wording, and the wording is the lesson. “Nothing here uses this” and “nothing uses this” are different claims, and only the first one had ever been checked. The note now says which project it speaks for, and names the one that actually owns the files.
  • We were careful not to over-correct. One other entry on that list looked like the same case, but we had not actually verified it — so it is now marked as unverified rather than quietly bundled in with the one we did measure. Guessing right and guessing wrong look identical afterwards.
  • Nothing to do at your end.

Version 2.205.0

August 23, 2026

Writing down what happened, and fixing a warning that was crying wolf

  • Nothing you can see changed. The update we published earlier is out and working; this is us bringing our own notes in line with it, on the same night rather than a month later.
  • One of yesterday’s new checks was wrong the first time it ran for real. It compares the version of a component against the newest available, and reported a mismatch between two things that were the same version written two different ways — one with a leading zero, one without.
  • The reason that matters more than it sounds: it would have complained most of the year. Any month before October, any day before the tenth. A warning that fires constantly for no reason is worse than no warning, because people stop reading them — which is precisely the failure the check was written to avoid. It now compares the numbers rather than the text.
  • Everything else went out cleanly. Four machines updated and each one checked by making it do real work rather than asking it whether it felt well — including one that fetched an actual video and confirmed the file it produced was a real video file.
  • Nothing to do at your end.

Version 2.204.0

August 22, 2026

A stale password is worse than no password, and we had several

  • Nothing you can see changed. This is about how our machines sign in to fetch the software they run.
  • Each machine had been signed in separately, at a different time, with its own key — and several of those had since stopped working. Nothing announced it. Some machines worked and some did not, which reads as the outside service being unreliable rather than as our own keys having quietly expired.
  • The important part is that an expired key is worse than none at all. A machine with no key simply asks anonymously and gets what it needs. A machine with a dead key presents it, is refused, and does not then try asking anonymously — so it fails at things it could otherwise do perfectly well. That distinction is now reported, because the two look identical otherwise and need opposite responses.
  • There is now one command that reports every machine, and one that sets them all from a single key. Which means there is one thing to renew rather than a dozen drifting apart, and one place to look when something cannot fetch.
  • We also chose a key that can only read, not publish. Every one of these machines only ever downloads; publishing is done elsewhere. A read-only key means that if one machine were ever compromised, it could not push anything back.
  • Nothing to do at your end.

Version 2.203.0

August 22, 2026

Our own release checklist had a silent gap in it

  • Nothing you can see changed. This is the checklist we follow when publishing an update — the one that tells us what needs doing and where.
  • For one kind of change, it printed nothing at all. The checklist works by asking “what did we rebuild, and where does it go?”. Some of what we run is not something we build — it is standard software we simply configure — so for those, the question returns nothing, and the checklist stayed quiet rather than saying so.
  • Which meant that step was done from memory. It was done, and correctly, but only because the person doing it happened to know. Nothing would have reminded the next person, and a step that depends on someone remembering is a step that eventually gets missed.
  • It now prints the exact instructions, including where the files have to go. That last part matters more than it sounds: in a couple of cases the destination folder is not named after the thing it holds, so it cannot be guessed — and copying to the wrong place would be worse than doing nothing.
  • And where it does not know, it says so rather than guessing. We added a test that deliberately asks it about something it has no answer for, and confirmed it refuses instead of inventing one.
  • Nothing to do at your end.

Version 2.202.0

August 22, 2026

This page was getting long again, so we filed the older entries

  • Everything from 2.186 to 2.196 has moved to its own page, listed in the release archive along with every other batch. This page now carries the newest entries only.
  • Every link you may have saved still works. A link to any moved entry is forwarded to wherever it now lives, and lands on the entry itself rather than the top of the page — which is a distinction that has caught us out before.
  • We did it early on purpose. There was still room for about three more entries. The last time this was left until the page was actually too long, it had grown so far past the limit that no single split would work — one option produced a filed page that was over the limit the day it was created, and the other left this page too full to hold the very entry announcing the change. Two pages had to be made at once. Doing it with room to spare avoids all of that.
  • And we stopped at the last entry you have actually seen. A few entries have been written but not yet published to the site; filing those would have moved them into the archive without their ever having appeared here. So the cut is at the newest one that has been live, not the one that would have freed the most space.
  • Nothing to do at your end.

Version 2.201.0

August 22, 2026

The part that made it work was only ever in one place, and not a saved one

  • Nothing you can see changed. This is the piece that fetches a recording from a link so it can be transcribed — the first step whenever we turn a talk into text.
  • Its instructions existed on exactly one machine, and nowhere else. Not saved anywhere, not backed up, never reviewed since the day it was written. If that machine had been lost we would have had to write it again from memory. It is now kept with the rest of our work.
  • Worse: the version doing the actual fetching had been patched by hand, and that patch was not saved either. The tool it relies on has to keep up with the video sites it reads, which change constantly. Somebody had updated it directly on the running machine months ago — and the routine act of restarting that machine would have quietly undone seven months of those updates. Everything would have looked fine and links would have started failing for no visible reason.
  • So we stopped relying on anyone remembering. It now updates itself when it starts, checks again nightly, and reports which version it is actually using — because the update quietly doing nothing is a real possibility, and one you cannot notice unless the answer is written down somewhere you can look.
  • And its self-check can now say it is broken. Before, it always reported that it was fine — including when the tool it depends on was missing entirely. Third time we have found that same fault this evening, in a different place.
  • Nothing to do at your end.

Version 2.200.0

August 22, 2026

Asking what exists, instead of trusting a list of what we meant to keep

  • Nothing you can see changed. More work on the copies we keep of everything the site stores.
  • We built a single check that reports on all of them at once. Until now, answering “are our backups fine?” meant logging into each machine in turn and reading a log by eye. Everything turned out to be healthy — but nobody could have known that without doing the walk, and nobody was doing the walk.
  • The useful half of the check asks the question backwards. The obvious test is “does everything on our list have a recent copy?” — and a list cannot tell you about something that was never added to it. So the check asks the machine what it is actually holding, and compares that against the list. That is what found the gap we fixed yesterday, and it is what will find the next one.
  • The new check was wrong the first time we ran it, and the way it was wrong is the point. It reported that our main database had no copies at all — twenty minutes after we had watched two of them being written. The fault was in the checking tool, not the backups. We only caught it because we already knew the true answer; had we not, we would have spent the evening chasing a problem that did not exist.
  • So we made it prove it can fail. We deliberately removed one database from the list, confirmed the check went red and named it, and put everything back. A check nobody has watched fail is not a check.
  • It now runs automatically before we publish an update. Early enough that we can simply stop, rather than discovering a problem halfway through. And it deliberately only blocks for the thing that update actually depends on — a warning that fires for unrelated reasons is one people learn to ignore.
  • Nothing to do at your end.

Version 2.199.0

August 22, 2026

We restored a backup, rather than assuming one would work

  • Nothing you can see changed. This is about the copies we keep of everything the site stores, and what happens if we ever need one.
  • We had never actually restored one. Backups were being taken nightly, checked automatically, and stored in more than one place — and not one of them had ever been read back. A backup nobody has restored is a hope, not a safeguard, and our own notes had been saying so for a month.
  • So we did it properly: onto a different machine. Restoring alongside the original would have proved much less — it shares the same software, the same settings and the same disk. We rebuilt it somewhere completely separate and then compared the two record by record, not just “does it look right”. Everything matched exactly.
  • And we checked that the comparison could fail. We deliberately removed a single record from the copy and confirmed the check noticed. A test that always agrees isn’t a test.
  • One set of information turned out not to be included. Our editing and drafting environment was never part of the nightly copy — only the live site was. It is now.
  • The instructions for putting things back are now written out in full. Before, the recovery notes said “restore from the backup” and stopped there, leaving whoever was on the spot to work out which one and how — at the worst possible moment. The exact steps now appear automatically, including reading the list of available copies rather than guessing at a filename.
  • Nothing to do at your end.

Version 2.198.0

August 22, 2026

A self-check that could only ever answer “fine”

  • Nothing you can see changed. This is internal plumbing — the checks we run against our own systems to notice when one of them stops working.
  • Some of those checks could not report a failure at all. Each one did the right test — is this working? — and then answered “fine” regardless of what the test said. One of them didn’t even do that: it looked the answer up and then threw it away, replacing it with the word “fine” written in by hand, with the real answer sitting unused right beside it.
  • This is the fault we most often write down as our own worst case, and we still had it. A check that says “all clear” whatever the truth is worse than no check, because it stops anyone looking. We even have a written rule about it that uses one of these as its example — and the example had never been fixed. Its near-identical twin elsewhere was repaired months ago, and the note explaining why that one was now safe is, we think, exactly what stopped anyone going back to the original.
  • We proved it instead of arguing it. We deliberately broke both services and ran the old and new versions side by side against the identical fault. The old one: reports healthy. The new one: reports broken. Same fault, same words in the report — the only thing that changed is the part anything actually reads.
  • And doing that corrected two things we had already written down as fact. One was a claim about how the failure would look, which turned out to describe only one of three ways it can go wrong — and not the quiet one. The other was a reason we gave for part of the fix, which measurement showed simply wasn’t true. The fix stands; the reasoning behind it was rewritten to say something honest.
  • Nothing to do at your end.

Version 2.197.0

August 22, 2026

Writing down what actually happened, while it was still true

  • Nothing you can see changed. The part of the system that turns recordings into text moved to a different machine today, and this is us updating our own notes to match — on the same day, rather than a month later.
  • We proved the move rather than assuming it. The obvious test — try it and see if it works — proves nothing while the old machine is still switched on and able to answer. So we switched the old one off first, confirmed it could no longer respond at all, and only then ran a real transcription. It worked, and this time that meant something.
  • The change we thought would do it turned out not to be enough. The same settings file contained two kinds of entry that look identical and behave in opposite ways: some reach the running system and override everything, others are quietly ignored. We had to check which was which by measuring, because nothing about the names tells you.
  • And we walked every machine while we were in there. Each thing we found had, in principle, a check that should have caught it — and every one of those checks was reporting that all was well. Most of them failed in the direction that makes things look tidier than they are, which is the harder direction to notice.
  • Nothing to do at your end.