Graticula · Phase 1 — Implementation

Control Room

Everything below is read out of the repository at build time — the ADR headers, open-questions.md, architecture-debt.md, architecture-assumptions.md and git. Nothing on this page is typed by hand, because the two versions that were went stale within a day.

Generated from commit 90f51d7 · 2026-09-12 16:05

Where it stands

ADRs

12 accepted outright

195/238

ADR conditions discharged

41 live · 2 deferred with their decision

open questions

157 answered

open debts

248 repaid · 9 waiting on a trigger

7/9

review gates run

1 need an outside reviewer

16/87

assumptions validated

the rest are unproven

2658

tests

285 source files, 119,638 lines

What is left

Three buckets, sorted by who can move them. The sort is derived: an item is the owner's when the question register names them, and an outside reviewer's when the gate says in its own words that it needs somebody who did not write this. Everything else is ours, and it is the only bucket that shrinks by working.

Owner0 open

Nothing is waiting on the owner.

An outside reviewer1 gates

Operations — Needs a deployment somebody operates.

§67 also still owes a review round by somebody who did not participate. Rounds 1 and 2 were self-review; round 3 was commissioned and briefed by the author.

Ours45 items

41 ADR conditions outstanding across 31 decisions — the largest commitment on this page.

0 debts with their repayment triggers already written down.

3 capability areas not started: Publishing, Observability, Resource governance.

1 review gates nobody else is blocking: Extensibility.

Open conditions, by decision

A condition is discharged when its text is struck through in the ADR itself. Nothing here is marked done by this page — it is counted from the decision that made the promise.

ADR-013 · Feature Service Data Model: Identi

ADR-028 · Style documents: the one thing abo

ADR-007 · Service Runtime

ADR-010 · Caching

ADR-017 · Admin API Shape

ADR-029 · Affinity routing is not the defaul

ADR-052 · The canonical symbology document i

ADR-055 · A connection is fields, and this s

ADR-002 · Primary Data Architecture

ADR-005 · API Architecture

ADR-006 · Plugin Model

ADR-009 · Raster Engine

ADR-011 · Job System

ADR-015 · Authentication

ADR-021 · Tiles are encoded by PostGIS, and

ADR-023 · The REST Services Directory: an HT

ADR-024 · Shapefile import, and the exceptio

ADR-025 · Governance: what a gift owes, and

ADR-026 · Serving through a platform-store o

ADR-027 · Glyphs and sprites: the tile servi

ADR-032 · The product is named Graticula

ADR-038 · How a geodatabase becomes one serv

ADR-039 · WFS 2.0, read-only, is the first s

ADR-046 · Admission control bounds the queue

ADR-047 · The outbound licence is Elastic Li

ADR-048 · CI does not run the real-data suit

ADR-054 · The symbology document is not boun

ADR-056 · An item is its own thing, and a se

ADR-057 · Composing and publishing a service

ADR-059 · Quiescing a data source

ADR-060 · The axis order comes from the auth

Review gates (§66)

Each gate runs against the whole architecture, not per ADR, and a failure reopens decisions rather than being noted and passed over. A gate ticked without evidence is worse than one left open: it turns an unknown into a false assurance and nothing afterwards re-examines it.

Gate	Run	Result, or what it is waiting for
Correctness	FAIL	FAIL, and all five findings are repaired.
Simplicity	FAIL	FAIL, narrowly, and not for the reason this row expected.
Performance	FAIL	FAIL, on a finding about behaviour rather than speed.
Failure	FAIL	FAIL, and all ten findings are now repaired — six on the day, the last four on 2026-08-23, each measured before and after.
Operations	not run	Needs a deployment somebody operates.
Security	FAIL	FAIL on one finding, repaired the same day.
Extensibility	not run	No plugin code exists, so the gate has nothing to examine.
Licensing	PASS	PASS.
Consistency	FAIL	FAIL, and all four findings are now answered — three on the day, the fourth on 2026-08-23.

Decisions

Every architectural decision is an ADR. Status and confidence are read from each file's own header, so a decision cannot quietly change grade here without changing there.

ADR	Decision	Status	Confidence	Conditions
001	Core Language	ACCEPTED 2026-08-25, by owner decision: "ben Q-01'i kabul ettim .NET olarak".	MEDIUM — 2026-08-25.
002	Primary Data Architecture	REOPENED → re-decided, ACCEPTED WITH… REOPENED → re-decided, ACCEPTED WITH CONDITIONS	MEDIUM	2/3
003	Geometry Engine	ACCEPTED WITH CONDITIONS single-provider scope.	HIGH for the split, which is measured.
004	Rendering Engine	ACCEPTED un-deferred 2026-08-20 by ADR-041, which is where the decision now lives.	—
005	API Architecture	ACCEPTED WITH CONDITIONS re-closed 2026-08-20.	MEDIUM-HIGH	3/4
006	Plugin Model	ACCEPTED WITH CONDITIONS re-closed 2026-08-15, see §0.	MEDIUM-HIGH	1/2
007	Service Runtime	ACCEPTED WITH CONDITIONS	MEDIUM — structure well supported, routing unproven	2/4
008	Query Engine	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
009	Raster Engine	ACCEPTED WITH CONDITIONS re-closed 2026-08-15, see §0.	MEDIUM	1/3
010	Caching	ACCEPTED WITH CONDITIONS	MEDIUM	2/4
011	Job System	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH	3/4
012	Clustering	DEFERRED	—
013	Feature Service Data Model: Identity, Relationships and Attachments	ACCEPTED WITH CONDITIONS	MEDIUM	4/7
014	TLS and Certificates	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH	4/4
015	Authentication	ACCEPTED WITH CONDITIONS	MEDIUM	4/5
016	Packaging, Deployment and Upgrade	ACCEPTED WITH CONDITIONS	MEDIUM	4/4
017	Admin API Shape	ACCEPTED WITH CONDITIONS	MEDIUM — the shape is decided, the surface is not	1/3
018	Authorization: user types, roles and privileges	REOPENED 2026-08-14 by owner direction →… REOPENED 2026-08-14 by owner direction → re-decided, ACCEPTED WITH CONDITIONS	MEDIUM	5/5
019	One deployable, three fused tiers	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH for the decision · LOW for the trigger conditions in §5	3/3
020	An admin console, and what "stop a service" means	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH for the console · MEDIUM for the status model	3/3
021	Tiles are encoded by PostGIS, and we do not write an encoder	ACCEPTED WITH CONDITIONS	HIGH for the decision · MEDIUM for the condition in §7	2/3
022	GeometryServer ships in halves, and the projection engine is the datastore's	ACCEPTED WITH CONDITIONS · §2 SUPERSEDED by… ACCEPTED WITH CONDITIONS · §2 SUPERSEDED by §2b, 2026-08-15	HIGH for the split · HIGH for the engine · MEDIUM for the vertex cap	4/4
023	The REST Services Directory: an HTML face for the API	ACCEPTED WITH CONDITIONS	HIGH	6/7
024	Shapefile import, and the exception it costs	ACCEPTED WITH CONDITIONS	HIGH	4/5
025	Governance: what a gift owes, and what it does not	ACCEPTED WITH CONDITIONS	HIGH	3/4
026	Serving through a platform-store outage: public-only, while blind	ACCEPTED WITH CONDITIONS	HIGH for the policy · MEDIUM for the window	4/5
027	Glyphs and sprites: the tile service could not draw a label	ACCEPTED WITH CONDITIONS	HIGH for the decision · MEDIUM for the coverage	4/5
028	Style documents: the one thing about a map a server cannot guess	ACCEPTED WITH CONDITIONS	HIGH	2/5
029	Affinity routing is not the default, and A-003 stops being load-bearing	ACCEPTED WITH CONDITIONS	HIGH for the reversal · MEDIUM for what replaces it at scale	2/4
030	Reading the reference implementation, not only its documentation	~~ACCEPTED WITH CONDITIONS~~ WITHDRAWN the permission this ADR granted ended 2026-09-09 by owner decision.	MEDIUM	2/3
031	A service's capabilities are configured, and configuration only ever restricts	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
032	The product is named Graticula	ACCEPTED	HIGH	3/4
033	Symbology: one canonical document per layer, and both protocol faces derive from it	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH for the canonical model · MEDIUM for the derivation's fidelity	5/5
034	Two surfaces over one API: Server for the operator, Studio for the publisher	ACCEPTED WITH CONDITIONS	HIGH for the split · MEDIUM for where each screen lands	5/5
035	Role privileges are editable, except the administrator's	UNKNOWN	—	7/7
036	Groups, and the two axes an authorization answer now has	UNKNOWN	—	5/5
037	Job workers come in two kinds	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
038	How a geodatabase becomes one service with many layers	UNKNOWN	—	5/6
039	WFS 2.0, read-only, is the first surface after v1	UNKNOWN	—	5/6
040	The portal surface is how ArcGIS Pro connects	UNKNOWN	—	4/4
041	The map renderer, and the two faces that hang off it	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH for the placement and the library · MEDIUM for labels · HIGH for throughput,…	6/6
042	OGC API Features, and the inversion it unwinds	ACCEPTED WITH CONDITIONS	HIGH for the decision, which was already taken · MEDIUM for the conformance claim until…	5/5
043	ImageServer, and where the raster Tier 1 line falls	ACCEPTED WITH CONDITIONS	MEDIUM for the decomposition and the Tier 1 line · LOW for the first cut's completeness,…	6/6
044	Tiles are served, because the claim had to be true	ACCEPTED WITH CONDITIONS	HIGH	6/6
045	The server keeps a log you can ask questions of	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
046	Admission control bounds the queue, not the wait	ACCEPTED WITH CONDITIONS	MEDIUM	4/5
047	The outbound licence is Elastic License 2.0	ACCEPTED	HIGH for the decision · MEDIUM for what it will cost in adoption	2/3
048	CI does not run the real-data suites, and says so on every run	ACCEPTED	HIGH for the exclusion · MEDIUM for whether announcing it is enough	1/2
049	A face refuses in its own vocabulary, even when that vocabulary has no word for it	ACCEPTED	HIGH for refusing at all · MEDIUM for which exception code
050	A release is a tag, and what it publishes is two images	ACCEPTED	HIGH for the registry and the trigger · MEDIUM for the tag scheme
051	An appearance is chosen by looking at it	ACCEPTED	HIGH
052	The canonical symbology document is CIM	ACCEPTED WITH CONDITIONS	MEDIUM	3/5
053	The symbology editor is three columns, and the item page has a head	ACCEPTED	HIGH
054	The symbology document is not bounded	ACCEPTED	HIGH — MEDIUM on what replaces the bound until 2026-09-05, when condition 1 was measured	1/2
055	A connection is fields, and this server assembles it	ACCEPTED	HIGH	0/2
056	An item is its own thing, and a service is one kind of it	ACCEPTED	HIGH — MEDIUM on the field layout until 2026-09-05, when condition 1 was answered	1/2
057	Composing and publishing a service	ACCEPTED	HIGH for the composition and the publish rules · MEDIUM for the faces	6/7
058	The datastore's schema is edited from the screen	ACCEPTED WITH CONDITIONS	HIGH for the rule and the refusals · HIGH for the dependency list — MEDIUM until…	4/4
059	Quiescing a data source	ACCEPTED WITH CONDITIONS	HIGH for the refusal and the deadline · MEDIUM for the window's length · LOW for the…	4/5
060	The axis order comes from the authority's register, carried as data	ACCEPTED WITH CONDITIONS	HIGH for the answer, which is the authority's own · HIGH for the defect, measured on a…	3/4
061	Metrics are aggregate; per-entity numbers live in the admin API	ACCEPTED WITH CONDITIONS	MEDIUM	2/2
062	The query face streams, like every other face	ACCEPTED	HIGH — the choice is between two behaviours that were both measured on the same route…
063	A field list may differ from the table, in two ways and no more	ACCEPTED WITH CONDITIONS	~~MEDIUM — the decision is the owner's and the shape is forced by what already exists,…	3/3
064	Editor tracking, and what `features:edit` means	ACCEPTED WITH CONDITIONS	MEDIUM	3/3

Open questions

Uncertainty is recorded rather than hidden. An empty list here would mean the recording stopped, not that the uncertainty did.

Architecture debt

Temporary compromises, each with the trigger that repays it. A compromise with no trigger is a permanent decision wearing a temporary label.

ID	Debt	Repay when	State
D-04	Multi-tenant resource isolation is not designed.	Before multi-tenant deployments are supported	PARKED
D-10	ADR-015 is implemented for local passwords only.	OIDC before the first deployment with an IdP; /generateToken before any unmodified ArcGIS client is pointed at us The…	PARKED
D-107	Elevation in the source is dropped and only counted.	Whenever 3D storage is decided, or the first user who notices their contours flattened	PARKED
D-108	The pipe streams and the importer does not, so the million-feature ceiling has not moved — it has changed owner.	The first archive with a layer past a million features, which is an ordinary size for a national road network	PARKED
D-115	The Server/Studio surface split is the single cause of four recorded console defects.	The next defect whose cause is the split	PARKED
D-144	~~Nothing bounds how long one request may hold a database permit.~~ The headline is struck 2026-09-09 rather than reworded, because it was false and the correction had already been written into this row's status cell without reaching its first sentence — half…	A way to refuse before the first byte, or a way to end a response that says why.	PARKED
D-162	A provider that is not PostGIS would be handed PostGIS SQL.	When DuckDB is designed as the file-format query engine (Q-81), and not after.	PARKED
D-261	Every request under /rest/services makes six to eleven short database round trips, and that — not the query, not the response size, not admission control — is what holds the path at about 1,300 requests a second.	A deployment whose request rate approaches it, or the day the catalogue and identity reads are held the way ADR-015 §3a…	PARKED
D-262	The product's own containers are amd64 only, so docker compose up — the first command README.md offers — fails on every arm64 machine.	The release workflow publishing both architectures, which GitHub's arm64 runners make free for a public repository; and…	PARKED

248 repaid — every one of them kept in the register with what it cost, because a repaid debt is evidence and this page is only the work

Assumptions

Invalidating one triggers a review of every ADR that rests on it. The unvalidated majority is the honest state of the project, not an oversight.

ID	Assumption	State
A-001	The tile path is CPU-bound enough that language performance materially affects capacity	VALIDATED
A-002	Single-binary distribution is genuinely valuable for air-gapped installs, not just aesthetically pleasing	UNVALIDATED
A-003	Most published services are idle most of the time, making shared workers viable	DOWNGRADED
A-004	Hot-path geometry overhead is material enough to justify our own primitives	VALIDATED
A-005	Geometry running in the same runtime meaningfully reduces defect resolution time versus FFI	UNVALIDATED
A-006	One internal geometry representation can serve both the feature path and the tile path without a second conversion	VALIDATED
A-007	Crash containment is required in practice, not merely in principle — workers really do die (GDAL on malformed input, plugins, OOM)	CONTESTED,
A-008	Administrators will not correctly hand-tune per-service worker settings, so defaults must be good and adaptive	VALIDATING
A-011	A distinguished central manager process is a robustness and recovery liability, so placement and routing state must be recoverable without one	VALIDATING
A-012	The sharing question is really about per-service state size, binding cost and neighbour tolerance — not about "shared versus dedicated"	VALIDATING
A-013	Our Tier 2 dependencies (GDAL, GEOS, PROJ) are thread safe enough to permit a threaded worker model	VALIDATED
A-014	Routing requests to workers already warm for a service materially improves L1 hit rate without wrecking load balance	DOWNGRADED
A-015	Per-service warm state is small — connections, schema, symbology, fonts, CRS — making bind/unbind cheap	VALIDATED
A-018	~~A deliberately boring platform schema can be supported across SQLite and PostgreSQL at acceptable cost~~	SUPERSEDED
A-019	In-process MVT encoding can meet our latency targets	VALIDATED
A-020	Cache seeding absorbs the provider performance gap, so an expensive Oracle tile path is acceptable when paid once rather than per request	UNVALIDATED
A-036	RLS delegation and large streaming reads do not collide often — the layers wanting row-level security are not usually the layers wanting bulk export	UNVALIDATED
A-035	Data source count stays low relative to service count — many services share one registered database	UNVALIDATED
A-032	COG range-request traffic is view-proportional, so proxying it costs about what serving tiles costs	UNVALIDATED
A-033	Target clients can render COG directly, so serving one format suffices	UNVALIDATED
A-034	Internal ports designed for our own use will be good enough to become a plugin contract later, without a redesign	UNVALIDATED
A-030	Lease expiry plus checkpoint verification prevents one job running twice across nodes	UNVALIDATED
A-031	Job rate stays low enough for a database-backed queue — jobs per minute, not messages per second	UNVALIDATED
A-028	Administrators can and will declare layer volatility usefully, and keep it roughly accurate	UNVALIDATED
A-029	Tiles, not feature query responses, are where cache reuse actually is	UNVALIDATED
A-026	OGC API Features Parts 1+2+3 plus additive extensions can express what §28 requires, without bending the standard's meaning	UNVALIDATED
A-027	Optimistic concurrency can be made correct against writes we never see, by relying on database-maintained versioning rather than our own event record	UNVALIDATED
A-025	A small number of pinned service contexts suffices for real deployments, and administrators will not pin everything	UNVALIDATED
A-024	A small residual executor plus explicit refusal is acceptable to real users, given a capability report published in advance	UNVALIDATED
A-022	~~The datastore schema can be created on PostGIS, SQL Server Spatial and Oracle Spatial at acceptable cost~~	SUPERSEDED
A-023	A cheap schema fingerprint can be polled often enough to detect drift on registered sources without loading the source database	UNVALIDATED
A-021	Filter and predicates can be pushed down usefully on all three spatial dialects — narrowed by Q-67: clip and simplify no longer need to be, since only PostGIS serves tiles.	VALIDATED
A-017	Data sources will frequently be foreign and possibly read-only, so the platform cannot rely on DDL rights in them	VALIDATING
A-016	GDAL-backed providers can be made optional, so a PostGIS-only deployment ships as one artefact	VALIDATED
A-037	Allocation rate, not CPU, sets the tile-serving ceiling per worker	VALIDATED
A-038	GDAL is needed for the import formats we care about at all	INVALIDATED
A-039	~~Every provider can clip server-side cheaply enough to avoid shipping whole geometries~~	SUPERSEDED
A-040	All three engines can stream BLOBs out of a query without materialising them in our process	UNVALIDATED
A-041	A bounded separate connection pool is sufficient protection against slow-client exhaustion during attachment streaming	UNVALIDATED
A-042	Caps on vertex count, batch size and wall clock are sufficient to make a public general-overlay endpoint safe	INVALIDATED
A-043	Six geometry engines can be made to agree closely enough that the same query returns the same answer on any provider	VALIDATED
A-044	Certificate rotation can take effect on the next handshake without recycling the listener or the worker	VALIDATED
A-045	Soft-fail revocation checking is an acceptable posture for the air-gapped profile	UNVALIDATED
A-046	An opaque-token session lookup per request is affordable at the concurrency ADR-007 targets	VALIDATED
A-047	Every provider supporting RLS delegation can accept a principal name we generate, through administrator-controlled mapping	UNVALIDATED
A-048	Expand-and-contract is achievable for every migration we will need, including index and constraint changes on large hosted tables	UNVALIDATED
A-049	A curated Python wheel set can cover realistic geoprocessing without pip at runtime	UNVALIDATED
A-050	Per-worker allocation rate and GC pause can be sampled continuously, cheaply enough to be always-on metrics	UNVALIDATED
A-051	A supervisor-served admin surface can authenticate without the platform store without becoming a bypass	UNVALIDATED
A-010	The 100–1,000 service target will not shift upward by an order of magnitude after launch	UNVALIDATED
A-057	STAsMVT output is acceptable to the ArcGIS and MapLibre clients we care about	PARTLY
A-058	The datastore has spare capacity for tile encoding in a 100–1,000 service deployment	UNVALIDATED
A-059	A vertex cap bounds the work for single-pass geometry operations	UNVALIDATED
A-060	Using the datastore's PROJ rather than an in-process library costs nothing that matters	PARTLY
A-061	An administrator's first act against an unfamiliar server is to open its URL in a browser	UNVALIDATED
A-064	A security report will arrive at some point after publication, and the cost of having nowhere to send it exceeds the cost of the policy	UNVALIDATED
A-065	Requiring a DCO rather than a CLA does not deter contribution, and requiring a CLA would	UNVALIDATED
A-066	A stale Public grant discloses nothing that was not already disclosed	VALIDATED
A-067	Platform-store failures that leave the data sources up are common enough to be worth serving through	UNVALIDATED
A-068	Fifteen minutes is longer than a transient outage and shorter than one nobody is handling	UNVALIDATED
A-069	One Latin/Greek/Cyrillic typeface serves the deployments this product is for	UNVALIDATED,
A-070	Substituting an unavailable font beats refusing the request	UNVALIDATED
A-071	One style per service is enough to be useful, even though it is not enough to be finished	UNVALIDATED
A-072	Refusing a style at write time costs an author less than a blank map costs them at read time	UNVALIDATED
A-073	Warm-state fragmentation across workers costs less than the affinity control system would cost in instability	UNVALIDATED
A-074	A QGIS or GDAL client asking a WFS feature type for its default output format gets GML 3.2 — so a WFS offering only GeoJSON would not have connected, and the GML writer is…	VALIDATED
A-075	ArcGIS Pro's portal connection works against a portal API this project implements, rather than requiring something only Esri's own portal returns	VALIDATED
A-076	A CPU rasteriser meets the latency a WMS client expects at typical image sizes on this runtime, without the allocation profile ADR-007 §4.14's worker sizing has no term for	VALIDATED
A-077	The canonical symbology document carries enough to draw a map a cartographer would accept, rather than enough to describe one.	PARTLY
A-052	Enforcing the user-type ceiling costs nothing in deployments that never use it	UNVALIDATED
A-053	A fused deployable remains operable at the top of the stated scale target — 1,000 services	UNVALIDATED.
A-054	Catalogue load and serving load stay similar enough that separate scaling is never forced	UNVALIDATED,
A-055	A single-page console with no build step stays maintainable	UNVALIDATED.
A-056	Operators want start/stop rather than only sharing	UNVALIDATED
A-062	256 MB uncompressed is above any shapefile a person uploads through a browser and below what troubles the machine	UNVALIDATED
A-063	Refusing an undeclared encoding costs less than silently corrupting text	UNVALIDATED
A-078	An operator would rather write MapLibre than a format we invented, because tools exist for the first	UNVALIDATED,
A-079	The publisher and the operator are different people often enough for two surfaces to be worth their cost	UNVALIDATED,
A-080	admin:manageServer is the right single gate for Server, so no reader is left without a tool they need	UNVALIDATED
A-081	The operator console is read on a screen at least 1,180 CSS pixels wide	SUPERSEDED
A-082	The EPSG register's axis definitions change rarely enough that regenerating from whatever proj.db the PostGIS image ships is soon enough	UNVALIDATED
A-083	No deployment needs an axis answer for a CRS code PROJ's own register does not carry	UNVALIDATED
A-019	In-process MVT encoding meets latency targets — on PostGIS only, which v1 made the whole of it: D-05 closed 2026-08-24 with the scope cut	2026-08-12
A-004	Hot-path geometry overhead justifies our own primitives	2026-08-12
A-001	The tile path is CPU-bound enough that language performance materially affects capacity	2026-08-12
A-013	GDAL, GEOS and PROJ permit a threaded worker model	2026-08-12
A-009	PostgreSQL/PostGIS is an acceptable hard dependency for the baseline deployment	REINSTATED

What is verified

Counted from [Fact] and [Theory] attributes in the test sources, so this number cannot drift from the suite that produces it.

Host

633

Conformance

485

Core

458

Platform.Postgres

395

Console

172

Api.ArcGis

148

Platform

142

Api.Wfs

113

Architecture

Render.Skia

Security.Argon2

Raster.Tiff

Recent work

90f51d72026-09-12The published images carry both architectures
c4186552026-09-12The datastore image builds on arm64, because the official one does not
43bcd322026-09-12The query path's ceiling has a name: six to eleven database round trips a request
78ed2d62026-09-12A debt that is decided and waiting on a trigger is parked, not open
69551072026-09-12ADR-046 condition 1 re-measured after D-249: the pipeline is flat, the query path is not
7cce7982026-09-11features:edit changes your own features, on a layer that records who created them
1589dbc2026-09-11The Datastore card sits in the row, says its owners are a list, and says why Read again may repeat
2200e052026-09-11D-243 closes: a claimed job holds a lease, and a job whose worker died is taken back
6136b6c2026-09-11D-237 closes: /admin/health says how large the datastore is and whose layers fill it
d2ce7262026-09-11D-259 closes: the Publish half was D-173's second wave on a fetch, and a red toast now reaches the report
735947a2026-09-11The console harness waits out Chrome's verifier rebuild, and presses what it rewrites
3fcb8402026-09-11An outage's own words reach the operator's log, so /admin/health can stay redacted
f72877e2026-09-11ASP.NET Core writes nothing per request unless somebody asks it to
d8a3b092026-09-11An anonymous request no longer asks the platform store who it is