Constraints

• Logout must revoke immediately — support runs "log out all devices" during account-takeover response.
• Session writes happen on every request (rolling expiry), so the store sees full request volume.
• The team already operates Redis for rate limiting; nobody runs Dynamo-style infrastructure today.

Settled last week

How the session id travels was decided before this page and the client change is merged, so it reads as one line — open it if you want the alternatives.

How payments were asked

Payments settled the same question in March. Their page put it in two cards with the operating cost on the front of each, which is a framing worth copying. Their answer travels less well, since they had a tenth of our write volume and nothing that had to survive the store going down.

Options

The two cookies

The recommendation rides two cookies with different jobs:

One revision is waiting on you below: accept or reject it with the controls in the margin, and the next version carries whichever you chose.

What I pick up next

Whichever store wins, three jobs stand behind it, and each is argued somewhere above rather than in a card of its own. Pick the ones worth starting — click a row, or Tab to its mark and press Enter — and the box takes anything the rows don't cover, including "none of these".

Timeline

Root cause

The export worker treats any failure as retryable. One workspace carried an attachment with a declared size of −1, which fails serialization every time; with retries capped by attempt count but not by queue position, the job returned to the head on each attempt and starved everything behind it.

Follow-ups

1. Classify worker failures as permanent vs. retryable; dead-letter permanents on first failure.
2. Re-enqueue retries at the tail.
3. Alert on a single job id exceeding five attempts, not only on queue depth.

Shape of the change

The interesting part is gateway/limits.py:41: the bucket key changes from the remote address to the token id when one is present. Everything else is plumbing that key through.

The ceilings themselves

None of these numbers move. What moves is what they are counted against: a plan's ceiling used to be spent by every client behind one address, and is now spent per token.

The core diff

Why the prefixes matter

def bucket_key(self, request):
    if request.token:
        return f"tok:{request.token.id}"
Unprefixed, a token id that happens to look like an IP would share a bucket
            with that address. The prefixes make the two namespaces disjoint.
    return f"ip:{request.remote_addr}"

Testing

• Unit: bucket key for tokened, untokened, and both-present requests.
• Integration: two tokens behind one address each get a full budget; two addresses on one token share one.

Both suites run under the rate-limit marker:

# the integration half needs the migration applied first
cd gateway && alembic upgrade head
pytest tests/ -m ratelimit --maxfail=1

Milestones

The long-tail gap

The old engine's synonym table carries fifteen years of manual curation; the new engine currently ships without it. On tail queries where a synonym was the match, we lose the document entirely, which is most of the −0.03.

Next week

1. Import the synonym table export when it lands Tuesday.
2. Re-run the shadow comparison on the tail set.
3. Draft the cutover guardrails (error rate, zero-result rate, p95).

Right now

Work

Blocked

Finance export reconciliation needs a fixture with a partially refunded order. The rest of the rehearsal does not depend on it; the agent left the check open and moved on.

Latest events

Triage notes

The migration stamp bug is the only one with data risk; it blocks the release even if the fix slips a day. The logout fix is trivial but touches the auth path, so it rides the same release train rather than a hotfix.

Needs you

Two items, one decision each. The tree's ambers are the milder tier — work finished and readable whenever you sit down; they queue, they don't interrupt. Everything else on the page is news, not a request.

Land the schema migration?

The migration adds the two nullable columns the reconciliation work writes into. It touches schema/atlas.sql, which is in the overlap zone, so it holds for your word rather than landing on green tests — file-disjoint tasks still meet in this schema, which is why it is listed. Landing it unblocks the variance report; holding it keeps main untouched but idles finch after today. Click an option to decide.

The reconciliation fixture is yours

Reconcile ledger exports is blocked on a fixture with a partially refunded order, which only you can pull from the production replica. One command, pasted in a comment here, unblocks it.

Work

The plan as it stands, counted by its leaves. Amber means finished by its agent and waiting on your review; red is stuck, and says on what.

Agents

Feed

Standing policy

Tasks are scoped not to share files, branch from the same base commit, and merge one at a time after a test run against current main. Mechanical changes land on green; anything touching schema/, auth/, or a public contract holds for your word, however green the tests. The grant is yours, recorded below — click to tighten or revoke it any time — and any landed change is a revert away for as long as you care to look.

CLI

API

Kept deliberately dry — the Sunset header does the announcing, and the migration guide carries the detail.

Console

The run list grew a status column, so a failure now reads off the list instead of costing a click each. It is the release's only visual change.

before

after

before after

Operations

Left out on purpose

The dependency bumps and the flaky-test fixes stay in the changelog only — nothing a user would change behavior over. If one of them deserves a note after all, say so in a comment and a draft for it arrives in the next version.