We have no customers to show you. Here is our own record instead.

Why, at the time

Email capture was about to become the main way decisions arrive, and a queue that drains once a day would make the channel feel broken.

What happened

Vercel’s Hobby plan refuses any cron that runs more than once a day, and it rejects the deployment at creation — so no deployment record is ever produced. The dashboard showed nothing wrong and the live site quietly kept serving the August 3 build for twenty-six days. Roughly four weeks of merged work, including the entire email capture path, was never actually in production.

Why, at the time

Restoring sub-daily schedules costs money. That is a spend decision, and it should not be made by accident to work around an engineering constraint.

What happened

The channel stayed responsive on the free plan. A stuck message no longer waits a full day while mail is still arriving, and the runbook records the constraint so the next person does not rediscover it.

Why, at the time

An enforcing CSP that is wrong breaks the site for everyone at once, and the failure mode is silent for anyone not watching a console.

What happened

Report-only ran clean, the policy was promoted to enforcing, and nothing broke. The escape hatch has not been needed.

Why, at the time

The individual and team products were pulling the data model in opposite directions, and the research said the individual framing had a retention problem we had no answer for.

What happened

The model simplified sharply — every decision now belongs to an organization, and row-level security has one rule to enforce instead of two. It has held with no pressure to reverse it.

Why, at the time

Handing a product your inbox is the moment you should be suspicious of it, and a guarantee enforced by the database is worth more than a promise in a policy.

What happened

The organization-only migration two changes later dropped the policies, the function and the column, and nobody noticed at the time. The guarantee is gone; the site now says plainly that every active member can read the ledger and the captured mail behind it.

Why, at the time

Slack is where the discussion already happens, and asking people to open another tab is how decision tools die.

What happened

The handler was built and never given a way for anyone to actually install it. Zero installations exist. It was removed from every piece of marketing on September 4, two months after it was written.

Why, at the time

Revoking it breaks anonymous reads across nine tables that rely on those functions inside their own row-level security policies. The advisor flags the shape, not the consequence.

What happened

The grant stayed, the reads kept working, and the reasoning now sits in the migration where the next person to see the warning will find it.

Why, at the time

A decision record is only worth keeping if everyone who makes a decision writes it down. Per-seat pricing gives you a reason not to invite people, which attacks the one behavior the product depends on.

What happened

Published on September 3. Billing was not switched on at the time and no one had paid anything, so there was nothing to report yet. Recorded here so that the claim is on the record before the result is known.

Why, at the time

It sounded like an established category, and being in a category people already search for seemed safer than inventing a name.

What happened

It is an enterprise business-intelligence category owned by companies with sales teams and a decade of backlinks. Unwinnable for a product with no customers, and the traffic it does attract is looking for dashboards. Replaced the next day with the terms an operations lead actually types.

Why, at the time

The product asks people to hand over their email and trust a ledger. Honesty in that much detail felt like the differentiator.

What happened

Roughly half the page’s height was objection-handling placed before any reason to want the product, and the section that makes anyone want it sat at sixty-five percent scroll depth. Cut by forty-seven percent the following day, with the detail moved to a second page rather than deleted.

Why, at the time

A decision ledger is one product decision away from becoming an employee-monitoring tool, and a screen that merely sits behind a flag can be turned back on by anyone in a hurry.

What happened

The screen is gone rather than disabled. The organization dashboard computes its rates from a database view that physically contains no title, summary or message text, and looks titles up separately to label the decisions it lists.

Why, at the time

Blocking every pull request on a third-party advisory we cannot fix teaches people to ignore the pipeline.

What happened

The step talks to the registry and hung twice in a row, taking the whole job to its fifteen-minute timeout. Two runs reported as canceled even though lint, type-checking, the tests and the production build had all passed — and both commits were already live. Fixed with a two-minute timeout on the step.

Why, at the time

The project had moved to a Vercel team on the Pro plan, which allows a cron every minute rather than once a day. The daily schedule, the ±59-minute slack the staleness windows were sized for, and the comments explaining all of it were compensating for a constraint that no longer applied. Leaving them was the real risk: a stale platform assumption written into the code is precisely what produced the twenty-six-day outage, and the second reader has no way to tell a live constraint from an expired one.

What happened

Committed on September 11. Whether an hourly retry measurably shortens how long a stuck message waits cannot be known yet — there was too little inbound volume to observe at the time. What is already true is narrower: a test now fails if a schedule in vercel.json and its staleness window in the code disagree, which is the drift that left an hourly job with a thirty-hour window in the first place.

Why, at the time

The published promise was that the allowance was a meter and never a lock, on the reasoning that the hard part of this product is getting teams to log decisions at all. That reasoning held while nobody could pay: refusing a write that no amount of money could unblock is not a price, it is breakage. Once Checkout existed the refusal had a way out, and an allowance nobody is ever held to is a price list rather than a price.

What happened

Shipped and deployed on September 11 behind two conditions, so it stayed inert until the limit was switched on AND a checkout could actually complete. Nothing had been refused at the time — the only workspace was at seven of ten decisions for the month — and nobody had paid. This supersedes the September 3 pricing entry, written while billing was still off. Two things did not survive contact: the meter counted the decision rows that still existed, so deleting one refunded allowance and the limit could be spent over and over, which took a database trigger and a counter that only climbs; and the environment variable that arms the limit turned out to arm every paid-feature gate as well, so the same deploy closed export, import and the weekly and monthly reports for that workspace, which nobody had decided to do that day.