Shipping Notes, 15 September 2026: The Gates Started Firing, on the Wrong Things
274 commits across 16 repositories. Having spent a fortnight finding checks that never ran, we spent this one making them run — and then two weeks discovering how many of them fired on things that were perfectly fine.
Every fortnight we publish what actually shipped across the group.
274 commits across 16 repositories. The last edition was about safeguards that existed, were documented as existing, and had never once executed. This fortnight we wired them up.
Then we spent most of it finding out how many of them were wrong.
The numbers
Two hundred and seventy-four commits, sixteen repositories. The book-review pipeline dominated at 84, most of that gate work, followed by the content pipeline at 37 and the Potentialz site at 34.
The finding: a gate that fires on nothing real is on its way to being ignored
Five separate false positives, in five different checks, all of which had been switched on within the previous fortnight.
A thumbnail check that was a false negative
The publish step’s thumbnail verification reported a problem where none existed. A check that blocks a correct publish teaches you to bypass it, and a bypassed gate protects nothing.
Brand-drift firing on real book covers
A visual drift detector, meant to catch a rendered frame straying from brand, was flagging genuine book covers as drift. The covers were correct. The detector’s notion of “our brand” did not accommodate the one thing the product is built around.
Caption drift blocking on an artefact of the transcriber
A caption-alignment check was failing on the opening of videos, because the speech-to-text model produces characteristic artefacts in its first seconds. The video was fine. The measurement was reading noise as signal, at exactly the point where every video has noise.
Claims grounding demanding a source for every number
A grounding check, meant to ensure statistics in a script are backed by a source, was treating every bare number as a statistic. “Three ways to do this” required a citation. It now grounds statistics rather than digits.
Stale shorts releasing after a re-cut
Not a false positive but the same family: the scheduler had no cutoff, so videos recorded before a re-cut could still release. A date cutoff now prevents it.
The harder finding: our own review of our own fixes was wrong
The clearest thing that happened this fortnight is uncomfortable to write.
A round of gate fixes was reviewed, signed off, and shipped. A second pass found that two of them were wrong — and that the signing step itself had a defect. A third pass found more: a threshold set at 40 that should have been 49, and a failed network fetch that was being read as evidence of a fresh channel rather than as a failure to determine anything.
Three rounds. Each round found defects in the previous round’s corrections.
The pattern is specific and it is not carelessness. When the same person or process both makes a fix and verifies it, the verification inherits the assumption that produced the bug. What breaks the cycle is a separate pass that is trying to refute rather than confirm, and we now run gate work that way deliberately.
The associated practice, which the book-review pipeline adopted wholesale this fortnight: every gate is mutation-probed. You deliberately break the thing the gate protects and confirm it goes red on a real artifact. A green check that has never been seen to go red is not evidence.
Also shipped
The internal-linking engine was rebuilt. The previous version searched for link opportunities per post, which is quadratic and stalled on the full corpus; the replacement plans the whole graph in three linear passes and emits a plan you can read before anything is written. It also gained a rule that no link may be placed on a line quoting a price, after 315 had been.
Twenty-five commercial pages moved off an editorial route on the apps site onto their own commercial routes, with 301s from every old URL and 175 internal links repointed. Their structured data changed from Article to Service at the same time, because a URL and a schema type that disagree are worse than either being wrong alone.
A defect was fixed in how the link planner derives URLs: it had been using the filename, while the sites build routes from a frontmatter slug where the author sets one. Thirty-one posts set one.
The social pipeline was fixed to read every spec and manifest as UTF-8 rather than trusting the platform locale.
The Potentialz search-console dataset was corrected to page through results properly, so zero-click queries are no longer cut off by the row limit.
What went wrong
Beyond the three rounds above: a spacing fix in the book-review layout revealed that the existing gaps were multiples of the wrong element’s dimension, so the whole scale had been subtly off. And a harvest of editorial reviews had been sitting on disk, complete, and was never ingested — present, unread, invisible.
Which is last fortnight’s finding again, in a different costume.
The thread
Two fortnights, two halves of one lesson.
A check that never runs protects nothing, and it is invisible because everything about it looks correct from the outside.
A check that runs and fires on things that are fine also protects nothing — and it is worse, because it actively trains the people around it to route past it. Alert fatigue is not a failure of discipline in the reader. It is the rational response to a signal that has stopped carrying information.
So the standard we have landed on has three parts, and a gate is not finished until all three hold. It runs on the real path. It goes red when something is genuinely wrong, proven by breaking that thing on purpose. And it stays green on the ordinary case, proven by running it across the actual corpus rather than a fixture.
The third is the one we skipped, and it cost us this fortnight.
Ganda Tech Services runs web, cloud, mobile and content operations for a group of Australian brands. These notes are published every fortnight, whatever they say.
