enforce vendor-class pool routing from exit_reputation — replace build-time RESERVED_HARD domain classification ( / enforcement phase)
enforce vendor-class pool routing from exit_reputation — replace build-time RESERVED_HARD domain classification ( / enforcement phase) bot protection system Bot Manager denies deep links without interaction telemetry — route to a T4 -warm session (vendor class, replaces identity rotation) prevent cannibalizing blog posts with a durable intent registry enforced on every generator Adaptive Unblocking Control Loop → staging consolidate existing cannibalizing blog posts — audit never runs in product
New Features
18enforce vendor-class pool routing from exit_reputation — replace build-time RESERVED_HARD domain classification ( / enforcement phase)
enforce vendor-class pool routing from exit_reputation — replace build-time RESERVED_HARD domain classification ( / enforcement phase)
Adaptive Unblocking Control Loop → staging
Adaptive Unblocking Control Loop → staging
require cross-egress consistency as positive evidence before delivering non-placeholder thin T4 pages
require cross-egress consistency as positive evidence before delivering non-placeholder thin T4 pages
spec + epic tracker — support@ inbound filtering and in-house CRM leads
spec + epic tracker — support@ inbound filtering and in-house CRM leads
Adaptive Unblocking Control Loop → staging
Adaptive Unblocking Control Loop → staging
merge post-auth, scrape-per-key and concurrency checks into one Lua call
merge post-auth, scrape-per-key and concurrency checks into one Lua call
win back the lapsed top-revenue accounts after reliability fixes
win back the lapsed top-revenue accounts after reliability fixes
activate cloud provider storage backup lane (relay account, keys, host-key pin, monitor, restore drill)
activate cloud provider storage backup lane (relay account, keys, host-key pin, monitor, restore drill)
monitor read access to all internal tooling, /var/log/monitoring, single-instance state and node-exporter textfiles on both hosts ( part 4)
monitor read access to all internal tooling, /var/log/monitoring, single-instance state and node-exporter textfiles on both hosts ( part 4)
earn anti-bot system clearance on cold T3 contact (in-house QuickJS device-check on the unified T3 path)
earn anti-bot system clearance on cold T3 contact (in-house QuickJS device-check on the unified T3 path)
adaptive per-domain backoff on target strain signals; replace static preemptive domain caps
adaptive per-domain backoff on target strain signals; replace static preemptive domain caps
hint render_js="auto" when a forced-render job fails on challenge or timeout ( option 1)
hint render_js="auto" when a forced-render job fails on challenge or timeout ( option 1)
obs-internal tooling close — the monitor account's single write (open→closed rename with lifecycle note) ( part 3)
obs-internal tooling close — the monitor account's single write (open→closed rename with lifecycle note) ( part 3)
follow-up: 1 deferred item(s) (deferred from )
follow-up: 1 deferred item(s) (deferred from )
Worker quota exhaustion must never take marketing pages offline
Worker quota exhaustion must never take marketing pages offline
Incident-ID issue-link cron that sets canonical_issue on open Critical/High internal tooling
Incident-ID issue-link cron that sets canonical_issue on open Critical/High internal tooling
obs-redis read-only allowlist wrapper (SLOWLOG/INFO/LATENCY/CLIENT LIST) absorbing obs-redis-keyspace ( part 2)
obs-redis read-only allowlist wrapper (SLOWLOG/INFO/LATENCY/CLIENT LIST) absorbing obs-redis-keyspace ( part 2)
make monitor_ro inherit pg_monitor/pg_read_all_stats so pg_stat_statements shows query text ( part 1)
make monitor_ro inherit pg_monitor/pg_read_all_stats so pg_stat_statements shows query text ( part 1)
Bug Fixes
76bot protection system Bot Manager denies deep links without interaction telemetry — route to a T4 -warm session (vendor class, replaces identity rotation)
bot protection system Bot Manager denies deep links without interaction telemetry — route to a T4 -warm session (vendor class, replaces identity rotation)
prevent cannibalizing blog posts with a durable intent registry enforced on every generator
prevent cannibalizing blog posts with a durable intent registry enforced on every generator
consolidate existing cannibalizing blog posts — audit never runs in production
consolidate existing cannibalizing blog posts — audit never runs in production
4h45m cloud provider host outage (2026-10-16 21:39–02:24Z) went undetected; no off-host availability probe
4h45m cloud provider host outage (2026-10-16 21:39–02:24Z) went undetected; no off-host availability probe
cloud provider scraper-lite stuck in autoheal restart loop for ~6h (restarts never recovered; only recreate did)
cloud provider scraper-lite stuck in autoheal restart loop for ~6h (restarts never recovered; only recreate did)
Phantom T4.5 returns bot protection system Edge deny page as a billed success — re-check drops T3 status/headers
Phantom T4.5 returns bot protection system Edge deny page as a billed success — re-check drops T3 status/headers
Inline-path options snapshot hand-mirrors the worker payload and records has_* flags as false for headers/body/extraction/custom keys (review finding — )
Inline-path options snapshot hand-mirrors the worker payload and records has_* flags as false for headers/body/extraction/custom keys (review finding — )
pre-T3 origin probe counts a stalled proxy CONNECT (tunnel_timeout) as dead-origin witness, fast-failing live sites (review finding — )
pre-T3 origin probe counts a stalled proxy CONNECT (tunnel_timeout) as dead-origin witness, fast-failing live sites (review finding — )
paid-request failure rate regressed from ~5% (Apr) to 30-40% (Sep-Oct)
paid-request failure rate regressed from ~5% (Apr) to 30-40% (Sep-Oct)
10x capacity headroom on existing hardware — 0.8 -> 8 jobs/sec with zero 5xx (supersedes , fitted to the retired 8 vCPU box)
10x capacity headroom on existing hardware — 0.8 -> 8 jobs/sec with zero 5xx (supersedes , fitted to the retired 8 vCPU box)
bot protection system identity-rotation, stage-span and event-loop test failures on deploy
bot protection system identity-rotation, stage-span and event-loop test failures on deploy
mandate-wording guard breaks after waf_block marker moved to (deploy )
mandate-wording guard breaks after waf_block marker moved to (deploy )
map new cron jobs in the RSI periodic-job inventory (deploy )
map new cron jobs in the RSI periodic-job inventory (deploy )
renumber duplicate 0451 rollout-cohorts migration blocking deploy
renumber duplicate 0451 rollout-cohorts migration blocking deploy
worker pytest session dies at 95% with no summary on deploy
worker pytest session dies at 95% with no summary on deploy
wire five unaccounted scripts/tests suites into CI jobs
wire five unaccounted scripts/tests suites into CI jobs
Chrome upgrade safety gate cannot parse refactored
Chrome upgrade safety gate cannot parse refactored
add external-availability-probe and storage-category-metrics to trusted-runtime closure
add external-availability-probe and storage-category-metrics to trusted-runtime closure
classify status-0 T3 failures by cause and deny T4 only on a confirmed reputation reject
classify status-0 T3 failures by cause and deny T4 only on a confirmed reputation reject
blog generation publishes nothing when the free LLM is rate-limited because exhausts the static topic pool
blog generation publishes nothing when the free LLM is rate-limited because exhausts the static topic pool
DatabaseBudgetStatusUnavailable fires permanently because worker processes export alterlab_db_budget_status_ok=0
DatabaseBudgetStatusUnavailable fires permanently because worker processes export alterlab_db_budget_status_ok=0
render_js browser-tier jobs run on WORKER_TYPE=http lite workers and OOM-kill them
render_js browser-tier jobs run on WORKER_TYPE=http lite workers and OOM-kill them
internal tooling-bridge leaves memos open when an alert vanishes without a resolved webhook; reconcile against Alertmanager
internal tooling-bridge leaves memos open when an alert vanishes without a resolved webhook; reconcile against Alertmanager
OpenRouterKeyLimitLow and openrouter_balance_low fire permanently against the deliberate $0.20 free-only key cap
OpenRouterKeyLimitLow and openrouter_balance_low fire permanently against the deliberate $0.20 free-only key cap
cache stall cascades into cluster-wide DB budget exhaustion because failed lease releases leak slots until expiry
cache stall cascades into cluster-wide DB budget exhaustion because failed lease releases leak slots until expiry
T4 content-validation rejections and time-budget stops are recorded as unknown failure_category
T4 content-validation rejections and time-budget stops are recorded as unknown failure_category
job-failure alerts count origin 404 (not_found) and 5xx (target_server_error) as platform failures
job-failure alerts count origin 404 (not_found) and 5xx (target_server_error) as platform failures
publish recovery outcomes for load balancer, scanner, security_rate_limit and api_cf_routing checks so memos auto-close
publish recovery outcomes for load balancer, scanner, security_rate_limit and api_cf_routing checks so memos auto-close
treat per-account 429s and customer-input 400s as expected so traefik_4xx_flood and security_rate_limit can clear
treat per-account 429s and customer-input 400s as expected so traefik_4xx_flood and security_rate_limit can clear
log-monitor titles every ERROR Critical Infrastructure Failure and re-pages every 15 min for a standing condition
log-monitor titles every ERROR Critical Infrastructure Failure and re-pages every 15 min for a standing condition
web error scan pages Critical on Next.js server-action scanner probes; filter and classify them
web error scan pages Critical on Next.js server-action scanner probes; filter and classify them
refund_retry_all_stores_failed log drops its extra payload, so the documented recovery can't be done from API logs
refund_retry_all_stores_failed log drops its extra payload, so the documented recovery can't be done from API logs
apex DNS check alerts DNS Mismatch on every Cloudflare edge IP; port the proxied-path check from check_api_dns
apex DNS check alerts DNS Mismatch on every Cloudflare edge IP; port the proxied-path check from check_api_dns
log-monitor.sh exits 1 when the LLM reply lacks ROOT_CAUSE, failing every ERROR cycle and the heartbeat
log-monitor.sh exits 1 when the LLM reply lacks ROOT_CAUSE, failing every ERROR cycle and the heartbeat
LLM auth/connection failure alert fires on free-tier 429s; classify as degraded and auto-close on recovery
LLM auth/connection failure alert fires on free-tier 429s; classify as degraded and auto-close on recovery
worker package manager.lock regenerated with package manager 2.4.3 breaks pinned 2.2.1 installs (deploy )
worker package manager.lock regenerated with package manager 2.4.3 breaks pinned 2.2.1 installs (deploy )
wire 3 new scripts/tests suites and make the wiring guard runnable locally (deploy )
wire 3 new scripts/tests suites and make the wiring guard runnable locally (deploy )
entitlement cache epoch ordering and invalidation gaps (review finding — )
entitlement cache epoch ordering and invalidation gaps (review finding — )
remove DDG Lite direct-egress burst timeout regression
remove DDG Lite direct-egress burst timeout regression
Cloudflare Worker route audit has never passed — token lacks Workers read scopes
Cloudflare Worker route audit has never passed — token lacks Workers read scopes
event-loop isolation from hangs the worker suite and breaks asyncpg diagnostics tests
event-loop isolation from hangs the worker suite and breaks asyncpg diagnostics tests
r2-evidence-lifecycle token recipe must use exact internal tooling YAML path (deploy )
r2-evidence-lifecycle token recipe must use exact internal tooling YAML path (deploy )
auto-resolve cloud provider worker-only error-trigger memos
auto-resolve cloud provider worker-only error-trigger memos
successes whose body is a classified challenge are billed in full and invisible to FalseSuccessRateHigh
successes whose body is a classified challenge are billed in full and invisible to FalseSuccessRateHigh
provision internal service analytics/GSC/analytics credentials in prod secrets and fail loud instead of reporting "stale"
provision internal service analytics/GSC/analytics credentials in prod secrets and fail loud instead of reporting "stale"
drop the per-IP rate-limit-global middleware from web-router so crawlers on public pages are never 429'd at origin
drop the per-IP rate-limit-global middleware from web-router so crawlers on public pages are never 429'd at origin
dev.to syndication returns 401 and 4,100 legacy content drafts are never dispatched or expired
dev.to syndication returns 401 and 4,100 legacy content drafts are never dispatched or expired
remove bm-verify from vendor-marker extras now derived from bot protection system provider (deploy )
remove bm-verify from vendor-marker extras now derived from bot protection system provider (deploy )
refund all-stores test vs budget-exempt fallback; economics contract test vs refactor (deploy )
refund all-stores test vs budget-exempt fallback; economics contract test vs refactor (deploy )
update deploy checkout-index and cutover-gate contract tests for and (deploy )
update deploy checkout-index and cutover-gate contract tests for and (deploy )
map ovh-internal tooling-issue-link in rsi-coverage.json (deploy )
map ovh-internal tooling-issue-link in rsi-coverage.json (deploy )
lost-data alerts (RefundRetryAllStoresFailed) must not auto-close their internal tooling on resolve
lost-data alerts (RefundRetryAllStoresFailed) must not auto-close their internal tooling on resolve
cache public marketing HTML so crawl volume never reaches origin (keep crawlers unthrottled)
cache public marketing HTML so crawl volume never reaches origin (keep crawlers unthrottled)
bot protection system bm_mi and vendor-script markers on complete real pages are classified as challenges
bot protection system bm_mi and vendor-script markers on complete real pages are classified as challenges
register test-deploy-internal tooling-issue-link-token-contract.sh with the CI suite guard (deploy CI)
register test-deploy-internal tooling-issue-link-token-contract.sh with the CI suite guard (deploy CI)
follow-up: /etc/server/sites-enabled/alterlab.conf (deferred from )
follow-up: /etc/server/sites-enabled/alterlab.conf (deferred from )
register internal tooling-issue-link.sh in the trusted-runtime closure and make the closure check part of lane validation
register internal tooling-issue-link.sh in the trusted-runtime closure and make the closure check part of lane validation
proxy cost provenance marks zero-byte metered attempts unknown, so ValidResultEconomicsCoverageDegraded fires permanently
proxy cost provenance marks zero-byte metered attempts unknown, so ValidResultEconomicsCoverageDegraded fires permanently
heartbeat-watchdog and ssh-guard drift alerts never create internal tooling; deploy should re-install guard shims
heartbeat-watchdog and ssh-guard drift alerts never create internal tooling; deploy should re-install guard shims
Web: SEO structured data, redirects and CLS
Web: SEO structured data, redirects and CLS
log-monitor billed-5xx 'retained' check matches any customer's debit, keeping a standing Critical REVENUE IMPACT memo
log-monitor billed-5xx 'retained' check matches any customer's debit, keeping a standing Critical REVENUE IMPACT memo
follow-up: Worker-scope WebGL/deviceMemory coherence (deferred from )
follow-up: Worker-scope WebGL/deviceMemory coherence (deferred from )
log-monitor tier-stats Lua SCAN freezes cache 2-6s every 15 min — root cause of the 2026-10-19 06:00Z outage
log-monitor tier-stats Lua SCAN freezes cache 2-6s every 15 min — root cause of the 2026-10-19 06:00Z outage
DB budget cap strands claimed jobs while database is idle
DB budget cap strands claimed jobs while database is idle
node-exporter cannot read the textfile collector dir under 0700 /var/lib/alterlab, so all textfile metrics are invisible
node-exporter cannot read the textfile collector dir under 0700 /var/lib/alterlab, so all textfile metrics are invisible
ChallengeCookieCacheZeroHitRate can't distinguish nothing-stored-to-reuse from a broken cache
ChallengeCookieCacheZeroHitRate can't distinguish nothing-stored-to-reuse from a broken cache
Bing submit/verify ignores the 100-URL daily quota and ThrottleHost, so discovery reports 0 verified indexed
Bing submit/verify ignores the 100-URL daily quota and ThrottleHost, so discovery reports 0 verified indexed
OPERATOR RUNBOOK: restore production recovery posture (ordered — backup, database, credential, cloud provider)
OPERATOR RUNBOOK: restore production recovery posture (ordered — backup, database, credential, cloud provider)
obs-redis-keyspace reports "no running api/worker container" on cloud provider while obs-queues works
obs-redis-keyspace reports "no running api/worker container" on cloud provider while obs-queues works
settlement checker flags failed batch jobs whose job-keyed refund covers the batch-keyed base debit
settlement checker flags failed batch jobs whose job-keyed refund covers the batch-keyed base debit
test_force_t4_preserves_executed_penetrator_engine hangs on an unreaped child process (deploy )
test_force_t4_preserves_executed_penetrator_engine hangs on an unreaped child process (deploy )
T3 reachable SLI buckets transport no-response failures as content, hiding the real T3 gap
T3 reachable SLI buckets transport no-response failures as content, hiding the real T3 gap
cache 'Too many connections' ~55/h on stream trim and alert processing paths
cache 'Too many connections' ~55/h on stream trim and alert processing paths
log-monitor runs an LLM agent with shell/write tools on the prod host, fed attacker-influenced log text
log-monitor runs an LLM agent with shell/write tools on the prod host, fed attacker-influenced log text
refund compensation must persist when cache or the DB budget gate is unavailable (all-stores failure drops refunds)
refund compensation must persist when cache or the DB budget gate is unavailable (all-stores failure drops refunds)
a single Reddit 401 trips a 7-day permanent circuit and the alert mislabels it as a ban
a single Reddit 401 trips a 7-day permanent circuit and the alert mislabels it as a ban