- Source
- Repository
- Releases
- 14
- Served
- Since 2026-08-18
Every entry below was written, reviewed and verified in the repository, and from 2026-08-18 onwards against the live database as well. Anyone can sign in and start a campaign on the free plan; two real tables keep testing it.
2026-09-03
A player at the wrong door, and one slug per campaign
- FIXA player signed in with an address that holds no seat at the table she was opening got an engineering strip above a crash, and neither sentence was addressed to her. The strip now says what is true of the reader: signed in, no seat here, and the two acts available. It names no campaign, so a table that does not exist and a table you are not in answer alike.
- FIXThe four character pages a player reaches from that link report not found rather than throwing into the error boundary. A page that is not yours to open is an answer, not a fault.
- FOUNDATIONA campaign slug is unique across the platform, applied to the live database. The campaign address carries no world and was resolved by a read with no ordering, so two tables that chose the same name could each be served the other one. Creation walks to the next free address and hands it back.
- FOUNDATIONA read-only way to ask which address holds a seat, run as one bound statement in a read-only transaction. A seat is a link and the address on it is whatever the person who opened it typed, so when a player cannot sign in, nobody could answer the first question worth asking.
2026-09-02
The trust floor, a reveal that reaches its reader, and the fields a world actually has
- SECURITYChecks had been failing on the main branch through two production deploys. Linting runs before the gates, so the row level security suite, which is the only mechanical proof that a player cannot read a sealed body, did not execute for either of them.
- SECURITYThe lockdown migration named three anonymous doors while the live database held five, and it is the documented recovery path. Re-running it would have closed every published campaign page and every issued key without a word. It names all five now, guards each grant, and refuses to apply if one is missing.
- FIXRevealing something now rebuilds the copy the reader holds. Concealment here is a written copy rather than a filter applied on the way out, so widening who may read a thing has to rebuild it, and nothing did: four players held a grant, a log line and a receipt each, and all four opened the page and read that the prose was not available. A rebuild that fails does not undo the reveal; it reports the copy as behind, because a stale copy is invisible from every counter on the page.
- FOUNDATIONThe nightly backup dumped half the product. Every reference to the authentication schema dangled and no storage manifest was captured, so restoring it produced a database nobody could sign in to, and it had been green every night for a fortnight because a valid dump of half a product is still valid. It now takes both schemas and the manifest, and a drill restores it into an empty database and fails if a member points at an account that did not come back.
- SURFACEA DM can say what their world records: custom fields and profiles, with the two dangerous verbs kept apart. Removing a field from a profile stops asking for it and keeps every value; deleting the field destroys every value everywhere, holds under a press, and says so.
- FIXA chat thread keeps up with the room. A message arrived for its sender and nobody else, so everyone else read a conversation frozen at the moment they opened it. The page asks the server to render itself again under the reader's own session rather than opening a second path out of the database.
- DECISIONA merge is no longer a deploy. Pushing to the main branch shipped to production, which was not what anybody believed it did. Production is now one deliberate act, from a clean tree, refused if the commit is unpushed or its checks are not green.
2026-09-01
A page for strangers, a key for a model, and guides that describe the product that exists
- SURFACEA campaign can publish a page to the open internet, DM only, at an address suggested apart from the campaign's own so that handing out one link does not hand out the other. Publishing holds under a press: a page that has been read and cached cannot be unread by taking it down. Absent, not live, archived and malformed all answer with one not found, because four answers would turn the address into a way to enumerate campaigns.
- SURFACEA member can mint a key that lets a model read what that member may read, and nothing else. The key is a member's rather than a DM's, is shown once, and reports when it was last used and never what was asked.
- FIXThe guides had gone on describing a product that no longer exists: the DM guide still said uploading a base image was not built, six days after it shipped, so a DM reading it never went looking for the control. Every retired claim is now paired with the file whose existence disproves it, and the check was proven red before it was believed.
- FOUNDATIONThe delivery layer had been written, reviewed and unreachable, because there was nowhere to get a roster: an address belongs to the account, not to the campaign. A DM-safe roster function closes that. Email is wired. The device switch stores your answer and says out loud that it is not sending yet.
2026-08-31
The simplicity pass: 42 of 45 findings
- DECISIONFour reviews read the product against one question, why does it not explain itself, and raised forty-five items. Forty-two are answered here. Three are declined with their reasons, including renaming the addresses a DM has already pasted into a chat.
- SURFACEThe rail is twenty-one rows down to eleven for a player and twenty-seven down to fifteen for a DM. Three of a player's rows were one character wearing three labels, and five were a hand-kept copy of a list the home page already renders with live counts. Search and help move into the header, where they can be used.
- SURFACEOne thing has one name. The reveal log stopped calling itself the register, the two names the board used for the world became the Record, and the guides stopped teaching internal names the interface had already changed, which is what sent a lost player looking for words that are not on screen.
- FIXA member seated after the world was prepared read nothing until the DM published to them, and finding the control that fixes it required already knowing how the copies are built. A strip now names the count and the act on all four surfaces a DM stands on. Its read fails to unknown rather than to clear, because silence there would be a claim that every seat can read the world, made out of an error.
- SURFACEFive surfaces about the same six people became two, split on whether they change somebody or only read them, and eight schedule tabs became four. Every route survives and every absorbed one still lights its parent.
- FIXThe character builder painted a motionless grey block for twenty-five to thirty seconds, which two readers took for a dead page. It renders its first screen on the server now.
2026-08-29
The seven questions a player asked, and the rulebook the builder was not reading
- FIXA player reached step nine of the character builder and sent seven questions. Five of them were the tool's fault. The worst cost her two proficiencies: every background in the live rulebook carries the labels a book prints where the model matches keys, so nothing threw, both boxes stayed tickable, and the check that should have caught the overlap compared against the same unresolved list. A label now resolves to its key, and anything that resolves to nothing is named on screen rather than going quiet.
- FIXChoices written inside a feature's prose are now asked. Three features say "of your choice" and the builder printed the paragraph and asked nothing, so one class was offered three cantrips instead of four and no human ever picked a skill.
- SURFACEReview opens on who the character is and what they have, and every skill row names the choice that granted it. It had shown numbers and nothing else, which is why three traits read as missing.
- SURFACEA player may write their own portrait and backstory. The policy widens by ownership, and the owner's door to their own prose refuses a body the DM has sealed rather than redacting it, because a curse a character does not know about themselves is exactly what a DM seals onto a player's page.
- SURFACEThe character builder reads the campaign rulebook's feats and spells beside the open ones, with the source printed beside the name, and a DM can correct a row rather than deleting it and retyping it. A spell that names no class this build knows is offered to nobody rather than to everybody, and a row that cannot be read is named with its reason.
- SECURITYA researcher who finds a flaw has somewhere to send it, with the same contact and the same windows as the other product. Dependency alerting is on, weekly, with minor and patch grouped so that major versions still get read.
2026-08-26
The door opens, the legal documents come into force, and sealing works from the editor
- FOUNDATIONCreation is open to anyone signed in, capped by the free plan rather than by an invitation list: two active campaigns, archiving one frees a slot, and a granted plan lifts the cap. Applied to the live database and driven there, including the refusal at three.
- FOUNDATIONThe privacy notice and the terms leave draft and are in force, the registered address being the last fact they were waiting on. A third document, "If this ends", states the shutdown commitments in advance: ninety days of notice to the address you signed in with, export open the whole period, deletion after, and the difference between that and simply lapsing.
- SURFACESealing works from the editor. The body, the visibility rows, their first grants and the reveal log commit in one transaction, so the editor's refusal that sealing was not wired came out the same day. Deleting a seal logs the withdrawal per grant and refuses while any body still points at it.
- SURFACEA map can carry a base image at last, uploaded by the DM, served back to the DM alone and role-checked on every request, because the raster carries no fog. The free plan's one map per campaign is enforced for the first time.
- SURFACEEarly access, said from one source across the status line, the badge and the footer. The waitlist is retired for the door it stood in for: start a campaign on the free plan through the same link that signs you in. A worked example shows one entry, three readers and the receipt, which is the first thing a cold DM asks to see.
- FIXThe upload ceiling drops from a fictional twelve megabytes to a real four. The host refuses a body over four and a half, so the old number was refused by the platform before the product's own check ever ran, and the page promised a size it could not take.
- FIXThe front page opens readable. Its first paint was a black stage with no words until a large video arrived, and none of the seven layer pictures ever loaded under the pinned hero, so the page showed empty plates where its own art belongs.
2026-08-22
The rulebook and chat on production, and the fixes before session zero
- FOUNDATIONChat, the campaign rulebook, and three more rulebook kinds applied to the live database, each verified there: row level security on, anonymous access absent from every grant.
- FIXEvery prose save reported WRITE FAILED over a body that had already committed, and backlinks were never recorded. Both fixed.
- FIXA proposed date can be settled and a player can answer it. The availability page and the docket no longer crash on the way there.
- FIXThe chat column tracks the plate rather than the status strip, and the sign-in check page stops promising a cross-device sign-in the link cannot deliver.
- SURFACEChecked against the live database and moved to RUNNING: export as Markdown and JSON, and lines and veils recorded on the table page.
2026-08-21
Notes, sheets, the rulebook, chat, and a front page
- SECURITYA character sheet is private to its owner and the DM. The read had been expressed against visibility rather than ownership, so every seated player could open every sheet.
- FIXA player can write a note. The insert was always permitted; the read-back of the new row was what was refused.
- FIXSign-in survives the clock skew that met the first real sign-in.
- SURFACEThe campaign rulebook: the table, the policies, the gates and the DM-only screens for what a table plays with beyond the SRD. Chat between sessions, with the DM able to voice an NPC.
- SURFACEThe front page is a scroll-scrubbed descent through the Record, with a picture for each of the four layers and the three things built on top.
- FOUNDATIONThe eleven seats for the two real tables issued.
2026-08-20
The Interlude live, the SRD pack, and sign-in fixed
- FOUNDATIONThe six Interlude doors the product had always called and the database never had, and the calendar feed answering a token-identified reader with no session.
- SURFACEA starter pack from SRD 5.2.1 via Open5e under CC BY 4.0, installed on the live database and read back: monster tables by tier, magic finds, nine original tables and three generators. A player guide. Your own denominations.
- SURFACEPortraits, session notes, reveal receipts, the Delta, and a generated sigil for every entity.
- FIXThe commonest sign-in failure printed UNKNOWN. It is named now, and the whole path was walked end to end.
- DECISIONThe footer advertises the privacy notice only, and the sub-processor list is corrected to name the sender of every sign-in link and the nightly backup.
2026-08-19
The first seat walked, end to end
- SURFACEA real seat taken from a phone: invite, magic link, seat, every player surface read. The reveal boundary held for the new member.
- SURFACEThe docket and entity-notes widgets, so no player reads a build-status warning. A real account settings page. A favicon that is ours.
- SECURITYThe private-test gateway, and a nightly database backup restore-tested into a scratch Postgres.
2026-08-18
The database opened, and the first campaign went live
- FOUNDATIONThe schema applied to a live Postgres, with the nineteen RPCs the product was calling and none of which existed. The first campaign created and served.
- SECURITYForty-three definer functions were executable without signing in. An explicit lockdown now revokes and asserts it, and every later migration sorts before it.
- SURFACEThe Launcher, so a campaign is created without SQL, and a shell that tells a player from a DM.
- FIXEvery campaign page rendered in a 64px column. A flex item with an auto margin does not stretch.
- DECISIONPublish-on-join is a button on the roster, not automatic, because no player-facing path may carry an elevated client.
2026-08-17
Routes, primitives, data access
- FOUNDATIONThe Blueline component library: 25 primitives, no colour literal in the compiled stylesheet.
- FOUNDATIONEvery route in the product laid out, with the campaign shell mounted exactly once.
- SECURITYPreview-as-member implemented as a path prefix, with a forged preview header stripped at the edge.
- FOUNDATIONThe data access layer: reads throw, writes return a result, and no write path may catch silently.
- DECISIONA not-found page written as a redaction surface, so a concealed address and a nonexistent one are byte-identical.
2026-08-16
Schema and redaction policies
- FOUNDATION62 tables across three migrations, with the four decisions that cannot be retrofitted made first.
- SECURITY149 row level security policies, and a migration that fails if a table ever lands without one.
- SECURITYEntity prose is unreadable column by column, so a readable row can still contain unreadable text.
- FOUNDATIONThe zero-sum ledger constraint, enforced per transaction per asset rather than per transaction.
- DECISIONRules content comes from the open 5e APIs. Nothing is extracted from a book we do not have the right to ship.
2026-08-15
Direction set
- DECISIONBlueline: one graphite ink, emphasis by density rather than hue, colour reserved for limits.
- DECISIONConcealment renders with no hue at all, so it is never spottable from across a table.
- DECISIONThe vocabulary locked, each word chosen to avoid a collision that would be expensive to undo.
