On July 10 we pulled a client's name off this website. Their case study, their portfolio entry, and a post about them all came down the same night, replaced with a lock and a date: July 27, 2026.
Today is July 27. The build shipped today too, which was not planned and is a little funny. The client is Black Water Window Cleaning, the case study is back up in full, and this is the honest version of how it went.
What we actually delivered
Not a website. The operating layer: a public site with instant quoting, a CRM, dispatch, invoicing, payroll export, a crew app, and a merch store — running on the company's own domain, under the owner's own credentials.
The distinction matters more than it sounds. Plenty of agencies will build a local business a site and then quietly become the only party who can change it. We build the thing and hand over the keys. If we vanished tomorrow, the owner still owns his operating layer.
The part I'd rather not print
We committed an owner API token into the repository during the build. Ours, not his — our mistake, on our side of the fence.
We rotated it on delivery day. But rotating a credential is not the same as containing one, so we took the old token and replayed it against the live API to watch it get rejected. It was. Then we untracked the file and ignored it.
I'm writing that down because the version of this paragraph that most companies publish is the one where the incident never happened. A credential you have rotated but never tested is a credential you are hoping about.
The gate that lied
Our pre-commit gate started reporting zero tests and blocking the build. Except it only did that when automation ran it — by hand, from a terminal, it passed every time.
The cause is stupid and worth knowing. Outside an interactive terminal there is no locale set, and in that fallback the pattern we used to count tests can't match the multibyte character the test reporter prints at the start of its summary line. The suite was green the entire time. The thing measuring the suite was broken.
We fixed the parse so it works under both locales, kept the control that fails closed when there genuinely are no tests, and then went looking for the same pattern in every other gate we run. That is the actual lesson: when a check goes red in automation and green by hand, suspect the check first.
Handed over empty
The system went over with zero leads, zero jobs, zero invoices.
We pushed exactly one record through the live path — quote form to CRM to the owner's digest — to prove the wiring end to end, and then deleted it. Day one runs on his data and nothing else. No demo customers, no seeded rows, nothing that would make the dashboard look busier than his business actually is on its first morning.
That's the whole standard, and it's the same one every product we sell ships under: empty, honest, and yours.