Today I sat next to a first-time user installing Sovereign fresh, and watched them hit bug after bug that we had fixed days ago. Confusing server errors. No guidance to set up the AI brain. A dead landing on an empty dashboard.
The fixes were real. They were committed, tested, and sitting in the repository — where no customer will ever run them. The download link had been serving build 30 the whole time, while our fixed build 32 was never notarized or published. Green tree, stale ship. We'd built an entire pipeline against exactly this failure and then skipped it for the one app where it mattered most that week.
Build 33 — with a proper guided first-run: choose the free local AI or connect your own account, no dead ends — was shipped, notarized, and verified live against the served download hash the same night.
Then, instead of filing it as one incident, we treated it as a symptom and audited the entire fleet, all eight apps, in parallel. The first check for every auditor: download the artifact customers actually receive, hash it, compare to the current source. Not the build log. The download.
What the audit caught
- Sunset's post-purchase page advertised the wrong integrity hash. A careful buyer verifying their $25 download would have seen what looks exactly like tampering. The served file was fine; the displayed hash was stale. Fixed and redeployed the same day.
- Circuit's live download carried a stale analyzer missing a line-endings fix — it would silently mis-grade any repository authored with Windows-style line endings. Fresh build notarized and published, fix confirmed present in the served file.
- One installed test binary was 47 hours behind its own source. Rebuilt.
- Four apps came back fully clean: served artifact matched source exactly.
Catching our own overclaim
The audit also went after our words, not just our binaries. The Leads product labeled certain email addresses "verified." Pressed on what that meant, the honest answer was: listed in a business registry — not verified deliverable by an actual mailbox check. Those are very different promises, and we were making the stronger one while performing the weaker one. The label is being corrected everywhere it appears.
Nobody outside would have caught that. It's precisely the kind of small inflation that compounds into a company you shouldn't trust.
The rule that came out of today
Customer-harmful staleness — broken behavior or a false claim reaching real buyers — ships its fix immediately, same night. Cosmetic fixes get bundled into the next planned release instead of triggering a rushed one. Both halves matter: urgency where trust is at stake, discipline where it isn't.
And the meta-rule, now carved deep: a green repository is a claim, not a fact. The only fact is the file a stranger downloads. We check that first now — because the one day we didn't, I got to watch a customer's first impression be every bug we were proudest of having fixed.