Change control — Friday 31 July

What it is One part in ten was telling the customer In Stock or Available while we had no price for it. Nobody could buy those — add to cart was already blocked — so we lost no orders. We lost trust: the site said something untrue and the filters counted it that way. 1,814 were the worst kind, In Stock with an empty price. This is your rule from yesterday's call — when the data is ambiguous, default to out of stock.

How we test it An unpriced part reads Out of Stock on its own page and in browse; a priced part on the Clinton shelf is unchanged; the filter counts match the database exactly.

Evidence It is live, and the forecast held. We told you on Wednesday that 579,250 parts would be visible to the filter; the live store reads 579,301 — 51 apart, and the catalogue itself moved in between. Out of stock landed at 204,588 against 205,445 forecast. The part you can check yourself, 84271412, read In Stock before and reads Out of Stock now.

The bottom row is the part nobody had spotted: 13,645 parts were missing from the availability filter entirely. They are counted now, as out of stock. Try it — 84271412 is In Stock with no price on the live store today and Out of Stock on our test site. Control: 86641542 has a price and stays In Stock.

Roll back or fail forward Roll back — put today's version back. One rule, nothing stored, clean.

What it is Three places on the site kept the old rule and would have contradicted the change above: the badge put In Stock back, a parts-list row accepted an empty price and created a zero-price cart line, and a cart already holding one died with an error the customer could not read.

How we test it An unpriced part reads Out of Stock everywhere, including on the Clinton shelf; a zero-price line is dropped by name instead of erroring.

Evidence Done, in the change, against the test site already carrying the change above.

Roll back or fail forward Fail forward if the only symptom is a customer holding a zero-price cart line — rolling back brings the unreadable error back for them. Otherwise a one-click roll back is clean.

What it is Our New Holland prices are still an April copy. The official CNH 2026 dealer list disagrees with ours on 121,103 parts. Friday replaces 117,844 of them — 115,868 come down, 1,976 go up where we were underselling. Alex's change.

How we test it Run on a copy of the database first: every price replaced, none left disagreeing with the official list afterwards, and reversible in one step.

Evidence Alex's run on the copy came back with nothing left disagreeing. His first run was erased by the nightly copy-refresh before Denis started, and he re-ran it. That the refresh wipes anything applied by hand every night means the copy cannot be the bench for testing a Thursday migration — that is a question for the call, not something to re-run every week.

Roll back or fail forward Roll back — one step, from a backup taken inside the same run.

This did not go on Friday. It was taken out of the week on Alex's judgement — tested and safe, but not resolving what it set out to resolve — and he is redoing it his way. Nothing to roll back, because nothing was applied.

Your two parts stay wrong on Friday, and that is your decision to change. 504115130ER shows $99,999.99 against an official $68,805.00; 5803147510 shows $140,349.05 against $121,435.40. Both are reman engines, and each carries a second official line for the core deposit the customer gets back. The change deliberately skips any part with more than one price. The instinct is right and the answer here is wrong — a core deposit is not a competing price. 498 parts are wrong on the site today for exactly this reason, including both of yours. Narrowing the rule is small; it is Thursday's decision rather than a quiet edit in Alex's work.

What it is When one caching step fails, the whole shipping-rate request fails and the customer cannot get through checkout — even though the rate itself worked out fine. This is happening in production now.

How we test it Force the cache write to fail and confirm the customer still gets their rate.

Evidence Done, in the change. This was the open question on Wednesday and it is closed. The fix had been written for a week and was running nowhere, because this was the only service on the payment path that had never been runnable outside production. That gap is filled and the fix is on the test site, so Denis can check it like anything else. Nothing surfaced it until this list was built.

Roll back or fail forward Roll back — put today's version back.

What it is Lets an order be cancelled and records that the part was out of stock. Ships first, before the button.

How we test it Cancel an order as staff: it reads cancelled with the reason stored. Someone who is not staff is refused.

Evidence Denis, on the test site — pending, due before the call.

Roll back or fail forward Roll back — put today's version back. Nothing changes for existing orders. The button below must come back with it or it fails when pressed.

What it is The button and confirmation that call the change above. Do not ship alone — it fails without it.

How we test it Cancel from the staff screen: the order reflects it and the out-of-stock reason reaches the back end.

Evidence Denis, on the test site — pending, due before the call.

Roll back or fail forward Roll back — one click, and only together with the change above.

What it is Orders shipped from Clinton said "Will Call" at checkout. They now say "Shipping Carrier". Wording only.

How we test it A shipped tier reads Shipping Carrier; a genuine will-call tier still reads Will Call.

Evidence Denis, on the test site — pending. Only visible with a cart at the shipping step, so his screenshot is the check.

Roll back or fail forward Roll back — put today's version back. Wording only, no effect on data.

What it is Every search on the site was one page deep. Page 1 of "oil filter" offers 72 pages; page 2 serves the not-found page. Worse than a plain dead link: the not-found page comes back marked as a success, so Google is told the page is fine and shown nothing — on every search address past page 1. Found this morning while checking something else.

How we test it Page 2 of a broad search returns results and the same total as page 1; the first four pages hold no repeated part; page 1 is unchanged.

Evidence Applied to the live database at 07:52 by Alex, and measured after. A broad search returns a full page at every depth tried, and the total stays steady at 22,591. The first four pages hold 80 parts and no part appears twice. Page 1 is identical to the old version line for line, so nothing that worked before was disturbed — that was the risk, and it did not happen. Separately we read the live store the same way: pages 1, 2 and 3 each carry twenty parts, with no part shared between them. See it yourself: page 1 against page 2.

Roll back or fail forward Fail forward — there is no version to switch back to. This one lives in the database, not in a release, and until this week it existed nowhere else. Our test site reads the same database as the live store, so it goes live on both at the same instant. That is a property of the change, not a gap in the process.

What it is Typing or linking a plain part number returned Page not found unless you knew our internal prefix. 1,242,081 part numbers with exactly one owner were dead on their short address — every inbound link, printed-catalogue reference and hand-typed number for the brands we carry alongside CNH.

How we test it A number owned by one brand reaches its page; a number two brands share still returns not-found; anything that already worked is untouched.

Evidence Done, in the change, against live search. Try it — 50002200 on our test site against the same address on the live store.

Roll back or fail forward Roll back — one click. The new lookup only runs where the answer was already going to be not-found.

What it does not do — 9,334 part numbers are used by more than one brand and keep today's not-found. A bare number cannot say which brand the customer meant, and guessing serves the wrong part. Those wait for a "which brand did you mean" page.

What it is 2,836 parts we can sell today had no reachable product page. Their tiles appear in listings, the customer clicks, and gets Page not found. Anything with a space or a slash in the part number — SOL 020, 1-1/2.

How we test it A space-bearing and a slash-bearing part number both load; a control part that already worked is unchanged.

Evidence Done, in the change, against live part data. Try it — SOL 020 on our test site against the live store. Every one of these pages was also fetching its part twice; fixed in the same change.

Roll back or fail forward Roll back — one click.

Merged after this morning's test-site cut, so Denis has not checked it. Judge it on the checks in the change, or hold it a week — not on a test pass that does not exist.

What it is Search results for Hotsy equipment offered a Diagrams link, and we have no diagrams pages for Hotsy — a guaranteed dead end. About 170 of these are reachable from search. The link is now left off rather than shown as a promise we cannot keep.

How we test it A brand we do not carry renders no Diagrams action; a brand we do carry still renders it; View parts still works for the brand we do not carry.

Evidence Done, in the change: four new checks, each confirmed to fail against the old version and pass against the new one. The surviving action verified against the live store — Hotsy parts loads.

Roll back or fail forward Roll back — one click.

Merged after this morning's test-site cut, so Denis has not checked it.

What it is The trail that tells Google where a listing sits in the catalogue was only sent on the bare parts landing page. Every filtered, searched and paged listing drew the trail on screen with nothing behind it.

How we test it A filtered, searched or paged listing carries exactly one trail and it matches what is drawn on screen; the landing page is unchanged.

Evidence Denis, on the test site — pending: view source on a filtered listing and on the landing page.

Roll back or fail forward Roll back — one click. Nothing but markup changes.

What it is New Holland is the brand affected this week: 360 equipment models that had no picture now have one. No other brand changed. Where each brand stands, measured 29 July:

How we test it Open an affected model page and see the picture.

Evidence Denis, on the test site — pending, on a sample of the affected New Holland models.

Roll back or fail forward Not a release — pictures are data, published one at a time. Any single one can be removed on its own.

Two gaps, stated rather than smoothed over. New Holland has model pictures and no category pictures yet. And the record does not say who uploaded what, so this is pictures added, not a per-person count — worth deciding whether a per-person count is useful before we build it.

What it is Pictures for equipment models and categories no longer need a developer. It works on the test site; this puts it in the live store — which is what makes the row above repeatable rather than a one-off.

How we test it An upload appears in the store; someone who is not staff is refused.

Evidence Denis, on the test site — pending. He is the user of this one.

Roll back or fail forward Roll back — put today's version back. Nothing existing changes.

What it is A picture uploaded for a New Holland model saved correctly and then never showed up — filed under one name and read back under another. Only New Holland is affected, because it is the one brand split into Agriculture and Construction.

How we test it A picture applied under either New Holland division shows on both; every other brand is unchanged.

Evidence Done, in the change: both divisions checked against the single name, on the way in and both ways out.

Roll back or fail forward Roll back — one click. Nothing stored changes shape, so no pictures are lost.

Merged three minutes after the test-site cut, so Denis has not checked it. The cut was deliberately not retaken — half of Denis's day had already gone to a stopped build machine, and another rebuild was worth less than his remaining hours.

What it is Alex's change, and it needs a number from you. We check availability for 50,000 parts a night out of 433,831, so the catalogue turns over in about nine days — today's freshness floor, measured rather than assumed. Checking all of them nightly costs roughly $70 a month more.

How we test it One clean night at the current size first: every part sent accounted for, and a lost batch visible in the log rather than silent.

Evidence Last night ran clean at 50,000 and every missing part is accounted for. What this change turned up is worth more than the change. Monday's full run was a one-off by hand, not a change to the schedule, and it silently lost 600 parts and reported success. Both Alex and I had been writing as though the full check were already normal. It is not. The silent-failure part is fixed and live since yesterday morning.

Roll back or fail forward Roll back — set the nightly number back. Nothing is stored differently.

This did not go on Friday. It waits on your number: nine days as it is, or every night for about $70 a month more. The silent-failure fix inside it is live and stays live.

Decision already taken, deliberately: tonight stays at 50,000. Last night was the first clean measured run at that size, and scaling up the same night we gain the ability to see failures throws away the one clean reading.

What it is Worth a minute at the call, because it is the same fault as two changes above. Our overnight test run was being cut off at a time limit, and a run cut off that way reports "stopped" rather than "failed" — so on roughly half the nights it raised nothing and saved nothing. The nights it was least healthy were the nights it was silent. Separately, our test lane against the test site was never sending the password that gets it through the front door, so 45 requests were refused and read as broken features for two weeks (front#3313).

How we test it A run cut off at the limit now reports failed and files an issue. The test lane reaches the test site without being refused.

Evidence Done, in the changes. This is why Denis's sign-off today is done by hand against samples rather than by machine against the catalogue.

Roll back or fail forward Nothing to roll back — neither change ships anything a customer touches.

What it is Changing someone's role could have removed their access to your dashboard as a side effect. It now refuses that change and says what to grant first. Nobody's access changed — grants stay yours to make in your own panel.

How we test it Every shape of the mistake is refused; every legitimate role change still goes through.

Evidence Done, in the change: nine cases, 226 checks passing in that service. No effect in production today — it exists so the hazard is fenced on the day the admin console is switched on.

Roll back or fail forward Roll back — put today's version back. Refusal only, nothing written.

What it is What it is, how we test it, the evidence, and how it comes back out — now a form on every change in all four repositories, so this page assembles itself instead of being remembered. Companions: search#837 · ps#536 · hub#359.

How we test it Open a change in each repository and the four questions are already there to answer.

Evidence Every change on this page from Wednesday onwards was opened against the form.

Roll back or fail forward Nothing to roll back — it is a form, not code.

Tests, build machinery and internal documents. One line each rather than four questions, because none of them ships anything a customer can reach — nothing to test on the store and nothing to roll back.

Nine of the fourteen are live; five stayed behind on purpose. ps#528, ps#535, ps#538, ps#539 and ps#544 only touch our test site and our own notes, so putting them on the live store would be change for its own sake. They ride the next week at no cost. Everything else here is live.

• ps#539 — the missing test-site lane for the shipping service. This is what unblocked the rates fix above.
• ps#527 — tighter safety checks on our own release process.
• ps#528 · ps#544 — stale internal notes removed and corrected.
• ps#535 · search#838 — two leftovers pointed at the current search service instead of the one we retired.
• ps#538 — Denis and I can use staff features on the test site.
• front#3276 · front#3283 · front#3284 · front#3295 — Denis's work: the checkout money path now tested against the real test site, plus ten more checkout and cart checks and four stale ones repaired.
• front#3282 — the four places that show a cart count are pinned to one number.
• front#3278 — our test lane now tests the build that was actually pushed, not whatever the test site happened to be serving.
• front#3313 — the front-door password fix described two rows above.

What it was This is on the list because it broke the rule you set. A release went to production on Tuesday afternoon, Clinton time, with no list, no call and no roll-back decision. By your 25 July rule that is an emergency change, and it is logged as one. It was already in flight before this process existed, which explains it and does not excuse it.

Mostly checkout repairs Denis found: pickup wrongly offered where Clinton has no shelf stock (front#3262), an address overwritten while the customer typed it (front#3260), paid overnight lanes missing (front#3258) and overnight lanes offered that we cannot price (front#3271), one meaning for "items" across the cart (front#3267), a redundant In Stock line dropped from cart items (front#3277), Saved addresses pointing at the right page (front#3261), blank page titles on brand diagram pages (front#3245), listing pages bounded at a sensible depth (front#3246), error reporting restored on two screens (front#3247), and three internal clean-ups (front#3240 · front#3241 · front#3268).

How we tested it Denis signed off on the test site before it went, open blockers were zero, and the test-site checks were green. That part held. What was missing is the next line.

Evidence after it went live Checked on 29 July — a day late, and the lateness is itself the finding. No check was recorded at the time, which is exactly the gap you named on 25 July. All four came back healthy:

Roll back or fail forward Roll back was available the whole time — the previous production release was kept ready. Not needed and not used.

Also live this week, applied directly rather than through a release: the supplier-check silent failure fix (hub#355 · hub#357), Alex's availability glossary and per-brand feed table (hub#346 · hub#347 · hub#351), and the retirement of an old search deploy job (search#839).

Run against the live store after it landed, not against a copy. Each line is a thing that had to be true, and was.

• The store works. Home, the parts listing and the cart each answer properly and with their own page, not a blank one wearing a success label.
• Availability tells the truth. 84271412 read In Stock before and reads Out of Stock now. The whole catalogue lands where we forecast it would.
• Search goes deeper than one page. Pages 1, 2 and 3 each carry twenty parts, and no part appears on two of them. Before this week page 2 was empty.
• The two broken part pages open. A part number with a space in it and a Kuhn bolt both used to say Page not found; both now open on their own name. We also checked a part number that cannot exist, and it still says not found — so the fix did not make us say yes to everything.
• The dead Diagrams link is gone. Hotsy equipment no longer offers a link to a page that never existed.
• Shipping rates answer. One second, no error. They were failing overnight.

The check runs as one command and is kept with our tools, so next Friday it is repeated rather than reinvented — that was missing until today.