Seventy-five items reached Done and six went to Won't Do, and thirteen of the eighty-one belong to a week already written up. Entry 018 closed its own ticket at twenty to eleven on the Sunday morning and said, correctly, that a beauty therapy studio's deliverability test and cutover were both still ahead. They were, by a matter of hours: the test passed at a quarter to six and the domain moved at half past nine that same evening. That is the third week running that the tail after filing has not been empty, which by now is less a recurring surprise than a straightforward property of filing on a Sunday.
The item worth leading on has been open since the middle of July. Last week's entry listed the junior chess club's governance block as outstanding — the data mapping and record of processing, the controller and processor positions in writing, the subprocessor list and transfer assessment, the retention position for historic posts, and a takedown route with a service level attached. All five closed this week, and the privacy notice, the cookie policy, the registration position and the consent register underpinning them closed alongside.
One is worth explaining, because it looks like paperwork and is not. The cookie policy claims the site sets no cookies and stores nothing. Anyone can open a browser today and confirm that. What nobody can do in two years' time is confirm it was true on the day the claim was published — so the check was run across every page type and the result dated and filed. That is the difference between saying there are no cookies and being able to show that somebody looked, on a date, before making the promise.
A second strand is deliberately not written up here. Work touching children's personal data does not appear in this journal from the findings side — not the defect, not the audit, not the counts, not the remediation — and that holds however carefully the client has been described by type rather than by name. What can be said is the discipline. A template that must show an entry without a photograph renders it as a designed card rather than as a broken image, so that a family's decision not to appear cannot be inferred by anyone counting gaps down a page. And where something could not be published without a permission that did not exist, the answer was to publish less rather than to ask for more. The requirement was dissolved rather than satisfied, which is usually the better of the two.
For the retained veterinary practice, the week's substantial piece of work was email authentication. Both of the practice's domains now sign their outbound mail, publish a tightened sending policy, and carry a reporting policy in monitoring mode — the full set rather than part of it, verified end to end by sending real messages and reading the headers that arrived at the other end.
The signing is the part with an effect people will actually notice. A sending policy covers mail sent directly, but it cannot vouch for a message the recipient then forwards on, because forwarding preserves a signature and breaks a sending policy. Adding signatures is what lets forwarded correspondence arrive with its authentication intact — for a practice whose letters are often passed on, a practical improvement rather than a theoretical one. The same pass tidied the domains' DNS so that it now describes only what is actually in use, and nothing was interrupted at any point: every change either added something, or cleared away something already superseded.
— On the record —A check can only fail what it can perceive — and a gate that reads pages cannot read pictures.
That turned out to be the shape of the week. The chess club's accessibility gate was found to count sixty-nine rules and evaluate sixty-two of them, and to report a further set of findings it had never been configured to fail on — and a check that reports without enforcing gets read as a pass. Then the club's teaching material turned out to be text baked into images: perfectly readable on screen, invisible to a screen reader, and invisible to every automated pass the project has ever run green.
The performance gate came back too. Last week it was made to name its worst page; this week that page turned out to sit about thirty milliseconds inside a two-second budget, with consecutive runs on a provably unchanged tree landing on either side of the line. The budget moved to two and a half seconds — the recognised threshold for the metric, rather than a number picked to make the run go green. Two point one would have done, had passing been the point. The gate's own configuration carried a note saying to revisit the run count if any metric ever landed close; the metric landed close five days earlier, in unrelated work, and nobody read the file that had asked to be told.
The content migration ran alongside all of it, and was mostly consolidation — fifteen old pages on openings into one, nine on tactics, seven on traps and blunders, six each on endgames and on the rules. An architecture decision recorded the principle underneath: the archive of the old site is a reference library, not a publishing source, there to check things against rather than to copy from.
The game viewer built last week came back with a real bug. It numbered moves from their position in its own array, so any game starting from a set position rather than the opening was numbered wrongly throughout. That fix, cross-device verification and screen-reader announcements closed the epic between them.
The quieter thread was continuity: credential holdings recorded, a break-glass route agreed, a continuity register built, and a one-page note written explicitly for a successor rather than for the client — the right audience, and an easy one to get wrong. A handover written for the person who already understands everything is not a handover; it is a reminder.
The beauty therapy studio's site went live that Sunday evening and was verified on the production domain the following weekend: legacy redirects, one real enquiry through the contact form end to end, structured data and social previews validated, the sitemap submitted and a re-crawl requested. The old hosting was then switched off. For the small services business whose migration ran a fortnight ago, the soak period closed clean — no error spikes, no rollback needed — and its old hosting contract was cancelled with the confirmation filed. Both followed the same shape, and it is the shape worth keeping: move, watch, and only then switch the old thing off. A soak period is not caution for its own sake. It is the window in which going back is still cheap.
The board came out of the week in better shape than it went in. In progress across every project fell from eighteen items to five, and six more closed as Won't Do — mostly questions that a decision taken elsewhere had already answered, retired deliberately rather than left open to be re-read as live.
The through-line is the distance between a thing being checked and a thing being true. A gate that counts more rules than it runs; a gate that reports what it will not fail on; a gate whose own instructions asked to be revisited and were not. None of these was a breakage, and none of them surfaced from a report — they surfaced because somebody went and looked at the thing itself, which is the only way that kind of gap ever closes.