Sixty-eight items reached Done and one went to Won't Do, and nineteen of the sixty-nine closed after the last entry was filed. Entry 020 went out just before eleven on the Sunday morning — the earliest filing in this record — and its counts stop there, so the whole of that afternoon and evening belongs here instead, a junior chess club's site going live among it. The arithmetic reconciled to the item again: last week's fifty-three and four, plus those nineteen, is exactly what its window held. Two client sites reached their own domains this week, four days apart.
The chess club's cutover ran on the Sunday afternoon. The existing zone was replicated at the new registrar as a deliberate no-change copy first, so that moving authority and moving the site stayed two separate events rather than one compound one. Then the apex and www were pointed at the static host, certificates provisioned, and the club's old email retired properly rather than left to decay — a null MX, a sending policy that authorises nothing, and a reject policy above it, so that mail to an address nobody reads bounces instead of vanishing. Search Console, robots, sitemap and canonicals followed, then a handover session and post-cutover verification.
The interesting part of a launch is not what goes up but what has to come down. Every page carried a tag holding it out of search results, put there so the temporary host would not be indexed, and no open ticket owned removing it — the two tickets once named as owning it were both already closed. It was found by accident, while correcting an unrelated claim in a working-notes file.
What surfaced it was a performance gate that excludes one audit which cannot pass while the tag is present. The exclusion carries a reason and a ticket number, and the gate prints its exclusions on every run precisely so that an exclusion cannot outlive its cause. The ticket it named had closed thirteen days earlier — and the row immediately below it carries a comment recording this exact failure, on a neighbouring exclusion, caught and fixed nine days before. The rule that came out of that fix, to search for the claim rather than merely for the ticket in front of you, had failed on the two lines most likely to be read together.
— On scaffolding —A control that looks like an obstacle will eventually be removed by someone in a hurry.
The exclusion mattered more than a stale reference because of the direction it fails in. A gate that reads as spent invites the next person to remove the control rather than the exclusion: the score goes green, the change looks like housekeeping, and a protection has been deleted by someone who believed they were tidying up. The tag came off after the apex was serving and not before — twenty-seven pages on disk, twenty-seven stripped, none left carrying it, counted rather than sampled. A second, permanent robots file on the storage origin was confirmed still in place by fetching it rather than by remembering it had not been touched.
The week's other gate story is a hang. A content-security-policy check that runs in about thirty-five seconds locally stalled in CI for three minutes and twenty-two seconds, printed the policy header, and then printed nothing at all — no pages tested, no violations, no page and no directive named. A red step that names nothing is indistinguishable at a glance from a real finding. The cause was not established and the ticket says so, rather than reaching for the plausible one. What was not in doubt is that the check waited on the browser painting a frame with no time limit at all, which is a latent hang whether or not it caused this one.
The obvious fix was ruled out by the ticket that proposed it. Racing the wait and carrying on would convert a loud hang into a silent under-audit: if the frame never painted then the interactive board never built, and what gets audited is markup with the thing under test missing from it. The gate would not go red. It would quietly check less, and report zero violations either way. So a stall is now named — by page and by figure — and fails the build. It was mutation-tested rather than assumed: forcing the budget to zero makes it fire, while the real run still passes twenty-seven of twenty-seven in thirty-four seconds.
Then it fired for real, on a documentation-only change, later the same day. Seven figures of nineteen on the longest page never painted inside the budget. It named them, said what it had actually audited, refused to call it a pass, and told the reader what to do next; a re-run was green. The cause remains undiagnosed and the record says so. But a bound that has never triggered is a bound nobody has seen work, and this one has now been seen.
Four days later the clinical canine massage practice's site went live on its own domain, closing a build that has been in this record since the spring. Three gates from earlier phases had to converge before the cutover could run: a clean pre-launch accessibility audit, a DNS baseline showing no surprises against the state recorded after the mail work, and the practice's own ICO registration number in hand — because the footer and the privacy page carried a placeholder until it arrived, and a site does not launch with a placeholder where a registration number belongs.
The pre-flight was mostly compliance rather than engineering. The onward-transfer position of every processor in the chain was re-verified at source rather than carried forward from the last time somebody looked, with the dates recorded against the processing register. A public registry lookup confirmed that no registrant name or address is exposed. Registrar-account protections were checked one at a time — transfer lock, auto-renew, two-factor, and the billing contact held at an address that does not depend on the domain. Then the time-to-live values were lowered a day ahead, the apex and www were moved, the mail records were left strictly alone, and uptime monitoring was pointed at both the site and its health endpoint, alerting somewhere that stays reachable when the domain is not. The bot-protection widget's allow-list, still carrying the temporary platform hostname beside the real one, was trimmed at the same time.
Two new builds ran alongside the launches. For the retained veterinary practice, most of a site in a day — a mock-up through to fourteen production pages, a news section with thirteen posts, self-hosted fonts, redirects, a branded 404, structured data, security headers, and two form routes, one of them a registration form carrying a UK address and a repeater for each animal, both with working no-JavaScript fallbacks. The privacy policy was rewritten and the cookie policy retired outright rather than maintained, along with every reference left behind in the terms. A written briefing on the trade-off between a managed content platform and a static site went out with the sign-off checkpoint, on the view that a client choosing between the two should be choosing rather than deferring.
An independent garage's one-pager replaced a hosted content platform over the same few days: an approved mock-up built out, self-hosted fonts so the pages make no third-party requests, redirects mapping the legacy URLs so that nothing already linked stops working, structured data, a privacy page, and a contact route behind a managed sending service and a cookie-less bot check. An accessibility audit and an image pass followed; cross-browser and performance verification were still in review as the week closed. A local dog-training club's site, built out the week before, went through its own audits, and an end-to-end deliverability test across both its forms.
One item was retired as Won't Do, and it belongs to the same theme as the rest: a pre-cutover checklist and go/no-go, closed unused because the cutover it existed to gate had already run. A checklist whose moment has passed is better closed than left open, where it will eventually be read as a step that was skipped. In progress across every project stands at nine, unchanged on the week.
The through-line is scaffolding. A site waiting to launch is full of things put there to hold it back — a tag keeping it out of search, an allow-list entry for a temporary hostname, an audit exclusion that exists only while the tag does, a checklist for a moment that has not yet come. Each is correct while it is needed and wrong the moment it is not, and not one of them fails loudly when its time arrives. Two sites went live this week. What made both of them work was knowing what had to come down.