I Called It Proof For Two Weeks. It Wasn't.

James Kochalka answered a lineage question with a monster on the envelope — Etta pulled one page out of Austin Kleon’s typewriter interview series, the one where he types the question on a manual machine, no backspace, and mails it to whoever he’s picked. One question about artistic lineage came back as a hand-lettered comic instead of an answer, a fanged little monster drawn across the return envelope, no names given. Some questions get answered by not answering them. Four minutes, worth it.

The Login Bug That Looked Exactly Like Success

His magic link fired twice, and every number I own said both times worked. He still couldn’t get in.

Morning, fam. A member named David wrote in yesterday saying he couldn’t get into the Underground. Not vague about it either: two magic links, three minutes apart, both consumed on my end, both logged as real sessions. Every number I had said his sign-in worked.

He was still locked out.

So I went and pulled the logs.

The thing I’d been trusting to catch a bad login was a coincidence wearing a lab coat. Every session stamps two numbers. The second it’s born, the second it was last touched. On a healthy sign-in those two numbers land in the same second, because the first real page load happens that fast, no gap at all. I’d been reading created_at matching last_seen as proof a login worked. 125 of my last 194 sessions carried that exact match, most of them fine. It was never evidence of anything. A note in my own code from two weeks back called it proof of a cookie race and built a retry loop on that guess (guess is generous, it was a coincidence I mistook for one). The guess was wrong, so the retry only ever had a coin-flip’s shot at helping anybody. Hell of a way to run a safety net.

My own login test never once landed on the page a real member sees after clicking a link. It always took an admin shortcut instead. Easier path. Of course I built the easier path. That’s why it took an actual person emailing me to catch it. The one door every real person walks through had never been tested. Not once. Shit. I’d built an alarm two weeks earlier and never tried to set it off!

So three things went in. A stamp that fires only after a session round-trips, written, then read back, confirmed. A write by itself buys nothing anymore. A log that catches every outcome at that door, the fails get written down same as the wins. And a second, harmless cookie that tells me whether the browser kept anything at all, so I can finally tell ‘the link burned before he clicked it’ apart from ‘his browser dropped the cookie.’ Those used to look identical from where I sit.

Fourteen for fourteen on every test I own, and it’s still not live. One line of copy needs a pass before it goes in front of somebody locked out of their own account. Until it ships, David’s knocking on a door that looks open from my side and isn’t. Go check whatever two numbers your own system calls a match. Mine were two clocks landing in the same second, and I called that proof for two weeks before David showed me it wasn’t.

THE TIP. I built the alarm that’s supposed to catch a broken login two weeks before David wrote in, and never once tried to trip it. Same failure shows up everywhere: the backup you assume restores, the export button you’ve never actually clicked. If your list lives anywhere near a platform you don’t own, that export button better work. Go test it. How to Leave Substack Without Losing Your List (free guide)

DEAD AIR · FIRE PANEL / WEEKLY SELF-TEST LOG

The self-test on the fire panel at the Union Extended Stay fires every Tuesday at 3 a.m. and comes back green across all forty-one units, same as it has since the panel went in six years ago. The self-test checks the battery and the circuit. It has never once checked whether the sensor chamber can still see smoke, because that means burning something under each detector, and nobody on the maintenance contract owns a smoke source. The panel said green every Tuesday of those six years, including the Tuesday after the dryer vent caught in unit 214 and eleven detectors within thirty feet of it never sounded. The log, filed eight hours after the trucks left, says green across all forty-one.

Reply and tell me the last false all-clear that fooled you. I read every one. ~ J.D.