The Ship Log.
Everything, forever.

One deliberate day of instrumenting before expanding the corpus: the retrieval suite grew from 44 checks to 246, every new case verified against the regulatory text before it counted. Thirty-nine failed on first run — everyday words like “hard hat” that the standards never use, construction questions being steered to general-industry rules — and every failure became a vocabulary bridge (68 → 126) or an engine fix. Also caught its own author twice, which is the point of a suite.

Five ad clicks produced zero typed questions. The hero card looped forever, which reads as a recording — so it now plays one demo, stops, and hands itself over with a lit composer and a “your turn” label. The joke demos no longer lead.

An audit found 31 focusable elements on the homepage with no visible keyboard focus ring at all. All fixed with :focus-visible, plus 24px minimum tap targets and a reduced-motion path through every animation.

Somebody outside the building asked what training OSHA requires before operating a forklift. The answer was correct and badly written — it changed who it was addressing mid-paragraph, and it missed the three-year re-evaluation. Both fixed, both now permanent tests.

The desktop header collided into CANARY SAFETYCANARYSAFETY.AI because a CSS selector was matching the logo instead of the first nav link. Small bug, embarrassing result.

The phone layout was zooming out to 645px on a 390px screen. Cause: decorative background glows 900px wide were expanding the layout viewport, and a body-level overflow rule was hiding the evidence rather than fixing it. Rebuilt the hero as a single-column stack.

A real question about an unwitnessed injury came back refused. “Nobody saw it” had matched woodworking SAW passages and pushed everything relevant below the abstention floor — 18.8 against a threshold of 20. New vocabulary bridges took it to 92.8. Four new tests exist purely to catch the engine being too cautious.

A deploy that didn’t take, because two different builds had been packaged under the same filename. Repackaged unambiguously. Filed under lessons that only need learning once.

The homepage and roadmap had drifted out of date — old counts, superseded claims, roadmap screenshots that looked like crops of crops. Re-rendered everything at 2x.

In one specific failure state the app would echo its own system instructions back to the user. Closed at two layers: the fallback path no longer echoes anything, and a scrubber now sits between the model and the screen regardless.

Height changes in the live demo card now animate instead of snapping, and the sources drawer resizes with them.

The homepage demo stopped being a scripted animation and became the actual engine — three real questions a day, no signup, with skeleton loading, honest abstention states, and a graceful message when the free line is busy.

The new workspace section overflowed a fixed-height column and quietly pushed the admin link off the bottom of the screen. Also: every mode renamed into language a human would use — “Write it for me” rather than “Draft.”

Two rebuilds in quick succession as the answer to “who is this actually for” changed — away from the well-resourced safety department and toward the person who got handed safety on top of their real job.

A round of copy and interface corrections from a full review — including cutting language that read as condescending to the person using it. The rule that came out of it: it’s never “you can’t do this,” it’s “let me help you.”

A red button on the admin page, usable from a phone, that halts every answer instantly with a polite maintenance message and zero further spend. Survives restarts. Every flip logged.

A deep-dive audit shipped as one batch: forged-header spoofing that could reset free-usage limits, per-mode input ceilings so a giant paste can’t become a giant bill, authenticated PDF export, a 512KB body cap, and a brute-force lockout after 50 bad codes.

Root causes from the first live testing, each with a guard so it can’t recur: a cache with no cross-release invalidation was serving old answers, and a vocabulary entry said “four feet” where the regulation writes “4 feet.”

It was finding the right standard for a shop acronym and then refusing to connect the two. The retrieval bridge now also tells the model what the term means.

Tightened daily and monthly allowances, with per-code overrides.

Per-answer pricing is still recorded for everyone; it’s only displayed to the person paying it.

Adding or revoking access stopped requiring a terminal.

Where it started, and where it ran for weeks: a local copy on one machine, no accounts, no server, one person asking it questions and writing down everything it got wrong.