Four things changed this week
A loud week, and an uneven one: 628 commits on the Monday, 11 on the Wednesday, then 464 and 356 as the overnight runs came back.
The two biggest threads pull in opposite directions, and they are worth reading as a pair. One is a design effort in which every judgement was made by hand, seventeen times over. The other is a mechanical campaign whose entire point was that no judgement was made at all.
Photos was redesigned across seventeen surfaces at once
The shell, river, places, people, events in two layouts, stories, studio, sharing, editing and the inspector all landed a fresh redesign on 7 June, faithful to its mock.
A hundred changes landed overnight without a reviewer
An agent worked unattended through the night under a contract narrow enough that every individual change could be checked by machine, so nobody had to re-read the batch in order to accept it.
Two ways the service could freeze were moved off its heartbeat
Signing was given a lane of its own, and the signature taken when a device creates its first identity was lifted out of its database transaction.
The design for moving very large files was set out in full
Big files arrive from every trusted device that holds them at once, verified piece by piece, and are fetched only at the moment you actually open one.
Two smaller command-line conveniences and three published positions fill out the rest of the week, and all of them are listed at the end.
Seventeen surfaces, redesigned together
The feature: photos — everything from the grid you land on to the panel that tells you about a single picture.
Before: each surface had arrived at its own moment and carried its own conventions. Now: seventeen of them share one design, landed together on 7 June and faithful to the approved mock: shell, river, places, people, events in two layouts, stories, studio, sharing, editing and the inspector. (A photos app that never hands your library to anyone)
A redesign that stops at the front door is a reskin. The surfaces people judge a product by are rarely the ones they spend time in. Landing the shell alone would have made the first screen agree with the mock and every screen behind it disagree with the first — which reads worse than leaving all of them alone.
Doing seventeen at once is expensive, and it is the cheaper of the two options over any horizon longer than a month. A partially converted interface has to carry both vocabularies, so every later change is made twice and decided twice, and the conversion that was supposed to end never does.
A photos app sounds like a solved problem until you remember that this one keeps nothing on anyone else's machines. That single constraint reshapes every screen, which is why a redesign here is more than a matter of taste.
What the surfaces actually are
The frame the rest hangs in is the shell: a top bar, a rail of destinations, a row of filter chips, and the large area the other views render into. The rail and the chips stay put while the body swaps, which makes the experience read as one application rather than a stack of loosely related pages.
Filter chips sit along the top of that frame, so narrowing down what you are looking at never means leaving the view you were in.
The headline view is the river — the continuous flow of your pictures in time, where recent things sit near you and older ones drift away. The word is chosen deliberately and is used across the whole project: a river is something you watch pass, rather than a grid you administer.
The rail names the destinations and the body swaps beneath it. That is what a shell is for, and it is why seventeen separate surfaces read as one product.
Places, people, and events drawn two ways
Beside it sit places, which groups pictures by where they were taken, and people, which groups them by who is in them. Events landed in two forms the same day, a timeline and a set of blocks, so the same grouping can be shown as a chronological spine or as discrete chunks.
That two-layout split says something about how settled the design is underneath. Events are not one hard-coded screen; they are a model of what an event is, with more than one way of presenting it. A screen that can only be drawn one way usually has its data and its picture tangled together.
Stories, studio, and a claim not being made
Two surfaces push past organising what already exists into making something new. Stories is the curated, told sequence — your pictures arranged into a narrative rather than a raw feed. Studio is the creative surface, where editing, generation and composition live.
Both landed on 7 June as surfaces faithful to their approved mock: the layout, the structure and the visual design are what shipped, and they are real and on disk. The generative capability behind studio is not claimed here as production-complete.
Memories landed alongside them in the same wave and on the same terms: the surface is faithful to its mock, and nothing further is claimed for it here.
Being precise about that boundary is not modesty. A surface built faithfully to a mock is a checkable thing. A fully wired generative engine is a different claim needing different evidence, and reporting the second while only the first exists is how a project loses the right to be believed.
Sharing, editing, and the panel that tells you the truth
Sharing is the surface that answers "who can see this picture?", and in a system with no provider that question has an unusual answer. In a cloud photos app, sharing means uploading to the provider and granting access on their servers.
There is no provider in this system holding a second copy, which is what makes the question answerable at all rather than merely reported on.
Here, sharing a picture means granting one named person, over an encrypted channel, the ability to decrypt it. The redesign brought the share drawer, the "shared with me" view, and the "forgotten" state — pictures whose access you have taken back — into one visual system.
The difference is not cosmetic. A cloud service can only ever report what it currently believes about access, and it keeps its copy either way. Forgotten here is a real revocation of the ability to read the picture, not a hidden-but-retained flag on somebody's record.
The share drawer, the shared-with-me view and the forgotten state are three faces of one question, which is why they were redesigned together rather than in sequence.
The inspector, and what it can honestly claim
The inspector is the per-picture panel where that state becomes legible: who holds this, where it came from, what is attached to it. It can tell the truth about provenance and access because the system genuinely knows both, rather than repeating a remote service's account of who can see what.
Editing rounds it out — crop, adjust, the ordinary operations — performed on data that never leaves your control in order to be edited. The edit drawer was brought in line with the rest of the visual system in the same wave.
Why looking ordinary is the hard part
The redesigned experience looks like the cloud photo apps you already know, and the familiarity is deliberate. Nobody should have to relearn what a photos app is in order to use one that keeps nothing on anyone else's machines.
Underneath, every surface answers a different question than its cloud counterpart does. The river renders your own local stream of events rather than a server-side feed. People and places are computed on your device rather than by a provider's vision service reading through your library.
Places and people are computed where the pictures already are. No library is uploaded anywhere to be indexed by somebody else's model on somebody else's machines.
The achievement is making all of that look unremarkable. The hardest part of software that keeps your data yours is that the sovereignty is supposed to be invisible — it should simply feel like a photos app, while quietly never handing the library to anyone.
The honest status
What it cost to prove, and what is still missing. The surfaces landed; the verification did not finish. This is labelled partial for that reason, and the honest description is that the redesign is in and being checked rather than done.
The pictures in this report were re-rendered on 11 June, four days after the surfaces landed. They depict what shipped, and they are a later render rather than a capture taken on the day, which is worth saying plainly rather than letting a caption imply otherwise.
Verification is where surfaces built to a mock meet real libraries and real use, and it is the phase that decides whether they hold up.
A hundred changes made by machine, and every one of them proved
The practice: handing an agent a batch of a hundred mechanical changes to make unattended overnight, and deciding in the morning whether to accept them.
Before: a batch that size arrives with two bad options. Read every change yourself, which costs more than making them did, or accept the whole batch on the agent's own account of its work. Most teams quietly pick the second and describe it as the first.
Now: the batch is specified so narrowly that each change can be checked by a machine on its own, and the reviewer's question shrinks to whether those checks came back clean.
A change you can prove mechanically is a different animal from one you have to judge. The tempting thing, when an agent is already inside a piece of code, is to let it improve what it finds — rethink the boundaries, tidy the names. That instinct is the one to suppress the moment the same operation has to run a hundred times before morning.
Bulk work is where agents are genuinely faster than people, and it is also where they are least reviewable. Those two facts are the same fact: what makes the work quick to do is exactly what makes it slow to read.
The way through is not a better reviewer. It is choosing a class of change narrow enough that a machine can settle the only question that matters.
The contract, stated precisely
The version that survived has four terms and no discretion in any of them. The agent lifts a body of code out of one file and puts it in a sibling. It moves that body word for word — no tidy-ups, no renames, nothing done because it happened to be passing.
The original file keeps a thin forwarding entry, so every caller still finds the same name in the same place it always looked. Then an automated check reads both files and confirms each still holds together: a broken import, a missing export, a name that no longer resolves, any of these fails loudly.
A rename would break that guarantee, which is why renames were excluded even where one would obviously have been an improvement to make.
Nothing on that list is negotiable, and the discipline is most of the value. Each clause exists to keep the change inside the set of things a machine can check by itself — which is exactly what makes running the next hundred of them safe rather than reckless.
Why "byte-identical" is the load-bearing word
The reason this scales is about knowledge, not mechanics. When the body is identical and the only difference is which file holds it plus a forwarding entry, the question "did this change behaviour?" stops being a matter of opinion. The answer is no, unless the automated check disagrees.
That is not the same thing as being confident. Confidence is a claim about the author, and an agent's confidence is worth less than a person's, because nothing in it has been calibrated by consequences.
This is a claim about the artefact instead, and the artefact can be checked by somebody who has never met its author and has no reason to trust them.
An automated check that fails loudly is worth more here than a careful reader, because the check does not get tired at the eightieth change of the night.
The two have entirely different economics. A judgement call is made carefully, a few at a time, with someone watching for regressions afterwards. A verifiable mechanical move can run a hundred times in a night, each one provable alone, because being wrong about any single one is both bounded and detectable.
It also changes what review means. Nobody has to re-read the moved code and convince themselves the logic survived. The question shrinks to whether the body is genuinely unchanged and whether both checks came back clean — a review that is fast and reliable at once.
Why independence is what makes volume safe
The trigger was human and simple: an instruction to run unattended through the night and not stop until the batch was finished. Because each change is independent and provable, this is close to the ideal shape of work to hand to a fleet of machines while nobody is at the keyboard.
There is no coordination needed between the individual changes, no shared judgement for two of them to get differently wrong, and each stands or falls on its own evidence.
The run needed no supervisor, because none of the individual changes could contradict another; each touched two files and nothing else at all.
That independence is the property to design for, and it is worth more than any amount of extra instruction. A batch whose members can interact needs a reviewer holding all of them in mind at once, and nobody does — which is how an overnight run becomes a week of bisecting.
None of this is glamorous work, and the lack of glamour is close to the reason it could be trusted at that volume in the first place.
What the human still has to supply
A run of this shape gets described as autonomy, and the description flatters it. Everything that made the night safe was decided before it started: which class of change was in scope, what counted as proof, and what was forbidden even where it looked like an improvement.
The agent supplied volume and patience. The contract supplied the guarantee. Neither of those is judgement, and all the judgement happened in advance, in one short specification a person wrote and could defend.
That division is the part worth copying. Write down the narrowest change you can verify without reading it, say plainly what the machine may not do, and then let it run as long as it likes. The scarce resource is not agent time; it is the attention needed to decide what a proof would even consist of.
A batch specified this way also fails usefully. When a check comes back red it names one change and two files, so the cost of a bad night is a single reverted move rather than a tangle nobody can unpick.
What it bought, and what it did not
What it cost to prove. The proof is the pair of clean checks on the two touched files, and that is deliberately the whole of it. Nobody is asked to trust that the agent was careful; they are handed an artefact that is either true or false, which is the principle the rest of the system runs on.
What is still missing. This is groundwork rather than a finished improvement. It relocates code, and it makes what was there easier to navigate and less likely to hide a bug. It does not, by itself, buy a better abstraction.
That distinction is the easiest one to lose here, and losing it would turn a useful night's work into a false claim of progress. A machine can prove that nothing changed. Only a person can decide what ought to change, and that is a separate and much slower kind of work.
What this means, in plain terms
Most of what lands in a week belongs only to the thing it landed in. A few things travel. These five come out of the work above, each learned by getting something wrong first, and each should hold in a codebase that has nothing to do with this one.
Convert every surface, or carry two vocabularies forever
Seventeen photo surfaces landed one design together rather than one surface at a time. A half-converted interface forces every later change to be decided twice, once per convention, and the conversion never reaches an end. A migration done in slices has to be finished on a schedule, or the slices become the architecture.
Split the provable part of a change from the judged part
Handing an agent a large refactor mixes two jobs: relocating code, which a machine can verify, and improving it, which only a person can weigh. Separating them let a hundred relocations run unattended overnight, each provable alone. Automate the half you can prove, and spend your scarce attention on the half you cannot.
A failure with no ceiling deserves more than a test
A freeze inside the service's main loop stops everything indefinitely while still answering "yes, I am running" to a naive health check. A crash takes down one process; this takes down all of them, with no automatic recovery. When the worst case is unbounded, aim to make the shape unwritable, not merely untested.
Never hold a lock across a call that might not return
Creating a device's first identity used to sign inside an open database transaction — tidy to read, and a latent deadlock, because a stalled signature would freeze every other writer queued behind that lock. The signing moved out. A held lock plus an opaque call is a deadlock waiting for a bad day.
The precise behaviour is the default; the noisy one is asked for
Searching command help text for "lid" with plain substring matching drowns you in validate, consolidate and holiday. Matching at the start of a word instead kills the noise and still finds whole families of words. Make the footgun require a flag, not the behaviour that is right most of the time.
How much healthier is it than a week ago?
No net line-count figure appears. This week's diff is dominated by fixtures and generated files, and by a campaign that relocates code between files without changing it, so a net-lines headline would be dishonest — the honest size signals are the commit and work-stream counts above.
How these numbers are counted
The counting rule is the one used throughout this series: activity on the main line of the shared codebase, inside the window, and nothing that landed after it. Where a figure cannot be produced honestly, it is left out rather than estimated.
That refusal costs this report its most quotable number, and it is the right trade. A net line count this week would mostly be measuring a machine moving text from one file to another.
Two of the five figures above are day counts rather than totals, kept because the shape of a week is as informative as its size.
Nothing here is a comparison against the previous window. That comparison is not available for this report, and an invented baseline would be worse than none at all.
Four honest notes
Each of these is a place where the week's headline is true and incomplete, and where the incompleteness is the more useful half.
Photos is landed, not verified. Seventeen surfaces carry the redesign and the verification pass has not finished. The word for that is partial.
The overnight batch bought a proof, not a better design. More than a hundred changes were made by machine and each was shown to have changed no behaviour. Not one of them produced a better abstraction, and the volume should not be read as if it had.
The main-loop work is slices, not a guarantee. Signing when a device creates its first identity moved out of its database transaction, and the signer was given its own lane. Both make a freeze less likely; neither makes it structurally impossible, which is the actual goal.
The large-file design is published with its gaps named. Its foundation is built and green at the unit and integration level, while cloning a repository across it, erasing a file's bytes, retiring the older fetch path, and the full end-to-end run in a browser are all still open.
seventeen photo surfaces landed one design together, more than a hundred changes were made unattended by machine and each proved to have changed nothing, two paths that could freeze the service moved off its heartbeat, and the design for moving very large files was set out in full with its gaps named.
What changed, area by area
Every area that moved this week. Per-area file counts are not available for this window, so the areas are listed by what landed rather than ranked by traffic.
The two big threads
One was drawn by hand and one was run by machine, and between them they account for most of the week's volume. Both are honest about what they did not achieve, which is the part worth reading.
Read together, they show the week's method: prove mechanically whatever can be proved, and spend human judgement on the rest.
Seventeen surfaces landed a ground-up redesign together on 7 June, faithful to the approved mock: the shell, river, places, people, events in two layouts, stories, studio, sharing, editing and the inspector.
Sharing here means granting one person the ability to decrypt a picture over an encrypted channel, and "forgotten" is a real revocation. The surfaces are in and the verification pass is not finished, so this is partial rather than done. ( A photos app that never hands your library to anyone )
More than a hundred mechanical changes were made by an agent running unattended overnight.
Each moved a body of code word for word into a sibling file, left a thin forwarding entry so callers still resolve the same name, and was proved by an automated check on both files — a contract narrow enough that no reviewer had to read the batch.
Reliability, and the way bytes move
Three threads this week are about what happens underneath, where nobody looks until something stops. Two are landings; the third is an architecture published in full, with the built parts and the open questions both named.
They share a pattern. Each names a shape that fails badly, then removes the shape rather than adding a warning next to it. A warning depends on somebody reading it at the moment they are least likely to.
A stalled signature used to be able to stop the entire service. It is now merely a slow signature, which is a survivable thing to have.
The large-file work starts from a split that most systems make late: small ordered records travel one way, and big files travel another, and neither is allowed to ride the other's path. Let files onto the gossip path and the coordination layer drowns behind a payload it should never have carried.
From there, a file is named by a fingerprint of its own contents rather than by where it lives. Any device holding matching bytes is an interchangeable supplier, and a wrong answer cannot go unnoticed, because the bytes are checked against the name that was asked for.
Fetching lazily is the other half. A device you picked up an hour ago can be honest about what exists without first dragging everything across the network.
Signing moved off the path the service's heartbeat runs on, and the signature taken when a device creates its first identity moved out of the database transaction that used to enclose it.
A stalled signature now degrades to a slow signature rather than a stopped service, and no database lock is held across it. ( A main-loop hang should be unbuildable )
The architecture for large files was published in full: a file is addressed by a fingerprint of its contents, so any device holding matching bytes is an interchangeable supplier, and a download pulls from every trusted holder at once with each piece checked on arrival.
Three earlier half-built attempts were collapsed into this single one. ( Your files arrive from everywhere at once )
A brand-new device can answer a query with the full, honest result set while holding almost none of the underlying content.
Nothing is fetched when a file is mentioned, listed or returned in a search — only when you open it, and only the part the thing you are doing needs. ( Your files arrive from everywhere at once )
The positions we published
Not everything published this week was a change to the software. Three pieces set out a position or studied somebody else's, and they are reported here as exactly that rather than dressed up as features.
A study is not a shipped feature, and the distinction matters most when the subject is somebody else's good work.
The first takes on a contradiction at the centre of the system. Honesty demands a record that cannot be rewritten, and a person's right to be forgotten demands that things can genuinely go. Those look like opposites, and the essay argues they were never asking for the same thing.
The resolution separates the proof that something existed from the thing itself. The fingerprint stays welded into the record forever; the content lives separately and can be deleted. What is left is an honest trace: something was here, and it has been released.
The other two look outward, at projects working on how value moves between people. Both are studies of somebody else's system, including the parts that did not work, and neither describes anything shipped here.
The forgetting piece is a position about how this system should behave, and it is reported on those terms rather than as an announcement.
A published design position set out how a record that can never be rewritten can still genuinely forget: the fingerprint of a payload stays in the chain forever while the payload itself lives separately and can be deleted.
Anyone replaying the record still sees that something existed, and can no longer see what it was — forgetting with a shape, rather than a quiet deletion pretending the thing never was. ( Forgetting is a feature )
A published study of GNU Taler looked closely at a payment system where the buyer is anonymous by construction and the seller's income is fully visible to auditors.
Its asymmetric privacy model and its coins-on-your-own-device stance both fit how we think; its reliance on a central exchange to clear a payment does not. ( GNU Taler, and cash that tells the truth )
A second study looked at Circles, where every person issues their own currency and it has value only where somebody chooses to accept it.
Fake accounts mint currency nobody must take, revoking trust is expulsion with no central deleter, and a candidly documented pilot failure showed that a sound mechanism is not a living economy. ( Circles, and money that starts from trust )
The everyday surfaces
Two small command-line conveniences shipped, both requested in a single sentence, and both are more interesting than their size suggests. Each does the whole of the job it was asked for rather than the obvious half.
Neither is large. Both do the whole of the job they were asked for, which is the part worth copying from them.
One keeps a laptop awake through a closed lid, which on that platform needs two separate settings changed rather than the one most short recipes touch. The other makes a growing set of commands searchable, and picks the quiet matching rule as its default.
Both were asked for in a single plain sentence, and both shipped inside the same day they were asked for.
A command now keeps a laptop awake through a closed lid for the length of a long build, flipping both the idle-sleep and the lid-closed settings rather than only the first.
It has three verbs — on, off, and a status report — and a companion that chimes at login if you left it on, because the mistake this feature makes easy is forgetting to turn it off.
A search across every command's name, summary, description and flag text now returns each hit as a line you can paste and run.
It matches at the start of a word by default, so "lid" no longer drags in validate and consolidate, and a search that finds nothing exits as a failure rather than reporting success to whatever called it.
A permission you granted is now found by the check that looks for it.
The two halves had been filing and reading the record under different names, so a granted permission left the feature silently shut; the names are tied together and the tests now fail loudly if they come apart.
Files can be browsed in nested folders, the way a desktop file manager works.
The surface is in, the work behind it is still open, and there is no native capture of it yet.
Everything else that moved
Two smaller threads, one a fix and one a deletion, and the deletion turned out to carry the week's most quotable idea.
A wedge in the peer-to-peer path was root-caused and fixed.
Every mention of a prior external home was removed wholesale, leaving one clear place the source lives.
In the owner's words: we do not specify all the things we are not. we only specify what we do use.