What changed, and when.

Take-back window, client viewers, more detectors, weekly reports

The largest release so far, and the one that makes the loop complete end to end.

• Five-minute take-back window. Approving a change no longer sends it immediately. For five minutes one click restores the previous value, and nothing has been written to the platform yet. The window, the countdown and the take-back are all recorded in the ledger.
• Client-scoped viewer logins. A client can be given a read-only login that shows their own account and nothing else: findings, changes, reports. Viewers cannot approve. Every viewer read is logged like any other access.
• Detectors. Creative fatigue, cost-per-result drift, budget under-delivery and learning-phase reset joined pacing-over-plan. Each one carries its evidence rows onto the proposal card.
• Weekly PDF reports. Generated per client from the ledger, written in sentences. Generated automatically; sent by a person after they have read it.
• Off-site backups. Encrypted daily backups now leave the machine that produced them, and a restore has been exercised rather than assumed.

Operator settings and the platform mode switch

• Dry run / live is now a switch, per platform. It used to be a deployment setting only we could change. It is now visible in the product, owned by the customer, and every flip is written to the ledger with who flipped it.
• Live writes, per account. A second, independent switch. A platform can be live while an individual account stays proposals-only, and new accounts start off.
• Operator settings screen. The guardrails (blast radius, cooldown, daily cap) moved out of configuration files and into the interface, with the current values shown on every proposal card that they constrain.
• Halt. One button that stops every pending and future write across every account, and stays stopped until a person turns it back on.

Security audit, round 2

The second independent review, by people who do not work for us, covering tenant isolation, platform-token handling, the approval path and the operator console. Publishing what it found is the point of publishing it at all.

• Tenant isolation moved into the database. The reviewers' main point: application-level checks are one forgotten filter away from a leak. Separation is now enforced by PostgreSQL row-level security, so a query that fails to scope itself returns nothing instead of another agency's data.
• Platform tokens bound to their connection. Tokens were encrypted, but the encryption was not tied to the row they belonged to. They now are, so a token lifted out of one record cannot be decrypted for use against another.
• Operator access narrowed and logged. The console we use to run the service lost its remaining routes to campaign data. What an operator can still reach is written to the same append-only log as everything else, and is visible to the tenant.
• The isolation rules are now covered by tests that run against a real PostgreSQL database on every change, rather than against a stand-in. That suite stands at 840 tests.