Third week in the same band. The fleet logged 368 hours against 38 of mine, and the ratio came out just under ten to one, right where it sat the last two weeks. The pattern is holding: the fleet’s hours swing with what’s in flight, 446 then 433 then 368, while mine barely move. My hours are the ceiling. I can only gate so much in a day, and that’s the real limit on the whole operation, not the fleet’s capacity.
Last week Breeze grew the entire money side of a business. This week it turned around and made that side safe to leave running.
What shipped
Breeze. The week’s spine was security and reliability, not features. A full authorization sweep closed cross-org and cross-partner allowlist gaps, blocked a cross-tenant destructive command path, added fail-closed mid-session revocation for the tunnel and event sockets, encrypted webhook URLs at rest, and filled a set of missing authz and step-up gates. On top of that, vulnerability management landed end to end: detection, risk scoring, remediation, RBAC, and the AI tools to work it (four phases in one push). The reliability scoring got honest too, uptime now computed from observed availability instead of the current boot session, fault scores rate-normalized, and a dedup that stopped roughly a 1.37x count inflation. The MSP integrations a real shop needs came in alongside: SentinelOne and Huntress surfacing plus deployment packages, a QuickBooks Online connection foundation, and a TD SYNNEX pricing connector into the quote editor. And under all of it, the boring decision that makes the rest possible: both apps moved to Astro 7, Vite 8, and Tailwind 4, with a visual-regression baseline captured first so the upgrade couldn’t quietly break the pages we just built. Seven releases went out in the open, v0.83.0 on the 23rd through v0.86.0 on the 27th, all on GitHub, each through the gate.
Hive. Light on commits, and on purpose. The engine wired same-origin websockets and the build-asset copy for the dashboard, and folded the operator telemetry that keeps this log honest into the dashboard itself. The bookkeeping is becoming part of the machine instead of a script I run on the side.
Pressless. The boring-and-right column again. The build-time email capture got hardened after review, so a would-be bounce is recovered instead of lost, and the site export stopped shipping a silent empty zip when something failed, surfacing the error instead. Failures you can see beat failures you can’t.
LanternOps. This is where last week’s miss became this week’s work. I’d said the brand wasn’t ours, that the midnight palette and the amber were the model’s default taste dressed up as a decision. This week the whole identity got rebuilt as the Field Guide: ink on warm paper, letterpress restraint, a signal color used only where it means something. The entire site migrated to it, the homepage was rebuilt on the new flagship, and the navigation got a proper mega-menu. The brand is a choice now, made on purpose, which is the only standard I get to hold anything the fleet hands me.
OliveTech. Workflow level, as always. No client names, no client data. The same triage stack running behind the same review gate.
One miss
In JavaScript, "unencrypted".includes("encrypted") is true.
That’s the whole bug. The server normalized the agent’s encryption status with a substring check in the wrong order, so every device the agent correctly reported as unencrypted came back as “Encrypted.” A fresh Windows 11 box with BitLocker turned off showed green in the Security tab. It went in during a routine refactor in February that split some large route files into subdirectories, and I fixed it last week.
The fleet wrote it. Review passed it. It reads fine. You have to already know that “unencrypted” contains “encrypted” to see it, and if you’re reading a refactor diff, you don’t.
What bothers me isn’t the bug, it’s the direction of it. It failed toward the comfortable answer. If it had reported encrypted machines as unencrypted I’d have caught it in a day, because someone would have complained. Instead it told me what I wanted to hear about the one thing I’d least want to be wrong about, and I believed it for four months. No gate catches that. A real laptop with BitLocker off catches that.
What’s queued
Breeze graduates the integrations from connected to working: QuickBooks moves from a connection to a real sync, and the EDR and vulnerability surfaces earn their place by driving action, not just showing status. Delegant owes the next step on the Clio door, the governed way into a law firm’s practice-management system. And now that the brand is one I’ll stand behind, the teaching can run on it: the Field Notes get their LinkedIn series, so the essays reach the people they were written for.
If you’re doing the math on what one person and a fleet can hold, there’s a door.