0.11.16 — accounts by link, the tile as the unit of every list, and outbound entries

This release is larger than usual because its code sat in the lead instance for a whole day, deployed to production, before it entered the engine repository. That was the plan: accounts and mail are things you test on a live address, not in a container. They get a number only now.

First: the reader account. There is no password. The reader enters an address, a one-time link valid for thirty minutes arrives, a click signs them in and — if there was no account — creates one. Confirming an address is already a link by mail; a password would add hashed storage, a reset path, and something that can be stolen. The database holds no token, only its hash. The response to a link request is identical for an address that exists and one that does not. An account is an address: one person may have any number of them and nothing connects them, because the key is an identifier, not a human being.

An account needs mail, and mail needs a different kind of protection than comments. A comment from a bot waits in the author's moderation queue, so a missing secret on the worker lets it through — a freshly deployed instance must remain testable. A message sent to an arbitrary address leaves the site, and the domain's reputation pays for it. So for everything that sends mail the check is hard: a missing secret refuses, and no answer from the provider counts as a failed test. The check runs before the first database query.

Second: the list. Until now the series index and the stream each had their own card layout, and the grid grew from its content — a longer title or a photo of different proportions broke the row. Now there is one tile for both places, of fixed height in the grid; the image in it is a crop, not a reproduction, and the number of text lines is measured after rendering, not guessed. The number of columns — one, two, three — is the reader's choice, and the choice follows them: on the account if there is one, in the browser if not. The header carries an account mark, visible to a signed-in reader even at zero stars, because zero on an account is information and zero without one is nothing.

The third thing is of a different order and grew out of a question that was not technical: how to send a reader to someone else's text without pretending it is ours. An entry gained a field for an address. When it is set, the entry's content is not a text but a description of someone else's text — a few sentences from the editors on why to go there — and the tile leads straight to the external address, in a new tab, with a real link and no marker telling search engines to discount it. The link is part of what is being given.

Four consequences live in the code, not in convention. An outbound tile is distinguishable by three signals at once — a different edge and background colour, the target domain in the byline, the word "external" — because colour alone is not a signal for everyone. An outbound entry never enters the RSS feed and never triggers a notification: distribution sits on the feed and rewrites items into posts elsewhere as the site's own content, and someone else's text would go out under our name. It does not count reading time or award stars, because the description is three sentences long. It has no rating, because we would be rating our own description. The entry's own page remains — the language switch works through it — with a note that this is a pointer, and an exit above the description and below it.

One thing in this release is a commitment, not a feature. A pointer to a living blog may, a year from now, lead somewhere other than what we described. The entry has a field with the date it was last checked, but nothing enforces it yet. That is debt written down for next time — along with a rule that is not code: the description speaks about the text, not about the author.