Today we completed the staging domain cutover, prepared staging for fresh testing, and improved how the platform responds to everyday changes. The UI work is now deployed to staging Cell-1. Production customer admission remains paused while launch checks continue.
Keeping staging separate
The staging website, application and onboarding flows now use their dedicated staging domains. Staging authentication accepts only staging callbacks, and production authentication accepts only production callbacks. We verified that each rejects the other environment’s callback.
We removed old staging listeners for production domains and reconciled identity routing records without recreating deleted organizations. Staging continues to use Paddle sandbox. The image registry, backup/provider resources and operator Zoho application remain intentionally shared; this is not complete provider account isolation.
A reset mistake, and its recovery
We reset staging tenants, customer identities and related routing state to start testing cleanly, and canceled the remaining active sandbox subscriptions. Protected backups were taken before the reset.
The cleanup was too broad. A cascading database operation also removed shared ontology catalogs and operational history that should have survived tenant deletion. We corrected the reset record and restored those shared records from the pre-reset backups.
Recovery restored entity and relationship catalogs, deployment history and platform error history while leaving former tenant content and customer identities deleted. A new tenant created after the reset was preserved. We compared shared catalog data against the backups and verified sample-data creation inside a transaction that was rolled back.
Production was unaffected. The recorded rule for future cleanups is to delete only the selected tenant data and verify shared catalogs and operational history before and after the operation.
Updating the workspace in place
Changing a status or owner should not reload the entire page or discard work in another panel. We expanded in-place updates across system and model operations, component properties and configuration, publication workflows, user permissions, API clients, webhooks and report management.
Supported actions now refresh affected server-rendered regions while keeping the document, navigation context, scroll, open panels and unrelated drafts. Existing authorization, validation and impact confirmations remain part of the same operations.
Five concrete audit fixes
We reviewed six live system compositions, six component types and shared-model relationships, alongside template, handler and browser code. Additional tests covered 92 type, state and access combinations.
The audit found five issue groups, all now fixed:
- Architecture actions still reloaded. Recording validation, applying starter patterns, creating or connecting entities, removing them, and adding relationships now update the existing workspace.
- Validation lost its explanation. Expected field errors now appear inside the submitted form, preserving values so users can correct and resubmit.
- Rapid filters lost the latest request. Systems, models and components now ignore stale responses. Sorting and Back/Forward navigation use the same handling, and text entered while loading is retained.
- Removed objects stayed in navigation context. Removing the selected operations object returns context to its model or system. Surviving objects keep their context, and renamed objects display their updated name.
- Guide text became the list context. Inventory pages now consistently identify themselves as Systems, Models or Components, regardless of guide visibility or wording.
These corrections use the existing navigation gadget and layout. They do not add another navigation layer.
Release and verification
Cell-1 now runs 20260909.1 / v1.1.0-rc96. Its application and worker use the same immutable image and report healthy. All 164 existing migration checksums matched; no new database migrations were needed.
Full verification included Go tests, database integration, tenant isolation, backup and restore, scaling and release-control checks. The browser gate reported 407 passing tests, 59 approved optional skips and zero failures. Shellcheck and Python tests could not run because their tools were unavailable; shell syntax checks did run.
The release-verification email was confirmed, encrypted backups were verified before and after deployment, and public health/readiness checks passed. The deployed navigation and update scripts match the committed source. An attempt to inspect the authenticated hosted UI timed out, so that acceptance remains outstanding.
CellPro and production did not receive this application rollout. Updated identity-theme recovery instructions are committed but were not deployed with the Cell-1 application.
Next checks
We will continue authenticated staging acceptance, ordinary-user workflow checks, specialized creation and deletion navigation, and tenant-recovery planning. Production launch checks and any wider rollout remain separate steps. Closing these five findings does not mean every platform workflow has been exhaustively tested.