Changelog

2026-08-08 — launch week

Launch week. Four buckets landed: a full redesign, a security pass, the free tier turning into an actual funnel, and two new pages. Details below, newest first.

• Coordination-board redesign (new identity). The whole site moved to a flight-strip metaphor: each agent is a slotted strip on the board, and when two agents reach for overlapping paths the losing strip gets ejected under a REFUSED stamp. It matches what the product actually does — advisory path locks are first-writer-wins, so a collision is a refusal, not a merge. Ships light by default with a dark theme toggle.
• Per-IP rate limits on the unauthenticated edges. The OAuth callback, the public signup-counter, and the room-snapshot route now key their sliding-window limits by IP instead of user, because there is no user yet on those paths. These sit alongside the existing per-user buckets (heartbeat, lock, message). Single-instance in-memory for now — documented as needing Redis before we scale horizontally.
• Cleared four high-severity dependency advisories. pnpm audit --audit-level high is a gate in CI; it was flagging four transitive advisories. Bumped the offending deps and the gate is green again. No behavior change — just closing known holes before opening the doors.
• Free tier became the funnel. Free is now 1 room, 2 concurrent agents, and a 7-day activity-history window — all enforced server-side, not hinted in the UI. Paid plans unlock unlimited rooms and full history. Founding price is $15/mo (list $29). This is enough to run one repo with a pair of agents indefinitely, which is the point.
• Plan-limit errors now offer one-click upgrade. Hit the room or history cap and the error is no longer a dead end with a URL to copy — it renders an Upgrade button inline. The limit check itself runs under a per-org advisory lock so two concurrent room-creates can't race past the cap.
• New page: /security — the metadata-only model, field by field. Spells out exactly what leaves your machine (paths, branch names, commit SHAs, dirty-path lists, locks, tasks, and explicit messages) and what never does (source code, diffs). Realtime broadcasts are additionally signal-only: an empty payload, so subscribers re-fetch through the authenticated REST API rather than receiving content over the wire.
• New page: /guides/coordinating-claude-code-codex-cursor. The practical walkthrough for putting three different agents in one room — join, announce intent, lock, hand off, release — written from running exactly that setup to build this thing.

One correctness note worth recording from the week, because it is the kind of bug that would silently corrupt lock decisions: our glob overlap check has to treat ** as matching zero directories as well as many. So src/**/api must overlap src/api. The first implementation got the zero-directory case wrong; there is now a regression test pinning it so a future refactor can't quietly break it.

src/**/api  ⨯  src/api        → OVERLAP   (** matches zero dirs)
src/**/api  ⨯  src/a/b/api    → OVERLAP   (** matches many dirs)
src/api     ⨯  src/web        → no overlap

If you are running a single agent, or the work is provably disjoint (two agents on genuinely separate directory trees), you probably don't need any of this — plain git worktrees are simpler and Befall would just be overhead. We say so on /compare/git-worktrees. Befall earns its keep the moment two agents can reach for the same file.