Thursday, 8 October 2026

Satsuma's autonomous process keeps a work ledger on chain: a contract that tracks each piece of proposed work from submission through building to deployment. The change that makes that ledger move only through governance was merged. Before it, the session's own note put the problem plainly: "Today the ledger's state changes are made by the daemon's own key. The ledger mirrors governance; governance doesn't produce it." Now every transition comes from the governance timelock's execution payload, deployments are recorded by one role and attested only by the timelock, and releasing a stalled item is permissionless. The change carries 35 ledger tests and 16 dry-run acceptance tests; the full suite stood at 628 passing and 1 failing, the same failure already present before it.

Two design records were written down. One covers moving ledger transitions into governance payloads. The other covers an operating component: a registry of key performance indicators, a registry of operations, a generic measurement step and an operator runtime, so that what Satsuma builds is also run and measured as a governed operation. The defaults chosen: a separate indicator registry, operators file reports of need but only the loop proposes, budgets escrowed in SUMA and debited in compute units, and a policy hash pinned per operation and changed only by an amendment vote.

The operating component was built on a branch: 16 commits plus three fixes covering hold-close, bounded operator restarts and a settlement grace period. 27 dry-run acceptance tests passed, six of them with caveats; the suite stood at 691 passing and 1 failing, the same failure as before. A further pull request was merged after that.

With the new loop, the same objective ran again on fresh chains for 5 h 26 min with no human intervention after the start. Satsuma proposed three build protocols, an exchange, a remote account and a mandate account, plus a first operation; the council approved 3–0, the operation was activated and traded, and the goal was declared met. Six of sixteen swaps failed on slippage, and the research step judged nothing needed.

Review of the design pushed back on one point. Pausing an operation permissionlessly on a breached bound was rejected in favour of review periods that give an operation time to play out, with re-evaluation leading to a proposal or an on-chain change request; as the design notes already say, "The mandate contract already refuses every out-of-limit action on chain; that is the hard stop." That redesign is open, along with the write-up of this run, the naming of the runs, four long-standing test failures in continuous integration, and the fact that budgets still count model calls rather than real spend.

Satsuma runs three public websites: a main site, a block explorer that shows the chain's blocks and transactions, and this engineering blog. A round of speed work landed on all three. Font downloads fell from 352 KB to 89 KB, the next page starts loading as soon as its link is hovered, including links that cross from one site to another, and an explorer page that was loaded ahead of time now starts polling for live data only once it is actually opened. Images and other media are kept out of that hover preloading.

The explorer's overview page no longer jumps around while it loads. Block rows are stacked and the fees lines have a fixed size, and the measured layout shift dropped from 0.028 to 0.0004 on desktop and from 0.074 to 0.0006 on a phone.

The main site's homepage now carries sourced numbers, a single header pattern shared across its sections, and a section on the first experiment, in which Satsuma was given a goal and built what it needed to reach it.

A cross-browser pass covered WebKit and Firefox on the live domains. WebKit logged access-control errors in its console; their cause is not yet confirmed.

Section navigation landed on engineering.satsuma.one: merged through a pull request and deployed, it appears on articles with 3+ sections. The design is a side rail on desktop and a bottom bar with a sheet on mobile, softened from the first mockup to a lighter look. The preview server, worktree and merged branch were cleaned up afterwards.

The like study was revived as a weighted like button and went live as a three-way experiment across hold, tap-again and swipe, with a likes database and a stats endpoint behind it. Hold was the initial recommendation; the decision was to test all three in production instead.

Further pull requests, all merged and deployed, reworked the button. The glow word, the popup, the hint text and every other word were dropped. A prism effect while holding and a lasting page imprint were built and then abandoned in favour of a plain strip. Tap-to-like followed and was replaced by swipe-to-like with intensity.

The button now is a centred swipe-to-like strip. Swipe distance sets the intensity, a partial fill stays visible after a half swipe, and a tap on a like removes it. The first swipe sets handedness, which is remembered; after that the strip tilts 18° and bows 7px toward the thumb. "Handedness is a guess from one swipe."

Still open: the touch gestures and a select-all fix were tested only with simulated touch, not on a real phone. Handedness cannot be flipped without clearing site data. The per-gesture breakdown in the stats now shows only taps and likely needs adjusting after the move to swipe. One of the like button pull requests was merged before its build check reported, though the local build passed. In light mode, the navigation's thread and hollow markers are faint.