Fast Lane — a mode, not a fork

The pitch, in one breath

The team gets one command that turns any practice URL into a live site plus an editable repo in about 20 minutes, and a 30-second edit loop inside that repo — by running the existing factory in a mode that records problems instead of stopping on them, with the editing enforcement layer unplugged but every legibility primitive kept.

This was not designed on a whiteboard. Every number on this page happened tonight, on a real practice site (Hudson Valley Veterinary Dermatology), and the receipts exist on disk.

A mode with hard seams, not a fork. The historical wrong-pipeline scars came from two parallel systems coexisting — a fork recreates that topology; seams close it.

Legibility stays, enforcement goes. The labeled map of every fact ships with the site itself — gates were never what made it editable.

No confirm, none (ruled 08-18). Every edit applies the moment it's typed; anyone on the team runs intake. The 26-second loop doubles as the undo.

Uncertified by construction. This mode is structurally incapable of minting a certificate — a fast-lane site can never impersonate a certified one.

The journey — one site, URL to edited-and-live

Intake — one command, ~20 minutes, never a silent death. A team member runs the door with a practice URL. The factory captures every page the practice's own site serves, builds the editable book, creates the repo, and deploys a live preview. If a step goes red, the run keeps moving, deploys whatever exists, and hands back a plain list of what went wrong — the team member always ends with something in hand.
↘ go deeper — what the builder wires

A --fast-lane flag on the assembly line: discovery-mode semantics (collect-through failures, deploy what exists, certification exits hard-disabled) plus a clean stop after the deploy stage reports its URL, emitting URL + repo + the failure census as the run's result. Tonight's proxy for this flag: --sweep --keep-on-fail with an external cutoff at the deploy verdict. nydermvet timings: capture 8.5 min (30 pages), mint-through-deploy ~9 min, total 22 min including one 90s deploy stage.
The book — where the site's editability actually lives. The build mints a truth book: every fact on the site — phone numbers, hours, headlines, images, colors — named, typed, and anchored to every place it appears, including tap-to-call links and the structured data Google reads. nydermvet minted 710 labeled facts. This layer ships with the site whether or not any gate ever runs — which is the whole reason the fast lane can drop gates without losing the agent-editable surface.
↘ go deeper — the query surface

In the produced repo: npm run ask -- phone (plain-language question → facts with provenance down to byte offsets in the capture), npm run facts:list, npm run facts:where -- "555-0142" (every page and slot a value appears). The repo's own house rules already carry the gate-light philosophy: "Information, never gates" and the M/J fork — machine-checkable changes apply directly; judgment changes preview-then-ship.
The edit loop — ~26 seconds of machine time, measured twice. Ask where the fact lives, change it — it applies the moment it's typed (ruled 08-18: no confirm of any kind, even for a phone number; the certified lane's staging machinery is switched off in fast-lane repos) — rebuild, publish. Tonight's phone-number edit landed everywhere the fact appears — visible text, tap-to-call links, Google's structured data — and the same loop ran in reverse as the undo. Under half a minute each way.
↘ go deeper — the exact loop + the one missing verb

npm run edit:fact -- telephone-2 "347-624-5199" → stages an intent for world-consequence facts (auto-applies for machine-checkable ones) → npm run edit:confirm-world-consequence -- telephone-2 --intent <id> → npm run edit:preview (full reproject, internal consistency gate green) → publish. The missing piece: edit:promote is local-only today; tonight's deploy rode a hand-written driver around the door's own deploy function. Delta #4 gives the repo a real edit:publish verb. Known nick: one sms: link's hidden href kept the old number while its visible text updated — one carrier type not fully anchored; facts:where is the find-check until that carrier lands.
The peek — 30 seconds of honest eyes after every deploy. A headless browser loads the deployed homepage and reports what a real visitor's browser experienced: files that were blocked, errors in the console, whether the design actually painted. As information, never as a blocker. Tonight is the proof this peek earns its slot: our first deploy served a completely naked site while every single file returned 200 — only a browser could see it, and the check that would have seen it is exactly the one the fast lane cuts.
↘ go deeper — what bit us and the class-level cure

The pages carried 1,018 subresource-integrity fingerprints promising the origin's exact bytes; the pipeline necessarily rewrites CSS bytes, so the browser blocked the master theme stylesheet (console: "Failed to find a valid digest in the 'integrity' attribute… The resource has been blocked"). Hot-fixed tonight by stripping stale fingerprints in the staged output; the durable cure (delta #2) is in the rewrite pass: strip-or-recompute integrity on any byte-changed resource. The peek's assertion set: zero blocked resources, master stylesheet applied (computed styles, not file presence), console error list attached to the run result.

The seams — why this cannot cross-wire

Two doors, never a flag. The team gets its own named command with the mode hard-coded inside; the certified door is untouched. No shared entry point takes a mode argument a human can mis-set — the historical incidents all involved one surface with configurable behavior.

The dangerous direction is closed by code, not discipline. The only cross-wiring that costs real money — a fast-lane site treated as certified — is structurally impossible: this mode cannot mint certificates (proven tonight: every certification stage reported "hard-disabled… can never be emitted"), and the cutover gates fail closed on a missing certificate.

Separate output namespaces. Fast-lane repos and deploy projects get distinct naming plus an UNCERTIFIED marker in the repo itself. No fast-lane output path overlaps any certified path.

The one-way valve. Fast-lane sites never promote in place. Graduation to a real client site re-enters through the certified front door (~20 minutes, clean provenance).

A check that can fail. A standing wiring audit on every merge: certified entries cannot reach fast-lane mode; no namespace overlap. Turns "the seams hold" from a belief into a mechanical verdict.

What trunk needs — five small deltas

1 · Identity-ordering fix (a bug, ships regardless). Fresh sites were failing the mint because the site's identity file was written two stages too late. Found, fixed, and validated red→green tonight; the fix is two commits in the experiment clone ready to PR.

2 · Fingerprint fix (a bug, ships regardless). The rewrite pass must drop or recompute integrity fingerprints on any file whose bytes it changed — otherwise every browser blocks the rewritten stylesheet on any site whose origin emits them.

3 · The mode behind its own door. Record-don't-stop semantics, deploy what exists, certification structurally off, clean stop at URL + repo + failure list — hard-coded inside a separate named team command (seam #1). The certified door untouched.

4 · The publish verb + confirm off. The produced repo gets edit:publish (rebuild + deploy in one step; tonight it took a hand-written driver), and fast-lane repos ship with the confirm machinery off — every edit applies immediately.

5 · The render peek. Post-deploy browser look, report-only in this lane. The certified lane keeps its full blocking walk unchanged.

The labeling law. Fast-lane output is structurally incapable of carrying a certificate — the mode hard-disables certification, so no fast-lane site can ever read as certified. And no fast-lane site goes client-facing without Robert's word. The bridge is for the team's speed, never for quietly lowering the bar on what ships to a practice.

Named risks — accepted with eyes open

Broken renders can reach the preview. The peek reports it in the same breath — the team sees "deployed, but the browser reports X," never silence. Tonight's naked-site hour is what this trades away.

Edits apply instantly — no confirm of any kind (ruled 08-18). A wrong phone number reaches the preview the moment it's typed. Mitigations: the 26-second loop is also the undo; facts:where shows everywhere a value lands; fast-lane previews are never client-facing, so the blast radius is the team's own review surface.

Some edits need a find-check. Anchor coverage has known nicks (the sms-link case). facts:where answers "everywhere this value appears" in one command until coverage closes.

Fast-lane repos drift from certified output. Accepted: bridge artifacts. Graduation re-enters through the certified front door — unless you rule otherwise below.

Ruled in chat, 2026-08-18, folded into this draft: no confirm of any kind — every edit applies immediately · anyone on the team runs intake · cross-wiring with the certified lane is the central design constraint, answered structurally by the seams above.

Open questions — your red pen

1 · Graduation as law

Written above as law: a fast-lane site never promotes in place — a real client site re-enters through the certified front door. Confirm or amend.

2 · Naming

"Fast lane" is a placeholder. What does the team call this so it never gets confused with the certified pipeline?

3 · The pretty URL

Fast-lane deploys land on workers.dev today. Wiring the prettier preview domain touches the shared practices namespace — worth doing now, or after the lane proves itself?