bonuz Human Layer and Lifestyle Wallet

For thirty versions, the confirmation in our camera lens said this, in whatever language you were using: "It disappears from the world for everyone, and this cannot be undone." A drop is a virtual object any user can leave at a real place for a stranger to find. What the button did was remove it from a list on your own phone. The drop stayed exactly where it was, on every other phone, forever.
Nobody caught the lie, and the reason is the point. The lens hides your own drops from your own radar, because you already know where you put them. So the instant the local copy went, the screen showed nothing where the drop had been, and it looked correct to the only person who would ever check. That is how a lie survives thirty releases: not by hiding, but by being indistinguishable from the truth from every angle a user can occupy.
The fix has a second half. Written, reviewed, tested, every check green. Then an adversarial review, where readers try to break work rather than approve it, found that the new delete button called an address that did not exist. The lens is a web page and the backend sits on another domain, so every action goes through a small forwarding route on the lens's own side. Three existed: placing, claiming, moving. The fourth, deleting, had never been created. Every test passed, because the tests replace the network with a stand in and check that the right address was requested. They prove the client asks the right question and nothing about whether anything answers. Shipping it would have been a regression: the old button at least cleared your own bag, and the new one would have shown an error forever.
Now the part this room will recognise. Every item a business can hand someone in bonuz, a voucher, a membership, a punch card, a pass, is minted from one engagement contract on Base. There are now two, an older one and its improved successor. The old one will never be retired from display, because retiring it would erase things people already own. The founder set the rule out loud: "The old one will eventually be sunsetted for minting, but it will never be sunsetted for showing and display." Then he asked for something nobody had scoped: "The new smart contract is just an improvement. Check again if you've done it right, compare with the old one."
The interfaces matched almost exactly. The data did not. A punch card records how many punches you have and how many you need. On the old contract that second value is stored under the name max punches, with a space. On the new one it is max_punches, with an underscore. The app read only the underscore. So every punch card on the old contract reported that it needed zero punches: no progress bar, no counter reading three out of ten, and because the completion check requires a maximum above zero, a finished card could never be recognised as finished. Somebody could fill their card and never be given the reward.
No interface comparison would have shown that. No type checker, no test suite, no schema. It was visible only by reading real items off the live chain and putting the two side by side. When two things must both be supported, breaking either one must fail. Removing the new contract from a list is the obvious test. Removing the old one is the test people forget, and the one that protects the promise.
The same preference sits at the front door. LIFE mode is locked, and a wallet opens it by holding a Life Key, an item whose on chain attributes say what it grants. The gate reads the chain and nothing else. It keeps no list of approved wallets, because a list is something a person has to maintain and a chain is not.
Two fences were built before they were needed. Users can place ten drops in any rolling twenty four hours: "That's why we limit users right now to ten drops a day, so it can't be abused." The limit came first, before the social feature it protects. Drops can also be reported anonymously, because requiring an account to report something objectionable means most of it goes unreported. But anonymous reports can never hide anything, at any volume. Only distinct identified accounts count toward the threshold, one account reporting the same drop repeatedly counts once, and hiding is always reversible. A moderation feature that anonymous volume can trigger is a takedown weapon aimed at whoever somebody dislikes.
Then our own outage. A change added a new record type to the database. The system that stores records keeps a table of editing locks with one column per record type, and builds a single query naming every column at once. The new type went into the configuration and not into that table, so the query named a column that did not exist, so every write to the database failed. Every write, of every kind, including the admin panel's own save button. Seventy five minutes, self inflicted and self reported. Types passed, the test suite passed, and the check that exists to rehearse database changes passed, because it applies the change to an empty database where the missing column is equally missing. A green rehearsal means the change applies. It does not mean the result is complete.
Off the chain sit the failures no monitoring can see. A map tile service moved behind a key and, instead of refusing, served a valid image with API KEY REQUIRED printed diagonally across it: status two hundred, correct file type, sensible size, every check green. Twenty eight venue photographs turned out to be generated rather than taken, all produced by feeding the venue's name to an image model, which is how Wild Wadi Waterpark, a water park in Dubai, came to be illustrated with a desert valley. All twenty eight are gone from production. "You really took really messed up pictures. This is something in Arizona, this doesn't exist."
The honest state. The lens is live, it runs in twenty four languages, drops can now genuinely be deleted, and loyalty cards on both contracts display and complete correctly. Roughly a hundred and seventy photographs still await attribution. About a third of the image library is below the size the app prefers, and re-processing cannot fix it, because the system does not enlarge images. Some of the oldest punch cards were minted without the punch target at all, and no client code reaches those. And the app has not been rebuilt since a significant amount of this work landed, so several of the fixes described here exist in the repository and not yet on anybody's phone.
Every person these failures would have hurt was unable to report them. The person whose punch card would not complete assumes they miscounted.
"Updates are taken very serious. We must be careful. Ship less, but perfect ones only."