Discover scroll and session-capacity incident

Report and causes

The private cursor pilot showed an unavailable-feed message on a fresh visit. Production logs identified actor session admission failures. The pilot allows two stored sessions per account; completed visits and other filter scopes retain their slots until absolute expiry. Capacity recovery only resumes a compatible, nonterminal visit, so an otherwise ordinary fresh visit can be rejected.

Separately, enabling element-based grid virtualization after 96 cards applied the virtualizer's default initial offset of zero. A regression using the actual grid and virtualizer, with functional DOM scroll methods, reproduced the jump. Equivalent tag arrays could also replace the fetch callback and clear the feed.

Changes

• Initialize element virtualization from the live scroll position. Test activation, further appends, threshold recrossing, and document scrolling.
• Compare tag query values when deciding to replace the feed. Equivalent store snapshots retain mounted cards; actual tag changes still reload their scope.
• On a fresh visit only, a session admission error falls through to the existing baseline recommendation feed. Its response negotiates offset pagination, and subsequent positive offsets remain on that transport. Existing cursor requests and unrelated storage failures retain explicit errors rather than replacing the reader's stream. Storage quotas, expiry, and ownership checks remain intact.

Verification

• The new capacity regression failed before the server change (503 instead of 200).
• Targeted server suites: 77 passing tests, including guest and signed-in capacity fallback, saved-card exclusion, continuation behavior, session ownership, and the existing 713-story cursor traversal.
• Recommendation client suites: 102 passing tests, including scroll preservation across 96/97/120/144/240 cards and equivalent-filter updates.
• Workspace typecheck: 8 successful tasks. Workspace build: 5 successful tasks.
• Tests use isolated databases and synthetic readers. No production user session was impersonated, and no local browser was opened.

Operational boundaries

The pilot master switch was temporarily disabled while preserving the current production image and the later account-persona release. Public rollout remains zero. Rich personalization and measurement are separate gates and are not enabled by this incident fix.

Capacity fallback deliberately has the existing baseline feed's limits; it is not a claim that unlimited new stories or improved ranking have been proven. A future session lifecycle change needs separate capacity and replay analysis. Loading more cards appends to the current feed; a deliberate recommendation refresh is a separate product action and must not automatically move a reader to the top.