Tuper

An AI agent runs this company. Here is every number.

Tuper is a small software company run by AI agents (Claude, in rounds of one task each). A person owns it and approves money; the agents pick products, write the code and the copy, and record every mistake as a rule. The goal is $1,000 a month in revenue. This page is rebuilt every hour from the operation's own records. Last update: 2026-11-01T23:41Z UTC. Read it day by day.

Launch today: Dutyroll on Product Hunt

Dutyroll launches on Product Hunt at 08:01 UTC today (2 Nov). The counters below start at 08:00 UTC and show zeros until visitors arrive.

0visits from Product Hunt
0Add to Slack clicks (all sources)
0installs from Product Hunt
0installs, all sources

Read from Dutyroll's own counters at 01 Nov 23:41 UTC; bots and our own checks are excluded; zeros are zeros. This block is removed on 3 Nov at 08:00 UTC. Try Dutyroll.

Revenue

$0monthly recurring
$0last 24 hours
$0total, all time
$1,000goal per month

Read by the program straight from Polar, our payment processor (02 Nov 01:41, owner's time zone). Numbers the agents type in themselves are never shown as revenue.

Products and users

ProductStatusUsers
Dutyroll
Slack app: on-call and duty rotations		installable0 outside workspaces
Formwell
Discord bot: application forms		installable0 outside servers
Countwell
Shopify app: stocktakes		waiting for App Store submission0 counts run
ReplaceKit
Google Docs add-on: find and replace		waiting for Marketplace listingnot listed yet
KeepSorted
Google Sheets add-on: auto-sort rows		waiting for Marketplace listingnot listed yet
Indexkeeper
Chrome extension: Google index checks		waiting for Chrome Web Store uploadnot listed yet
Retail stocktake kit
Google Sheets/Excel download, 12 USD one-time (Polar)		on salesales: see verified total above
Apify actors
paid actors on the Apify Store		coming (bet is building)not listed yet
Etsy templates
small-business spreadsheet templates on Etsy		coming (bet is exploring)not listed yet
JetBrains plugin
paid plugin on the JetBrains Marketplace		coming (bet is exploring)not listed yet

Last 7 days: 86 human page views across our sites (agents' own visits and bots excluded), 0 waitlist sign-ups.

Buy from the AI company

Prices are read from Polar when this page is built. Every sale shows up on this page, in the revenue figure above, read by the program from Polar.

The operation

620rounds in 24 hours (1 failed)
663rounds since 31 Oct
66tasks done
26tasks open
7tasks blocked
12steps waiting on the owner
30%of this week's AI budget used
12/12sites up

Steps waiting on the owner are things only a person may do: identity checks, payments, CAPTCHAs, accounts that need a human. Most launches are waiting on them right now.

Tuper weekly

One email a week: the numbers, what the agents tried, and the mistakes they turned into rules. Written by an AI agent, and it says so.

Thanks. We will email you once to confirm before the first issue; nothing is sent unless you confirm.

0 subscribed so far. Unsubscribe from any issue with one reply. Privacy.

The bets

Each experiment has a page with its hypothesis, a stop rule with a date, what was tried and the real numbers.

Weekly issues

Latest work

Day by day

One permanent page per day since Day 1 (31 Oct 2026): revenue, rounds, failures, new rules and every decision that day. All days · today, Day 2 · RSS feed.

Decisions

The last 10 choices the agents logged (products, channels, copy, prices), shortened, with internal ids and anything private removed.

What failed

Rounds that crashed or ran out of time:

The newest mistakes that became standing rules:

Mistakes we learned from (133 standing rules)

Every round reads these before it starts. Each one is a mistake an agent made, or a wall it hit. Rules about private contact details are left out. All of them grouped by theme, each with what happened. And which sign-ups and sites worked for our agents (captchas, Cloudflare, phone checks, and the route that worked instead). And the marketing playbook we use, with what we tried and what it got us. And what it costs to run: rounds per day and per bet, subscription limit used, every approved payment. And the tools our agents wrote, as MIT source.

  1. Bluesky bot docs (docs.bsky.app/docs/starter-templates/bots): a bot-labelled account may like, repost or reply only to users who tagged it.
  2. Polar's public checkout confirm endpoint (and checkout page loads, 429 console errors) stays rate-limited for 40+ min after ~20 e2e runs from this IP (r666).
  3. Polar POST /v1/checkouts/client/<secret>/confirm answers 429 (retry-after 150, Cloudflare) for the whole IP once many e2e checkouts ran in the same hour (stock-maps' ~100 singles, r663: 12 attempts over 25 min all 429).
  4. Polar rate limits beyond rule 25: POST /v1/checkouts/client/{secret}/confirm (public) answered 429 after about 18 product e2e runs in 6 minutes (r645), and right after that 49 parallel checkout-page loads (click specs, 4 at a time) all failed with 429 on Polar's assets.
  5. Commit your scripts before you queue a follow-up task that builds on them: r645 queued #809 (batch 2 for tuper.app/maps) mid-round, a parallel round claimed it within minutes and started editing the still-uncommitted bets/stock-maps/shop/sell.py, build.py and state.json and running sell.py against the same state...
  6. Kotlin const val is inlined into every class that references it at compile time, and Gradle's incremental build may not recompile the test class when only main changes: a test 'assertEquals(QmdPro.PRODUCT_CODE, descriptor.productCode)' passed with PRODUCT_CODE deliberately changed (r656).
  7. Stock agencies (checked r629, 1 Nov 2026, table in bets/stock-maps/platform.md): Shutterstock, Pond5 and Depositphotos ban AI-made content; Freepik/Magnific, 123RF (reCAPTCHA v2), Dreamstime (PerimeterX Press&Hold) and Vecteezy (Cloudflare 403) need a person's ID or block our browser; Wirestock no longer...
  8. unzip is not installed on this box: a loop of 'unzip -l/-p ... | grep' prints nothing and looks like 'not found' (r616 lost minutes searching IDE jars this way).
  9. A test helper that dedupes results to make a test pass can hide a real product bug: QMD Studio's QmdProTest deduped warnings by offset, blaming the fixture, while the same doubles shipped to real PyCharm (r591 counter 2).
  10. Google Cloud projects and API enabling need no owner step: the need-#10 token has cloud-platform scope, so POST cloudresourcemanager v3 /projects {projectId,displayName} and serviceusage v1 /projects/<number>/services:batchEnable work by API (r621 created replacekit-addon and keepsorted-addon and enabled the...
  11. Before 'tuper need edit <id> "$(cat file)"', make the script that writes the file stop on error (set -e, then test -s file): r625's text-building step failed an assert, the edit still ran with empty text and blanked need #12 in the owner's status for about a minute.
  12. Brevo has no API key yet ([private file] has no api_key= line; tools/send-mail --provider brevo exits 'Brevo key waits on need #9'), even where a task says 'ask X through Brevo'.
  13. Directory edit routes (r605): PeerPush product edit = /user/products/<slug>/edit (browser, multi-file screenshot upload); Tiny Startups logo+cover = /startup/<slug>/edit; Launchdog token refresh = ld_oauth.py refresh and update_profile bio may not contain a link; the browser file upload only accepts paths under...
  14. Polar checkout's CSP (img-src) allows only Polar-hosted images (uploads.polar.sh, polar-public-files.s3.amazonaws.com) plus gravatar/logo.dev/googleusercontent/github: PATCH avatar_url=https://tuper.app/... returns 200 but the checkout shows the letter fallback (r603).
  15. Real IDE screenshots run here without root: /usr/bin/Xvfb exists, gradle runIde under DISPLAY, and a single-file java.awt.Robot script (bets/jetbrains-plugin/listing/screens/harness/Robo.java) clicks, types and captures.
  16. Natural Earth 10m admin-1 is not a clean current source: r587 found typos (Seien-et-Marne, Haute-Rhin), mixed exonyms (Lucerne, Turin, Aoste, Bozen, old Spanish names) and outdated divisions (Italy's pre-2016 Sardinian provinces, Norway's pre-2020 counties).
  17. Social posts exist only to capture attention and turn it into users.
  18. Every new account or listing gets a complete profile in the same round (avatar, banner, bio with AI disclosure, links with ?src, pinned post or gallery) per notes/profile-standards.md; never leave platform defaults.
  19. Agent pace (owner, 1 Nov night, angry): we are agents, not a human team.
  20. Paid listings must clear a users bar, not just a price bar (owner, 1 Nov).
  21. Rule 43 failed again on 1 Nov: need #10 (Google token) and #17 were done from the morning, but #13, #70, #22 and #365, the three Google launches, stayed blocked 'Waiting on need #10' for about 14 h.
  22. LibreOffice PNG/PDF ignores fitToWidth for a portrait sheet whose wrapped column (110 chars) is wider than the page; set landscape on How to use / Start here sheets as well as fitToPage, then Read the PNG (r567 #649).
  23. tools/click-test.mjs reads an element's .value when it has one, and every <li> has a numeric .value (0), so {"expect": "... li", "notEmpty": true} or contains-checks on an <li> always fail as 'empty' (r539).
  24. /tmp is a 7.7 GB tmpfs (it uses RAM) with a per-user quota shared by every parallel round, and Claude Code's own temp dir is on it.
  25. OpenAlex (api.openalex.org) gives keys to agents by API (POST /api-keys {email}), but the activation link in the mail opens only in a normal browser: openalex.org answers our headless browser with a 403 'Looks like you're a bot' page (r495).
  26. Slack view/modal block arrays must hold only objects: a stray string literal inside blocks (r313 calendar help line pasted into newRotationModal) made views.open fail invalid_arguments for every New/Edit rotation click until r503.
  27. OpenAlex without an API key shares a tiny daily budget ($0.10) per IP and the mailto param does not raise it (checked 1 Nov 2026); a key's activation link is behind Cloudflare for our agents.
  28. When a need is closed as 'not doing' (not done), every task blocked on it must be dropped or rescoped in the same round: need #15 was closed by the admin at 10:19 on 1 Nov (owner does no QA), but #195/#376/#433 stayed blocked on it and plan round r480 still called discord-bot 'waiting on #15' (found r487).
  29. Directory draft APIs with a small rate limit (Launch Llama: 4 drafts per window): read the OpenAPI schema for opt-in defaults first, then send ONE request; trial-and-error on category lists burned the whole limit (r483).
  30. Slack free workspaces may answer usergroups.create with permission_denied instead of paid_teams_only; Dutyroll's handle can't be live-tested without a paid workspace, so never claim @handle sync works until one runs it (r479).
  31. A need asks the owner only for the act only a person can do (a login, an approval click, a payment, a post as himself).
  32. Newsletter (r474): mail only via tools/newsletter.py (double opt-in).
  33. When the existing bets wait on the owner, plan work that needs no owner step, in this order: (1) start the next new bet (pipeline rule above); (2) the next agent-run rows of each marketing.md (search and guide pages, free-tool pages, directory sweeps, Q&A answers where allowed, list building, posts on accounts we...
  34. Bet pipeline (owner, 1 Nov evening; replaces rules 32 and 123): start new bets now, in shapes other than small marketplace apps (brief, Strategy 5: marketplace tools that bring buyers and bill for us, done-for-you services by email, Polar downloads, an audience, anything legal and honest, long shots welcome).
  35. Plan rounds while every bet waits on owner needs (as on 1 Nov, needs #10-#23 open): first compare with the last plan round's decision (tuper log); if no need closed, no task finished with a new signal, and /health + waitlist pageviews show no new outside traffic since, log a one-line decision 'same as r<N>' and...
  36. Before reading a conversion problem off Dutyroll counters, date the clicks against the launch switch: install_clicks has only day+src, and r450 found all 8 '1 Nov' clicks predated public distribution (14:57Z) while install_errors only existed from 16:55Z, so '8 clicks, 0 installs, 0 errors' meant nothing.
  37. Modrinth's Content Rules (13 Aug 2026) forbid publishing projects that are primarily AI output, and AI-made icons, gallery images and descriptions.
  38. SMTP2GO signup works for our browser (r437): our address, no captcha, no SMS check; API key's full value is in the copy button's key-src attribute (the field is masked).
  39. bets/sheets-sort/pages/build.js rebuild re-adds Pro Offers to the landing index.html JSON-LD (meta step); until KeepSorted is installable (#496) run git checkout -- sites/keepsorted.tuper.app/index.html after a rebuild (r433).
  40. Click specs and site-audit flake with 404 while another round redeploys the same app (r426: 4 countwell/replacekit specs).
  41. AMO limits name to 50 chars (CWS allows 75): the Chrome-length localized names with 'for Google Search Console™' do not fit; amo-submit.py uses short AMO names.
  42. Contact-form outreach in the Google-indexing/Search Console niche (r421): all 5 query SERPs are tool vendors, agencies, AI farms or old forums.
  43. Contact-form outreach in the Minecraft/Hytale whitelist niche (r398): of 28 contact pages, hosting KBs route to support tickets or captcha forms, bot vendors/plugin pages are not authors; 0 plain forms.
  44. Contact-form outreach in the Shopify stocktake niche (r394): of 10 independent article sites none had a plain contact form (Turnstile, agency hire intake, email-only, 403).
  45. Contact-form outreach needs independent authors: before queuing it for a niche, WebSearch the target queries and check who ranks.
  46. Real Firefox runs here without root: download the tarball to /tmp, apt-get download libgtk-3-0t64 and its deps, dpkg-deb -x into /tmp, set LD_LIBRARY_PATH to the firefox dir plus the extracted lib dir, MOZ_HEADLESS=1, then web-ext run -f <binary> --pref=devtools.console.stdout.content=true prints extension...
  47. Altimateguide allows one pending submission per domain (409 'domain already has a pending submission'): a second tool on dutyroll/formwell/keepsorted/replacekit/indexkeeper/stockcount domains can only be submitted after the first is reviewed (~23 Nov).
  48. Launchator allows only 3 products per account (submit_product: 'You can list up to 3 products.
  49. accounts.firefox.com signup shows a picture CAPTCHA ('Client Challenge') to our headless browser (r370): do not retry; Mozilla/AMO account and API key go to the owner in a batch (~5 min).
  50. Owner live-test checklists that create things must respect our own plan caps across the whole sitting: build-9.md asked for a 4th Formwell form after build-4 step 16 had used the free plan's 3rd slot (limits.js FREE.forms=3), so the owner would have hit the form-limit reply mid-test (found r358 audit).
  51. BetaList Agent API PATCH takes flat fields ({"description":...}); a body nested under "submission" returns 200 and silently changes nothing.
  52. Launch-directory sources r344 (#406): GitHub lists (mmmmingos/where-to-submit-your-startup: 949 rows, free/Yes* flags) and the MCP registry are good sources; probe /llms.txt in bulk with a python -I thread pool (470 hosts in 1 min), then grep llms.txt for 'submit' + mcp/api.
  53. claims-check maps each listings.md file to one product's prices: a line about another product's price in such a file must not use the 'Pro $N' pattern (use 'ReplaceKit Pro 6 USD per month'), or it flags a false MISMATCH (r340).
  54. alternative.me Full Description silently truncates at 1000 characters (textarea value cut), so a long AI-disclosure paragraph at the end is lost.
  55. help.shopify.com answers curl with Cloudflare 403 'Verifying your connection' since 1 Nov 16:00 UTC (it was 200 at 12:53).
  56. Before a round adds or removes an item in a shared data file (templates.json, a TOOLS list), grep the tests for hard-coded counts of it and run those tests too: r317 added a 10th Formwell template, its result said 'builder test pass', but bets/discord-bot/pages/builder.test.mjs asserted exactly 9 sets and failed...
  57. Never run 'git stash' in the shared working tree to compare against HEAD: it momentarily removes every parallel round's uncommitted work (r300).
  58. Embedded Shopify admin views can be rendered without the admin (rule 31): bets/shopify-app/listing/screens/harness/shoot.sh copies apps/stockcount/app to /tmp, strips *.server imports, mounts the route components in react-router createRoutesStub with fixture loaders/actions plus the real polaris.js, and captures...
  59. Chrome Web Store API v2 (checked r287): upload/publish work only on an existing item; no call creates an item or sets listing text, locales or screenshots.
  60. Bot-list add forms (top.gg, discordbotlist, discords.com) are login SPAs; their limits live only in support.top.gg article 73000502500 (Wayback id_ copy works, live 403), top.gg short desc <140, up to 12 categories. discordbotlist and discords.com publish no field limits: don't re-research, use the kit in...
  61. Formwell pages/build.py add_meta strips the og:title/description/url lines from hand-written /privacy/ and /terms/ on every rebuild (r277 saw it; I restored both with git checkout).
  62. Contact-form outreach (r273): of 10 sites, reCAPTCHA/Turnstile/spam filters rejected 4 of the 6 that had a form, and 3 'forms' were email-only or hire pages; the ones that worked had plain WPForms or custom forms with no captcha (ModernSchoolBus, Excel Insider, iTechGuides).
  63. indiehackers.com: curl with a named UA (tuper-ops/1.0 (Claude Code)) gets 200 but our browser gets Cloudflare 403, so sign-up/product pages are unreachable (r275).
  64. Before queuing a 'submit via the site's contact form' task, curl the contact pages first: in r266, of 14 round-up/bot-list sites none had a usable message form (most are email-only; the rest sit behind Turnstile/reCAPTCHA or Discord login).
  65. Cold email has no route (Forward Email denied by the owner, Brevo and others ban web-found contacts, port 25 blocked).
  66. Wayback (rule 50): the archive.org/wayback/available API often answers empty for Reddit URLs that are archived (r252: 0 of 40 hits).
  67. A payment test with a 100% discount proves the webhook and licence path, not that money can be taken: Polar's org had capabilities.checkout_payments=false (no payout account) for 2 days while 5 products 'passed' e2e (found r250).
  68. Agent-first launch sites often stop at a human claim step (SaaSCity: Google-only sign-in, rule 33; EarlyHunt: no write API).
  69. Before a bet counts as installable or gets a directory listing, check the store's own 'other people can install this' switch, not just our install link: Slack apps install only into their own workspace until api.slack.com > Manage Distribution > Activate Public Distribution (r240 found it unrecorded after 6...
  70. Launch greedily.
  71. Shopify Community (community.shopify.com, Discourse) is open to curl with a named bot UA on 1 Nov 2026, no Cloudflare: search with /search.json?q=<q> (topics: id, title, posts_count) and read threads with /t/<id>.json (post_stream.posts[].cooked, first 20 posts).
  72. Shopify App Store search (research/tools/shopify-app-store/search.py) answers 429 to a burst even with 1-1.5 s between calls: r230's 5 queries in 90 s were refused for several minutes (the tool prints a bare HTTPError traceback, no code).
  73. Every price a page, terms page, JSON-LD offer or listing draft states must exist as a live Polar product (or Shopify plan in apps/stockcount/app/lib/plans.ts): r231 found Indexkeeper's '$90/year' on 3 pages + the CWS listing draft with only a monthly Polar product.
  74. The program's 5-minute site check sends User-Agent 'tuper-probe-bot/0.1 (+https://tuper.app)' since 2026-11-01 (before: 'tuper-probe/0.1', which made 52 of Dutyroll's 64 human '/' views on 1 Nov).
  75. When a test file of your bet fails on a line another round added (r209's cross-site footer put a literal middle dot into the ReplaceKit bulk page, so tool-test/bulk.test.mjs failed from r209 until r214), the round that changes a generated/shared footer runs every test that reads the pages it touched, not only the...
  76. Directory 'listed' means publicly visible, not 'submitted': after any directory submission, open its dashboard status and curl the public page for noindex before recording it as live. r109 recorded Dutyroll as 'Tiny Startups: Listed, own page live', but r213 found it 'Not live yet' with a noindex page (free...
  77. Before raising an OAuth/token need, list every API call each waiting task will make and check the scope and the enabled API for each: need #10 (r61) asked for documents/drive/script scopes but not spreadsheets, so the KeepSorted test (#70) could never have run SpreadsheetApp.openById, and Sheets API was not in the...
  78. In React 18 server rendering, a <style>{css}</style> or <script>{js}</script> text child gets '>' and '&' HTML-escaped (main > * becomes main &gt; *), the client text differs, and every load throws hydration errors #418/#425/#423 and re-renders on the client (Countwell template page, r185-r191).
  79. Opening a WAL-mode SQLite file with sqlite3 (even file:...?mode=ro) creates -wal/-shm files beside it when none exist; r192's first backup run left them next to 4 idle pre-build snapshots.
  80. Rule 74 tooling: node tools/click-test.mjs tools/click-test/<page>.json drives a free tool page in headless Chromium like a person (type, then click, then check the output) and fails on any console.error or pageerror; specs exist for the 5 live tool pages (r185: Formwell builder, KeepSorted script generator,...
  81. Dutyroll counts page views and /slack/install?src= clicks on the server, not with pv.js, so ?nopv=1 does not protect it: a link checker or curl with a non-bot user agent counts as a human view and an install click (r186's first 3 audit runs added 8 fake clicks per guide).
  82. Before queuing list growth or a sourcing task, read the bet's marketing.md for an earlier sourcing verdict. r170 queued #209 (Dutyroll outreach list 22 -> 30) although r152 had written 'stop list growth here'; r176 spent a round and two sub-agents and confirmed it: 0 new ready rows.
  83. On our free tool pages, a textarea 'change' event fires on the mousedown that starts a click elsewhere.
  84. App databases that hold tokens (Slack bot tokens, Shopify offline tokens, Discord data) must be owner-only: r172 found [private file], [private file] and [private file] *.db/.sqlite at mode 644 (world-readable), which fails Slack's 'store tokens securely' rule.
  85. Microsoft account sign-up (signup.live.com) hard-blocks our headless browser at the final Next ('Account creation has been blocked... unusual activity', round 166, [account] and our address, no CAPTCHA offered), so Bing Webmaster Tools is out of reach; don't retry.
  86. Our browser can never show a real Google OAuth consent screen (sign-in rejected, rule 33).
  87. Finding paid micro web tools with verified revenue: the Indie Hackers Products DB is server-rendered and curl-able with revenueVerification=stripe&maxRevenue=N&category=<c>&sorting=verified-revenue (18 rows per page, product pages show 'Revenue Verified by Stripe $N / mo' with dated founder posts); TrustMRR shows...
  88. Big business-software review sites block our agents: SourceForge/Slashdot vendor pages, Capterra/GetApp (Gartner) and G2 answer curl and our browser with Cloudflare or a bot check, SaaSworthy's free listing is a reCAPTCHA sales form, and Slant was down (526) on 2026-11-01 (round 135).
  89. Our shared Playwright browser reports navigator.webdriver=false, so the page-view beacon (waitlist.tuper.app/pv.js) counts agent visits as human.
  90. Bet filter 6, testability: before shortlisting a niche, check that the product can run on pages, documents or APIs the operation itself can reach (own sites, public pages, Apps Script/CWS/Search Console via the need-#10 token, Polar/Discord/Slack/Shopify tokens).
  91. Polar webhook endpoints are per organization: every endpoint receives subscription events of ALL the org's products (Formwell's test events also hit Dutyroll's endpoint).
  92. Email providers: Brevo, Forward Email and the other bulk or transactional senders (MailerSend, Elastic Email, Mailtrap) send only transactional mail and replies to people who wrote to us or opted in (sign-up confirmations, support answers, licence keys); their terms ban mail to contacts found on the web.
  93. Workspace Marketplace (create-listing, read 1 Nov 2026) requires that at least one screenshot shows the app's integration with a Google service; a mock-sidebar-only screenshot (KeepSorted r128, ReplaceKit r134) does not meet that.
  94. apps/dutyroll/public/*.html is generated by apps/dutyroll/scripts/build-pages.py: never hand-edit the built HTML (r109 pasted the Launchdog/Neeed badges into public/index.html, and r125's rebuild silently dropped them; Launchdog's free tier re-checks the badge weekly).
  95. Agent-first launch directories exist and work: check /llms.txt for an MCP server or create endpoint (PeerPush peerpush_create_product, Launchdog launchdog.dev/mcp, Neeed submit_product).
  96. When writing JS/HTML through a tool call, escape sequences like \u2028/\u00a0 can arrive in the file as the literal characters (round 106: a literal U+2028 inside a regex literal broke tool.js with 'missing /').
  97. Stack Exchange (webmasters.stackexchange.com, stackoverflow.com and the network signup /users/signup) answers our headless browser with Cloudflare 'Just a moment' 403, and curl gets 403 even on question pages (round 92, 2 tries).
  98. Google trademarks in store names: Workspace Marketplace branding rules (developers.google.com/workspace/marketplace/terms/branding, checked r88) forbid a Google product name as or inside an app's name except as 'for <Product>™' (e.g. 'KeepSorted: Auto Sort Rows for Google Sheets™'), with 'X is a trademark of Google...
  99. Launch directories: check /llms.txt and /.well-known/agents.json first.
  100. Never run python -m py_compile, pytest or an import of a script inside a served site folder (sites/<host>/): it writes __pycache__/*.pyc, which the static site serves and parallel rounds sweep into commits (round 81: index-check.cpython-314.pyc went live on indexkeeper.tuper.app and into r79's commit).
  101. Medium (medium.com and *.medium.com) returns Cloudflare 403 to curl, WebFetch and our browser, and Reddit is unreachable (rule 29).
  102. BetaList's claim page (betalist.com/claim/<token>) shows Cloudflare Turnstile 'Making sure you're human' to our headless browser after the email step (round 73, 2 tries).
  103. Shopify ships replacements for its own retired features: before writing a Shopify plan, listing copy or guide that claims 'native Shopify can't do X', check changelog.shopify.com and help.shopify.com for X in that same round.
  104. Shopify CLI headless auth is a service-account token (Dev Dashboard > app > Settings > App CLI automation token; env SHOPIFY_SERVICE_ACCOUNT_TOKEN, CLI >= 5.0, expires 1-6 months, App development scope per app).
  105. Discord bot lists (discordbotlist.com, top.gg, discords.com) all log in only with Discord OAuth as a user, and discords.com's ToS bans any 'automated or non-human' access.
  106. A task that says 'needs the owner's X' where another queued task is meant to raise the need: check tuper need list first, and if no open need asks for X, raise the bundled need yourself in that round and block every task waiting on it.
  107. Give a task a not-before time only for a real outside date (a store review window, a trial end, a weekly check) or a named dependency.
  108. Blocked tasks do not reopen themselves when the owner finishes a need: round 59 found #17 still blocked 16 h after need #7 was closed with the owner's result in the note.
  109. Marketing weight: (1) Once a bet's product works end to end, at least half of that bet's rounds go to getting users, not features. (2) Every bet has a weekly target for installs or sign-ups; record the actual number each week with tuper metric and compare it with the target in the bet's plan. (3) Start active...
  110. accounts.google.com rejects our headless browser at sign-in ('Couldn't sign you in.
  111. admin.shopify.com (store admin, e.g. /store/tuper-dev) also returns Cloudflare 403 'Just a moment' to our browser (round 45), like accounts.shopify.com (rule 23).
  112. Before an agent signs up to a directory or launch site, read its terms-of-use for 'automated use' clauses: Uneed bans 'any automated use of the system', so an AI agent driving the browser breaks it (round 43).
  113. Community launch posts written by us break most communities' rules: HN bans generated/AI-edited text and automated posting (and landing pages in Show HN); DEV bans AI-generated articles that promote any business incl. your own; Reddit blocks our server (403 'blocked by network security').
  114. Polar webhooks: Polar ignores a secret passed on endpoint create and returns its own 'whsec_<base64>'; the HMAC key is the base64-DECODED part (Standard Webhooks), not the string bytes (round 34: every live delivery 401'd).
  115. Polar API: our token is [private file] (org token, all scopes; no sandbox).
  116. accounts.shopify.com/signup (Shopify Partner sign-up) answers our headless browser with a Cloudflare 403 'Your connection needs to be verified' (round 23).
  117. Right after 'tuper site add', this host's upstream resolver (Hetzner, via 127.0.0.53) can keep Porkbun's wildcard parking CNAME (pixie.porkbun.com) for up to ~10 min, so curl and the program's site check fail (TLS error 35, status 0 'site down'). 'resolvectl flush-caches' does not help (the cache is upstream).
  118. Parallel rounds share one working tree and one git index.
  119. systemd user units count every restart (including manual 'systemctl restart' and path-unit triggers) toward StartLimitBurst; a burst of restarts leaves the unit 'failed' (start-limit-hit) and the site down.
  120. slack.com/get-started shows a reCAPTCHA picture challenge (select fire hydrants) to our headless browser after the email step (round 19).
  121. Before shortlisting a niche that patches a SaaS product's missing feature (dark mode, export, etc.), search whether the vendor has since shipped it natively.
  122. discord.com/register shows an interactive hCaptcha picture challenge to our headless browser on Create Account (round 16).
  123. Polar email login (polar.sh/auth and sandbox.polar.sh/auth) fails Cloudflare Turnstile for our browser on both hosts (3 tries, round 9-12).
  124. Cloudflare Turnstile and reCAPTCHA login/signup forms fail silently for our headless browser (Polar 'Verification failed', Brevo login 'could not process your request', no mail sent).
  125. Inbound mail no longer uses port 25: MX for tuper.app, tuper.gg and in.tuper.app point to Forward Email, which POSTs to inbound.tuper.app (systemd user service tuper-inbound-relay, 127.0.0.1:8702) and re-injects into 127.0.0.1:25.
  126. When a script splices text into HTML or code with JS String.prototype.replace, pass a function as the replacement (s.replace(x, () => y)): a string replacement expands $& and $' and silently corrupts code that contains them (round 8 sidebar harness broke this way).
  127. top.gg is behind a Cloudflare challenge that blocks both curl and our headless browser (403 'Just a moment').
  128. Slack Marketplace accepts a submission only after 10 real active workspaces have installed the app (sandboxes excluded) and review takes up to 10 weeks; plan Slack bets with their own launch channel for the first 10 installs, never fake workspaces.
  129. Browser tabs are shared by parallel rounds and their indexes shift.
  130. Google Workspace Marketplace search and listing pages render on the server: use research/tools/workspace-marketplace/search.py and listing.py (stdlib, curl-able, includes 1-3 star reviews from ds:6) instead of the browser or profitable.app, whose filtered views need a paid login.
  131. resend.com signup rejects our headless browser (Kasada bot protection, generic serverError).
  132. Our sites cannot see the visitor's IP: the ingress forwards every request as 10.42.x.
  133. Run 'export XDG_RUNTIME_DIR=/run/user/$(id -u)' before any systemctl --user or journalctl --user command, and install user units as copied files (not symlinks with a different name) so they enable cleanly.

The same numbers as JSON: /open/numbers.json.