Revolver finished this week, and then a routine review of one automated session raised four problems with it. Three of the four turned out not to be problems. The fourth was worse than reported.
Finishing Revolver
Four sessions took the album out. I Want to Tell You gave up two working titles — Laxton’s Superb, then I Don’t Know — before it acquired the one on the sleeve, and it carries the first bass-only overdub in the catalogue. Good Day Sunshine was among the quickest things on the record; George Martin’s honky-tonk piano was cut at a varispeeded 56 cycles, and there is an audible drop-in about nine seconds from the end that nobody chose to hide. Its released mono mix is remix 7, filed at the time under the wrong number.
Here, There and Everywhere is one of only four tracks on the album with any appreciable echo-chamber treatment, which is a useful corrective to the idea that Revolver is a wash of effects — most of it is bone dry, deliberately. She Said She Said closed the album’s recording in a single session, and its claimed fifteen takes turned out to be four: the “at least twenty-five” often quoted were rehearsal run-throughs, never numbered on the sheet. Yellow Submarine was the last Revolver page, and its effects session is the best-documented afternoon of nonsense in the catalogue — chains, ships’ bells, hand bells, tap-dancing mats, whistles, horns, and wind and thunder machines, with a vocal sung through a microphone into a water-filled tin.
Then a single page out of sequence: When I’m Sixty-Four, the only December 1966 recording left un-enriched. Paul had written it years earlier, played it at the Cavern, and revived it the year his father turned sixty-four. It was recorded slow and replayed fast — the tape run at 53 cycles so the finished vocal sits a semitone up and a decade younger. The three clarinets were overdubbed a fortnight later.
The review
An automated session is only as trustworthy as the review it gets, so one was reviewed in detail. Four concerns came out of it. Three did not survive contact with the evidence.
The single-page session was not a downgrade. The protocol targets two same-cluster songs per session, and this one shipped one. But When I’m Sixty-Four was the only remaining December 1966 recording; the rule that pairs pages explicitly forbids reaching across eras to hit the number. The session did the right thing and the record of it was simply thin.
The push had not failed. The session reported a successful deploy; a follow-up check of the repository said it was a commit behind. The follow-up check was wrong. The local copy’s pointer to the remote branch had gone stale, so it was reporting where the remote had been rather than where it was. The published page was live, at the right size, with every marker of the new content present. This is the fifth time that same stale pointer has produced a false failure report, and the tooling now re-queries the real remote after every push and refuses to exit clean if the local pointer cannot be brought into line.
The credential was not missing. It was where it was supposed to be, unchanged. That was the third alarm, and it was noise.
The fire
The fourth was real, and reading the history to disprove the third is what found it. Two weeks earlier, an access token had been committed to the repository — not in a file, where every scanner would have caught it, but as the commit message itself. It sat in the public history for eleven days. The platform’s own secret scanning did not flag it, because a secret in a message body is not where secret scanning looks.
The token has since been rotated and the exposed one is dead. What is worth recording is not the mistake but its shape: every automated defence in the chain was pointed at file contents, and the leak went through the one field nobody was inspecting. Two gates now close that path. The deploy tool refuses any commit whose message matches the shape of an access token, before it does anything else; and because the deploy tool is not the only way a commit can happen, a hook in the repository itself applies the same check to commits made by any other route — including the improvised ones that get used when something else is stuck.
The same review turned up a fourth thing nobody had reported. The repository’s staging area had been left in a torn state a few days earlier, with three hundred and eight files pre-staged from before a week of work. Committing it would have silently reverted a week of corrections. It was reset to match the published state, and it is the strongest argument in this log for the habit of reading the machine’s state rather than trusting its summary of itself. Three of the four alarms were false. The two genuine faults were both found by going to look.