Writing
Research notes, technical essays and field notes. Each carries its own status, so you can tell what is established from what is still being worked out.
600 File Reads to Serve One Article
A content loader that reads the entire collection to find a single document, what it costs at realistic scale, and the four-line fix that also opened a path-traversal hole
A measured account of read amplification in a file-backed Next.js content site: 600 disk reads per article request at 300 documents, reduced to 2, and the security surface the fix created along the way.
2026-09-07 · technical-essay · 4 min read
A Nonce Is Not a Security Upgrade If Your Pages Are Static
How a textbook-perfect Content-Security-Policy shipped a site with every script blocked, while every gate stayed green
Tightening script-src to a per-request nonce is standard hardening advice. On a statically prerendered Next.js site it silently disables all JavaScript on every static route, and nothing in the build, the test suite or the response headers will tell you.
2026-09-07 · technical-essay · 5 min read
Exit Zero Means Nothing
Six autonomous coding jobs reported success. Three had produced nothing usable. What a green result actually proves, and what it does not.
An account of measured verification theatre across autonomous agents, shell pipelines and accessibility affordances, and the small set of checks that distinguish work reported as done from work that happened.
2026-09-07 · field-note · 5 min read
Your Prerendered Pages Return 404 on Cloudflare Workers
A Next.js dynamic route builds as SSG, deploys without error, and 404s in production. The cause is one missing line of configuration, and nothing in the build will tell you.
Prerendered pages of a dynamic route are served through OpenNext's incremental cache, not from the asset bucket. With no cache adapter configured they 404 in production while every static route works and the build reports success.
2026-09-07 · technical-essay · 5 min read