Blog
Engineering notes and project postmortems — 68 in total, newest first. Also available via RSS.
- A TLS Certificate Inside a QR Code — No CA Will Vouch for a Mac on Your Home Network
- TLS Alone Doesn't Know Who's Calling — Lynsi's Handshake Gate, and the Test Script That Lied to Me Twice
- 256 Characters, No Appeals — After a Restricted HarmonyOS Permission Got Rejected
- Pricing Against a Free Official App — Where Lynsi's Paywalls Go
- A Segmented Control You Can't Click on Mac — Catalyst Doesn't Deliver Taps Into List Section Headers
- Implementing a Protocol You're Not Allowed to Read — Re-deriving Mosh from Packet Captures
- Mosh Was Painfully Slow, and I Almost Blamed the Tradeoff I'd Just Made
- How Long Did You Actually Type? — Making Practice Time Deterministic, Tamper-Resistant, and Reproducible
- Playable Offline, No Lost Scores Online — an Idempotent Outbox and One Worker Boundary Pipeline
- Sync the Source of Truth, Rebuild the Rest on Each Stack — Cross-Stack AI Conversation Sync
- A Command Snippet Library: Changing 'Tap to Execute' to 'View Before Executing'
- No Server-Side Merge, No Account, and the Save Still Converges Across Devices — G-Counters plus CAS
- A Leaderboard That Shows Your City Without Knowing Where You Are — Anonymous Region Labels
- If You Can't Parse the Command Name, Don't Allow It — Command Parsing Is the AI Agent's Security Boundary
- One Sync Protocol, Two Tech Stacks — And a Contract zlib Forced Me to Change
- A Pairing Code You Can Freely Photograph — Because the Passphrase Isn't in It
- Making Alibaba OSS Actually Behave Like S3 — 'S3-Compatible' Is Not a Contract
- Deleted and Back Again — An Object That Writes Itself Into the Database
- 'Try Restart' Is Not 'Undo' — Shell-Free Restart and a Crash-Recovery Ledger
- Prefer a Miss Over a Wrong Kill — A Fail-Closed Cleanup Grading Engine
- Stopping a Process That Keeps Changing — TOCTOU and Continuous Checkpoints in a Cleanup Action
- From Resource Monitor to Cleanup Assistant — When Safety Is the Product Itself
- What Actually Belongs in a Bilingual Site's <head> — canonical, hreflang, and Structured Data
- No OG-Image Service — Making Share Cards With Headless Chrome
- One Key, Five Macs — Keeping Activation Seats From Quietly Leaking Away
- SEO for a One-Person Constellation of Sites — Same-Origin Sitemaps, Domain Properties, and a 308 Trap
- Notarized, Approved, and Dead on Double-Click
- Pier 2.0 Goes Paid — and You Pick the Price
- Two Kinds of Garbled Terminal — vim Paste Wedging and Remote Chinese Turning to Question Marks
- KeyDo: A CRT Arcade-Style Typing Dojo
- Three Subscriptions, One Endpoint: Open-Sourcing LLM-Bridge
- Make the AIs Hold a Meeting: Open-Sourcing Open Council
- Why Trust a Client-Computed Score? A Leaderboard's Server-Side Floor
- Found but Unreachable: One Message, Two Identities
- Opening a Door in Someone Else's Terminal: Four Downgrades of VibeTrail's Resume
- Building This Site: How It's Put Together
- Running an Imperative Game Loop Inside React: Word Rain
- Letting an AI Type Commands on Your Server: Shellby's Three-Tier Gate and Five Guardrails
- Keeping an AI Agent's Context From Ballooning With Step Count — Cache Breakpoints, History Folding, and Streaming
- Credentials Can't Touch the Cloud: Shellby's Dual-Track Sync
- Linking ripgrep into Your App: Index-Free Full-Text Search in VibeTrail
- Typing Sound Effects Without a Single Audio File
- No Agent, One Command for All Server Metrics: Shellby's Monitoring
- There's Only One Kind of Tunnel: Shellby's Port Forwarding
- Truth in a Ref, Snapshot for React: A Per-Character Typing Engine
- A Dead Connection That Looks Alive: Shellby's Liveness Token
- What 4 Million Files Taught Me: A Diskly Scanner Performance Postmortem
- One SwiftUI Codebase, Three Different Hands: Shellby's Multi-Session Adaptation
- Making macOS Stop Asking for Keychain Access on Every Connect: A Keychain Choice
- One reasoning_effort, Translated for Three Backends
- Skipping the App Store: Signing, Notarization, and Self-Updating for macOS Apps
- Cutting OAuth, Keeping Two Protocols: The Trade-offs of an Access Convergence
- The Life and Death of a Feature: Four Rewrites of Pier's Per-Process Network Monitor
- Group Cards Flickering During a Scan — Three Layers of Nondeterminism and One Epoch Bin
- A License System With Zero Backend
- Two SSH Stacks for One Login: Shellby's Backend Choice
- Three App Freezes, One Culprit: Don't Block Swift's Cooperative Thread Pool
- A Red Dot in the Menu Bar — Passive Monitoring for LaunchAgents
- Three Subprocess Invariants: Don't Turn a CLI Into a Zombie
- lsof Says node. It Doesn't Say Which Project.
- Not a Single Photo Uploaded: Flick's On-Device Similar Photo Detection
- Database Constraints as Tripwires: Three Bugs Caught Red-Handed
- The Debate Is Too Long to Feed In: A Compression Before Synthesis
- Three Layers of Defense Against Overselling: Concurrency Control in a Seat Allocation System
- One OpenAI Endpoint, Three Very Different Processes Behind It
- Every Chinese Keyword Was Dead Code: Routing, Roles, and a Regex Trap
- Extracting Tokens Is a Dead End: A Personal AI Gateway's Compliance Line
- How a Consensus Score of 0.82 Is Computed: Quantifying Multi-Model Peer Review