Build LogDVLAW
#06
2026-06-045 min read

A missed slot at 09:00 should not silently vanish: building past-due grace into the article pipeline publisher

The `schedule_sweep` runs on a laptop. Laptops sleep. Without a grace policy, an article scheduled for 09:00 silently strands when the machine wakes at 09:07. Sprint 6 of B-schedule — past-due grace plus 48-hour hard-expire — turns that silent drop into a recoverable state with a reason, an audit trail, and a path back to publish.

Read post
Build LogPython
#07
2026-05-318 min read

The classifier is the product: how four branches replaced an inbox

Inbox Hub is five SQLite tables, twelve route handlers, four Shadow DOM components, and a launchd cron. Strip those away and what remains is a four-branch decision tree that runs on every message. Everything else is plumbing around that core.

Read post
Build LogPython
#08
2026-05-306 min read

monkeypatch lies to you when your tests run in subprocesses

The fixture looked correct. The patch was applied. The subprocess ignored all of it and wrote to the real registry. Three days of roadmap work taught me that monkeypatch only rebinds the parent process — env-var overrides are the only isolation that survives a fork.

Read post
SecurityBuild Log
#09
2026-05-287 min read

The backtick that could run anything: hardening AppleScript shell escaping

A Sprint 2.11 review flagged a shell command-substitution gap in a single Python helper. Backticks and dollar signs were passing through unescaped into a double-quoted `do script` string, meaning a crafted issue title could execute arbitrary code. The fix was four lines. Understanding why it mattered took longer.

Read post