Checks That Cannot Fail
Twelve documented mistakes across a bandit benchmark and two cryptographic labs, and not one of them was a math error. Four ways a verification quietly stops verifying, and what actually catches them.
Read Note →
Notebook
Deep dives into engineering concepts, implementation experiments, benchmarks, and technical notes.
Idempotency
A duplicate request consuming a single-use token can't just be retried safely. What actually stops it from running twice, and why a vendored Redis lock library turned out not to.
Read Note →
Request Coalescing
Rejecting in-flight duplicate requests with 409 Conflict protects the database but breaks client UX. How we evolved from defensive locking to transparent singleflight result sharing.
Read Note →
Retry Semantics
A rare gRPC error slipped past a gateway's default retry policy and got retried six times instead of one. The fix was separating deterministic domain errors from actually-transient ones.
Read Note →
Trust Anchors
JWT, TLS, HSMs, and blockchain all rest on the same cryptographic assumption. What differs is how each one defends it, and that's where they all actually fail.
Read Note →