research
Research for builders.
Original research on systems, ownership, AI, and the architecture of modern business.
Ideas intended to outlast today's platforms, trends, and algorithms.
research/featured
Featured Research
Backups Only Count Once You Have Restored One: A Restore Drill You Can Run in an Afternoon
A backup you have never restored is a guess. Here is a four-hour restore drill, a checklist and a scorecard a small business can run without a technician.
Read Research →No, Your Website Isn't Finished
A new website is where the work starts. The four jobs after launch, why most sites never bring in work, and how to make yours earn its keep.
Read Research →End-of-Life Software in Plain English: How to Find Out When Your Software Stops Getting Fixes
What end of life means, where to find the dates for PHP, Node.js, WordPress and iOS, and a one-hour check of what your business runs and when support ends.
Read Research →What a Quarterly Maintenance Visit Actually Covers, and What It Catches
A quarterly maintenance visit checks runtimes, CMS and plugins, backups, certificates, DNS and accounts. Here is the checklist and what each check catches.
Read Research →Website Templates Are a Starting Point, Not a Strategy
Website templates save time and show options, but cannot supply your message. How to use one well: write content first, cut extras, and adapt the structure.
Read Research →What AI Automation Actually Changes for a Ten-Person Business
AI automation for a small business pays off in repetitive, text-heavy work with clear rules. Where it helps, where it falls short, and how to start.
Read Research →The Shortlist Is Back: Being Named When AI Answers for Your Customers
Gatekeepers didn't disappear online. They moved from editors to feeds, and now to AI answers that name two or three businesses. What a small business can do about it.
Read Research →Design Systems for Small Teams: Constraints Beat Component Libraries
A design system for a small team can be a dozen tokens and five rules. How constraints produce consistency faster than a component library, and when to grow.
Read Research →Documentation as Leverage: Runbooks and Decision Logs for Small Companies
Runbooks and decision logs keep a small company running when its founder is unavailable. What to write first, with a minimal template described in plain prose.
Read Research →Scoping Web Projects Around Outcomes, Not Hours
Scoping web projects around outcomes keeps buyers and builders aligned: define what changes for the customer, write it down together, and handle change openly.
Read Research →Local Search Visibility: Be the Clear Answer, Not Just Another Listing
Local search visibility starts with being easy to understand: clear facts, consistent details and a page that answers the question directly.
Read Research →Website Speed Is a Product Feature, Not a Technical Detail
Website speed shapes trust and abandonment before a visitor reads a word. Why pages get slow, how static delivery helps, and a performance budget for owners.
Read Research →How Small Companies Earn Trust Online Without Gimmicks
How small companies earn trust online: clear identity, real contact details, plain language, visible process and honest limits, with no fake urgency or reviews.
Read Research →The October 2026 PHP Emergency: Why Staying Current Always Costs Less
Two critical PHP flaws sent governments offline in October 2026. Sites on supported versions patched in minutes. Why steady upgrades cost less than catching up.
Read Research →The Real Cost of Rented Platforms: Page Builders, Marketplaces and Lock-In
Rented platforms look cheap at the start. This paper covers the real cost of lock-in: exit costs, fee creep, policy changes, and how to use platforms safely.
Read Research →Your Website Is a Business Asset: Why Small Businesses Should Own Their Digital Presence
A small business website is an asset, like equipment or inventory. Why owning your domain, content and data matters, and how to audit it.
Read Research →The Case for Boring Web Architecture
Static pages, a handful of edge functions, one database, and a git push. Why the least fashionable stack is the one that keeps ownership with the builder.
Read Research →Own the First Conversation
The intake form is the most undervalued asset on a business website. Why the first exchange with a prospect should be designed and owned.
Read Research →Optional Intelligence: Designing AI Features That Can Be Switched Off
The most trustworthy AI feature is one the product doesn't need. Four properties that keep intelligence useful without making it a point of failure.
Read Research →The Future Belongs to System Builders
When execution gets cheap, the advantage moves to whoever designs the system doing the executing — not whoever does the work by hand.
Read Research →research/engineering
Engineering Notes
Synthesizing a Soundtrack in Python, Timed to a Video's Cut List
Generate a soundtrack with numpy and scipy that lands on a video's cuts. We tested timing error, clipping, clicks and rounding drift, then muxed it with ffmpeg.
Read Research →An Internal Link Checker for a Static Build in 34 Lines of Node.js
A 34-line Node.js script that checks every internal link in a static site build. We ran it on 202 pages and 8,766 links, then broke the site to prove it works.
Read Research →Muxing a Soundtrack onto a Silent Video with ffmpeg: When You Need -map
Adding audio to a video with ffmpeg works without -map until the video already has a silent audio track. We tested both cases on ffmpeg 6.1.1.
Read Research →Comparing Version Strings Without a Library: A 30-Line Semver Compare, Fuzzed Against the Reference
A semver compare in 30 lines of Node.js, checked against the semver package on 200,000 random pairs, plus the cases where plain string sorting goes wrong.
Read Research →A 9:30 AM Publish Time That Survives Daylight Saving Changes
A static site that publishes at 9:30 AM New York time needs more than a fixed UTC hour. We tested an Intl-based function on every day of 2026 and 2027.
Read Research →A DST-Safe Weekday Cron in GitHub Actions: Two Schedules and a Guard
GitHub Actions cron runs in UTC only. Two schedules plus a New York time guard fire once per weekday all year. We simulated 522 weekdays.
Read Research →A Runbook for a One-Person Operation: What to Write Down First
What belongs in a runbook for a one-person operation: the few procedures worth writing down first, and why we wrote ours for someone who has forgotten everything.
Read Research →Testing a form flow that depends on bot checks and AI
What to mock, what never to mock, and the two bugs that taught us to test the browser's behavior, not just our own state.
Read Research →Managing 64 Template Thumbnails and Assets from Figma
How we keep a 64-entry template gallery consistent: one JSON file, one stable slug, WebP thumbnails exported from Figma, and checks that catch missing files.
Read Research →Rebuilding a Figma frame as a scaled canvas
A fixed-size stage, one CSS variable, and a ResizeObserver reproduce a designer's frame faithfully at any width. The technique, the font problem, and when to stop.
Read Research →Isolating Failures in a Form Pipeline: Save First, Notify Independently
How we build a form pipeline so one failing step never loses a lead: save to the database and send the email as independent steps, and fail only if both fail.
Read Research →Fuzzing an LLM JSON Extractor: What Breaks When You Parse Between the First and Last Brace
We fuzzed the common first-brace-to-last-brace JSON extractor with 99 malformed model replies and compared it to a balanced scanner. Real counts, final helper.
Read Research →Building an Accessible Mobile Menu Without a Framework
An accessible mobile menu in plain HTML, CSS, and a few lines of JavaScript: aria-expanded, Escape to close, focus return, and a no-JS fallback.
Read Research →One Config for Client and Server: A Single Source of Truth for Intake Forms
How we define a project intake form once in TypeScript so the page, the conversational interview, and the server validation can never drift apart.
Read Research →A Cloudflare Turnstile Integration Checklist for Contact Forms
A practical Cloudflare Turnstile checklist for contact forms: server-side verification, single-use tokens, widget lifecycle, test keys, and a honeypot.
Read Research →Prompting for Structured JSON and Validating the Result
How we prompt a model for structured JSON, extract it from messy output, validate every field, and fall back to non-AI behavior when the result is unusable.
Read Research →How Much Does Self-Hosting Fonts Weigh? Measuring Latin woff2 Payloads
We fetched seven Google Fonts families, kept latin, deduplicated by URL, and weighed each woff2: 16 files, 340,256 bytes. Script, table, and budget method.
Read Research →Typed Content Collections in Astro for a Research Section
How we run a research section from plain markdown files with Astro content collections, a zod schema, and a build that fails when frontmatter is wrong.
Read Research →Automating Accessibility Checks with axe-core and Playwright
How we run axe-core inside Playwright against built pages, what it caught on our own site, and why one color token fix beat 34 element fixes.
Read Research →SQLite UPSERT with RETURNING: Building an Atomic Counter You Can Trust
We ran SQLite's UPSERT with RETURNING under eight threads: read-then-write lost up to 3,500 of 4,000 increments, the single atomic statement lost none.
Read Research →D1 Migrations for a Small Product: Additive Changes and a Local-First Workflow
Our D1 migrations are numbered SQL files that only add things, applied locally first and then remotely. Why the additive rule keeps deploys forgiving.
Read Research →Reading a Security Advisory in the First Hours: Notes From the PHP Emergency
During the October 2026 PHP emergency, rumor, official notices and trackers disagreed for a day. How to tell them apart and act on what is confirmed.
Read Research →Checking Every PHP Install Against php.net in 45 Lines of Code
A small Node script that checks a list of PHP installs against php.net's release data and flags anything behind on patches or past end of life.
Read Research →WCAG Contrast Ratio in 20 Lines of Code: Auditing a Dark UI's Color Tokens
Implement the WCAG 2.x contrast ratio in nine lines of JavaScript, audit a real dark UI's text tokens, and binary-search the lightness that passes 4.5:1.
Read Research →Structuring an Astro Static Site with Cloudflare Pages Functions
How we lay out an Astro static site with Cloudflare Pages Functions: file-based routes, shared helpers, bindings in wrangler.jsonc, and secrets kept out of the repo.
Read Research →
180 Seconds, 18% Quota Burn: How to Exploit Claude Code Cloud Sessions and Evacuate to Local VS Code
A telemetry analysis of Claude Code Cloud Sessions: a 3-minute QA sprint used 18% of a Pro quota, and how to evacuate to local VS Code.
Read Research →Treating visitor text as untrusted when it reaches a model
A web form that feeds a language model has the same trust problem as any input field, with one extra twist. Six habits that keep it contained.
Read Research →Self-hosting Google Fonts without a build plugin
A short script, a modern user agent, and one dedupe rule replace a runtime dependency on a third-party font host. How we moved a 24-family site.
Read Research →Rate-limiting an AI endpoint with a single D1 table
Per-visitor and global daily budgets, enforced before the model is called, with no extra infrastructure. The design, the SQL, and why it fails closed.
Read Research →Agents that fail loudly: designing AI workflows for the bad day
Autonomous systems earn trust by how they behave when something goes wrong. Notes on escalation design and confidence thresholds.
Read Research →MCP in production: wiring business systems to language models
Model Context Protocol moved integration work from custom glue code to a standard interface. Field notes from connecting real business tools to AI systems.
Read Research →The solo stack: shipping production software as a team of one
AI-accelerated development collapsed the team size a real product requires. What that changes about architecture choices, and what it doesn't.
Read Research →