Notes
Field notes on building sites that actually perform.
Practical writing on speed, conversion, and turning traffic into real inquiries — the same thinking that goes into every project I ship.
A quarter of your customers are invisible to your analytics — and it’s not their fault
This isn’t about tracking people who told you not to. It’s about the growing share of visitors whose browsers block your analytics before you ever get the chance to ask. Here’s what’s actually happening, how first-party server-side tracking fixes the technical half of the problem, and what it doesn’t pretend to fix.
Read the noteProduct notes
The same URL, two different answers: building a storefront an AI agent can actually shop
Ask an AI assistant to find you a product like the one you’re describing, and most stores can’t answer — not because the product isn’t there, but because the page was only ever written for a human. Here’s what it actually means to be agent-ready, and the honest reasons it’s worth building now instead of waiting.
August 6, 2026Performance
The kitchen and the menu: why fast and accurate stopped being a tradeoff
Every storefront used to force the same bad choice: pre-built and instant with stale prices, or accurate and live with a spinner. Here’s the architecture that ends the tradeoff — and the real, cited numbers on why the milliseconds were never a vanity metric in the first place.
August 6, 2026Reliability
The empty account that loaded forever
Green builds, passing health checks, every API returning 200 — and the first person to sign up got a loading skeleton that never resolved. The cause was an empty list that no screen had been designed to render.
August 6, 2026Reliability
The API said 200 OK. Three times, nothing had happened.
A value I could write but never read back, a PATCH that returned success and quietly persisted nothing, and a login test that could only pass by defeating the security control I had just installed. Three ways a success response lied during one production deploy.
August 6, 2026The security emails had never sent once, and nothing anywhere complained
A shared internal service sends the “we noticed a new sign-in” emails for several apps, and it verifies a signature on every request — against a list of secrets that turned out to be empty. Every send had been failing since the day the feature shipped, and because that call is fire-and-forget by design, nothing ever said so.
August 6, 2026Security
I turned on a captcha for one login screen. Two apps I never touched stopped letting anyone in.
Adding bot protection to a customer portal looked like a one-app change: a widget, a token, a switch. Minutes later staff couldn’t reach the admin console and the mobile app’s login was dead too. The switch wasn’t per-app — and that’s the part worth understanding before you flip one.
August 6, 2026Reliability
Your deploy checklist is a hypothesis, not a fact
I brought a battle-tested deploy checklist to a repo that was shaped differently underneath. Three times in one session it asked me to build something the app already did another way. Then the deploy went out clean and broke twice in an hour — and a HAR file turned both investigations into two-minute fixes.
August 6, 2026Product notes
The generated code isn’t the asset. The two files it imports are.
Generating a typed API client from an OpenAPI spec is a solved problem — until you have a dozen of them and half have rotted into folders nobody dares regenerate. What separated the durable ones wasn’t the tool or its config. It was two decisions about everything around the generated code.
August 6, 2026Reliability
I Almost Shipped a Production Outage Twice — Because the Dashboard Said Everything Was Fine
Every deploy tool on the market will tell you “Ready,” “Healthy,” “Success.” During one production rollout, all three were true and the site was still broken or serving stale code — twice, for two unrelated reasons. Here’s the verification discipline that actually catches what a green dashboard can’t, and why I run it on every deploy, not just the ones that go wrong.
August 5, 2026Security
The bug report cited a fix. The fix was for a different bug.
A detailed security report landed on one of my own systems, complete with a specific commit as proof this exact class of bug had already been caught once before. The commit was real. It fixed something else entirely. Here’s what checking the citation — instead of just the argument — turned up.
August 2, 2026Security
I stopped trusting my own review, so I made two AI agents argue about it
The agent that writes a fix is the worst-positioned reviewer of that fix — it already believes the design is right, or it wouldn’t have built it that way. Here’s what changed when I stopped asking one agent to check its own work, and started asking a second one to try to break it instead.
August 2, 2026Reliability
It wasn’t DNS — but everyone had already decided it was
The site went down hours after a DNS change, so the DNS change was obviously the cause. It wasn’t. Here’s the detail that ruled it out in thirty seconds, and the two cheap decisions that actually caused the outage.
August 1, 2026Reliability
The 200 OK that means “page not found”
Your error page can look perfect and still be lying to Google about whether it exists. A tour of the bugs that pass every automated check and only show up in a real browser.
August 1, 2026Security
What your software is allowed to know about you
Most tools “collect usage data.” Almost none of them tell you where the line is. Here’s the written contract I hold my own software to — the exact list of what may be sent, and what must be rejected.
August 1, 2026Reliability
A green deploy is not a working site
A quarter of my own site was returning server errors while every build was green and every deploy said “Ready.” Here’s the failure class that no build step can catch, and the check that now runs after every release.
August 1, 2026Product notes
CrewlineOS: the job shouldn’t be typed in four times
A booking becomes a quote becomes a job becomes an invoice — and at every hand-off, money and scope leak. CrewlineOS is the field-service system I built around removing those hand-offs.
July 31, 2026Product notes
RooflineOS: a season is the unit of work
Holiday lighting isn’t a business with an even year — it’s ten weeks of chaos wrapped in ten months of everything else. Most contractor software models a month. This one models the season.
July 30, 2026Security
Permission bugs don’t throw errors. They just leak.
A crash tells you something broke. A broken permission check quietly returns someone else’s data with a 200 OK. Here’s what a hard audit of my own platform turned up, and the rule that closed all of it.
July 29, 2026Security
One login for every app you own
Five products meant five sets of credentials, five password resets, and five places to forget to revoke access. Consolidating them behind one branded sign-in changed the support load more than any feature did.
July 28, 2026Why your confirmation emails land in spam
The booking confirmation your customer never got is not a mail setting — it’s missing infrastructure. Here’s what has to be in place before a mailbox provider will trust mail from your domain.
July 27, 2026Lead generation
Where do your customers actually come from?
If you can’t tell which channel produced your last ten inquiries, you’re guessing with your marketing budget. Here’s how attribution turns guesswork into decisions.
February 24, 2026Conversion
The anatomy of a page that converts
A beautiful site that doesn’t turn visitors into customers is just expensive decoration. Here’s the structure I use to design pages around a single, clear action.
February 3, 2026Performance
Speed is a feature: why every 100ms costs you customers
Performance isn’t a technical vanity metric — it’s the first impression, the conversion lever, and the SEO signal most sites quietly fail. Here’s how I think about making sites genuinely fast.
January 14, 2026Let’s talk
Have a project, or a product that could work harder?
Most projects begin with a short, no-pressure discovery call.