Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
The Craft 6 alpha ships built-in Model Context Protocol servers that let an AI inspect and edit content, the content model and project config. The interesting part isn't the AI — it's the permissions design: OAuth 2.1, an explicit 'Use Craft MCP' permission, public access off by default, and writes that land as drafts.
An eager-loaded Matrix relation with orderBy and limit:1 returned the wrong row and said nothing. The fix adds an allowlist of 'safe' sort forms — the fingerprint of a security fix, because the same criteria-cleansing path produced two High-severity advisories this autumn.
The Claude Haiku 5.5 discount is real but smaller than the headline: a 30% tokenizer tax and a two-tier price mean most real coding subagents land in the 1.5x tier, not the 10x one. Route by prompt size, not by the banner.
Five security-bearing Traefik patch releases between 31 Jul and 6 Oct 2026, all sharing one bug class: the proxy and the backend parse the same request differently. Why that's an argument for app-level authorization.
PHP 8.6 turns on strict mode, httponly and SameSite=Lax by default. For a Drupal box that's a non-event for web traffic — Drupal forces all three. The real exposure is CLI scripts and SSO flows. Test, don't assume.
A Drupal dev's honest audit of Craft's out-of-the-box editor experience — first-class drafts and live preview that out-polish Drupal, parity on transforms and exports, and the one real gap: no approval workflow.
Between 23 Sep and 7 Oct 2026, four Drupal contrib modules got advisories for the same bug class — user strings evaluated as Twig. Plus the 14 Oct core release window, and the fifteen-minute audit I ran on my own VPS.