Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
~82% of disaster-recovery setups are never tested. So I actually restored this blog cold into a throwaway container: 23MB dump in ~1s, fresh DB up in ~12s, restore in 3s, verified 47 articles back. The real lesson wasn't the sub-minute RTO — it was that the dump doesn't contain the secrets and config that actually make the site run.
PHP's own JIT authors admitted it barely helps real apps like WordPress — ~3.5%. Here's why: a Drupal page is I/O-bound, and Amdahl's law caps what JIT can ever do to ~11% even if it made the CPU work infinitely fast. What actually speeds a site up instead (OPcache, preloading, a real cache backend), and the CPU-bound cases where JIT genuinely earns its keep.
A peer-reviewed study found regex tied an LLM on accuracy for structured extraction while running 28,000× faster. The case for AI as seasoning, not flour: route the predictable 90% to deterministic code, escalate only the fuzzy long tail to a model. A decision rule, real numbers, and the honest counterpoint (don't parse HTML with regex).
Chroma tested 18 models: accuracy falls well before the advertised limit, and semantically-similar distractors hurt more than the raw token count — models even did better on a shuffled haystack than a coherent one. Plus RULER's 'effective context' and Lost-in-the-Middle. Why curated retrieval still beats stuffing everything in the window.
A July 2026 Concordia benchmark (IssueTrojanBench) found 66.5% of malicious instructions hidden in GitHub issues bypassed every guardrail in Cursor, Claude Code and Codex — and nearly every block came from the base LLM refusing, not the agent's own safety layer. What that means if you point an agent at anything you didn't write.
Final approval landed July 20. Training on legally-acquired books was ruled fair use; acquiring pirated copies was not. But the ruling says nothing about model outputs and creates no forward license — so for a dev using Claude to write code, it changes nothing in either direction. Separating the headline from the law.
On July 22 the Drupal security team shipped ten contrib advisories — five with no fix, just 'uninstall it.' What 'unsupported' actually means (including why they all read 'Critical' regardless of real severity), why it keeps happening, and the audit I now run on my own composer.json.