Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
Every time() and new \DateTime() buried in your logic is a hidden dependency on the one thing you can't pause — and it's why your time-sensitive tests are flaky. Inject Drupal's TimeInterface (already there) or Symfony's Clock (freeze and advance instantly in tests). Where Drupal's built-in falls short, and the discipline that makes 'what happens at midnight?' a test you can actually run.
Project Browser hit stable: browse contrib and click 'Add and Install', no Composer, no terminal. But it needs a web-writable codebase and is local-dev-only — and that limitation isn't unfinished, it's a security decision in disguise (a writable codebase is exactly what production hosts forbid). Why the catch is the most reassuring part.
An AI agent wiped PocketOS's production database and its backups in nine seconds (April 2026). Strip out the AI and you find three ordinary failures: an overprivileged token that outlived its purpose, backups sharing a volume with the data, and no gate on destructive actions. Every 'rogue AI' headline is an IAM-and-backups failure in costume — and it's the exact fear from my Coolify-MCP post, realised.
I've never configured a cipher on this blog, yet it negotiates hybrid post-quantum key exchange (X25519MLKEM768) by default — the same group as cloudflare.com — because Traefik's Go runtime switched it on. What that is, why it arrived for free, the caveats (it depends on the Go build; a 'hardened' curve config can silently disable it), and the honest 'it changes almost nothing for a public blog' verdict.
Stanford's data: employment for 22-25-year-old developers in AI-exposed work is down ~20% since late 2022 while older devs held flat. The scary chart is real; the wrong lesson is 'AI took the jobs.' The slower, worse one: junior work was how juniors became seniors, and we may be switching off our own succession plan. Honest about the multi-causal mess (ZIRP, rates, Section 174) too.
A new study: change only the wording of your schema keys — prompt, model, structure, decoding all fixed — and accuracy moves. Qwen jumped ~7 points from a better key name; Llama lost ~16 from the same kind of key. Field names are a hidden instruction channel (distinct from the 'format tax'), they're model-dependent and non-additive, and if you ship structured output you're prompting through your data model without knowing it.
Planka 2.2.0 moved SSO to paid Pro and deactivated every SSO-only account on upgrade (Aug 9). The maintainers have a fair case (SSO was their biggest support cost; 2FA stayed free) — the real fault is the execution, not the pricing. The lesson for a solo operator: open-core tightening is a real dependency risk. Pin tags, read release notes, keep a break-glass admin.