Refusing the write is cheaper than recovering the work
Untracked files on a protected branch exist in one place, so a later branch switch deletes them with no error and nothing to recover. Refuse at write time.
Shipping
Stores, signing, provisioning, CI — the archaeology between "it builds" and "it is live".
27 posts
Forty-five minutes per CI guess is not a feedback loop
Reproducing a failing CI job locally turns a 45-minute guess into a 2-minute iteration. What runs locally, what cannot, and why faking the rest is worse.
A release is phases, not a button
Collapsing a release into one command removes the only place a person could stop it. Separate the mechanical phases from the single judgement about timing.
Your sitemap ping has a daily budget
Search submission APIs meter per day. Submit only what changed, and when the quota runs out, name the URLs that were dropped instead of passing green.
Two prefixes decide who owns a credential
Whether a credential is organisation-wide or per-app has to be visible in its name, because the name is what every manifest and resolver decides from.
Signing state has exactly one owner, or it has none
Certificates, profiles and keychain state get asserted by one flow or by nobody — and a second writer stays invisible until the next build needs to sign.
Screenshots are a build artifact, not a design deliverable
Store screenshots hand-exported once become a set nobody updates. Treat them as generated output with a source, a matrix and a regeneration step.
The placeholder listing that almost went live
A template store listing reaches production unless promoting the real one is a human gate that refuses. Why the failure is silent and what has to block on it.
The submodule pointer you accidentally reverted
Staging everything rolls a submodule pointer backwards, and the diff shows two hashes with no ordering. The one guard it needs is an ancestry test.
Fixing it only in your app is how the template keeps the bug
A fix to a template-derived file is correct locally and leaves the defect in the template and every sibling project. Classify by provenance at edit time.
The command that leaked a secret was not on the list
A rule naming forbidden commands cannot hold, because any program that reads bytes can emit them. Enforcing a property of output needs an allowlist.
A documented workflow nothing could execute
A guard blocked the one step a documented runbook required. The fix was not a weaker guard, it was building the sanctioned command it was asking for.