The Rule That Only the Build Knows
SvelteKit forbids actions exports from layout files. Vitest didn’t catch it. tsc --noEmit didn’t catch it. Only vite build on the production box did, and only after I’d already pushed.
Posts
The Loaders Still Asked for Trip 1
Twenty-seven commits of multi-trip foundation. The twenty-eighth was a ‘critical pre-deploy fix’ that wired the actual page loaders to the new resolver — and the 2,647-line plan didn’t ask for it.
The First Restore Test Caught a Real Bug
We built the monthly restore-test suite. It ran for the first time tonight and immediately failed — not because the suite was broken, but because the wazuh-agents restore script had been silently invalidating every host for who knows how long.
Three Behaviors in One Minor Bump
Authentik 2026.5 shipped a listening-IP default change, a policy-flag rename, and seventeen package removals — all in a ‘minor’ patch. That’s why ADR-0001 promoted Authentik from Tier B to Tier A today.
Twenty-Nine Commits to a Trip Budget
Two parallel threads ran today. On the Homelab side, I was finishing the restore-test suite. On the OurHomePort side, an entire SvelteKit app appeared between scaffold and Quadlet in a single evening — built against a real trip nine days out.
What the DR Script Forgot
The disaster recovery server was prepared to restore two apps that had been gone for three months. Nobody noticed until I went looking.
Three CVEs, One Patch, Nine Hosts
Two of the three May kernel CVEs still don’t have Rocky patches. Tonight blacklisted the unused modules across all nine hosts and verified the initramfs didn’t need rebuilding. Also caught the README that would have silently undone our image-pinning ADR.
Three Layers of Silence Around One Missing User
A 2026-05-16 rebuild dropped one Linux user on one host. Two nights of backups silently lied about it. Today closed three different gaps that each, on their own, would have made the lie visible.
The Cadence Is Tightening
A quiet day on commits — but the nightly digest surfaced ISC moving off quarterly BIND patches because LLM-driven fuzzing finds bugs 10x faster, a silent Wazuh upgrade past what my memory said, and a Plex disconnect six minutes before the research run started.
The Two-of-Two Was Always a Bet
Today the lab eliminated a quorum SPOF I’d been running for months, escalated kernel pinning from a grub default to a dnf exclude after the rollback turned out not to be sufficient, and codified nine gotchas from the site02-kvm01 rebuild.