Five things that were each one line of wrong and are cheap to hold shut.
Turnstile failed OPEN. `lib/turnstile.ts` returned true whenever
TURNSTILE_SECRET_KEY was unset, and logged the visitor's token while doing it.
Lose that variable in a deploy and the contact form quietly stops checking
anything, the only trace a warning nobody reads. Missing configuration is now a
refusal; the dev bypass survives as an explicit TURNSTILE_DEV_BYPASS=1 that a
production build ignores, rather than as a side effect of an empty variable. The
caller now distinguishes "you failed the check" from "we cannot run the check",
because telling a real visitor to refresh, when the server has no key, sends them
round a loop that cannot succeed.
The social card was being dropped by the pages that cared enough to write their
own. Next merges metadata shallowly, so a page exporting `openGraph: { title,
description }` replaces the parent's whole block, image included. Seventeen pages
did that; five had an opengraph-image.tsx to fall back on and twelve shared as a
bare grey rectangle. `pageMetadata()` takes the parts that differ and fills in
the parts that must not go missing. Built output goes from 23/51 pages carrying
og:image and 12/51 carrying twitter:image to 51/51 on both. Canonical was already
51/51 and stays there.
The sitemap was a hand-kept list and had drifted nine routes behind the site,
among them /products/{vegan-iq,suchoice,bauhaus-echo,such-moon-launch}/privacy,
which Apple and Google fetch during store review. It now walks the route tree, so
a page is advertised because it exists. Dynamic segments still come from their
data (blog posts, service pillars), and /contact is excluded WITH its reason: it
redirects, and a sitemap should name the destination rather than the door.
Result: 37 static routes, up from 28, nothing removed.
`vegan-iq-data-pipeline.mdx` was `draft: true`, which kept the most substantial
post on the site out of the index, the sitemap and generateStaticParams.
And /contact was unreachable on a first visit. It redirects to /#contact, but the
splash owns the first screen and entering it pins scroll to 0, so every inbound
contact link played the intro and dropped the visitor at the top of the homepage
with the hash discarded. A fragment that names something real on the page now
skips the splash and is honoured once, on arrival.
Verified: pnpm build green, lint clean (8 pre-existing no-img-element warnings,
none from this change), og/twitter/canonical counted in the built HTML.
Title takes "Our" instead of "My", and the body follows it: fifteen instances of
first-person singular are now plural. The second "Our" in the title became "the"
to avoid the doubling.
Swept the same judgment language out of it. "I like it", "the obvious thing",
"The obvious suspect", "First gotcha worth knowing", "What I would actually tell
you", "Why I care about the boring version". A report states what happened and
lets the reader rank it. Kept the honest method reporting ("we got it wrong
twice"), which is evidence rather than editorial.
Swept the other posts too and deliberately changed nothing in them.
such-moon-launch-release uses "I" for a real authorship claim, "the very first
game I ever wrote", which becomes false as "we". The two hits in
vegan-iq-data-pipeline are an idiom and a quoted hypothetical. Site copy under
src/ came back clean.
NEW UPDATE. The post described a splash that no longer exists, so it now carries
the replacement and what measuring it turned up.
The pillar signature replaced the Cherenkov splash. Making it advance on its own
surfaced a defect that had been shipping: CLS 0 to 1.0, caused not by the new
animation but by the splash having always been a min-h-[100svh] block in document
flow that only became fixed on the way out. CLS excuses shifts within 500ms of
input, so clickers never contributed it and the headline 100 was accurate only
for them. Reduced-motion and returning-session visitors, who never click, scored
74 with CLS 1.0 against production.
Numbers are measured, not recalled: mobile 97 (LCP 1.2s, CLS 0.013, TBT 20ms),
desktop 98 (LCP 1.0s, CLS 0.005, TBT 0ms), run against production this week. The
reduced-motion path is 98 where it was 74.
TABLES. next-mdx-remote had no remark plugins, so GFM tables rendered as literal
pipe characters in a paragraph. Four published posts were affected, not just the
new one: bauhaus-echo-launch, flutter-3d-physics-dice, vegan-iq-data-pipeline
and smirk-v0-3-0. remark-gfm is now wired into MDXRemote's mdxOptions.
BACKTICKS. @tailwindcss/typography wraps every inline <code> in literal backtick
characters via code::before / code::after. The served HTML was already clean;
the marks were injected by CSS. Monospace already marks code as code, so the
backticks were a redundant second marker that reads as a typo in running prose.
Suppressed across .prose.
TRANSPORT. The previous version's "transports" section covered only Grin slate
channels. Tor is a separate mechanism and was undocumented: the wallet accepts a
.onion backend origin over plain http, alongside private ranges and .local,
because onion services carry their own transport authentication and no CA issues
for them. The onion pattern matches the label immediately before .onion, so an
onion-lookalike public host is refused. On the backend, the admin plane binds to
loopback and TOR_ADMIN_ONION adds exactly one onion host to its Host allowlist
as a DNS-rebinding guard.
There is no bundled Tor daemon and no I2P support anywhere in either repo. The
post now says so rather than leaving it implied.
COPY. Removed the editorial voice throughout: no more "the part worth
explaining", "the instructive one", "worth dwelling on". A technical report
states what a thing does and lets the reader decide what matters. Headings are
now descriptive rather than argumentative.
Rewritten as a technical report on what v0.3.0 does, written as released rather
than pending. Cut the "working notes" framing and the narrative voice.
Three inline SVG diagrams carry the parts that are awkward in prose:
- Federation: two wallets on two independent backends, each delegating to its
own chain nodes, with the Nostr relay layer joining the WALLETS rather than
routing through a backend. The first draft drew that line from a wallet to a
backend, which quietly asserted the opposite of the point.
- Signing tiers: signEvent routed by kind into money / session-grantable /
default, with the actual kind numbers.
- Slate transports: the three Grin transports with their discovery keys, and
which are federated versus same-instance.
They are inline SVG rather than images: text stays selectable and translatable,
they scale without artefacts, and structure drawn in currentColor inherits the
prose colour so both themes are correct by construction. Verified rendered in
light and dark rather than assumed. Accent colours are mid-tones chosen to read
on both grounds. Every figure carries role="img" and an aria-label describing
what it shows.
Sourced from the repos: docs/grin.md for the transport table and discovery
rules, packages/dapp-api/src/nostr-tiers.ts for the kinds, CHANGELOG.md and
smirk-backend-core's README for the rest.
Written as working notes from the release window rather than an announcement,
and framed as forthcoming: v0.3.0 is cut and in store review, not on anyone's
machine, so the post says so instead of implying availability.
Built around the design decision rather than the feature list. The interesting
part of the Nostr work is not that there is a NIP-07 provider, it is that a
signature is a bearer credential and so "remember this site" is a security
decision. Hence the three event-kind tiers, and specifically why NIP-98 (27235)
had to move to money-tier: the backend mints a full session from one, so leaving
it session-grantable let a connected site collect an auth token for the user's
own backend under a permission granted for social posts. Enforcement sits in the
wallet handler rather than the approval dialog, so the rule survives a hostile
UI.
Then the federation half, which is what makes smirk-backend-core worth writing
about: the wallet no longer assumes api.smirk.cash, which is only a real claim
if there is something to point it at.
Sourced from the repos, not from a summary: CHANGELOG.md, the tier table in
packages/dapp-api/src/nostr-tiers.ts, and smirk-backend-core's README. Both
linked repos verified public before publishing.
981 words, about a third shorter than the post it follows.
The linter had two faults stacked on top of each other.
First, the global `ajv: ^8.17.1` override starved @eslint/eslintrc, which
needs ajv 6 and passes it `missingRefs`; ajv 8 rejects that option, so ESLint
died before loading a single rule. Scoped overrides give eslint and
@eslint/eslintrc ajv 6.12.6 and leave the audit override in place everywhere
else.
Second, underneath that, `extends: ["@repo/config/eslint-preset.js"]` could
never resolve: ESLint's shareable-config naming convention rewrites it to
`@repo/eslint-config-config/...`. require.resolve hands ESLint a real path.
With the linter running it reported 35 react/no-unescaped-entities errors
across 7 files. Those are escaped rather than silenced, using ESLint's own
coordinates so only flagged text nodes were touched. Lint now exits 0. Two
@next/next/no-img-element warnings remain on the splash logos, which are
deliberate: theme-paired and fetchPriority="high".
Em dashes are also gone from the six blog posts and the README (105
occurrences), same rules as the site copy: colons for definition labels,
commas for appositives, semicolons for independent clauses.
- bento-grid: the Occupy Wallets tile is height-constrained (object-contain)
to ~240px wide, but sizes='33vw' made Next serve a 750w file into a 241px
slot (~62 KiB waste). Cap the sizes hint to the real display size.
- blog: add the 'a month later' chapter to the animated-hero post — the
Turnstile 450KB below-the-fold weight, deferred, mobile 75 -> 93 / desktop 99.
- Monitor terminal: ~4 blinks, type 'such', backspace, ~4 blinks, fade.
- Rewrite the blog post so it tells the accurate story end to end (not an update):
the LCP breakdown showed render delay with TTFB 0 and a free main thread, so it
was neither the network nor JavaScript. It was render-blocking CSS, fixed by
inlining the stylesheet. Server components / dropping framer are kept as honest
supporting steps, not the gate. Swap the architecture figure for a CSS
critical-path figure; mobile now a steady 100.
- New post 'My Animated Splash Was Tanking Our Mobile PageSpeed Score' (draft:false):
the LCP investigation, the data-URI diagnostic, and the real fix (shrink the
use-client boundary / server-render the static parts). Two SVG diagrams.
- Such Moon Launch now live on iOS: App Store link wired on the apps and product
pages.
- Splash is now a one-time intro per session: once entered (scroll or click) a
refresh skips it, so you can't scroll back up into it mid-page.
- Preload the splash logo <img> (the mobile LCP element) at high priority.
- Draft blog post on keeping an animated hero without tanking Core Web Vitals
(draft: true, for review).
- New /products/wownerogue page (SEO metadata + VideoGame JSON-LD) and
wownerogue-launch blog post covering the fairness, block-timing, and payout design.
- Drop the retired r/CryptoCurrency and MoonPlace references from the portfolio grid,
products index, and custom-websites page; feature Wownerogue + Neroswap instead.
- Add WownerogueLinks component (live instances + GitHub source) and wire it into MDX.
- Remove now-orphaned r-cryptocurrency and moonplace images; add product page to sitemap.
Build was failing because the new MDX post tried to `import` the
SuchMoonLaunchStoreButtons component — next-mdx-remote/rsc doesn't
support imports inside .mdx; components must be passed via the
`components` prop. Wire the helper into [slug]/page.tsx and drop the
import line from the .mdx.
Dependency bumps to clear the 14 outstanding Dependabot advisories
(9 high, 4 moderate, 1 low):
- apps/web/next: ^15.5.15 → ^15.5.18 (covers 12 next.js advisories)
- pnpm overrides: pin postcss ^8.5.14 (clears 1117015 XSS via </style>)
- pnpm overrides: pin fast-uri ^3.1.2 (clears 1117870 + 1117884 path
traversal / host confusion)
pnpm audit: 14 vulnerabilities → 0.
Visible-name rebrand for the game ahead of Play Store + App Store launch.
The Wownero theme stays in the game itself; this is purely about the
product name.
- Rename slug: /products/wownero-moon-launch → /products/such-moon-launch
- Rename blog post file + flip from draft → published with rewritten
origin story (first game ever → Tabby Labs test app → full rebuild
with tilt-to-steer controls + 11 levels)
- New "The Story" section on the product page
- StoreButtons: accept null href to render disabled "Coming Soon"
buttons; add SuchMoonLaunchStoreButtons preset (Google + Apple null
pending review, web link present, itch removed — no itch page exists)
- Add Such Moon Launch entry to /apps with coming-soon store buttons
- Bump privacy + terms last-updated dates to May 18, 2026
- Theme color: orange → amber to match the new brand palette
- Sweep all remaining "Wownero Moon Launch" / "wownero-moon-launch"
references in product listing, sitemap, top-level privacy index, and
website-relaunch blog post
Product page: added Dice Roll and Decision Duel to features grid (now
6 features), updated meta description and hero text, broadened Snap &
Decide description to include ingredients/labels.
Blog post: published 3D Physics in Flutter article covering three_js +
cannon_physics integration, framebuffer cache bug, quaternion convention
issue, vertex clustering for face detection, and settle mechanics.
- update site title and meta to Precision Engineering for Everyone
- footer and about: full-service software provider → software studio
- schema.org structured data aligned with new meta description
- clarify revenue-share model in services preview
- remove placeholder App Store links for Wownero Moon Launch
- add OpenGraph tags to all product, blog, and support pages
- fix About page OG description to match meta description
- Add sitemap.xml and robots.txt (such.software-site)
- Fix blog date on neroswap post (2025→2026)
- Filter draft posts from generateStaticParams and getPost
- Fix stale product list in website-relaunch blog post
- Fix Godot version (4.6→4)
- Add cross-links: product pages→blog posts, blog posts→product pages
- Add OG/Twitter metadata to blog [slug] pages
- Fix Bauhaus Echo privacy: hover color (emerald→blue), contact URL
- Fix Suchoice: card styling (p-6→glass-card), font-semibold→font-bold
- Fix products listing meta to include Suchoice
- Product page at /products/neroswap with exchange descriptions, features, and architecture
- Blog post at /blog/neroswap-aggregator explaining the data pipeline and privacy design
- Added to products listing (first position, yellow color)
- Added to bento grid portfolio section
- Links to neroswap.com throughout
- SEO metadata with keywords, canonical URLs, Open Graph
- Add gray-matter + next-mdx-remote for MDX rendering
- Create content/blog/ with .mdx files and frontmatter
- Add dynamic [slug] route and blog utility (src/lib/blog.ts)
- Blog index auto-populates from MDX files, sorted newest first
- Upgrade React to 19 for next-mdx-remote v6 compatibility
- Convert existing posts: website-relaunch, smirk-wallet, bauhaus-echo, crypto-checkout
jwinterm