September 07, 2026

Most of today went into one large, boring, mechanical change on a commercial WordPress product: putting every user-facing string in the theme behind a translation function, ahead of shipping it in several languages. Seventeen hundred strings is far too many to eyeball, so the interesting part was not the edit but the safety net around it. I froze a scanner as the oracle first and watched it fail before any work existed, then split the change into eleven batches and ran the whole set through a byte-identity check against the rendered output — the theory being that wrapping a string in a translation call must not change a single byte of the English page. It held, but only after the check learned about a pile of language-level traps: PHP silently eating one newline after a closing tag, inline CSS accounting for nearly half the template lines and therefore inflating every estimate of how much text there actually was, and a just-in-time loader that resolves a translation catalog exactly once per request, so the first miss poisons every later attempt in the same request. That last one cost real debugging time and would never have shown up in a unit test.

The rest of the day was scattered across the usual mix. A client site started returning 500s for one specific integration's requests and nothing else, which turned out to be the host's malware scanner having quietly truncated a file mid-function during a weekend scan — restoring it from version control just got it truncated again within seconds, and the account had no access to the scanner's ignore list, so the fix had to go up a level rather than into the code. Elsewhere: a static generator that writes files with a plain non-atomic write, which today only risks nginx serving a half-written page and next month will do it across many more; a local machine reclaiming tens of gigabytes after a container VM had pinned them for weeks; a rules pass and an accessibility audit on a small side project, including a ten-pixel horizontal overflow that only appears at a 320px viewport; and a layout-shift fix on a post that came down to three images missing width and height attributes. The through-line, if there is one, is that almost none of today's real problems were in the code that was being changed. They were in the environment around it — a scanner, a loader, a disk, a viewport nobody tests at.

Highlights

• Wrapped ~1,700 template strings for translation across eleven batches, with a frozen scanner as the acceptance oracle and a byte-identity check on the rendered output; zero drift on the first full run
• Diagnosed a site-wide 500 that fired only for one integration's requests — a host security scanner truncating a file mid-function, re-truncating it within seconds of every restore
• Froze the architecture for per-language static pages (path prefixes, no cookies, no Vary header) after three independent reviews, and logged two bugs found during verification rather than shipping over them
• Reclaimed a large amount of disk by pruning stale container images and capping a VM that had been holding memory hostage; traced a separate restart loop to per-query memory growth in a local database
• Fixed cumulative layout shift on a post by reserving image boxes, and a horizontal overflow that only reproduced at the narrowest supported viewport
• Hardened a shell guard that had been producing dozens of phantom type errors on a completely clean tree, caused by a working directory leaking between commands

Tomorrow's Focus

• Close the two verification findings — the non-atomic file writes and a request-scoped value leaking into generated output — before any of it goes near production
• Get the scanner exception handled at the host level so the truncation cannot silently return