Engineering

Building DropReady: Drop Scheduling and a Bug That Was Always There (Week 6)

The biggest and riskiest change in this series so far - the first one to touch the admit worker itself. Along the way I found a dormant bug that had been sitting in the code since day one, waiting for a long enough pause to surface.

29.09.2026

Building DropReady: Next-Drop Signup, Not Pre-Drop Capture (Week 5)

I wanted a signup form that runs before the queue even opens. Exploring the codebase showed that was a much bigger project than it looked - and that a simpler version solves the same business problem without a new integration surface.

22.09.2026

Building DropReady: Self-Hosted Proof-of-Work Against Queue Bots (Week 4)

X-Queue-User was a random UUID the backend trusted unconditionally - zero bot protection. This week: self-hosted proof-of-work instead of a third-party CAPTCHA, and a fail-open bug that nearly reopened the door.

17.09.2026

Building DropReady: Early Intercept and Ed25519 Token Verification (Week 2)

A real client ran an adversarial code review on our integration and caught a bug blocking 100% of traffic, plus an architectural flaw in the heartbeat. How we fixed it, and why Ed25519 over HMAC or RSA.

28.07.2026

Building DropReady: Adaptive Polling vs WebSockets - Why We Chose Differently (Week 1)

WebSocket is a great technology - just not for every use case. We show why a WebSocket-based virtual waiting room is architecturally fragile at scale, how Adaptive Polling with Jitter works, and why a Circuit Breaker matters more than HTTP 500 when KeyDB hiccups.

21.07.2026