https://synthocore.ca/engineering/ Writing on how calculations are made, checked, and reviewed. Methodology, not product — each piece is something you can apply with a spreadsheet and a pencil. en Mon, 07 Sep 2026 00:00:00 +0000 https://synthocore.ca/engineering/merged-is-not-served/ https://synthocore.ca/engineering/merged-is-not-served/ Mon, 07 Sep 2026 00:00:00 +0000 A merged change, a deployed change, and a served change are three separate observations, not one. A green pipeline, a resolving hostname, and an HTTP 200 each prove their own small thing — and none of them proves your content is in front of a user. The only verification is fetching the served page as a user would. https://synthocore.ca/engineering/cheapest-decisive-experiment/ https://synthocore.ca/engineering/cheapest-decisive-experiment/ Fri, 04 Sep 2026 00:00:00 +0000 When two explanations both fit a defect, rank candidate experiments by cost-to-decisiveness, not by how confident you feel. A decisive experiment splits the hypothesis space no matter which way it lands — and the confirmation run never does. https://synthocore.ca/engineering/two-accounts-or-it-didnt-happen/ https://synthocore.ca/engineering/two-accounts-or-it-didnt-happen/ Thu, 03 Sep 2026 00:00:00 +0000 A single-account test shows a subject sees its own data — never that another cannot see it. Isolation is a claim about the boundary between two subjects, so proving it takes two: open two independent subjects and assert one cannot observe the other. https://synthocore.ca/engineering/a-gate-that-never-failed/ https://synthocore.ca/engineering/a-gate-that-never-failed/ Tue, 01 Sep 2026 00:00:00 +0000 A check that has always passed may be structurally unable to fail. The negative-control principle: a passing gate carries no information until it has been seen to fail on a deliberately broken input — and why fixtures should assert sentinels, never the real prohibited string. https://synthocore.ca/engineering/fail-closed-sign-in-door/ https://synthocore.ca/engineering/fail-closed-sign-in-door/ Sun, 30 Aug 2026 00:00:00 +0000 A sign-in door should deny when it is unsure, not permit. The engineering case for deny-if-absent config, empty allowlists that refuse everyone, separating signed-in from entitled, and error pages that stay quiet while logs stay loud. https://synthocore.ca/engineering/opaque-sessions-vs-jwts/ https://synthocore.ca/engineering/opaque-sessions-vs-jwts/ Sun, 30 Aug 2026 00:00:00 +0000 Self-contained tokens are fast to verify but hard to revoke. For a family of products under one domain, opaque session handles plus RFC 7662 introspection make logout mean something. A walk through the trade-off. https://synthocore.ca/engineering/choosing-storage-on-the-edge/ https://synthocore.ca/engineering/choosing-storage-on-the-edge/ Sun, 30 Aug 2026 00:00:00 +0000 Edge key-value stores are eventually consistent; edge SQL is strongly consistent. Matching the store to the data's consistency need — and why single-use auth transaction state is the trap case. https://synthocore.ca/engineering/what-makes-a-calculation-checkable/ https://synthocore.ca/engineering/what-makes-a-calculation-checkable/ Wed, 26 Aug 2026 00:00:00 +0000 A reviewer either checks a calculation or trusts it. The difference is a property of the document. Here is the test, with worked examples of an uncheckable calculation and the same one made checkable.