How this site is built

The network behind this site

Other systems run behind or beside this site, and some packages are shared with my other sites. None is in this repository.

Capsid is the site's memory and job queue. It stores decisions and current state, and hands work from a conversation to a working session as a signed job that ends in a pull request.

A small admin server lets me run the site from a chat, covering the registry, citations and lab procedures. It cannot write or publish posts. Carrel does that.

• Carrel is my private writing hub, behind a login, where articles are written before publication. A finished article reaches this site through a small keyed API.

• Capsid's source is public; read about it on its page.

• Capsomer is the shared design system: color tokens, header, footer and components, in plain CSS.

• Prelum turns markdown into pages, feeds, sitemaps, search records, llms.txt and each page's structured data.

• site-runtime supplies security headers, the rate limiter, the health report, responsive images, sign-in and the edge page cache.

• site-api is the contract Carrel uses to list, edit and publish this site's content.

• d1-dump backs up each table of the database to the site's own storage and restores it. The database's own export cannot handle tables with full-text search.

• Enarratio renders charts on the server, each with a text alternative and a data table.

• devkit holds the shared test workflows, the dependency update rules and the check that fails on a copy of code a shared package already provides.

What the site does

Each entry names an anchor, and a gate checks that the anchor still exists. The gate does not check that the sentence is true.

44 entries. What the whole network does is on the features page.

• Content pipeline

  D1 holds the source, and every read comes from it

  D1's source_files table holds every file a save writes, keyed by repository path, and source_revisions holds each version. The repository copies are the seed and CI's test corpus. A deploy pulls D1's files over the checkout, builds from them and restores the checkout. Each rendered row records the blob sha of its source and a hash of its own render, so a ship compares both against a fresh build before writing and names every row that has drifted. A row whose source is unchanged but whose render differs fails the run after the deploy stands, because that is a pipeline defect, not staleness.

  • route /writing
  • gate check:content

• Content pipeline

  One renderer, two writers

  The build scripts and the Worker import the same markdown pipeline module. There is deliberately no second renderer, because both writers render the same source independently, the Worker on every save and the build on every ship, and a difference between the two is invisible until something compares them.

  • route /writing/:slug
  • gate check:content

• Content pipeline

  Every post has a markdown twin

  The same URL with .md appended returns the source the page was rendered from. Requesting the post with an Accept: text/markdown header returns the same bytes.

  • route /writing/:slug.md
  • gate check:machine-readable

• Writing

  Posts are written in Carrel, through one save

  The admin has no post editor. Carrel writes posts through /api/carrel/v1, and the operator API calls the same save. A save validates the frontmatter, writes the file and its revision in one D1 batch, renders the rows and purges the cache by tag. Ask is updated last and cannot fail the save. The save names the blob sha it loaded, and a file changed since is refused, with the same check inside the batch.

  • assertion in check:worker: answers the key on its prefix
  • gate check:policy

• Writing

  Each caller has a fixed set of capabilities

  One table in the publish policy lists what each caller may do. The admin may do everything. An operator may write but not publish a post for the first time or delete one. Carrel may write and publish for the first time but not delete. A refusal is a 403 that names the rule.

  • route /api/operator
  • gate check:policy

• Writing

  First publication is a fact in the file

  A post's first_published date lives in its frontmatter, not in a database column, because rows are rebuilt from the source and a column would be dropped silently and fail open. The value is read only from the stored file and overwritten on the way out, so a caller cannot publish a draft by asserting the fact the gate checks.

  • route /api/operator
  • assertion in check:policy: readState reads a previously published post

• Writing

  Scheduled posts go live with no write

  A per-minute cron puts schedules live. A post scheduled before it was ever live goes live by its publish_at with no write, and the cron announces it once, so IndexNow, the page purge and the outgoing webmentions all hear it.

  • route /webmention
  • gate check:worker

• Charts

  Charts are content, not a widget

  A chart is authored as a container directive over a fenced block of CSV and rendered to SVG as the post is rendered, so it is part of the stored HTML and a reader with JavaScript disabled sees the same chart as everyone else. Colors are CSS custom properties that resolve per theme, which is why one stored SVG serves light and dark with nothing to flash.

  • gate check:content

• Diagrams

  Diagrams render ahead of time, one drawing per theme

  A diagram needs real font metrics, so it cannot render in a Worker. One SVG per theme is produced ahead of time and the stylesheet shows one of them. The rendered post carries the key and the source rather than the drawing, so a font-rendering difference between two machines can never turn into a failed build. Alt text is mandatory.

  • gate check:diagrams
  • assertion in check:diagrams: a diagram with no alt fails

• Search

  Two FTS5 indexes over one derived table, fused by rank

  An FTS5 tokenizer is set per table, not per column, so one index cannot serve both exact-token lookup and prose relevance. There are two: unstemmed for titles and tags, Porter-stemmed for bodies. The two ranked lists are merged by reciprocal rank fusion, never by raw score, because scores from two tokenizers over two average document lengths are not comparable on value.

  • route /search

• Search

  Results are section-grained

  One post yields a document record plus one per heading, so a hit deep-links to the heading that answers it rather than to the top of the page.

  • route /search
  • gate check:content

• Search

  A filter with no text takes a different query path

  A bare year or a tag chip has nothing to give FTS5, so those queries run the filter SQL straight over the derived table, date ordered, document records only. Returning every section of one post for a bare year would present the corpus at several times its real size. The snippet carries no highlight, because nothing was matched and marking anything would claim a match that never happened.

  • route /search

• Search

  The same URL returns JSON under content negotiation

  Requesting the search page with Accept: application/json returns the same query against the same index, with Vary: Accept. It is not a second API. Negotiation runs in middleware, because a document route's loader cannot return a raw Response.

  • route /search

• Ask

  A streamed AI answer with citations that deep-link

  Retrieval and generation sit strictly above classic search and never block it. Citations map back to heading anchors, and the answer is written with textContent rather than as HTML, because it is generated text and the one thing known about it is that we did not write it.

  • route /search/ask

• Ask

  The two search layers fail on opposite inputs

  Measured on the same corpus: classic keyword search found two things AI retrieval missed, both single tokens naming a heading almost verbatim, and AI retrieval found three that classic missed, all long natural-language questions. Neither layer subsumes the other, which is the case for keeping classic first and Ask on top rather than replacing one with the other.

  • route /search/ask
  • route /search

• Ask

  Three cost gates in front of the only metered endpoint

  A per-IP burst limit, then an answer cache keyed by a hash of the normalized question, then a site-wide daily ceiling. The ordering is load-bearing: the ceiling sits after the cache, so a cache hit costs nothing and consumes no budget. A refusal is a 429 with Retry-After and reaches no model.

  • route /search/ask

• Ask

  Drafts can never reach the AI index

  The classic index filters drafts at query time. The AI index cannot, because it has no per-item status a query can filter on, so exclusion happens at upload time. A draft uploads nothing and actively removes anything the post already had, because skipping the upload alone would leak on the unpublish path: a post published, indexed, then withdrawn would stay answerable forever.

  • gate check:ask-guards
  • assertion in check:ask-guards: a withdrawn post is not Ask-publishable

• Rate limiting

  Durable Objects, because the platform limiter does not count

  Both cheaper mechanisms were built first and both leaked. Cloudflare's GA ratelimit binding, configured at five requests per sixty seconds and attacked with twelve concurrent requests, refused one, then two, then nine, then zero across four runs. It is documented as permissive and eventually consistent: it sheds sustained load rather than counting. A Durable Object using the asynchronous storage API allowed eight through a ceiling of three, because a read and a write spanning an await is not atomic even inside a single-threaded object. The synchronous SQLite API landed on its ceiling exactly, which is the whole reason the class is registered as a SQLite-backed one.

  • route /search/ask

• Media

  R2 is the store, D1 is a rebuildable index

  R2 holds the bytes and wins every conflict: a row with no object is deleted, an object with no row is backfilled, never the reverse. The index exists in D1 because R2 paginates in key order and promises nothing else, so sorting by date, filtering unused, searching by name and counting by type are each a query, and building those over a key-ordered iterator means listing the whole bucket per request. A capability decision, not a scale one.

  • route /media/*

• Media

  Keys are content-addressed and carry their dimensions

  A key is a truncated hash of the bytes plus the extension, which was decided on security rather than tidiness: the old scheme was derivable from a slug the sitemap publishes plus eight hex characters, so a draft's images were guessable. The key also carries the pixel dimensions, so the build and the Worker resolve image sizes from the string rather than from two different stores that could disagree.

  • route /media/*
  • assertion in check:tests: the fixture produced both resolutions and refusals

• Media

  Transforms are computed on request and never written back

  One object per image, every size derived from it, which keeps the bucket free of variant sprawl and is why it needs no lifecycle rules. It uses the Images binding and not the URL transform syntax, and that is forced rather than preferred: the URL interface answers 404 on both of the site's addresses, with error 1042 on the workers.dev address (which has no zone) and a plain 404 on dustinedwards.info, so the binding is the only route to resizing. Thumbnails serve one format unconditionally, after a negotiated version turned out to poison a cache whose key carried no headers.

  • route /media/*

• Theming

  The theme is resolved server-side, so nothing flashes

  The choice lives in a cookie, is read in the root loader, and the correct attribute is written into the first byte of HTML. There is no inline script and nothing is corrected after paint. System preference is the absence of the attribute rather than a third value.

  • route /theme
  • gate check:contrast

• Theming

  The toggle works with scripting off

  It is a real form posting to a route that sets the cookie and sends the reader back. The client enhancement only removes the round trip. It is deliberately not a radio group, because a real radiogroup owes arrow-key roving focus that cannot be delivered without script.

  • route /theme

• Theming

  Every color pair is recomputed from the shipped stylesheet

  The gate reads the token values back out of the stylesheet and recomputes the whole contrast matrix, so a tuned hex moves one side of the comparison and fails. The pairs and thresholds are transcribed as token names rather than values, so nothing in the gate restates a color.

  • gate check:contrast
  • assertion in check:contrast: dark (prefers-color-scheme)

• Brand mark

  The mark is inline SVG

  One component collapses the four SVG files into a path list and a viewBox, because the files differ in exactly two ways. The purple paths carry no fill and take a brand custom property instead, which is the entire dark-mode story for the mark.

  • route /

• Machine surfaces

  Feeds, a sitemap, and a map of the site for agents

  RSS and JSON feeds, a sitemap, robots, and a plain-text map of the site with a full-text companion carrying every published post in one document. ONE FEED POLICY: both feeds read the same query with the same visibility predicate and the same cap, and carry the whole post rather than a summary, differing only in representation because an RSS reader renders markup and a JSON consumer is usually a program. The map is served from a database row rather than from the file in the repository, and the inlined fallback is imported from that same file so the two cannot drift.

  • route /writing/rss.xml
  • route /writing/feed.json
  • route /sitemap.xml
  • route /llms.txt
  • route /llms-full.txt
  • assertion in check:machine-readable: llms.txt is LF-only
  • gate check:tests

• Machine surfaces

  Search is exposed over the Model Context Protocol

  The same corpus is reachable as an MCP tool, so an agent can search the site without scraping it. It needs no authentication and returns the same section-grained keys the rest of the site uses. It shows the same retrieval characteristic as the AI answer layer: it finds passages that answer a question and misses short exact tokens the keyword index finds immediately, which is stated rather than hidden.

  • route /llms.txt
  • gate check:machine-readable

• Backups

  Per-table exports, because the platform export is broken here

  The database export command fails outright on a schema containing FTS5 virtual tables and writes nothing, so backups are taken per table with the schema excluded, never touching the virtual tables or their shadow tables. The table list is derived from the migrations directory, and the check fails in both directions. It found a real omission on its first run.

  • gate check:backup
  • assertion in check:backup: sqlite_master returned no tables

• Backups

  Counting an FTS5 index cannot detect that it is empty

  A count on an external-content FTS5 table reads through to the content table, so it reports rows that the index itself no longer holds. Measured twice: with the index emptied, the count still read seven while the size shadow table read zero and matching returned nothing. An integrity check also passed on the broken index. The shadow table is what gets counted, and the repair for a corrupt index is a rebuild, never a delete.

  • gate check:backup

• Safety rails

  URL protocols are allowlisted in the schema as well as the renderer

  The render-layer guard only walks nodes the body renderer produced, so frontmatter bypassed it entirely: a curated link field took a generic URL validator, which accepts javascript:, and rendered as a live public anchor. Both that field and the cover path now call the same predicate the renderer uses rather than reimplementing it. That is asserted against the source, not only through behavior, because the two come apart: the cover path spent a while refusing bad protocols as a side effect of a stricter rule about paths, which every behavioral case passed and no gate could see.

  • gate check:urls
  • assertion in check:urls: frontmatter blocked cases were exercised
  • assertion in check:urls: schema: ${label} calls isAllowedUrl, not a reimplementation

• Safety rails

  Rules stated twice are checked against each other

  Some rules cannot be collapsed into one function because they are expressed in two languages: the public visibility predicate exists once as a query-builder condition and once as a hand-written SQL string over a different table. Those are run against a fixture of post states and must admit the same rows. The same suite proves the column schema agrees between the schema module, the migrations and the deployed database.

  • gate check:tests
  • assertion in check:tests: both predicates admit the same posts

• Pages

  Prose pages are rows, not deploys

  The Research, Teaching and Software pages and About are markdown files saved into D1's pages table. The page, its markdown twin, its sitemap entry and its search records are drawn from that row at request time, so an edit goes live without a build or a deploy. A save runs the same validator CI runs.

  • route /about
  • gate check:links

• CV

  One source, four outputs

  The CV is one file per section, saved into D1. The page at /cv, its charts at /cv/charts.json, its markdown twin at /cv.md and its PDF are all drawn from those rows. The page filters, searches and sorts without a reload.

  • route /cv
  • route /cv.md

• Publications

  Citations export in BibTeX, RIS and JSON

  Each paper is a file named by its DOI and saved into D1, and its page is drawn from the row. The list exports as BibTeX, RIS and JSON, and each paper as BibTeX, RIS and markdown. The CV gives each paper copy buttons for its plain citation, BibTeX and RIS.

  • route /research/publications
  • route /research/publications.bib

• Procedures

  One format for protocols, recipes and computational procedures

  A procedure is a file with a profile (protocol, recipe or computational), saved into D1 and drawn from the row. A procedure page can run as a checklist with a Done check and a note for each step, and can be kept on the device for offline use.

  • route /research/protocols
  • gate check:protocols

• Systems map

  The network is a map, not a list

  /systems draws the network of systems. Pointing at a system lights the ones it uses and the ones that use it, and mutes the rest. Each system has its own page with its parts and flows, and every flow is an ordered list without script.

  • route /systems
  • gate check:systems-map

• Error pages

  Each error page carries a vintage comic ad

  The not found, gone, forbidden and server error pages show a small comic-book ad at the foot, below the page's plain message and buttons. /ads is the gallery, and adding a folder under app/utility-ads adds an ad.

  • route /ads/:id?
  • gate check:tests

• Reading aids

  Posts add reading aids without script

  A reading-progress bar (CSS only, where the browser has scroll-driven animations), a table of contents that follows the section on screen, copy buttons on code blocks, footnote previews, an image lightbox and click-to-copy heading links are each added to a page that is complete without them.

  • route /writing
  • gate check:features

• Search

  A command palette opens on / or Cmd-K

  The header's search link becomes a modal palette with live results. Without script it is the search page.

  • route /search
  • gate check:features

• Lab registry

  A fact is stored once, in a record, and every page draws it from there

  The lab's primers, host strains, reagents and equipment are records in the repository, one file each, and a protocol names them by id instead of repeating them. A primer's sequence is written in one file, and the protocol that uses it, the primer's own page, the printable bench sheet, the markdown copy and the search records all print that one sequence. A save recompiles every protocol that names the changed record, so no page is left reading an old value. The files are the source and the database holds a derived copy that the health checks compare against the files.

  • route /research/lab
  • route /research/protocols
  • gate check:content
  • gate check:protocols

• Lab registry

  Sizes, positions and melting temperatures are computed, never copied

  A primer's length, GC content, reverse complement and melting temperature come from its sequence, with the conditions stated beside the figure and the figure called an estimate for comparing primers rather than an annealing temperature. Where a primer binds a named GenBank reference, and the size of the product a pair makes, are computed by the site's own tested placement code, and a mismatch is shown rather than absorbed. A reference is genomic unless a protocol amplifies cDNA. The phages isolated on a host strain are counted from the phage table by host, so a phage added there is counted on the strain's page with no edit to the strain.

  • route /research/lab
  • gate check:content
  • gate check:tests

• Lab registry

  What no record states is said, with the reason, and listed

  A fact that could not be found in a source the lab can read is written as missing with the reason (paywalled, not stated, waiting on a person), and the page shows it as not found with that reason instead of leaving a blank or filling it from memory. A sequence that differs from the one a paper prints is shown as different and reported, never corrected quietly. The reagents and the equipment are each one table, because the record behind a row has little to say beyond its supplier or maker, and each protocol keeps its own amounts, stocks and settings in its own table.

  • route /research/lab
  • gate check:content

• This page

  The stack half is generated

  Every binding, migration, gate and dependency above is emitted from the repository's own configuration when the site is built. Nothing in the generator or on this page restates a name.

  • route /colophon

• This page

  The feature half is anchored, because it cannot be generated

  Sentences like this one are in no configuration file, so each carries an anchor: a route, a gate, or a specific assertion inside a gate. The check verifies the anchored thing still exists. It cannot verify that the sentence is true, which is stated in its header rather than implied, and a claim whose only anchor would be an external decision record is refused outright, because that would be an unverifiable claim wearing the costume of a verified one.

  • route /colophon
  • gate check:features

Runtime

Compatibility date, Worker flags and the pinned Node version.

Compatibility date

2026-09-01

Compatibility flags

none

Node

26.12.1

Bindings

Every resource the Worker binds to, what it is for, and the measurement that put it there.

17 resources.

Credits

The packages shared with my other sites adapt code from three open-source projects, each under the MIT license.

• Astro is the source of devkit's island-loading rules and dev-toolbar audit rules. Site-runtime adapts its speculation-rules prefetching and image layouts and widths. Capsomer adapts its size-matched fallback fonts.

• EmDash is the source of the scheduled updates to live posts that site-api and Carrel apply, and of the ideas for focal points and captions on media.

• Cloudflare Nimbus is the model for how Prelum serves Markdown copies of pages to AI agents. Prelum uses Nimbus's own code to decide when a request prefers Markdown.

What was not adopted

Choices ruled out on purpose, each with its reason.

5 entries.