Readable evidence before dashboards
Prefer a verifiable sentence over a colored panel when the claim has to survive an audit.
Static-Web
Freshness and validation in the two-clock cache model
A cache is only as coherent as the pair of conditions your headers make explicit.
The zero-JavaScript static site is a defensible choice
An explicit script-src ’none’ policy is a boundary with a measurable contract.
A release checklist for a static site
Verify the artifact before replacing the live directory, and keep the checks close to the release command.
Security headers should describe the actual page
Start with a narrow policy, then expand it only when a documented feature needs another resource.
A release is not complete until the public edge agrees
Validate one staged artifact, publish it, then compare representative public responses with those exact bytes.
Content-Type should describe the bytes you actually send
A filename is only a hint; the response header is the browser-facing contract for the representation.
Why a small site can stay static
A static origin is a boundary you can name, cache, and roll back.