BLOG
Development notes
Working notes, not announcements. Architecture decisions I actually made, problems that cost me time, and how I solved them. If I haven't measured something, I say so.
When You Don't Need an LLM: Splitting Work Between Device, Classifier and Big Model
Laravel AI SDK 1.0 makes classification a capability of its own. It is the same question I ask in Miraviso: which slice of the work actually deserves a generative model.
READ →Slow Jobs, Killer Containers: Laravel Queue Timeouts and Crashes in Docker
A job calling an AI model can time out, get OOM-killed or die mid-deploy. What killOnTimeout and CountCrashesAsExceptions change, and how to line up your timeouts.
READ →Approving a Tool Is Not Approving Data: What Laravel AI SDK 1.0 Changes, and What It Doesn't
The Approvable contract puts a human inside the agent loop. In Miraviso the boundary that matters sits lower down: at the point where an image leaves the device.
READ →Storage::path() Could Walk Out of the Disk: The Path Traversal Laravel 13.30 Closes
Storage::get('../.env') was rejected, Storage::path('../.env') was not. What Laravel 13.30 closes, and why the real fix is never building a path from user input.
READ →Thirty Days to Migrate: When Your SaaS Depends on a Model That's About to Disappear
Gemini Omni 1.1 Flash went GA and the preview endpoint is deprecated on September 30. How to prepare when your privacy design forbids keeping data for regression tests.
READ →Laravel's Native Vector Search Now Speaks MariaDB — Plain MySQL Is Still Left Out
The PR that brings whereVectorSimilarTo to MariaDB is a lesson in driver design. If your apps run on plain MySQL you're still out. Why, and what to do about it.
READ →Sensitive Data in Your Logs: What Laravel 13.27's Binding Masking Fixes (and What It Doesn't)
A failed query copies customer data into logs, failed_jobs and APM traces. Laravel 13.27's new flag closes one hole. The threat model is bigger.
READ →The Server Can't Read It: Sealed-Envelope Encryption for Sensitive Data in a B2B SaaS
Miraviso encrypts sensitive notes with a device-derived key the server never sees. The real costs of client-side encryption in a SaaS, and why they pay off.
READ →Vue 3.6 Vapor Mode: Lessons From Writing Browser Games With No Framework
Vue 3.6 is in RC and Vapor Mode removes the virtual DOM. Hand-writing logic games in plain JS taught me why it's the right move — and when it actually matters.
READ →