Update for the week ending on Friday, May 8, 2026

Refactoring English

• Published new chapter “Eliminate Ambiguity”
• Started playing around with reader feedback tool
  • I wrote a simple design doc and let an AI agent run with it, but I didn’t supervise enough, and it sort of went of the rails, so I’m going to start over and do it more slowly.

ScreenJournal

ScreenJournal is basically Goodreads, but for TV and movies. Or letterboxd, but focused on small communities.

• Migrated to the new version of simpleauth
  • I made a simpleauth v3 because it was initially split across two repos, and it confused me which component handled password auth, which component managed sessions, which persisted state.
  • Now simpleauth just has common helpers for sessions and passwords, but the app itself manages the sessions and persistent data store.
• Moved Playwright test isolation into Playwright
  • I originally wanted a way for Playwright to run multiple e2e tests at once, and there wasn’t a standard solution, so I rolled my own thing.
  • My solution was to add a special “dev mode” where each client is assigned a cookie, and that cookie is associated with a dedicated database, so on each request, the server loads the isolated database for that client.
  • It worked okay in that each client has an isolated view of app state, but as I add to the app, there just kept being little things I had to add to make the isolation work until the complexity got too confusing.
  • I used an LLM to do the isolation in Playwright, and I find it less elegant, but it isolates hte hackiness to Playwright config rather than spilling into my app.
• Fixed a missing defer to unlock a lock in IsSessionIsolationEnabled
  • Ended up being pointless because this code went away after the session isolation changes.

Little Moments

Little Moments is an open-source web app I’m working on to replace the current family photo sharing app (TinyBeans) I used (which I strongly dislike).

• Store user IDs as UUIDv4 values
• Worked on adding authentication using a shared secret
• Backported a bunch of improvements from similar projects
  • Depend directly on sqlite.Store instead of interface
  • Drop external linker flags from tool installs
  • Fix GOROOT in Nix dev shell
  • Fix import path in import README.md
  • Handle e2e test isolation in Playwright
  • Ignore reference directory in frontend checks
  • Ignore reference directory in sqlfluff
  • Use memdb test databases in SQLite helper
  • Rename SQLite store database handle
• Added AI guidance for separating requests in Go tests
• Renamed test helpers for clarity

Go App Starter

go-app-starter is my template project for Go web apps.

• Backported recent improvements from other projects back into my starter.
  • Dropped external linker flags from tool installs
  • Fixed GOROOT in nix flake
  • Moved playwright isolation in playwright](https://codeberg.org/mtlynch/go-app-starter/pulls/49)
  • Ignore reference directory in check-frontend script
  • Renamed SQLite store database handle
  • Switched to memdb for ephemeral SQLite test databases
  • Use memdb test databases in SQLite test helper

NixOS config

• Applied mitigations to my systems for copyfail and dirtyfrag Linux vulnerabilities.

Misc

• Got VibeVoice ASR working on my system
  • It’s super slow, so I suspect it’s not using my GPU fully, but it transcribed a 1h audio clip pretty well and identified the different speakers.

Security research

• Received my first bug bounty since starting AI research
  • It was actually several for the same vendor totalling $9,700.
• Submitted 8 new bug bounty reports plus 15 tool-discovered reports