标签：#tutorial

TL;DR ABR "flapping" is when your player hops between quality levels every few seconds on a jittery network, and each hop is a visible lurch. We'll detect it from LEVEL_SWITCHED events, then fix it in layers: widen the bandwidth-estimator memory, make upswitches earn their place, and cap the switch rate with abrSwitchInterval (new in hls.js 1.7). Config + a detection snippet you can paste in today. 📦 Code: github.com/USER/hlsjs-abr-tuning, replace before publishing The bug nobody reports correctly Users don't file "my ABR is flapping." They say the video "kept changing" or "couldn't decide." What's happening: on cellular, throughput is spiky, and the player's bandwidth estimator treats every spike as the new truth. One fast segment and it jumps to 1080p, one slow segment and it drops to 240p, over and over. Low rebuffer ratio, good startup time, and still a miserable watch. Counterintuitively, feeding the player fresher bandwidth data makes this worse, because fresher data is noisier. The fix is a player with a longer memory and slower reflexes. Let's build that. 1. First, detect the flap 📊 Don't tune by vibes. Count level switches per minute of playback. Every switch fires Hls.Events.LEVEL_SWITCHED . // abr-monitor.js, hls.js 1.7.x, node 20+ tooling / any modern browser import Hls from " hls.js " ; export function attachFlapMonitor ( hls ) { const switches = []; hls . on ( Hls . Events . LEVEL_SWITCHED , ( _evt , data ) => { const now = performance . now (); switches . push ({ t : now , level : data . level }); // keep a 60s sliding window while ( switches . length && now - switches [ 0 ]. t > 60 _000 ) switches . shift (); const perMin = switches . length ; const reversals = countReversals ( switches ); if ( perMin >= 6 ) { console . warn ( `[abr] flapping: ${ perMin } switches/min, ${ reversals } reversals` ); } }); } // a "reversal" = up then down (or down then up), the signature of flapping function countReversals ( s ) { let r = 0 ; for ( let i = 2 ; i < s . l

WordPress's plugin and theme update screens both have a "select all" checkbox. Calling check() on it with Playwright succeeds — no error, no exception. But look at the individual checkboxes afterward, and sometimes none of them are actually checked. Note: Playwright's check() ticks a checkbox. The click itself can succeed even if the page's JavaScript handler never fires, leaving what the form actually submits out of sync with what the screen visually shows. What actually happens The "select all" checkbox is usually wired up with a JavaScript handler: clicking it is supposed to check every individual checkbox underneath it. Playwright's check(force=True) can force the DOM state of that one checkbox — but that only changes that checkbox's own state . It doesn't guarantee the JavaScript handler that's supposed to propagate the change to the individual checkboxes actually fires. # Looks like it worked, but the individual checkboxes are still unchecked select_all . first . check ( force = True ) page . click ( ' input[type= " submit " ][name= " upgrade " ] ' ) Clicking the update button submits whatever the form's actual state is — which is "nothing checked." Nothing updates. No error is thrown, so on the surface it looks like the run completed normally. The fix — verify right after checking, every time Right after checking "select all," confirm that the individual checkboxes underneath are actually checked. If they aren't, fall back to checking each one individually. sel_all_sel = ' input[type= " checkbox " ][id^= " plugins-select-all " ] ' select_all = plugin_form . locator ( sel_all_sel ) if select_all . count () > 0 : select_all . first . check ( force = True ) page . wait_for_timeout ( 500 ) # Verification step — confirm checkboxes are actually checked chk_sel_check = ' input[type= " checkbox " ][name= " checked[] " ]:checked ' any_checked = plugin_form . locator ( chk_sel_check ). count () > 0 if not any_checked : # Select-all had no effect; switch to individual s

The day your first cohort completes a course is the day certificates stop being a design job and become an engineering problem. One certificate is a Canva export. Ten thousand is a rendering pipeline with a database table, a queue and a verification page. This post walks through the three ways teams actually build that pipeline, with working Python for each, then covers the two parts most certificate tutorials skip: batching at volume and verification. It is a condensed version of our full guide, How to generate signed digital certificates at scale , which also covers storage, retention and revocation. One scope note up front. Most platform certificates do not need cryptographic signing in the PKI sense. The trust model that 95% of platforms ship is simpler: a unique ID printed on the certificate resolves to a verification page on the issuer's domain. An employer types the ID, the page confirms it. That is the model this post builds. If you need true PKI signing for regulated credentials, the stack is different (Adobe Sign, DocuSign, in-house HSM workflows) and this post is not it. What every certificate needs Whichever approach you pick, the output is the same: Component Detail Layout Landscape A4, 2480x1754 at 200 DPI for print Personal Recipient name with full Unicode support Course Course title and completion date Issuer Issuer name plus a signature image ID Unique certificate ID (UUID or short slug) Verify A URL under the ID pointing to your /verify route The signature image communicates authority but provides zero tamper resistance. The certificate ID plus the verification page is the practical trust layer. Keep both in mind as you read the code. The three approaches at a glance Approach Setup Render time Maintenance PDF library (ReportLab, PDFKit) 1 day 200 to 400 ms Fonts, layout drift, library updates HTML plus headless Chrome 2 hours 1 to 3 sec Chromium, memory, queue workers Template API 5 minutes 1 to 2 sec None Approach 1: a PDF library Python with Repo

100 城时区页给跨区调度当速查，DST 自动算 作者是 数据管道 / 跨时区调度 方向的开发者。这篇不是广告，是踩坑记录 + 顺手做的工具。 背景 做 数据管道 / 跨时区调度 时，时间戳转换是最常被低估的雷区。16 个时间戳工具(Unix 转换/时区/ISO8601/Cron/Duration…) 已覆盖日常；但每个语言/框架的坑都不一样，所以又补了 30 个语言/框架时间戳页(python/javascript/java/sql/…)，每页含 6 个真实坑。 我踩过的坑（举几个） 秒 vs 毫秒：前端 Date.now() 是毫秒，后端常存秒，混用差 1000 倍。 时区不是字符串：存 UTC、展示本地，别把本地时间当 UTC 落库。 2038 问题：32 位系统 time_t 在 2038-01-19 溢出，老系统要提前查。 夏令时：一年有两次重复/缺失的本地时间，跨区调度尤其坑。 我顺手做的东西 转换速查页： https://gotimestamp.com/timezone/new-york 相关语言页： https://gotimestamp.com/timezone/london 开源 MCP： https://github.com/caresotin/tsforge-mcp —— 把时间戳转换/校验直接接进 LLM 工作流，不用手算。 小结 时间戳没那么简单，但工具到位就省心。上面都是免费、开源、可直接用的，希望对同样踩坑的人有帮助。

Node Date 的 epoch 毫秒坑 + 用 MCP 把转换塞进 AI 流 作者是 Node.js / JS 时间 方向的开发者。这篇不是广告，是踩坑记录 + 顺手做的工具。 背景 做 Node.js / JS 时间 时，时间戳转换是最常被低估的雷区。16 个时间戳工具(Unix 转换/时区/ISO8601/Cron/Duration…) 已覆盖日常；但每个语言/框架的坑都不一样，所以又补了 30 个语言/框架时间戳页(python/javascript/java/sql/…)，每页含 6 个真实坑。 我踩过的坑（举几个） 秒 vs 毫秒：前端 Date.now() 是毫秒，后端常存秒，混用差 1000 倍。 时区不是字符串：存 UTC、展示本地，别把本地时间当 UTC 落库。 2038 问题：32 位系统 time_t 在 2038-01-19 溢出，老系统要提前查。 夏令时：一年有两次重复/缺失的本地时间，跨区调度尤其坑。 我顺手做的东西 转换速查页： https://gotimestamp.com/timestamp/nodejs 相关语言页： https://gotimestamp.com/timestamp/javascript 开源 MCP： https://github.com/caresotin/tsforge-mcp —— 把时间戳转换/校验直接接进 LLM 工作流，不用手算。 小结 时间戳没那么简单，但工具到位就省心。上面都是免费、开源、可直接用的，希望对同样踩坑的人有帮助。

A few months back I was running Sales Navigator searches for a client project — filtering down to "VP Sales, fintech, based in Italy or Spain" type lists — and the results were genuinely good. 60, 80 leads that actually matched. Then I hit the part nobody warns you about: there's no button on that page that says "save this." So I did what everyone does. Opened a spreadsheet, alt-tabbed back and forth, typed names and job titles by hand. Around profile 40 I gave up and went looking for a better way. This is what I found, roughly in the order I found it, including the tool I ended up building because none of the existing options quite fit what I needed. First: the export LinkedIn actually gives you LinkedIn has a real, built-in data export, and most people don't realize how narrow it is. It's under your profile photo → Settings & Privacy → Data Privacy → Get a copy of your data . From there you either tick specific categories (that email usually lands within minutes) or request the full archive, which takes closer to a day and sometimes arrives in two batches. Either way you get a download link that expires after 72 hours — and it's desktop only, the mobile app won't let you request one. What you get back is genuinely thorough: connections, messages, your own profile history, activity, even the ad-targeting data LinkedIn holds on you. A couple of quirks worth knowing before you rely on it: some connections' email addresses will just be missing, because sharing an email on download is something each person opts into individually, and you won't get a list of who viewed your profile or any "People You May Know" data. If you're in the EU, EEA, or Switzerland, LinkedIn also runs a separate API for pulling your data on a schedule rather than as a one-off request. Here's what this export is not built for, though: it has no idea what you searched for yesterday. It's an archive of your own account, not a way to capture a live search. Run a Sales Navigator query and pull 80 lea

Git is the ultimate tool for developers. Yet, branching strategies still confuse many of us. Commands like merge, rebase, and cherry-pick manipulate your commit history in completely different ways. If you just guess what they do, you risk ruining your team's shared history or losing track of your changes. The easiest way to understand Git is to visualize it. Let us look at exactly what happens to your Git graph when you run these three critical commands. 🏗️ Starting Point: Our Example Repository Imagine we have a standard repository. We branched off the main branch from commit B to work on a new feature in a feature branch. While we worked on our feature, someone else pushed commit C and D to main. Here is what our history looks like right now: C --- D [main] / A --- B \ E --- F [feature] main has two new commits: C and D. feature has two new commits: E and F. 🔀 1. Git Merge (The Safe Record Keeper) When you merge main into your feature branch (or vice versa), Git creates a special, brand-new commit called a merge commit. git checkout feature git merge main The Visual Graph After Merge: C ------- D ------ [main] / \ A --- B \ \ v E --- F --- G [feature] What happened under the hood? Git looked at the common ancestor (B), took the history of main (C and D), took the history of feature (E and F), and combined them. Commit G is the merge commit. It has two parent commits: F and D. Pros: 100% non-destructive. It preserves the exact historical timeline of when things actually happened. Cons: Your Git graph can quickly become a messy "train track" web if you have many developers merging constantly. 🚀 2. Git Rebase (The Clean History Rewriter) Rebase takes all the commits from your current branch, lifts them up, and replants them on top of the very last commit of the target branch. git checkout feature git rebase main The Visual Graph After Rebase: C --- D [main] / \ A --- B E' --- F' [feature] What happened under the hood? Git temporarily blew away commits E and F. It ca

I often see people using the term "namespace" incorrectly. Even when explanations of what a namespace is are presented, they only go as far as describing its function, neglecting to properly define the name "namespace" itself. Definition of the Namespace A namespace is literally the space to which a name belongs . If we were to classify the term namespace, it would be a specification (concept), not a tool. In namespaces, the higher level is represented as outer and the lower level as inner . In terms of class structure, this corresponds to outer classes and inner classes. In other words, to explain it from a different perspective, it looks like this. Representation of namespaces from the outer perspective Build namespaces (best) Define namespaces (to fit many programming language implementations) Open namespaces (such as Ruby's class definition and module definition ) Create namespaces (such as the pseudo-namespace hack in older JavaScript) Declare namespaces (such as the package declaration in Java or the namespace declaration in PHP) Representation of namespaces from the inner perspective Belong to a namespace (best) Entering the namespace (This is entirely from an inner perspective, so it might feel out of place depending on the context) Be included in the namespace (this is a reasonable explanation if explained objectively). Incorrect expression From the definition above, it is clear that the following expressions are incorrect. Add/Paste a namespace (the expression "add/paste a space" is grammatically incorrect). Use namespaces (not to the point of being completely broken, but treating namespaces as a tool) Separate/Cut namespaces (While "Separated by namespaces" is understandable, "separate/cut" can be misleading) Meaning of "Name" in Namespace The "names" referred to here can be class names, module names, or package names. What they represent varies depending on the language that implements namespaces. For example, in Ruby, it refers to constant names. In Rub

A hands-on guide to being your own Identity Provider — with Laravel 12 and Passport v13. You will build a Central Portal that acts as an OAuth 2.0 Authorization Server, then wire up child sites ( Site A , Site B , Site C ) so a user logs in once and gets access to all of them. No Google. No Auth0. No Keycloak. No "Sign in with…" anything. You own the users table, you issue the codes and tokens, you hold the signing keys. The only dependency is laravel/passport , which implements the OAuth 2.0 protocol machinery — every identity decision is yours to make, and this guide walks through each one. The scope is deliberately narrow: authentication only. How a user proves who they are at a central server, and how a child site learns that identity. Everything else (admin CRUD screens, audit logging, UI theming) is left out. Everything here is buildable on a fresh Laravel install. No prior context needed. Table of Contents What We Are Building OAuth 2.0 Foundations System Architecture Authentication Workflows Part A — Building the Central Portal Part B — Building a Child Site Registering a Child Site End-to-End Testing Gotchas & Security Notes Reference Tables Appendix A — Extending to Multiple User Types Appendix B — Mental Model in One Page 1. What We Are Building The Problem You operate several web applications. Each has its own users table, its own login form, its own password reset flow. When a staff member joins, someone creates four accounts. When they leave, someone must remember to disable four accounts. Passwords drift out of sync. There is no single place to answer "who has access to what?" The Solution One central server owns identity. Every child site delegates login to it. ┌─────────────────────────────┐ │ Central Portal │ │ ┌───────────────────────┐ │ │ │ admin.portal.test │ │ Management UI │ │ │ │ — create users │ └───────────────────────┘ │ — grant per-site access │ ┌───────────────────────┐ │ │ │ sso.portal.test │ │ OAuth 2.0 endpoints │ │ (authorization ser

On hosting without SSH access, a common pattern is to open update-core.php (the WordPress update screen) with Playwright and read "what version is WordPress core currently running" straight off the page text. In one deployment, the recorded core version came back as something like 1.7.11 — a number that has never existed for WordPress core. Note: update-core.php is the WordPress admin's "Updates" page, listing pending updates for core, plugins, themes, and translations all on one screen. What was actually happening That page doesn't only show the core version string — it's packed with version numbers belonging to pending plugin and translation updates too. A line like "Update Plugin X to 1.7.11" is typical. # First implementation — grabs the first N.N.N-shaped number on the page match = re . search ( r ' \d+\.\d+(?:\.\d+)? ' , page_text ) version = match . group ( 0 ) if match else None This naive regex grabs whatever N.N.N -shaped number appears first on the page. Because of how the page is laid out, a plugin's pending update can render above the core version message, so 1.7.11 (a plugin's version) ended up recorded as the WordPress core version. Why this is hard to catch The bug doesn't throw an exception — the regex matches successfully, just on the wrong value. Nothing about it looks broken until someone notices the report shows a version that WordPress core has never shipped (there's no 1.x series for core). The fix — a three-stage guard Prefer a dedicated selector first — look for specific DOM locations where core's update message actually renders, like p.response > strong or #wp-version-message strong Fall back to keyword-anchored regex — if no selector matches, only accept a number immediately following the words "WordPress," "バージョン," or "Version" Validate plausibility as a final check — whichever path produced a value, run it through a function that checks the major version number falls within 4–9 def is_plausible_wp_core_version ( ver : str ) -> bool : m =

I have two-factor authentication (2FA) enabled on most of my accounts using an authenticator app. Recently, while installing the app on another Android device, I tried to change the backup password, but it didn't work. As a result, I lost access, had to disable 2FA, and re-enable it using a different authenticator app. Setting up 2FA again wasn't a problem because I was still logged in to most of my accounts. However, I didn't have my GitLab recovery codes. GitLab offers only two ways to regain access: receiving a six-digit verification code via email or generating new recovery codes using an SSH key associated with the account. Receiving a verification code via email is the easiest way to recover your account, but having an SSH key can be incredibly useful when receiving an email verification code isn't an option. Whenever I configure GitLab in my local environment, I create an SSH key for authentication and commit signing, as I always sign commits in my repositories. I described this process in a previous article . Get New Recovery Codes Check the SSH keys on your machine: ls -la ~/.ssh Look for files named like id_rsa , or id_ed25519 . Run the following command to get new recovery codes: ssh -i ~/.ssh/id_ed25519 git@gitlab.com 2fa_recovery_codes Replace id_ed25519 with the name of your SSH key file. Copy one of the recovery codes Go to the sign in page Enter your username and password Provide the recovery code when prompted Now you're signed in! Disable 2FA and re-enable it—and don't forget to save your recovery codes somewhere safe this time.

You published a DMARC record months ago. Every checker says it's valid. No reports have ever arrived, and at some point you stopped thinking about it and quietly concluded nobody's forging your domain. You don't know that. You just can't see. Two causes account for almost all of it, and both leave the DMARC record itself looking perfect. 1. Your reporting address never agreed to receive them This is in the spec and almost nobody knows about it. If your rua= address is on a different organisational domain from the domain publishing the record, RFC 7489 section 7.1 requires the destination to explicitly consent. The reason is obvious once you see it: otherwise anyone could point rua= at your mailbox and use the world's mail infrastructure as a free DDoS. Consent is a DNS record, published by the receiving domain: <your-domain>._report._dmarc.<their-domain>. TXT "v=DMARC1" So if example.com sends reports to dmarc@reports.vendor.com , then vendor.com has to publish: example.com._report._dmarc.reports.vendor.com. TXT "v=DMARC1" Without it, conforming reporters send nothing at all. That includes Google, which is most of your report volume. You can watch this working in production. PayPal sends aggregate reports to a third party, and the authorisation record exists: paypal.com._report._dmarc.rua.agari.com. TXT "v=DMARC1;" The practical consequence: not a Gmail address You cannot put a Gmail address in rua= . Google is not going to publish yourdomain.com._report._dmarc.gmail.com on your behalf, and you can't create records in their zone. Same for Outlook, Yahoo, or any address at a domain you don't control. This is a common first move — publish DMARC, point reports at your personal inbox, wait. Nothing arrives, and nothing is wrong with the record. If you use a commercial DMARC service they normally publish these records during onboarding, often via a wildcard. If reports never start after you sign up, check this before anything else. When it doesn't apply: reporting to you

There's a failure mode in SPF that produces no error anywhere you'd think to look. Your record is syntactically valid. dig returns it. Your DNS provider is happy. Your own test mail arrives fine. And yet some of your mail is failing authentication at the receiver, and nothing in your infrastructure will tell you. The cause is usually that you've gone past ten DNS lookups. Ten is a hard ceiling, not a guideline RFC 7208 section 4.6.4 requires evaluators to cap DNS-querying terms at ten. Go past it and the result is PermError — a permanent failure. The important part: receivers don't degrade gracefully. They don't evaluate the first ten and shrug at the rest. They treat the entire record as unusable. You go from "SPF configured" to "SPF absent" in one step, and the only place that's visible is in DMARC aggregate reports, which most people aren't reading yet. Six terms cost a lookup. Four are free. Costs a lookup Free include: ip4: a ip6: mx all ptr exp= exists: redirect= The count isn't yours to control This is what catches people out. The limit applies to the whole resolution tree, not just your record. You publish four includes. One of those vendors publishes six includes of their own. You're at eleven, and your record lists four things. Nothing changed on your side. A vendor updated their record and broke yours. There is no notification for this, from anyone, ever. Counting it by hand You can walk the tree with dig if you want to see it directly: dig +short TXT example.com | grep spf1 Then for every include: you find, recurse: dig +short TXT _spf.vendor.com | grep spf1 Keep going until you bottom out, counting every include: , a , mx , ptr , exists: and redirect= along the way. It's tedious but instructive — you'll usually find one vendor accounting for half your budget. Three traps that make tools lie to you Doing this by hand or with a naive script, there are three places to go wrong. I've seen all three produce confidently incorrect output. 1. redirect= uses = ,

You loaded an image, got a tensor shaped (batch, height, width, channels) , and your convolution wants (batch, channels, height, width) . Stack Overflow says permute . Someone else says transpose . And reshape(2, 3, 28, 28) gives you the right shape too — so why is everyone making this complicated? Because two of those three are the same tool, and the third one silently destroys your data. The short answer transpose(dim0, dim1) swaps exactly two dimensions. permute(...) reorders all of them in one call, and you must list every dimension. transpose is a special case of permute . Both return a view — no data is copied, only the strides change — which also means both leave you with a non-contiguous tensor. reshape is not in this family at all. It reinterprets the flat memory under a new shape without moving anything, so it can produce the shape you asked for while completely scrambling what the numbers mean. import torch t = torch . arange ( 24 ). reshape ( 2 , 3 , 4 ) print ( t . transpose ( 0 , 1 ). shape ) # torch.Size([3, 2, 4]) — swapped dims 0 and 1 print ( t . permute ( 2 , 0 , 1 ). shape ) # torch.Size([4, 2, 3]) — full reorder transpose — swap two axes transpose(dim0, dim1) takes two dimension indices and swaps them. Everything else stays put. t = torch . arange ( 24 ). reshape ( 2 , 3 , 4 ) print ( t . shape ) # torch.Size([2, 3, 4]) print ( t . transpose ( 0 , 1 ). shape ) # torch.Size([3, 2, 4]) print ( t . transpose ( 1 , 2 ). shape ) # torch.Size([2, 4, 3]) The order of the two arguments doesn't matter — t.transpose(0, 1) and t.transpose(1, 0) are the same thing. A swap is a swap. On a 2-D tensor this is the matrix transpose you already know, and .T is the shorthand: m = torch . arange ( 6 ). reshape ( 2 , 3 ) print ( m . T . shape ) # torch.Size([3, 2]) print ( m . transpose ( 0 , 1 ). shape ) # torch.Size([3, 2]) — identical One caution on .T : on tensors with more than two dimensions, .T reverses every dimension, and modern PyTorch has deprecated that

Short answer To build an MCP server: install an official MCP SDK, declare your tools with typed inputs, optionally expose resources and prompts, run the server over stdio or HTTP, then connect an MCP client like Claude and test it. A minimal Python server is about ten lines; the work is in choosing what to expose and validating every input. This is the build . For what MCP is, its three primitives, and how it differs from an API, start with what is the Model Context Protocol — this page assumes that and goes straight to code. Prerequisites You need very little to get a server running locally: A language with an official SDK. Python and TypeScript are the most mature; the same protocol is also implemented for other languages. This guide uses the Python SDK (the secondary path most people search for), with notes on where the TypeScript SDK is equivalent. Python 3.10 or newer and uv (recommended) or pip to manage the environment. An MCP client to test against — Claude Desktop, or the MCP Inspector that ships with the SDK. You do not need cloud credentials to build or run the server itself. Conceptually a server exposes three things — tools (model-callable functions), resources (readable data), and prompts (reusable templates) . The steps below add them in that order. Exact SDK signatures evolve, so treat the snippets as the current shape and check the live docs before shipping. Which spec revision this builds against. The code here targets MCP revision 2025-11-25 — the revision the spec's versioning page still names as the current protocol version. Revision 2026-07-28 is published and reworks the wire format substantially. A server built against 2025-11-25 stays conformant today; what the new revision changes for a server author is set out below, so you can build now and plan the move. Step 1: scaffold the server Create a project, install the SDK, and write the smallest server that runs. With uv : uv init weather cd weather uv venv source .venv/bin/activate # Install t

Learn how to build professional PDF reports in Odoo 19 using QWeb . This guide covers everything from creating your first report to advanced techniques like reusable templates, custom paper formats, barcodes, multilingual reports, RTL support, and performance optimization. Introduction Every Odoo application relies on reports. Whether you're printing: Sales Quotations Customer Invoices Purchase Orders Delivery Slips Manufacturing Orders Inventory Labels Payroll Documents Custom Certificates you're using QWeb , Odoo's XML-based templating engine. Although creating a basic report is straightforward, building maintainable, scalable, and professional reports requires understanding how the entire reporting pipeline works. In this tutorial, we'll build a complete report from scratch while exploring best practices used by experienced Odoo developers. By the end of this guide, you'll be able to: Create custom PDF reports Understand how Odoo generates PDFs Design reusable templates Display relational data Build dynamic tables Format currencies and dates correctly Add company logos, images, barcodes, and QR codes Create custom paper formats Pass additional data from Python Optimize report performance Debug common QWeb issues How Odoo Generates a PDF Before writing any XML, it's important to understand the report generation process. User clicks "Print" │ ▼ ir.actions.report │ ▼ Report Model (_get_report_values) │ ▼ QWeb Template │ ▼ Rendered HTML │ ▼ wkhtmltopdf │ ▼ PDF Download Each step has a specific responsibility: Component Responsibility ir.actions.report Registers the report Report Model Prepares business data QWeb Generates HTML wkhtmltopdf Converts HTML into PDF Understanding this workflow makes debugging significantly easier. Project Structure A clean module structure helps keep reports maintainable. my_module/ │ ├── models/ │ └── sale_order.py │ ├── report/ │ ├── sale_order_report.xml │ ├── report_action.xml │ └── paperformat.xml │ ├── security/ │ ├── views/ │ └── _

A spreadsheet containing laptop serial numbers is not proof that every endpoint is managed. It proves only that someone created a spreadsheet. For an audit, customer security review, onboarding check, or incident investigation, the evidence needs to connect four facts: The organisation expects the device to exist. The device is assigned to an accountable owner or lifecycle state. A management or monitoring control is actively reporting from it. The reported evidence is recent enough to support the decision being made. A device can appear in an asset register while being absent from the management platform. It can also appear in the management platform while belonging to a former employee or reporting data that is months old. Control objective: Maintain a current, reconciled inventory of expected endpoints, managed endpoints, owners, security state, and unresolved exceptions. 1. Define what "managed" means before counting devices Teams often use the word managed without an operational definition. That creates false confidence. An endpoint should not count as managed merely because an agent was installed once. For a company-owned laptop, a practical definition normally requires all of the following. Criterion Minimum evidence Identity Hostname, serial number, hardware identifier, operating system, and management record can be tied to one device Ownership Named user, department, custodian, stock status, repair status, or retirement state Control Expected MDM, RMM, EDR, or other endpoint control is enrolled and associated with the correct organisation Freshness Last check-in and evidence timestamps fall within a documented threshold Posture Update, encryption, firewall, antimalware, restart, and other required states are known Accountability Deviations have a reason, owner, approval, target date, and review history A device that fails one criterion should not disappear from the report. It should remain visible as an exception. 2. Reconcile three sources of truth No sing

🕉️ Devlog — गुरु-दीक्षा: Teaching Karma Without Breaking Immersion "गुरु बिना ज्ञान नहीं।" Without a Guru, there is no knowledge. The Problem Moksha is a game rooted in Sanatan Shastra — Vedic Karma mechanics, Sanskrit concepts, rebirth cycles. It's intentionally deep. And that depth was quietly becoming its biggest barrier. New players would start the game and immediately face naama-jaap, vairaagya, prarabdha, chetana-jagriti — all at once, with no guidance. Within the first 30 seconds, most had no idea what they were doing or why. The game needed a tutorial. But it needed one that didn't betray what Moksha is. Why a Normal Tutorial Wouldn't Work The obvious solution — pause the game, show a tooltip, unpause — felt completely wrong for Moksha. Spiritually, a hard pause breaks the flow of consciousness. Mechanically, isPaused = true is deeply wired into audio ducking, gamepad state, and ambient layers. Hijacking it for tutorial logic would have introduced subtle bugs across every system. An earlier attempt at a tutorial (Issue #30) tried to live inside engine.js itself. That was worse — the engine is already the heaviest file in the codebase, and embedding tutorial step state there violated the entire modular architecture we'd been building toward. So I scrapped both approaches and started over. The Solution: गुरु-दीक्षा (Guru's Initiation) The new system is built around one philosophical reframe: a Guru doesn't stop the world to teach. They walk alongside you. This became the technical foundation too. A New Module — src/tutorial.js TutorialManager is a self-contained ES6 class. It doesn't import from engine.js or touch any game state directly. Instead, main.js passes it an engine state snapshot every frame via checkCompletion(state) . The tutorial reads — never writes. engine.js ──(no connection)──> tutorial.js main.js ──(snapshot feed)──> tutorial.js Zero coupling. Zero risk to existing systems. Slow Motion, Not Hard Pause When a tutorial card is visible, the game

I maintain a non-custodial escrow protocol that runs on two blockchains: Base, an Ethereum L2, and TON, the chain behind Telegram. Same product, same core logic on paper: lock funds, deliver work, release on approval, handle disputes. I expected the second implementation to be a port. It wasn't. The two chains disagree so fundamentally about how a contract should be structured that writing the same feature twice forced me to rethink what "the same" even means. This post is about those differences, the design decisions each model pushed me toward, and what I'd tell anyone about to make the same jump. Light on code, heavy on the reasoning. The interesting part was never the syntax. The two mental models The single most important difference is not the language. It's the execution model underneath. On Base , a contract is an object with shared state. You write Solidity, and it behaves like a class instance sitting in memory that everyone calls into. A user calls a function, the function reads and writes contract storage synchronously, and either the whole thing succeeds or it reverts atomically. All my escrows live in one contract, in one big mapping, and every call reaches straight into that shared state. On TON , a contract is an actor that receives messages. You write Tact, and it behaves like an isolated process with a mailbox. You don't call a function; you send a message, and the contract handles it in its own turn. There is no synchronous cross-contract call in the EVM sense. Interaction between contracts is asynchronous message passing, and you design around that or you fight it the whole way. The shape of the entry point tells the whole story. On Base, an external caller invokes a named function: function approveWork(uint256 _contractId) external validContract(_contractId) nonReentrant whenNotPaused { // reads and writes shared contract storage, synchronously } On TON, nothing "calls" the contract. A message arrives, and a handler consumes it in the actor's own

Introduction Your agent guesses. It matches names as text and hopes the right line was in...