Practical insights and guides on PHP/Symfony, React/Next.js, legacy modernization, and software architecture, drawn from 18+ years of building web applications for European businesses.
Most production LLM agents fail not because the model is wrong, but because the orchestration layer cannot recover when one step times out. This post shows how the Symfony Workflow Component — built for business processes — makes an excellent agent loop runtime with explicit state, replayable transitions, and built-in audit traces.
Read moreMigrating a WordPress site to headless Next.js without tanking your rankings is possible — if you do it incrementally. This is the step-by-step replatforming playbook for mid-size European businesses with hard-earned SEO authority.
Read moreBilling and support data catch cancellation two weeks too late. The signals that actually predict churn live in your product telemetry — feature adoption decay, session depth collapse, and the integration-disconnection pattern that precedes 90% of downgrades.
Read moreWhen Twig has hit its ceiling but a fully decoupled React SPA feels like overkill, Inertia.js gives Symfony teams a third option — modern frontend components without an API layer, a separate deployment, or a complete rewrite.
Read moreTurbopack is stable for next dev in Next.js 15, but the confidence curve for production builds with MDX, Sentry, and custom webpack loaders is a different story. Here is the honest state of Turbopack in mid-2026 and an incremental adoption path that lets your team capture dev-mode speed without betting the build pipeline.
Read morePostgres RLS can enforce tenant isolation at the database layer—but connection pooling, SECURITY DEFINER functions, and Doctrine quirks create gaps that bite teams in production. Here's where RLS holds and where it doesn't.
Read moreWhen an AI feature misbehaves in production, standard APM dashboards are useless. Here is the minimum viable LLM observability stack for small engineering teams — prompt capture, cost attribution, and the alerting rules that actually predict AI incidents.
Read moreInput sanitization stops the obvious attacks and almost nothing else. Indirect prompt injection through RAG documents, tool outputs, and multi-turn context is the threat most B2B SaaS teams are not ready for. This post covers the production defense stack: structural prompt separation, tool-use allowlists, user-scoped permission propagation, output constraints that catch data exfiltration, and the red-team harness enterprise buyers will ask to see.
Read morePure vector search misses exact queries. Pure BM25 misses paraphrased intent. The production answer is hybrid — and for most mid-size SaaS, the right place to do it is inside Postgres itself.
Read moreThe European Accessibility Act enforcement gap closes mid-2026, and the WCAG 2.2 AA checklist your product manager hands to engineers rarely survives contact with a real React component tree. This is the engineering-level audit: focus management in Next.js App Router, criteria that Radix and Headless UI quietly fail, form error announcements that work with real screen readers, and the CI setup using axe-core and Playwright that catches regressions before they ship.
Read more