Readable evidence before dashboards
Prefer a verifiable sentence over a colored panel when the claim has to survive an audit.
Static-Web
Cache validation is two clocks, not one freshness setting
A cache is only as coherent as the pair of conditions your headers make explicit.
The zero-JavaScript static site is a defensible choice
No script-src is not a gap — it is a boundary with a measurable contract.
A release checklist for a static site
Verify the artifact before replacing the live directory, and keep the checks close to the release command.
Security headers should describe the actual page
Start with a narrow policy, then expand it only when a documented feature needs another resource.
A release is not complete until the public edge agrees
Build once, inspect the output, then exercise representative public routes before replacing the live directory.
Content-Type should describe the bytes you actually send
A filename is only a hint; the response header is the browser-facing contract for the representation.
Why a small site can stay static
A static origin is a boundary you can name, cache, and roll back.