diff --git a/.claude/rules/pages.md b/.claude/rules/pages.md
new file mode 100644
index 0000000..7448711
--- /dev/null
+++ b/.claude/rules/pages.md
@@ -0,0 +1,13 @@
+---
+paths:
+  - "**/*.html"
+  - "sitemap.xml"
+  - "tools/deploy.sh"
+---
+
+# A new page, or a new top-level file or folder of the site
+
+- Copy the `<head>` of an existing page, with its Content-Security-Policy line.
+- Add the URL to `sitemap.xml` (`tools/check.py` fails without it).
+- Add a new top-level file or folder to the `SITE` list in `tools/deploy.sh`, or it is not published.
+- Update "Contents" in the title block of `index.html` and the sheet numbers of its sections.
diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..fd1d312
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,14 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "n=$(ls \"${CLAUDE_PROJECT_DIR:-.}\"/.review/notes/*.json 2>/dev/null | wc -l); if [ \"$n\" -gt 0 ]; then echo \"$n open review notes in .review/notes/ (skill handling-review-notes)\"; fi; true"
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/.claude/skills/adding-a-thought/SKILL.md b/.claude/skills/adding-a-thought/SKILL.md
new file mode 100644
index 0000000..4aafd42
--- /dev/null
+++ b/.claude/skills/adding-a-thought/SKILL.md
@@ -0,0 +1,74 @@
+---
+name: adding-a-thought
+description: Use when Tim gives a link (a web page, a tweet or X post, a paper, a repository, a video) or an idea and wants to think it through as a new thought on t7d.dev, when he wants to revise an existing thought, change its status, or add feedback that people gave on X or LinkedIn. Also for "new thought", "add this to my thoughts", "write a thought about".
+---
+
+# Adding a thought
+
+The thoughts in `thoughts/<slug>/` are Tim's archive of ideas he works through and comes back to. Anyone can read them, but they are mostly for him: each keeps where it started, what it rests on, its status and how it changed. The reference page is `thoughts/humans-md/index.html`.
+
+## 1. Gather the starting point
+
+- Read what Tim gave you. For a web page use WebFetch, or the `web-fetch` agent. X often blocks fetches: try the post's URL, then a reader or embed URL (`https://publish.twitter.com/oembed?url=<post>`), and if that fails, ask Tim to paste the text. Never guess what a post says.
+- Note the author, the date and one sentence of what it claims. These go into "Starting points".
+
+## 2. Think it through with Tim before you write
+
+Ask 2 to 4 questions per round with AskUserQuestion, and wait for the answers. Tim wants to iterate on the idea, not get a finished report. Good questions:
+
+- What caught his interest: the claim, the method, or a use for his own work?
+- His own practice today. The thought must be honest about it ("Mostly I go by feel" is fine, inventing a habit is not).
+- Where he disagrees or is unsure.
+- The form of the figures: what should move, what should be switchable.
+
+After a research round, share what you found with one or two more questions before you write.
+
+## 3. Research
+
+- Small: a few WebSearch and WebFetch calls yourself.
+- Big, or when Tim asks for it: the `deep-research` workflow, with the refined question as args. While it runs, ask Tim the questions from step 2.
+- Check every number and quote against a primary source. Mark what you could only see in a search snippet, and leave it out or paraphrase it. Name who coined a term only with a dated source (for example the first commit).
+
+## 4. Write
+
+The voice is DESIGN.md "Wording": first person, short sentences, plain words, no slogans. A thought is not a report:
+
+- Open with the question or the itch, in Tim's words.
+- One section per step of the thinking. Headings name their content.
+- Figures carry the ideas that are easier to see than to read. Use `figure.anim` (DESIGN.md "Animated diagram"): a drawing that plays once on screen, a two-state switch, parts to tap, a running token. Draw a narrow version (`.dg-n`) for phones. Use only the `.dg` classes, no colours, no `style` attributes.
+- End with what Tim takes from it: a rule, a draft, a file, or open questions.
+
+## 5. The page
+
+Copy `thoughts/humans-md/index.html` and keep its structure:
+
+1. `<head>`: title, description, canonical, `og:*`, `article:published_time` (the start date). The feeds and `llms.txt` are made from it at deploy time.
+2. `.post-head`: crumb to `/thoughts/`, `h1`, `.sub`, a label with topics, and `.tmeta`: Status, Started, Last revised.
+3. `.toc` with every `h2`.
+4. The text, then in this order: Open questions (if any), Starting points, Sources (`ol.refs`, `id="s1"`...), Revisions (`ul.dates`), Feedback.
+
+Status is one of `Draft` (still forming), `Settled` (Tim stands by it) and `Changed my mind`. Set it only as Tim says; a new thought is `Draft`.
+
+Then:
+
+- Add it at the top of the list in `thoughts/index.html` (date, status, title, one sentence).
+- Add it as the first `.proj` box in the Thoughts section of `index.html`, with an inline SVG cover. Keep two boxes there; the list holds the rest. Update the count in "Contents" in the title block.
+- Add the URL to `sitemap.xml`.
+- A file to download (like `HUMANS.md`) goes into the thought's folder.
+
+## 6. Check, let Tim review, ship
+
+Follow CLAUDE.md: serve the site (`python3 -m http.server 8000`), look at 1440, 390 and 320 px in both themes, no sideways scroll, no console errors. Click every switch and pick, and look at the narrow drawings. Commit on the session's branch and push.
+
+Tim reviews a thought as a Claude artifact before it is published: run `python3 tools/preview-artifact.py thoughts/<slug> <scratchpad>/preview-<slug>` and publish its `index.html` with the Artifact tool, with every other printed file in `files`. After a change, build again and publish the same `file_path`, so the link stays the same. Comments on the artifact reach the session: answer them and change the page in the repository, never only in the bundle. `tools/ship.sh <pr>` merges and checks the live site when Tim asks for it.
+
+## Revising a thought
+
+- Change the text, set "Last revised", and add one line at the top of Revisions: the date and what changed, and why ("Changed the third rule after feedback on LinkedIn").
+- Change the status only as Tim says.
+- Feedback: quote or summarise what people said, with a link to the post, and what it changed. If it changed nothing, say so.
+- Keep the old start date in `article:published_time`.
+
+## Sharing a thought
+
+To draft X and LinkedIn posts for a thought and bring the replies back, use the skill `sharing-a-thought` from `Tim-Conrad/Tim-Conrad-Skills`. It records each post and the feedback in the thought's Feedback section, with the revision rules above.
diff --git a/.claude/skills/handling-review-notes/SKILL.md b/.claude/skills/handling-review-notes/SKILL.md
new file mode 100644
index 0000000..d6f2012
--- /dev/null
+++ b/.claude/skills/handling-review-notes/SKILL.md
@@ -0,0 +1,20 @@
+---
+name: handling-review-notes
+description: Use when Tim mentions notes or feedback on the review site (the tab »Note«), when the session start says there are open review notes, or when you change tools/review/ or docker-compose.dev.yml.
+---
+
+# Handling review notes
+
+Tim writes notes on the review site: the tab »Note« at the right edge. The review site is this clone, served by `tools/review/devserver.py` in the container `t7d-review` (`docker-compose.dev.yml`, host name in `.env` as `REVIEW_HOST`). It shows the checked-out branch at once and loads the page again when a file changes. A note is a JSON file in `.review/notes/`.
+
+1. The SessionStart hook (`.claude/settings.json`) prints the number of open notes in `.review/notes/`. Tell Tim how many are open, and list them with `ls .review/notes/*.json`.
+2. Read the note: `note`, `path`, `viewport`, `theme`, `scroll`, `target` (`selector`, `text`, `rect`), `selection`, `branch`, `commit`.
+3. Run `uv run --no-project --with playwright python3 tools/review/show.py <id>` (more ids in one call). Look at `.review/notes/<id>.png`. The red frame is the part that Tim pointed at.
+4. Do the work with the rules of this file: a branch, `DESIGN.md`, the look at three widths.
+5. After the fix, run `show.py <id> --suffix after` and compare the two pictures.
+6. Add an `"answer"` field to the note: what changed, and the commit. Move the note to `.review/notes/done/`. Tim sees the answer under »My notes« in the tab.
+
+- Keep notes and their pictures out of git. `.review/` and `.env` are ignored.
+- A change to `devserver.py` needs `docker restart t7d-review`. A change to `review.js` or `review.css` needs only a page load.
+- The server adds only `connect-src 'self'` to the CSP of a page. Keep it that way, so that the review site keeps the rules of the real site.
+- Tests: `python3 -m unittest tools/review/test_devserver.py`.
diff --git a/.claude/skills/updating-product-reels/SKILL.md b/.claude/skills/updating-product-reels/SKILL.md
index c8f3ed1..b1bf8ba 100644
--- a/.claude/skills/updating-product-reels/SKILL.md
+++ b/.claude/skills/updating-product-reels/SKILL.md
@@ -66,7 +66,7 @@ Before a run: start the dev server in `../wortzauber` with `python3 devserver.py
    `ffmpeg -i <work>/kleinbahn-reel.mp4 -vf "fps=16/39,scale=320:180,tile=4x4" -frames:v 1 sheet.jpg` (16 pictures over a 39 s reel).
    Check that each caption sits on its own shot, that no caption covers a speech bubble or a panel, and that the end card is readable.
 4. `build.py publish`. The stills come from the sources, not from the reel, so they carry no caption. Which frames they are is at the top of `build.py` (`KB_PICS`, `WZ_PICS`, `WZ_PHONE`). If a shot or a take changed, check that the alt texts in `projects/<game>/index.html` still describe the pictures.
-5. Serve the site (`python3 -m http.server 8000` in this repo) and look at `/projects/kleinbahn/`, `/projects/wortzauber/` and `/#projects` at 1440 and 390 px wide. The page must not scroll sideways.
+5. Serve the site (`python3 -m http.server 8000` in this repo) and look at `/projects/kleinbahn/`, `/projects/wortzauber/` and `/#projects` at 1440, 390 and 320 px wide, in the light and the dark theme (CLAUDE.md). The page must not scroll sideways.
 6. Commit the files in `assets/projects/` with the change.
 
 ## Common mistakes
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..71ee819
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,15 @@
+name: Check the pages
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: CSP rules and sitemap
+        run: python3 tools/check.py
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a5072a6..092aeb0 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Check the pages
+        run: python3 tools/check.py
       - name: Publish the site files to gh-pages
         env:
           GIT_AUTHOR_NAME: github-actions[bot]
diff --git a/.gitignore b/.gitignore
index 4b7681e..5a4d505 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,8 @@
 __pycache__/
 # made by tools/gen-feeds.py at deploy time
 /llms.txt
+/thoughts/feed.xml
 /blog/feed.xml
 .review/
 .env
+.preview/
diff --git a/404.html b/404.html
index d913cbf..3dd7bd9 100644
--- a/404.html
+++ b/404.html
@@ -17,7 +17,7 @@
     <a class="brand" href="/">Tim Conrad</a>
     <nav class="nav__links" aria-label="Site">
       <a href="/#games">Games</a>
-      <a href="/blog/">Blog</a>
+      <a href="/thoughts/">Thoughts</a>
       <a class="opt3" href="/#research">Research</a>
       <a class="opt2" href="/#verify">PGP key</a>
       <a class="opt2" href="/#contact">Contact</a>
diff --git a/CLAUDE.md b/CLAUDE.md
index d18515d..3ced004 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,74 +1,33 @@
 # CLAUDE.md
 
-t7d.dev: the personal site of Tim Conrad. Plain HTML, CSS and a little JavaScript, with no build step and no dependencies.
+t7d.dev: the personal site of Tim Conrad. Plain HTML, CSS and a little JavaScript, with no build step and no dependencies. `DESIGN.md` says how it looks and sounds; `README.md` holds the deploy and the common changes.
 
-## Read first
+## Check your work
 
-- `DESIGN.md` - how the site looks and sounds. Read it before you change a page, a style or any wording.
-- `README.md` - what is on the site, the repository layout, the deploy and the common changes.
-
-## Project map
-
-- `index.html`, `404.html` - front page and not-found page.
-- `research/`, `projects/`, `blog/`, `CVE/` - one folder with an `index.html` per page. `blog/<slug>/` is one post, `blog/` the list. `CVE/` only redirects an old address.
-- `assets/site.css` - all styles and the colour tokens.
-- `assets/theme.js`, `assets/site.js` - the only scripts.
-- `assets/projects/` - reels, posters and stills of the two games.
-- `tools/deploy.sh`, `.github/workflows/deploy.yml` - the deploy to `gh-pages`.
-- `/sealed/<site>/` (only on `gh-pages`) - encrypted sites that the sealed admin app (`Tim-Conrad/sealed`) pushes. Their login page uses `assets/site.css` (`.sealed`).
-- `tools/reels/` - the scripts that film the games and cut the reels, and `timeline.mjs` with its stages file, which films the timeline clips.
-- `assets/projects/timeline/` - the timeline clips and posters of the game pages.
+- `python3 tools/check.py`: the Content-Security-Policy rules and the sitemap of every page. CI runs it on pull requests and before each deploy.
+- After a change to a page, a style or any wording: serve the site (`python3 -m http.server 8000` in the repository root; all paths are absolute) and look at it at 1440, 390 and 320 px wide, in the light and the dark theme. The page must not scroll sideways, and the browser console must show no errors.
+- Show what you ran and what you saw, not only "it works".
 
 ## Rules for every task
 
-- Follow `DESIGN.md`. The two rules that matter most: the site is black and white with colour only in pictures and videos, and the wording is plain with no slogans or overstatement.
+- Read `DESIGN.md` before you change a page, a style or any wording. The two rules that matter most: the site is black and white with colour only in pictures and videos, and the wording is plain with no slogans or overstatement.
 - Claim only what is true. Do not invent facts about Tim, the research or the games.
 - Do not rewrite the text of the write-up under `research/`. It is Tim's own.
-- A new blog post goes into `blog/<slug>/`, at the top of the list in `blog/index.html` and of the Blog section of `index.html`, and into `sitemap.xml`. Copy the `<head>` of the existing post, with its description and `article:published_time`: `llms.txt` and the RSS feed are made from them at deploy time (`tools/gen-feeds.py`). Do not commit those two files.
-- Keep the Content-Security-Policy of each page strict: no inline scripts or styles, no `style=""` attributes, and no request to another site on page load.
-- `master` is the source. Never edit `gh-pages` by hand: the workflow publishes it after every push to `master`, and the sealed admin app publishes `sealed/` on it. `tools/deploy.sh` must keep `sealed/`.
+- A new or revised thought: use the skill `adding-a-thought`. `llms.txt` and the feeds are made at deploy time (`tools/gen-feeds.py`); do not commit them.
+- Keep the Content-Security-Policy of each page strict: no inline scripts or styles, no `style=""` attributes, and no request to another site on page load. `assets/theme.js` and `assets/site.js` are the only scripts.
+- `master` is the source. Never edit `gh-pages` by hand: the workflow publishes it after every push to `master`, and the sealed admin app (`Tim-Conrad/sealed`) publishes encrypted sites to `sealed/` on it, a folder that exists only there. `tools/deploy.sh` must keep `sealed/`.
 - Classes and scripts that the sealed login page uses (`.sealed`, `.label`, `.btn`, `.nav`, `#theme-toggle`, `/assets/site.js`) are used by another repository too. Keep them, or change `client/themes/t7d/login.html` in sealed with them.
+- `blog/` and `CVE/` only redirect old addresses (the thoughts were a blog until November 2026). Do not add pages there.
 
-<important if="you change a page, a style, a component or any wording">
-Read `DESIGN.md` first. After the change, serve the site and look at it at 1440, 390 and 320 px wide, in the light and the dark theme. The page must not scroll sideways, and the browser console must show no errors.
-</important>
-
-<important if="you need to preview or check the site">
-Run `python3 -m http.server 8000` in the repository root and open `http://localhost:8000`. All paths are absolute, so serve from the root.
-</important>
-
-<important if="Tim mentions notes or feedback on the site, .review/notes/ has files, or you change tools/review/ or docker-compose.dev.yml">
-Tim writes notes on the review site: the tab »Note« at the right edge. The review site is this clone, served by `tools/review/devserver.py` in the container `t7d-review` (`docker-compose.dev.yml`, host name in `.env` as `REVIEW_HOST`). It shows the checked-out branch at once and loads the page again when a file changes. A note is a JSON file in `.review/notes/`.
-
-1. At the start of a session, list `.review/notes/*.json`. Tell Tim how many notes are open.
-2. Read the note: `note`, `path`, `viewport`, `theme`, `scroll`, `target` (`selector`, `text`, `rect`), `selection`, `branch`, `commit`.
-3. Run `uv run --no-project --with playwright python3 tools/review/show.py <id>` (more ids in one call). Look at `.review/notes/<id>.png`. The red frame is the part that Tim pointed at.
-4. Do the work with the rules of this file: a branch, `DESIGN.md`, the look at three widths.
-5. After the fix, run `show.py <id> --suffix after` and compare the two pictures.
-6. Add an `"answer"` field to the note: what changed, and the commit. Move the note to `.review/notes/done/`. Tim sees the answer under »My notes« in the tab.
-
-- Keep notes and their pictures out of git. `.review/` and `.env` are ignored.
-- A change to `devserver.py` needs `docker restart t7d-review`. A change to `review.js` or `review.css` needs only a page load.
-- The server adds only `connect-src 'self'` to the CSP of a page. Keep it that way, so that the review site keeps the rules of the real site.
-- Tests: `python3 -m unittest tools/review/test_devserver.py`.
-</important>
-
-<important if="you add a page, or a top-level file or folder that belongs to the site">
-- Copy the `<head>` of an existing page, with its Content-Security-Policy line.
-- Add the URL to `sitemap.xml`.
-- Add a new top-level file or folder to the `SITE` list in `tools/deploy.sh`, or it is not published.
-- Update "Contents" in the title block of `index.html` and the sheet numbers of its sections.
-</important>
-
-<important if="Kleinbahn or Wortzauber changed, or a reel, a poster, a still or a caption must change">
-Use the skill `updating-product-reels`. It needs the two game repositories (`Tim-Conrad/tiny-train` and `Tim-Conrad/wortzauber`) cloned next to this one.
+<important if="you show Tim a change for review">
+Show a changed page as a Claude artifact, not a local server: `python3 tools/preview-artifact.py <page folder> <out dir>` builds the bundle; publish `<out dir>/index.html` with the Artifact tool and pass the other printed files in `files`. Republish the same `file_path` after each change, so the link stays. The review site (skill `handling-review-notes`) is where Tim leaves notes on his own.
 </important>
 
-<important if="a game got new merged pull requests, or its timeline ("How it changed") must grow or a timeline clip must be filmed again">
-Use the skill `updating-game-timeline`. It films one clip per PR at that PR's merge commit and needs the game repository cloned next to this one, with its full history.
+<important if="Tim mentions notes or feedback on the review site, or you change tools/review/ or docker-compose.dev.yml">
+Use the skill `handling-review-notes`. A hook prints the number of open notes at the start of a session.
 </important>
 
 <important if="you deploy, or the live site does not show a change">
 See "Deploy" in `README.md`. GitHub Pages serves the `gh-pages` branch at https://t7d.dev.
-To merge a PR and see it live, run `tools/ship.sh <pr>` after the checks of the change. If it stops, read its last line, fix the cause, and run it again: a merged PR skips the merge.
+When Tim asks to ship a PR, run `tools/ship.sh <pr>` after the checks of the change. Merging publishes to t7d.dev, so do not run it unasked. If it stops, read its last line, fix the cause, and run it again: a merged PR skips the merge.
 </important>
diff --git a/DESIGN.md b/DESIGN.md
index 6dfd660..64d92e9 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -60,7 +60,7 @@ All fonts are in `assets/fonts/` (SIL Open Font License). Nothing loads from ano
 - **The sheet.** `body` is the sheet: at most 82 rem wide, centred, with a 1.5 px frame. Do not add a second frame inside it.
 - **Sections.** A full-width rule (`--rule`, 1.5 px) separates the sections. Lighter 1 px rules divide things inside a section.
 - **Section label.** Each section of the front page starts with a mono label, "Sheet 2 · Research", then an `h2`, then one short paragraph. The sheet numbers follow the page order, so renumber them when a section is added or moved.
-- **The front page stays short.** It says what exists and links to it: overview, the games, the latest blog posts, the research summary with a button to the write-up, the PGP key, contact. Details such as the attack steps and the disclosure timeline belong in the write-up, not here.
+- **The front page stays short.** It says what exists and links to it: overview, the games, the latest thoughts, the research summary with a button to the write-up, the PGP key, contact. Details such as the attack steps and the disclosure timeline belong in the write-up, not here.
 - **Title block.** The box next to the name lists site, contents, contact and the PGP fingerprint. It holds facts only. Update "Contents" when a write-up or a game is added.
 - **Grid.** The faint 48 px grid appears only behind the name on the front page. It is the one decorative element. Do not put it behind text blocks.
 - **Square corners.** Nothing has rounded corners or a shadow, except the phone frame, the step numbers and the dots of the timeline.
@@ -74,11 +74,13 @@ All fonts are in `assets/fonts/` (SIL Open Font License). Nothing loads from ano
 | Label | `.label` | Small upper-case mono text above a heading or a value. |
 | Facts | `.facts`, `.tb` | Label and value pairs. |
 | Code block | `.code` | Dark in both themes, with a bar for the file name and a copy button. |
-| Item box | `.proj` in `.projects` | The items of Games, Blog and Research on the front page all use it, so the sections look the same. One framed box per item, and the whole box is the link. In this order: a mono label, the name as a heading, a picture (a gameplay loop, a screenshot, or for a post an inline SVG cover), one or two plain sentences, the link text ("Details and live demo", "Read the post", "Read the write-up"). |
+| Item box | `.proj` in `.projects` | The items of Games, Thoughts and Research on the front page all use it, so the sections look the same. One framed box per item, and the whole box is the link. In this order: a mono label, the name as a heading, a picture (a gameplay loop, a screenshot, or for a thought an inline SVG cover), one or two plain sentences, the link text ("Details and live demo", "Read the thought", "Read the write-up"). |
 | Video | `.player` | A silent loop with a poster. It plays while it is on screen. The only controls are one icon button (two bars to pause, a triangle to play) and a 2 px progress line. The button fades out while the video plays and comes back on hover, on keyboard focus and when paused; on touch screens it stays faintly visible. Controls on a video use `--video-bg` and `--video-fg`, black and white in both themes, so they read on any footage. No sound, no native browser controls. |
 | Live demo | `.phone`, `[data-demo]` | Loads the game from its own host only after a tap. The note below says so. |
 | Timeline | `.changes`, `.tl` | On a game page: one entry per merged pull request that changed play, newest first, on a vertical ink line with a dot per entry (the newest dot filled). Each entry: a mono label with date and PR, the title as `h3`, one sentence on what the clip shows, a short list of the other changes, and the silent clip (the video component) beside the text. One line at the end names the PRs that are not shown. |
-| Post list | `.posts` | On the front page and `/blog/`: date as a label, the title underlined, one sentence. Newest first. |
+| Post list | `.posts` | On `/thoughts/`: date as a label and the status, the title underlined, one sentence. Newest first. |
+| Thought | `.tmeta`, `.status` | A page in `/thoughts/<slug>/`: an idea Tim works through and comes back to. Under the title: Status (`Draft`, `Settled` or `Changed my mind`), Started, Last revised. At the end, in this order: Open questions (if any), Starting points (the links the thought began with), Sources, Revisions (`.dates`: date and what changed), Feedback (what people answered when it was shared, and what it changed; "Not shared yet" until then). |
+| Animated diagram | `figure.anim` | Inline SVG that moves: lines draw (`.draw`), bars grow (`.grow`, `.grow-l`), parts appear (`.pop`, delays `.d1`-`.d8`) and numbers count up (`[data-count]`) once the figure comes on screen; a token can run along a path (`<animateMotion>`) while it is on screen, with a Pause button. `data-switch="A|B"` adds two buttons that switch the figure between two states (`.w-a`/`.w-b` show, `.hi-a`/`.hi-b` stay strong, `.off-b` fades). `[data-pick]` parts are buttons that show their item of `.pick__list` in a `.pick__panel`. A wide drawing (`.dg-w`) can have a narrow one for phones (`.dg-n`, below 600 px) instead of scrolling. Without the script, the end state and the whole list show. |
 | Diagram | `.dg` in a `figure` | Inline SVG drawn only with the classes in `site.css` (`.bx`, `.bx-s`, `.bx-i`, `.ln`, `.t-h`, `.t-s`, ...), which use the colour tokens, so a diagram follows the theme. Give it `<title>` and `<desc>`. In a `.fig-wide` figure it scrolls inside its box on a phone instead of shrinking the text. No colours, no `style` attributes. |
 | Diagram with steps | `figure[data-steps]`, `.steps__list` | A diagram whose parts carry `data-step="n"`, with one list item per step. The list sits in a box joined to the bottom of the diagram (`.steps__panel`, surface colour). `site.js` puts the step number, the text of the step and Back, Next and Play into that box and shows one step at a time: earlier steps faint, later ones nearly hidden. Without the script the box holds the whole numbered list. Use it where a process has an order; keep a still diagram where it has none. |
 | Encrypted site login | `.sealed` | The login page of a site below `/sealed/`, written by sealed (theme `t7d`). Label "Encrypted", the title as `h1`, one hint, username, password, one filled button "Open", a mono status line. Inputs are framed in ink with square corners. |
@@ -89,7 +91,7 @@ All fonts are in `assets/fonts/` (SIL Open Font License). Nothing loads from ano
 - **Links are underlined.** Colour cannot mark a link here.
 - **Keyboard focus is visible**: a 3 px ink outline.
 - **Phone first.** Check each change at 1440, 390 and 320 px wide, in both themes. The page must not scroll sideways. Wide tables and code scroll inside their own box.
-- **Motion.** The interface does not move, apart from smooth scrolling to a section. The exceptions are recordings of real things: the videos, which loop silently and do not start by themselves for a visitor who asked for reduced motion, and the gameplay loop in a game box: a short animated WebP of the real game, loaded lazily. A visitor who asked for reduced motion gets a still instead, through the `<picture>` element. The other exception is a diagram with steps in a post: it changes only when the reader presses Back, Next or Play, never by itself, and without fades for a visitor who asked for reduced motion.
+- **Motion.** The interface does not move, apart from smooth scrolling to a section. The exceptions are recordings of real things: the videos, which loop silently and do not start by themselves for a visitor who asked for reduced motion, and the gameplay loop in a game box: a short animated WebP of the real game, loaded lazily. A visitor who asked for reduced motion gets a still instead, through the `<picture>` element. The other exceptions are diagrams in a thought. A diagram with steps changes only when the reader presses Back, Next or Play. An animated diagram (`figure.anim`) plays its drawing once when it comes on screen, and a running token moves only while the figure is on screen and stops with its Pause button. Animation explains something in the diagram; it is never decoration. A visitor who asked for reduced motion gets the end state at once, and the running token stands still until Play.
 - **Pictures.** Give every picture `width`, `height` and a plain `alt` text that describes what it shows.
 
 ## Where things are
diff --git a/README.md b/README.md
index b7fb95e..b8ddef4 100644
--- a/README.md
+++ b/README.md
@@ -8,14 +8,16 @@ It is plain HTML, CSS and a little JavaScript. There is no build step and no dep
 
 | Page | Path | Content |
 | --- | --- | --- |
-| Front page | `/` | Overview, the two games, the latest blog posts, the CVE summary, the PGP key, contact |
-| Blog | `/blog/` | List of posts; each post in `/blog/<slug>/` |
-| Post | `/blog/encrypted-patches/` | Encrypted patches, unlocked on patch day (three inline SVG diagrams) |
+| Front page | `/` | Overview, the two games, the latest thoughts, the CVE summary, the PGP key, contact |
+| Thoughts | `/thoughts/` | Ideas I work through and come back to; each in `/thoughts/<slug>/` with a status, sources, revisions and feedback |
+| Thought | `/thoughts/humans-md/` | A humans.md for working with models (animated diagrams, the file `HUMANS.md` to download) |
+| Thought | `/thoughts/encrypted-patches/` | Encrypted patches, unlocked on patch day (inline SVG diagrams) |
 | Write-up | `/research/cve-2022-46166/` | CVE-2022-46166: template injection in Spring Boot Admin |
 | Kleinbahn | `/projects/kleinbahn/` | Reel, live demo from `tiny-train.beacon.host`, features, stills |
 | Wortzauber | `/projects/wortzauber/` | Reel, live demo from `wortzauber.beacon.host`, features, stills |
 | llms.txt | `/llms.txt` | A summary of the site for language models (llmstxt.org format), made at deploy time |
-| RSS feed | `/blog/feed.xml` | The blog posts, newest first, made at deploy time |
+| RSS feed | `/thoughts/feed.xml` | The thoughts, newest first, made at deploy time. `/blog/feed.xml` is the same feed for readers of the old address |
+| Old blog URLs | `/blog/`, `/blog/encrypted-patches/` | Redirect to `/thoughts/` |
 | PGP key | `/key.asc` | Public key, fingerprint `A886 6CB1 6B07 9685 5615 74B2 A91D ABBE C996 7390` |
 | Old write-up URL | `/CVE/CVE-2022-46166/` | Redirects to the new write-up address |
 | Encrypted sites | `/sealed/<site>/` | Private games and files, encrypted with [sealed](https://github.com/Tim-Conrad/sealed). A login page, then the browser decrypts the site. Not linked, not in the sitemap, kept out of search engines by `robots.txt` |
@@ -25,10 +27,11 @@ It is plain HTML, CSS and a little JavaScript. There is no build step and no dep
 | Path | What it is |
 | --- | --- |
 | `index.html`, `404.html` | Front page and not-found page |
-| `research/`, `projects/`, `blog/`, `CVE/` | One folder with an `index.html` per page |
+| `research/`, `projects/`, `thoughts/` | One folder with an `index.html` per page |
+| `blog/`, `CVE/` | Redirects from old addresses |
 | `assets/site.css` | All styles and the colour tokens of both themes |
 | `assets/theme.js` | Applies the saved theme before the first paint |
-| `assets/site.js` | Theme toggle, copy buttons, the table of contents, the tap-to-play demo |
+| `assets/site.js` | Theme toggle, copy buttons, the table of contents, the tap-to-play demo, diagrams with steps and animated diagrams |
 | `assets/fonts/` | Site fonts (SIL Open Font License, see `OFL.txt`) |
 | `assets/img/` | Pictures and the recording of the write-up |
 | `assets/projects/` | Reels, posters, stills, phone pictures and gameplay loops of the two games |
@@ -36,12 +39,19 @@ It is plain HTML, CSS and a little JavaScript. There is no build step and no dep
 | `CNAME`, `.nojekyll`, `robots.txt`, `sitemap.xml` | Hosting and crawler files |
 | `tools/deploy.sh` | Publishes the site files to `gh-pages` |
 | `tools/ship.sh` | Merges a PR, waits for the deploy and checks t7d.dev |
+| `tools/preview-artifact.py` | Builds a page as a Claude artifact bundle, for a review before it is published |
 | `tools/reels/` | Scripts that film the two games and cut the reels |
 | `tools/review/`, `docker-compose.dev.yml` | The review site: live reload and a note tab. Never published |
 | `.github/workflows/deploy.yml` | Runs the deploy on every push to `master` |
 | `DESIGN.md` | How the site looks and sounds: colours, type, layout, components and the wording rules |
 | `CLAUDE.md` | Instructions for Claude Code in this repository |
 | `.claude/skills/updating-product-reels/` | Working guide for Claude Code: how to take the reels and pictures again |
+| `.claude/skills/adding-a-thought/` | Working guide for Claude Code: how to turn a link into a new thought, and how to revise one |
+| `.claude/skills/updating-game-timeline/` | Working guide for Claude Code: how to film the timeline clips of a game page |
+| `.claude/skills/handling-review-notes/` | Working guide for Claude Code: how to handle Tim's notes from the review site |
+| `.claude/rules/pages.md` | Rules for a new page; Claude Code loads them only when it works on an HTML page, the sitemap or the deploy script |
+| `.claude/settings.json` | A hook that prints the number of open review notes at the start of a session |
+| `tools/check.py` | Checks the CSP rules and the sitemap of every page; CI runs it |
 
 ## Preview locally
 
@@ -71,7 +81,7 @@ GitHub Pages serves the `gh-pages` branch at <https://t7d.dev>. `master` is the
 
 1. Merge a change into `master`.
 2. The workflow `.github/workflows/deploy.yml` runs `tools/deploy.sh`.
-3. The script copies the site files of that commit to `gh-pages`, writes `llms.txt` and `blog/feed.xml` from the pages with `tools/gen-feeds.py`, and pushes. `tools/`, `.claude/`, `.github/` and this README stay on `master`.
+3. The script copies the site files of that commit to `gh-pages`, writes `llms.txt` and the feeds from the pages with `tools/gen-feeds.py`, and pushes. `tools/`, `.claude/`, `.github/` and this README stay on `master`.
 
 To ship a pull request in one step, run `tools/ship.sh [<pr>]`. It merges the PR, puts this clone on `master`, waits for the deploy and the Pages build, and checks that t7d.dev serves each site file of the PR. It runs no checks: look at the pages first.
 
@@ -108,6 +118,4 @@ Each product page allows exactly one frame host. Add the new host to `frame-src`
 
 ### Design and wording
 
-The site is black ink on white paper (white on black in the dark theme), with a thin frame and a small label per section. The only colour is in the pictures and videos. Every colour is a token at the top of `assets/site.css`.
-
-The wording is plain. Say what a thing is and what it does. No slogans, no superlatives, and nothing the site does not hold.
+See `DESIGN.md`.
diff --git a/assets/site.css b/assets/site.css
index cff8cdf..b42d33e 100644
--- a/assets/site.css
+++ b/assets/site.css
@@ -355,6 +355,62 @@ blockquote { margin: 0; padding: .2rem 0 .2rem 1.2rem; border-left: 3px solid va
 @media (prefers-reduced-motion: reduce) { .dg [data-step] { transition: none; } }
 .fig-wide .dg { min-width: 34rem; }
 
+/* ---------- thoughts: status, dates, revisions ---------- */
+.tmeta { margin: 0; display: flex; flex-wrap: wrap; gap: .5rem 2rem; padding-top: .9rem; border-top: 1px solid var(--soft); }
+.tmeta div { display: grid; gap: .15rem; }
+.tmeta dt { font: 500 .68rem/1.4 var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--muted); }
+.tmeta dd { margin: 0; font: 500 .875rem/1.5 var(--mono); }
+.status { display: inline-block; font: 500 var(--step--1)/1 var(--mono); letter-spacing: .08em; text-transform: uppercase; padding: .3rem .45rem; border: 1px solid var(--ink); color: var(--ink); }
+.posts__meta { display: flex; flex-wrap: wrap; gap: .5rem 1rem; align-items: center; }
+.code pre.wrap-lines { white-space: pre-wrap; overflow-wrap: anywhere; }
+
+/* ---------- animated diagrams (site.js): figure.anim
+   site.js adds .anim--ready, then .is-in when the figure comes on screen: .draw lines draw, .grow / .grow-l bars grow, .pop parts appear (.d1-.d8 delay them).
+   data-state="a" / "b" from the switch buttons: .w-a shows in state a, .w-b in state b, .hi-a / .hi-b stay strong, the rest fades.
+   [data-pick] parts are buttons: they show their item of .pick__list. A visitor who asked for less motion gets the end state. */
+.anim--ready .draw { stroke-dasharray: 1; stroke-dashoffset: 1; transition: stroke-dashoffset 1.4s cubic-bezier(.6,0,.2,1); }
+.anim--ready .grow, .anim--ready .grow-l { transform: scaleX(0); transform-box: fill-box; transform-origin: left center; transition: transform 1.1s cubic-bezier(.3,0,.1,1); }
+.anim .grow-l { transform-origin: right center; transform-box: fill-box; }
+.anim--ready .pop { opacity: 0; transform: scale(.6); transform-box: fill-box; transform-origin: center; transition: opacity .5s ease, transform .6s cubic-bezier(.3,1.4,.5,1); }
+.anim--ready.is-in .draw { stroke-dashoffset: 0; }
+.anim--ready.is-in .grow, .anim--ready.is-in .grow-l, .anim--ready.is-in .pop { transform: none; opacity: 1; }
+.anim .d1 { transition-delay: .15s; } .anim .d2 { transition-delay: .3s; } .anim .d3 { transition-delay: .45s; } .anim .d4 { transition-delay: .6s; }
+.anim .d5 { transition-delay: .75s; } .anim .d6 { transition-delay: .9s; } .anim .d7 { transition-delay: 1.05s; } .anim .d8 { transition-delay: 1.2s; }
+.anim .w-a, .anim .w-b, .anim .fade { transition: opacity .5s ease; }
+.anim[data-state="a"] .w-b, .anim[data-state="b"] .w-a, .anim:not([data-state]) .w-b { opacity: 0; pointer-events: none; }
+.anim[data-state="a"] .hi-b, .anim[data-state="b"] .hi-a { opacity: .2; }
+.anim[data-state="b"] .off-b { opacity: .22; }
+.anim .lvl { transform-box: fill-box; transform-origin: left center; transition: transform .9s cubic-bezier(.3,0,.1,1); }
+.anim .lvl.s20 { transform: scaleX(.2); } .anim .lvl.s30 { transform: scaleX(.3); } .anim .lvl.s100 { transform: scaleX(1); }
+.anim[data-state="b"] .lvl.b100 { transform: scaleX(1); } .anim[data-state="b"] .lvl.b10 { transform: scaleX(.1); }
+.anim [data-pick] { cursor: pointer; pointer-events: bounding-box; }
+.anim [data-pick] .bx, .anim [data-pick] text { transition: fill .25s ease; }
+.anim [data-pick]:hover .bx, .anim [data-pick].is-on .bx { fill: var(--ink); }
+.anim [data-pick]:hover text, .anim [data-pick].is-on text { fill: var(--bg); }
+.anim [data-pick]:focus { outline: none; }
+.anim [data-pick]:focus-visible .bx { stroke-width: 4; }
+.anim .dot-pick { transition: r .25s ease; }
+.anim [data-pick]:hover .dot-pick, .anim [data-pick].is-on .dot-pick { r: 13; }
+.anim [data-pick]:hover .t-pick, .anim [data-pick].is-on .t-pick { fill: var(--ink); font-weight: 700; }
+.anim__bar { display: flex; flex-wrap: wrap; align-items: center; gap: .5rem; }
+.anim__bar .btn[aria-pressed="true"] { background: var(--ink); color: var(--bg); }
+.pick__panel { border: var(--rule) solid var(--ink); background: var(--surface); padding: .9rem 1rem 1rem; display: grid; gap: .55rem; margin-top: calc(var(--rule) * -1 - .6rem); }
+.pick__list { margin: 0; padding-left: 1.3rem; display: grid; gap: .3rem; font-size: .9688rem; line-height: 1.5; }
+.pick--on .pick__list { list-style: none; padding-left: 0; }
+.pick--on .pick__list li { display: none; }
+.pick--on .pick__list li.is-now { display: block; }
+.pick__list b { font-family: var(--display); font-size: 1.15rem; font-weight: 600; }
+.prose .pick__list a { display: inline; border: 0; background: none; }
+.prose .pick__list a:hover { background: var(--ink); color: var(--bg); outline: 0; }
+.pick__hint { margin: 0; font-size: .9688rem; color: var(--muted); }
+.pick__hint[hidden] { display: none; }
+/* a figure can hold a wide drawing (.dg-w) and a narrow one for phones (.dg-n) */
+.anim .dg-n { display: none; }
+@media (max-width: 600px) { .anim .dg-w { display: none; } .anim .dg-n { display: block; } .fig-wide.anim { overflow-x: visible; } .fig-wide .dg-n { min-width: 0; } }
+@media (prefers-reduced-motion: reduce) {
+  .anim .draw, .anim .grow, .anim .grow-l, .anim .pop, .anim .w-a, .anim .w-b, .anim .fade, .anim .lvl { transition: none; }
+}
+
 /* ---------- 404 ---------- */
 .lost { min-height: 60vh; display: grid; align-content: center; gap: 1.25rem; padding-block: 3rem; }
 .lost h1 { font-size: clamp(5rem, 22vw, 14rem); line-height: .85; }
diff --git a/assets/site.js b/assets/site.js
index d7ee269..938ceb5 100644
--- a/assets/site.js
+++ b/assets/site.js
@@ -158,6 +158,107 @@
     show(0);
   });
 
+  /* ---- animated diagrams: figure.anim (styles in site.css)
+     - on screen: the figure gets .is-in once, so its lines draw and its bars grow; [data-count] numbers count up.
+     - data-switch="Label A|Label B": two buttons set data-state="a" / "b". With data-switch-free the state starts empty
+       and a second press on the pressed button clears it.
+     - [data-pick="k"] parts of the SVG become buttons that show the item li[data-k="k"] of .pick__list.
+     - SVG animations (<animateMotion>) run only while the figure is on screen, with a Pause button. A visitor who asked
+       for less motion gets the end state, and the moving parts stand still until Play. Without the script the figure
+       shows its end state and the whole list. ---- */
+  $$('figure.anim').forEach(function (fig) {
+    fig.classList.add('anim--ready');
+    /* a figure can hold a wide and a narrow drawing; both follow the same state */
+    var svgs = $$('svg', fig).filter(function (s) { return typeof s.pauseAnimations === 'function' && $('animateMotion, animate, animateTransform', s); });
+    var counts = $$('[data-count]', fig);
+    var looping = svgs.length > 0;
+    var bar = null;
+    function getBar() {
+      if (bar) return bar;
+      bar = document.createElement('div'); bar.className = 'anim__bar';
+      var panel = $('.pick__panel', fig), cap = $('figcaption', fig);
+      if (panel) panel.appendChild(bar); else fig.insertBefore(bar, cap || null);
+      return bar;
+    }
+    function button(text) {
+      var b = document.createElement('button'); b.type = 'button'; b.className = 'btn btn--ghost btn--s';
+      b.textContent = text; getBar().appendChild(b); return b;
+    }
+
+    /* counting numbers: they start at zero only when the script runs, so the page without it shows the real values */
+    function fmt(el, v) { el.textContent = (el.getAttribute('data-fmt') || '{}').replace('{}', String(v)); }
+    function count() {
+      counts.forEach(function (el) {
+        var to = +el.getAttribute('data-count'), t0 = null, dur = 1100;
+        if (still) { fmt(el, to); return; }
+        function tick(t) {
+          if (t0 === null) t0 = t;
+          var k = Math.min(1, (t - t0) / dur);
+          fmt(el, Math.round(to * (1 - Math.pow(1 - k, 3))));
+          if (k < 1) requestAnimationFrame(tick);
+        }
+        requestAnimationFrame(tick);
+      });
+    }
+
+    /* switch between two states */
+    var sw = fig.getAttribute('data-switch');
+    if (sw) {
+      var free = fig.hasAttribute('data-switch-free'), btns = [];
+      var setState = function (k) {
+        if (k) fig.setAttribute('data-state', k); else fig.removeAttribute('data-state');
+        btns.forEach(function (b, i) { b.setAttribute('aria-pressed', String(['a', 'b'][i] === k)); });
+      };
+      sw.split('|').slice(0, 2).forEach(function (name, i) {
+        var k = ['a', 'b'][i], b = button(name);
+        b.addEventListener('click', function () { setState(free && fig.getAttribute('data-state') === k ? null : k); });
+        btns.push(b);
+      });
+      setState(free ? null : 'a');
+    }
+
+    /* pick a part of the diagram to read about it */
+    var picks = $$('[data-pick]', fig), items = $$('.pick__list li', fig);
+    if (picks.length && items.length) {
+      fig.classList.add('pick--on');
+      var hint = $('.pick__hint', fig);
+      var choose = function (k) {
+        picks.forEach(function (p) { p.classList.toggle('is-on', p.getAttribute('data-pick') === k); });
+        items.forEach(function (li) { li.classList.toggle('is-now', li.getAttribute('data-k') === k); });
+        if (hint) hint.hidden = true;
+      };
+      picks.forEach(function (p) {
+        var k = p.getAttribute('data-pick');
+        var li = items.filter(function (x) { return x.getAttribute('data-k') === k; })[0], name = li && $('b', li);
+        p.setAttribute('tabindex', '0'); p.setAttribute('role', 'button');
+        p.setAttribute('aria-label', 'Show: ' + (name ? name.textContent : k));
+        p.addEventListener('click', function () { choose(k); });
+        p.addEventListener('keydown', function (e) { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); choose(k); } });
+      });
+    }
+
+    /* SVG animations run only while the figure is on screen */
+    var wanted = !still, seen = false, loopBtn = null;
+    function run() { svgs.forEach(function (s) { if (wanted && seen) s.unpauseAnimations(); else s.pauseAnimations(); }); }
+    function paintLoop() {
+      loopBtn.textContent = wanted ? 'Pause' : 'Play';
+      loopBtn.setAttribute('aria-label', (wanted ? 'Pause' : 'Play') + ' the animation');
+    }
+    if (looping) {
+      run();
+      loopBtn = button('Pause');
+      loopBtn.addEventListener('click', function () { wanted = !wanted; paintLoop(); run(); });
+      paintLoop();
+    }
+
+    function enter() { if (!fig.classList.contains('is-in')) { fig.classList.add('is-in'); count(); } }
+    if (still || !('IntersectionObserver' in window)) { enter(); seen = true; run(); return; }
+    counts.forEach(function (el) { fmt(el, 0); });
+    new IntersectionObserver(function (es) {
+      es.forEach(function (e) { seen = e.isIntersecting; if (seen) enter(); run(); });
+    }, { threshold: 0.3 }).observe(fig);
+  });
+
   /* ---- 404: show the path that missed ---- */
   var lost = $('#lost-path');
   if (lost) lost.textContent = location.pathname;
diff --git a/blog/encrypted-patches/index.html b/blog/encrypted-patches/index.html
index b0282e8..59256d8 100644
--- a/blog/encrypted-patches/index.html
+++ b/blog/encrypted-patches/index.html
@@ -2,436 +2,12 @@
 <html lang="en">
 <head>
 <meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; font-src 'self'; media-src 'self'; base-uri 'none'; form-action 'none'">
-<title>Encrypted patches, unlocked on patch day · Tim Conrad</title>
-<meta name="description" content="Ship a security fix early as ciphertext and publish the key at release time, so teams can stage it and apply it together instead of racing attackers. What games already do, a design with signed keys, open source in private, the air-gapped case and the patents.">
-<link rel="canonical" href="https://t7d.dev/blog/encrypted-patches/">
-<meta property="og:type" content="article">
-<meta property="og:title" content="Encrypted patches, unlocked on patch day">
-<meta property="og:description" content="Ship a security fix early as ciphertext and publish the key at release time, so teams can stage it and apply it together instead of racing attackers. What games already do, a design with signed keys, open source in private, the air-gapped case and the patents.">
-<meta property="og:url" content="https://t7d.dev/blog/encrypted-patches/">
-<meta property="og:image" content="https://t7d.dev/assets/og.png">
-<meta property="article:published_time" content="2026-11-10">
-<meta name="twitter:card" content="summary_large_image">
-<link rel="alternate" type="application/rss+xml" title="Tim Conrad · Blog" href="/blog/feed.xml">
-<link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
-<link rel="preload" href="/assets/fonts/barlow-condensed-700.woff2" as="font" type="font/woff2" crossorigin>
-<link rel="stylesheet" href="/assets/site.css">
-<script src="/assets/theme.js"></script>
-<script src="/assets/site.js" defer></script>
+<title>This post has moved · Tim Conrad</title>
+<meta name="robots" content="noindex">
+<link rel="canonical" href="https://t7d.dev/thoughts/encrypted-patches/">
+<meta http-equiv="refresh" content="0; url=/thoughts/encrypted-patches/">
 </head>
 <body>
-<a class="skip" href="#main">Skip to content</a>
-
-<header class="nav">
-  <div class="wrap nav__in">
-    <a class="brand" href="/">Tim Conrad</a>
-    <nav class="nav__links" aria-label="Site">
-      <a href="/#games">Games</a>
-      <a href="/blog/">Blog</a>
-      <a class="opt3" href="/#research">Research</a>
-      <a class="opt2" href="/#verify">PGP key</a>
-      <a class="opt2" href="/#contact">Contact</a>
-    </nav>
-    <button class="toggle" id="theme-toggle" type="button">dark</button>
-  </div>
-</header>
-
-<main id="main" class="wrap">
-
-<header class="post-head">
-  <a class="crumb" href="/blog/">← Blog</a>
-  <h1>Encrypted patches, unlocked on patch day</h1>
-  <p class="sub">Ship the fix early as ciphertext and publish the key at release time. Teams stage it in advance and apply it at the same moment, instead of racing attackers.</p>
-  <p class="label">Tim Conrad · <time datetime="2026-11-10">10 Nov 2026</time> · Updates · Patch diffing · Key release</p>
-</header>
-
-<div class="post">
-  <nav class="toc" aria-label="On this page">
-    <p class="label">On this page</p>
-    <ol>
-      <li><a href="#problem">The problem</a></li>
-      <li><a href="#games">What games do</a></li>
-      <li><a href="#design">A design</a></li>
-      <li><a href="#beacon">Without a key server</a></li>
-      <li><a href="#airgap">Air-gapped sites</a></li>
-      <li><a href="#oss">Open source in private</a></li>
-      <li><a href="#limits">What it does not fix</a></li>
-      <li><a href="#prior">Prior art and patents</a></li>
-      <li><a href="#sources">Sources</a></li>
-    </ol>
-  </nav>
-
-  <article class="prose">
-    <h2 id="problem">The problem</h2>
-    <p>A security fix tells an attacker where the bug was. That was always true. What changed in the last year is the price of turning a fix into an exploit.</p>
-    <p>Keycloak is a good example. Between November 2025 and November 2026 the project tagged 47 releases, about one every eight days, across four supported lines, and fixed at least 50 CVEs <a href="#s1">[1]</a>. In August 2026 one of them, CVE-2026-18963, let an unauthenticated attacker take over accounts through the password-reset flow <a href="#s2">[2]</a>. The fixed builds carry tag dates a week before the CVE was published <a href="#s1">[1]</a>, and the public fix is a small change of 57 added lines <a href="#s3">[3]</a>. A public proof of concept credits Claude for "research and PoC development assistance" and ships "the annotated patch diff" <a href="#s4">[4]</a>. A team that runs Keycloak has to patch every week, and every patch is a map for someone else.</p>
-    <p>The numbers behind that feeling are from 2026:</p>
-    <ul>
-      <li>Anthropic gave its Mythos Preview model only public patches. The first working Firefox exploit came less than an hour after the patch; Windows kernel exploits cost about $2,000 each. Its summary: "The binding constraint to N-days is now just a few thousand dollars and API access" <a href="#s5">[5]</a>.</li>
-      <li>Elastic found the bug behind a Windows patch "within minutes" of reading the diff with an LLM; the exploit took hours instead of weeks <a href="#s6">[6]</a>.</li>
-      <li>Google counted 141 exploited vulnerabilities from January to August 2026, more than in all of 2025, and puts the growth in "the rapid weaponization of n-days" <a href="#s7">[7]</a>. Mandiant's estimate for the mean time-to-exploit in 2025 is minus seven days <a href="#s8">[8]</a>, and Rapid7 measured a median of five days from publication to the CISA list of exploited bugs <a href="#s9">[9]</a>.</li>
-    </ul>
-    <p>Finding a new bug with AI works, but it is a search, and search costs. XBOW spent about $40,000 on API calls for a six-day campaign that produced a full Chrome exploit chain <a href="#s10">[10]</a>. Anthropic's OpenBSD campaign took about 1,000 runs for under $20,000, and the FFmpeg one about $10,000 <a href="#s11">[11]</a>. A patch removes the search: it says where to look.</p>
-    <figure class="fig-wide">
-      <svg class="dg" viewBox="0 0 760 330" role="img" aria-labelledby="d0t d0d">
-  <title id="d0t">What it costs: finding new bugs against exploiting patched ones</title>
-  <desc id="d0d">Log scale. Finding new bugs, per campaign: XBOW Chrome full chain about 40,000 dollars; Anthropic OpenBSD about 1,000 runs under 20,000 dollars; Anthropic FFmpeg about 10,000 dollars. Exploiting a patched bug, per exploit: Windows kernel exploit about 2,000 dollars; Linux kernel n-day under 1,000 dollars; Windows crash proof of concept about 120 dollars.</desc>
-  <line class="ln-s" x1="330.0" y1="56" x2="330.0" y2="300"/><text x="330.0" y="320" text-anchor="middle" class="t-s">$100</text><line class="ln-s" x1="463.3" y1="56" x2="463.3" y2="300"/><text x="463.3" y="320" text-anchor="middle" class="t-s">$1k</text><line class="ln-s" x1="596.7" y1="56" x2="596.7" y2="300"/><text x="596.7" y="320" text-anchor="middle" class="t-s">$10k</text><line class="ln-s" x1="730.0" y1="56" x2="730.0" y2="300"/><text x="730.0" y="320" text-anchor="middle" class="t-s">$100k</text>
-  <text x="20" y="46" class="t-h">Find new bugs · per campaign</text>
-  <text x="20" y="194" class="t-h">Exploit a patched bug · per exploit</text>
-  <text x="20" y="87">XBOW · Chrome full chain, 6 days</text><rect class="bx-i" x="330" y="72" width="346.9" height="22"/><text x="684.9" y="88" class="t-s">~$40k</text>
-  <text x="20" y="119">Anthropic · OpenBSD, ~1,000 runs</text><rect class="bx-i" x="330" y="104" width="306.8" height="22"/><text x="644.8" y="120" class="t-s"><$20k</text>
-  <text x="20" y="151">Anthropic · FFmpeg, some 100 runs</text><rect class="bx-i" x="330" y="136" width="266.7" height="22"/><text x="604.7" y="152" class="t-s">~$10k</text>
-  <text x="20" y="227">Windows kernel exploit, from patch</text><rect class="bx-s" x="330" y="212" width="173.5" height="22"/><text x="511.5" y="228" class="t-s">~$2k</text>
-  <text x="20" y="259">Linux kernel n-day exploit</text><rect class="bx-s" x="330" y="244" width="133.3" height="22"/><text x="471.3" y="260" class="t-s"><$1k</text>
-  <text x="20" y="291">Windows crash PoC, from patch</text><rect class="bx-s" x="330" y="276" width="10.6" height="22"/><text x="348.6" y="292" class="t-s">~$120</text>
-  
-</svg>
-      <figcaption>Fig. 1 · Cost per result on a log scale, from <a href="#s5">[5]</a>, <a href="#s10">[10]</a> and <a href="#s11">[11]</a>. Discovery is a whole campaign, the n-day rows are one exploit each. Some discovery is cheaper: depthfirst reports 21 FFmpeg bugs for about $1,000 <a href="#s12">[12]</a>.</figcaption>
-    </figure>
-    <p>The idea of this post: ship the fix days early, but encrypted. Teams download it, plan the change and stage it. At patch day T, only the key is published, and everyone applies the fix at the same moment. Nobody could diff it before T. The goal is not to win the race against the attackers, but to stop it from being a race.</p>
-    <figure class="fig-wide">
-      <svg class="dg" viewBox="0 0 760 300" role="img" aria-labelledby="d1t d1d">
-  <title id="d1t">Timeline: today and with an encrypted pre-load</title>
-  <desc id="d1d">Today the attacker can diff the patch as soon as the first host downloads it at T, while installs spread over weeks. With a pre-load, the encrypted bundle arrives in the week before T, the key arrives at T, and automatic updates install within minutes, while the attacker also only starts at T.</desc>
-  <line class="ln-s" x1="420" y1="34" x2="420" y2="262"/>
-  <text x="420" y="24" text-anchor="middle" class="t-h">T · patch day</text>
-  <text x="20" y="68" class="t-h">Today</text>
-  <rect class="bx-s" x="420" y="56" width="250" height="26"/>
-  <text x="432" y="73">installs spread over weeks</text>
-  <rect class="bx-i" x="426" y="92" width="150" height="26"/>
-  <text x="438" y="109" class="t-inv">diff → exploit</text>
-  <text x="588" y="109" class="t-s">from the first download</text>
-  <text x="140" y="73" class="t-s">nothing on the hosts yet</text>
-  <line class="ln" x1="20" y1="140" x2="740" y2="140"/>
-  <text x="20" y="176" class="t-h">Pre-load</text>
-  <rect class="bx-s" x="140" y="164" width="280" height="26"/>
-  <text x="152" y="181">encrypted bundle on every host</text>
-  <rect class="bx-i" x="420" y="164" width="22" height="26"/>
-  <text x="452" y="181" class="t-s">installed within minutes</text>
-  <rect class="bx-i" x="426" y="200" width="150" height="26"/>
-  <text x="438" y="217" class="t-inv">diff → exploit</text>
-  <text x="588" y="217" class="t-s">same start line</text>
-  <g transform="translate(409,236)"><circle class="bx" cx="6" cy="6" r="5"/><line class="ln" x1="11" y1="6" x2="22" y2="6"/><line class="ln" x1="18" y1="6" x2="18" y2="10"/></g>
-  <text x="402" y="246" text-anchor="end" class="t-s">32-byte key published</text>
-  <line class="ln" x1="140" y1="274" x2="700" y2="274"/>
-  <line class="ln" x1="140" y1="270" x2="140" y2="278"/><text x="140" y="292" text-anchor="middle" class="t-s">−7 days</text>
-  <line class="ln" x1="420" y1="268" x2="420" y2="280"/><text x="420" y="292" text-anchor="middle" class="t-s">T</text>
-  <line class="ln" x1="700" y1="270" x2="700" y2="278"/><text x="700" y="292" text-anchor="middle" class="t-s">+7 days</text>
-</svg>
-      <figcaption>Fig. 2 · With a pre-load, the attacker and the defenders start at the same moment, and hosts that update by themselves are done within minutes.</figcaption>
-    </figure>
-
-    <h2 id="games">What games do</h2>
-    <p>Games have done this for years. A pre-load puts the game on your disk before launch, and it opens only at release. Steam, as SteamDB describes it, encrypts each depot with AES-256 and one key that is the same for every user, so mirrors and caches can serve the same bytes, and only owners can ask for the key <a href="#s13">[13]</a>.</p>
-    <p>GTA Online shows the other side. Rockstar ships the content of later updates early inside earlier ones and switches it on from its servers. The files are encrypted, but the keys are in the game, so dataminers read upcoming cars and missions long before they go live. A server switch decides <em>when</em> something is available. It does not keep it <em>secret</em> while the key sits on the device.</p>
-    <p>For patches, four rules follow:</p>
-    <ul>
-      <li>The key is not on the device before T.</li>
-      <li>The device clock never opens anything. Only the published key does.</li>
-      <li>Everything is signed, and the client checks the ciphertext before T.</li>
-      <li>Decryption at T is cheap. One key, one pass.</li>
-    </ul>
-
-    <h2 id="design">A design</h2>
-    <p>The update frameworks TUF and Uptane already solve most of this: an offline root key, roles with narrow rights, thresholds of signatures, and protection against rollback and freeze attacks <a href="#s14">[14]</a><a href="#s15">[15]</a>. Uptane even names patch diffing as an attacker goal and can carry wrapped keys for encrypted images. What they lack is a key that is published later. The design adds one role for that.</p>
-    <ol>
-      <li><b>Pre-load.</b> Days before T, the vendor publishes the encrypted bundle as an ordinary target. The manifest with its hash, size and release time is signed by the targets role under the organisation's root key. Clients download it and check the hash.</li>
-      <li><b>Release.</b> At T a separate release role signs a short statement: patch id, hash of the ciphertext, the 32-byte content key. A threshold, say two of three officers, keeps one person from releasing early.</li>
-      <li><b>Log.</b> Every statement goes into an append-only transparency log, so a release before T, or a different key for some customers, can be seen <a href="#s16">[16]</a>.</li>
-      <li><b>Install.</b> The client checks the statement and the log entry, decrypts with the key and installs.</li>
-    </ol>
-    <figure class="fig-wide" data-steps>
-      <svg class="dg" viewBox="0 0 760 420" role="img" aria-labelledby="d2t d2d">
-  <title id="d2t">Who signs what</title>
-  <desc id="d2d">An offline organisation root key delegates to a targets role and a release role. Days before T the targets role signs a manifest with the hash of the encrypted bundle, and mirrors carry both. At T a release role, two of three officers, signs a key-release statement that is written to a transparency log. The client verifies the manifest, the bundle hash, the statement signature and the log entry, then decrypts and installs.</desc>
-  <text x="20" y="28" class="t-h">Organisation</text>
-  <text x="290" y="28" class="t-h">Mirrors and log</text>
-  <text x="560" y="28" class="t-h">Client</text>
-  <g data-step="1"><rect class="bx-i" x="20" y="44" width="220" height="54"/></g>
-  <g data-step="1"><text x="36" y="67" class="t-inv">org root key</text></g>
-  <g data-step="1"><text x="36" y="86" class="t-inv t-s">offline · delegates roles</text></g>
-  <g data-step="1"><line class="ln" x1="70" y1="98" x2="70.0" y2="135.0"/><polygon class="arr" points="70,140 66.9,132.6 73.1,132.6"/></g>
-  <g data-step="1"><line class="ln" x1="190" y1="98" x2="190.0" y2="257.0"/><polygon class="arr" points="190,262 186.9,254.6 193.1,254.6"/></g>
-  <g data-step="1"><rect class="bx" x="20" y="142" width="160" height="54"/></g>
-  <g data-step="1"><text x="36" y="165">targets role</text></g>
-  <g data-step="1"><text x="36" y="184" class="t-s">signs the manifest</text></g>
-  <g data-step="1"><rect class="bx" x="100" y="264" width="140" height="54"/></g>
-  <g data-step="1"><text x="114" y="287">release role</text></g>
-  <g data-step="1"><text x="114" y="306" class="t-s">2 of 3 officers</text></g>
-  <g data-step="2"><line class="ln" x1="180" y1="169" x2="283.0" y2="169.0"/><polygon class="arr" points="288,169 280.6,172.1 280.6,165.9"/></g>
-  <g data-step="2"><text x="196" y="160" class="t-s">−7 days</text></g>
-  <g data-step="4"><line class="ln" x1="240" y1="291" x2="283.0" y2="291.0"/><polygon class="arr" points="288,291 280.6,294.1 280.6,287.9"/></g>
-  <g data-step="4"><text x="250" y="282" class="t-s">at T</text></g>
-  <g data-step="2"><rect class="bx-s" x="290" y="142" width="220" height="54"/></g>
-  <g data-step="2"><text x="304" y="165">manifest + bundle</text></g>
-  <g data-step="2"><text x="304" y="184" class="t-s">hash, size, patch id, T</text></g>
-  <g data-step="4"><rect class="bx-i" x="290" y="264" width="220" height="54"/></g>
-  <g data-step="4"><text x="304" y="287" class="t-inv">key-release statement</text></g>
-  <g data-step="4"><text x="304" y="306" class="t-inv t-s">patch id, hash, key · 104 B</text></g>
-  <g data-step="4"><line class="ln" x1="400" y1="318" x2="400.0" y2="349.0"/><polygon class="arr" points="400,354 396.9,346.6 403.1,346.6"/></g>
-  <g data-step="4"><rect class="bx-d" x="290" y="356" width="220" height="46"/></g>
-  <g data-step="4"><text x="304" y="377">transparency log</text></g>
-  <g data-step="4"><text x="304" y="394" class="t-s">append only, public</text></g>
-  <g data-step="2"><line class="ln" x1="510" y1="169" x2="553.0" y2="169.0"/><polygon class="arr" points="558,169 550.6,172.1 550.6,165.9"/></g>
-  <g data-step="4"><line class="ln" x1="510" y1="291" x2="553.0" y2="291.0"/><polygon class="arr" points="558,291 550.6,294.1 550.6,287.9"/></g>
-  <g data-step="4"><path class="ln-s" d="M510 379 H534 V320 H558"/></g>
-  <g data-step="3"><rect class="bx" x="560" y="122" width="180" height="236"/></g>
-  <g data-step="3"><text x="576" y="150">1 check manifest</text></g>
-  <g data-step="3"><text x="590" y="166" class="t-s">against org key</text></g>
-  <g data-step="3"><text x="576" y="192">2 check bundle</text></g>
-  <g data-step="3"><text x="590" y="208" class="t-s">hash from manifest</text></g>
-  <g data-step="3"><text x="576" y="234">3 wait for T</text></g>
-  <g data-step="3"><text x="590" y="250" class="t-s">the key opens, not</text><text x="590" y="264" class="t-s">the clock</text></g>
-  <g data-step="5"><text x="576" y="286">4 check statement</text></g>
-  <g data-step="5"><text x="590" y="302" class="t-s">signature + log proof</text></g>
-  <g data-step="5"><text x="576" y="326">5 decrypt, install</text></g>
-  <g data-step="5"><text x="590" y="342" class="t-s">AES-GCM, key from 4</text></g>
-</svg>
-      <div class="steps__panel">
-        <ol class="steps__list">
-          <li>The organisation’s root key stays offline. It gives two roles their rights: one signs the manifest, the other releases keys.</li>
-          <li>Days before T the targets role signs the manifest, and mirrors carry it together with the encrypted bundle.</li>
-          <li>Every client checks the manifest against the organisation key and the bundle against the manifest. Then it waits; its clock opens nothing.</li>
-          <li>At T two of three release officers sign the key-release statement, and it goes into the public log.</li>
-          <li>The client checks the statement and its log entry, decrypts the bundle with the key and installs.</li>
-        </ol>
-      </div>
-      <figcaption>Fig. 3 · Two roles under one offline root. The release role can only publish keys for ciphertext that is already pinned, so a stolen release key cannot push code.</figcaption>
-    </figure>
-    <p>The statement is small and public, so any mirror, CDN or even DNS can carry it. That makes the release hard to block.</p>
-    <div class="code">
-      <div class="code__bar"><span>key-release statement, about 104 bytes</span></div>
-<pre><code>patch    8 B   id of the patch, points to its manifest entry
-key     32 B   AES-256-GCM content key
-sig     64 B   Ed25519 over patch id, ciphertext hash and key</code></pre>
-    </div>
-    <p>The signature covers the hash of the ciphertext from the manifest, so the key belongs to exactly one bundle. With a threshold, each officer adds a signature of 64 bytes.</p>
-
-    <h2 id="beacon">Without a key server</h2>
-    <p>The key server is the weak spot. It can go down at the wrong moment, someone can force it to wait, or someone can leak the key early. There is a way to release a key on time without any server of the vendor.</p>
-    <p>A public service called drand publishes a new signed number every three seconds, and each number has a sequence position. A group of independent organisations runs it together, the League of Entropy. No single member can make the number for a position alone: it takes enough of them together, and they make it only when that moment has come <a href="#s17">[17]</a>.</p>
-    <p>The trick: you can lock data to a number that does not exist yet. The vendor picks the position that falls on patch day T and locks the patch key to it. Until T nobody, the vendor included, can open the lock. At T drand publishes the number, and that number opens it. The free tool tlock does exactly this <a href="#s17">[17]</a>.</p>
-    <figure class="fig-wide" data-steps>
-      <svg class="dg" viewBox="0 0 760 380" role="img" aria-labelledby="d5t d5d">
-  <title id="d5t">How a drand number opens a patch key at patch day</title>
-  <desc id="d5d">Independent organisations make a new numbered value every three seconds; the value for a position exists only when enough of them have taken part, at that moment. Days before patch day the vendor locks the patch key to the value at position T, which does not exist yet. At T the organisations make that value, it is published, and anyone can use it to open the lock and install the patch.</desc>
-  <g data-step="3"><text x="20" y="34" class="t-h">League of Entropy</text></g>
-  <g data-step="3"><text x="250" y="34" class="t-s">independent organisations</text></g>
-  <g data-step="3"><rect class="bx" x="250" y="58" width="48" height="30"/><text x="274" y="78" text-anchor="middle" class="t-s">org A</text><rect class="bx" x="310" y="58" width="48" height="30"/><text x="334" y="78" text-anchor="middle" class="t-s">org B</text><rect class="bx" x="370" y="58" width="48" height="30"/><text x="394" y="78" text-anchor="middle" class="t-s">org C</text><rect class="bx" x="430" y="58" width="48" height="30"/><text x="454" y="78" text-anchor="middle" class="t-s">org D</text><rect class="bx" x="490" y="58" width="48" height="30"/><text x="514" y="78" text-anchor="middle" class="t-s">org E</text></g>
-  <g data-step="3"><line class="ln" x1="274" y1="88" x2="439.5" y2="165.9"/><polygon class="arr" points="444,168 436.0,167.7 438.7,162.0"/><line class="ln" x1="394" y1="88" x2="441.4" y2="163.8"/><polygon class="arr" points="444,168 437.5,163.4 442.7,160.1"/><line class="ln" x1="454" y1="88" x2="444.6" y2="163.0"/><polygon class="arr" points="444,168 441.8,160.3 448.0,161.1"/><line class="ln" x1="514" y1="88" x2="447.3" y2="164.2"/><polygon class="arr" points="444,168 446.5,160.4 451.2,164.5"/></g>
-  <g data-step="3"><line class="ln-s" x1="334" y1="88" x2="440.0" y2="165.1"/></g>
-  <g data-step="3"><text x="560" y="78" class="t-s">enough of them together</text></g>
-  <g data-step="3"><text x="560" y="94" class="t-s">make the value for T,</text></g>
-  <g data-step="3"><text x="560" y="110" class="t-s">only when T has come</text></g>
-  <g data-step="3"><text x="560" y="134" class="t-s">(B is not needed)</text></g>
-  <g data-step="1"><text x="20" y="195" class="t-h">drand values</text></g>
-  <g data-step="1"><rect class="bx-s" x="150" y="176" width="28" height="28"/><rect class="bx-s" x="190" y="176" width="28" height="28"/><rect class="bx-s" x="230" y="176" width="28" height="28"/><rect class="bx-s" x="270" y="176" width="28" height="28"/><rect class="bx-s" x="310" y="176" width="28" height="28"/><rect class="bx-s" x="350" y="176" width="28" height="28"/><rect class="bx-s" x="390" y="176" width="28" height="28"/><rect class="bx-d" x="470" y="176" width="28" height="28"/><rect class="bx-d" x="510" y="176" width="28" height="28"/><rect class="bx-d" x="550" y="176" width="28" height="28"/><rect class="bx-d" x="590" y="176" width="28" height="28"/><rect class="bx-d" x="630" y="176" width="28" height="28"/></g>
-  <g data-step="3"><rect class="bx-i" x="424" y="170" width="40" height="40"/><text x="444" y="195" text-anchor="middle" class="t-inv">T</text></g>
-  <g data-step="1"><text x="150" y="232" class="t-s">already published</text></g>
-  <g data-step="1"><text x="550" y="232" class="t-s">not made yet</text></g>
-  <g data-step="1"><text x="150" y="166" class="t-s">one every 3 seconds</text></g>
-  <g data-step="2"><rect class="bx" x="20" y="268" width="250" height="84"/></g>
-  <g data-step="2"><text x="36" y="290" class="t-h">Vendor · days before T</text></g>
-  <g data-step="2"><path class="ln" d="M40 314 V310 a5 5 0 0 1 10 0 V314"/><rect class="bx" x="36" y="314" width="18" height="13"/></g>
-  <g data-step="2"><text x="66" y="322">patch key, locked</text></g>
-  <g data-step="2"><text x="66" y="340" class="t-s">to the value at T</text></g>
-  <g data-step="2"><line class="ln-s" x1="240" y1="300" x2="425.5" y2="214.1"/><polygon class="arr" points="430,212 424.6,217.9 422.0,212.3"/></g>
-  <g data-step="4"><rect class="bx" x="490" y="268" width="250" height="84"/></g>
-  <g data-step="4"><text x="506" y="290" class="t-h">Everyone · at T</text></g>
-  <g data-step="4"><path class="ln" d="M510 314 V304 a5 5 0 0 1 10 0 V306"/><rect class="bx-i" x="506" y="314" width="18" height="13"/></g>
-  <g data-step="4"><text x="536" y="322">value T opens it</text></g>
-  <g data-step="4"><text x="536" y="340" class="t-s">patch key → install</text></g>
-  <g data-step="4"><line class="ln" x1="458" y1="212" x2="535.8" y2="263.3"/><polygon class="arr" points="540,266 532.1,264.5 535.6,259.3"/></g>
-</svg>
-      <div class="steps__panel">
-        <ol class="steps__list">
-          <li>drand makes a new value every three seconds. Values for later moments do not exist yet.</li>
-          <li>Days before T the vendor locks the patch key to the value at T. Nobody can open it now, the vendor included.</li>
-          <li>At T enough of the organisations together make the value for T. Not every one is needed.</li>
-          <li>The value is public. It opens the lock, and everyone installs the patch.</li>
-        </ol>
-      </div>
-      <figcaption>Fig. 4 · The lock points at a value that does not exist yet. Only the organisations together can make it, and only at T.</figcaption>
-    </figure>
-    <p>The vendor can use both ways at once: its own key server and the drand lock. Then the patch opens at T even if the vendor's server is down. Two limits remain:</p>
-    <ul>
-      <li>The vendor still makes the key before it locks it, so someone inside can still leak it.</li>
-      <li>Once locked, the key cannot be held back. If the fix turns out to be broken, it opens at T anyway.</li>
-    </ul>
-    <p>Check the chosen position before you publish. A wrong one, in the past, opens the patch at once.</p>
-
-    <h2 id="airgap">Air-gapped sites</h2>
-    <p>Offline networks already carry updates in on removable media. With a pre-load, the large part crosses days before T and can be checked against the organisation's key. At T only the key has to cross: the signed statement, or the 48-byte drand number for T, which the site checks against drand's public key, stored there in advance <a href="#s17">[17]</a>. Either fits in one QR code, which holds up to 2,953 bytes <a href="#s18">[18]</a>, or can be typed in as hex.</p>
-    <figure class="fig-wide">
-      <svg class="dg" viewBox="0 0 760 330" role="img" aria-labelledby="d3t d3d">
-  <title id="d3t">Updates for an air-gapped site</title>
-  <desc id="d3d">Days before T, the encrypted bundle and its signed manifest cross the air gap on removable media, gigabytes in size. At T only a key-release statement of about 104 bytes, or a 48-byte drand number, crosses, small enough for one QR code. The offline site checks both against pinned keys, then decrypts and installs.</desc>
-  <defs><pattern id="d3h" width="6" height="6" patternUnits="userSpaceOnUse" patternTransform="rotate(45)"><line class="hatch-p" x1="0" y1="0" x2="0" y2="6"/></pattern></defs>
-  <text x="20" y="28" class="t-h">Connected</text>
-  <text x="380" y="28" text-anchor="middle" class="t-h">Air gap</text>
-  <text x="740" y="28" text-anchor="end" class="t-h">Offline site</text>
-  <rect class="bx" x="20" y="44" width="190" height="262"/>
-  <text x="36" y="72">vendor mirror</text>
-  <text x="36" y="90" class="t-s">bundle, manifest</text>
-  <text x="36" y="196">key release</text>
-  <text x="36" y="214" class="t-s">vendor statement</text>
-  <text x="36" y="230" class="t-s">or drand number</text>
-  <rect class="gap" x="350" y="44" width="60" height="262"/>
-  <rect class="bx" x="550" y="44" width="190" height="262"/>
-  <text x="566" y="72">keys stored early</text>
-  <text x="566" y="90" class="t-s">org key</text>
-  <text x="566" y="106" class="t-s">drand public key</text>
-  <text x="566" y="196">at T</text>
-  <text x="566" y="214" class="t-s">verify offline</text>
-  <text x="566" y="230" class="t-s">decrypt, install</text>
-  <rect class="bx-s" x="250" y="66" width="260" height="70"/>
-  <text x="264" y="86" class="t-s">days before T</text>
-  <text x="264" y="106">USB or disc</text>
-  <text x="264" y="124" class="t-s">encrypted bundle · gigabytes</text>
-  <line class="ln" x1="210" y1="101" x2="243.0" y2="101.0"/><polygon class="arr" points="248,101 240.6,104.1 240.6,97.9"/><line class="ln" x1="510" y1="101" x2="543.0" y2="101.0"/><polygon class="arr" points="548,101 540.6,104.1 540.6,97.9"/>
-  <rect class="bx" x="262" y="164" width="236" height="122"/>
-  <text x="376" y="186" class="t-s">at T</text>
-  <g transform="translate(276,190)"><rect class="bx-i" x="0" y="0" width="28" height="28"/><rect class="qr-w" x="4" y="4" width="20" height="20"/><rect class="bx-i" x="8" y="8" width="12" height="12"/><rect class="bx-i" x="56" y="0" width="28" height="28"/><rect class="qr-w" x="60" y="4" width="20" height="20"/><rect class="bx-i" x="64" y="8" width="12" height="12"/><rect class="bx-i" x="0" y="56" width="28" height="28"/><rect class="qr-w" x="4" y="60" width="20" height="20"/><rect class="bx-i" x="8" y="64" width="12" height="12"/><rect class="dot" x="32" y="0" width="4" height="4"/><rect class="dot" x="36" y="0" width="4" height="4"/><rect class="dot" x="44" y="0" width="4" height="4"/><rect class="dot" x="32" y="4" width="4" height="4"/><rect class="dot" x="36" y="4" width="4" height="4"/><rect class="dot" x="44" y="4" width="4" height="4"/><rect class="dot" x="48" y="4" width="4" height="4"/><rect class="dot" x="32" y="8" width="4" height="4"/><rect class="dot" x="36" y="8" width="4" height="4"/><rect class="dot" x="40" y="8" width="4" height="4"/><rect class="dot" x="48" y="8" width="4" height="4"/><rect class="dot" x="32" y="12" width="4" height="4"/><rect class="dot" x="48" y="12" width="4" height="4"/><rect class="dot" x="36" y="16" width="4" height="4"/><rect class="dot" x="44" y="16" width="4" height="4"/><rect class="dot" x="48" y="16" width="4" height="4"/><rect class="dot" x="32" y="20" width="4" height="4"/><rect class="dot" x="36" y="20" width="4" height="4"/><rect class="dot" x="44" y="20" width="4" height="4"/><rect class="dot" x="36" y="24" width="4" height="4"/><rect class="dot" x="44" y="24" width="4" height="4"/><rect class="dot" x="48" y="24" width="4" height="4"/><rect class="dot" x="32" y="28" width="4" height="4"/><rect class="dot" x="40" y="28" width="4" height="4"/><rect class="dot" x="44" y="28" width="4" height="4"/><rect class="dot" x="0" y="32" width="4" height="4"/><rect class="dot" x="4" y="32" width="4" height="4"/><rect class="dot" x="16" y="32" width="4" height="4"/><rect class="dot" x="36" y="32" width="4" height="4"/><rect class="dot" x="44" y="32" width="4" height="4"/><rect class="dot" x="48" y="32" width="4" height="4"/><rect class="dot" x="56" y="32" width="4" height="4"/><rect class="dot" x="64" y="32" width="4" height="4"/><rect class="dot" x="0" y="36" width="4" height="4"/><rect class="dot" x="16" y="36" width="4" height="4"/><rect class="dot" x="28" y="36" width="4" height="4"/><rect class="dot" x="36" y="36" width="4" height="4"/><rect class="dot" x="56" y="36" width="4" height="4"/><rect class="dot" x="60" y="36" width="4" height="4"/><rect class="dot" x="68" y="36" width="4" height="4"/><rect class="dot" x="72" y="36" width="4" height="4"/><rect class="dot" x="76" y="36" width="4" height="4"/><rect class="dot" x="80" y="36" width="4" height="4"/><rect class="dot" x="0" y="40" width="4" height="4"/><rect class="dot" x="8" y="40" width="4" height="4"/><rect class="dot" x="12" y="40" width="4" height="4"/><rect class="dot" x="16" y="40" width="4" height="4"/><rect class="dot" x="24" y="40" width="4" height="4"/><rect class="dot" x="28" y="40" width="4" height="4"/><rect class="dot" x="48" y="40" width="4" height="4"/><rect class="dot" x="52" y="40" width="4" height="4"/><rect class="dot" x="56" y="40" width="4" height="4"/><rect class="dot" x="68" y="40" width="4" height="4"/><rect class="dot" x="72" y="40" width="4" height="4"/><rect class="dot" x="76" y="40" width="4" height="4"/><rect class="dot" x="80" y="40" width="4" height="4"/><rect class="dot" x="8" y="44" width="4" height="4"/><rect class="dot" x="12" y="44" width="4" height="4"/><rect class="dot" x="16" y="44" width="4" height="4"/><rect class="dot" x="20" y="44" width="4" height="4"/><rect class="dot" x="48" y="44" width="4" height="4"/><rect class="dot" x="68" y="44" width="4" height="4"/><rect class="dot" x="72" y="44" width="4" height="4"/><rect class="dot" x="76" y="44" width="4" height="4"/><rect class="dot" x="0" y="48" width="4" height="4"/><rect class="dot" x="4" y="48" width="4" height="4"/><rect class="dot" x="8" y="48" width="4" height="4"/><rect class="dot" x="12" y="48" width="4" height="4"/><rect class="dot" x="16" y="48" width="4" height="4"/><rect class="dot" x="20" y="48" width="4" height="4"/><rect class="dot" x="24" y="48" width="4" height="4"/><rect class="dot" x="28" y="48" width="4" height="4"/><rect class="dot" x="32" y="48" width="4" height="4"/><rect class="dot" x="36" y="48" width="4" height="4"/><rect class="dot" x="40" y="48" width="4" height="4"/><rect class="dot" x="52" y="48" width="4" height="4"/><rect class="dot" x="56" y="48" width="4" height="4"/><rect class="dot" x="60" y="48" width="4" height="4"/><rect class="dot" x="64" y="48" width="4" height="4"/><rect class="dot" x="68" y="48" width="4" height="4"/><rect class="dot" x="80" y="48" width="4" height="4"/><rect class="dot" x="36" y="52" width="4" height="4"/><rect class="dot" x="40" y="52" width="4" height="4"/><rect class="dot" x="44" y="52" width="4" height="4"/><rect class="dot" x="48" y="52" width="4" height="4"/><rect class="dot" x="56" y="52" width="4" height="4"/><rect class="dot" x="60" y="52" width="4" height="4"/><rect class="dot" x="72" y="52" width="4" height="4"/><rect class="dot" x="80" y="52" width="4" height="4"/><rect class="dot" x="48" y="56" width="4" height="4"/><rect class="dot" x="52" y="56" width="4" height="4"/><rect class="dot" x="56" y="56" width="4" height="4"/><rect class="dot" x="72" y="56" width="4" height="4"/><rect class="dot" x="76" y="56" width="4" height="4"/><rect class="dot" x="52" y="60" width="4" height="4"/><rect class="dot" x="60" y="60" width="4" height="4"/><rect class="dot" x="64" y="60" width="4" height="4"/><rect class="dot" x="68" y="60" width="4" height="4"/><rect class="dot" x="72" y="60" width="4" height="4"/><rect class="dot" x="76" y="60" width="4" height="4"/><rect class="dot" x="36" y="64" width="4" height="4"/><rect class="dot" x="52" y="64" width="4" height="4"/><rect class="dot" x="56" y="64" width="4" height="4"/><rect class="dot" x="60" y="64" width="4" height="4"/><rect class="dot" x="64" y="64" width="4" height="4"/><rect class="dot" x="68" y="64" width="4" height="4"/><rect class="dot" x="32" y="68" width="4" height="4"/><rect class="dot" x="44" y="68" width="4" height="4"/><rect class="dot" x="64" y="68" width="4" height="4"/><rect class="dot" x="68" y="68" width="4" height="4"/><rect class="dot" x="76" y="68" width="4" height="4"/><rect class="dot" x="36" y="72" width="4" height="4"/><rect class="dot" x="40" y="72" width="4" height="4"/><rect class="dot" x="52" y="72" width="4" height="4"/><rect class="dot" x="56" y="72" width="4" height="4"/><rect class="dot" x="60" y="72" width="4" height="4"/><rect class="dot" x="72" y="72" width="4" height="4"/><rect class="dot" x="36" y="76" width="4" height="4"/><rect class="dot" x="44" y="76" width="4" height="4"/><rect class="dot" x="48" y="76" width="4" height="4"/><rect class="dot" x="68" y="76" width="4" height="4"/><rect class="dot" x="80" y="76" width="4" height="4"/><rect class="dot" x="32" y="80" width="4" height="4"/><rect class="dot" x="36" y="80" width="4" height="4"/><rect class="dot" x="40" y="80" width="4" height="4"/><rect class="dot" x="48" y="80" width="4" height="4"/><rect class="dot" x="52" y="80" width="4" height="4"/><rect class="dot" x="56" y="80" width="4" height="4"/><rect class="dot" x="64" y="80" width="4" height="4"/><rect class="dot" x="68" y="80" width="4" height="4"/><rect class="dot" x="80" y="80" width="4" height="4"/></g>
-  <text x="376" y="210">QR code</text>
-  <text x="376" y="232" class="t-s">104 B signed</text>
-  <text x="376" y="248" class="t-s">statement, or</text>
-  <text x="376" y="264" class="t-s">48 B drand no.</text>
-  <line class="ln" x1="210" y1="232" x2="255.0" y2="232.0"/><polygon class="arr" points="260,232 252.6,235.1 252.6,228.9"/><line class="ln" x1="498" y1="232" x2="543.0" y2="232.0"/><polygon class="arr" points="548,232 540.6,235.1 540.6,228.9"/>
-</svg>
-      <figcaption>Fig. 5 · The gigabytes cross early. At T only a few bytes cross, and they are public, so the channel needs to reach the site, not to be secret.</figcaption>
-    </figure>
-    <p>A checked drand number also proves that its moment has passed. A site without a reliable clock learns that it is at least that late.</p>
-
-    <h2 id="oss">Open source in private</h2>
-    <p>For an open-source project the hard part comes earlier: the fix has to be written and tested without showing it. Today it often shows. In the Keycloak case the fixed builds were tagged a week before the CVE, the port to the main branch was a public pull request whose title does not mention security, and the proof of concept was written from that diff <a href="#s3">[3]</a><a href="#s4">[4]</a>.</p>
-    <p>The tools for private work are thin. On GitHub, maintainers can open a temporary private fork from a security advisory. Only invited collaborators see it, but no CI runs there, branch protection does not apply, and merging and publishing are manual steps <a href="#s19">[19]</a>. On GitLab a merge request in a public project is public; private work needs a separate private fork <a href="#s20">[20]</a>. Distributions coordinate by mail: the linux-distros list allows an embargo of at most 14 days <a href="#s21">[21]</a>, and the kernel security team holds a fix back for at most 7 days, 14 in exceptional cases <a href="#s22">[22]</a>. The Git project comes closest to the idea of this post: it prepares signed tags in a private repository, sends a bundle to the distributions less than a week ahead, and pushes in public on release day <a href="#s23">[23]</a>. That bundle is plaintext and goes to a few.</p>
-    <figure class="fig-wide">
-      <svg class="dg" viewBox="0 0 760 330" role="img" aria-labelledby="d4t d4d">
-  <title id="d4t">A security fix in an open-source project, from private work to release</title>
-  <desc id="d4d">The maintainers write and test the fix on a private branch with private CI. Days before T the project publishes the encrypted, signed build. The embargo list of distributions gets the key early to test. Everyone else stages the ciphertext. At T the key is published, everyone applies the fix, and the public repository gets the merge and the advisory.</desc>
-  <line class="ln-s" x1="505" y1="38" x2="505" y2="290"/>
-  <text x="505" y="26" text-anchor="middle" class="t-h">T · release</text>
-  <text x="20" y="73" class="t-h">Maintainers</text><text x="20" y="123" class="t-h">Release</text><text x="20" y="173" class="t-h">Embargo list</text><text x="20" y="223" class="t-h">Everyone</text><text x="20" y="273" class="t-h">Public repo</text>
-  <rect class="bx-s" x="165" y="56" width="238" height="26"/>
-  <text x="177" y="73">private branch, private CI</text>
-  <rect class="bx-s" x="301" y="106" width="204" height="26"/>
-  <text x="313" y="123">encrypted build, signed</text>
-  <rect class="bx-i" x="505" y="106" width="22" height="26"/>
-  <text x="537" y="123" class="t-s">key published</text>
-  <rect class="bx-i" x="335" y="156" width="170" height="26"/>
-  <text x="347" y="173" class="t-inv">early key: test</text>
-  <rect class="bx-s" x="335" y="206" width="170" height="26"/>
-  <text x="347" y="223">ciphertext staged</text>
-  <rect class="bx-i" x="505" y="206" width="22" height="26"/>
-  <text x="537" y="223" class="t-s">apply at T</text>
-  <rect class="bx-i" x="505" y="256" width="170" height="26"/>
-  <text x="517" y="273" class="t-inv">merge + advisory</text>
-  <line class="ln" x1="362.2" y1="82" x2="362.2" y2="99.0"/><polygon class="arr" points="362.2,104 359.1,96.6 365.3,96.6"/>
-  <line class="ln" x1="165" y1="304" x2="709" y2="304"/>
-  <line class="ln" x1="165" y1="300" x2="165" y2="308"/><text x="165" y="322" text-anchor="middle" class="t-s">−10 days</text>
-  <line class="ln" x1="505" y1="298" x2="505" y2="310"/><text x="505" y="322" text-anchor="middle" class="t-s">T</text>
-  <line class="ln" x1="709" y1="300" x2="709" y2="308"/><text x="709" y="322" text-anchor="middle" class="t-s">+6 days</text>
-</svg>
-      <figcaption>Fig. 6 · Work in private, publish the ciphertext early, open it for everyone at T. The embargo list keeps what it has today: early access to test.</figcaption>
-    </figure>
-    <p>To make this normal, a forge such as GitHub or GitLab would need (Fig. 7):</p>
-    <ul>
-      <li>Private branches and pull requests inside the public repository, visible only to maintainers and a security role.</li>
-      <li>Private CI for those branches, with closed logs and no webhooks to outside apps.</li>
-      <li>Release artefacts that are published encrypted and signed, with the key held by the forge.</li>
-      <li>One action that, at T, publishes the key, merges the branch and publishes the advisory.</li>
-    </ul>
-    <figure class="fig-wide" data-steps>
-      <svg class="dg" viewBox="0 0 760 420" role="img" aria-labelledby="d6t d6d">
-  <title id="d6t">What a forge would need for a private fix in a public repository</title>
-  <desc id="d6d">Inside the public repository a private branch holds the fix; only maintainers and a security role see it. Private CI with closed logs tests it. Days before T the forge publishes the encrypted, signed release, and the embargo list gets the key early. At T one action publishes the key and the advisory and merges the branch, and everyone applies the fix.</desc>
-  <rect class="bx" x="20" y="44" width="720" height="262"/>
-  <text x="36" y="68" class="t-h">Public repository</text>
-  <line class="ln-s" x1="600" y1="34" x2="600" y2="404"/>
-  <text x="600" y="26" text-anchor="middle" class="t-h">T</text>
-  <text x="60" y="88" class="t-s">main · public</text>
-  <line class="ln-t" x1="60" y1="104" x2="720" y2="104"/>
-  <circle class="dot" cx="110" cy="104" r="5"/><circle class="dot" cx="210" cy="104" r="5"/><circle class="dot" cx="310" cy="104" r="5"/><circle class="dot" cx="410" cy="104" r="5"/><circle class="dot" cx="510" cy="104" r="5"/>
-  <g data-step="1"><rect class="bx-d" x="60" y="124" width="500" height="112"/><text x="166" y="144" class="t-s">private branch · maintainers and a security role only</text><path class="ln" d="M150 104 V176 H520"/><circle class="dot" cx="230" cy="176" r="5"/><circle class="dot" cx="310" cy="176" r="5"/><circle class="dot" cx="390" cy="176" r="5"/></g>
-  <g data-step="2"><rect class="bx-s" x="344" y="192" width="200" height="34"/><text x="356" y="214">private CI, closed logs</text></g>
-  <text x="36" y="276" class="t-s">releases</text>
-  <g data-step="3"><rect class="bx-s" x="330" y="254" width="250" height="38"/><text x="344" y="278">encrypted release, signed</text><line class="ln" x1="455" y1="292" x2="455.0" y2="329.0"/><polygon class="arr" points="455,334 451.9,326.6 458.1,326.6"/><rect class="bx" x="330" y="336" width="250" height="54"/><text x="344" y="358">embargo list</text><text x="344" y="377" class="t-s">early key: test</text></g>
-  <g data-step="4"><path class="ln" d="M520 176 L600 104"/><circle class="dot" cx="600" cy="104" r="7"/><text x="610" y="128" class="t-s">merge</text><rect class="bx-i" x="600" y="254" width="130" height="38"/><text x="612" y="278" class="t-inv">key + advisory</text><line class="ln" x1="665" y1="292" x2="665.0" y2="329.0"/><polygon class="arr" points="665,334 661.9,326.6 668.1,326.6"/><rect class="bx" x="600" y="336" width="140" height="54"/><text x="612" y="358">everyone</text><text x="612" y="377" class="t-s">applies at T</text></g>
-</svg>
-      <div class="steps__panel">
-        <ol class="steps__list">
-          <li>The fix is written on a private branch inside the public repository. Only the maintainers and a security role can see it.</li>
-          <li>Private CI builds and tests the branch. Its logs stay closed.</li>
-          <li>Days before T the forge publishes the encrypted, signed release. The embargo list gets the key early and tests.</li>
-          <li>At T one action publishes the key and the advisory and merges the branch. Everyone applies the fix.</li>
-        </ol>
-      </div>
-      <figcaption>Fig. 7 · What a forge would need for a private fix in a public repository.</figcaption>
-    </figure>
-    <p>The embargo lists fit into this as they are: their members get the key early and test, everyone else gets the ciphertext early. Each early key is a chance to leak, so the list stays short and the embargo stays short.</p>
-
-    <h2 id="limits">What it does not fix</h2>
-    <ul>
-      <li><b>Diffing after T.</b> At T the patch is public. The scheme moves the start line; it does not stop the race. It helps the hosts that install at once.</li>
-      <li><b>Zero-days.</b> They are still 62&nbsp;% of the vulnerabilities Google saw exploited in 2026 <a href="#s7">[7]</a>. No patch, nothing to encrypt. The scheme is for the part that grows fastest.</li>
-      <li><b>Slow patching.</b> A host that waits a month after T gains nothing. The scheme helps those who can apply at T.</li>
-      <li><b>Metadata.</b> File names and sizes still show which component changed. Padding and fixed bundles help, at a cost in bandwidth.</li>
-      <li><b>Insiders.</b> The key exists before T. Create it late, keep it in an HSM, split it between people.</li>
-      <li><b>Testing.</b> Companies test patches before they roll them out. Most can stage before T but test only after it. Early keys for a few, as embargo lists do today, bring back the risk of leaks.</li>
-    </ul>
-
-    <h2 id="prior">Prior art and patents</h2>
-    <p>The idea is not new, and the patents below show it. I found no vendor that does it for security patches today.</p>
-    <p>Microsoft has patents on it. They are old, but they matter now. This is my reading, not legal advice, and I could not open the claims or the fee records:</p>
-    <ul>
-      <li><b>US 7,876,902</b>, "Distribution of encrypted software update to reduce attack window", priority date 31 August 2006, granted 2011 <a href="#s24">[24]</a>. A US patent runs 20 years from filing, so it ends around 31 August 2026, later only if the patent office added term for its own delays, and earlier if a maintenance fee was not paid. Its description releases the key once enough machines have the update or after testing, not at a fixed time.</li>
-      <li><b>US 8,171,560</b>, "Secure content pre-distribution to designated systems", granted 2012 <a href="#s25">[25]</a>. It is closer to this post: content goes out encrypted and the key follows at a set moment. Filed around 2008, it may run to about 2028.</li>
-    </ul>
-    <p>So the design can be built from public parts, and a fixed release time, a transparency log and a public beacon in place of a vendor key server differ from the first patent's description. Whether that is enough depends on the claims. Anyone who wants to ship this as a product in the US before about 2028 should have a patent attorney read both patents first.</p>
-    <p>My conclusion: the tool is cheap for an update system that already signs its metadata. It does not stop patch diffing, and with LLMs diffing is now cheap. It lets every team have the fix ready when it becomes public, and that turns patch day from a race into a date.</p>
-
-    <h2 id="sources">Sources</h2>
-    <ol class="refs">
-      <li id="s1">Keycloak: <a href="https://github.com/keycloak/keycloak/tags" rel="noopener">tags</a> and <a href="https://github.com/keycloak/keycloak/security/advisories" rel="noopener">security advisories</a>, Nov 2025 to Nov 2026; <a href="https://github.com/advisories?query=keycloak+published%3A%3E%3D2025-11-10" rel="noopener">GitHub Advisory Database</a>.</li>
-      <li id="s2">The Hacker News: <a href="https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html" rel="noopener">Critical Keycloak password reset flaw</a>, Aug 2026; <a href="https://www.sentinelone.com/vulnerability-database/cve-2026-18963/" rel="noopener">SentinelOne: CVE-2026-18963</a>.</li>
-      <li id="s3">Keycloak: <a href="https://github.com/keycloak/keycloak/pull/51844" rel="noopener">pull request #51844</a>, Aug 2026.</li>
-      <li id="s4"><a href="https://github.com/Red-Darkin/CVE-2026-18963-keycloak" rel="noopener">Red-Darkin/CVE-2026-18963-keycloak</a>, 2026.</li>
-      <li id="s5">Anthropic: <a href="https://anthropic.com/research/n-days" rel="noopener">N-days to N-hours</a>, Jun 2026.</li>
-      <li id="s6">Elastic Security Labs: <a href="https://www.elastic.co/security-labs/blog/patch-diff-to-system" rel="noopener">Patch diff to SYSTEM</a>, Mar 2026.</li>
-      <li id="s7">Google Threat Intelligence: <a href="https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era" rel="noopener">Vulnerability discovery and exploitation trends in the AI era</a>, Sep 2026.</li>
-      <li id="s8">Mandiant: <a href="https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026/" rel="noopener">M-Trends 2026</a>, Mar 2026.</li>
-      <li id="s9">Rapid7: <a href="https://www.rapid7.com/about/press-releases/rapid7-2026-global-threat-landscape-report-shows-exploited-high-and-critical-severity-vulnerabilities-surged-105-as-attack-timelines-collapsed" rel="noopener">2026 Global Threat Landscape Report</a>, 2026.</li>
-      <li id="s10">CSO Online: <a href="https://www.csoonline.com/article/4236599/xbow-spent-40k-on-ai-and-cracked-google-chrome-wide-open-2.html" rel="noopener">XBOW spent $40k on AI and cracked Google Chrome</a>, Oct 2026.</li>
-      <li id="s11">Anthropic: <a href="https://anthropic.com/research/mythos-preview" rel="noopener">Mythos Preview</a>, Apr 2026.</li>
-      <li id="s12">depthfirst: <a href="https://depthfirst.com/research/21-zero-days-in-ffmpeg" rel="noopener">21 zero-days in FFmpeg</a>, Jun 2026.</li>
-      <li id="s13">SteamDB: <a href="https://steamdb.info/blog/steam-download-system" rel="noopener">How the Steam download system works</a>.</li>
-      <li id="s14"><a href="https://github.com/theupdateframework/specification/blob/master/tuf-spec.md" rel="noopener">The Update Framework specification</a>.</li>
-      <li id="s15"><a href="https://github.com/uptane/uptane-standard/blob/master/uptane-standard.md" rel="noopener">Uptane Standard</a>.</li>
-      <li id="s16"><a href="https://datatracker.ietf.org/doc/html/rfc9162" rel="noopener">RFC 9162: Certificate Transparency 2.0</a>; <a href="https://docs.sigstore.dev/logging/overview/" rel="noopener">Sigstore Rekor</a>.</li>
-      <li id="s17">drand: <a href="https://github.com/drand/tlock" rel="noopener">tlock</a>.</li>
-      <li id="s18">ISO/IEC 18004 capacity table, summarised by <a href="https://www.keyence.com/ss/products/auto_id/barcode_lecture/basic_2d/qr/" rel="noopener">Keyence</a>.</li>
-      <li id="s19">GitHub Docs: <a href="https://docs.github.com/en/code-security/tutorials/fix-reported-vulnerabilities/collaborate-in-a-fork" rel="noopener">Collaborating in a temporary private fork</a>.</li>
-      <li id="s20">GitLab Docs: <a href="https://docs.gitlab.com/user/project/merge_requests/confidential/" rel="noopener">Confidential merge requests</a>.</li>
-      <li id="s21">Openwall: <a href="https://oss-security.openwall.org/wiki/mailing-lists/distros" rel="noopener">The distros mailing list</a>.</li>
-      <li id="s22">Linux kernel: <a href="https://docs.kernel.org/process/security-bugs.html" rel="noopener">Security bugs</a>.</li>
-      <li id="s23">Git: <a href="https://github.com/git/git/blob/master/Documentation/howto/coordinate-embargoed-releases.adoc" rel="noopener">How to coordinate embargoed releases</a>.</li>
-      <li id="s24">Microsoft: <a href="https://patents.google.com/patent/US7876902" rel="noopener">US 7,876,902 B2</a>, Distribution of encrypted software update to reduce attack window.</li>
-      <li id="s25">Microsoft: <a href="https://patents.google.com/patent/US8171560" rel="noopener">US 8,171,560 B2</a>, Secure content pre-distribution to designated systems.</li>
-    </ol>
-  </article>
-</div>
-
-</main>
-
-<footer class="foot">
-  <div class="wrap">
-    <span>Tim Conrad</span>
-    <span>No cookies, no trackers, no third-party requests</span>
-  </div>
-</footer>
-
+<p>This post has moved: <a href="/thoughts/encrypted-patches/">/thoughts/encrypted-patches/</a>.</p>
 </body>
 </html>
diff --git a/blog/index.html b/blog/index.html
index 1c3bbbf..5539b05 100644
--- a/blog/index.html
+++ b/blog/index.html
@@ -2,70 +2,12 @@
 <html lang="en">
 <head>
 <meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; font-src 'self'; media-src 'self'; base-uri 'none'; form-action 'none'">
-<title>Blog · Tim Conrad</title>
-<meta name="description" content="Notes by Tim Conrad on security ideas.">
-<link rel="canonical" href="https://t7d.dev/blog/">
-<meta property="og:type" content="website">
-<meta property="og:title" content="Blog">
-<meta property="og:description" content="Notes by Tim Conrad on security ideas.">
-<meta property="og:url" content="https://t7d.dev/blog/">
-<meta property="og:image" content="https://t7d.dev/assets/og.png">
-<meta name="twitter:card" content="summary_large_image">
-<link rel="alternate" type="application/rss+xml" title="Tim Conrad · Blog" href="/blog/feed.xml">
-<link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
-<link rel="preload" href="/assets/fonts/barlow-condensed-700.woff2" as="font" type="font/woff2" crossorigin>
-<link rel="stylesheet" href="/assets/site.css">
-<script src="/assets/theme.js"></script>
-<script src="/assets/site.js" defer></script>
+<title>The blog is now called Thoughts · Tim Conrad</title>
+<meta name="robots" content="noindex">
+<link rel="canonical" href="https://t7d.dev/thoughts/">
+<meta http-equiv="refresh" content="0; url=/thoughts/">
 </head>
 <body>
-<a class="skip" href="#main">Skip to content</a>
-
-<header class="nav">
-  <div class="wrap nav__in">
-    <a class="brand" href="/">Tim Conrad</a>
-    <nav class="nav__links" aria-label="Site">
-      <a href="/#games">Games</a>
-      <a href="/blog/">Blog</a>
-      <a class="opt3" href="/#research">Research</a>
-      <a class="opt2" href="/#verify">PGP key</a>
-      <a class="opt2" href="/#contact">Contact</a>
-    </nav>
-    <button class="toggle" id="theme-toggle" type="button">dark</button>
-  </div>
-</header>
-
-<main id="main" class="wrap">
-
-<header class="post-head">
-  <a class="crumb" href="/">← Home</a>
-  <h1>Blog</h1>
-  <p class="sub">Notes on security ideas I am thinking through.</p>
-  <div class="btn-row"><a class="btn btn--ghost" href="/blog/feed.xml">RSS feed</a></div>
-</header>
-
-<section class="blog-list">
-  <ul class="posts">
-    <li>
-      <a href="/blog/encrypted-patches/">
-        <span class="label"><time datetime="2026-11-10">10 Nov 2026</time></span>
-        <span class="posts__title">Encrypted patches, unlocked on patch day</span>
-        <span class="posts__sum">Ship a security fix early as ciphertext and publish the key on patch day, so teams can stage it and apply it together. Games, a design with signed keys, open source in private, and the patents.</span>
-      </a>
-    </li>
-  </ul>
-</section>
-
-</main>
-
-<footer class="foot">
-  <div class="wrap">
-    <span>Tim Conrad</span>
-    <span>No cookies, no trackers, no third-party requests</span>
-  </div>
-</footer>
-
+<p>The blog is now called Thoughts: <a href="/thoughts/">/thoughts/</a>.</p>
 </body>
 </html>
diff --git a/index.html b/index.html
index c2a959b..a49b152 100644
--- a/index.html
+++ b/index.html
@@ -5,15 +5,15 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; font-src 'self'; media-src 'self'; base-uri 'none'; form-action 'none'">
 <title>Tim Conrad</title>
-<meta name="description" content="Tim Conrad does security research and builds browser games. This site holds two games, a blog, the CVE-2022-46166 write-up and a PGP key.">
+<meta name="description" content="Tim Conrad does security research and builds browser games. This site holds two games, his thoughts, the CVE-2022-46166 write-up and a PGP key.">
 <link rel="canonical" href="https://t7d.dev/">
 <meta property="og:type" content="website">
 <meta property="og:title" content="Tim Conrad">
-<meta property="og:description" content="Tim Conrad does security research and builds browser games. This site holds two games, a blog, the CVE-2022-46166 write-up and a PGP key.">
+<meta property="og:description" content="Tim Conrad does security research and builds browser games. This site holds two games, his thoughts, the CVE-2022-46166 write-up and a PGP key.">
 <meta property="og:url" content="https://t7d.dev/">
 <meta property="og:image" content="https://t7d.dev/assets/og.png">
 <meta name="twitter:card" content="summary_large_image">
-<link rel="alternate" type="application/rss+xml" title="Tim Conrad · Blog" href="/blog/feed.xml">
+<link rel="alternate" type="application/rss+xml" title="Tim Conrad · Thoughts" href="/thoughts/feed.xml">
 <link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
 <link rel="preload" href="/assets/fonts/barlow-condensed-700.woff2" as="font" type="font/woff2" crossorigin>
 <link rel="stylesheet" href="/assets/site.css">
@@ -28,7 +28,7 @@
     <a class="brand" href="/">Tim Conrad</a>
     <nav class="nav__links" aria-label="Sections">
       <a href="#games">Games</a>
-      <a href="/blog/">Blog</a>
+      <a href="/thoughts/">Thoughts</a>
       <a class="opt3" href="#research">Research</a>
       <a class="opt2" href="#verify">PGP key</a>
       <a class="opt2" href="#contact">Contact</a>
@@ -43,11 +43,11 @@
   <div class="hero__main">
     <p class="label">Sheet 1 · Overview</p>
     <h1>Tim Conrad</h1>
-    <p class="lede">I do security research and build browser games. This site holds two games, a blog, one vulnerability write-up and my PGP key.</p>
+    <p class="lede">I do security research and build browser games. This site holds two games, the ideas I am working through, one vulnerability write-up and my PGP key.</p>
   </div>
   <dl class="tb">
     <div><dt>Site</dt><dd>t7d.dev</dd></div>
-    <div><dt>Contents</dt><dd>2 games, 1 blog post, 1 write-up</dd></div>
+    <div><dt>Contents</dt><dd>2 games, 2 thoughts, 1 write-up</dd></div>
     <div class="wide"><dt>Contact</dt><dd><a href="https://de.linkedin.com/in/tim-c-94397a200/de" rel="me noopener">LinkedIn</a>, <a href="https://github.com/Tim-Conrad" rel="me noopener">GitHub</a></dd></div>
     <div class="wide"><dt>PGP fingerprint</dt><dd class="mono">A886 6CB1 6B07 9685 5615<br>74B2 A91D ABBE C996 7390</dd></div>
   </dl>
@@ -85,16 +85,40 @@ <h3>Wortzauber</h3>
   </div>
 </section>
 
-<section class="section" id="blog">
+<section class="section" id="thoughts">
   <div class="wrap">
     <div class="section__head">
-      <p class="label">Sheet 3 · Blog</p>
-      <h2>Blog</h2>
-      <p>Notes on security ideas I am thinking through. Follow them with the <a href="/blog/feed.xml">RSS feed</a>.</p>
+      <p class="label">Sheet 3 · Thoughts</p>
+      <h2>Thoughts</h2>
+      <p>Ideas I am working through. Each one keeps its sources and a list of what changed. All of them are on <a href="/thoughts/">the list</a>, and in the <a href="/thoughts/feed.xml">RSS feed</a>.</p>
     </div>
     <div class="projects">
-      <a class="proj" href="/blog/encrypted-patches/">
-        <p class="label"><time datetime="2026-11-10">10 Nov 2026</time> · updates · key release</p>
+      <a class="proj" href="/thoughts/humans-md/">
+        <p class="label"><time datetime="2026-11-10">10 Nov 2026</time> · draft · working with models</p>
+        <h3>A humans.md for working with models</h3>
+        <svg class="dg" viewBox="0 0 640 360" role="img" aria-labelledby="hm-t">
+          <title id="hm-t">Two files side by side: CLAUDE.md for the agent, HUMANS.md for me, with a log per model.</title>
+          <rect class="bx" x="50" y="56" width="240" height="220"/>
+          <text x="72" y="98" class="t-l">CLAUDE.md</text>
+          <rect class="bx-s" x="72" y="122" width="190" height="12"/>
+          <rect class="bx-s" x="72" y="148" width="150" height="12"/>
+          <rect class="bx-s" x="72" y="174" width="170" height="12"/>
+          <rect class="bx-s" x="72" y="200" width="120" height="12"/>
+          <text x="50" y="316" class="t-l t-m">for the agent</text>
+          <rect class="bx-i" x="350" y="56" width="240" height="220"/>
+          <text x="372" y="98" class="t-l t-inv">HUMANS.md</text>
+          <rect class="bx" x="372" y="122" width="190" height="12"/>
+          <rect class="bx" x="372" y="148" width="150" height="12"/>
+          <rect class="bx" x="372" y="190" width="196" height="64"/>
+          <line class="ln" x1="372" y1="211" x2="568" y2="211"/>
+          <line class="ln" x1="372" y1="232" x2="568" y2="232"/>
+          <text x="350" y="316" class="t-l t-m">for me</text>
+        </svg>
+        <p>My repositories tell the agent how to work with me, but nothing tells me how to work with the agent. A first version of that file, and what changes when a new model ships.</p>
+        <span class="proj__more">Read the thought</span>
+      </a>
+      <a class="proj" href="/thoughts/encrypted-patches/">
+        <p class="label"><time datetime="2026-11-10">10 Nov 2026</time> · draft · updates · key release</p>
         <h3>Encrypted patches, unlocked on patch day</h3>
         <svg class="dg" viewBox="0 0 640 360" role="img" aria-labelledby="bc-t">
           <title id="bc-t">The encrypted bundle reaches every host before patch day; at T only the key is published.</title>
@@ -112,7 +136,7 @@ <h3>Encrypted patches, unlocked on patch day</h3>
           <text x="40" y="344" class="t-l t-m">−7 days</text>
         </svg>
         <p>Ship a security fix early as ciphertext and publish the key on patch day, so teams can stage it and apply it together. Games, a design with signed keys, open source in private, and the patents.</p>
-        <span class="proj__more">Read the post</span>
+        <span class="proj__more">Read the thought</span>
       </a>
     </div>
   </div>
diff --git a/projects/kleinbahn/index.html b/projects/kleinbahn/index.html
index 9d63696..d8be74b 100644
--- a/projects/kleinbahn/index.html
+++ b/projects/kleinbahn/index.html
@@ -27,7 +27,7 @@
     <a class="brand" href="/">Tim Conrad</a>
     <nav class="nav__links" aria-label="Site">
       <a href="/#games">Games</a>
-      <a href="/blog/">Blog</a>
+      <a href="/thoughts/">Thoughts</a>
       <a class="opt3" href="/#research">Research</a>
       <a class="opt2" href="/#verify">PGP key</a>
       <a class="opt2" href="/#contact">Contact</a>
diff --git a/projects/wortzauber/index.html b/projects/wortzauber/index.html
index b8b9313..ff3fce1 100644
--- a/projects/wortzauber/index.html
+++ b/projects/wortzauber/index.html
@@ -27,7 +27,7 @@
     <a class="brand" href="/">Tim Conrad</a>
     <nav class="nav__links" aria-label="Site">
       <a href="/#games">Games</a>
-      <a href="/blog/">Blog</a>
+      <a href="/thoughts/">Thoughts</a>
       <a class="opt3" href="/#research">Research</a>
       <a class="opt2" href="/#verify">PGP key</a>
       <a class="opt2" href="/#contact">Contact</a>
diff --git a/research/cve-2022-46166/index.html b/research/cve-2022-46166/index.html
index 418574e..d4c8649 100644
--- a/research/cve-2022-46166/index.html
+++ b/research/cve-2022-46166/index.html
@@ -28,7 +28,7 @@
     <a class="brand" href="/">Tim Conrad</a>
     <nav class="nav__links" aria-label="Site">
       <a href="/#games">Games</a>
-      <a href="/blog/">Blog</a>
+      <a href="/thoughts/">Thoughts</a>
       <a class="opt3" href="/#research">Research</a>
       <a class="opt2" href="/#verify">PGP key</a>
       <a class="opt2" href="/#contact">Contact</a>
diff --git a/sitemap.xml b/sitemap.xml
index 6b08ab6..1c67bef 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -1,8 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
   <url><loc>https://t7d.dev/</loc></url>
-  <url><loc>https://t7d.dev/blog/</loc></url>
-  <url><loc>https://t7d.dev/blog/encrypted-patches/</loc></url>
+  <url><loc>https://t7d.dev/thoughts/</loc></url>
+  <url><loc>https://t7d.dev/thoughts/humans-md/</loc></url>
+  <url><loc>https://t7d.dev/thoughts/encrypted-patches/</loc></url>
   <url><loc>https://t7d.dev/research/cve-2022-46166/</loc></url>
   <url><loc>https://t7d.dev/projects/kleinbahn/</loc></url>
   <url><loc>https://t7d.dev/projects/wortzauber/</loc></url>
diff --git a/thoughts/encrypted-patches/index.html b/thoughts/encrypted-patches/index.html
new file mode 100644
index 0000000..25d7f80
--- /dev/null
+++ b/thoughts/encrypted-patches/index.html
@@ -0,0 +1,452 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; font-src 'self'; media-src 'self'; base-uri 'none'; form-action 'none'">
+<title>Encrypted patches, unlocked on patch day · Tim Conrad</title>
+<meta name="description" content="Ship a security fix early as ciphertext and publish the key at release time, so teams can stage it and apply it together instead of racing attackers. What games already do, a design with signed keys, open source in private, the air-gapped case and the patents.">
+<link rel="canonical" href="https://t7d.dev/thoughts/encrypted-patches/">
+<meta property="og:type" content="article">
+<meta property="og:title" content="Encrypted patches, unlocked on patch day">
+<meta property="og:description" content="Ship a security fix early as ciphertext and publish the key at release time, so teams can stage it and apply it together instead of racing attackers. What games already do, a design with signed keys, open source in private, the air-gapped case and the patents.">
+<meta property="og:url" content="https://t7d.dev/thoughts/encrypted-patches/">
+<meta property="og:image" content="https://t7d.dev/assets/og.png">
+<meta property="article:published_time" content="2026-11-10">
+<meta name="twitter:card" content="summary_large_image">
+<link rel="alternate" type="application/rss+xml" title="Tim Conrad · Thoughts" href="/thoughts/feed.xml">
+<link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
+<link rel="preload" href="/assets/fonts/barlow-condensed-700.woff2" as="font" type="font/woff2" crossorigin>
+<link rel="stylesheet" href="/assets/site.css">
+<script src="/assets/theme.js"></script>
+<script src="/assets/site.js" defer></script>
+</head>
+<body>
+<a class="skip" href="#main">Skip to content</a>
+
+<header class="nav">
+  <div class="wrap nav__in">
+    <a class="brand" href="/">Tim Conrad</a>
+    <nav class="nav__links" aria-label="Site">
+      <a href="/#games">Games</a>
+      <a href="/thoughts/">Thoughts</a>
+      <a class="opt3" href="/#research">Research</a>
+      <a class="opt2" href="/#verify">PGP key</a>
+      <a class="opt2" href="/#contact">Contact</a>
+    </nav>
+    <button class="toggle" id="theme-toggle" type="button">dark</button>
+  </div>
+</header>
+
+<main id="main" class="wrap">
+
+<header class="post-head">
+  <a class="crumb" href="/thoughts/">← Thoughts</a>
+  <h1>Encrypted patches, unlocked on patch day</h1>
+  <p class="sub">Ship the fix early as ciphertext and publish the key at release time. Teams stage it in advance and apply it at the same moment, instead of racing attackers.</p>
+  <p class="label">Tim Conrad · Updates · Patch diffing · Key release</p>
+  <dl class="tmeta">
+    <div><dt>Status</dt><dd><span class="status">Draft</span></dd></div>
+    <div><dt>Started</dt><dd><time datetime="2026-11-10">10 Nov 2026</time></dd></div>
+    <div><dt>Last revised</dt><dd><time datetime="2026-11-10">10 Nov 2026</time></dd></div>
+  </dl>
+</header>
+
+<div class="post">
+  <nav class="toc" aria-label="On this page">
+    <p class="label">On this page</p>
+    <ol>
+      <li><a href="#problem">The problem</a></li>
+      <li><a href="#games">What games do</a></li>
+      <li><a href="#design">A design</a></li>
+      <li><a href="#beacon">Without a key server</a></li>
+      <li><a href="#airgap">Air-gapped sites</a></li>
+      <li><a href="#oss">Open source in private</a></li>
+      <li><a href="#limits">What it does not fix</a></li>
+      <li><a href="#prior">Prior art and patents</a></li>
+      <li><a href="#sources">Sources</a></li>
+      <li><a href="#revisions">Revisions</a></li>
+      <li><a href="#feedback">Feedback</a></li>
+    </ol>
+  </nav>
+
+  <article class="prose">
+    <h2 id="problem">The problem</h2>
+    <p>A security fix tells an attacker where the bug was. That was always true. What changed in the last year is the price of turning a fix into an exploit.</p>
+    <p>Keycloak is a good example. Between November 2025 and November 2026 the project tagged 47 releases, about one every eight days, across four supported lines, and fixed at least 50 CVEs <a href="#s1">[1]</a>. In August 2026 one of them, CVE-2026-18963, let an unauthenticated attacker take over accounts through the password-reset flow <a href="#s2">[2]</a>. The fixed builds carry tag dates a week before the CVE was published <a href="#s1">[1]</a>, and the public fix is a small change of 57 added lines <a href="#s3">[3]</a>. A public proof of concept credits Claude for "research and PoC development assistance" and ships "the annotated patch diff" <a href="#s4">[4]</a>. A team that runs Keycloak has to patch every week, and every patch is a map for someone else.</p>
+    <p>The numbers behind that feeling are from 2026:</p>
+    <ul>
+      <li>Anthropic gave its Mythos Preview model only public patches. The first working Firefox exploit came less than an hour after the patch; Windows kernel exploits cost about $2,000 each. Its summary: "The binding constraint to N-days is now just a few thousand dollars and API access" <a href="#s5">[5]</a>.</li>
+      <li>Elastic found the bug behind a Windows patch "within minutes" of reading the diff with an LLM; the exploit took hours instead of weeks <a href="#s6">[6]</a>.</li>
+      <li>Google counted 141 exploited vulnerabilities from January to August 2026, more than in all of 2025, and puts the growth in "the rapid weaponization of n-days" <a href="#s7">[7]</a>. Mandiant's estimate for the mean time-to-exploit in 2025 is minus seven days <a href="#s8">[8]</a>, and Rapid7 measured a median of five days from publication to the CISA list of exploited bugs <a href="#s9">[9]</a>.</li>
+    </ul>
+    <p>Finding a new bug with AI works, but it is a search, and search costs. XBOW spent about $40,000 on API calls for a six-day campaign that produced a full Chrome exploit chain <a href="#s10">[10]</a>. Anthropic's OpenBSD campaign took about 1,000 runs for under $20,000, and the FFmpeg one about $10,000 <a href="#s11">[11]</a>. A patch removes the search: it says where to look.</p>
+    <figure class="fig-wide">
+      <svg class="dg" viewBox="0 0 760 330" role="img" aria-labelledby="d0t d0d">
+  <title id="d0t">What it costs: finding new bugs against exploiting patched ones</title>
+  <desc id="d0d">Log scale. Finding new bugs, per campaign: XBOW Chrome full chain about 40,000 dollars; Anthropic OpenBSD about 1,000 runs under 20,000 dollars; Anthropic FFmpeg about 10,000 dollars. Exploiting a patched bug, per exploit: Windows kernel exploit about 2,000 dollars; Linux kernel n-day under 1,000 dollars; Windows crash proof of concept about 120 dollars.</desc>
+  <line class="ln-s" x1="330.0" y1="56" x2="330.0" y2="300"/><text x="330.0" y="320" text-anchor="middle" class="t-s">$100</text><line class="ln-s" x1="463.3" y1="56" x2="463.3" y2="300"/><text x="463.3" y="320" text-anchor="middle" class="t-s">$1k</text><line class="ln-s" x1="596.7" y1="56" x2="596.7" y2="300"/><text x="596.7" y="320" text-anchor="middle" class="t-s">$10k</text><line class="ln-s" x1="730.0" y1="56" x2="730.0" y2="300"/><text x="730.0" y="320" text-anchor="middle" class="t-s">$100k</text>
+  <text x="20" y="46" class="t-h">Find new bugs · per campaign</text>
+  <text x="20" y="194" class="t-h">Exploit a patched bug · per exploit</text>
+  <text x="20" y="87">XBOW · Chrome full chain, 6 days</text><rect class="bx-i" x="330" y="72" width="346.9" height="22"/><text x="684.9" y="88" class="t-s">~$40k</text>
+  <text x="20" y="119">Anthropic · OpenBSD, ~1,000 runs</text><rect class="bx-i" x="330" y="104" width="306.8" height="22"/><text x="644.8" y="120" class="t-s"><$20k</text>
+  <text x="20" y="151">Anthropic · FFmpeg, some 100 runs</text><rect class="bx-i" x="330" y="136" width="266.7" height="22"/><text x="604.7" y="152" class="t-s">~$10k</text>
+  <text x="20" y="227">Windows kernel exploit, from patch</text><rect class="bx-s" x="330" y="212" width="173.5" height="22"/><text x="511.5" y="228" class="t-s">~$2k</text>
+  <text x="20" y="259">Linux kernel n-day exploit</text><rect class="bx-s" x="330" y="244" width="133.3" height="22"/><text x="471.3" y="260" class="t-s"><$1k</text>
+  <text x="20" y="291">Windows crash PoC, from patch</text><rect class="bx-s" x="330" y="276" width="10.6" height="22"/><text x="348.6" y="292" class="t-s">~$120</text>
+  
+</svg>
+      <figcaption>Fig. 1 · Cost per result on a log scale, from <a href="#s5">[5]</a>, <a href="#s10">[10]</a> and <a href="#s11">[11]</a>. Discovery is a whole campaign, the n-day rows are one exploit each. Some discovery is cheaper: depthfirst reports 21 FFmpeg bugs for about $1,000 <a href="#s12">[12]</a>.</figcaption>
+    </figure>
+    <p>The idea of this post: ship the fix days early, but encrypted. Teams download it, plan the change and stage it. At patch day T, only the key is published, and everyone applies the fix at the same moment. Nobody could diff it before T. The goal is not to win the race against the attackers, but to stop it from being a race.</p>
+    <figure class="fig-wide">
+      <svg class="dg" viewBox="0 0 760 300" role="img" aria-labelledby="d1t d1d">
+  <title id="d1t">Timeline: today and with an encrypted pre-load</title>
+  <desc id="d1d">Today the attacker can diff the patch as soon as the first host downloads it at T, while installs spread over weeks. With a pre-load, the encrypted bundle arrives in the week before T, the key arrives at T, and automatic updates install within minutes, while the attacker also only starts at T.</desc>
+  <line class="ln-s" x1="420" y1="34" x2="420" y2="262"/>
+  <text x="420" y="24" text-anchor="middle" class="t-h">T · patch day</text>
+  <text x="20" y="68" class="t-h">Today</text>
+  <rect class="bx-s" x="420" y="56" width="250" height="26"/>
+  <text x="432" y="73">installs spread over weeks</text>
+  <rect class="bx-i" x="426" y="92" width="150" height="26"/>
+  <text x="438" y="109" class="t-inv">diff → exploit</text>
+  <text x="588" y="109" class="t-s">from the first download</text>
+  <text x="140" y="73" class="t-s">nothing on the hosts yet</text>
+  <line class="ln" x1="20" y1="140" x2="740" y2="140"/>
+  <text x="20" y="176" class="t-h">Pre-load</text>
+  <rect class="bx-s" x="140" y="164" width="280" height="26"/>
+  <text x="152" y="181">encrypted bundle on every host</text>
+  <rect class="bx-i" x="420" y="164" width="22" height="26"/>
+  <text x="452" y="181" class="t-s">installed within minutes</text>
+  <rect class="bx-i" x="426" y="200" width="150" height="26"/>
+  <text x="438" y="217" class="t-inv">diff → exploit</text>
+  <text x="588" y="217" class="t-s">same start line</text>
+  <g transform="translate(409,236)"><circle class="bx" cx="6" cy="6" r="5"/><line class="ln" x1="11" y1="6" x2="22" y2="6"/><line class="ln" x1="18" y1="6" x2="18" y2="10"/></g>
+  <text x="402" y="246" text-anchor="end" class="t-s">32-byte key published</text>
+  <line class="ln" x1="140" y1="274" x2="700" y2="274"/>
+  <line class="ln" x1="140" y1="270" x2="140" y2="278"/><text x="140" y="292" text-anchor="middle" class="t-s">−7 days</text>
+  <line class="ln" x1="420" y1="268" x2="420" y2="280"/><text x="420" y="292" text-anchor="middle" class="t-s">T</text>
+  <line class="ln" x1="700" y1="270" x2="700" y2="278"/><text x="700" y="292" text-anchor="middle" class="t-s">+7 days</text>
+</svg>
+      <figcaption>Fig. 2 · With a pre-load, the attacker and the defenders start at the same moment, and hosts that update by themselves are done within minutes.</figcaption>
+    </figure>
+
+    <h2 id="games">What games do</h2>
+    <p>Games have done this for years. A pre-load puts the game on your disk before launch, and it opens only at release. Steam, as SteamDB describes it, encrypts each depot with AES-256 and one key that is the same for every user, so mirrors and caches can serve the same bytes, and only owners can ask for the key <a href="#s13">[13]</a>.</p>
+    <p>GTA Online shows the other side. Rockstar ships the content of later updates early inside earlier ones and switches it on from its servers. The files are encrypted, but the keys are in the game, so dataminers read upcoming cars and missions long before they go live. A server switch decides <em>when</em> something is available. It does not keep it <em>secret</em> while the key sits on the device.</p>
+    <p>For patches, four rules follow:</p>
+    <ul>
+      <li>The key is not on the device before T.</li>
+      <li>The device clock never opens anything. Only the published key does.</li>
+      <li>Everything is signed, and the client checks the ciphertext before T.</li>
+      <li>Decryption at T is cheap. One key, one pass.</li>
+    </ul>
+
+    <h2 id="design">A design</h2>
+    <p>The update frameworks TUF and Uptane already solve most of this: an offline root key, roles with narrow rights, thresholds of signatures, and protection against rollback and freeze attacks <a href="#s14">[14]</a><a href="#s15">[15]</a>. Uptane even names patch diffing as an attacker goal and can carry wrapped keys for encrypted images. What they lack is a key that is published later. The design adds one role for that.</p>
+    <ol>
+      <li><b>Pre-load.</b> Days before T, the vendor publishes the encrypted bundle as an ordinary target. The manifest with its hash, size and release time is signed by the targets role under the organisation's root key. Clients download it and check the hash.</li>
+      <li><b>Release.</b> At T a separate release role signs a short statement: patch id, hash of the ciphertext, the 32-byte content key. A threshold, say two of three officers, keeps one person from releasing early.</li>
+      <li><b>Log.</b> Every statement goes into an append-only transparency log, so a release before T, or a different key for some customers, can be seen <a href="#s16">[16]</a>.</li>
+      <li><b>Install.</b> The client checks the statement and the log entry, decrypts with the key and installs.</li>
+    </ol>
+    <figure class="fig-wide" data-steps>
+      <svg class="dg" viewBox="0 0 760 420" role="img" aria-labelledby="d2t d2d">
+  <title id="d2t">Who signs what</title>
+  <desc id="d2d">An offline organisation root key delegates to a targets role and a release role. Days before T the targets role signs a manifest with the hash of the encrypted bundle, and mirrors carry both. At T a release role, two of three officers, signs a key-release statement that is written to a transparency log. The client verifies the manifest, the bundle hash, the statement signature and the log entry, then decrypts and installs.</desc>
+  <text x="20" y="28" class="t-h">Organisation</text>
+  <text x="290" y="28" class="t-h">Mirrors and log</text>
+  <text x="560" y="28" class="t-h">Client</text>
+  <g data-step="1"><rect class="bx-i" x="20" y="44" width="220" height="54"/></g>
+  <g data-step="1"><text x="36" y="67" class="t-inv">org root key</text></g>
+  <g data-step="1"><text x="36" y="86" class="t-inv t-s">offline · delegates roles</text></g>
+  <g data-step="1"><line class="ln" x1="70" y1="98" x2="70.0" y2="135.0"/><polygon class="arr" points="70,140 66.9,132.6 73.1,132.6"/></g>
+  <g data-step="1"><line class="ln" x1="190" y1="98" x2="190.0" y2="257.0"/><polygon class="arr" points="190,262 186.9,254.6 193.1,254.6"/></g>
+  <g data-step="1"><rect class="bx" x="20" y="142" width="160" height="54"/></g>
+  <g data-step="1"><text x="36" y="165">targets role</text></g>
+  <g data-step="1"><text x="36" y="184" class="t-s">signs the manifest</text></g>
+  <g data-step="1"><rect class="bx" x="100" y="264" width="140" height="54"/></g>
+  <g data-step="1"><text x="114" y="287">release role</text></g>
+  <g data-step="1"><text x="114" y="306" class="t-s">2 of 3 officers</text></g>
+  <g data-step="2"><line class="ln" x1="180" y1="169" x2="283.0" y2="169.0"/><polygon class="arr" points="288,169 280.6,172.1 280.6,165.9"/></g>
+  <g data-step="2"><text x="196" y="160" class="t-s">−7 days</text></g>
+  <g data-step="4"><line class="ln" x1="240" y1="291" x2="283.0" y2="291.0"/><polygon class="arr" points="288,291 280.6,294.1 280.6,287.9"/></g>
+  <g data-step="4"><text x="250" y="282" class="t-s">at T</text></g>
+  <g data-step="2"><rect class="bx-s" x="290" y="142" width="220" height="54"/></g>
+  <g data-step="2"><text x="304" y="165">manifest + bundle</text></g>
+  <g data-step="2"><text x="304" y="184" class="t-s">hash, size, patch id, T</text></g>
+  <g data-step="4"><rect class="bx-i" x="290" y="264" width="220" height="54"/></g>
+  <g data-step="4"><text x="304" y="287" class="t-inv">key-release statement</text></g>
+  <g data-step="4"><text x="304" y="306" class="t-inv t-s">patch id, hash, key · 104 B</text></g>
+  <g data-step="4"><line class="ln" x1="400" y1="318" x2="400.0" y2="349.0"/><polygon class="arr" points="400,354 396.9,346.6 403.1,346.6"/></g>
+  <g data-step="4"><rect class="bx-d" x="290" y="356" width="220" height="46"/></g>
+  <g data-step="4"><text x="304" y="377">transparency log</text></g>
+  <g data-step="4"><text x="304" y="394" class="t-s">append only, public</text></g>
+  <g data-step="2"><line class="ln" x1="510" y1="169" x2="553.0" y2="169.0"/><polygon class="arr" points="558,169 550.6,172.1 550.6,165.9"/></g>
+  <g data-step="4"><line class="ln" x1="510" y1="291" x2="553.0" y2="291.0"/><polygon class="arr" points="558,291 550.6,294.1 550.6,287.9"/></g>
+  <g data-step="4"><path class="ln-s" d="M510 379 H534 V320 H558"/></g>
+  <g data-step="3"><rect class="bx" x="560" y="122" width="180" height="236"/></g>
+  <g data-step="3"><text x="576" y="150">1 check manifest</text></g>
+  <g data-step="3"><text x="590" y="166" class="t-s">against org key</text></g>
+  <g data-step="3"><text x="576" y="192">2 check bundle</text></g>
+  <g data-step="3"><text x="590" y="208" class="t-s">hash from manifest</text></g>
+  <g data-step="3"><text x="576" y="234">3 wait for T</text></g>
+  <g data-step="3"><text x="590" y="250" class="t-s">the key opens, not</text><text x="590" y="264" class="t-s">the clock</text></g>
+  <g data-step="5"><text x="576" y="286">4 check statement</text></g>
+  <g data-step="5"><text x="590" y="302" class="t-s">signature + log proof</text></g>
+  <g data-step="5"><text x="576" y="326">5 decrypt, install</text></g>
+  <g data-step="5"><text x="590" y="342" class="t-s">AES-GCM, key from 4</text></g>
+</svg>
+      <div class="steps__panel">
+        <ol class="steps__list">
+          <li>The organisation’s root key stays offline. It gives two roles their rights: one signs the manifest, the other releases keys.</li>
+          <li>Days before T the targets role signs the manifest, and mirrors carry it together with the encrypted bundle.</li>
+          <li>Every client checks the manifest against the organisation key and the bundle against the manifest. Then it waits; its clock opens nothing.</li>
+          <li>At T two of three release officers sign the key-release statement, and it goes into the public log.</li>
+          <li>The client checks the statement and its log entry, decrypts the bundle with the key and installs.</li>
+        </ol>
+      </div>
+      <figcaption>Fig. 3 · Two roles under one offline root. The release role can only publish keys for ciphertext that is already pinned, so a stolen release key cannot push code.</figcaption>
+    </figure>
+    <p>The statement is small and public, so any mirror, CDN or even DNS can carry it. That makes the release hard to block.</p>
+    <div class="code">
+      <div class="code__bar"><span>key-release statement, about 104 bytes</span></div>
+<pre><code>patch    8 B   id of the patch, points to its manifest entry
+key     32 B   AES-256-GCM content key
+sig     64 B   Ed25519 over patch id, ciphertext hash and key</code></pre>
+    </div>
+    <p>The signature covers the hash of the ciphertext from the manifest, so the key belongs to exactly one bundle. With a threshold, each officer adds a signature of 64 bytes.</p>
+
+    <h2 id="beacon">Without a key server</h2>
+    <p>The key server is the weak spot. It can go down at the wrong moment, someone can force it to wait, or someone can leak the key early. There is a way to release a key on time without any server of the vendor.</p>
+    <p>A public service called drand publishes a new signed number every three seconds, and each number has a sequence position. A group of independent organisations runs it together, the League of Entropy. No single member can make the number for a position alone: it takes enough of them together, and they make it only when that moment has come <a href="#s17">[17]</a>.</p>
+    <p>The trick: you can lock data to a number that does not exist yet. The vendor picks the position that falls on patch day T and locks the patch key to it. Until T nobody, the vendor included, can open the lock. At T drand publishes the number, and that number opens it. The free tool tlock does exactly this <a href="#s17">[17]</a>.</p>
+    <figure class="fig-wide" data-steps>
+      <svg class="dg" viewBox="0 0 760 380" role="img" aria-labelledby="d5t d5d">
+  <title id="d5t">How a drand number opens a patch key at patch day</title>
+  <desc id="d5d">Independent organisations make a new numbered value every three seconds; the value for a position exists only when enough of them have taken part, at that moment. Days before patch day the vendor locks the patch key to the value at position T, which does not exist yet. At T the organisations make that value, it is published, and anyone can use it to open the lock and install the patch.</desc>
+  <g data-step="3"><text x="20" y="34" class="t-h">League of Entropy</text></g>
+  <g data-step="3"><text x="250" y="34" class="t-s">independent organisations</text></g>
+  <g data-step="3"><rect class="bx" x="250" y="58" width="48" height="30"/><text x="274" y="78" text-anchor="middle" class="t-s">org A</text><rect class="bx" x="310" y="58" width="48" height="30"/><text x="334" y="78" text-anchor="middle" class="t-s">org B</text><rect class="bx" x="370" y="58" width="48" height="30"/><text x="394" y="78" text-anchor="middle" class="t-s">org C</text><rect class="bx" x="430" y="58" width="48" height="30"/><text x="454" y="78" text-anchor="middle" class="t-s">org D</text><rect class="bx" x="490" y="58" width="48" height="30"/><text x="514" y="78" text-anchor="middle" class="t-s">org E</text></g>
+  <g data-step="3"><line class="ln" x1="274" y1="88" x2="439.5" y2="165.9"/><polygon class="arr" points="444,168 436.0,167.7 438.7,162.0"/><line class="ln" x1="394" y1="88" x2="441.4" y2="163.8"/><polygon class="arr" points="444,168 437.5,163.4 442.7,160.1"/><line class="ln" x1="454" y1="88" x2="444.6" y2="163.0"/><polygon class="arr" points="444,168 441.8,160.3 448.0,161.1"/><line class="ln" x1="514" y1="88" x2="447.3" y2="164.2"/><polygon class="arr" points="444,168 446.5,160.4 451.2,164.5"/></g>
+  <g data-step="3"><line class="ln-s" x1="334" y1="88" x2="440.0" y2="165.1"/></g>
+  <g data-step="3"><text x="560" y="78" class="t-s">enough of them together</text></g>
+  <g data-step="3"><text x="560" y="94" class="t-s">make the value for T,</text></g>
+  <g data-step="3"><text x="560" y="110" class="t-s">only when T has come</text></g>
+  <g data-step="3"><text x="560" y="134" class="t-s">(B is not needed)</text></g>
+  <g data-step="1"><text x="20" y="195" class="t-h">drand values</text></g>
+  <g data-step="1"><rect class="bx-s" x="150" y="176" width="28" height="28"/><rect class="bx-s" x="190" y="176" width="28" height="28"/><rect class="bx-s" x="230" y="176" width="28" height="28"/><rect class="bx-s" x="270" y="176" width="28" height="28"/><rect class="bx-s" x="310" y="176" width="28" height="28"/><rect class="bx-s" x="350" y="176" width="28" height="28"/><rect class="bx-s" x="390" y="176" width="28" height="28"/><rect class="bx-d" x="470" y="176" width="28" height="28"/><rect class="bx-d" x="510" y="176" width="28" height="28"/><rect class="bx-d" x="550" y="176" width="28" height="28"/><rect class="bx-d" x="590" y="176" width="28" height="28"/><rect class="bx-d" x="630" y="176" width="28" height="28"/></g>
+  <g data-step="3"><rect class="bx-i" x="424" y="170" width="40" height="40"/><text x="444" y="195" text-anchor="middle" class="t-inv">T</text></g>
+  <g data-step="1"><text x="150" y="232" class="t-s">already published</text></g>
+  <g data-step="1"><text x="550" y="232" class="t-s">not made yet</text></g>
+  <g data-step="1"><text x="150" y="166" class="t-s">one every 3 seconds</text></g>
+  <g data-step="2"><rect class="bx" x="20" y="268" width="250" height="84"/></g>
+  <g data-step="2"><text x="36" y="290" class="t-h">Vendor · days before T</text></g>
+  <g data-step="2"><path class="ln" d="M40 314 V310 a5 5 0 0 1 10 0 V314"/><rect class="bx" x="36" y="314" width="18" height="13"/></g>
+  <g data-step="2"><text x="66" y="322">patch key, locked</text></g>
+  <g data-step="2"><text x="66" y="340" class="t-s">to the value at T</text></g>
+  <g data-step="2"><line class="ln-s" x1="240" y1="300" x2="425.5" y2="214.1"/><polygon class="arr" points="430,212 424.6,217.9 422.0,212.3"/></g>
+  <g data-step="4"><rect class="bx" x="490" y="268" width="250" height="84"/></g>
+  <g data-step="4"><text x="506" y="290" class="t-h">Everyone · at T</text></g>
+  <g data-step="4"><path class="ln" d="M510 314 V304 a5 5 0 0 1 10 0 V306"/><rect class="bx-i" x="506" y="314" width="18" height="13"/></g>
+  <g data-step="4"><text x="536" y="322">value T opens it</text></g>
+  <g data-step="4"><text x="536" y="340" class="t-s">patch key → install</text></g>
+  <g data-step="4"><line class="ln" x1="458" y1="212" x2="535.8" y2="263.3"/><polygon class="arr" points="540,266 532.1,264.5 535.6,259.3"/></g>
+</svg>
+      <div class="steps__panel">
+        <ol class="steps__list">
+          <li>drand makes a new value every three seconds. Values for later moments do not exist yet.</li>
+          <li>Days before T the vendor locks the patch key to the value at T. Nobody can open it now, the vendor included.</li>
+          <li>At T enough of the organisations together make the value for T. Not every one is needed.</li>
+          <li>The value is public. It opens the lock, and everyone installs the patch.</li>
+        </ol>
+      </div>
+      <figcaption>Fig. 4 · The lock points at a value that does not exist yet. Only the organisations together can make it, and only at T.</figcaption>
+    </figure>
+    <p>The vendor can use both ways at once: its own key server and the drand lock. Then the patch opens at T even if the vendor's server is down. Two limits remain:</p>
+    <ul>
+      <li>The vendor still makes the key before it locks it, so someone inside can still leak it.</li>
+      <li>Once locked, the key cannot be held back. If the fix turns out to be broken, it opens at T anyway.</li>
+    </ul>
+    <p>Check the chosen position before you publish. A wrong one, in the past, opens the patch at once.</p>
+
+    <h2 id="airgap">Air-gapped sites</h2>
+    <p>Offline networks already carry updates in on removable media. With a pre-load, the large part crosses days before T and can be checked against the organisation's key. At T only the key has to cross: the signed statement, or the 48-byte drand number for T, which the site checks against drand's public key, stored there in advance <a href="#s17">[17]</a>. Either fits in one QR code, which holds up to 2,953 bytes <a href="#s18">[18]</a>, or can be typed in as hex.</p>
+    <figure class="fig-wide">
+      <svg class="dg" viewBox="0 0 760 330" role="img" aria-labelledby="d3t d3d">
+  <title id="d3t">Updates for an air-gapped site</title>
+  <desc id="d3d">Days before T, the encrypted bundle and its signed manifest cross the air gap on removable media, gigabytes in size. At T only a key-release statement of about 104 bytes, or a 48-byte drand number, crosses, small enough for one QR code. The offline site checks both against pinned keys, then decrypts and installs.</desc>
+  <defs><pattern id="d3h" width="6" height="6" patternUnits="userSpaceOnUse" patternTransform="rotate(45)"><line class="hatch-p" x1="0" y1="0" x2="0" y2="6"/></pattern></defs>
+  <text x="20" y="28" class="t-h">Connected</text>
+  <text x="380" y="28" text-anchor="middle" class="t-h">Air gap</text>
+  <text x="740" y="28" text-anchor="end" class="t-h">Offline site</text>
+  <rect class="bx" x="20" y="44" width="190" height="262"/>
+  <text x="36" y="72">vendor mirror</text>
+  <text x="36" y="90" class="t-s">bundle, manifest</text>
+  <text x="36" y="196">key release</text>
+  <text x="36" y="214" class="t-s">vendor statement</text>
+  <text x="36" y="230" class="t-s">or drand number</text>
+  <rect class="gap" x="350" y="44" width="60" height="262"/>
+  <rect class="bx" x="550" y="44" width="190" height="262"/>
+  <text x="566" y="72">keys stored early</text>
+  <text x="566" y="90" class="t-s">org key</text>
+  <text x="566" y="106" class="t-s">drand public key</text>
+  <text x="566" y="196">at T</text>
+  <text x="566" y="214" class="t-s">verify offline</text>
+  <text x="566" y="230" class="t-s">decrypt, install</text>
+  <rect class="bx-s" x="250" y="66" width="260" height="70"/>
+  <text x="264" y="86" class="t-s">days before T</text>
+  <text x="264" y="106">USB or disc</text>
+  <text x="264" y="124" class="t-s">encrypted bundle · gigabytes</text>
+  <line class="ln" x1="210" y1="101" x2="243.0" y2="101.0"/><polygon class="arr" points="248,101 240.6,104.1 240.6,97.9"/><line class="ln" x1="510" y1="101" x2="543.0" y2="101.0"/><polygon class="arr" points="548,101 540.6,104.1 540.6,97.9"/>
+  <rect class="bx" x="262" y="164" width="236" height="122"/>
+  <text x="376" y="186" class="t-s">at T</text>
+  <g transform="translate(276,190)"><rect class="bx-i" x="0" y="0" width="28" height="28"/><rect class="qr-w" x="4" y="4" width="20" height="20"/><rect class="bx-i" x="8" y="8" width="12" height="12"/><rect class="bx-i" x="56" y="0" width="28" height="28"/><rect class="qr-w" x="60" y="4" width="20" height="20"/><rect class="bx-i" x="64" y="8" width="12" height="12"/><rect class="bx-i" x="0" y="56" width="28" height="28"/><rect class="qr-w" x="4" y="60" width="20" height="20"/><rect class="bx-i" x="8" y="64" width="12" height="12"/><rect class="dot" x="32" y="0" width="4" height="4"/><rect class="dot" x="36" y="0" width="4" height="4"/><rect class="dot" x="44" y="0" width="4" height="4"/><rect class="dot" x="32" y="4" width="4" height="4"/><rect class="dot" x="36" y="4" width="4" height="4"/><rect class="dot" x="44" y="4" width="4" height="4"/><rect class="dot" x="48" y="4" width="4" height="4"/><rect class="dot" x="32" y="8" width="4" height="4"/><rect class="dot" x="36" y="8" width="4" height="4"/><rect class="dot" x="40" y="8" width="4" height="4"/><rect class="dot" x="48" y="8" width="4" height="4"/><rect class="dot" x="32" y="12" width="4" height="4"/><rect class="dot" x="48" y="12" width="4" height="4"/><rect class="dot" x="36" y="16" width="4" height="4"/><rect class="dot" x="44" y="16" width="4" height="4"/><rect class="dot" x="48" y="16" width="4" height="4"/><rect class="dot" x="32" y="20" width="4" height="4"/><rect class="dot" x="36" y="20" width="4" height="4"/><rect class="dot" x="44" y="20" width="4" height="4"/><rect class="dot" x="36" y="24" width="4" height="4"/><rect class="dot" x="44" y="24" width="4" height="4"/><rect class="dot" x="48" y="24" width="4" height="4"/><rect class="dot" x="32" y="28" width="4" height="4"/><rect class="dot" x="40" y="28" width="4" height="4"/><rect class="dot" x="44" y="28" width="4" height="4"/><rect class="dot" x="0" y="32" width="4" height="4"/><rect class="dot" x="4" y="32" width="4" height="4"/><rect class="dot" x="16" y="32" width="4" height="4"/><rect class="dot" x="36" y="32" width="4" height="4"/><rect class="dot" x="44" y="32" width="4" height="4"/><rect class="dot" x="48" y="32" width="4" height="4"/><rect class="dot" x="56" y="32" width="4" height="4"/><rect class="dot" x="64" y="32" width="4" height="4"/><rect class="dot" x="0" y="36" width="4" height="4"/><rect class="dot" x="16" y="36" width="4" height="4"/><rect class="dot" x="28" y="36" width="4" height="4"/><rect class="dot" x="36" y="36" width="4" height="4"/><rect class="dot" x="56" y="36" width="4" height="4"/><rect class="dot" x="60" y="36" width="4" height="4"/><rect class="dot" x="68" y="36" width="4" height="4"/><rect class="dot" x="72" y="36" width="4" height="4"/><rect class="dot" x="76" y="36" width="4" height="4"/><rect class="dot" x="80" y="36" width="4" height="4"/><rect class="dot" x="0" y="40" width="4" height="4"/><rect class="dot" x="8" y="40" width="4" height="4"/><rect class="dot" x="12" y="40" width="4" height="4"/><rect class="dot" x="16" y="40" width="4" height="4"/><rect class="dot" x="24" y="40" width="4" height="4"/><rect class="dot" x="28" y="40" width="4" height="4"/><rect class="dot" x="48" y="40" width="4" height="4"/><rect class="dot" x="52" y="40" width="4" height="4"/><rect class="dot" x="56" y="40" width="4" height="4"/><rect class="dot" x="68" y="40" width="4" height="4"/><rect class="dot" x="72" y="40" width="4" height="4"/><rect class="dot" x="76" y="40" width="4" height="4"/><rect class="dot" x="80" y="40" width="4" height="4"/><rect class="dot" x="8" y="44" width="4" height="4"/><rect class="dot" x="12" y="44" width="4" height="4"/><rect class="dot" x="16" y="44" width="4" height="4"/><rect class="dot" x="20" y="44" width="4" height="4"/><rect class="dot" x="48" y="44" width="4" height="4"/><rect class="dot" x="68" y="44" width="4" height="4"/><rect class="dot" x="72" y="44" width="4" height="4"/><rect class="dot" x="76" y="44" width="4" height="4"/><rect class="dot" x="0" y="48" width="4" height="4"/><rect class="dot" x="4" y="48" width="4" height="4"/><rect class="dot" x="8" y="48" width="4" height="4"/><rect class="dot" x="12" y="48" width="4" height="4"/><rect class="dot" x="16" y="48" width="4" height="4"/><rect class="dot" x="20" y="48" width="4" height="4"/><rect class="dot" x="24" y="48" width="4" height="4"/><rect class="dot" x="28" y="48" width="4" height="4"/><rect class="dot" x="32" y="48" width="4" height="4"/><rect class="dot" x="36" y="48" width="4" height="4"/><rect class="dot" x="40" y="48" width="4" height="4"/><rect class="dot" x="52" y="48" width="4" height="4"/><rect class="dot" x="56" y="48" width="4" height="4"/><rect class="dot" x="60" y="48" width="4" height="4"/><rect class="dot" x="64" y="48" width="4" height="4"/><rect class="dot" x="68" y="48" width="4" height="4"/><rect class="dot" x="80" y="48" width="4" height="4"/><rect class="dot" x="36" y="52" width="4" height="4"/><rect class="dot" x="40" y="52" width="4" height="4"/><rect class="dot" x="44" y="52" width="4" height="4"/><rect class="dot" x="48" y="52" width="4" height="4"/><rect class="dot" x="56" y="52" width="4" height="4"/><rect class="dot" x="60" y="52" width="4" height="4"/><rect class="dot" x="72" y="52" width="4" height="4"/><rect class="dot" x="80" y="52" width="4" height="4"/><rect class="dot" x="48" y="56" width="4" height="4"/><rect class="dot" x="52" y="56" width="4" height="4"/><rect class="dot" x="56" y="56" width="4" height="4"/><rect class="dot" x="72" y="56" width="4" height="4"/><rect class="dot" x="76" y="56" width="4" height="4"/><rect class="dot" x="52" y="60" width="4" height="4"/><rect class="dot" x="60" y="60" width="4" height="4"/><rect class="dot" x="64" y="60" width="4" height="4"/><rect class="dot" x="68" y="60" width="4" height="4"/><rect class="dot" x="72" y="60" width="4" height="4"/><rect class="dot" x="76" y="60" width="4" height="4"/><rect class="dot" x="36" y="64" width="4" height="4"/><rect class="dot" x="52" y="64" width="4" height="4"/><rect class="dot" x="56" y="64" width="4" height="4"/><rect class="dot" x="60" y="64" width="4" height="4"/><rect class="dot" x="64" y="64" width="4" height="4"/><rect class="dot" x="68" y="64" width="4" height="4"/><rect class="dot" x="32" y="68" width="4" height="4"/><rect class="dot" x="44" y="68" width="4" height="4"/><rect class="dot" x="64" y="68" width="4" height="4"/><rect class="dot" x="68" y="68" width="4" height="4"/><rect class="dot" x="76" y="68" width="4" height="4"/><rect class="dot" x="36" y="72" width="4" height="4"/><rect class="dot" x="40" y="72" width="4" height="4"/><rect class="dot" x="52" y="72" width="4" height="4"/><rect class="dot" x="56" y="72" width="4" height="4"/><rect class="dot" x="60" y="72" width="4" height="4"/><rect class="dot" x="72" y="72" width="4" height="4"/><rect class="dot" x="36" y="76" width="4" height="4"/><rect class="dot" x="44" y="76" width="4" height="4"/><rect class="dot" x="48" y="76" width="4" height="4"/><rect class="dot" x="68" y="76" width="4" height="4"/><rect class="dot" x="80" y="76" width="4" height="4"/><rect class="dot" x="32" y="80" width="4" height="4"/><rect class="dot" x="36" y="80" width="4" height="4"/><rect class="dot" x="40" y="80" width="4" height="4"/><rect class="dot" x="48" y="80" width="4" height="4"/><rect class="dot" x="52" y="80" width="4" height="4"/><rect class="dot" x="56" y="80" width="4" height="4"/><rect class="dot" x="64" y="80" width="4" height="4"/><rect class="dot" x="68" y="80" width="4" height="4"/><rect class="dot" x="80" y="80" width="4" height="4"/></g>
+  <text x="376" y="210">QR code</text>
+  <text x="376" y="232" class="t-s">104 B signed</text>
+  <text x="376" y="248" class="t-s">statement, or</text>
+  <text x="376" y="264" class="t-s">48 B drand no.</text>
+  <line class="ln" x1="210" y1="232" x2="255.0" y2="232.0"/><polygon class="arr" points="260,232 252.6,235.1 252.6,228.9"/><line class="ln" x1="498" y1="232" x2="543.0" y2="232.0"/><polygon class="arr" points="548,232 540.6,235.1 540.6,228.9"/>
+</svg>
+      <figcaption>Fig. 5 · The gigabytes cross early. At T only a few bytes cross, and they are public, so the channel needs to reach the site, not to be secret.</figcaption>
+    </figure>
+    <p>A checked drand number also proves that its moment has passed. A site without a reliable clock learns that it is at least that late.</p>
+
+    <h2 id="oss">Open source in private</h2>
+    <p>For an open-source project the hard part comes earlier: the fix has to be written and tested without showing it. Today it often shows. In the Keycloak case the fixed builds were tagged a week before the CVE, the port to the main branch was a public pull request whose title does not mention security, and the proof of concept was written from that diff <a href="#s3">[3]</a><a href="#s4">[4]</a>.</p>
+    <p>The tools for private work are thin. On GitHub, maintainers can open a temporary private fork from a security advisory. Only invited collaborators see it, but no CI runs there, branch protection does not apply, and merging and publishing are manual steps <a href="#s19">[19]</a>. On GitLab a merge request in a public project is public; private work needs a separate private fork <a href="#s20">[20]</a>. Distributions coordinate by mail: the linux-distros list allows an embargo of at most 14 days <a href="#s21">[21]</a>, and the kernel security team holds a fix back for at most 7 days, 14 in exceptional cases <a href="#s22">[22]</a>. The Git project comes closest to the idea of this post: it prepares signed tags in a private repository, sends a bundle to the distributions less than a week ahead, and pushes in public on release day <a href="#s23">[23]</a>. That bundle is plaintext and goes to a few.</p>
+    <figure class="fig-wide">
+      <svg class="dg" viewBox="0 0 760 330" role="img" aria-labelledby="d4t d4d">
+  <title id="d4t">A security fix in an open-source project, from private work to release</title>
+  <desc id="d4d">The maintainers write and test the fix on a private branch with private CI. Days before T the project publishes the encrypted, signed build. The embargo list of distributions gets the key early to test. Everyone else stages the ciphertext. At T the key is published, everyone applies the fix, and the public repository gets the merge and the advisory.</desc>
+  <line class="ln-s" x1="505" y1="38" x2="505" y2="290"/>
+  <text x="505" y="26" text-anchor="middle" class="t-h">T · release</text>
+  <text x="20" y="73" class="t-h">Maintainers</text><text x="20" y="123" class="t-h">Release</text><text x="20" y="173" class="t-h">Embargo list</text><text x="20" y="223" class="t-h">Everyone</text><text x="20" y="273" class="t-h">Public repo</text>
+  <rect class="bx-s" x="165" y="56" width="238" height="26"/>
+  <text x="177" y="73">private branch, private CI</text>
+  <rect class="bx-s" x="301" y="106" width="204" height="26"/>
+  <text x="313" y="123">encrypted build, signed</text>
+  <rect class="bx-i" x="505" y="106" width="22" height="26"/>
+  <text x="537" y="123" class="t-s">key published</text>
+  <rect class="bx-i" x="335" y="156" width="170" height="26"/>
+  <text x="347" y="173" class="t-inv">early key: test</text>
+  <rect class="bx-s" x="335" y="206" width="170" height="26"/>
+  <text x="347" y="223">ciphertext staged</text>
+  <rect class="bx-i" x="505" y="206" width="22" height="26"/>
+  <text x="537" y="223" class="t-s">apply at T</text>
+  <rect class="bx-i" x="505" y="256" width="170" height="26"/>
+  <text x="517" y="273" class="t-inv">merge + advisory</text>
+  <line class="ln" x1="362.2" y1="82" x2="362.2" y2="99.0"/><polygon class="arr" points="362.2,104 359.1,96.6 365.3,96.6"/>
+  <line class="ln" x1="165" y1="304" x2="709" y2="304"/>
+  <line class="ln" x1="165" y1="300" x2="165" y2="308"/><text x="165" y="322" text-anchor="middle" class="t-s">−10 days</text>
+  <line class="ln" x1="505" y1="298" x2="505" y2="310"/><text x="505" y="322" text-anchor="middle" class="t-s">T</text>
+  <line class="ln" x1="709" y1="300" x2="709" y2="308"/><text x="709" y="322" text-anchor="middle" class="t-s">+6 days</text>
+</svg>
+      <figcaption>Fig. 6 · Work in private, publish the ciphertext early, open it for everyone at T. The embargo list keeps what it has today: early access to test.</figcaption>
+    </figure>
+    <p>To make this normal, a forge such as GitHub or GitLab would need (Fig. 7):</p>
+    <ul>
+      <li>Private branches and pull requests inside the public repository, visible only to maintainers and a security role.</li>
+      <li>Private CI for those branches, with closed logs and no webhooks to outside apps.</li>
+      <li>Release artefacts that are published encrypted and signed, with the key held by the forge.</li>
+      <li>One action that, at T, publishes the key, merges the branch and publishes the advisory.</li>
+    </ul>
+    <figure class="fig-wide" data-steps>
+      <svg class="dg" viewBox="0 0 760 420" role="img" aria-labelledby="d6t d6d">
+  <title id="d6t">What a forge would need for a private fix in a public repository</title>
+  <desc id="d6d">Inside the public repository a private branch holds the fix; only maintainers and a security role see it. Private CI with closed logs tests it. Days before T the forge publishes the encrypted, signed release, and the embargo list gets the key early. At T one action publishes the key and the advisory and merges the branch, and everyone applies the fix.</desc>
+  <rect class="bx" x="20" y="44" width="720" height="262"/>
+  <text x="36" y="68" class="t-h">Public repository</text>
+  <line class="ln-s" x1="600" y1="34" x2="600" y2="404"/>
+  <text x="600" y="26" text-anchor="middle" class="t-h">T</text>
+  <text x="60" y="88" class="t-s">main · public</text>
+  <line class="ln-t" x1="60" y1="104" x2="720" y2="104"/>
+  <circle class="dot" cx="110" cy="104" r="5"/><circle class="dot" cx="210" cy="104" r="5"/><circle class="dot" cx="310" cy="104" r="5"/><circle class="dot" cx="410" cy="104" r="5"/><circle class="dot" cx="510" cy="104" r="5"/>
+  <g data-step="1"><rect class="bx-d" x="60" y="124" width="500" height="112"/><text x="166" y="144" class="t-s">private branch · maintainers and a security role only</text><path class="ln" d="M150 104 V176 H520"/><circle class="dot" cx="230" cy="176" r="5"/><circle class="dot" cx="310" cy="176" r="5"/><circle class="dot" cx="390" cy="176" r="5"/></g>
+  <g data-step="2"><rect class="bx-s" x="344" y="192" width="200" height="34"/><text x="356" y="214">private CI, closed logs</text></g>
+  <text x="36" y="276" class="t-s">releases</text>
+  <g data-step="3"><rect class="bx-s" x="330" y="254" width="250" height="38"/><text x="344" y="278">encrypted release, signed</text><line class="ln" x1="455" y1="292" x2="455.0" y2="329.0"/><polygon class="arr" points="455,334 451.9,326.6 458.1,326.6"/><rect class="bx" x="330" y="336" width="250" height="54"/><text x="344" y="358">embargo list</text><text x="344" y="377" class="t-s">early key: test</text></g>
+  <g data-step="4"><path class="ln" d="M520 176 L600 104"/><circle class="dot" cx="600" cy="104" r="7"/><text x="610" y="128" class="t-s">merge</text><rect class="bx-i" x="600" y="254" width="130" height="38"/><text x="612" y="278" class="t-inv">key + advisory</text><line class="ln" x1="665" y1="292" x2="665.0" y2="329.0"/><polygon class="arr" points="665,334 661.9,326.6 668.1,326.6"/><rect class="bx" x="600" y="336" width="140" height="54"/><text x="612" y="358">everyone</text><text x="612" y="377" class="t-s">applies at T</text></g>
+</svg>
+      <div class="steps__panel">
+        <ol class="steps__list">
+          <li>The fix is written on a private branch inside the public repository. Only the maintainers and a security role can see it.</li>
+          <li>Private CI builds and tests the branch. Its logs stay closed.</li>
+          <li>Days before T the forge publishes the encrypted, signed release. The embargo list gets the key early and tests.</li>
+          <li>At T one action publishes the key and the advisory and merges the branch. Everyone applies the fix.</li>
+        </ol>
+      </div>
+      <figcaption>Fig. 7 · What a forge would need for a private fix in a public repository.</figcaption>
+    </figure>
+    <p>The embargo lists fit into this as they are: their members get the key early and test, everyone else gets the ciphertext early. Each early key is a chance to leak, so the list stays short and the embargo stays short.</p>
+
+    <h2 id="limits">What it does not fix</h2>
+    <ul>
+      <li><b>Diffing after T.</b> At T the patch is public. The scheme moves the start line; it does not stop the race. It helps the hosts that install at once.</li>
+      <li><b>Zero-days.</b> They are still 62&nbsp;% of the vulnerabilities Google saw exploited in 2026 <a href="#s7">[7]</a>. No patch, nothing to encrypt. The scheme is for the part that grows fastest.</li>
+      <li><b>Slow patching.</b> A host that waits a month after T gains nothing. The scheme helps those who can apply at T.</li>
+      <li><b>Metadata.</b> File names and sizes still show which component changed. Padding and fixed bundles help, at a cost in bandwidth.</li>
+      <li><b>Insiders.</b> The key exists before T. Create it late, keep it in an HSM, split it between people.</li>
+      <li><b>Testing.</b> Companies test patches before they roll them out. Most can stage before T but test only after it. Early keys for a few, as embargo lists do today, bring back the risk of leaks.</li>
+    </ul>
+
+    <h2 id="prior">Prior art and patents</h2>
+    <p>The idea is not new, and the patents below show it. I found no vendor that does it for security patches today.</p>
+    <p>Microsoft has patents on it. They are old, but they matter now. This is my reading, not legal advice, and I could not open the claims or the fee records:</p>
+    <ul>
+      <li><b>US 7,876,902</b>, "Distribution of encrypted software update to reduce attack window", priority date 31 August 2006, granted 2011 <a href="#s24">[24]</a>. A US patent runs 20 years from filing, so it ends around 31 August 2026, later only if the patent office added term for its own delays, and earlier if a maintenance fee was not paid. Its description releases the key once enough machines have the update or after testing, not at a fixed time.</li>
+      <li><b>US 8,171,560</b>, "Secure content pre-distribution to designated systems", granted 2012 <a href="#s25">[25]</a>. It is closer to this post: content goes out encrypted and the key follows at a set moment. Filed around 2008, it may run to about 2028.</li>
+    </ul>
+    <p>So the design can be built from public parts, and a fixed release time, a transparency log and a public beacon in place of a vendor key server differ from the first patent's description. Whether that is enough depends on the claims. Anyone who wants to ship this as a product in the US before about 2028 should have a patent attorney read both patents first.</p>
+    <p>My conclusion: the tool is cheap for an update system that already signs its metadata. It does not stop patch diffing, and with LLMs diffing is now cheap. It lets every team have the fix ready when it becomes public, and that turns patch day from a race into a date.</p>
+
+    <h2 id="sources">Sources</h2>
+    <ol class="refs">
+      <li id="s1">Keycloak: <a href="https://github.com/keycloak/keycloak/tags" rel="noopener">tags</a> and <a href="https://github.com/keycloak/keycloak/security/advisories" rel="noopener">security advisories</a>, Nov 2025 to Nov 2026; <a href="https://github.com/advisories?query=keycloak+published%3A%3E%3D2025-11-10" rel="noopener">GitHub Advisory Database</a>.</li>
+      <li id="s2">The Hacker News: <a href="https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html" rel="noopener">Critical Keycloak password reset flaw</a>, Aug 2026; <a href="https://www.sentinelone.com/vulnerability-database/cve-2026-18963/" rel="noopener">SentinelOne: CVE-2026-18963</a>.</li>
+      <li id="s3">Keycloak: <a href="https://github.com/keycloak/keycloak/pull/51844" rel="noopener">pull request #51844</a>, Aug 2026.</li>
+      <li id="s4"><a href="https://github.com/Red-Darkin/CVE-2026-18963-keycloak" rel="noopener">Red-Darkin/CVE-2026-18963-keycloak</a>, 2026.</li>
+      <li id="s5">Anthropic: <a href="https://anthropic.com/research/n-days" rel="noopener">N-days to N-hours</a>, Jun 2026.</li>
+      <li id="s6">Elastic Security Labs: <a href="https://www.elastic.co/security-labs/blog/patch-diff-to-system" rel="noopener">Patch diff to SYSTEM</a>, Mar 2026.</li>
+      <li id="s7">Google Threat Intelligence: <a href="https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era" rel="noopener">Vulnerability discovery and exploitation trends in the AI era</a>, Sep 2026.</li>
+      <li id="s8">Mandiant: <a href="https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026/" rel="noopener">M-Trends 2026</a>, Mar 2026.</li>
+      <li id="s9">Rapid7: <a href="https://www.rapid7.com/about/press-releases/rapid7-2026-global-threat-landscape-report-shows-exploited-high-and-critical-severity-vulnerabilities-surged-105-as-attack-timelines-collapsed" rel="noopener">2026 Global Threat Landscape Report</a>, 2026.</li>
+      <li id="s10">CSO Online: <a href="https://www.csoonline.com/article/4236599/xbow-spent-40k-on-ai-and-cracked-google-chrome-wide-open-2.html" rel="noopener">XBOW spent $40k on AI and cracked Google Chrome</a>, Oct 2026.</li>
+      <li id="s11">Anthropic: <a href="https://anthropic.com/research/mythos-preview" rel="noopener">Mythos Preview</a>, Apr 2026.</li>
+      <li id="s12">depthfirst: <a href="https://depthfirst.com/research/21-zero-days-in-ffmpeg" rel="noopener">21 zero-days in FFmpeg</a>, Jun 2026.</li>
+      <li id="s13">SteamDB: <a href="https://steamdb.info/blog/steam-download-system" rel="noopener">How the Steam download system works</a>.</li>
+      <li id="s14"><a href="https://github.com/theupdateframework/specification/blob/master/tuf-spec.md" rel="noopener">The Update Framework specification</a>.</li>
+      <li id="s15"><a href="https://github.com/uptane/uptane-standard/blob/master/uptane-standard.md" rel="noopener">Uptane Standard</a>.</li>
+      <li id="s16"><a href="https://datatracker.ietf.org/doc/html/rfc9162" rel="noopener">RFC 9162: Certificate Transparency 2.0</a>; <a href="https://docs.sigstore.dev/logging/overview/" rel="noopener">Sigstore Rekor</a>.</li>
+      <li id="s17">drand: <a href="https://github.com/drand/tlock" rel="noopener">tlock</a>.</li>
+      <li id="s18">ISO/IEC 18004 capacity table, summarised by <a href="https://www.keyence.com/ss/products/auto_id/barcode_lecture/basic_2d/qr/" rel="noopener">Keyence</a>.</li>
+      <li id="s19">GitHub Docs: <a href="https://docs.github.com/en/code-security/tutorials/fix-reported-vulnerabilities/collaborate-in-a-fork" rel="noopener">Collaborating in a temporary private fork</a>.</li>
+      <li id="s20">GitLab Docs: <a href="https://docs.gitlab.com/user/project/merge_requests/confidential/" rel="noopener">Confidential merge requests</a>.</li>
+      <li id="s21">Openwall: <a href="https://oss-security.openwall.org/wiki/mailing-lists/distros" rel="noopener">The distros mailing list</a>.</li>
+      <li id="s22">Linux kernel: <a href="https://docs.kernel.org/process/security-bugs.html" rel="noopener">Security bugs</a>.</li>
+      <li id="s23">Git: <a href="https://github.com/git/git/blob/master/Documentation/howto/coordinate-embargoed-releases.adoc" rel="noopener">How to coordinate embargoed releases</a>.</li>
+      <li id="s24">Microsoft: <a href="https://patents.google.com/patent/US7876902" rel="noopener">US 7,876,902 B2</a>, Distribution of encrypted software update to reduce attack window.</li>
+      <li id="s25">Microsoft: <a href="https://patents.google.com/patent/US8171560" rel="noopener">US 8,171,560 B2</a>, Secure content pre-distribution to designated systems.</li>
+    </ol>
+
+    <h2 id="revisions">Revisions</h2>
+    <ul class="dates">
+      <li><time datetime="2026-11-10">10 Nov 2026</time><span>First version, as a blog post.</span></li>
+    </ul>
+
+    <h2 id="feedback">Feedback</h2>
+    <p>Not shared yet. When I post about it, what people answer goes here, with what it changed.</p>
+  </article>
+</div>
+
+</main>
+
+<footer class="foot">
+  <div class="wrap">
+    <span>Tim Conrad</span>
+    <span>No cookies, no trackers, no third-party requests</span>
+  </div>
+</footer>
+
+</body>
+</html>
diff --git a/thoughts/humans-md/HUMANS.md b/thoughts/humans-md/HUMANS.md
new file mode 100644
index 0000000..5928d8d
--- /dev/null
+++ b/thoughts/humans-md/HUMANS.md
@@ -0,0 +1,31 @@
+# HUMANS.md
+
+How I work with language models. The agent has its CLAUDE.md. This file is for me.
+
+Version 0.2, 10 Nov 2026. The thinking behind it: https://t7d.dev/thoughts/humans-md/
+
+## With every model
+
+1. Agree first. For anything bigger than a small fix, let the model ask me questions until the plan is clear. Keep the words we agreed on.
+2. Say what I want done. "Change it", not "can you suggest". Give the reason for a rule instead of capital letters.
+3. Give context as to a new colleague: the goal, the limits, where to look.
+4. Read what I merge. Tests show that it works. Reading shows that I understand it.
+5. When something breaks, look first myself, or ask for the explanation with the fix.
+6. Do some small work without a model, regularly, so I can still do it.
+7. Measure instead of feel, without extra work: once a month and after each model switch, read the report from the session transcripts and git. Look at the sessions that went worst.
+
+## When a new model ships
+
+1. Read the model card and the vendor's prompting guide. Look for what the model does more, what it does less, and what to remove.
+2. Do one real task without my CLAUDE.md files. Compare.
+3. Remove what the new model no longer needs: capitals, old workarounds, extra checks.
+   Let a review skill and `/doctor prompt-audit` in Claude Code find these, then decide myself.
+4. Write one entry in the log.
+5. Two weeks later, read the entry again. Was it right?
+
+## Log
+
+| Date | Model | What the guide says changed | What I change | Two weeks later |
+| --- | --- | --- | --- | --- |
+| 10 Nov 2026 | Claude Opus 5.5 | Newer Claude models follow instructions literally, check their own work, and react strongly to words like CRITICAL | To try: remove capitals and "verify each step" lines from my CLAUDE.md files | |
+| 10 Nov 2026 | Claude Opus 5.5, Fable 5.2 | Claude Code docs: CLAUDE.md under 200 lines, no file layout, no emphasis, hooks for hard rules, the check command first | t7d.dev CLAUDE.md from 76 to 33 lines: notes into a skill and a hook, a page check in CI, page rules on demand | |
diff --git a/thoughts/humans-md/index.html b/thoughts/humans-md/index.html
new file mode 100644
index 0000000..f781ab7
--- /dev/null
+++ b/thoughts/humans-md/index.html
@@ -0,0 +1,600 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; font-src 'self'; media-src 'self'; base-uri 'none'; form-action 'none'">
+<title>A humans.md for working with models · Tim Conrad</title>
+<meta name="description" content="My repositories tell the agent how to work with me, but nothing tells me how to work with the agent. Who already uses the name humans.md, how models change under you, why feel is a bad meter, and a first version of the file, with a log for each new model.">
+<link rel="canonical" href="https://t7d.dev/thoughts/humans-md/">
+<meta property="og:type" content="article">
+<meta property="og:title" content="A humans.md for working with models">
+<meta property="og:description" content="My repositories tell the agent how to work with me, but nothing tells me how to work with the agent. Who already uses the name humans.md, how models change under you, why feel is a bad meter, and a first version of the file, with a log for each new model.">
+<meta property="og:url" content="https://t7d.dev/thoughts/humans-md/">
+<meta property="og:image" content="https://t7d.dev/assets/og.png">
+<meta property="article:published_time" content="2026-11-10">
+<meta name="twitter:card" content="summary_large_image">
+<link rel="alternate" type="application/rss+xml" title="Tim Conrad · Thoughts" href="/thoughts/feed.xml">
+<link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
+<link rel="preload" href="/assets/fonts/barlow-condensed-700.woff2" as="font" type="font/woff2" crossorigin>
+<link rel="stylesheet" href="/assets/site.css">
+<script src="/assets/theme.js"></script>
+<script src="/assets/site.js" defer></script>
+</head>
+<body>
+<a class="skip" href="#main">Skip to content</a>
+
+<header class="nav">
+  <div class="wrap nav__in">
+    <a class="brand" href="/">Tim Conrad</a>
+    <nav class="nav__links" aria-label="Site">
+      <a href="/#games">Games</a>
+      <a href="/thoughts/">Thoughts</a>
+      <a class="opt3" href="/#research">Research</a>
+      <a class="opt2" href="/#verify">PGP key</a>
+      <a class="opt2" href="/#contact">Contact</a>
+    </nav>
+    <button class="toggle" id="theme-toggle" type="button">dark</button>
+  </div>
+</header>
+
+<main id="main" class="wrap">
+
+<header class="post-head">
+  <a class="crumb" href="/thoughts/">← Thoughts</a>
+  <h1>A humans.md for working with models</h1>
+  <p class="sub">My repositories tell the agent how to work with me. Nothing tells me how to work with the agent. A first version of that file, and what I found when I looked for one.</p>
+  <p class="label">Tim Conrad · Language models · Habits · Coding agents</p>
+  <dl class="tmeta">
+    <div><dt>Status</dt><dd><span class="status">Draft</span></dd></div>
+    <div><dt>Started</dt><dd><time datetime="2026-11-10">10 Nov 2026</time></dd></div>
+    <div><dt>Last revised</dt><dd><time datetime="2026-11-10">10 Nov 2026</time></dd></div>
+  </dl>
+</header>
+
+<div class="post">
+  <nav class="toc" aria-label="On this page">
+    <p class="label">On this page</p>
+    <ol>
+      <li><a href="#missing">The missing file</a></li>
+      <li><a href="#taken">The name is taken</a></li>
+      <li><a href="#change">Models change under me</a></li>
+      <li><a href="#feel">Feel is a bad meter</a></li>
+      <li><a href="#measure">Measure without extra work</a></li>
+      <li><a href="#agree">Agree first, then build</a></li>
+      <li><a href="#sharp">Stay able to do it</a></li>
+      <li><a href="#loop">When a new model ships</a></li>
+      <li><a href="#review">Reviewing my CLAUDE.md</a></li>
+      <li><a href="#file">The file, version 0</a></li>
+      <li><a href="#open">Open questions</a></li>
+      <li><a href="#start">Starting points</a></li>
+      <li><a href="#sources">Sources</a></li>
+      <li><a href="#revisions">Revisions</a></li>
+      <li><a href="#feedback">Feedback</a></li>
+    </ol>
+  </nav>
+
+  <article class="prose">
+    <h2 id="missing">The missing file</h2>
+    <p>Every repository of mine has a <code>CLAUDE.md</code>. It tells the agent how to build the project, what to leave alone and how I want my commits. When the agent gets something wrong, I add a line.</p>
+    <p>There is no such file for me. When a new model comes out, I switch, try a few tasks and go by feel. Sometimes I start a task without any <code>CLAUDE.md</code>, to see whether the new model does better without my old rules. Mostly I just notice things.</p>
+    <p>That is a strange split. The model gets a written manual and a changelog. The person who drives it gets a hunch. This thought is about the other file: a <code>humans.md</code>, with rules for me, written down and changed when the model changes.</p>
+
+    <h2 id="taken">The name is taken</h2>
+    <p>I was not the first to think of it. I found three projects that use the name, and they mean three different things.</p>
+    <figure class="fig-wide anim">
+      <svg class="dg dg-w" viewBox="0 0 640 380" role="img" aria-labelledby="f1t f1d">
+        <title id="f1t">Files called humans.md, by who reads them and what they are about</title>
+        <desc id="f1d">Horizontal axis: the agent reads it, or I read it. Vertical axis: how I work, or how the agent treats me. attogram/agents HUMANS.md, September 2025, is read by humans and is about how they work. thellmwhisperer/human.md, February 2026, is read by the agent and sets hours and breaks. cmdai-hq/HUMANS.md, October 2026, is read by the agent and says how to talk to me. The file in this thought sits next to attogram's and adds a log per model.</desc>
+        <line class="ln draw" pathLength="1" x1="40" y1="190" x2="600" y2="190"/>
+        <line class="ln draw d1" pathLength="1" x1="320" y1="30" x2="320" y2="350"/>
+        <text x="40" y="180" class="t-s">the agent reads it</text>
+        <text x="600" y="180" text-anchor="end" class="t-s">I read it</text>
+        <text x="330" y="40" class="t-s">about how I work</text>
+        <text x="330" y="346" class="t-s">about how the agent treats me</text>
+        <g data-pick="atto" class="pop d3">
+          <circle class="dot dot-pick" cx="530" cy="80" r="9"/>
+          <text x="514" y="76" text-anchor="end" class="t-pick">attogram/agents</text>
+          <text x="514" y="93" text-anchor="end" class="t-s">Sep 2025 · for humans</text>
+        </g>
+        <g data-pick="mine" class="pop d6">
+          <circle class="bx-d dot-pick" cx="480" cy="140" r="11"/>
+          <text x="462" y="136" text-anchor="end" class="t-pick">this file</text>
+          <text x="462" y="153" text-anchor="end" class="t-s">+ a log per model</text>
+        </g>
+        <g data-pick="cmd" class="pop d5">
+          <circle class="dot dot-pick" cx="130" cy="235" r="9"/>
+          <text x="146" y="231" class="t-pick">cmdai-hq/HUMANS.md</text>
+          <text x="146" y="248" class="t-s">Oct 2026 · how to reach me</text>
+        </g>
+        <g data-pick="llm" class="pop d4">
+          <circle class="dot dot-pick" cx="80" cy="292" r="9"/>
+          <text x="96" y="288" class="t-pick">thellmwhisperer/human.md</text>
+          <text x="96" y="305" class="t-s">Feb 2026 · hours and breaks</text>
+        </g>
+      </svg>
+      <svg class="dg dg-n" viewBox="0 0 360 400" role="img" aria-labelledby="f1nt">
+        <title id="f1nt">Files called humans.md, by who reads them and what they are about</title>
+        <line class="ln draw" pathLength="1" x1="10" y1="200" x2="350" y2="200"/>
+        <line class="ln draw d1" pathLength="1" x1="180" y1="30" x2="180" y2="370"/>
+        <text x="10" y="190" class="t-s">agent reads it</text>
+        <text x="350" y="190" text-anchor="end" class="t-s">I read it</text>
+        <text x="188" y="42" class="t-s">about how I work</text>
+        <text x="188" y="364" class="t-s">about how it treats me</text>
+        <g data-pick="atto" class="pop d3"><circle class="dot dot-pick" cx="315" cy="80" r="9"/><text x="299" y="76" text-anchor="end" class="t-pick">attogram</text><text x="299" y="93" text-anchor="end" class="t-s">Sep 2025</text></g>
+        <g data-pick="mine" class="pop d6"><circle class="bx-d dot-pick" cx="322" cy="145" r="11"/><text x="304" y="141" text-anchor="end" class="t-pick">this file</text><text x="304" y="158" text-anchor="end" class="t-s">+ log per model</text></g>
+        <g data-pick="cmd" class="pop d5"><circle class="dot dot-pick" cx="34" cy="245" r="9"/><text x="50" y="241" class="t-pick">cmdai-hq</text><text x="50" y="258" class="t-s">Oct 2026</text></g>
+        <g data-pick="llm" class="pop d4"><circle class="dot dot-pick" cx="24" cy="305" r="9"/><text x="40" y="301" class="t-pick">thellmwhisperer</text><text x="40" y="318" class="t-s">Feb 2026</text></g>
+      </svg>
+      <div class="pick__panel">
+        <p class="pick__hint">Tap a point to read about that file.</p>
+        <ul class="pick__list">
+          <li data-k="atto"><b>attogram/agents, HUMANS.md</b>: the oldest one I can date, first added on 5 September 2025. It sits next to <code>AGENTS.md</code> and is for humans to read: treat agents as junior developers, give clear instructions, review their pull requests. It has one guide per agent, for Jules, Claude and Claude Code <a href="#s1">[1]</a>.</li>
+          <li data-k="llm"><b>thellmwhisperer/human.md</b>, February 2026: a file the agent reads. It holds your working hours, breaks and the longest session you allow, and a hook makes the agent tell you when to stop <a href="#s2">[2]</a>.</li>
+          <li data-k="cmd"><b>cmdai-hq/HUMANS.md</b>, October 2026: a profile in your home folder that tells your agents, and your colleagues' agents, how to write to you, when to ask you and when to interrupt you. "AGENTS.md is for your codebase. HUMANS.md is for you." <a href="#s3">[3]</a></li>
+          <li data-k="mine"><b>This file</b>: like attogram's, it is for me to read. What I could not find anywhere is the log: one entry for each new model, because the models change.</li>
+        </ul>
+      </div>
+      <figcaption>Fig. 1 · Three files with one name. Their places on the map are my reading of each project.</figcaption>
+    </figure>
+    <p>So "humans.md" is not my term, and it is not a standard either. Two of the three are files for the agent, about how it should treat me. Mine is the other way round: a file for me, about how I should work with it.</p>
+
+    <h2 id="change">Models change under me</h2>
+    <p>The vendors already write a kind of humans.md for every model. They call it a prompting guide, and the useful part is the section on what changed. Anthropic's guide puts the differences between models first <a href="#s4">[4]</a>. Three of its examples:</p>
+    <ul>
+      <li>Newer models listen more closely to the instructions. Capitals like "CRITICAL: You MUST", which once helped a model use a tool at all, now make it use the tool too often. The guide says to soften them.</li>
+      <li>Claude Opus 5 checks its own work. Old instructions to verify every step make it check again and again. The guide says to remove them.</li>
+      <li>Newer models take the words literally. "Can you suggest some changes?" can get suggestions and no changes.</li>
+    </ul>
+    <p>Other vendors say the same. OpenAI's guide for GPT-5.5 says to treat it as a new model family and to start from a fresh baseline, instead of carrying over every instruction from older prompts <a href="#s5">[5]</a>. Google recommends that Gemini 3 keep its default temperature of 1.0, although tuning the temperature was normal with older models <a href="#s6">[6]</a>.</p>
+    <figure class="fig-wide anim" data-switch="What I meant|What a newer model does">
+      <svg class="dg dg-w" viewBox="0 0 680 296" role="img" aria-labelledby="f2t f2d">
+        <title id="f2t">The same instruction, read by a newer model</title>
+        <desc id="f2d">Three instructions written for older models. CRITICAL: You MUST use the search tool: I meant that it searches when it helps; a newer model searches far too often. After each step, verify your work twice: I meant one more check; a newer model that checks its own work checks again and again. Can you suggest some changes: I meant that it changes the code; a literal model lists ideas and changes nothing.</desc>
+        <text x="20" y="28" class="t-h">Written for an older model</text>
+        <text x="370" y="28" class="t-h w-a">What I meant</text>
+        <text x="370" y="28" class="t-h w-b">What a newer model does</text>
+
+        <rect class="bx-s" x="20" y="44" width="300" height="68"/>
+        <text x="36" y="72">CRITICAL: You MUST use the</text>
+        <text x="36" y="92">search tool when it helps.</text>
+        <line class="ln" x1="328" y1="78" x2="358" y2="78"/><polygon class="arr" points="358,73 366,78 358,83"/>
+        <rect class="bx" x="370" y="44" width="290" height="68"/>
+        <text x="386" y="68" class="w-a">searches when it helps</text>
+        <text x="386" y="68" class="w-b">searches far too often</text>
+        <rect class="bx-s" x="386" y="78" width="258" height="10"/>
+        <rect class="bx-i lvl s30 b100" x="386" y="78" width="258" height="10"/>
+        <text x="386" y="104" class="t-s">how often it searches</text>
+
+        <rect class="bx-s" x="20" y="128" width="300" height="68"/>
+        <text x="36" y="156">After each step, verify your</text>
+        <text x="36" y="176">work twice.</text>
+        <line class="ln" x1="328" y1="162" x2="358" y2="162"/><polygon class="arr" points="358,157 366,162 358,167"/>
+        <rect class="bx" x="370" y="128" width="290" height="68"/>
+        <text x="386" y="152" class="w-a">checks once more</text>
+        <text x="386" y="152" class="w-b">checks again and again</text>
+        <rect class="bx-s" x="386" y="162" width="258" height="10"/>
+        <rect class="bx-i lvl s30 b100" x="386" y="162" width="258" height="10"/>
+        <text x="386" y="188" class="t-s">how often it checks</text>
+
+        <rect class="bx-s" x="20" y="212" width="300" height="68"/>
+        <text x="36" y="240">Can you suggest some</text>
+        <text x="36" y="260">changes?</text>
+        <line class="ln" x1="328" y1="246" x2="358" y2="246"/><polygon class="arr" points="358,241 366,246 358,251"/>
+        <rect class="bx" x="370" y="212" width="290" height="68"/>
+        <text x="386" y="236" class="w-a">changes the code</text>
+        <text x="386" y="236" class="w-b">lists ideas, changes nothing</text>
+        <rect class="bx-s" x="386" y="246" width="258" height="10"/>
+        <rect class="bx-i lvl s100 b10" x="386" y="246" width="258" height="10"/>
+        <text x="386" y="272" class="t-s">how much it changes</text>
+      </svg>
+      <svg class="dg dg-n" viewBox="0 0 360 572" role="img" aria-labelledby="f2nt">
+        <title id="f2nt">The same instruction, read by a newer model</title>
+        <text x="10" y="24" class="t-h">Written for an older model</text>
+        <rect class="bx-s" x="10" y="40" width="340" height="60"/>
+        <text x="24" y="65">CRITICAL: You MUST use the</text>
+        <text x="24" y="85">search tool when it helps.</text>
+        <line class="ln" x1="180" y1="104" x2="180" y2="120"/><polygon class="arr" points="175,120 180,128 185,120"/>
+        <rect class="bx" x="10" y="132" width="340" height="68"/>
+        <text x="24" y="156" class="w-a">searches when it helps</text>
+        <text x="24" y="156" class="w-b">searches far too often</text>
+        <rect class="bx-s" x="24" y="166" width="312" height="10"/>
+        <rect class="bx-i lvl s30 b100" x="24" y="166" width="312" height="10"/>
+        <text x="24" y="192" class="t-s">how often it searches</text>
+        <rect class="bx-s" x="10" y="216" width="340" height="60"/>
+        <text x="24" y="241">After each step, verify your</text>
+        <text x="24" y="261">work twice.</text>
+        <line class="ln" x1="180" y1="280" x2="180" y2="296"/><polygon class="arr" points="175,296 180,304 185,296"/>
+        <rect class="bx" x="10" y="308" width="340" height="68"/>
+        <text x="24" y="332" class="w-a">checks once more</text>
+        <text x="24" y="332" class="w-b">checks again and again</text>
+        <rect class="bx-s" x="24" y="342" width="312" height="10"/>
+        <rect class="bx-i lvl s30 b100" x="24" y="342" width="312" height="10"/>
+        <text x="24" y="368" class="t-s">how often it checks</text>
+        <rect class="bx-s" x="10" y="392" width="340" height="60"/>
+        <text x="24" y="417">Can you suggest some</text>
+        <text x="24" y="437">changes?</text>
+        <line class="ln" x1="180" y1="456" x2="180" y2="472"/><polygon class="arr" points="175,472 180,480 185,472"/>
+        <rect class="bx" x="10" y="484" width="340" height="68"/>
+        <text x="24" y="508" class="w-a">changes the code</text>
+        <text x="24" y="508" class="w-b">lists ideas, changes nothing</text>
+        <rect class="bx-s" x="24" y="518" width="312" height="10"/>
+        <rect class="bx-i lvl s100 b10" x="24" y="518" width="312" height="10"/>
+        <text x="24" y="544" class="t-s">how much it changes</text>
+      </svg>
+      <figcaption>Fig. 2 · Switch between what I meant and what a newer model does with the same words. The examples are from Anthropic's guide <a href="#s4">[4]</a>, shortened. The bars show the direction, not a measurement.</figcaption>
+    </figure>
+    <p>A habit that helped with the last model can hurt with this one. And my trick of starting without a <code>CLAUDE.md</code> turns out to be the fresh baseline that OpenAI recommends. I just did it without knowing why.</p>
+
+    <h2 id="feel">Feel is a bad meter</h2>
+    <p>That I go by feel worries me because of one study. In early 2025 METR gave 16 experienced open-source developers real tasks in their own projects, some with AI tools and some without <a href="#s7">[7]</a>.</p>
+    <figure class="fig-wide anim">
+      <svg class="dg dg-w" viewBox="0 0 680 250" role="img" aria-labelledby="f3t f3d">
+        <title id="f3t">Felt and measured speed in METR's 2025 study</title>
+        <desc id="f3d">Before the tasks the developers expected to be 24 percent faster with AI. Afterwards they believed they had been 20 percent faster. Measured, they took 19 percent longer.</desc>
+        <line class="ln" x1="360" y1="30" x2="360" y2="210"/>
+        <text x="20" y="65">Expected, before</text>
+        <rect class="bx-s grow d1" x="360" y="46" width="144" height="28"/>
+        <text x="514" y="65" data-count="24" data-fmt="{}% faster">24% faster</text>
+        <text x="20" y="123">Believed, after</text>
+        <rect class="bx-s grow d3" x="360" y="104" width="120" height="28"/>
+        <text x="490" y="123" data-count="20" data-fmt="{}% faster">20% faster</text>
+        <text x="20" y="181" class="t-h">Measured</text>
+        <rect class="bx-i grow-l d6" x="246" y="162" width="114" height="28"/>
+        <text x="238" y="181" text-anchor="end" data-count="19" data-fmt="{}% slower">19% slower</text>
+        <text x="352" y="232" text-anchor="end" class="t-s">← slower</text>
+        <text x="368" y="232" class="t-s">faster →</text>
+      </svg>
+      <svg class="dg dg-n" viewBox="0 0 360 290" role="img" aria-labelledby="f3nt">
+        <title id="f3nt">Felt and measured speed in METR's 2025 study: expected 24 percent faster, believed 20 percent faster, measured 19 percent slower</title>
+        <line class="ln" x1="190" y1="36" x2="190" y2="250"/>
+        <text x="10" y="30">Expected, before</text>
+        <text x="350" y="30" text-anchor="end" data-count="24" data-fmt="{}% faster">24% faster</text>
+        <rect class="bx-s grow d1" x="190" y="40" width="120" height="24"/>
+        <text x="10" y="100">Believed, after</text>
+        <text x="350" y="100" text-anchor="end" data-count="20" data-fmt="{}% faster">20% faster</text>
+        <rect class="bx-s grow d3" x="190" y="110" width="100" height="24"/>
+        <text x="10" y="170" class="t-h">Measured</text>
+        <text x="350" y="170" text-anchor="end" data-count="19" data-fmt="{}% slower">19% slower</text>
+        <rect class="bx-i grow-l d6" x="95" y="180" width="95" height="24"/>
+        <text x="182" y="275" text-anchor="end" class="t-s">← slower</text>
+        <text x="198" y="275" class="t-s">faster →</text>
+      </svg>
+      <figcaption>Fig. 3 · METR, early 2025: what 16 developers expected, what they believed afterwards, and what was measured <a href="#s7">[7]</a>.</figcaption>
+    </figure>
+    <p>They expected to be 24% faster. Measured, they took 19% longer. Afterwards they still believed they had been 20% faster.</p>
+    <p>The number itself has aged. METR now marks the 2025 post as out of date. Its update from February 2026 says developers are likely faster than in early 2025, but calls its own data very weak evidence: many developers no longer wanted to work without AI for the test, and the timing breaks down when one person runs several agents at once <a href="#s8">[8]</a>. Other studies found gains: 21% faster in a randomised trial at Google, with a wide margin of error <a href="#s15">[15]</a>, and 26% more completed tasks in three field experiments with code completion <a href="#s16">[16]</a>.</p>
+    <p>What stays is the gap between felt and measured. In November 2026 METR put the speed-up of work at Anthropic at about 2x on well-specified tasks, and treated the staff's own estimate of about 12x as very loose evidence <a href="#s14">[14]</a>. People misjudge their own time in general: they plan too optimistically, and looking at how long past tasks took is what corrects it <a href="#s19">[19]</a>.</p>
+
+    <h2 id="measure">Measure without extra work</h2>
+    <p>I will not log my tasks by hand. I know myself. So the numbers have to come from what is already recorded.</p>
+    <p>Claude Code keeps a transcript of every session on my machine. Besides the conversation, it records the model of each answer, the time of each step, the tokens and their price, and the lines changed <a href="#s18">[18]</a>. Git adds the other half: Claude's commits carry the model's name in a trailer, and a revert or a fix two days later says something about the code that came before it.</p>
+    <figure class="fig-wide anim">
+      <svg class="dg dg-w" viewBox="0 0 680 290" role="img" aria-labelledby="f7t f7d">
+        <title id="f7t">Two records that already exist, and four questions they answer</title>
+        <desc id="f7d">The session transcripts hold the model, time, tokens, cost, lines changed and corrections. Git holds the model trailer, reverts and fixes. The transcripts answer: am I faster, is the result good, how fast does the budget go, what keeps failing. Git also answers whether the result is good.</desc>
+        <rect class="bx-s" x="20" y="60" width="200" height="70"/>
+        <text x="36" y="88" class="t-h">Session transcripts</text>
+        <text x="36" y="108" class="t-s">model, time, tokens, cost,</text>
+        <text x="36" y="122" class="t-s">lines, corrections</text>
+        <rect class="bx-s" x="20" y="170" width="200" height="70"/>
+        <text x="36" y="198" class="t-h">Git history</text>
+        <text x="36" y="218" class="t-s">model trailer, reverts,</text>
+        <text x="36" y="232" class="t-s">fixes two days later</text>
+        <path class="ln draw d1" pathLength="1" d="M220 95 C320 95 320 52 410 52"/>
+        <path class="ln draw d2" pathLength="1" d="M220 95 C320 95 320 117 410 117"/>
+        <path class="ln draw d3" pathLength="1" d="M220 95 C320 95 320 182 410 182"/>
+        <path class="ln draw d4" pathLength="1" d="M220 95 C320 95 320 247 410 247"/>
+        <path class="ln draw d5" pathLength="1" d="M220 205 C320 205 320 117 410 117"/>
+        <g data-pick="fast" class="pop d2"><rect class="bx" x="410" y="30" width="250" height="44"/><text x="426" y="57">Am I faster?</text></g>
+        <g data-pick="good" class="pop d3"><rect class="bx" x="410" y="95" width="250" height="44"/><text x="426" y="122">Is the result good?</text></g>
+        <g data-pick="budget" class="pop d4"><rect class="bx" x="410" y="160" width="250" height="44"/><text x="426" y="187">How fast does the budget go?</text></g>
+        <g data-pick="fail" class="pop d5"><rect class="bx" x="410" y="225" width="250" height="44"/><text x="426" y="252">What keeps failing?</text></g>
+      </svg>
+      <svg class="dg dg-n" viewBox="0 0 360 390" role="img" aria-labelledby="f7nt">
+        <title id="f7nt">Two records that already exist, session transcripts and git history, and four questions they answer</title>
+        <rect class="bx-s" x="10" y="10" width="165" height="64"/>
+        <text x="22" y="36" class="t-h">Transcripts</text>
+        <text x="22" y="56" class="t-s">time, tokens, cost</text>
+        <rect class="bx-s" x="185" y="10" width="165" height="64"/>
+        <text x="197" y="36" class="t-h">Git history</text>
+        <text x="197" y="56" class="t-s">reverts, fixes</text>
+        <path class="ln draw d1" pathLength="1" d="M30 74 V360"/>
+        <path class="ln draw d2" pathLength="1" d="M30 150 H50 M30 220 H50 M30 290 H50 M30 360 H50"/>
+        <path class="ln draw d3" pathLength="1" d="M267 74 V100 H345 V220 H330"/>
+        <g data-pick="fast" class="pop d2"><rect class="bx" x="50" y="130" width="280" height="40"/><text x="66" y="155">Am I faster?</text></g>
+        <g data-pick="good" class="pop d3"><rect class="bx" x="50" y="200" width="280" height="40"/><text x="66" y="225">Is the result good?</text></g>
+        <g data-pick="budget" class="pop d4"><rect class="bx" x="50" y="270" width="280" height="40"/><text x="66" y="295">How fast does the budget go?</text></g>
+        <g data-pick="fail" class="pop d5"><rect class="bx" x="50" y="340" width="280" height="40"/><text x="66" y="365">What keeps failing?</text></g>
+      </svg>
+      <div class="pick__panel">
+        <p class="pick__hint">Tap a question to see what answers it.</p>
+        <ul class="pick__list">
+          <li data-k="fast"><b>Am I faster?</b> Active time per session and per month, and the lines changed, for each model. Activity, not value.</li>
+          <li data-k="good"><b>Is the result good?</b> Reverts, and fix commits on code that another commit changed two days before, counted against the model that wrote that code. Plus how often I had to correct the model in the session.</li>
+          <li data-k="budget"><b>How fast does the budget go?</b> Tokens and their price per month and model, and the price per active hour. On a subscription nothing is billed per token, but the number shows how fast the limits go.</li>
+          <li data-k="fail"><b>What keeps failing?</b> Corrections per ten prompts, interrupts, denied tools and tool errors, and a list of the sessions that went worst. Each of those gets one line on what went wrong: an unclear task, a missing or ignored rule, or a mistake of the model.</li>
+        </ul>
+      </div>
+      <figcaption>Fig. 7 · What is already recorded, and what it can answer.</figcaption>
+    </figure>
+    <p>The last question matters most to me. The sessions where I corrected the model most often are a small, personal eval set. After a month they say more about a model than my impression of it, and after a model switch they show whether my instructions still work.</p>
+    <p>I wrote this down as a skill for my agent, with a script that reads the transcripts and git and prints a report per month and model. The numbers are signs of activity and friction, not of value, and METR treats counts like these as an upper bound for the real gain <a href="#s17">[17]</a>. They are good for one thing: comparing my own months and models with each other. One catch: Claude Code deletes transcripts after 30 days unless I raise that limit <a href="#s18">[18]</a>.</p>
+
+    <h2 id="agree">Agree first, then build</h2>
+    <p>The best habit I picked up this year comes from Matt Pocock's skills for coding agents <a href="#s9">[9]</a>. Before any code, <code>/grill-me</code> makes the model ask me questions, round after round, until every branch of the plan is decided. Then a spec, then tickets, then the build test first, then a review. A small change skips the spec and the tickets.</p>
+    <figure class="fig-wide anim" data-switch="Bigger change|Small change">
+      <svg class="dg dg-w" viewBox="0 0 720 230" role="img" aria-labelledby="f4t f4d">
+        <title id="f4t">Matt Pocock's flow from idea to merged change</title>
+        <desc id="f4d">Five steps: grill (/grill-me), spec (/to-spec), tickets (/to-tickets), build (/tdd) and review (/code-review). A bigger change goes through all five. A small change goes from grill straight to build.</desc>
+        <path id="f4-main" class="ln w-a" d="M70 100 H630"/>
+        <path id="f4-small" class="ln w-b" d="M70 100 H126 C170 215 390 215 434 100 H630"/>
+        <g data-pick="grill"><rect class="bx" x="14" y="78" width="112" height="44"/><text x="70" y="106" text-anchor="middle" class="t-h">Grill</text></g>
+        <g data-pick="spec" class="fade off-b"><rect class="bx" x="154" y="78" width="112" height="44"/><text x="210" y="106" text-anchor="middle" class="t-h">Spec</text></g>
+        <g data-pick="tickets" class="fade off-b"><rect class="bx" x="294" y="78" width="112" height="44"/><text x="350" y="106" text-anchor="middle" class="t-h">Tickets</text></g>
+        <g data-pick="build"><rect class="bx" x="434" y="78" width="112" height="44"/><text x="490" y="106" text-anchor="middle" class="t-h">Build</text></g>
+        <g data-pick="review"><rect class="bx" x="574" y="78" width="112" height="44"/><text x="630" y="106" text-anchor="middle" class="t-h">Review</text></g>
+        <text x="70" y="146" text-anchor="middle" class="t-s">/grill-me</text>
+        <text x="210" y="146" text-anchor="middle" class="t-s fade off-b">/to-spec</text>
+        <text x="350" y="146" text-anchor="middle" class="t-s fade off-b">/to-tickets</text>
+        <text x="490" y="146" text-anchor="middle" class="t-s">/tdd</text>
+        <text x="630" y="146" text-anchor="middle" class="t-s">/code-review</text>
+        <text x="20" y="40" class="t-s w-a">a bigger change: all five steps</text>
+        <text x="20" y="40" class="t-s w-b">a small change: from the questions straight to the build</text>
+        <circle class="bx-i w-a" r="7"><animateMotion dur="6s" repeatCount="indefinite"><mpath href="#f4-main"/></animateMotion></circle>
+        <circle class="bx-i w-b" r="7"><animateMotion dur="5s" repeatCount="indefinite"><mpath href="#f4-small"/></animateMotion></circle>
+      </svg>
+      <svg class="dg dg-n" viewBox="0 0 360 410" role="img" aria-labelledby="f4nt">
+        <title id="f4nt">Matt Pocock's flow: grill, spec, tickets, build, review. A small change goes from grill straight to build.</title>
+        <path id="f4n-main" class="ln w-a" d="M150 40 V360"/>
+        <path id="f4n-small" class="ln w-b" d="M150 40 V60 C30 110 30 230 150 280 V360"/>
+        <g data-pick="grill"><rect class="bx" x="80" y="20" width="140" height="40"/><text x="150" y="46" text-anchor="middle" class="t-h">Grill</text></g>
+        <g data-pick="spec" class="fade off-b"><rect class="bx" x="80" y="100" width="140" height="40"/><text x="150" y="126" text-anchor="middle" class="t-h">Spec</text></g>
+        <g data-pick="tickets" class="fade off-b"><rect class="bx" x="80" y="180" width="140" height="40"/><text x="150" y="206" text-anchor="middle" class="t-h">Tickets</text></g>
+        <g data-pick="build"><rect class="bx" x="80" y="260" width="140" height="40"/><text x="150" y="286" text-anchor="middle" class="t-h">Build</text></g>
+        <g data-pick="review"><rect class="bx" x="80" y="340" width="140" height="40"/><text x="150" y="366" text-anchor="middle" class="t-h">Review</text></g>
+        <text x="232" y="45" class="t-s">/grill-me</text>
+        <text x="232" y="125" class="t-s fade off-b">/to-spec</text>
+        <text x="232" y="205" class="t-s fade off-b">/to-tickets</text>
+        <text x="232" y="285" class="t-s">/tdd</text>
+        <text x="232" y="365" class="t-s">/code-review</text>
+        <circle class="bx-i w-a" r="7"><animateMotion dur="6s" repeatCount="indefinite"><mpath href="#f4n-main"/></animateMotion></circle>
+        <circle class="bx-i w-b" r="7"><animateMotion dur="5s" repeatCount="indefinite"><mpath href="#f4n-small"/></animateMotion></circle>
+      </svg>
+      <div class="pick__panel">
+        <p class="pick__hint">Switch between a bigger and a small change, or tap a step.</p>
+        <ul class="pick__list">
+          <li data-k="grill"><b>Grill</b>: the model interviews me until the plan has no open branch. The variant <code>grill-with-docs</code> also writes the terms we settle into a glossary and the hard-to-reverse decisions into ADRs.</li>
+          <li data-k="spec"><b>Spec</b>: the agreed plan, written down.</li>
+          <li data-k="tickets"><b>Tickets</b>: the spec, cut into pieces that can be built one at a time.</li>
+          <li data-k="build"><b>Build</b>: test first, one ticket at a time.</li>
+          <li data-k="review"><b>Review</b>: a code review closes each change.</li>
+        </ul>
+      </div>
+      <figcaption>Fig. 4 · The main flow of Matt Pocock's skills <a href="#s9">[9]</a>. The README says they work with any model.</figcaption>
+    </figure>
+    <p>What I like about it: it turns the instructions around. I do not tell the model what to do in one long prompt. The model checks whether I know what I want. That works on the one part of the session that I control, and it works with every model.</p>
+
+    <h2 id="sharp">Stay able to do it</h2>
+    <p>The second rule that holds for every model is about me, not the model. In a study by Anthropic, 52 developers, most of them junior, learned a new Python library <a href="#s10">[10]</a>. The group with an AI assistant scored 50% on a quiz afterwards, the group that wrote the code by hand 67%. The AI group was not significantly faster.</p>
+    <p>How people used the AI mattered more than whether they used it:</p>
+    <figure class="fig-wide anim" data-switch="Asked to understand|Handed it over" data-switch-free>
+      <svg class="dg dg-w" viewBox="0 0 680 330" role="img" aria-labelledby="f5t f5d">
+        <title id="f5t">Quiz scores by how people used the AI</title>
+        <desc id="f5d">Asked to understand: generated code and then asked why, 86 percent, 2 people; asked for code with an explanation, 68 percent, 3 people; asked only about concepts, 65 percent, 7 people. Handed it over: handed over all the code, 39 percent, 4 people; slid into full reliance, 35 percent, 4 people; let the AI debug, 24 percent, 4 people. For comparison: the hand-coding group scored 67 percent, the whole AI group 50 percent.</desc>
+        <line class="ln-s" x1="538" y1="24" x2="538" y2="284"/>
+        <line class="ln-s" x1="470" y1="24" x2="470" y2="284"/>
+        <text x="538" y="300" text-anchor="middle" class="t-s">by hand: 67%</text>
+        <text x="470" y="316" text-anchor="middle" class="t-s">all with AI: 50%</text>
+        <g class="fade hi-a">
+          <text x="20" y="30" class="t-h">Asked to understand</text>
+          <text x="20" y="58" class="t-s">generated, then asked why (2)</text>
+          <rect class="bx-i grow d1" x="270" y="42" width="344" height="24"/>
+          <text x="622" y="59" data-count="86" data-fmt="{}%">86%</text>
+          <text x="20" y="94" class="t-s">asked for code + explanation (3)</text>
+          <rect class="bx-i grow d2" x="270" y="78" width="272" height="24"/>
+          <text x="550" y="95" data-count="68" data-fmt="{}%">68%</text>
+          <text x="20" y="130" class="t-s">asked only about concepts (7)</text>
+          <rect class="bx-i grow d3" x="270" y="114" width="260" height="24"/>
+          <text x="538" y="131" data-count="65" data-fmt="{}%">65%</text>
+        </g>
+        <g class="fade hi-b">
+          <text x="20" y="170" class="t-h">Handed it over</text>
+          <text x="20" y="198" class="t-s">handed over all the code (4)</text>
+          <rect class="bx-s grow d4" x="270" y="182" width="156" height="24"/>
+          <text x="434" y="199" data-count="39" data-fmt="{}%">39%</text>
+          <text x="20" y="234" class="t-s">slid into full reliance (4)</text>
+          <rect class="bx-s grow d5" x="270" y="218" width="140" height="24"/>
+          <text x="418" y="235" data-count="35" data-fmt="{}%">35%</text>
+          <text x="20" y="270" class="t-s">let the AI debug (4)</text>
+          <rect class="bx-s grow d6" x="270" y="254" width="96" height="24"/>
+          <text x="374" y="271" data-count="24" data-fmt="{}%">24%</text>
+        </g>
+      </svg>
+      <svg class="dg dg-n" viewBox="0 0 360 380" role="img" aria-labelledby="f5nt">
+        <title id="f5nt">Quiz scores by how people used the AI</title>
+        <line class="ln-s" x1="251" y1="30" x2="251" y2="330"/>
+        <line class="ln-s" x1="190" y1="30" x2="190" y2="330"/>
+        <text x="251" y="350" text-anchor="middle" class="t-s">by hand: 67%</text>
+        <text x="190" y="368" text-anchor="middle" class="t-s">all with AI: 50%</text>
+        <g class="fade hi-a">
+          <text x="10" y="24" class="t-h">Asked to understand</text>
+          <text x="10" y="46" class="t-s">generated, then asked why (2)</text>
+          <rect class="bx-i grow d1" x="10" y="52" width="310" height="18"/>
+          <text x="326" y="66" data-count="86" data-fmt="{}%">86%</text>
+          <text x="10" y="90" class="t-s">asked for code + explanation (3)</text>
+          <rect class="bx-i grow d2" x="10" y="96" width="245" height="18"/>
+          <text x="261" y="110" data-count="68" data-fmt="{}%">68%</text>
+          <text x="10" y="134" class="t-s">asked only about concepts (7)</text>
+          <rect class="bx-i grow d3" x="10" y="140" width="234" height="18"/>
+          <text x="250" y="154" data-count="65" data-fmt="{}%">65%</text>
+        </g>
+        <g class="fade hi-b">
+          <text x="10" y="192" class="t-h">Handed it over</text>
+          <text x="10" y="214" class="t-s">handed over all the code (4)</text>
+          <rect class="bx-s grow d4" x="10" y="220" width="140" height="18"/>
+          <text x="156" y="234" data-count="39" data-fmt="{}%">39%</text>
+          <text x="10" y="258" class="t-s">slid into full reliance (4)</text>
+          <rect class="bx-s grow d5" x="10" y="264" width="126" height="18"/>
+          <text x="142" y="278" data-count="35" data-fmt="{}%">35%</text>
+          <text x="10" y="302" class="t-s">let the AI debug (4)</text>
+          <rect class="bx-s grow d6" x="10" y="308" width="86" height="18"/>
+          <text x="102" y="322" data-count="24" data-fmt="{}%">24%</text>
+        </g>
+      </svg>
+      <figcaption>Fig. 5 · Quiz scores by pattern of use, number of people in brackets <a href="#s10">[10]</a>. The groups are tiny, and the authors say this shows no cause.</figcaption>
+    </figure>
+    <p>Those who asked why scored like the hand coders. Those who handed the work over scored below 40%. The groups have two to seven people each, so this is a hint, not a result. It matches a survey of 319 knowledge workers by Microsoft Research and Carnegie Mellon: the more people trusted the AI, the less critical thinking they reported, and the more they trusted themselves, the more <a href="#s11">[11]</a>. Their work moved from doing the task to overseeing it.</p>
+    <p>The authors warn that a skill used only in the rare hard case decays. That is an old finding. In 1983 Lisanne Bainbridge called it one of the ironies of automation: the machine takes the routine work, and the human keeps the hard cases without the practice they need <a href="#s12">[12]</a>. Simkute and others found the same ironies in generative AI <a href="#s13">[13]</a>.</p>
+    <p>So: when something breaks, I look first myself, or I ask for the explanation along with the fix. And I keep some small work without a model.</p>
+
+    <h2 id="loop">When a new model ships</h2>
+    <p>Put together, the file has two parts. One part holds for every model. The other is a loop that I run each time a model comes out.</p>
+    <figure class="fig-wide anim">
+      <svg class="dg dg-w" viewBox="0 0 640 420" role="img" aria-labelledby="f6t f6d">
+        <title id="f6t">The loop for a new model</title>
+        <desc id="f6d">A circle of six steps: new model, read the card, fresh baseline, prune, work, write it down, then back to the next new model. In the middle: HUMANS.md, one entry per model.</desc>
+        <path id="f6-loop" class="ln draw" pathLength="1" d="M320 60 A150 150 0 1 1 319.9 60"/>
+        <text x="320" y="206" text-anchor="middle">HUMANS.md</text>
+        <text x="320" y="226" text-anchor="middle" class="t-s">one entry per model</text>
+        <g data-pick="new" class="pop d1"><rect class="bx" x="252" y="42" width="136" height="36"/><text x="320" y="65" text-anchor="middle">New model</text></g>
+        <g data-pick="card" class="pop d2"><rect class="bx" x="382" y="117" width="136" height="36"/><text x="450" y="140" text-anchor="middle">Read the card</text></g>
+        <g data-pick="base" class="pop d3"><rect class="bx" x="382" y="267" width="136" height="36"/><text x="450" y="290" text-anchor="middle">Fresh baseline</text></g>
+        <g data-pick="prune" class="pop d4"><rect class="bx" x="252" y="342" width="136" height="36"/><text x="320" y="365" text-anchor="middle">Prune</text></g>
+        <g data-pick="work" class="pop d5"><rect class="bx" x="122" y="267" width="136" height="36"/><text x="190" y="290" text-anchor="middle">Work</text></g>
+        <g data-pick="log" class="pop d6"><rect class="bx" x="122" y="117" width="136" height="36"/><text x="190" y="140" text-anchor="middle">Write it down</text></g>
+        <circle class="bx-i" r="8"><animateMotion dur="14s" repeatCount="indefinite"><mpath href="#f6-loop"/></animateMotion></circle>
+      </svg>
+      <svg class="dg dg-n" viewBox="0 0 360 420" role="img" aria-labelledby="f6nt">
+        <title id="f6nt">The loop for a new model: new model, read the card, fresh baseline, prune, work, write it down</title>
+        <path id="f6n-loop" class="ln draw" pathLength="1" d="M180 90 A120 120 0 1 1 179.9 90"/>
+        <text x="180" y="206" text-anchor="middle">HUMANS.md</text>
+        <text x="180" y="226" text-anchor="middle" class="t-s">one entry per model</text>
+        <g data-pick="new" class="pop d1"><rect class="bx" x="122" y="74" width="116" height="32"/><text x="180" y="95" text-anchor="middle">New model</text></g>
+        <g data-pick="card" class="pop d2"><rect class="bx" x="226" y="134" width="116" height="32"/><text x="284" y="155" text-anchor="middle">Read the card</text></g>
+        <g data-pick="base" class="pop d3"><rect class="bx" x="226" y="254" width="116" height="32"/><text x="284" y="275" text-anchor="middle">Fresh baseline</text></g>
+        <g data-pick="prune" class="pop d4"><rect class="bx" x="122" y="314" width="116" height="32"/><text x="180" y="335" text-anchor="middle">Prune</text></g>
+        <g data-pick="work" class="pop d5"><rect class="bx" x="18" y="254" width="116" height="32"/><text x="76" y="275" text-anchor="middle">Work</text></g>
+        <g data-pick="log" class="pop d6"><rect class="bx" x="18" y="134" width="116" height="32"/><text x="76" y="155" text-anchor="middle">Write it down</text></g>
+        <circle class="bx-i" r="7"><animateMotion dur="14s" repeatCount="indefinite"><mpath href="#f6n-loop"/></animateMotion></circle>
+      </svg>
+      <div class="pick__panel">
+        <p class="pick__hint">Tap a step.</p>
+        <ul class="pick__list">
+          <li data-k="new"><b>New model</b>: a release, or a new default in the tool I use.</li>
+          <li data-k="card"><b>Read the card</b>: the model card and the vendor's prompting guide. I look for what the model does more, what it does less, and what the guide says to remove.</li>
+          <li data-k="base"><b>Fresh baseline</b>: one real task without my <code>CLAUDE.md</code> files, to see what the model does on its own.</li>
+          <li data-k="prune"><b>Prune</b>: remove what it no longer needs: capitals, old workarounds, extra checks.</li>
+          <li data-k="work"><b>Work</b>: with the rules that hold for every model: agree first, read what I merge, ask why.</li>
+          <li data-k="log"><b>Write it down</b>: one line in the log of <code>HUMANS.md</code>, and two weeks later a second look: was it right?</li>
+        </ul>
+      </div>
+      <figcaption>Fig. 6 · The loop. The log keeps what I noticed, so the next model does not start from a hunch again.</figcaption>
+    </figure>
+
+    <h2 id="review">Reviewing my CLAUDE.md</h2>
+    <p>One open question of the first version was whether a skill could read a new model card and propose the changes to my <code>CLAUDE.md</code> files. I built one. It reads my session transcripts to see which models I actually use, reads the current prompting guides for those models, runs a fresh research round on the last three months, checks every instruction file of a project, and proposes changes with a reason for each. It changes nothing without my OK.</p>
+    <p>I ran it on this site. The research found one consistent message, all of it from Anthropic's own docs and none of it measured: keep the always-loaded file under about 200 lines, leave out what the agent can read from the repository, drop capitals and "IMPORTANT", turn rules that must always hold into hooks or checks, and put the check command first <a href="#s20">[20]</a><a href="#s21">[21]</a>. Claude Code even has a built-in audit for instructions written for older models <a href="#s21">[21]</a>.</p>
+    <figure class="fig-wide anim">
+      <svg class="dg dg-w" viewBox="0 0 680 190" role="img" aria-labelledby="f8t f8d">
+        <title id="f8t">Length of this site's CLAUDE.md</title>
+        <desc id="f8d">76 lines before the review, 61 after the first review, 33 after the changes from the research.</desc>
+        <text x="20" y="56">Before</text>
+        <rect class="bx-s grow d1" x="260" y="38" width="380" height="26"/>
+        <text x="632" y="56" text-anchor="end" data-count="76" data-fmt="{} lines">76 lines</text>
+        <text x="20" y="106">After the review</text>
+        <rect class="bx-s grow d3" x="260" y="88" width="305" height="26"/>
+        <text x="573" y="106" data-count="61" data-fmt="{} lines">61 lines</text>
+        <text x="20" y="156" class="t-h">After the research</text>
+        <rect class="bx-i grow d5" x="260" y="138" width="165" height="26"/>
+        <text x="433" y="156" data-count="33" data-fmt="{} lines">33 lines</text>
+      </svg>
+      <svg class="dg dg-n" viewBox="0 0 360 220" role="img" aria-labelledby="f8nt">
+        <title id="f8nt">Length of this site's CLAUDE.md: 76 lines before, 61 after the review, 33 after the research</title>
+        <text x="10" y="28">Before</text>
+        <rect class="bx-s grow d1" x="10" y="38" width="266" height="22"/>
+        <text x="284" y="54" data-count="76" data-fmt="{} lines">76 lines</text>
+        <text x="10" y="96">After the review</text>
+        <rect class="bx-s grow d3" x="10" y="106" width="214" height="22"/>
+        <text x="232" y="122" data-count="61" data-fmt="{} lines">61 lines</text>
+        <text x="10" y="164" class="t-h">After the research</text>
+        <rect class="bx-i grow d5" x="10" y="174" width="116" height="22"/>
+        <text x="134" y="190" data-count="33" data-fmt="{} lines">33 lines</text>
+      </svg>
+      <figcaption>Fig. 8 · The always-loaded instructions of this site, before and after the review. The rest did not disappear: it moved into skills, a hook, a check script and rules that load only when they apply.</figcaption>
+    </figure>
+    <p>What changed: the workflow for my review notes moved into a skill, with a hook that counts the open notes when a session starts. A script now checks the page rules in CI, where four sentences in four files used to ask for them. The rules for new pages load only when the agent works on a page. The file layout went, because the agent reads the repository anyway. And the file now starts with how to check the work.</p>
+    <p>Whether the agent works better with it, I do not know yet. That is what the monthly report is for, and the "two weeks later" column of the log.</p>
+    <p>Some trends I wanted to check found no evidence either way in the last three months: formal verification such as TLA+ as the agent's check, dropping hand-written tests, and deleting code comments so they cannot mislead the model. They stay on my list as open questions.</p>
+
+    <h2 id="file">The file, version 0</h2>
+    <p>This is the first version. It is short on purpose: a rule I do not follow is worse than no rule.</p>
+    <div class="code">
+      <div class="code__bar"><span>HUMANS.md</span><button class="copy" type="button" data-copy="humans-file">copy</button></div>
+<pre id="humans-file" class="wrap-lines"><code><span class="l"># HUMANS.md</span><span class="l"> </span><span class="l">How I work with language models. The agent has its CLAUDE.md. This file is for me.</span><span class="l"> </span><span class="l">Version 0.2, 10 Nov 2026. The thinking behind it: https://t7d.dev/thoughts/humans-md/</span><span class="l"> </span><span class="l">## With every model</span><span class="l"> </span><span class="l">1. Agree first. For anything bigger than a small fix, let the model ask me questions until the plan is clear. Keep the words we agreed on.</span><span class="l">2. Say what I want done. &quot;Change it&quot;, not &quot;can you suggest&quot;. Give the reason for a rule instead of capital letters.</span><span class="l">3. Give context as to a new colleague: the goal, the limits, where to look.</span><span class="l">4. Read what I merge. Tests show that it works. Reading shows that I understand it.</span><span class="l">5. When something breaks, look first myself, or ask for the explanation with the fix.</span><span class="l">6. Do some small work without a model, regularly, so I can still do it.</span><span class="l">7. Measure instead of feel, without extra work: once a month and after each model switch, read the report from the session transcripts and git. Look at the sessions that went worst.</span><span class="l"> </span><span class="l">## When a new model ships</span><span class="l"> </span><span class="l">1. Read the model card and the vendor&#x27;s prompting guide. Look for what the model does more, what it does less, and what to remove.</span><span class="l">2. Do one real task without my CLAUDE.md files. Compare.</span><span class="l">3. Remove what the new model no longer needs: capitals, old workarounds, extra checks.</span><span class="l">   Let a review skill and `/doctor prompt-audit` in Claude Code find these, then decide myself.</span><span class="l">4. Write one entry in the log.</span><span class="l">5. Two weeks later, read the entry again. Was it right?</span><span class="l"> </span><span class="l">## Log</span><span class="l"> </span><span class="l">| Date | Model | What the guide says changed | What I change | Two weeks later |</span><span class="l">| --- | --- | --- | --- | --- |</span><span class="l">| 10 Nov 2026 | Claude Opus 5.5 | Newer Claude models follow instructions literally, check their own work, and react strongly to words like CRITICAL | To try: remove capitals and &quot;verify each step&quot; lines from my CLAUDE.md files | |</span><span class="l">| 10 Nov 2026 | Claude Opus 5.5, Fable 5.2 | Claude Code docs: CLAUDE.md under 200 lines, no file layout, no emphasis, hooks for hard rules, the check command first | t7d.dev CLAUDE.md from 76 to 33 lines: notes into a skill and a hook, a page check in CI, page rules on demand | |</span></code></pre>
+    </div>
+    <div class="btn-row"><a class="btn" href="/thoughts/humans-md/HUMANS.md" download>Download HUMANS.md</a></div>
+
+    <h2 id="open">Open questions</h2>
+    <ul>
+      <li>Should the agent read part of it too? "Ask me questions before a big change" could live in <code>CLAUDE.md</code> as well.</li>
+      <li>Which of the numbers in the monthly report really track what I care about? I will know after a few months of it.</li>
+      <li>Models now come out every few months. Is one log entry per model too much, or too little?</li>
+      <li>Do formal checks, fewer tests or fewer comments help an agent? I found no evidence yet.</li>
+    </ul>
+
+    <h2 id="start">Starting points</h2>
+    <ul>
+      <li>My own question: if the agent gets a <code>CLAUDE.md</code>, what would the human's file say?</li>
+      <li>Matt Pocock's skills, above all <code>/grill-me</code> <a href="#s9">[9]</a>.</li>
+    </ul>
+
+    <h2 id="sources">Sources</h2>
+    <ol class="refs">
+      <li id="s1">attogram: <a href="https://github.com/attogram/agents/blob/main/HUMANS.md" rel="noopener">agents, HUMANS.md</a>, first added 5 Sep 2025.</li>
+      <li id="s2">The LLM Whisperer: <a href="https://github.com/thellmwhisperer/human.md" rel="noopener">human.md</a>, Feb 2026.</li>
+      <li id="s3">cmdai: <a href="https://github.com/cmdai-hq/HUMANS.md" rel="noopener">HUMANS.md</a>, Oct 2026.</li>
+      <li id="s4">Anthropic: <a href="https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices" rel="noopener">Prompting best practices</a>, read Nov 2026.</li>
+      <li id="s5">OpenAI: <a href="https://developers.openai.com/api/docs/guides/gpt-5.5" rel="noopener">GPT-5.5 prompting guide</a>, Apr 2026.</li>
+      <li id="s6">Google: <a href="https://ai.google.dev/gemini-api/docs/gemini-3" rel="noopener">Gemini 3 developer guide</a>.</li>
+      <li id="s7">METR: <a href="https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/" rel="noopener">Measuring the impact of early-2025 AI on experienced open-source developer productivity</a>, Jul 2025.</li>
+      <li id="s8">METR: <a href="https://metr.org/blog/2026-02-24-uplift-update/" rel="noopener">We are changing our developer productivity experiment design</a>, Feb 2026.</li>
+      <li id="s9">Matt Pocock: <a href="https://github.com/mattpocock/skills" rel="noopener">skills</a>.</li>
+      <li id="s10">Shen and Tamkin, Anthropic: <a href="https://arxiv.org/abs/2601.20245" rel="noopener">arXiv 2601.20245</a>, Jan 2026, and <a href="https://www.anthropic.com/research/AI-assistance-coding-skills" rel="noopener">Anthropic's summary of the study</a>.</li>
+      <li id="s11">Hao-Ping Lee and others: <a href="https://www.microsoft.com/en-us/research/wp-content/uploads/2025/01/lee_2025_ai_critical_thinking_survey.pdf" rel="noopener">The impact of generative AI on critical thinking</a>, CHI 2025.</li>
+      <li id="s12">Lisanne Bainbridge: <a href="https://doi.org/10.1016/0005-1098(83)90046-8" rel="noopener">Ironies of automation</a>, Automatica, 1983.</li>
+      <li id="s13">Auste Simkute and others: <a href="https://arxiv.org/abs/2402.11364" rel="noopener">Ironies of generative AI</a>, 2024.</li>
+      <li id="s14">METR: <a href="https://metr.org/blog/2026-11-05-anthropic-ai-rd-acceleration-assessment/" rel="noopener">Anthropic AI R&amp;D acceleration assessment</a>, Nov 2026.</li>
+      <li id="s15">Elise Paradis and others, Google: <a href="https://arxiv.org/abs/2410.12944" rel="noopener">How much does AI impact development speed? An enterprise-based randomized controlled trial</a>, ICSE 2025.</li>
+      <li id="s16">Kevin Zheyuan Cui and others: <a href="https://doi.org/10.1287/mnsc.2025.00535" rel="noopener">The effects of generative AI on high-skilled work: evidence from three field experiments with software developers</a>, Management Science.</li>
+      <li id="s17">METR: <a href="https://metr.org/notes/2026-02-17-exploratory-transcript-analysis-for-estimating-time-savings-from-coding-agents/" rel="noopener">Exploratory transcript analysis for estimating time savings from coding agents</a>, Feb 2026.</li>
+      <li id="s18">Claude Code docs: <a href="https://code.claude.com/docs/en/costs" rel="noopener">costs and usage</a>, <a href="https://code.claude.com/docs/en/claude-directory" rel="noopener">the .claude directory</a>, <a href="https://code.claude.com/docs/en/monitoring-usage" rel="noopener">monitoring</a>, read Nov 2026.</li>
+      <li id="s20">Claude Code docs: <a href="https://code.claude.com/docs/en/best-practices" rel="noopener">best practices</a>, read Nov 2026.</li>
+      <li id="s21">Claude Code docs: <a href="https://code.claude.com/docs/en/memory" rel="noopener">memory and CLAUDE.md</a>, read Nov 2026.</li>
+      <li id="s19">Roger Buehler, Dale Griffin, Michael Ross: Exploring the "planning fallacy", Journal of Personality and Social Psychology 67, 1994.</li>
+    </ol>
+    <p class="refs">The METR pages <a href="#s8">[8]</a>, <a href="#s14">[14]</a> and <a href="#s17">[17]</a>, and the studies <a href="#s15">[15]</a> and <a href="#s16">[16]</a>, I could read only through summaries, not the full text. The numbers are as those summaries give them.</p>
+
+    <h2 id="revisions">Revisions</h2>
+    <ul class="dates">
+      <li><time datetime="2026-11-10">10 Nov 2026</time><span>Added "Reviewing my CLAUDE.md": what a review of this site's instructions against current guidance found and changed. The file got a step for that and a new log entry.</span></li>
+      <li><time datetime="2026-11-10">10 Nov 2026</time><span>Measurement: METR's 2025 numbers are out of date; added later studies, the gap between felt and measured, and a section on measuring from what Claude Code and git already record. Rule 7 of the file changed to match.</span></li>
+      <li><time datetime="2026-11-10">10 Nov 2026</time><span>First version.</span></li>
+    </ul>
+
+    <h2 id="feedback">Feedback</h2>
+    <p>Not shared yet. When I post about it, what people answer goes here, with what it changed.</p>
+  </article>
+</div>
+
+</main>
+
+<footer class="foot">
+  <div class="wrap">
+    <span>Tim Conrad</span>
+    <span>No cookies, no trackers, no third-party requests</span>
+  </div>
+</footer>
+
+</body>
+</html>
diff --git a/thoughts/index.html b/thoughts/index.html
new file mode 100644
index 0000000..d5965b6
--- /dev/null
+++ b/thoughts/index.html
@@ -0,0 +1,78 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; font-src 'self'; media-src 'self'; base-uri 'none'; form-action 'none'">
+<title>Thoughts · Tim Conrad</title>
+<meta name="description" content="Thoughts by Tim Conrad: ideas he is working through and comes back to, each with its sources and a list of revisions.">
+<link rel="canonical" href="https://t7d.dev/thoughts/">
+<meta property="og:type" content="website">
+<meta property="og:title" content="Thoughts">
+<meta property="og:description" content="Thoughts by Tim Conrad: ideas he is working through and comes back to, each with its sources and a list of revisions.">
+<meta property="og:url" content="https://t7d.dev/thoughts/">
+<meta property="og:image" content="https://t7d.dev/assets/og.png">
+<meta name="twitter:card" content="summary_large_image">
+<link rel="alternate" type="application/rss+xml" title="Tim Conrad · Thoughts" href="/thoughts/feed.xml">
+<link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
+<link rel="preload" href="/assets/fonts/barlow-condensed-700.woff2" as="font" type="font/woff2" crossorigin>
+<link rel="stylesheet" href="/assets/site.css">
+<script src="/assets/theme.js"></script>
+<script src="/assets/site.js" defer></script>
+</head>
+<body>
+<a class="skip" href="#main">Skip to content</a>
+
+<header class="nav">
+  <div class="wrap nav__in">
+    <a class="brand" href="/">Tim Conrad</a>
+    <nav class="nav__links" aria-label="Site">
+      <a href="/#games">Games</a>
+      <a href="/thoughts/">Thoughts</a>
+      <a class="opt3" href="/#research">Research</a>
+      <a class="opt2" href="/#verify">PGP key</a>
+      <a class="opt2" href="/#contact">Contact</a>
+    </nav>
+    <button class="toggle" id="theme-toggle" type="button">dark</button>
+  </div>
+</header>
+
+<main id="main" class="wrap">
+
+<header class="post-head">
+  <a class="crumb" href="/">← Home</a>
+  <h1>Thoughts</h1>
+  <p class="sub">Ideas I am working through and come back to. Each one keeps its sources, a status and a list of what changed, so I can see how my view moved.</p>
+  <div class="btn-row"><a class="btn btn--ghost" href="/thoughts/feed.xml">RSS feed</a></div>
+</header>
+
+<section class="blog-list">
+  <ul class="posts">
+    <li>
+      <a href="/thoughts/humans-md/">
+        <span class="posts__meta"><span class="label"><time datetime="2026-11-10">10 Nov 2026</time></span><span class="status">Draft</span></span>
+        <span class="posts__title">A humans.md for working with models</span>
+        <span class="posts__sum">My repositories tell the agent how to work with me, but nothing tells me how to work with the agent. Who already uses the name, how models change under you, why feel is a bad meter, and a first version of the file.</span>
+      </a>
+    </li>
+    <li>
+      <a href="/thoughts/encrypted-patches/">
+        <span class="posts__meta"><span class="label"><time datetime="2026-11-10">10 Nov 2026</time></span><span class="status">Draft</span></span>
+        <span class="posts__title">Encrypted patches, unlocked on patch day</span>
+        <span class="posts__sum">Ship a security fix early as ciphertext and publish the key on patch day, so teams can stage it and apply it together. Games, a design with signed keys, open source in private, and the patents.</span>
+      </a>
+    </li>
+  </ul>
+</section>
+
+</main>
+
+<footer class="foot">
+  <div class="wrap">
+    <span>Tim Conrad</span>
+    <span>No cookies, no trackers, no third-party requests</span>
+  </div>
+</footer>
+
+</body>
+</html>
diff --git a/tools/check.py b/tools/check.py
new file mode 100644
index 0000000..cc71e2d
--- /dev/null
+++ b/tools/check.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Checks the rules of the site pages that must always hold. CI runs it before each deploy and on each pull request.
+
+  python3 tools/check.py
+
+For every HTML page in git (redirect pages excepted, they only carry a meta refresh):
+- a Content-Security-Policy <meta> is there;
+- no inline style: no style="" attribute and no <style> element;
+- no inline script: every <script> has a src;
+- the page's URL is in sitemap.xml (404.html excepted).
+
+Exit code 1 and one line per problem when a rule is broken. Standard library only.
+"""
+import os, re, subprocess, sys
+
+ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+SITE = 'https://t7d.dev'
+
+
+def pages():
+    out = subprocess.run(['git', '-C', ROOT, 'ls-files', '*.html'], capture_output=True, text=True, check=True).stdout
+    return [p for p in out.split() if not p.startswith(('tools/', '.claude/'))]
+
+
+def main():
+    sitemap = open(os.path.join(ROOT, 'sitemap.xml'), encoding='utf-8').read()
+    problems = []
+    for p in pages():
+        s = open(os.path.join(ROOT, p), encoding='utf-8').read()
+        if re.search(r'<meta\s+http-equiv="refresh"', s, re.I):
+            continue
+        if not re.search(r'<meta\s+http-equiv="Content-Security-Policy"', s, re.I):
+            problems.append(f'{p}: no Content-Security-Policy meta')
+        if re.search(r'\sstyle\s*=\s*["\']', s, re.I):
+            problems.append(f'{p}: style="" attribute')
+        if re.search(r'<style[\s>]', s, re.I):
+            problems.append(f'{p}: <style> element')
+        for tag in re.findall(r'<script\b[^>]*>', s, re.I):
+            if not re.search(r'\ssrc\s*=', tag, re.I):
+                problems.append(f'{p}: inline <script>')
+        if p != '404.html':
+            url = SITE + '/' + (p[:-len('index.html')] if p.endswith('index.html') else p)
+            if f'<loc>{url}</loc>' not in sitemap:
+                problems.append(f'{p}: {url} is not in sitemap.xml')
+    for line in problems:
+        print(line)
+    print(f'{len(pages())} pages checked, {len(problems)} problems')
+    sys.exit(1 if problems else 0)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tools/deploy.sh b/tools/deploy.sh
index 4ec5a05..ee328d3 100755
--- a/tools/deploy.sh
+++ b/tools/deploy.sh
@@ -7,7 +7,7 @@
 # encrypted sites there, one folder per site (sealed/<site>/). This script keeps that folder as it is.
 set -euo pipefail
 
-SITE=(index.html 404.html CNAME .nojekyll key.asc robots.txt sitemap.xml assets blog research projects CVE)
+SITE=(index.html 404.html CNAME .nojekyll key.asc robots.txt sitemap.xml assets thoughts blog research projects CVE)
 
 root=$(git rev-parse --show-toplevel)
 src=$(git -C "$root" rev-parse HEAD)
@@ -21,7 +21,7 @@ if git cat-file -e HEAD:sealed 2>/dev/null; then
   git checkout -q HEAD -- sealed
 fi
 git -C "$root" archive "$src" "${SITE[@]}" | tar -x
-# llms.txt and the RSS feed of the blog are made from the published pages, never by hand
+# llms.txt and the RSS feed of the thoughts are made from the published pages, never by hand
 python3 "$root/tools/gen-feeds.py" "$tree"
 git add -A
 
diff --git a/tools/gen-feeds.py b/tools/gen-feeds.py
index dd294ab..052a4bd 100755
--- a/tools/gen-feeds.py
+++ b/tools/gen-feeds.py
@@ -1,12 +1,15 @@
 #!/usr/bin/env python3
-"""Writes /llms.txt and the RSS feed of the blog (/blog/feed.xml) from the pages of the site.
+"""Writes /llms.txt and the RSS feed of the thoughts (/thoughts/feed.xml) from the pages of the site.
 
   python3 tools/gen-feeds.py [<site folder>]
 
 The folder defaults to the repository root. tools/deploy.sh runs it on the published copy, so both files always
 match the pages and nobody edits them by hand. Everything comes from each page's <head>: <title>, the meta
 description, the canonical URL and article:published_time. A page is listed in its section by its folder:
-projects/ (games), blog/<slug>/ (posts), research/ (write-ups). Standard library only.
+projects/ (games), thoughts/<slug>/ (thoughts), research/ (write-ups). Standard library only.
+
+The thoughts were a blog at /blog/ until November 2026. The same feed is also written to /blog/feed.xml, so readers
+who follow the old address keep getting new thoughts.
 """
 import html, os, re, sys
 from datetime import datetime, timezone
@@ -48,22 +51,22 @@ def md_link(p):
 
 def llms():
     home = meta(os.path.join(ROOT, 'index.html'))
-    games, posts, research = pages('projects'), pages('blog'), pages('research')
+    games, posts, research = pages('projects'), pages('thoughts'), pages('research')
     lines = [f"# {home['title'] or 'Tim Conrad'}", '', f"> {home['desc']}", '',
              'The personal site of Tim Conrad: security research and browser games. Plain HTML with no tracking.',
-             'Each page below is a normal HTML page; the blog has an RSS feed.', '']
-    for name, items in (('Games', games), ('Blog', posts), ('Research', research)):
+             'Each page below is a normal HTML page; the thoughts have an RSS feed.', '']
+    for name, items in (('Games', games), ('Thoughts', posts), ('Research', research)):
         if items:
             lines += [f'## {name}', ''] + [md_link(p) for p in items] + ['']
     lines += ['## Optional', '',
-              f'- [Blog RSS feed]({SITE}/blog/feed.xml): every post, newest first',
+              f'- [Thoughts RSS feed]({SITE}/thoughts/feed.xml): every thought, newest first',
               f'- [PGP key]({SITE}/key.asc): RSA 3072, fingerprint A886 6CB1 6B07 9685 5615 74B2 A91D ABBE C996 7390',
               f'- [Sitemap]({SITE}/sitemap.xml)', '']
     return '\n'.join(lines)
 
 
 def rss():
-    posts = pages('blog')
+    posts = pages('thoughts')
     def when(p):
         d = datetime.strptime(p['date'], '%Y-%m-%d').replace(tzinfo=timezone.utc) if p['date'] else datetime.now(timezone.utc)
         return format_datetime(d)
@@ -80,10 +83,10 @@ def when(p):
     return f'''<?xml version="1.0" encoding="UTF-8"?>
 <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
   <channel>
-    <title>Tim Conrad · Blog</title>
-    <link>{SITE}/blog/</link>
-    <atom:link href="{SITE}/blog/feed.xml" rel="self" type="application/rss+xml"/>
-    <description>Notes by Tim Conrad on security ideas.</description>
+    <title>Tim Conrad · Thoughts</title>
+    <link>{SITE}/thoughts/</link>
+    <atom:link href="{SITE}/thoughts/feed.xml" rel="self" type="application/rss+xml"/>
+    <description>Thoughts by Tim Conrad: ideas he is working through and comes back to.</description>
     <language>en</language>
     <lastBuildDate>{last}</lastBuildDate>
 {items}  </channel>
@@ -92,7 +95,7 @@ def when(p):
 
 
 # the generated files, by their path on the site
-FILES = {'llms.txt': llms, 'blog/feed.xml': rss}
+FILES = {'llms.txt': llms, 'thoughts/feed.xml': rss, 'blog/feed.xml': rss}
 
 
 def build(root):
diff --git a/tools/preview-artifact.py b/tools/preview-artifact.py
new file mode 100644
index 0000000..dffe8f9
--- /dev/null
+++ b/tools/preview-artifact.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Builds a preview of one page of the site as a Claude artifact bundle, so Tim can review it before it is published.
+
+  python3 tools/preview-artifact.py thoughts/humans-md [<out dir>]
+
+The out dir defaults to .preview/<page> (git ignores it). It holds index.html and the files it needs, at the paths the
+page uses:
+
+- index.html: the page without doctype, <html>, <head> and <body> (the artifact host adds its own skeleton) and without
+  its Content-Security-Policy meta (the host sets its own policy). The title loses " · Tim Conrad": it names the artifact. /assets/... becomes assets/...; links to other pages
+  of the site go to https://t7d.dev/..., which shows the live version of that page.
+- assets/site.css (font URLs made relative), site.js, theme.js and the fonts; every other /assets/ file the page uses;
+  and the files in the page's own folder (for example a download).
+
+Publish it with the Artifact tool: file_path <out>/index.html, files { "<path>": "<out>/<path>", ... } for every other
+file in the out dir (the script prints them). The same file_path updates the same artifact. Standard library only.
+"""
+import json, os, re, shutil, sys
+
+ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+SITE = 'https://t7d.dev'
+
+
+def build(page, out):
+    page = page.strip('/')
+    src_dir = os.path.join(ROOT, page)
+    html = open(os.path.join(src_dir, 'index.html'), encoding='utf-8').read()
+    if os.path.isdir(out):
+        shutil.rmtree(out)
+    os.makedirs(out)
+
+    head = html[html.index('<head>') + 6:html.index('</head>')]
+    body = html[html.index('<body>') + 6:html.rindex('</body>')]
+    head = re.sub(r'\s*<meta charset[^>]*>', '', head)
+    head = re.sub(r'\s*<meta name="viewport"[^>]*>', '', head)
+    head = re.sub(r'\s*<meta http-equiv="Content-Security-Policy"[^>]*>', '', head)
+    head = re.sub(r'\s*<link rel="(preload|alternate|canonical)"[^>]*>', '', head)
+    head = re.sub(r'(<title>.*?)\s*·\s*Tim Conrad</title>', r'\1</title>', head)  # the artifact's name
+    doc = head.strip() + '\n' + body.strip() + '\n'
+
+    # files of the page's own folder: keep them next to the page
+    own = [f for f in os.listdir(src_dir) if f != 'index.html' and os.path.isfile(os.path.join(src_dir, f))]
+    for f in own:
+        shutil.copy(os.path.join(src_dir, f), os.path.join(out, f))
+        doc = doc.replace(f'"/{page}/{f}"', f'"{f}"')
+
+    used = set(re.findall(r'"/(assets/[^"#?]+)"', doc)) | {'assets/site.css', 'assets/site.js', 'assets/theme.js'}
+    doc = re.sub(r'"/assets/', '"assets/', doc)
+    # every other link to the site: the live page
+    doc = re.sub(r'(href|src)="/(?!/)', lambda m: f'{m.group(1)}="{SITE}/', doc)
+    doc = re.sub(r'\s*download(?=[\s>])', '', doc)  # downloads are blocked in the viewer; the file opens instead
+
+    for rel in sorted(used):
+        dst = os.path.join(out, rel)
+        os.makedirs(os.path.dirname(dst), exist_ok=True)
+        shutil.copy(os.path.join(ROOT, rel), dst)
+    css_path = os.path.join(out, 'assets/site.css')
+    css = open(css_path, encoding='utf-8').read()
+    for font in re.findall(r'url\("/assets/(fonts/[^"]+)"\)', css):
+        dst = os.path.join(out, 'assets', font)
+        os.makedirs(os.path.dirname(dst), exist_ok=True)
+        shutil.copy(os.path.join(ROOT, 'assets', font), dst)
+    open(css_path, 'w', encoding='utf-8').write(re.sub(r'url\("/assets/', 'url("', css))
+
+    open(os.path.join(out, 'index.html'), 'w', encoding='utf-8').write(doc)
+    files = {}
+    for d, _, fs in os.walk(out):
+        for f in fs:
+            rel = os.path.relpath(os.path.join(d, f), out).replace('\\', '/')
+            if rel != 'index.html':
+                files[rel] = os.path.join(d, f)
+    return files
+
+
+if __name__ == '__main__':
+    if len(sys.argv) < 2:
+        sys.exit(__doc__)
+    page = sys.argv[1]
+    out = os.path.abspath(sys.argv[2] if len(sys.argv) > 2 else os.path.join(ROOT, '.preview', page.strip('/').replace('/', '-')))
+    files = build(page, out)
+    print(json.dumps({'file_path': os.path.join(out, 'index.html'), 'files': files}, indent=2))
diff --git a/tools/review/devserver.py b/tools/review/devserver.py
index 31f0d59..c3a120d 100644
--- a/tools/review/devserver.py
+++ b/tools/review/devserver.py
@@ -12,7 +12,7 @@
 - /__review/api/notes: GET lists the notes, open and done. POST writes one note as <notes>/<id>.json. The POST needs
   the header X-T7d-Review and a JSON body: a plain form from another site cannot send either. A handled note goes to
   <notes>/done/ with an "answer" field. The page shows the answer under "My notes".
-- /llms.txt and /blog/feed.xml are made on each request by tools/gen-feeds.py, as the deploy makes them for gh-pages.
+- /llms.txt, /thoughts/feed.xml and /blog/feed.xml are made on each request by tools/gen-feeds.py, as the deploy makes them for gh-pages.
 - /.git, /.review, /.reels and /node_modules are not served.
 """
 import argparse
@@ -32,7 +32,8 @@
 MAX_BODY = 32 * 1024
 MAX_NOTE = 4000
 NOTE_ID = re.compile(r"^\d{8}-\d{6}-[0-9a-f]{6}$")
-GENERATED = {"/llms.txt": "text/plain; charset=utf-8", "/blog/feed.xml": "application/rss+xml; charset=utf-8"}
+GENERATED = {"/llms.txt": "text/plain; charset=utf-8", "/thoughts/feed.xml": "application/rss+xml; charset=utf-8",
+             "/blog/feed.xml": "application/rss+xml; charset=utf-8"}
 
 
 def gen_feeds():
diff --git a/tools/review/test_devserver.py b/tools/review/test_devserver.py
index 0ae9909..cffb4cd 100644
--- a/tools/review/test_devserver.py
+++ b/tools/review/test_devserver.py
@@ -96,17 +96,18 @@ def test_missing_page_is_the_404_page(self):
         self.assertIn("Gone", body)
 
     def test_feed_and_llms_are_made_on_request(self):
-        post = '<html><head><title>Post · Tim Conrad</title><meta name="description" content="About it."><link rel="canonical" href="https://t7d.dev/blog/p/"><meta property="article:published_time" content="2026-11-10"></head><body></body></html>'
-        os.makedirs(os.path.join(self.root, "blog", "p"))
-        with open(os.path.join(self.root, "blog", "p", "index.html"), "w") as f:
+        post = '<html><head><title>Post · Tim Conrad</title><meta name="description" content="About it."><link rel="canonical" href="https://t7d.dev/thoughts/p/"><meta property="article:published_time" content="2026-11-10"></head><body></body></html>'
+        os.makedirs(os.path.join(self.root, "thoughts", "p"))
+        with open(os.path.join(self.root, "thoughts", "p", "index.html"), "w") as f:
             f.write(post)
-        code, headers, body = self.get("/blog/feed.xml")
-        self.assertEqual(code, 200)
-        self.assertIn("rss+xml", headers["Content-Type"])
-        self.assertIn("<title>Post</title>", body)
+        for feed in ("/thoughts/feed.xml", "/blog/feed.xml"):
+            code, headers, body = self.get(feed)
+            self.assertEqual(code, 200, feed)
+            self.assertIn("rss+xml", headers["Content-Type"])
+            self.assertIn("<title>Post</title>", body)
         code, headers, body = self.get("/llms.txt")
         self.assertEqual(code, 200)
-        self.assertIn("[Post](https://t7d.dev/blog/p/): About it.", body)
+        self.assertIn("[Post](https://t7d.dev/thoughts/p/): About it.", body)
 
     def test_hidden_folders_are_not_served(self):
         for p in ("/.git/HEAD", "/.review/notes/", "/a/../.git/HEAD"):