A tech blog by Lleg — deep dives on AI, web engineering, and infrastructure, with diagrams and data instead of hand-waving.https://lleg.deven-ushttps://lleg.dev/posts/unique-visitor-is-an-expiring-hashhttps://lleg.dev/posts/unique-visitor-is-an-expiring-hashUmami is MIT-licensed, so the identification path is readable. Where, who and when turn out to be a CDN header, a hash that expires on the 1st, and a bucket quantized to the clock hour.Wed, 16 Sep 2026 00:00:00 GMTanalyticswebdatasecuritydeep-diveLleghttps://lleg.dev/posts/browser-agent-same-origin-policyhttps://lleg.dev/posts/browser-agent-same-origin-policyThe web's oldest isolation guarantee is a string comparison. Put an agent inside the browser and it becomes a model's ability to resist a prompt injection.Tue, 15 Sep 2026 00:00:00 GMTsecuritywebaillmarchitecturedeep-diveLleghttps://lleg.dev/posts/agent-resends-the-whole-conversationhttps://lleg.dev/posts/agent-resends-the-whole-conversationA multi-turn agent replays its entire history on every request. Caching, context editing and compaction each attack a different part of that bill — and one of them, at its defaults, made it worse.Sun, 13 Sep 2026 00:00:00 GMTaillmcost-engineeringarchitecturedeep-diveLleghttps://lleg.dev/posts/why-increase-returns-27-5https://lleg.dev/posts/why-increase-returns-27-5Prometheus reports fractional counts for counters that only ever increment by one. The reason is a specific extrapolation rule, and knowing it tells you exactly when the number can be trusted.Sat, 12 Sep 2026 00:00:00 GMTobservabilityprometheusdevopsdeep-diveLleghttps://lleg.dev/posts/hermes-agent-learning-loophttps://lleg.dev/posts/hermes-agent-learning-loopHermes Agent says it improves its own skills. In the source, that loop is a tool-call counter, a forked LLM review told to be active, and a curator that archives what nobody uses.Fri, 11 Sep 2026 00:00:00 GMTaillmpythonarchitecturedeep-diveLleghttps://lleg.dev/posts/googlebot-is-not-your-browserhttps://lleg.dev/posts/googlebot-is-not-your-browserRendering is a separate, queued, stateless stage between crawling and indexing. Almost everything confusing about JavaScript and search comes from ignoring that.Thu, 10 Sep 2026 00:00:00 GMTwebfrontendarchitecturedeep-diveLleghttps://lleg.dev/posts/llm-inference-two-machineshttps://lleg.dev/posts/llm-inference-two-machinesPrefill and decode have opposite performance characteristics, and almost everything confusing about LLM latency, cost and context limits falls out of that one split.Thu, 10 Sep 2026 00:00:00 GMTaillmarchitecturedeep-diveLleghttps://lleg.dev/posts/observability-bill-multiplication-problemhttps://lleg.dev/posts/observability-bill-multiplication-problemCardinality does not creep up on you — it multiplies. Here is the arithmetic behind an exploding metrics bill, the four places the multiplication hides, and what actually shrinks it.Thu, 10 Sep 2026 00:00:00 GMTobservabilityopentelemetrycost-engineeringdevopsdeep-diveLleg