Engineering notes on backend, data, AI systems, infrastructure, and the evidence behind technical decisions.https://seongju.vercel.app/en/https://seongju.vercel.app/en/writing/arm64-gitops-image-drift/https://seongju.vercel.app/en/writing/arm64-gitops-image-drift/A delivery record that turned an AMD64-only OCI manifest into separate build, registry, Git write-back, reconciliation, and runtime gates.Wed, 15 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/async-confirm-action-boundary/https://seongju.vercel.app/en/writing/async-confirm-action-boundary/A write-path redesign that released Tomcat request threads immediately and fixed an overly broad rule that could supersede unrelated pending approval actions.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/cilium-fqdn-egress-lab/https://seongju.vercel.app/en/writing/cilium-fqdn-egress-lab/A disposable kind lab that proved identity-specific toFQDNs and Hubble drops while keeping the risky production CNI migration behind an explicit gate.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/cloudfront-alb-origin-lockdown/https://seongju.vercel.app/en/writing/cloudfront-alb-origin-lockdown/A zero-downtime origin lockdown that moved the BFF first, then restricted direct ALB HTTP access to AWS-managed CloudFront origin-facing networks.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/deterministic-refund-calculator/https://seongju.vercel.app/en/writing/deterministic-refund-calculator/Natural-language cancellation clauses become evidence-bound intervals, while a deterministic engine owns boundaries, fees, refunds, and blocking ambiguity.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/disclosure-number-guardrail/https://seongju.vercel.app/en/writing/disclosure-number-guardrail/Explaining rights issues and convertible bonds while exact-matching every number to source text and rejecting investment-language overreach.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/durable-reservation-intent-queue/https://seongju.vercel.app/en/writing/durable-reservation-intent-queue/A durable reservation queue using Postgres intents, short claim leases, an outbox, and seat-level coordination around a non-idempotent school API.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/ecs-deployment-circuit-breaker/https://seongju.vercel.app/en/writing/ecs-deployment-circuit-breaker/Separating a masked shell exit code, ECS launch backoff, and an undersized health grace period to make automatic rollback trustworthy.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/evidence-grounded-faq-pipeline/https://seongju.vercel.app/en/writing/evidence-grounded-faq-pipeline/A precision-first FAQ pipeline where deterministic code owns PII and evidence checks while an LLM performs bounded semantic merging and drafting.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/forwarded-ip-trust-boundary/https://seongju.vercel.app/en/writing/forwarded-ip-trust-boundary/Redesigning client-IP trust across ALB and a BFF, then bounding the rate-limiter map that attacker-controlled keys could grow indefinitely.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/geocoding-contract-and-idempotency/https://seongju.vercel.app/en/writing/geocoding-contract-and-idempotency/Natural keys, incremental persistence, and real HTTP contract tests for geocoding a coordinate-free public CSV into PostGIS.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/git-backed-blog-architecture/https://seongju.vercel.app/en/writing/git-backed-blog-architecture/An architecture record of separating Astro's static reading experience from browser-based management of posts, categories, and drafts with Keystatic.Wed, 15 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/github-worklog-and-blog/https://seongju.vercel.app/en/writing/github-worklog-and-blog/A documentation structure that connects Issues, worklogs, ADRs, troubleshooting records, and technical articles without copying every project change into the blog.Wed, 15 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/gitops-stale-image-readiness/https://seongju.vercel.app/en/writing/gitops-stale-image-readiness/GitHub redirected the repository but not the GHCR coordinate, so Argo CD combined a new /ready probe with an image that could only return 404.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/kafka-sse-broadcast-cutover/https://seongju.vercel.app/en/writing/kafka-sse-broadcast-cutover/A cutover from lightweight database notifications to Kafka KRaft, including broadcast semantics, a duplicate-bean rollout failure, and a live broker interruption.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/langgraph-hitl-resume-boundary/https://seongju.vercel.app/en/writing/langgraph-hitl-resume-boundary/Separating MCP content blocks, LangGraph checkpoint forks, and stale actions to make the human-in-the-loop flow verifiable beyond the UI.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/langgraph-stream-routing-boundary/https://seongju.vercel.app/en/writing/langgraph-stream-routing-boundary/A streaming and routing repair for real event metadata that differed from mocks, leaked tool preambles, and let stale turns influence new routes.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/llm-grader-deterministic-engine/https://seongju.vercel.app/en/writing/llm-grader-deterministic-engine/The model classifies free-text answers into four verdicts; authored anchors and a deterministic engine own teaching content, retries, affection, and endings.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/lms-capability-link-terminal/https://seongju.vercel.app/en/writing/lms-capability-link-terminal/A deterministic terminal formatter and safe-anchor boundary for an LMS ZIP capability link that disappeared before the final response.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/lms-partial-export-failure-boundary/https://seongju.vercel.app/en/writing/lms-partial-export-failure-boundary/How four unsupported attachments led to explicit origin checks and a partial-success policy instead of discarding an otherwise valid export.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/load-test-cpu-not-index/https://seongju.vercel.app/en/writing/load-test-cpu-not-index/A small production read-only load test and EXPLAIN analysis that separated a CPU-bound spatial path from two unrelated missing user-query indexes.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/observability-label-and-autoconfig/https://seongju.vercel.app/en/writing/observability-label-and-autoconfig/Repairing quiet observability failures by deriving Prometheus label contracts and Spring Boot tracing autoconfiguration from live evidence.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/posix-parallel-grader-pipeline/https://seongju.vercel.app/en/writing/posix-parallel-grader-pipeline/A systems-programming retrospective on student-level pthreads, overlapped fork/exec preparation, answer caching, buffered I/O, and deterministic output.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/postgis-expiry-index/https://seongju.vercel.app/en/writing/postgis-expiry-index/How execution plans over 300,000 synthetic places and 210,000 reports showed that expiry aggregation—not the spatial GiST index—was the bottleneck.Wed, 15 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/postgis-geometry-geography-index/https://seongju.vercel.app/en/writing/postgis-geometry-geography-index/A PostGIS design using expression-identical GiST indexes to preserve Hibernate and bounds-query compatibility without sacrificing correct radius and kNN semantics.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/postgres-notify-sse-surge/https://seongju.vercel.app/en/writing/postgres-notify-sse-surge/Using PostgreSQL NOTIFY only as invalidation, then combining authoritative rereads with SSE snapshots for a small multi-instance ECS service.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/provider-grant-transaction-boundary/https://seongju.vercel.app/en/writing/provider-grant-transaction-boundary/A three-service authentication incident resolved by separating web identity, provider credentials, and MCP session grants.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/rag-tpm-success-path/https://seongju.vercel.app/en/writing/rag-tpm-success-path/How I isolated a RAG embedding failure to token throughput, then fixed the Jackson response contract that only appeared after rate limiting was gone.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/rate-limit-fanout-unit/https://seongju.vercel.app/en/writing/rate-limit-fanout-unit/A redesign of a limiter that returned 429 during a normal seat search because its unit did not match the actual upstream call graph.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/rds-encrypted-snapshot-restore/https://seongju.vercel.app/en/writing/rds-encrypted-snapshot-restore/A snapshot-copy-and-restore migration for an RDS encryption setting that cannot change in place, including Terraform state recovery and 15 minutes of measured downtime.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/readonly-rootfs-jna-scratch/https://seongju.vercel.app/en/writing/readonly-rootfs-jna-scratch/A write-path audit that reduced a writable container to explicit /tmp scratch and an export PVC, then verified the native FFI path in production.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/recursive-descent-tree-walk-interpreter/https://seongju.vercel.app/en/writing/recursive-descent-tree-walk-interpreter/A retrospective on a Python and C++ recursive-descent interpreter, including runtime probes that exposed differences between its README and actual semantics.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/riscv-two-pass-simulator/https://seongju.vercel.app/en/writing/riscv-two-pass-simulator/A computer-architecture retrospective on R, I, S, and B bit fields, sign extension, two-pass branch labels, and a deliberately limited virtual CPU.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/scheduled-ingest-advisory-lock/https://seongju.vercel.app/en/writing/scheduled-ingest-advisory-lock/An EventBridge Scheduler Universal Target invoking ECS, with manual and scheduled runs serialized by a PostgreSQL advisory lock held on one physical connection.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/semantic-kiosk-automation/https://seongju.vercel.app/en/writing/semantic-kiosk-automation/A design for controlling source-less Windows kiosks through UIA, OCR, verified postconditions, and a hard stop before payment input.Wed, 15 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/server-verified-principal-boundary/https://seongju.vercel.app/en/writing/server-verified-principal-boundary/How discarding client-claimed principals and separating a server-verified subject from an explicit MCP session prevents IDOR on principal-owned threads and silent privilege downgrade.Wed, 15 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/spring-security-filter-chain-scope/https://seongju.vercel.app/en/writing/spring-security-filter-chain-scope/A Spring Security incident where an Auth0 filter chain captured every path, rejected another JWT format, and remained invisible under the test profile.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/sqlite-context-manager-windows-lock/https://seongju.vercel.app/en/writing/sqlite-context-manager-windows-lock/A WinError 32 portability failure caused by assuming with sqlite3.Connection closes the handle, plus UTF-8 and semantic Path fixes.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/sso-one-time-code-exchange/https://seongju.vercel.app/en/writing/sso-one-time-code-exchange/How multiple Set-Cookie headers exposed a fragile proxy boundary and led to a 256-bit, atomically consumed Redis authorization-code protocol.Sat, 18 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/stable-roommates-contract-testing/https://seongju.vercel.app/en/writing/stable-roommates-contract-testing/Shared fixtures kept parallel frontend and backend scoring aligned, while a small brute-force oracle checked the matching algorithm independently.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/statefulset-nonready-rollout/https://seongju.vercel.app/en/writing/statefulset-nonready-rollout/A production incident where Kafka and Tempo remained on broken probes and memory settings even after the Git manifests were corrected.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/survival-score-sql-policy-boundary/https://seongju.vercel.app/en/writing/survival-score-sql-policy-boundary/PostGIS derives facts while a pure policy function handles weights and missing data, making a composite score explainable and testable.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/testcontainers-context-cache-lifecycle/https://seongju.vercel.app/en/writing/testcontainers-context-cache-lifecycle/Aligning class-scoped containers with a cached Spring context, then removing a second CI flake caused by a reservation worker consuming test fixtures.Fri, 17 Jul 2026 00:00:00 GMThttps://seongju.vercel.app/en/writing/vercel-manual-alias-release/https://seongju.vercel.app/en/writing/vercel-manual-alias-release/Git and Vercel succeeded, but a manually assigned .vercel.app alias remained pinned to an older deployment until promotion became an explicit, reversible step.Fri, 17 Jul 2026 00:00:00 GMT