Long itineraries started dying with a 30-second max_execution_time fatal inside PhpSpreadsheet’s Font.php. The model wasn’t involved this time. Every style change makes PhpSpreadsheet scan the whole style collection for a match, recomputing an md5 hash for every style as it goes, so a heavily formatted workbook gets quadratic. I wrote a Spreadsheet subclass with a hash-to-style index, re-verified hits against the current hash, made misses harmless, and only used it when the plugin’s own vendored copy of the library is the one loaded. Same bytes out, 20 to 28 times faster. The timeout’s line number was a profiler with a sample size of one, and it pointed straight at the problem.

A Let’s Encrypt certificate expired on one of my WordPress boxes and nothing told me first. Three causes were stacked up, and every box in the fleet had all of them. The installer had run under sudo, so cron couldn’t write its own log and bailed before reaching the renew step. Lego’s account key was root-owned too, so a manual renew failed with an unhelpful message. And an Apache fix I’d rolled out in September only patched the generated vhosts, not the generator on each box, so the next renewal put the bug back. Fixed all three and added a renew-on-the-spot step. If something regenerates a file, patching the file only buys time.

I shipped version 4.0.0 of an old tour-packages plugin at half past ten and 4.0.5 just after twelve. Every fix pulled away whatever had been hiding the next problem. A function_exists() guard that only protects you from code that loads after you. A null going into WP_Post on PHP 8. A rewrite flush on every request that had been quietly covering for a broken activation hook. Draft packages visible to anyone with the URL. And last, a search page whose fatal error was the only thing keeping a reflected XSS and a shortcode injection out of sight. When a page has been dead for a long time, read all of it before you make it work again.

Third round of permissions trouble on migrated WordPress boxes. A plugin update from wp-admin failed on a server that had already had my full repair script applied. The modes were exactly what I’d asked for, 2775 and group-writable, but the owner and group were both root, because provisioning had installed that plugin with sudo wp –allow-root. The repair script promised never to chown anything, which meant it couldn’t see the problem. Now a fourth sweep hands only root-owned files under wp-content to the right owner, and provisioning chowns straight after installing. A repair script’s safety rule doubles as its list of blind spots.

An itinerary builder that planned fortnight-long trips without complaint broke four times on a ninety-day brief. The skeleton stage ran out of output tokens and reported it as a parse error. Then a finished response carried one malformed character, which I fixed with a retry and an outline-then-chunks fallback. The section stages hit the same ceilings, and finally one hung hotel check held the whole build at 28 of 29. Every limit had been sized for the trips we’d tested. Anything that scales with input needs a limit that scales too, or a design that doesn’t care. And check stop_reason before calling output unparseable.

A travel search on a few of my sites took about six seconds every time someone started fresh, and I’d have sworn it was cached. It was, on the way in. The writer stored the key without a trailing underscore; the reader asked for it with one. A forked sibling plugin had the opposite bug, a doubled underscore, plus a read that had been commented out altogether. The fix is one function that builds the key for both sides, then a daily cron that warms the cache inside a time budget. A cache entry existing only proves the writer ran. The only proof a cache works is a hit.

Pick a currency we had no conversion rate for and the page swapped the symbol but left the number where it was. A cabin at 1,200 in the base currency displayed as £1,200. No error, no log line, no visual tell, and a completely plausible price for a cruise cabin. Two functions, each correct on its own terms: the label side honoured the visitor’s cookie unconditionally, the maths side sensibly refused to convert without a rate. The fix is the weakest guarantee worth having — if we can’t convert, we don’t relabel. The shape to hunt for in your own code is a shared input whose validity only one side ever checks.

Four model calls running side by side instead of one long one, and the wall clock went up. Not the calls — those were faster, exactly as advertised. The time was in the gaps between stages. I’d ranked Action Scheduler as the preferred dispatcher on reliability grounds, and on a quiet site it runs its queue off WP-cron, which runs when somebody loads a page. Three handoffs at about a minute each, bought to save ninety seconds of generation. The fix was a reordering rather than a rewrite, and only because an atomic claim I’d written months earlier for a failure case turned out to be load-bearing as the design.

php -m listed imagick. Site Health, on the same box, insisted it wasn’t installed. One of them was lying. PHP on a web server isn’t one thing — CLI, Apache and FPM are separate SAPIs with separate conf.d directories, and phpenmod without -s ALL only wires up the SAPIs that exist at the moment you run it. This box was provisioned in the mod_php era and gained FPM later, so the one SAPI actually serving pages never got the symlink. Nothing errored; it just wasn’t there. Fix is -s ALL plus a version-discovered FPM reload. When something swears an extension is missing, work out which PHP is doing the complaining.

A cruise package that departed on a Saturday was showing Day 1 as the Friday. Not every package, which is what made me distrust my own eyes for the first hour. The cause was a date constructed with no timezone: PHP quietly uses the server’s, the rest of the feed handling assumed UTC, and a few hours of offset is all it takes to land on the wrong side of midnight. Pin the timezone where you build the date and make every date in the flow agree. I had already “fixed” this once in July and called it minor in the commit message. It was not minor. It was quiet.