Two small sites went down while Apache was still running. The log said the scoreboard was full but not at MaxRequestWorkers, which sounds like a contradiction. After rolling the fleet to PHP-FPM with the event MPM, I’d set ServerLimit to exactly MaxRequestWorkers divided by ThreadsPerChild, so one row on the small boxes. A child that’s exiting keeps its row until its connections drain, so the replacement had nowhere to go. Fifty-two of fifty-eight boxes logged it. The fix was spare rows, a much higher recycle limit, and a full restart rather than a reload, because ServerLimit is only read on restart. Check yours against the arithmetic.

My certificate wrapper kept flagging live domains for removal, a different one or two every run, even though they were plainly in the config. The cause: under set -o pipefail, echo piped into grep -q gets SIGPIPE when grep exits on the first match, so the pipeline returns 141 and the if takes the not-found branch. It’s a race, so it only bites on bigger lists. Left alone, it would eventually have deleted a live certificate. Swapping six pipes for here-strings fixed it. Check what’s feeding your grep -q.

Long itineraries started dying with a 30-second max_execution_time fatal inside PhpSpreadsheet’s Font.php. The model wasn’t involved this time. Every style change makes PhpSpreadsheet scan the whole style collection for a match, recomputing an md5 hash for every style as it goes, so a heavily formatted workbook gets quadratic. I wrote a Spreadsheet subclass with a hash-to-style index, re-verified hits against the current hash, made misses harmless, and only used it when the plugin’s own vendored copy of the library is the one loaded. Same bytes out, 20 to 28 times faster. The timeout’s line number was a profiler with a sample size of one, and it pointed straight at the problem.

A Let’s Encrypt certificate expired on one of my WordPress boxes and nothing told me first. Three causes were stacked up, and every box in the fleet had all of them. The installer had run under sudo, so cron couldn’t write its own log and bailed before reaching the renew step. Lego’s account key was root-owned too, so a manual renew failed with an unhelpful message. And an Apache fix I’d rolled out in September only patched the generated vhosts, not the generator on each box, so the next renewal put the bug back. Fixed all three and added a renew-on-the-spot step. If something regenerates a file, patching the file only buys time.

I shipped version 4.0.0 of an old tour-packages plugin at half past ten and 4.0.5 just after twelve. Every fix pulled away whatever had been hiding the next problem. A function_exists() guard that only protects you from code that loads after you. A null going into WP_Post on PHP 8. A rewrite flush on every request that had been quietly covering for a broken activation hook. Draft packages visible to anyone with the URL. And last, a search page whose fatal error was the only thing keeping a reflected XSS and a shortcode injection out of sight. When a page has been dead for a long time, read all of it before you make it work again.

Third round of permissions trouble on migrated WordPress boxes. A plugin update from wp-admin failed on a server that had already had my full repair script applied. The modes were exactly what I’d asked for, 2775 and group-writable, but the owner and group were both root, because provisioning had installed that plugin with sudo wp –allow-root. The repair script promised never to chown anything, which meant it couldn’t see the problem. Now a fourth sweep hands only root-owned files under wp-content to the right owner, and provisioning chowns straight after installing. A repair script’s safety rule doubles as its list of blind spots.

An itinerary builder that planned fortnight-long trips without complaint broke four times on a ninety-day brief. The skeleton stage ran out of output tokens and reported it as a parse error. Then a finished response carried one malformed character, which I fixed with a retry and an outline-then-chunks fallback. The section stages hit the same ceilings, and finally one hung hotel check held the whole build at 28 of 29. Every limit had been sized for the trips we’d tested. Anything that scales with input needs a limit that scales too, or a design that doesn’t care. And check stop_reason before calling output unparseable.

A travel search on a few of my sites took about six seconds every time someone started fresh, and I’d have sworn it was cached. It was, on the way in. The writer stored the key without a trailing underscore; the reader asked for it with one. A forked sibling plugin had the opposite bug, a doubled underscore, plus a read that had been commented out altogether. The fix is one function that builds the key for both sides, then a daily cron that warms the cache inside a time budget. A cache entry existing only proves the writer ran. The only proof a cache works is a hit.

Pick a currency we had no conversion rate for and the page swapped the symbol but left the number where it was. A cabin at 1,200 in the base currency displayed as £1,200. No error, no log line, no visual tell, and a completely plausible price for a cruise cabin. Two functions, each correct on its own terms: the label side honoured the visitor’s cookie unconditionally, the maths side sensibly refused to convert without a rate. The fix is the weakest guarantee worth having — if we can’t convert, we don’t relabel. The shape to hunt for in your own code is a shared input whose validity only one side ever checks.

Four model calls running side by side instead of one long one, and the wall clock went up. Not the calls — those were faster, exactly as advertised. The time was in the gaps between stages. I’d ranked Action Scheduler as the preferred dispatcher on reliability grounds, and on a quiet site it runs its queue off WP-cron, which runs when somebody loads a page. Three handoffs at about a minute each, bought to save ninety seconds of generation. The fix was a reordering rather than a rewrite, and only because an atomic claim I’d written months earlier for a failure case turned out to be load-bearing as the design.