How this site is built
The site is part of the argument the writing makes, so it is worth saying how it works.
SvelteKit, prerendered to static files, served from a CDN. There is no server, so there is nothing to cold-start and nothing to patch. Papers are markdown files: publishing one is writing a file, committing, and pushing.
Two gates run before anything deploys. One fails the build if a client name that should never be public appears anywhere in the output. It works from hashes, so the names it protects are not themselves stored in this repository. The other checks that every internal link resolves. Both fail the build rather than filing a warning, on the principle that a gate which only ever passes is not a gate.
The palette and type hierarchy are shared with the résumé generator behind the same business, which is why the two look like one hand.