NAME

design - Every non-obvious decision in the site, what it argues, what supports it, and what would falsify it.

Also resolves as: design rationale, why the site looks like this, the checker

Every claim here carries one of four labels. [measured] is a number taken from the built page or computed from the stylesheet, and can be re-run. [reference] is how the tools this site is modelled on do it: git log, journalctl, dmesg, man pages, RFCs, tmux, a tiling window manager, and the terminal colour schemes with a written rationale. [decision] is a choice made with an argument but no measurement. [guess] is a judgment with nothing behind it but a preference, stated so it can be argued with. The build script scripts/check.mjs enforces most of what follows and fails the build when a rule is broken; this page says why the rules exist.

The reference class

Twenty landing pages were fetched and tabulated on 2026.09.07 to decide the structure below: the personal sites of Jann Horn, Tavis Ormandy, Fabrice Bellard, George Hotz, Gwern Branwen, Dan Luu, Samuel Groß, Mateusz Jurczyk, Gynvael Coldwind, Halvar Flake, Travis Goodspeed, xorpd, Fabien Sanglard, Chris Wellons, hasherezade and 0xdf, the zines Phrack and tmp.0ut, and Openwall and LiveOverflow. lcamtuf, djb and textfiles.com refused the fetch. What the class does, counted:

• Single column: 17 of 20. Multi-pane landing pages with live state: 0 of 20. [measured]
• A line saying who this is, in the first screen, before the list: 10 of the 16 personal sites. Tavis: “Hello, my name is Tavis Ormandy, I’m an independent vulnerability researcher.” Jann: “Hello! I’m Jann and I’m interested in computer security and C programming.” [measured]
• Dated entries: 13 of 20. A line of description beside each entry: 15 of 20. [measured]
• Top-level links: median 6, range 2 to 35. [measured]
• Contact at the bottom of the page: the majority; near the top on 4. [measured]
• A last-updated stamp: 4 of 20 (Bellard, Tavis’s $Id$, gwern, j00ru). [measured]
• Numbering: Phrack (hex volume, issue and phile), tmp.0ut (01 to 21 with dotted leaders), j00ru (series #1 to #5). [measured]

Three of those moved the site: the first line, the description beside each entry, and the phile. The side column was the one place the class was overruled, at the author’s request; it lasted five passes and then went, at his request, for the reason the class gave.

The log

Claim. The log lives at /log and is the name of the site. The front page is a menu and the log is the destination behind it, as dense as it was when it was the front, with nothing removed and nothing explained that was not explained before. It is a reverse-chronological record of every dated state change: a post, a revision, a project status change, a question opened, a wiki entry created, a week with nothing shipped, a commitment past its date. Every row leads with a plain word: post, revised, note, project, question, wiki. A post’s row carries its summary after the title. The filter line is the log’s summary in codes with counts, and the key explains the codes. The essays are called entries, which is what a log has.

Support. git log, journalctl and dmesg are records of events, and each row says what happened rather than what a document is called. [reference] The rows led with three-letter codes for six passes and lost every reader who arrived from a bio link on a phone; Nielsen’s second heuristic is match between the system and the real world. [reference] Fifteen of the twenty sites in the reference class put a line of description beside each entry, and apropos prints name - description; the post row does the same. [reference] The word “log” belongs to the site as a whole because the name is six hour log. The essays were “posts” for one pass and “philes” for one day; the author asked for a word that is abstract and his, and then said phile was not his style. A log has entries, so that is the word, code ent, and it needs no key. [decision: the author’s] The threshold for an event is enforced by the schema: a changelog entry cannot exist without a note, a status change cannot exist without a reason. [decision]

Falsifier. If the log fills with rows that carry no information (revisions that say “typo”, status changes that say “update”), the threshold is wrong and belongs in a heuristic instead of the schema.

The title row and the key

Claim. The log’s title row reads log · about me · key. The about link is the way to the person; the key is a button that drops a box down under the title with one row per kind of event: the three-letter code, the word the rows use, and what it is. The box is hidden until asked for, and it is generated from the same table that generates the rows and the filter line, so it cannot say something the log does not do. The filter line uses the codes, “5 log · 2 rev”, because the key explains them.

Support. A paragraph over the log was tried first, in the shape the reference class uses (“Hello, my name is Tavis Ormandy…”). The author read it as an entrance he did not want, and the bare name it opened with as “one word”, and asked for the about link in the title row and the key back. [measured: the reading] The earlier rule that nothing on the site explains its own tokens is withdrawn; its replacement is that the one explanation is collapsed by default, one line per kind, and derived rather than written, which is the difference between a key and a legend. [decision] tmux keeps its help behind a key binding; man pages keep the conventions section at the end. [reference]

Falsifier. A stranger who never opens the key and still cannot read the log. The rows lead with words for that reader; the key is for the codes and the addresses.

An entry is a phile

Claim. An entry carries Phrack’s header line at the right end of the head row, 2026, Entry #0x05 of 0x05, opens with its address, its title and one line of date and markdown, numbers its sections the way a phile does (--[ 1 - The belief, ----[ 1.1 - ...), and ends with |=[ EOF ]=. The volume is the year, so the year is printed rather than a volume number; there are no issues, so none is printed; the entry number is its address, which never changes; “of” is how many posts exist. The wiki, the notes, the projects and the questions keep the man(7) header, because they are reference and an entry is a phile: Phrack’s shape, the site’s word.

Support. Phrack has printed Volume 0x0f, Issue 0x45, Phile #0x03 of 0x10 at the top of every article since the eighties, and its sections are --[ 1 - Introduction. [reference: phrack.org/issues/71/introduction] tmp.0ut numbers its philes 01 to 21 with dotted leaders. [reference] The site already used Phrack’s hex for addresses; the header is the same convention carried through. The section numbers are CSS counters, so no post was edited. [decision] The line printed Volume 0x01, Issue 0x1f for a season while this entry said there were no issues; the volume number and the year were two labels for one thing, and the issue was a count the site never had. It prints the year and the number now, and the checker refuses an issue. [measured: the reading; decision: the author’s] The header held ==sixhourlog==, the title, and a block of keys, word count, reading time, revisions, tags and a text link, three headers before the first word; the mark above already says the site’s name, the length is self-evident from the page, the markdown serves what the text link served, and the pane’s “in the log” section restated the number and the year now printed once at the top right. What remains is the address, the title, the date and the markdown. [decision: the author’s] The split between phile and manual page gives the two document classes on the site different first lines, which is how a reader tells an essay from a reference entry without a label. [decision]

Falsifier. A reader who takes --[ 1 - for decoration rather than numbering. The outline in the pane carries the same numbers, which is the check.

Addresses in hex

Claim. Every document has a fixed address in hexadecimal: 0x05 is the fifth post, P-0x02 the second project, U-0x01 the first open question. Counts are decimal.

Support. Phrack has numbered every article in hex since 1985, and hex is the native numeral of binary exploitation. [reference] Addresses are assigned in publication order and never change, so a deleted document leaves a hole rather than renumbering the rest. [decision] Counts went to decimal after hex counts in the navigation were read twice as addresses. [measured: the reading, not the number] The phile header is the one place a count is printed in hex, “of 0x05”, because that is Phrack’s line verbatim. [reference]

Falsifier. A reader who mistakes an address for a count, or the reverse, after the split.

Weeks and the deadline

Claim. Weeks run Sunday to Saturday and a post is due Friday. The running week is reported and not scored until Friday passes; from Saturday with nothing posted it is a miss.

Support. Both rules are the author’s, from the about post. [reference: the content] Dates are pinned to UTC midnight of the written calendar day so the same content builds the same numbers in Denver and on Cloudflare. [measured: the build was non-deterministic before this]

Falsifier. A post dated Saturday that the author considers on time.

Dated commitments

Claim. An open question with a deadline lives on /cadence while it is ahead, with a countdown. Past the date with no resolution it becomes a row in the log, dated to the day it fell due, wearing the failure block. A future date is a schedule, not a record, and a schedule at the top of the record confused the reader it was meant to hold.

Support. The pursuit post: “saying a thing publicly, with a date on it, is the only kind of self-imposed commitment that has ever held for me. It is mine that need a witness.” The site is the witness. [reference: the content] An overdue commitment is a failure state, one of the two the record tracks, which is why it wears the block. [decision]

Falsifier. A commitment that goes overdue and is quietly deleted rather than closed. The record would show the deletion as a missing row, which is the point.

The front page

Claim. The front page is a menu of four groups, not the log. It opens with the head every page has: the mark, “sixhourlog”, with its echoes, and under the head’s hairline, as the title row, one dim line in the site’s face at the path’s size: “Shayne, studying CE and larping CTFs. If I start speaking in binary, it’s because the 1’s and 0’s started speaking to me first.” On the ground below the band, a staircase of four steps, one per group, by what a visitor wants rather than by content type: reading (entries, projects, notes), archive (log, wiki, questions, cadence), code (open source, github), me (now, uses, shelf). Each step is one step down and one to the right of the last, with a rule above it, the tread, and a rule down its left edge, the riser. The step is a third of the room beside a group, held between five rem and thirteen percent of the frame, so the stair spreads on a wide frame and tightens on a narrow one; no group’s left edge passes half the frame; where a whole step does not fit, a group aligns with the one above rather than advancing part of a step; and each group runs from its left edge to the frame’s right edge, so the treads end on one line and the stair reads as one object with the ground open at its lower left. Past 1440 the frame keeps the share of the viewport it has there, so the stair widens with the window; see One page at every scale. The space between steps is a share of the viewport’s height, so all four groups sit above the bar on a 14-inch laptop. Each step opens with its label, bold, tracked wide, in the label grey, a tinted grey at the ground’s own hue, and lists its links one to a line, the name in the strongest ink then its state, derived at build from the collections, never typed: “entries 5 entries, latest 4d ago”; the log’s says “the full ledger, 18 events in 2026”, so a stranger knows what opens. One column on a phone. Open source has nothing in it, the row says so, and it links to /open-source, which holds one line in the author’s words until a repository exists. Nothing on the page is drawn: no border, no box, no panel, no rule. Depth comes from the ground and the setting, not from arranged elements. Hierarchy is weight, case, brightness and position within two type sizes. On a phone the label sits over its rows and the order holds, reading first.

The head is the row every page has; the ground below it is flat midnight. No field, no sky: the depth is the band against the ground, the line work, and the colour.

The type is one scale, ratio 1.25 from the body size, and one unit, a quarter line, with no gap over one line. The identity line was one paragraph at the size of the mark for a pass and the author read it as strange and as big as the mark; cut in two, who under the mark and the sentence under that, each has a place and a size, and the ground opens straight onto the groups. The sentence sat at the band’s right edge for a pass and the author read it as blurred and aligned with nothing; on the one left edge with the mark, a size up, it is crisp and belongs. [decision: the author’s] A visitor read “record”, clicked its first link, and landed on the full ledger unwarned; the group is “archive”, the log’s state line says what it opens, cadence joined it because it is one of the site’s own pages and had been lost from the front, and about left the me group because the bar carries it. [measured: a visitor; decision: the author’s] The labels sat at the metadata token, APCA 47 on the ground, and were unreadable as headings; they are bold and tracked wide now. They were set in the lavender for a pass, APCA 63 on the midnight and 76 on the silver, and the author read the lavender as a purple accent rather than as part of the page. The label grey keeps the lavender’s lightness and takes the ground’s own hue with a surface’s cast, Lab chroma 11 against the lavender’s 33: dark #BBB6CB, hue 296 where the ground is 296, APCA 64 on the ground and 63 on the inset; light #566172, hue 259 where the ground is 258, APCA 75 and 67. Each sits a CIEDE2000 distance of about 9 to 10 from the neutral grey at its lightness, so the tint is there beside a neutral and reads as grey on its own. On the light theme the label grey lands within a few units of the dim token, which was already a slate at the ground’s hue, so there the labels are told from the state lines by weight, case and tracking alone, which is how a man page tells a section head from its body. [measured; reference: man(7); decision] The floor for the labels is APCA 60, above the 47 that failed and under the body floor, because they are twelve-pixel bold capitals tracked wide and never body copy; the checker holds them to the ground’s hue within fifteen degrees, to a surface’s cast, and to that floor. [decision] Ink at the same weight is the fallback if the tint is refused; if the tint reads as flat grey with no benefit over neutral, the honest next step is the dim token, not more chroma. [guess: the reading, from the built page rather than a reader] The groups were a label column and rows for three passes and the author read them as the table of contents of a manual; four columns of name over state was the first change of shape, and the author asked for another; the staircase keeps the sleeve’s track list and gives the page’s empty ground a structure to descend through, which is the depth the author asked for without a field or a box. [decision: the author’s] The head had grown to the mark over two lines of text and read as giant; the author asked for the entries index’s head everywhere, so the front’s mark is the head’s size and its two lines are its title row. The steps stacked one under another for a pass and the fourth fell under the fold of a 14-inch laptop; the stair was redrawn as one line through four side-by-side columns for a pass and the author read it as a graph and asked for the stacked steps back, sized to fit; the steps are the same and only their spacing scales. [decision: the author’s] At a ten-rem step the last group began half-way across the frame and the lower left of the page was empty; the page was produced at four, ten and fourteen rem, and with the groups widened to a common right edge at ten and six. Varying the step alone moves the emptiness around; the common right edge makes the treads one silhouette and the emptiness its negative space, so that shipped, with the step held between five and eight rem. [measured: the reading; decision] The title row set who this is in dim mono and the sentence in the serif’s italic in ink, and the sentence pulled the eye; in one face and one dim the two halves still took two lines and the band a line more than the index’s, so the line is one line, at the path’s size, and the mark alone carries the head. [decision: the author’s] The underline under a link name is drawn transparent and only its colour changes on hover, so nothing moves; the state line beside it comes up from dim to ink at the same time.

Support. The homepage was the log for the whole first season, built to match how the reference class builds a personal site, and it failed the readers who matter: someone arriving from a bio link landed on eighteen rows of revisions and gap rows and could not find the latest entry. [measured: the reading] A menu answers the four-second visitor with facts and four choices; the depth is one tap behind each. [decision: the author’s]

Eleven front pages were built and rejected between the menu decision and this one. Plain versions read as institutional forms, “a textbook seller or a USPS info page”; loud versions read as clothing or Y2K movie sites. Every one of them was made of arranged rectangles: equal boxes, unequal tracks, staggered rectangles on a crossing, plates, tilted panels, blended blocks. The author’s diagnosis: a solid ground “just made it look like a blob”, and his target: “the art of simplistic complexity. small things that give way more than it looks.” [decision: the author’s] The actual CSS of thirty-eight sites where the surface is worked (studios, foundries, small presses, galleries, architects, and personal sites known for craft) was read for mechanics. None of them gets depth from arranged shapes; all of them get it from the ground, the scale, the spacing unit, the underline, the states and the details at small sizes. [measured: the study, 2026.09.09] The front takes from that study a stated scale and unit (Chipperfield, Commercial Type), tracking tightened at display size (Caruso St John), an optical pull on the wordmark (Grilli Type), an underline reserved before it is shown (John Morgan), a state that comes up under the cursor (Klim, Tim Brown), one transition duration with per-property opt-in (Manuel Moreale), an edge made of a hairline with a large shadow (e-flux), and a layered ground of neighbouring tints (Robin Rendle, Craig Mod). [reference]

The first cut of the ground had peaks thirteen values from the page colour, and the author read it as flat: a range that works on white paper does not register on a dark screen. [measured: the reading] The fields were then pushed until the page visibly was not one field and pulled back to the floors: on the dark ground the page runs from about #070707 to about #383838 under the band, on the paper from about #B2A792 to #F2EFE9, and every text token keeps its APCA floor at every point a field reaches under it, measured by sampling the built page with the text made transparent. [measured] The ground alone, however layered, still left the page reading as one run; the break that finally answered the complaint is the band, see Structural breaks. [measured: the reading] With the band and the bar flat and the fields between them, the author read the fields as not fitting, “a solid banner and footer and just a gradient between”, and then as corny; a sky in one direction under every page, with the band and the bar as its frame, is one material where three fields were three things. [decision: the author’s] Layering is perceived through overlap, so a single gradient reads as shading, not as a layer; two fields that cross, with the crossing blended to a value beyond both, read as surfaces. [reference: the study; decision: the author’s]

The man-page setting is the site’s own: the address column, the section head in the margin, the body on one left edge. [reference: this site’s documents] A region on its own surface groups more strongly than spacing, but a surface is a shape, and shapes are what failed; the group’s label and the one-line gap between groups carry the grouping instead. [decision]

Falsifier. A visitor who lands on the front, sees the four groups, and leaves without clicking any of them; or a reader who calls the ground flat.

One page at every scale

Claim. The root font size is a base plus a share of the viewport width, floored at the browser’s default and capped: 16px at 1440 and under, 20px at 2560 and beyond, growing between. Every length on the site is in rem, so the page at 2560 is the page at 1440 at a larger size, not the same page in a larger field. The front’s frame keeps the share of the viewport it has at 1440, about 72 percent, so the staircase widens with the window and its steps, capped as a share of the frame, keep the same silhouette. Documents keep their measure, 38rem, which grows with the root and holds its seventy-odd characters; the log keeps its 120 characters. The one viewport width unit in the stylesheet is this one, and the checker allows it only in this shape.

Support. The rule against viewport units exists because a viewport unit used alone breaks user zoom; a root that is floored and capped in rem zooms, because the floor and the cap are in the reader’s own unit, and it respects a reader’s font size setting for the same reason. [reference: David Chipperfield Architects’ stylesheet, which sets the root as a base plus a viewport factor under a cap, read in the craft study] Before this the frame was 1040px at 1440, at 2560 and at 3440, the last group’s left edge sat at 915px on a 2560 screen, and the type was 16px at every width: the right half and the lower two thirds of a 2560 screen were empty, and 1440 and 2560 were two different pages. [measured] The values: base 0.685rem plus 0.35vw is exactly 16px at 1440 and 19.9px at 2560, where the 1.25rem cap takes over; under 1440 the 1rem floor holds, so the type at and below 1440 is what it was, and the only movement there is the step, 128px to 124px at 1000 and to 129px at 1440, because thirteen percent of the frame is not exactly eight rem. The cap is 20px and not the 28px a proportional scale would give because a 27-inch 2560 monitor at 109 pixels per inch is read from about 65cm and a 14-inch laptop from about 48cm: 20px on the monitor subtends about what 16px does on the laptop, and 28px would be a page for the far side of the room. [decision, with the arithmetic] The frame’s share, 72 percent, is what the 65rem frame with its margins took of a 1440 viewport, stated as the share it was and held above the crossover; the step’s cap, thirteen percent of the frame, is the 8rem chosen by eye on the 62rem frame stated the same way, so three steps take 39 percent of the frame at every width. At 2560 the frame is 1843px with its margins, the step 232px and the last group’s left edge sits 695px into the frame’s content; at 3440 the frame is 2477px and the step 314px; the stair’s last tread ends at 817px of a 1440px-tall screen at 2560, against 635px of 900 at 1440, so the lower two fifths of the tall screen are ground where the lower third was on the laptop, which is the cap’s cost. [measured] Documents were not widened: the measure is a claim of its own, One column per document, and a wider frame there would falsify it; the record frame was left at 62rem for the same reason the log’s rows stop at 120 characters. [decision] The cap is reached at 2583px, so 3440 shows the 2560 page with a wider frame and the same type, which is what an ultrawide is: the same monitor, wider. [decision]

Falsifier. A reader on a 2560 screen who still calls the page small, or a reader on a laptop who finds the type changed. The first means the cap is low; the second means the floor moved.

Animation

Claim. Animation carries information, or it is a deliberate exception written into the checker with its reason, and either way it is still under prefers-reduced-motion. The checker lists every animated selector and refuses one that is not on the list or that the reduced motion block does not stop.

Support. The old rule was no animation at all; a field and a puzzle on the front replaced it with a narrower one that names its exceptions, and both have since been removed, so the allowlist is empty and the rule stands as written. [decision: the author’s] Cross-document view transitions are the one animation that carries information without an exception: the wordmark and the bar hold still while the page changes beneath them, which says what moved. [reference: the View Transitions API]

Falsifier. An animated element that is not in the list. The build fails.

View transitions

Claim. Pages change with a cross-document view transition, declared in CSS and nothing else; the wordmark and the status line carry names so they stay put while the content moves. Off under prefers-reduced-motion.

Support. @view-transition with navigation: auto is the no-script form of the API, and Astro’s static output needs nothing more. [reference]

Falsifier. A browser that flashes the bar on navigation. That is the API missing, not the rule wrong.

Questions from an entry

Claim. At the foot of an entry’s own page, above prev and next, the open questions that came out of that entry are listed with their addresses and state.

Support. Chronological prev and next is the shallowest relationship between two entries; the questions an entry produced are the depth link, and the questions already carry the entry’s slug in their frontmatter, so the link costs nothing. [decision: the author’s]

Falsifier. An entry whose questions a reader still could not find.

The frame on windows and documents

Claim. Outside the log, the text block takes one third of the leftover width on the left and leaves two thirds on the right. It is neither centred nor flush left.

Support. The canons of page construction (Van de Graaf, Tschichold) put a book’s inner margin at half its outer, 2:3:4:6 for inner:top:outer:bottom. [reference] A centred block reads as a card and a flush-left block as an unstyled default; both were tried and rejected by the author. [measured: the rejections, not the reading]

Falsifier. Eye-tracking or a reader test showing the off-centre block reads worse than a centred one for this content. None exists; this is the weakest-supported layout claim on the site.

One column per document

Claim. Prose and code share one column, 38rem wide, sized so eighty columns of code fit at 12.5px. Prose in it measures about 72 characters per line.

Support. Prose studies put the comfortable measure at 60 to 75 characters. [reference] The 80 columns is a terminal convention, not a finding. [reference] Two containers on one page, with code twice the width of the prose explaining it, was measured and rejected. [measured: 524px against 992px]

Falsifier. Code that needs more than eighty columns often enough that the scrollbar inside the block becomes the norm.

Line work

Claim. Hairlines, one pixel in the edge grey, where one surface meets another and nowhere else: under the head row, above a document’s closing line, above the bar, along the gutter between the front’s group labels and its rows, and around the cadence strip, where the box is the chart. Never between rows. Hierarchy still comes from surfaces, case, position and brightness; the lines say where a region ends.

Support. The earlier claim here was no rules anywhere, and its falsifier was that rules return if colour is not enough. It fired: the author read the pages as lacking line work, and the head band’s edge, a step of a few values with no line, as a grey block meeting a black one. [measured: the reading; decision: the author’s] A hairline at a surface edge is what the studios in the craft study do (e-flux’s hairlines, Chipperfield’s stroke tokens, Zone’s one black rule); a rule between rows is still what made the first log an undifferentiated field, and stays refused. [reference; measured] Man pages use uppercase heads flush left and indented bodies; git show indents the message under the header; journalctl has no rules at all. [reference] The checker lists every hairline with its reason. [decision]

Falsifier. A line that a reader takes for a box, or a page where the lines do the work the surfaces should.

Kinds without colour

Claim. Kinds of record are told apart the way a monochrome terminal tells things apart: weight, brightness, italic, underline, and the rail. Entries are bold ink, projects are ink, writeups are underlined ink, notes and wiki entries are pencil grey with the wiki in italic, open questions are bold ink, closed questions are struck through, and machine-observed rows are dotted. One kind carries a hue: corrections are the red. An overdue commitment wears the failure block.

Support. A field of identical monospace rows is the problem a terminal without colour solved first, with ANSI attributes. [reference] Every token is also its own three letters, so the attribute is never the only channel. [reference] Zebra striping was considered and not used: Enders found no effect in one study and a modest effect under time pressure in a second; the two disagree, and neither is a case for stripes. [reference] Six hues, one per kind, were tried across three passes and read as an editor theme each time; the author’s own description of the site is near-monochrome. [measured: the rejections]

Falsifier. A reader who cannot tell log from project at a glance. Weight is a weaker channel than hue, and this is the trade the monochrome buys.

The head and the path

Claim. Every page opens with the head: one row on the page ground, closed by a hairline, the same height on every page. In the row: top left the mark, which is the home link, always ”/”, on every page without exception, and beside it, on every page but the front, a path derived from the URL, each segment but the last a link: “entries / 0x05”, “wiki / design(7)”, “projects / P-0x02”. Beside the path a ”< prev” control that goes back one page when the page before was on this site; otherwise it is greyed and inert, which is also what it is without script. The bar carries contact, find, about me and the keys, and no wordmark. The Phrack line at the top of an entry stays, as a header line: the site name in it is text, not a link. The man(7) header line is the wiki’s alone; every other page prints its plain name in its closing line and no header line, since the path says where it is.

Support. Before this, an entry opened with “==sixhourlog==” top left, the Phrack convention, which occupies the position where every site puts a home link and went to the entries instead, while a second wordmark in the bar went home: two marks, two destinations, neither where a reader expects. [measured: the reading; decision: the author’s] The path is a position trail, not a history trail, so it is computed from the URL and the collections at build and cannot be wrong; the history is the prev control, which reads document.referrer on load and enables itself only for a same-origin page, so a reader arriving from elsewhere sees it greyed rather than absent. [decision: the author’s] The wordmark carries a view-transition name, so on the way from the front to a page its large mark becomes the small one in the head; the effect the bar’s wordmark used to give is kept without the second mark. [reference] The Phrack header is enforced on entries and belongs to the phile; making its site name plain text ends the ambiguity without moving the line. [decision] The head took two rows for a pass, the mark over the path, and the author read it as too tall for what was on it; one row is what it carries. [decision: the author’s] For five passes the head was a band on the inset surface that also held whatever a page put in it, two lines on the front and eight on an entry, and it grew to fit: not a header but a background behind however much content there was, which is why entries read as a different site from the front. The band is gone. The head is the row and its hairline on the ground, the same height everywhere, and a page’s own title row, keys or filters sit on the ground under it with a line of air between; the staircase does the structural work the band was added for. [measured: the reading; decision: the author’s] The section number in “NOW(7)” and “SHELF(7)” is the manual-section convention the wiki borrowed from man(7), where 7 is miscellany; it had leaked onto every reference page’s header line and the author asked why; it belongs to the wiki and nowhere else. [decision: the author’s]

Falsifier. A reader who clicks “==sixhourlog==” expecting to go home, or one who cannot find the way home from an entry.

Structural breaks

Claim. A page is regions, and the regions meet without a line. The head is a row on the ground closed by a hairline, the same height on every page. Inside the ground, regions are separated by a break, two lines of space, the one vertical space over a line on the site, used only as a margin above a region; and by a change of measure, the reading column narrower than the head above it. On an entry the head row carries the year and the number at its right end, the address, title and date follow under the hairline, the body follows a change of face, and the changelog and the EOF line follow a break. On a man page every section follows a break. On an index the title row sits under the head and the rows follow, with a break before each further group. On the log the title row sits under the head and the record follows. No rule, no border, no box and no panel does any of this; the pane beside a document is a column on the ground, not a surface.

Support. The complaint against eleven front pages and every document page was “no depth, no layers, words on a blob”, and for several passes it was read as a ground problem and answered with gradients. The front page’s ground then worked and the page still read as a blob, which showed the ground was never the issue: the pages had no structural breaks, one continuous run from the wordmark to the bottom with spacing between groups and nothing else. [measured: the reading] The rules against rules, borders, boxes and panels exist because the attempts that had them read as dashboards, so the breaks had to be made without them: a change of ground value between bands, a change of measure, real space, a band across the viewport with its content in the frame. [decision: the author’s] The break is two lines because one line is the ordinary paragraph gap on this site and could not read as anything else, and three read as a missing section; it is allowed as a margin-top only, so it can never become the padding of a box. [measured: the reading; decision] The test is the one the author set: on a screenshot, can a reader point at where one region ends and the next begins without pointing at a line someone drew. On every page type the head’s hairline and the break answer it. [measured]

Falsifier. A page type on which a reader cannot point at the end of a region, or a break that has to be drawn as a line to be seen.

The typeface

Claim. Hack, self-hosted, latin subset, in four faces, regular and bold with their italics, about 25 KB each. Plain Hack, not the Nerd Font patch. The mark is Redaction, Titus Kaphar and Reginald Dwayne Betts’s face with Forest Young, at grade 35, when the author has placed its file, and Alegreya Medium until then: lowercase, at the third step of the scale on the front and at 1.0625rem in a page’s head, in the strongest ink with the cover’s own device under it, a violet echo offset to the left and a mint one to the right, which close under the cursor. Never used for a heading or a word of copy. IBM Plex Serif for the body of an entry and of a question, and nothing else; it is the one font still fetched from Google. The scale is one ratio, 1.25 from the body size, at :root; the unit is a quarter line; every gap on the site is a multiple of it and none is over a line except the break. Links are underlined 1px at 0.2em below the baseline, the underline drawn before it is shown: in dim in running text, in transparent on a row’s title, and filled to ink on hover, so nothing moves. One transition duration on the site, 150ms, with nothing moving unless its property is named, and nothing at all under reduced motion. Entry bodies hang their punctuation, set old-style figures, keep three lines together at a page break, and indent consecutive paragraphs instead of gapping them, as a book does.

Support. Hack is the face the author works in. [decision: the author’s] The Nerd Font patch carries thousands of icon glyphs the site would never set. [decision: the author’s] Hack ships two weights, so the 500 and 600 the sheet asked for under Plex Mono fall to 400 and 700, and hierarchy did not need the steps between. [measured] Hack’s advance is 0.6022em against Plex Mono’s 0.6em, so eighty columns at the code size, 12.5px, need 602.06px; the 38rem measure gives a code block 600.5px of content after its padding, and the eightieth column overflows by 1.5px. The measure is unchanged pending the author’s call; the value that fits is 38.125rem. [measured] The mark was the body face, bold, at heading size, and read as a heading: twenty foundries, studios and presses were read for what they set their own names in, and none does that; they keep the name at body size, or change case, tracking or scale, or reserve a face of another genre never used for headings. [measured: the study, 2026.09.09] Syne in capitals was the mark for a day; the author preferred Alegreya and could not settle capitals against lowercase, and the call is lowercase: Alegreya’s identity is its lowercase, the h, l and g that give “sixhourlog” a rhythm no capitals have, and a lowercase mark against the site’s uppercase labels is the one word on the page that does not shout. [decision] It is set 6% over the body size in a head so its x-height meets Hack’s. [measured] The echoes are the cover’s chromatic aberration in type: a text-shadow at 0.07em to each side, no blur, static, and the same misregistration a Riso print has when its drums do not line up, which is the tradition the palette already cites. They are not a glitch overlay and nothing moves; on hover the offsets go to zero and the mark comes into register. [decision] The other three candidates stay at /lab for comparison. Redaction is the author’s ask; it is free for personal use from MCKL under their own terms and not an open licence, so the build never fetches it: the layout declares the face only when public/fonts/redaction-35-regular.woff2 exists, and the stack falls to Alegreya when it does not. [decision: the author’s] The pink was the mark’s right echo for a pass; the author keeps the pink for underlines and wanted the mark in something else, and the mint is the cover’s paper, lifted. [decision: the author’s] The identity line was set for one pass with “Shayne.” in the mono and the rest in the serif’s italic, and the mix read as a mistake; it is now two lines in two places, see The front page. [decision: the author’s]

The entry body stays in the serif. The entry is the one place on the site meant for sustained reading, and every site in the craft study that sets long prose sets it in a text face and its interface in another; the change of face is itself a break, the reading region told from the record around it by texture before anything else. [reference: the study; decision] The figures in prose are old-style so that a year sits in a sentence at x-height and a date in the keys stays lining; Caruso St John does exactly this split. [reference] Indented paragraphs with no gap are the book convention and make the body one dense setting rather than a stack of blocks; the wiki keeps gapped paragraphs because a man page is scanned, not read through. [decision]

Falsifier. A code block on the site that scrolls sideways at eighty columns; a reader who reads the indent as an error.

The palette

Claim. The palette is one record sleeve, GNB Chili’s “Emotionally Unavailable”, and its negative. The cover is a washed mint-white paper, a black figure, the figure’s echoes offset in electric violet and hot pink, and the title in a black band. The light theme is silver and near-white with a cold cast, the same page as the dark one and not book paper: ground #F2F4F7, inset #E4E8ED for the bar and code, edge #C3CAD3, ink #151A22, a cold dark rather than a black-brown, dim #5C6470, the strongest ink #0A0D12 for names and the mark. The dark theme is its negative in greys: midnight ground #110D1B, a violet cast a hair over grey; inset #1A1624, which is also the bar; edge #2F2942; ink #E5E5E5; dim #9A9A9A; the strongest ink #F1F7F5. The ground is flat. Four inks, each with one job and none of them on a surface: the red, #bc001c and #ff5352, on corrections and overdue commitments; the violet, #6A4E9C and #C2ADE8, a lavender on the dark ground, on the mark’s left echo and where the reader touches the page; the mint, #1C8073 and #8FE0D2, on the mark’s right echo and nowhere else; the pink, #C7237F and #FF74C0, on the underline under the cursor, never as type. The front’s group labels are the label grey, #566172 and #BBB6CB, the ground’s hue at the lavender’s lightness with a surface’s cast, a tinted grey and not a fifth ink; see The front page. Everything else is grey. Light: paper #F2EFE9, inset #E8E4DC, edge #DCD7CE, dim #67625A, ink #1F1B17, red #bc001c, violet #6A4E9C. The red goes on corrections and overdue commitments. The violet goes on the mark and where the reader touches the page: the selection, the focus ring, the underline under the cursor. Nowhere else, so a page at rest is grey with one violet word on it. Two inks is a two-colour Riso print; a third would be a scheme.

Support. Three things changed from the season before. The amber is retired: two warm, similarly weighted hues on a dark ground read as a syntax theme whatever the hues are, and the amber’s original reason, to stay distinct from the red under colour-blindness simulation, no longer applies once there is one accent, because red against grey is a lightness difference every form of colour vision reads. [decision: the author’s] The surfaces went through two steps. First the ground moved up from near-black so that near-black could be a recessed surface for boxes, code and the bar. Then, once the front page’s field was gone and the boxes had to carry the page on contrast alone, the recessed panels disappeared into it, so the ground moved down to #121212 and the panels came up to #1E1E1E: raised on a deeper ground, which reads at a glance where recessed did not. The site already argues that hierarchy comes from surfaces rather than rules, and this is the second surface that argument needs. [decision: the author’s] The wordmark carried the red for one season and was set in ink on 2026.09.09: at display size the red, APCA 43 on the ground, read faded, a light coral that washes out when enlarged, and the mark’s job is to be the lightest or darkest thing on the page, not the coloured one. The red went back to its original scope. [decision: the author’s] The violet came in with the mark’s own face: the author found the site void of colour once it was grey and red, and had spoken well of lavender. Riso Violet #9D7AD2 is lifted to a tint on the dark ground because a purple at mid lightness on a dark ground is what a syntax theme is; on the paper it is Riso Purple as printed. The washed lilac on the jinkasei cover in the album study is a Plum of the same family. [reference; decision: the author’s] The ground’s cast came with the author’s ask for “a midnight purple like a skyline”: every cast tried before was read as something else (a hospital, dirt, an editor), and a violet one is a night, which is the one thing a dark screen already is. It is held to Lab chroma 12 on the surfaces, and the checker holds it. [measured; decision: the author’s] The sky that came with it, one vertical gradient, lasted a pass: the author read any gradient against the flat band and bar as wrong, whatever its colour, and asked for the cover as the sample instead. The cover’s colours were measured from the file, not guessed: the paper is #b9bdbb to #c3ece6, the echoes #7c68f6 (violet, hue 285), #d3509d and #e16ace (pink, hues 334 to 355), a little peach. Each ink on the site is the cover’s hue held to a Riso ink within the checker’s tolerance: Violet and Purple for the violet, Fluorescent Pink for the pink. [measured] The band was set in the cover’s paper for a pass, with the labels in the violet, and the author read it as too many purples and whites and a weird blue; the band went back to the inset grey, the labels to dim, and the cover’s mint became a thin echo on the mark rather than a surface. The light theme kept the cover’s mint paper and mint band through three passes that nobody looked at in the light, and the author saw a teal bar over an off-teal page: the teal was those two tokens, #C6E2DC and #D6E6E2, the cover’s paper, which reads as mint against a page and as teal against a screen. The light theme is now cold silver and near-white with a cold dark ink, chosen so every structural element of the dark page carries across at the same contrast. [measured; decision: the author’s]

Provenance, and not from a terminal. #ff5352 sits between Risograph Bright Red (#F15060) and Riso Red (#FF665E), both spot inks a person can buy a drum of. [reference: the Riso ink chart] Independently, the underground electronic tradition that is not vaporwave converges on black or near-black, greys and one red: Underground Resistance built a label identity on black and white with red, stencil and militant; Digital Hardcore Recordings is red and black agitprop; Blackest Ever Black is the name and the policy; The Trilogy Tapes and L.I.E.S. are xerox with one spot colour; Basic Channel and Chain Reaction went the other way, grey on grey with almost no value separation. [reference] Three independent lineages landing on the same hue is stronger support than any one of them. [decision] A terminal lineage, ANSI red or a phosphor amber, is what makes a palette read as a syntax theme, and it is no longer cited. [decision: the author’s] A checker rule now refuses any accent with no ink, paint or safety-standard equivalent, which retires Dracula, Nord and gruvbox palettes as a matter of rule rather than taste. [decision]

Contrast is checked twice, WCAG 2 ratio and APCA Lc, at the size and weight each token is set in, and APCA is the binding check on the dark theme because the WCAG ratio overstates contrast on near-black grounds: #B0B0B0 on #1E1E1E scores 7.69:1, WCAG AAA, and Lc 57.7, under the body-text threshold of 75. [reference: APCA] On this palette the ink is Lc 90 on the ground and 89 on the inset; dim #9A9A9A is Lc 47 and 46, secondary-text territory, over the floor of 45 by one point on the inset, and why it never sets body copy; the author’s first dim, #8A8A8A, measured Lc 38 and was raised; the red is Lc 43 on the ground and 42 on the inset as 14px bold labels, under APCA’s 60 for that size, and the author chose the hue over its lightness; the checker’s floor for the red is 40 and records that choice. [measured] Both reds are OKLCH hue 25 and the checker holds them within eight degrees; only lightness is the theme’s. [measured]

Falsifier. A reader who cannot tell the site from a plain dark theme at a glance, or a correction whose red reads as an error state rather than as a mark.

The status line

Claim. Contact on the left, which drops up the same list the log’s title row drops down: the names, linked to the places, one glyph each; find in the centre; about me and the keys on the right; no wordmark, since the head carries it on every page. One row at every width, opened at the top by a hairline. No countdowns: the week and the next dated commitment live on /cadence, with their dates, and are recomputed on load there. Fixed, its ground running to the bottom edge of the screen, with corner room on phones and no bounce.

Support. The left end of the bar was empty once the wordmark left it, and contact was reachable only from the log; the same list, opening upward because the bar is at the bottom, fills the end with the one thing every page should offer. It listed each service beside its address for a pass; the author asked for the names alone, linked, with a symbol, and that is what it is. [decision: the author’s] A countdown on every page was ambient pressure that stopped carrying meaning. [decision: the author’s] Two wordmarks in two forms on one screen, the front’s and the bar’s bracketed ”[ S . H . L . ]”, was one too many, so the bar leaves the wordmark out, first on the front and then everywhere once the head carried it, and the bracket form is retired: where a wordmark appears, it is the name. [decision: the author’s] The window list went with the menu: home is one tap away and lists every section, and the keys cover the rest. [decision] For one pass the bar sat at the top edge of the safe area with the page ground showing beneath it; in Chrome on a phone the author saw content scrolling through that strip and called the bar floating, so the bar sits at the bottom edge and pads its own surface into the safe area. [measured: the reading] iPhone corners clipped the last segment at the ends of the row; 1.25rem of corner room clears the arc. [measured: the reading] iOS drags fixed elements along with its elastic overscroll, so the root sets overscroll-behavior-y: none. [measured: the reading] The bar and the wordmark carry view-transition names so they hold still while a page changes beneath them. [reference]

Falsifier. A phone on which the one row does not fit. It measured at 320px with room to spare.

Nothing from anyone else

Claim. The site carries only its author’s work. Nothing is fetched at build time, there is no scheduled rebuild, and there is no list of other people’s writing.

Support. A reading feed of thirty outside sources lived on the session for one day. It was removed because it promoted other people’s brands on a page that is supposed to be the record of one person’s work, and because keeping it fresh needed a daily build on a free hosting tier. [decision: the author’s] None of the twenty reference sites carries a feed of other people’s posts on its landing page; the ones that recommend reading do it in a page of their own, off the front. [measured] The checker refuses any fetch() in the source except the wiki preview, which reads the site’s own JSON at runtime.

Falsifier. A reader who wants to know what the author reads. The shelf page exists for that, and it is a list he wrote, not a feed.

The technique index

Claim. Every writeup names, in its frontmatter, the techniques it used and the bug classes it hit, and the wiki has a generated page that groups the writeups by each. A writeup that names no technique does not build. The page is an index of the work, not one of the wiki’s three supporting pages, and it is the one feature that gets more useful with every writeup at no further cost.

Support. The author put it first, ahead of any more research. [decision: the author’s] The schema and the checker both refuse a writeup without a technique, so the index cannot drift from the writeups. [measured]

Falsifier. Technique names that drift (“ret2libc”, “ret-2-libc”, “return to libc”) and split one group into three. The fix would be a vocabulary, as the tags have.

Raw text

Claim. Every document is also served as the markdown it was written in, at its own path with .md on the end, with the frontmatter rebuilt to one shape, and /llms.txt lists them all. No new dependency, nothing that is not already on the site.

Support. The .txt mirror of entries existed; this is the same idea for every kind, in the form that things which read markdown expect. [decision] The checker refuses a built page without its sibling.

Falsifier. A reader who wanted the HTML and got the markdown. The links are labelled.

Project updates

Claim. A project is one page with a rigid timeline of dated updates, each with a note and, when it changed, a status. The alternative, one entry per step the way Sanglard writes sixteen posts over sixteen days, was not taken.

Support. The projects here are hardware that stalls for months and moves in an afternoon; a page that accretes matches that, and the log already receives every update as a row, so nothing is lost from the record. [decision] The note is required and the status is optional, which is the threshold: an update nobody can explain is not recorded, and an update that changes nothing but the work still is. [decision]

Falsifier. A project whose updates are essays. Then it is entries.

Bounded runs and issues

Claim. A run of work is named as a bounded count, “pwn.college, day 3 of 30”, in the entry’s frontmatter and its header; the entry’s header line also carries an issue number, the Sunday-start week of the year it went up, “Volume 0x01, Issue 0x24, Entry #0x05 of 0x05”.

Support. An open-ended weekly commitment fails by drift; a bounded one fails as a finite, writable event. [reference: the pursuit entry’s own rules] Phrack and tmp.0ut number what they publish; the issue is metadata, printed in the header line and the .md frontmatter and nowhere else, so it stays a detail rather than a costume. [reference]

Falsifier. An issue number that a reader takes for a count. It is hex like the addresses and sits between two other hex numbers.

Proposals at /lab

Claim. /lab, a temporary route, holds the four display faces that were proposed for the mark, set side by side at the front’s size and a page head’s size on the inset, in lowercase as the mark is set. The colour that was proposed there is shipped: the violet, on the group labels, the mark and where the reader touches the page.

Support. The wordmark is the one purely identity element on the site and it is set in the body face, bold, at heading size, which makes it a heading. Twenty foundries, studios and presses were read for what they set their own names in: thirteen use live text, and of those none sets the name in the body face, bold, at heading size; they keep it at body size and weight so it reads as a menu item, change case or tracking or scale, or reserve a face of another genre that is never used for a heading. The four candidates are one of each kind. [measured: the study, 2026.09.09] The site went fully monochrome when the wordmark went to ink; the author wants some colour and has rejected every proposal so far, so the colour is shown working rather than argued. [decision: the author’s] A purple at mid lightness on a dark ground reads as a syntax theme; the dark value is a tint at the lightness of the ink and is never set on code or metadata, which is how each placement avoids it. [decision]

Falsifier. A placement the author turns on and leaves on for a week.

Not built, and why

Sidenotes: no entry carries a footnote, so there is nothing to move into the margin; the component waits. Cheat sheets: when a topic is finished, not before. A curated resource repo: around month six, as a separate repository. Interactive tools: last, and only out of an entry that needed one. No dark-mode toggle, no search beyond Pagefind, no comments or webmentions, no reading-time widgets, no tracking, no new top-level sections, no webring, no growing the wiki past three supporting pages.

What is enforced

`scripts/check.mjs` runs before Astro and again after Pagefind. On the source it refuses centring, truncation properties, hides in media queries that are not allowlisted with a reason, viewport-width units anywhere but the root scale, and a root scale that is not floored at 1rem, capped in rem, applied under @supports with the unscaled root as its fallback, and declared once, vertical space over one line, horizontal rules, em dashes, a header component or a layout that renders one, a window list or a forced break in the bar, a bar that wraps, a countdown in the bar, a cadence page without its countdowns, a wordmark that is not “sixhourlog” or is not ink, a layout that does not render the head, a head whose wordmark is not linked to ”/”, a path that is not derived from the URL, a prev control not disabled in the markup, a phile header that is a link, a bar with a wordmark or without the contact box, a break that is not two lines or is used as anything but a margin-top, an ink that names no Riso ink or does not match it, the violet anywhere but the mark and the touch states, a group label that is not the label grey at 700 and uppercase and tracked wide, a label grey that is not the ground’s hue within fifteen degrees, that carries more than a surface’s cast or less than a tint, or that is under APCA 60 on the ground or the inset, a front frame that does not hold its share of the viewport past 1440, a step cap that is not a share of the frame, a stair that does not round its travel down to whole steps or that lets a group’s left edge pass half the frame, a hairline that is not listed as line work with its reason, a man header off the wiki or a man footer off the wiki with the section number, a bar without contact, a front page without who this is in its head, the second sentence over the groups, and the four groups, a border, a drawn surface, a shadow or an outline on any front-page selector but the foot, a rule, box, panel or table on the front, a hardcoded count on the front page, a log page without its key, any animated selector at all (the allowlist is empty) or one not stopped under reduced motion, a stylesheet without cross-document view transitions or without their reduced-motion guard, a second colour, a red that names no ink or does not match it in hue and chroma, two reds more than eight degrees apart, any text colour under WCAG 4.5:1 or its APCA floor on the ground or the inset, the red anywhere but corrections and overdue commitments, two reds or two violets more than eight degrees apart, a coloured address, any fetch() in the source but the wiki preview’s read of the site’s own JSON, a feeds collection, an entry page without the phile header and footer, a reference page without the man header, and a writeup that names no technique. On the built output it refuses ISO dates and uppercased hex in visible text, placeholders, a page whose head does not open with the wordmark linked home, a page but the front without its path and prev control, a front with a path, a front without its two lines, four groups in order, every group’s links, the plain “nothing yet”, a bar with a wordmark, a log page without its one pane, key, contact drop-down, foot line, year link and code filters, a header other than the head, a bar with a countdown, a section that is not one tap from home, an entry without “Volume 0x.., Issue 0x.., Entry #0x.. of 0x..” and the EOF line, a document without its .md sibling, and any link to the reading layer. The exceptions live in the same file, each with its reason.

meta

Nothing references this page.

budding, last revised 2026.09.08.
taking shape, still incomplete