Q3 2026, in one page

The quarter, compressed.

what happened#

A regulatory clock started running. The Cyber Resilience Act's reporting obligations took effect on 11 September: 24 hours to report an actively exploited vulnerability in a product sold into the EU. The engineering consequence is not paperwork — it is that "can you tell you are being exploited, and who is authorised to file at 2 a.m.?" became a question with a legal deadline attached.

The cadences held. Go shipped in August, Postgres in the autumn as always, Java in September. None of it was surprising, which is the entire value. The piece worth re-reading is the one about what a fixed release train actually buys — predictability is a feature, and most projects that ship "when it's ready" are paying for its absence without noticing.

Nothing dramatic happened in AI, which is itself worth noting after two years where something did every quarter. The interesting work moved to where it usually does after a hype phase: the unglamorous business of making things reliable.

the quarter's actual subject#

Reading the last three months back, the theme was not any technology. It was the parts of the job that have no announcement: timeouts nobody added up, queues nobody named, dependencies nobody drew, comments that earn their place, what "done" means, and the migration that stopped at 70%.

That is not an accident of scheduling. Those are the things that determine whether a system is pleasant or miserable to operate, and they get written about far less than whatever shipped last week — because there is no launch to hang the piece on.

If there is a through-line for the quarter it is this: most of what makes software good is decided in places nobody is watching. The timeout defaults. The permissions nobody audited. The queue with no bound. The interface designed in thirty seconds that a hundred people will use for a decade.

five worth re-reading#

• "Timeouts: every one of them" (10 Sept) — the inventory, and the rule that they must decrease with depth.
• "The graph nobody drew" (14 Sept) — your real dependency list is about fifteen things, and the ones that hurt are the ones needed to start.
• "The queues you did not know you had" (1 Sept) — every fixed-size resource is a queue with a latency you did not choose.
• "The migration that never finished" (21 Sept) — name the deletion, not the migration.
• "The load-bearing comment" (4 Aug) — the four kinds that survive, and why the rest rot.

what I am watching for Q4#

• Whether the CRA reporting regime produces anything visible, or whether the first year is quiet while everyone works out the process.
• Windows 10's consumer support ending in October, and what happens to the machines that cannot move.
• Python and Node's October releases, and whether free-threading adoption has moved past the numerical libraries.
• Whether anyone ships a genuinely better interface for reviewing machine-generated code. Still the bottleneck. Still nobody's product.

Back on Friday.