Jason — 做了什么— build log— 制作ログ

PJ62 is a multi-persona paper-trading experiment — no broker, no real orders. Several AI personas (trend-following, contrarian, conservative, Japan market, China market, leveraged FX, high-activity, and a purely mechanical rules-based one) share one pool of virtual money, each making hypothetical decisions by its own rules every day, so that over time I can compare which style wins in which market conditions.

This week I grew the personas from 3 to 8, added hard rules (a no-trade day must state a concrete reason), required every entry and exit to carry a percentage, and attached the parameter ranges institutions commonly use as a reference. I also wrote a v0.1 draft of "my trading system" that I'll revise monthly against the actual results.

A Windows scheduled task runs it four times a day — Tokyo close, China close, the active FX window, and early the next morning — and emails out all 8 personas' moves and balances. It all runs on my local Claude Code subscription, and the prompts are written to be model-agnostic so another AI CLI could run it too.

I often lose hours to short videos and then beat myself up about it. PJ55 is a personal tool against that; it started as a daily "implementation intention" check-in. This week I added a "mental nutrition" library: a few 300–600 word pieces — Lincoln going from a string of failures to signing the Emancipation Proclamation; Tadao Ando, a boxer who never went to university, winning the Pritzker Prize; Haruki Murakami deciding at 29, in the bleachers at a baseball game, to start writing novels. Plus two original film notes on Japanese movies like Hula Girls and The Chef of South Polar — ordinary people keeping at something nobody bet on, one day at a time.

Each piece has a read-aloud button using the browser's built-in speech, so I can listen to them like an audiobook. The content lives in a JSON file, so adding or removing pieces is easy.

My personal site maysuns.uk was briefly misread as "verification failed" in Google Search Console — it turned out I'd been checking it while signed in to a different Google account that was logged in at the same time. Once that was sorted, I added DNS verification and a 27-URL sitemap and did a round of SEO / AI-search optimization.

I turned it into a rule: when checking a Google service that supports multiple accounts from a browser, don't conclude "no permission" too fast — first confirm which account you're actually looking at.

Every report must state three things: what was done, what was not tested, and what condition would make a placeholder real. For example: "the signed-in view is untested because I do not have the account", or "mobile is untested; only desktop width was checked".

Benefit: next time, "looks like it works" is never mistaken for "verified".

I write questions into a req file; the AI appends answers to a reply file; we refer to each other by line number. Benefits: (1) the original wording is kept verbatim and still makes sense after clearing; (2) every question is numbered and mapped, so none is skipped; (3) long answers stay out of the chat and I can reply by line number.

Cost: I have to save files myself, and answers are append-only.

When publishing the Japanese short-video learning site to GitHub: included the pages, subtitle/translation data, sitemap, README and an MIT license.

Excluded: video files (about 780 MB, over the per-file limit and each with its own license), the analytics script (so forks do not send data to my stats site), and internal pages with production details.

Before publishing I searched for secrets, passwords, server addresses and local paths: none. The README states honestly that the English and Japanese subtitles are translations of translations, not checked by native speakers.

Hiding content with CSS/JS only is fake protection; view-source reveals it.

The right way: put the content in a separate file; nginx first asks the sign-in service who the visitor is, and sends the file only if signed in, otherwise 401.

Honest limit: if a demo must run in the browser, its code necessarily reaches the browser; what you can gate is the full source, copy and download.

Symptom: most left-menu items did nothing.

Cause: the server injects a script into every site by replacing </body> with "script + </body>"; the page's own script also contained a literal </body> in a string, which got replaced too and broke the script's syntax.

Fix: never write a literal </body> inside site scripts (split it as '<'+'/body>'). Lesson: a site-wide injection mechanism affects strings in every page.

The "inspiration" section was just a list of text links. An automated browser now opens 58 design sites and captures the first screen as a thumbnail. 51 worked; 6 failed (timeouts, bot checks, blank captures) and stay as text cards.

Note: screenshot copyright belongs to each site and is used only as a reference thumbnail; the first screen is not always a site's most distinctive part.

Found: one project's frontend build embedded an OpenRouter key from .env into the live JavaScript, searchable by anyone viewing the source.

Fix: removed the "use .env when no key is entered" fallback, rebuilt, searched production for the same value (0 hits), revoked and replaced the key, and scanned every web file on the server for other leaks (none found).

Standing rule: after every frontend build, grep dist/ for the real values from .env; the result must be 0. (This post contains no key.)

Our shared sign-in (auth.maysuns.uk) used to redirect the whole page; after signing in, the original page was gone.

It is now a small 460×640 pop-up with a Cancel button; on success it closes itself and the original page recognizes the user.

It took many wrong attempts, each noted and fixed. I wrote it up as a short story, "The Little Login Window".

The motion gallery (html.maysuns.uk) holds 30 pure CSS/SVG animations: loaders, buttons, card flips, text effects, sky/rain/waves/snow and more. Each has a "how it moves" note, with category filter, search, speed control and pause.

Source, copy and download live on the server and are only sent after sign-in, to keep the page clean.

Honest note: demos run in the browser, so anyone technical can still inspect the styles; this is about tidiness, not copy protection.

The web design library separates themes (colors), backgrounds and page templates so any combination works. It now has 29 themes, 35 SVG backgrounds, 4 animated backgrounds (sky, rain, sea, snow) and 22 multi-column page templates.

Every color goes through design tokens, so switching a theme restyles the whole page; text contrast is checked automatically.

Not done yet: splitting the home page into separate pages, and photo-based animated backgrounds.

I'd wanted to learn git for a long time and kept failing at it. This time I had the AI use a dozen uncommitted files in a real project of mine as the exercise, and write a hands-on guide with concrete commands, a "what you should see" note for each step, and a "what to do if it goes wrong" table. I followed it through and made my first clean commit on my own — only the files for that project, without mixing in changes from other projects.

The takeaway: it wasn't that I couldn't learn it, it was that I lacked material that said "just do it once, following this specific example."