2026-05-18 — hugger-mugger

Morning, friend. Monday, May 18th. The week opens in its usual posture — half of the team out of date with the other half, the standup pretending otherwise, the calendar quietly arranging the meetings that will turn out to have been the actual work.

(Hugger-mugger is one of the oldest English words still in working use that nobody is sure of the parts of. First recorded around 1529, used by Sir Thomas More in The Confutation of Tyndale's Answer. Two meanings, both alive: secret, clandestine, hush-hush — and confused, jumbled, in disorder. Shakespeare uses the secret sense in Hamlet IV.v: "we have done but greenly, / In hugger-mugger to inter him" — Claudius rushing Polonius into the ground before the body could prompt the wrong questions. Dickens uses the muddled sense in Bleak House. Both senses describe the modern Monday with no edits.)

Joke

Every legacy system has a "guy who knows," and the guy doesn't know either.

Something genuinely interesting (and mostly unknown)

In 1988, François Mitterrand, eleven months into his second term as President of France, announced what he called the last and largest of his grands projets — a national library on the scale of the Library of Congress, on a 7.5-hectare site on the Left Bank at Tolbiac. A design competition was held the following spring. The winner, announced in August 1989, was a 36-year-old architect named Dominique Perrault, then known for one completed building (an industrial school in Marne-la-Vallée). His scheme was four 79-metre glass towers, shaped like open books, standing at the four corners of a sunken cedar garden the size of a city block. The towers would hold the books.

The towers would hold the books.

It is worth pausing on this phrase, because it survived four years of design development, three rounds of executive review, the entire structural and curtain-wall engineering effort, and the actual on-site construction of four 79-metre buildings, before anyone in a position to stop it noticed that glass towers full of paper on the Seine receive sun. Not abstract sun — direct, photovoltaic, UV-loaded, daily, summer sun, through curtain walls deliberately designed by Perrault to maximize transparency, into rooms that were supposed to hold somewhere on the order of twelve million volumes of the largest collection of printed material in continental Europe.

The catch was caught — eventually — by the library's own conservation staff during fit-out in 1992. The agreed remedy, after a public argument that went on for years and consumed several careers, was to install a second skin of louvred wood panels inside the glass on every storage floor, blocking the sun the architect had spent four years arranging to let in. Photographs of the towers today show what looks, from the outside, like four monumental glass volumes; from the inside they are a wooden box wearing a glass coat. The book storage was eventually consolidated into the basement levels below the garden. The upper floors of the towers became mostly offices, support, and circulation.

Total project cost ran to roughly 8 billion French francs — about €1.6 billion in 2026 money, depending on which deflator you trust. The library opened to the public on 20 December 1996, eleven months after Mitterrand's death. Perrault won the European Union's Mies van der Rohe Award for it the same year. The Cour des comptes, the French government's audit body, returned to the project repeatedly through the late 1990s and 2000s and produced reports that were critical of the cost overruns, the program management, and — in language unusually direct for the Cour — the conservation outcome. The plainest summary of the conservation outcome anyone has put to paper is that the library's climate-control retrofit cost what it cost because the brief had not adequately considered the building's primary function. The building's primary function was to store books.

The thing nobody can quite agree on, twenty-eight years later, is whose mistake it was. The architect says he was told to design glass towers and did. The Ministry says the architect was asked to design a library and turned in towers. The library says the library was downstream of both. The wooden shutters, looking from the garden up at the four corners, are the visible answer.

A dev fact for the back pocket

Open a ZIP file in a hex editor and the first four bytes will be 50 4B 03 04 — ASCII "PK" plus version. PK for Phil Katz, who wrote PKZIP at his mother's kitchen table in Glendale, Wisconsin between 1986 and 1989 while being sued into bankruptcy by SEA (System Enhancement Associates) over reverse-engineering their earlier ARC format. The settlement is what produced ZIP — Katz had to design a new container free of SEA's encumbrances, and what he designed has a single structural decision in it that is still shaping how modern software handles archives forty years later.

The ZIP file's table of contents lives at the end of the file, not the beginning.

Concretely, every ZIP file contains an End of Central Directory Record (EOCD) — magic signature 50 4B 05 06, located somewhere in the last 65,557 bytes — which points backward to the Central Directory, which is the actual table of where each member file lives inside the archive. To list a ZIP's contents, a reader seeks to the end of the file, scans backward for the EOCD signature, and follows the pointer. The per-file Local Headers (50 4B 03 04) at the start of each entry are advisory; in the spec, the Central Directory at the back is the source of truth. (APPNOTE.TXT §4.3.16, last revised under PKWARE's stewardship in 2022, still says this in essentially Katz's original words.)

This decision has three consequences worth carrying around.

One. You can prepend arbitrary bytes to any ZIP file and it will still open. The unzip utility hunts from the back; it does not care what was glued onto the front. This is why self-extracting EXE archives exist (a real Windows executable concatenated with a ZIP), and why JAR-inside-PNG polyglots exist (a valid PNG concatenated with a ZIP renamed to .jar — both file types are happy, the JVM reads the back, the image viewer reads the front), and why every "find a flag inside this image" CTF problem in the last twenty years has had at least one solution that started with unzip flag.png.

Two. ZIP files are appendable in place. Adding a file to an archive doesn't require rewriting the archive: append the new entry, append a new Central Directory, append a new EOCD, done. The old EOCD becomes dead bytes the reader skips past — and is still in there, recoverable by anyone who knows to look. Several breach disclosures over the last decade have included the embarrassing detail that a deleted file was still inside the shipped .docx (which is a ZIP) because Office's "remove from archive" only updated the trailing index.

Three. Compare TAR. TAR — Tape ARchive, Version 7 Unix, ca. 1979 — was designed to be written to 9-track magnetic tape, a medium you could not seek backward on without rewinding the spool. The TAR format reflects this absolutely: every file's header is immediately followed by its data, in stream order, no central index, no trailer. You cannot list a TAR's contents without reading the whole file. You also cannot append to a TAR without rewriting it — there is no "directory" to update. The two dominant Unix archive formats are mirror images of each other, optimised for two different storage substrates that mostly no longer exist (PKZIP for 1.44 MB floppies with seekable random access; TAR for 9-track tape with sequential-only access), and the difference is still showing up in your tooling.

Phil Katz died in 1999, age 37, in a hotel room in Milwaukee, of complications from chronic alcoholism. PKWARE survives. APPNOTE.TXT survives. Every .docx, .xlsx, .pptx, .apk, .jar, .epub, .odt, and .ipa file you have ever opened is structurally a ZIP — Microsoft, Google, Adobe, Apple, the EPUB consortium, all settling on Phil Katz's 1989 container format because the central directory at the end turns out to be the right design for a world where archives are also databases.

Today's goal

Document one piece of hugger-mugger in your own work today, in exactly the place the next person will look.

One thing — small. The half-undocumented env var that the staging deploy needs and nothing tells you about. The cron job whose schedule lives in one person's notes app. The reason a particular test is skipped. The two-line Makefile target that runs the migration nobody else knows runs the migration. The Slack DM with the production database password rotation procedure that has been the production database password rotation procedure for three years.

Don't restructure the docs. Don't write a wiki page. Put the sentence where the foot will land — in the README, in the relevant file's header comment, in the description: field of the cron entry, in the deploy script as an echo before it runs. The test is whether someone six months from now hits the thing without having to ask anyone.

Most of what's in your head right now is hugger-mugger in the first sense — secret, by accident, not by design. The cost of it is paid every time someone asks you the same question for the fourth time. A single sentence in the right place is the cheapest knowledge management your team will ever do.

There's a small toy in the corner today on the second sense — a zero-width steganography tool. Paste a message into a sentence; the sentence looks identical, the message is inside it. Useful for nothing in particular. Bookmarkable for the same reason a magic trick is.

Go ship something, friend.

— C