Issue 01 / November 2026

Field notes.

01 / A round trip is not a page load

A network round trip describes one exchange. Opening a new HTTPS connection also involves name resolution, transport setup, TLS negotiation and server processing. Comparing a ping result with a complete request therefore compares different quantities.

Record the method next to the number: cold or reused connection, resolved hostname or fixed address, response size and timing boundary. A median describes the middle of a sample; the slow tail describes a different part of the experience. Both matter.

A useful first comparison keeps the application and endpoint fixed while changing only the path. Repeat the original condition after the alternative to distinguish an improvement from a temporary change in load.

02 / The cost of starting over

A reused connection can avoid work that a fresh connection must repeat. This is why the second request often feels faster. It is not evidence that the network suddenly became geographically shorter.

Connection pooling introduces its own questions: how long is an idle connection retained, what happens when the remote end closes it, and do several independent clients accidentally share a bottleneck? Count successful reuse rather than assuming that a keepalive directive guarantees it.

When investigating failure, separate connection establishment from transfer. A successful handshake does not prove that an upload completes. Test a small request, a download and an upload before calling a path healthy.

03 / Keep the evidence small

A helpful operational record contains the question, the scope of the change, the original state and a reproducible check. It should explain how to return to the original state without relying on the person who made the change being available.

Preserve failures as well as successes. A later successful run does not erase an earlier timeout; it changes the question from permanent failure to intermittent behavior. Label the network and the time of each observation.

Logs should contain enough context to connect events, but not secrets. Credentials, private configuration links and personal identifiers rarely belong in an incident summary. Keep sensitive raw evidence separate from the public explanation.