Scene 01 — Index

Work

Six cases with their own pages · four smaller entries

I work where the method only exists on paper — designing the approach, building the hardware and signal chain it needs, and getting it to hold up on real data outside the lab.

Every case below states the condition its numbers were measured under, because a number without its condition is not a result. Where a figure is derived rather than measured, the arithmetic is written next to it. Where something was never measured, this says so.

Cases: Six, each with its own page
Smaller work: Four entries, listed here only
In production: Şeffaf Şehir, Limon Akademi, Vera, LQ
Research: SHIELD (Software Engineering thesis), PlantSense

Scene 02 — The range

Where the six do their work

One of them reaches all the way down to a circuit board. One occupies a single layer and nothing else — a thesis is narrow on purpose. Three sit across the top three layers, and the sixth runs from the signal it computes up to the screen it is read on.

Figure 1 — the range of the work, as I classify it. This is not a measurement and nothing here was counted from a repository: the layers are my own partition of the engineering surface, and each bar is a reading of the facts on that project’s case page. The only derived numbers are on the right — how many of the six reach each layer — and they are counted from the bars themselves rather than written by hand. Drawn deterministically at build time.

One habit, six times

The layer labelled enforced guarantees is the one worth arguing about. Four of the six projects place a rule below the code that would otherwise have to remember it: Row-Level Security instead of a filter every endpoint must not forget, a database trigger instead of a promise that audit rows are append-only, a lock in the query instead of a convention about which worker takes which job.

The other two do the same thing at the other end of the stack. SHIELD moves the guarantee into the detection primitive — a verdict computed from one revolution cannot depend on the vehicle moving, because there is nothing to compare against. PlantSense moves it into the hardware: a measurement that runs on a €10 board is not one you have to book laboratory time for.

The through-line

Put the rule one layer below the code that would otherwise have to remember it.

Scene 03 — Cases

The six, in order

Each entry carries the claim, the measured figure and the conditions, and links to the case that argues it in full. The small figure beside each one is that project’s own instrument, drawn at the same size as the other five.

SHIELD

Spectral Hybrid Interference Elimination LiDAR Defense

Bachelor thesis · 2025—26

Detecting LiDAR spoofing from a single frame, while the vehicle is standing still.

Published spoofing defences compare consecutive frames, so they lose their signal at exactly the moment a wrong perception decision costs the most: when the vehicle is not moving. I made the Short-Time Fourier Transform of one revolution the detection primitive, which needs no previous frame at all. The first result was 97.1% in simulation and 8.2% on real sensor data — and the collapse, not the simulation figure, became the finding.

A systematic review of IEEE Xplore, the ACM Digital Library and arXiv (2017–2025) found no prior time–frequency work in LiDAR security.
Trace-based injection: synthetic attacks placed onto authentic UGV recordings, giving a 3,836-sample hybrid dataset and taking real-world accuracy from 8.2% back to 79.3%.
Final system on authentic captures: 81.6% accuracy, 94.1% precision, 87.3% recall, 3.1% false positives on clean frames.
38.8 ms per frame, inside the 100 ms a 10 Hz LiDAR allows.

STFT
Random Forest
CFAR
Point clouds
Signal processing

81.6% accuracy · 38.8 ms per frameOpen the SHIELD case

One revolution in polar form: angle is the angular index, radius is the measured range. Schematic, generated deterministically at build time; not a capture.

PlantSense

IoT Acoustic Plant Stress Detection

Samsung Innovation Campus · 2024—25

Hearing a plant run out of water, on under €10 of hardware.

A plant short of water pulls harder on the water in its conducting tissue, and now and then one of those columns breaks. The break makes a sound, far above human hearing, and the device counts those clicks. Detecting them is established science — but science that lives in laboratories on instrumentation costing thousands of euros. The measurement was solved; the instrument was not.

Reproduced for under €10: a custom piezo circuit and a signal-conditioning stack on a Raspberry Pi Pico W.
FFT analysis separates the plant signal from ambient noise.
Stressed and healthy plants separated by a decisive margin — 173.5 against 2.5 events per hour.
A 69× margin — arithmetic, 173.5 ÷ 2.5 = 69.4.

FFT
Custom analogue circuit
RP2040
Embedded

173.5 vs. 2.5 events per hourOpen the PlantSense case

A twenty-four minute window, chosen so that the control channel lands on exactly one event: at the measured mean rates that is 2.5 × 0.4 h = 1.0 against 173.5 × 0.4 h = 69.4, drawn as 69 ticks. Where each tick falls is illustrative; how many there are is not. Schematic, generated at build time.

Limon Akademi

Multi-school learning platform

Client work · in production

142 endpoints, and not one of them is asked to keep the schools apart.

School administration, course content and student project submission in one application, with four roles that each see a different system. This is client work, so what is on the case page is scale and architecture — no internal business logic, no screenshots, no school data. The decision worth reading is where tenant isolation lives: one layer below every endpoint that would otherwise have to remember it.

Every request runs inside a single transaction with the school’s context set, under RLS policies — with no context set, no rows are visible at all.
The super-admin surface runs under a separate database role.
Four roles: super admin (whole platform), school principal (their school), teacher (assigned courses), student (their own enrolment).
Argon2id with TOTP MFA, opaque token sessions with refresh rotation, and dependency-free HTML and image sanitisers.
28 tables, 142 REST endpoints and roughly 420 automated tests across four layers.

NestJS
Kysely
PostgreSQL 18
RLS
pgTAP
Caddy

142 endpoints · 28 tables · ~420 testsOpen the Limon Akademi case

Same query, same role, two transactions. The row count on the left is illustrative — the point is the pair, not the number. Schematic of the mechanism, not measured output.

Vera

AudGraph — audiology management and clinical decision support

Freelance under VeraHQ · 10/2025—

Two databases, because a clinic holds two different shapes of data.

An end-to-end clinical management and decision-support platform for hearing-aid centres. Patient identity is relational and rigid. Clinical reasoning is not relational at all — it is a network of patients, visits, diagnoses, diseases and devices. Rather than compress both shapes into one database, each got the store that suits it.

PostgreSQL carries relational data and patient identity; Neo4j carries clinical relationships, diagnosis history and similar-patient algorithms.
An interactive clinical network map, with weighted graph traversal for differential diagnosis and automatic indexing on the Patient, Disease and Device nodes.
Patient data encrypted with AES-256-GCM.
A hash-chained, append-only audit log enforced by a database trigger, so the application layer cannot bypass it.
KVKK and ISO 27001 compliant, 40+ centres across Turkey, full Turkish/English i18n at one click.
Mobile QR stock intake streamed to the desktop over server-sent events; a post-deploy smoke test with automatic rollback on failure.

React 19
Node.js
PostgreSQL
Neo4j
Cypher
SSE

PostgreSQL + Neo4j · hash-chained audit logOpen the Vera case

A synthetic audiogram in the standard clinical form. No patient data, no capture and no customer: thresholds are invented for the drawing.

Şeffaf Şehir

Multi-tenant citizen reporting platform

Production · sold to municipalities · 2025—26

A privacy rule the compiler enforces, not the code review.

A citizen reports a problem with a photo and a location; it lands with the responsible institution; the institution answers with photographic evidence; and the citizen has the last word within six hours. The rule the whole design turns on is that the reporter’s identity appears in the institution’s panel and nowhere else — and a rule that lives in a comment survives only until someone forgets it.

Citizen-facing and institution-facing queries live in repository classes that cannot reach each other at compile time.
The privacy rule is held by an end-to-end regression test, not by review.
Tenant isolation runs on PostgreSQL Row-Level Security, with the connection pinned per request through AsyncLocalStorage.
National ID number and phone are never asked for. No super-users and no reputation score — both deliberate.
93 endpoints, 18 tables, 35 migrations, and 76 test cases running against a real PostGIS instance in CI.

NestJS
PostgreSQL RLS
PostGIS
Next.js
Multi-tenant

93 endpoints · 76 tests against real PostGISOpen the Şeffaf Şehir case

Who sees which field. Three of the four rows are the same for everyone; the fourth is the entire privacy design. Schematic of the rule, not a screen.

LQ

Learning Quotient — cognitive telemetry platform

By Vera · Flutter, NestJS, Next.js

No message broker. PostgreSQL is the queue.

A platform that measures cognitive performance through neuroscience-grounded games, analyses it, and coaches with a language model. The server has no GPU. Instead of adding a message broker to bridge that gap, the work leans on the atomic locking semantics of the database that was already there — fewer moving parts, and less to keep running.

One ai_jobs table carries the whole lifecycle: pending → processing → done or failed, with a partial index on (created_at ASC) WHERE status = ‘pending’.
Claiming a job is atomic through FOR UPDATE SKIP LOCKED, so two workers never take the same row.
A local Python worker polls over HTTP and runs Qwen through Ollama.
Grid Memory measures spatial clustering score, TCS, IRT, accuracy, chunking efficiency and cognitive load.
Grounded in the Corsi Block Test — in clinical use since 1972 — and the N-back paradigm, turned into an adaptive game.
JSONB in game_sessions is deliberate: roundDetails, adaptiveState and cognitiveMetrics change shape without a schema migration.

Flutter
Flame
NestJS
PostgreSQL
MongoDB
pgvector

12+ cognitive metrics · one table, FOR UPDATE SKIP LOCKEDOpen the LQ case

The Corsi paradigm on a four by four board. The sequence shown is a fixed example, not a recorded session — this is a product used by children and no session data appears here.

Scene 04 — Cross-cut

Read the six by what they refuse to allow

Six different domains, one recurring move. In each case there is something that must never be allowed to happen, and in each case the prohibition lives somewhere that cannot be forgotten by the next person to touch the code.

Each case, the thing it must never allow, and the layer where that prohibition is enforced
Case	What must never happen	Where it is enforced
SHIELD	A verdict must not depend on the vehicle moving	In the detection primitive — the STFT of a single revolution
PlantSense	A measurement must not need a laboratory	In the hardware — a custom piezo circuit under €10
Şeffaf Şehir	A neighbour must never see who reported	In the type system and in RLS, held open by an end-to-end test
Limon Akademi	One school must never read another school’s rows	In the database — RLS inside a single per-request transaction
Vera	An audit entry must not be altered after the fact	In a database trigger — hash-chained and append-only
LQ	Two workers must never take the same job	In the query — FOR UPDATE SKIP LOCKED

Scene 05 — Smaller work

Four that do not get a page

These are competition entries and small apps. They are here because they are real and because leaving them out would misrepresent how the six above were learned — not because there is a case to argue in any of them. Each is a card and nothing more.

MindCare AI

no case page

An AI therapy assistant, taken to the Regional Stage of the Huawei ICT Competition.

AI assistant
Huawei ICT

AfetLink

no case page

An emergency protocol built on Named Data Networking, with a fixed five-byte message format — small enough to survive a network that is mostly gone.

NDN
Protocol design

Livora

no case page

A Flutter vocabulary app built around spaced repetition.

Flutter
Spaced repetition

Not Arkadaşım

no case page

A Flutter app for students to share their course notes with each other.

Flutter
Student tools

Scene 06 — Close

The four numbers I would defend first

81.6%

SHIELD accuracy on real sensor captures

38.8ms

per frame — inside a 10 Hz LiDAR budget

69×

event-rate margin, stressed vs. healthy plant

300+

students taught across 20+ workshops

The 69× margin is derived, not measured: arithmetic on the two measured rates, 173.5 ÷ 2.5 = 69.4. The other three are reported as measured.

I work on measurement, and on what depends on it.Ali Batuhan Özsürmeli

If you are hiring, the case pages are the argument and the numbers on them carry their conditions. If you are looking for someone to build the thing, four of the six above are in production and one of them was sold. Either way the next page to open is the one whose problem looks most like yours.

two pages

Available immediately

Hatay, Turkeyinfo@mroz.tr