A product built solo, from design system to five platformsA product built solo, from design system to five platforms

Both sides are generated from one OpenAPI 3.0 document, so a renamed field breaks the build before a customer sees it.

Generator bugs get wrappers. The generated parser turned a present-but-empty query parameter into a silent false, so both route tables mount through a wrapper that strips it first.

A recurring entry is one row: its first occurrence and the template for the rest. The others are projected per request with deterministic ids. Editing “this and all future” starts a new series with recorded lineage. Payment state belongs to one occurrence, so it never copies from the template.

“The 15th and the last business day”, rolling off weekends like payroll, is a preset, and a bill due on the 31st lands on a real date in shorter months.

The product is named for its signature move: telling the app what the bank actually says. An anchor declares that on this date the balance is this number, and the running total restarts there.

Each day is computed from the most recent anchor, so one bad day cannot carry forward. The ledger also reads as confirmed-only: settled money on the date it landed, at the amount that left.

An older wire model had narrowed anchors to 32-bit floats, storing $391.60 as 391.6000061035156. A repair pass found them by exact float32 representation, and the endpoint now rejects sub-cent balances.

CI checks the evidence that tests came first: every test a branch adds must fail against the base branch. A new test that passes against unchanged code either transcribes the implementation or describes behaviour that already worked. Both had shipped here.

A test that does not compile against the base satisfies the check. A dependency bump, which has no failing test, carries a conspicuous commit-message marker. A deliberately failing commit, named red in its message, is welcome as the specification if the branch is green before the pull request opens.

Eight colour schemes, five layouts and three entry treatments, in light and dark, are too many to review by eye. So legibility is a contract: text must clear 4.5:1 against the surface it is actually drawn on.

Measuring text on translucent tinted chips against the bare cell overstated contrast by up to 0.9, hiding six failing role and mode combinations. A test now checks the whole matrix against composited colours. Income and expense must differ in brightness as well as hue, so they survive greyscale and common colour blindness.

A suite that only runs in its author’s timezone proves little about timezone independence, so the date-sensitive suites also run in a zone west of UTC with daylight saving and in the deepest zone without it.

The harness sets the zone at process spawn, which survives date-library caching and matches how a browser sees a fixed zone. It fails if a rename drops a file from the matrix.

The original design had a hard ceiling: state in process memory and a database on a volume that attaches to one machine. Scaling out took a Postgres cutover and moving rate limits, entitlement caching and per-user cooldowns onto Redis behind a narrow interface.

If Redis stops answering, each control degrades to process-local, and a store error never becomes an allow. The cost is written down: when Redis drops, one caller gets a fresh local allowance.

A validation script pins requests to specific instances through the platform proxy, so “counted on one, enforced on the other” is observed from outside.

Data migrations are an append-only registry keyed by name, each claiming its own bookkeeping row in a transaction so a racing deploy loses cleanly.

The ORM re-renders the text date columns on every automigrate, so the damage repeats while a name-keyed repair runs once. Restore a snapshot and you get corrupted dates behind a green deploy. Migrations can now be marked convergent and re-run on every bootstrap. Two of the seven are.

Others refuse to guess: the migration that reduced timestamps to calendar days runs only where the original offset survives, and another lists four data shapes it will not repair as unprovable.

Tauri wraps the SPA for all four platforms in a 58-line Rust shell, kept small so no platform becomes a fork. The release pipeline checks that a production bundle baked in the production API before it publishes.

In a workspace three packages deep, the expensive failures are a library built in the wrong flavour and a route with no component bound to it. A mapped type over the generated route ids makes the second a compile error.

The two repositories hold 179 markdown documents, and the index once rotted to 31 of 59 entries. Each document now opens with a status line: state, verification date and commit. A shell-and-grep check fails the build on a missing header, a disagreeing index row or a dead link.

Specification documents are read from the code and cite file and line for each claim. API and front-end changes cross repositories through a hand-off document stating the decisions made and what not to change.