Build log

M18: the site became an Agent Control Room

The home page was rebuilt to show how agents build and run this site: a run-console hero fed by the live Build Log, Cmd+K navigation, SVG architecture maps, an incidents board, and a single voice-waveform demo. The view switch shipped earlier the same day was removed after it added noise rather than clarity. Previewed, independently reviewed, then promoted on owner approval.

A phantom JS-budget breach: the measurement counted a legacy polyfill

Midway through the view-switch milestone the first-load JS check reported the home page well over its 150KB budget. Rebuilding the untouched baseline showed the same number, so the regression was in the measurement, not the code.

What broke

The budget script excluded legacy scripts by filename instead of by the nomodule attribute, so the core-js polyfill chunk (never loaded by modern browsers) was counted as first-load JS. The same mismeasure resurfaced later as a stale over-budget figure in planning notes.

How it was caught

Stash, rebuild the baseline, and measure with the same method: the pre-change build was already "over budget". Later, an implementer independently reproduced the reviewer's method and got the real, in-budget figure.

The fix

Exclude script tags carrying nomodule, re-measure, and correct the record. The real cost of the milestone was about 2KB.

Lesson

Before chasing a regression, measure the baseline with the exact same method. Filter by what the browser actually does (attributes), not by filenames.

Plan review caught a hydration bug in the "hide unfilled" design

The first plan for hiding unfilled placeholders in production stripped marker text out of the built JS after the build. Independent plan review showed it would make server and client render different text, so the approach was replaced before any code was written.

What broke

A postbuild regex strip on emitted chunks: a mixed field such as a timeline with a pending-dates marker would be dropped on the server but survive on the client as a trailing fragment, causing a hydration mismatch. Regex surgery on minified chunks was also brittle and gave the build gate false confidence.

How it was caught

Independent plan review, before implementation started.

The fix

Compile-time pruning: every marker literal sits behind an env-inlined SHOW_PLACEHOLDERS ternary, so dead-code elimination removes it from every chunk. Mixed fields were split in the data model, and the build gate over the whole output folder became a true independent check.

Lesson

Don't post-process build output to hide content. Make it unreachable at compile time, and keep the gate independent of the mechanism it checks.

Closed onboarding text-test slot with known limits

For a late test-report edge case we closed the onboarding text-test slot for the rest of that setup session and accepted three known limits instead of reopening already-accepted wiring.

Heavy tests moved off the Mac onto a remote box

Lumora and Teamora heavy tests and builds now run on a dedicated remote box so the Mac stays usable.

CoS caught a skipped post-cap plan before final review

After four review rejects, the coordinator nearly armed a final review without the required plan pass. Status watch and CoS audit stopped it.

What broke

coordinator almost jumped to a final review without the required post-cap plan

How it was caught

status watch + CoS audit against the review-cap rule; Subhav confirmed plan-first

The fix

cancelled the early final review; ran plan then check before build and one final review

Lesson

after a review cap, never arm the final review until the plan step is done and checked

M8 — confirmed contact values live; first deploy to Cloudflare Pages

Filled only the owner-confirmed contact values ([email protected], WhatsApp, LinkedIn, Cal.com) — every other marker stays literal — then shipped the static export to the subhav-tech Pages project via direct upload.

M7 — flipped the site from sales landing to portfolio-first

Owner feedback — "not a portfolio site, rather a selling one" — repositioned the home page to hero → work → lab → writing → about → testimonials → a quiet work-with-me close. The pricing teaser, currency toggle and demo console left home; the nav is now Work/Lab/Writing/About/Contact.

wrangler OAuth login failed its CSRF check when run headless

Provisioning the Cloudflare deploy path stalled on `wrangler login`: the browser round-trip never validated when driven non-interactively, so no API token was issued.

What broke

Agent-driven `wrangler login` — the localhost OAuth callback failed its state/CSRF check and the flow died before a token was stored.

How it was caught

M8 deploy prep: `wrangler whoami` still reported logged-out after the attempt.

The fix

Subhav ran the interactive login once himself; the OAuth token it produced is reused by every wrangler call since.

Lesson

Browser-callback OAuth can't be scripted — run it once by hand, then let agents reuse the credential.

Codex hit its usage cap mid-review — twice

Two independent code-review rounds stalled when the Codex instance exhausted its usage cap partway through. The milestone pipeline now names a fallback reviewer per round instead of discovering the gap mid-audit.

What broke

The M2 re-review lost its Codex instance mid-cycle and the M3 re-review lost a second one before the final pass — findings just stopped arriving.

How it was caught

The orchestrator's retry surfaced the exhausted quota; review state showed the rounds incomplete.

The fix

Each stalled round was re-delegated — a second Codex instance closed out M2/M3, and Gemini ran the M6 final re-review. Every round now carries a named fallback model.

Lesson

A review pipeline pinned to one provider's quota is a queue with a hidden failure mode. Name the fallback reviewer up front.

AskSubhav's regex matcher kept bypassing its own guardrails

The deterministic question matcher for the Ask Subhav sheet failed five review rounds: it admitted off-scope questions (a biography regex answered "Who is Subhav's banker?"), skipped the locked unknown-answer fallback, and then over-corrected into rejecting supported feature questions.

What broke

First-match regex routing returned grounded-looking answers to questions the knowledge file never covered — pricing asks skipped the mandatory "I don't know that. Want to ask Subhav on a call?" + booking flow, and generic who-is patterns produced the biography.

How it was caught

Independent reviewer probes (M5-01, M5-RR-01). Every fix round surfaced a new bypass the regex ordering had missed.

The fix

Four ordered-tier rewrites still leaked edge cases, so Subhav made the call to delete the matcher: the sheet is now tap-only — fixed suggested-question chips that map to reviewed, static answers.

Lesson

Deterministic routers fail open — every new regex widens what gets admitted. For a public-facing agent, fewer input paths beats cleverer matching.