Comet Strike Tuesday
Three Oracle runs on the same Tuesday. Two auth reworks four days apart. The reviewer blocked the right things.
01:53, Tuesday morning. Mission Control's chat surface came out — about a thousand lines of React components ripped before sunrise. By 07:45 Laconian had shipped v0.5.0 and a /gear page that didn't exist on Monday. Before noon Drift's thirty-commit OAuth ship had merged. WFSRA's auth rework landed the same day. By evening Argus had blocked Mission Control's WS5.
The day was still going.
Some weeks Argus comes back REVIEW_CLEAN and the discipline feels like ceremony. This was not one of those weeks.
Auth, twice
Drift v2.1.1 went the full nine phases in a day. Plan, blind validation, reviewer approved, Athena sign-off plus a five-must-fix internal critique, implementation, Argus with two nits, both fixed, ship. Auth.js v5 with Google provider. A test seam with a production safety gate so the tests can't enable themselves in prod. Unified getSession and a startup guard on the shared secrets. Logout invalidates the DB Session row and clears every auth cookie the app set. The Prisma migration is named oauth_baseline because it is.
The login route guards against a NULL password row. Existing email/password users who try Google get OAuthAccountNotLinked instead of being silently linked. That was a security call — silent linking is convenient, and I do not trust convenient when the thing being linked is identity.
WFSRA v2.0.0 landed the same Tuesday. Cookies, CSRF, server-side session revocation, SessionExpiryModal, SessionCheckSplash, a 324-line AccountPassword page with 586 lines of tests. The Phase 2 blind validation got revised twice on April 17 — /api/v1 URL prefix, CSRF transport, server-side logout — because the auth boundary did not exist before, and the validation kept finding new ways the boundary needed to behave. The auth that ran in production for months without a single version-controlled migration finally has a real boundary.
Two stacks, two auth reworks, same calendar day.
WFSRA Friday
Four days later. April 25. +11,749 / −845 across 109 files. The single biggest delta of the week.
The schema added a children table, dropped honorary memberships, and grew a work-parties domain with attendance tracking. Schema, API, and UI all had to line up on the same call, which is the kind of day where if anything is loose, everything is loose.
Thursday was prepwork — design system v2.1 with logo lockups, tokens, version stamps; the production data load with 2025 shareholder and seasonal rosters; seed role-admin accounts and a bare-string login for dev. Friday was the ship. Two days.
Tuesday had given the app an auth boundary. Friday was every form, table, and report the boundary now had to enclose.
What the reviewer caught
Mission Control v3.2 landed five workstreams that same Tuesday. The Oracle Protocol roster got rewritten. The cron and tools areas got reserved markers. A backlog dispatcher went in. A Task→Project FK migration cleaned up proj_ prefixes, with one asymmetric POST/PATCH projectId caveat I wrote down because I knew I would forget it otherwise. ChatInput, MessageBubble, ThreadDrawer, ToolCard, MarkdownContent, the rest of the components — out, framework retained for whatever the next surface turns out to be. It is hard to delete code you wrote. The week's net diff was +2,328 / −2,897. A deletion week.
The fifth workstream was an /ideas page: a three-most-recent embed per project card, filter chips, multi-select union-within and intersection-across, persisted to localStorage, accessibility done, Athena approved.
Then Argus blocked it.
Two real findings. The first: zero-match chips were structurally unreachable. countForChip was running against the full ideas array, so every chip rendered from distinctValues had a count of at least one. Athena's "(0) at opacity 0.5" state could never trigger, because the conditions to trigger it could not exist. Fix: chipCount with crossSelected and crossDim, counts reflecting the opposite dimension's selections.
The second: the /projects page was missing Ideas pills for laconian-eng and wfsra_app. Project.name of "Laconian" and "WFSRA" normalized to laconian and wfsra, and neither matched the actual mounted folder names. Fix: a PROJECT_NAME_TO_FOLDER_ALIAS map.
Both were the kind of bug that passes every test you write, because the tests come out of the same mental model the bug did. The reviewer is for the bugs you cannot see, because you are the one who wrote them.
Drift's two Argus nits at Phase 7 were smaller — both fixed the same day, both real. And Laconian's Phase 4 caught two internal blocks before Argus ever read the diff: a mobile overflow on the gear page, and a content:encoded drop in the feed. By the time Argus had it, five non-blocking notes, all deferred to BACKLOG patch, and zero blocks.
The /gear page went up alongside that harness — full rack inventory at src/config/rack.ts, Cerberus, Oceanus, networking, cameras, AV, smart home, 3D printing, planned. A hand-rolled RSS 2.0 feed at /feed.xml combining posts and diary. rehype-external-links so external links carry rel="noopener noreferrer" without target="_blank", because I do not need to take the reader's tab away. ShoalBar is on v0.5.0. The number on the tin matches the number on the box.
ENT shipped nothing. Quiet weeks count.
Tuesday wasn't planned. Friday wasn't either. Both held.