Build Log

Event Sign-Up Capacity Guard, and Whether the Observer Generalizes Beyond Research

August 24, 2026

A real, previously-undiscovered MedinaCHF race condition — any family could over-claim past an event sign-up sheet's capacity, or two families could both win the last spot — fixed with a Postgres advisory lock, verified by first catching the test suite's own false confidence, then tested against a second Experiment 0 Observer run using 3 sparse checkpoints instead of 9, at roughly 45x less token cost.

MedinaCHFBug FixTestingResearchExperiment 0Autonomous Build

real production race condition fixed

new armory tests, 35/35 total pass

observer calls (vs. 9 the prior run)

45x

observer token cost reduction

Timeline

Start

Charge received: find real product work outside the research surface

Explicit instruction not to manufacture a task or pick one likely to make the observer look useful

~30m

Scoped candidates, selected event sign-up capacity gap

Named directly in tests/e2e/armory/README.md's own 'Still not built' section — a live, unblocked, real feature gap

~1h

Found the real architectural constraint: no db.transaction() on this driver

drizzle-orm's neon-http throws unconditionally — ruled out the obvious fix approach before writing any code

~1.5h

Observation 1 (COMMITMENT) — CHALLENGE, accepted

Planned single-statement capacity check was never verified race-safe; confirmed a real TOCTOU race, found the correct db.batch()+advisory-lock fix

~2.5h

First 7-test spec written and passing — then found it proved nothing

Independently applied this codebase's own falsification standard (revert the fix, confirm the spec fails) and found the whole suite passed unchanged against broken code

~3h

Observation 2 (IMPLEMENTATION) — CONTINUE

Disclosed the self-found gap in full; nothing new for the observer to add on top of an already-specific self-report

~3.5h

Added a dev-only test hook, closed the gap for real

Falsification proof re-run: genuinely failed against reverted code, genuinely passed against the fix

~4h

Full 35-test regression suite, typecheck, real production build — all clean

No regression from touching a shared action file and a shared UI component

~4.5h

Observation 3 (COMPLETION) — CHALLENGE, partially accepted

No manual browser check had been run (accepted, closed, found a real minor UI staleness bug); concurrency test's real-function fidelity gap (rejected as a further action, reasoned cost/benefit call)

End

Morning report published, session closed

Verdict B — generalization signal, one clean non-research catch, evidence remains preliminary

What shipped

Found and fixed a real, previously-undiscovered production bug: MedinaCHF's event sign-up sheet ("What We Need") had zero server-side enforcement of item quantity caps — any authenticated member could over-claim past what a planner needed, or two families racing for the last spot could both win

Diagnosed and worked around a real architectural constraint before writing any fix code: drizzle-orm's neon-http driver throws unconditionally on db.transaction(), ruling out the obvious transactional-guard approach

Fixed using db.batch() (verified to be a genuine atomic multi-statement Postgres transaction on this specific driver) running pg_advisory_xact_lock as one statement and a capacity-guarded INSERT/UPDATE as a second statement in the same batch

Wrote an 8-test armory spec (tests/e2e/armory/member-event-signup.spec.ts) covering fixture creation via the real UI, a real cross-family claim, a real over-capacity rejection through the actual production function, and a genuine concurrent-race proof against the fix's own SQL mechanism

Caught, independently, that the first version of the concurrency test passed unchanged against completely reverted/broken code — it never called the real claimSignupItem function, only a hand-rolled SQL mirror of the same logic — before this was ever reported as done

Added a dev-only, NODE_ENV-gated window.__TEST_claimSignupItem hook (dead-code-eliminated from production builds, confirmed via a real production build) to close that gap by exposing the real function to Playwright

Ran the codebase's own documented falsification standard twice (revert the fix, confirm the spec fails, restore the fix) — the second run genuinely succeeded where the first had silently proven nothing

Confirmed zero regressions: full 35-test armory suite, tsc --noEmit, and a real production next build all pass clean

Ran the second live Experiment 0 Observer feasibility test: 3 sparse, hand-scoped observation checkpoints instead of the prior run's 9 whole-session-accumulation checkpoints, at roughly 45x lower total token cost

Published a full morning report (artifact) covering the product fix, all 3 observer checkpoints with real per-invocation data, and the experimental verdict