14 releases in 20 days.

• Migrated app hosting from Render Pro to Vercel free tier — $49/mo savings
• Hashed competition judgePin with bcrypt — eliminated plaintext PIN storage
• Added TypeScript module augmentation for next-auth — removed unsafe type casts
• Split auth into auth.config.ts (Edge-safe) and auth.ts (Node.js)
• Marketing site moved to GitHub Pages, separate from app

12 files changed · +180 / −95

• Separated static marketing site into its own marketing/ directory
• Independent deployment from the app
• Added package.json for Render static site config

• Full marketing landing page: hero, pain points, judge section, feature comparison, CTA
• Dark mode with system preference detection
• Mobile responsive across all sections
• Middleware updated to allow unauthenticated access to /

8 files changed · +1,850 / −25

• Added /roadmap with health scorecard, phased roadmap, risk register, velocity
• Added /changelog with release cards, change-type distribution, expandable details
• Added /status with live API health checks
• Added /analytics with product metrics
• MetaPageNav shared component; MermaidDiagram for client-side rendering

12 files changed · +2,400 / −50

• Rewrote /tech into 11-section build teardown
• Cost comparison (US dev shop vs offshore vs AI-assisted)
• AI development workflow section with delegation split documented
• Mermaid architecture flowchart + 3 ERD diagrams
• CollapsibleSection component using native HTML details/summary

7 files changed · +2,190 / −324

• Split monolithic competition/actions/index.ts (1,200+ lines) into 6 focused files
• Security hardening on server-action auth patterns
• Performance improvements on Prisma queries with selective includes
• Fixed edge cases discovered during code review

37 files changed · +1,785 / −1,728

• E2E competition simulation — 2,000+ assertions: seed → distribute → score 4 cats → tabulate → validate
• Simulation generates markdown report at reports/simulation-report.md
• Restructured docs into Diataxis framework (15 docs): tutorials, how-to, reference, explanation
• Fixed 3 DQ edge-case bugs that unit tests missed

85 files changed · +3,533 / −148

• WCAG pass — ARIA labels, keyboard navigation, focus management
• OWASP security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
• Sliding-window rate limiter (5 attempts / 15 min) on both login providers
• Failed login attempts logged with timestamp
• Test count: ~40 → 113 across 25 suites (+3 new edge-case suites)

47 files changed · +1,657 / −258

• Latin square box distribution generator — no repeat competitor at same table across categories
• Distribution approval workflow with cascading delete guard
• Category submission dialog for table captains
• Server-side gates for competition state transitions
• 188 unit tests for the distribution generator alone

17 files changed · +1,006 / −100

• Created auth-guards.ts: requireAuth(), requireOrganizer(), requireJudge(), requireCaptain()
• Retrofitted all 62 server actions with auth guards
• Derived all user IDs from session — eliminated IDOR
• Captain actions verify table.captainId === userId
• Wrapped multi-step mutations in prisma.$transaction

15 files changed · +172 / −173

The big one — full app in one session.

• Prisma schema (12 models)
• 5 feature modules with full structure (competition, judging, scoring, tabulation, users)
• NextAuth.js v5 with JWT strategy and 3 Credentials providers
• Dashboard shell with role-based sidebar navigation
• KCBS scoring constants and engine
• Judge flow (4-phase setup: not-registered → awaiting-table → pick-seat → ready)
• Scoring components (ScorePicker, ScoreCard, SubmissionQueue)
• Captain dashboard (TableStatusBoard, ScoreReviewTable, CorrectionRequestPanel)
• Tabulation engine (weighted scoring, drop-lowest, KCBS tiebreaking)
• Results page (4-tab layout with 15s polling)
• Design system: 11 common components + 10 UI primitives

130 files changed · +14,396 / −1,605 — later flagged in retrospective as "don't build the whole app in one commit."

• Next.js 14.2 with TypeScript strict mode and App Router
• Tailwind CSS v3 with custom deep red theme (#C0392B)
• Path aliases: @/*, @features/*, @shared/*
• shadcn/ui configured for new-york style
• Initial CLAUDE.md with project constraints