Build to Think: An Autumn Audit
The year-to-date audit, through the lens of Build to Think — the nineteenth edition since March, regenerated with /audit on Fable and Opus 5, this one 2026-10-27. One ink, one accent, short on purpose.
On the morning of October 19 a commit landed in the golf record that nobody typed. A nightly job had logged into the watch and the scorecard app, pulled a new round, rebuilt the record, passed its gates, and pushed; the host built it. Twelve of the thirteen scheduled runs since have been green, and the one failure opened its own issue and closed it on recovery. That is the window in miniature: 1,268 commits this year, twenty-one products anyone can open in a browser, no servers to babysit — and, for the first time, one commit the builder wasn’t there for.
He has been on paternity leave since August 26, and the chart below marks it. Before that date the portfolio’s two peaks were 5am and 9pm. Since it there has been no commit at 5am and one at 9pm, and two-thirds of everything landed between seven and eleven in the morning. The output per active day didn’t change. The days did — nineteen of sixty-three — and so did what got built on them: a tracker for one body, a coach for one kitchen, a record for one golfer, and a golf course you can own.
Lesson 1 — Projects die between sessions, not during them
Nothing here died of a hard problem. Things died of the cold start — sitting back down and not knowing where you left off. Every project that matured left itself a note; every one that stalled, stalled in the gap. The evidence is uncomfortably literal: one version’s final commit reads fix: resolve 27+ TypeScript build errors; another died finished, on branches nobody pushed.
This round adds a case the rule didn’t cover: the note was true and it didn’t help. On September 16 the war-game engine ended a session with two commits — a hotspot fix on main, a combat redesign on a branch with no upstream — and the stop hook wrote exactly that into the note: “0 file(s) dirty, 2 commit(s) unpushed.” Six weeks later the line is still there, still correct, and the live site is two versions behind the laptop. The generated status block atop that note was the fix this audit asked for in September. It writes the truth every session. It does not make anyone read it. The habit tracker’s July privacy fix is now 89 days uncommitted. And the site that publishes these audits generated its public project board on September 6 and never committed it — the board’s own address was a 404 when this edition was drafted, 51 days after it was built.
The counter-exhibit is the same shape pointed the other way. Six days after the last edition proposed a post-commit hook that pushes, the golf record had one; a month later it had a cron that captures, refreshes, gates, commits and deploys with nobody present, because “‘fresh’ has always meant ‘pushed’; this closes the only gap, the five hand steps between a round and a push.” The project whose note lied two editions running now has a record that cannot fall behind its author, because the author is no longer in the path. The newest repo went the other direction and also won: a hand-written entry for every session, with the schema version, the test counts, and the one line no other note has — “Someone else added … between commits; kept as-is.” The someone else was a parallel session of the same person. The note recorded a second author before the project had one.
The living log · how a project survives the gap
The transfer: give every project one living file — decisions with reasons, what’s next, what changed your mind — and let the machine write the part that’s a fact every time you stop. Then put the fact where a second pair of eyes lands. A status line nobody reads is a diary; a team’s board is only a board if it’s on the wall, and the cheapest wall is the thing that fires on its own.
Lesson 2 — Everything you build wants to become a game
Look at where each exploration ended up: an atlas of San Francisco became a drivable city. A launch-planning idea became a deckbuilder. Golf-course data became a sim you can lose at; a friend’s life became an RPG; even the habit tracker is a rat you keep alive. The AI underneath is indifferent. The pull toward play comes from the person: a general capability has no handles, and giving it rules, feedback and stakes is how a mind gets a grip on it.
This round the golf course became the game. The sim where you play a hole grew a sim where you own one: twenty golfers from three archetypes, patience that drains while they wait at the tee gate, a decision model that lays up or goes for it by risk appetite, and a done-when in the plan’s first paragraph — “a Hacker rinses three balls in the pond, quits, and the refund lands in the ledger.” It reached MUNI’s title screen as a side door, built by a cloud agent in twenty-one minutes of commits on a Saturday morning. The design notes are the honest part: “‘Guess’ means nobody has played it yet,” and nearly every line ends in Guess. The one that matters — “With the table verbatim a Hacker cannot reach zero on one hole” — says the spec’s own numbers could not produce the spec’s own ending. Water had to escalate before anyone could quit. The design doc described a game that, built, was unplayable in exactly the way the doc said it should be played.
The engine kept drifting toward instrument, as predicted: its new combat gives every exchange a stance and reports the result the way it always has — “~20 distinct winners (was 14), direct-kill share 0.24 → 0.53.” And the refusals are still the telling part. The new physical-therapy tracker is the most gamifiable thing in the set — sets, reps, a five-times-a-day counter — and declines in writing: “Prescriptions are transcribed from the handouts and never edited by the app.” Unknown set counts are not specified, not guessed. The golf record’s list of a hundred public courses refused to become a leaderboard and became nine weekends instead, each “an opinion, not a claim — no check applies.”
The transfer: when an idea isn’t landing — a pricing model, a roadmap — build a toy version people can lose at. Losing teaches faster than reading. Then label every number a guess until someone has lost to it: a tuning table with its reasons attached is a design review you can hold later, and one without them is a fight about taste.
Lesson 3 — Build the memory first, then chisel the product out of the rest
Building to think works like sculpture: early versions pile up material — code, dead ends, notes — and the product is what’s left after you cut the rest away. The cutting is only safe if the design lives somewhere outside the code. That’s why the memory comes first.
The Dopamine Rat proves it. Built four times; dependencies per version ran 2 → 7 → 10 → 3. The version that shipped is the smallest, and the only one that started from a written record of what the first three got wrong. Doppler applied the rule on day one instead of attempt four: two dependencies, no backend, and 264 CI data invariants. If a number can be derived, derive it; anything hand-set is labeled as opinion.
This round’s subtractions are editorial, and they are all about saying a thing once. The cooking coach cut its navigation to five tabs in four commits over sixteen minutes, and in the second of them “64 bespoke food-safety bullets become six shared rules”; the commit titles are the method — “say each rule once.” Its new fridge section was built as “the teach-only answer: no fridge inventory, no new state”: a feature that declined to add a table. The golf record replaced a progress grid with a verdict per row, and its plan page prices the record against sourced benchmarks instead of its own simulator — “next-round targets, never range data.” The course manager copied its random-number generator rather than importing it, so the two games can tune their randomness apart, and shipped “what makes its ‘done when’ true and nothing that only pays off later.” The film archive was the wholesale version: the March scaffold with zero photographs deleted and rebuilt in twenty-one minutes from a research brief — then stopped at the first account it had to create. The one cut that hasn’t happened: the engine, at fifty thousand lines, still has no decision log, seven weeks after its own note said to seed one.
One repo, three homes · the July extraction
Maturity as separation of concerns you can survive: give each exploration its own address, and keep — don't destroy — what it grew out of.
The transfer: when a rule appears twice, that’s the design asking to be written down once and referenced. The cheapest refactor in a team’s codebase is usually a document, and the second cheapest is deleting the copy that drifted.
Lesson 4 — AI compressed implementation. It did not compress judgment
The cold start is how projects die; whether the thing deserved to exist is why you never come back. bass is the year’s honest failure: ten commits of supply for a demand that never existed — one practice ever logged. The code was fine. The decision was wrong, and every added feature compounded it. Rat v3 made the same mistake with more ceremony — Garmin OAuth before daily use was proven — and died finished.
This round’s evidence is about what a machine is allowed to decide when nobody is watching, because for the first time something ran unattended. The nightly capture keeps the line the record drew in August — the refresh “will NEVER … confirm a round link” — and then records the one exception and why: “The link was confirmed by the three-way rule, the first the machine made.” A link confirmed by a rule anyone can rerun is a different act from a link guessed. After five runs the decision log named the one hand step that remains, and the cron does not try to do it. The hundred public courses arrived as two compiled lists, “transcribed verbatim and then CHECKED row by row” — five verification agents, twenty rows each, 193 values corrected, two left open by name rather than filled. The coach’s new photo review sends the plate to a model twice — the cook’s lens and “the seat across the table” — and then offers a button that copies the report for the next session, so the recipe learns through the human’s clipboard, not an auto-edit. And the film archive’s README leads with Live: above a domain that does not resolve, while the note beneath it says the database doesn’t exist yet. The note was written for the author. The README was written for a reader. Only one of them is right.
The transfer: when you hand a loop to a machine, write down the one decision it still may not make, and make any exception rule-shaped before you make it. The tool should never both set the goal and grade it. And read the front door the way a stranger would: a Live that means code complete is a judgment error, not a typo.
The stack — whatever you don’t have to log into wins
The monthly infrastructure bill is $0 — but the money is the least of it. Sort the portfolio by what each project depends on and a pattern falls out: everything that survived runs on things you can hit without logging in — OpenStreetMap, MapLibre, git, localStorage, a static host’s free tier — and everything that rotted, rotted at an auth boundary: an OAuth flow, an expiring token, a service key. Not because open tools are better, but because they’re still there at 5am, on a phone, from a golf course. The path of least friction wins, and a login screen is friction.
Keyless → still running
- OSM + Overpass — two golf projects' course geometry; cost: an attribution line
- MapLibre — real maps, no API key
- Open-Meteo — live microclimates for the atlas’s weather-chase mode; no key
- git + a CDN — doppler's whole "backend"; scoring is a commit
- localStorage — the rat's database; the cooking coach's whole state; the flagship's job queue
- Jekyll + GitHub Pages — twelve years; its one death is opposite →
- a browser extension riding your own session — the watch's data, captured verbatim, no OAuth; the 2021 death across the aisle, solved by not asking
- hand-placed terrain — 48,000 lines of war game on zero external data; every ridge typed in
- GitHub Actions + git — the golf record’s nightly capture: twelve green runs, one failure that opened and closed its own issue; the first commit in the census with no human author
- Demucs, local — stems: no cloud, no accounts, no uploads; the price: only a demo lives at a URL
Auth-walled → where things rotted
- Garmin OAuth — built before daily use was proven; rat v3 died finished
- a Supabase anon key — five months of public writes on the flagship
- Universal Analytics — the site's one death in twelve years
- cron secrets & DNS aliases — the rat simplified; the failures moved here
- a stale Overpass mirror — the one that answers looks healthy; three courses baked from May data. The guard written after it caught a second mirror lying 50 days deep, in a different repo, on its first run
- five runner secrets — a watch token and a scorecard password, held by a cron; it works because “neither site challenged the runner’s IP”, and stops the day one does
- a model key on a server — the cooking coach’s photo review answers 503 without it; the first server-side key in the set
- a free tier with two slots — the film archive is coded against a database it cannot create; both slots are taken
- a hosting team's URL — the war game's deploys answer a login screen; only an alias nobody wrote down is public, and the obvious address belongs to someone else
Tournament weekend was the field test. Thursday, July 23: git init at 3pm, a live tournament site by 11:31pm. Then every update, all weekend, came from a phone between rounds — 22 commits of scorecards entered hole by hole from the course in Ontario. Nothing on the board was ever set by hand: standings, odds and the champion badge all derive from the committed scorecards. No admin panel, no login. That’s the bar — run it from a golf course, on a phone, between shots — and any OAuth screen in that path kills the live board by Saturday.
This round the thesis got its sharpest test yet, and the result is split. The nightly capture is the most auth-walled thing in the set — five secrets, a password login driven by a headless browser, a token refreshed by a library — and it is also the most reliable: twelve green nights, a failure that filed and closed its own ticket. Its decision log knows what it is standing on: “neither site challenged the runner’s IP” — yet. The control arm went the other way again: the Codex-built renderer’s auth tier has now sat untouched for three months, its API answering 404 from outside. Nothing rotted loudly. Auth-walled things don’t; they just stop being checkable.
And keyless still isn’t the same as findable. Three of this year’s shipped things have no URL in their README; a fourth’s README names one that doesn’t resolve; the obvious address for two of them belongs to strangers. Open beats auth-walled on survival; it buys you neither correctness nor a front door.
The transfer: count the credentials before you count the features — every key is a place the project can die while you’re not looking. When you must hold one, hold it the way the cron does: in a vault, with a run log that files its own failures, and a sentence in the record naming the day it stops working.
What building on top found
Three things fell out this round that no reading would have found, each of them shipping silently until something ran.
- The spec’s numbers couldn’t produce the spec’s ending. The course manager’s design doc says the vertical slice is done when a golfer quits. With the penalty table as written, “a Hacker cannot reach zero on one hole (three rinses plus a triple leaves ~25).” Nobody could quit. The escalation that made the ending reachable is labelled a guess, with the seeds that show it working.
- The failure path that only fires at n=1. The nightly capture ran green for three nights and died on the fourth — the night exactly one bundle arrived and a plural helper tripped
set -e. A test suite checks the paths you thought of; a cron walks into the one you didn’t, at 4am, and files the ticket. - The vendor moved under the scraper. The scorecard app switched charting libraries between two captures. The reader now “accepts both eras.” A guard written against a stale mirror in July is the same reflex: the endpoint that asks nothing of you also promises nothing to you.
The transfer: when you inherit a pipeline you didn’t write, don’t audit it — extend it, and if you can, hand it to a schedule. The next feature walks into the paths you didn’t test, and the next night walks into the ones the feature didn’t. The fastest audit of code nobody remembers is the next thing somebody — or something — needs from it.
The year in one line
The shape of the year · commits per week, in three acts
Two quiet months, a detonation, a tail — and now a fourth act with its own clock. The spring holds 47% of the year’s commits, below half for the second edition running, with July third and August fourth. The mid-May flatline is Google I/O; the June trough is the move, New York to San Francisco; the autumn is paternity leave, from August 26. The leave doesn’t read as a stall: nineteen active days of sixty-three, a Saturday of eighteen commits, a Thursday of sixteen, and a twelve-day silence in between. What changed is the hour. For the first time the year’s busiest hour is a morning one — 9am, by three over 9pm — and the 5am peak, 94 commits deep before the leave, hasn’t been visited since.
The portfolio
This round’s deltas — MACKENZIE · MUNI golf · bittman · Westeros War Games · unstuck · the bench
Shipped & steady — Prompts · The Doppler XII · archetypes · SF · Flow Slays IO · inference · stems · Level Atlas · Minecraft mods · course renderer · kareemrpg · prompts-mcp · the site
Bench & footnotes — SF Rush · the Dopamine Rat · bass
MACKENZIE
Two editions ago it forgot to push; now it pushes without him. A nightly job logs into the watch and the scorecard app, captures as the extensions would, refreshes, passes the gates, commits and deploys — “the five hand steps between a round and a push” are gone, and the one commit it has made so far is the first in the census by a machine. Around it: a hundred public courses checked row by row (193 values corrected, two left open by name), nine weekends with a story, and a plan page that prices the record against sourced benchmarks instead of its own simulator.
MICKEY’S MUNIS · golf
A 16-bit sim on real course geometry — 360 holes, from Augusta to a Toronto par 3 — and now, through a side door on its title screen, a Golf Course Manager: one par 4, twenty golfers with patience that drains at the tee gate, a ledger, and a done-when — “a Hacker rinses three balls in the pond, quits, and the refund lands in the ledger.” Phase 0 was built by a cloud agent in twenty-one minutes of commits on a Saturday morning; nearly every number in its design notes is labelled Guess.
bittman
A cooking coach for one cook — a new dad — built in 28 hours in August and grown since: The Fridge (“the teach-only answer: no fridge inventory, no new state”), menus pinned to the time you want to eat, a nav cut to five tabs in sixteen minutes, six savory breakfasts one morning in October, and a photo review — two model reviewers look at the plate, then a button copies the report for the next session. The validator still runs by hand; the README still says no backend under the portfolio’s first server-side key.
Westeros War Games · catalina
A deterministic war-game engine that grew a genre a day in August, then a combat redesign in September: every exchange a stance — press, measure, guard, feint, close, finish, hold, yield, break — and a 200-game batch that went from 14 distinct winners to twenty. Two versions sit on one laptop: the hotspot fix on main, the redesign on a branch with no upstream, both unpushed for six weeks while the note beneath them said so every session. No decision log yet at fifty thousand lines.
unstuck
A physical-therapy tracker for one body, kept off the board on purpose. The program is “transcribed verbatim from the handouts … nothing clinical is invented”: unknown set counts are stored as not specified, left/right tracking is “labelled as your own choice,” and quick logs don’t count toward milestones. Five mornings: a PWA, a one-way export to a vendor that “only models sets and reps,” eight hand-drawn pictograms, and the best per-session notes in the portfolio — including one that records a parallel session’s change as “someone else … kept as-is.”
Prompts · the flagship
X bookmarks → a curated gen-media prompt dataset, and now a public market map: 74 companies, a Momentum 25, and a 352-finding validation trail written in two hours before work. Its strongest refutation is published in its own audit; contested numbers stay contested; the entry about the author’s own product was corrected toward accuracy, not flattery. The April essay it replaced kept its URL and lost its authority.
The Doppler XII
Built in one evening, operated from the tournament, sealed by Sunday. Live scoring was literally git: commit a scorecard, the field’s phones update. Two runtime dependencies, no backend, 264 data invariants in CI. After the seal came “The 36th”: the playoff hole resurveyed from OpenStreetMap, shot by shot, with witness corrections amending the record.
SF Rush
Don’t read the commit count — the game was built across sf’s spring sprints, then copied out whole on Jul 12: 18k lines, six vehicles, real LiDAR terrain. The chart shows the full lineage; its default level is the Harbor Links golf course.
Flow Slays IO
A Slay-the-Spire deckbuilder about shipping a GenMedia model. The truest mechanic: the PM classes cannot deal damage — the whole kit is leverage on other people’s cards. July’s retheme added pixel-art combat and an honest balance simulator.
Archetypes
v1 was built entirely on a phone. v2 rebuilt the problem statement: 87 archetypes, 170 graded mappings, every objection attacked on schedule and the survivors published.
Course renderer
A golf-course digital twin on MapLibre + OpenStreetMap — refuses to invent geometry the map doesn’t know. The keyless thesis’s control arm: its auth tier has now sat untouched for three months — not broken, just no longer checkable from outside.
Stems
A local-first Demucs stem splitter whose demo renders music videos in your browser — ten styles, four generative sketches drawn from a hand-written FFT — and then, in twenty-three minutes, became a working Winamp. Its own note says the next step is to ship it outward.
Level Atlas
An atlas of level design in which the repo is the database: every entry a JSON file checked at build time, so a dangling reference fails the build instead of the page. Day two it built a space-graph engine instead of per-level artwork.
The SF atlas
An atlas built to answer a real question: where in SF to live. Its weather-chase mode colors 189 neighborhoods by live sun, wind, and warmth. It also grew a driving game, then gave it up: −19,963 lines in six reversible minutes.
LabsCraft v2 · minecraft-mods
An LLM-driven NPC mod deleted and rebuilt in ~100 minutes by 7 parallel agents — safe because the design was extracted into a spec first. A third mod, SportsCraft, golf inside Minecraft, is still in PR, honest that no one has run it.
Inference
Gen-AI unit economics, cited and interactive. Its 34-commit launch day exposed the missing source of truth; the fix made July’s refresh one commit instead of thirty.
The Dopamine Rat
Dependency count per version: 2 → 7 → 10 → 3. v4 wins by deleting the other three. Its July privacy fix has been sitting uncommitted for 89 days — the campfire is lit; nobody has pushed it into git.
kareemrpg
A friend’s life as a walkable RPG. The tutorial folder quietly became the product — bias toward extending what works.
prompts-mcp
Learned MCP by implementing all four primitives and both transports over his own dataset. The bugs were the curriculum.
The bench
film was deleted and rebuilt in twenty-one minutes on Sep 12 — rolls as the unit, a contact sheet, a grease pencil, a search — and stopped at the first account it had to create; its README says Live above a domain that doesn’t resolve. westeros-battle-royale, the rival engine that got its first commit sixteen minutes after the last audit found it bare, has not moved since. Two repos never reached a first commit.
The cadence
The bimodal builder · commits by hour of day (Pacific)
Every day of 2026 · Daily commits, week by week
Hover any day for its count and which repos moved. The dense block is the March–April detonation; the warm cell is the single busiest day (Apr 12, the inference launch).
The verdict
The portfolio isn’t a list of products; it’s a thinking log with a URL for each thought. This round the log got its first entry the author didn’t write. The oldest failure in this file — the thing that is built, works, and is never pushed — is the thing he chose to engineer out of exactly one repo, and it worked: the record pushes itself, and nobody has typed push there since. The same failure is sitting in the engine right now, six weeks old, under a status line that has told the truth every day. A report works when someone is looking. A hook works when no one is. The difference this round is that one of the nine fixes the last report asked for was installed as a hook, and that one is the one that held.
The leave reads clearly in the data and the data is not sad. The 5am builder is gone and a 9am builder replaced him; the output per active day is the same. Every new thing this window has an audience of one — a body, a kitchen, a golfer, a course — and every one of them refuses, in writing, to invent what it doesn’t know.
What none of this has been tested on is still other people, and the gap moved in a strange direction. The cron is the first non-human with commit rights, and it has behaved. The parallel session that one note called “someone else” is the second — the same person in a different window — and “kept as-is” is the first merge decision in this file that wasn’t made by the only author. Whether any of it survives a human with a different opinion and the same permissions is still the question a solo portfolio can’t answer. Two months of the year are left to try.
Build to think; then push what you built, because a version number that only goes up on one machine is a private opinion.
Nineteenth dated edition since 2026-03-29. Census through 2026-10-27. Regenerated with /audit on Fable and Opus 5 across the run — this one on Fable. The long-form master report lives at ~/CodeProj/PROJECT_AUDIT.md.