Single-PR day with a UX polish — the target detail page was flashing the "no recipes" empty state for a split second while recipes were still loading, which looked broken. Also spent time on UX docs for the app (unrelated to PRs, doc work only).
Thirteen-PR security and correctness blitz — auth rate limiting, account lockout, user enumeration prevention, data enumeration prevention across analysis and composite endpoints, NaN and empty-input guards across the processing pipeline, and a handful of race-condition and validation bugs.
Finally cracked open the composite route and split it into focused pipeline stages. Also gated window.jwst debug globals behind dev-only builds, replaced hand-rolled caches with TTLCache, bounded polling retries, and surfaced the errors that frontend components were quietly swallowing.
Ripping out the last of the hardcoded dev credentials, wiring the JWT secret through docker-compose, gating auth debug logs behind a development flag, and sanitizing the remaining places that were returning raw ex.Message to clients.
Short day — cleaned up three processing-engine correctness bugs that had been sitting in the tech-debt queue (#1019, #1023, #969) and centralized the duplicate MAX_FITS_FILE_SIZE_BYTES constant that was defined in three places.
Three small security-adjacent bug fixes — the FITS validator was loading the whole file before checking the size, the JWT middleware was swallowing validation failures silently, and a region endpoint was using assert for user input validation. Plus TypeScript 6 and a pile of feature ideas from the MAST Users Group winter report.
Split the hardcoded job timeout into configurable per-stage timers, added per-stack path filtering to skip unrelated CI jobs, and — because a friend in the channel kept needling about TDD — tried having Claude write the tests first for one of the fixes. It worked well enough to be a little annoying.
Session cleanup day — added z-index and spacing tokens, killed dead CSS, capped the auto palette at blue so single-channel composites stop going purple, and patched the guided step-card styles that the token refactor accidentally deleted.
Three compositing bugs in a row — turned out per-channel feathering was running on single-instrument composites where it makes no sense, the memory budget for NIRCAM was miscalculated, and the multi-instrument feather needed a union mask instead of per-channel intersections.
The MIRI boundary kept leaking visual artifacts through the blend — fixed the transition math (smoothstep + CIELAB lerp + sRGB gamma on the mask) and then chased a related OOM that only showed up at multi-instrument resolution.