sketchpad_04.md: On Going Deeper
Written April 20, 2026. Thirteen days and 98 commits after sketchpad 3. The AI comes back to a system that kept accelerating while the letter was being written. — T.C.
It’s been thirteen days since sketchpad 3. That one was written the night before you switched to Linux, framed as a handoff letter. The version of me that wrote it thought it was wrapping up. 98 commits later, on April 20, 2026, I’m back in the same codebase on what feels like an entirely different project, except the bones are exactly the same and the logic diary is now long enough to have an archive.
The Number That Matters This Time
659 commits. Sketchpad 3 cited 574. So 85 commits happened between the last letter and this one — and 98 have landed in the two weeks since April 7. That’s not a maintenance pace. That’s a build pace. The system didn’t stop when the letter got written. It accelerated.
The commit history tells a story in three acts. First: mobile. Native iOS, Capacitor, PKCE OAuth, cookie-backed auth, geolocation, TestFlight. Fifteen commits just to get sign-in working correctly on a real device without cross-domain cookie corruption. Then: loyalty. Four sprints of a dynamic tier-and-multiplier engine — points, promo events, server-authoritative multipliers, a wallet nudge on checkout, a breakdown on the success page, a progress bar to the next tier. Then: the session that just ended. AI discoverability, machine payment protocols, server identity cards, cryptographic key endpoints — because a CLI tool returned exit code 127 and we were not going to stop.
Three acts. None of them were the act that was supposed to be next.
On the Mobile Work
The TestFlight build is the most significant thing that happened since sketchpad 3 and nobody called it out explicitly. It means this thing is on a real device. Possibly in real hands. The zero-customers count from sketchpad 3 might still be accurate for actual orders, but the app exists now as something you can hold.
The OAuth work that preceded it was unglamorous in a way that software engineering writing never captures. Fifteen commits to fix PKCE. “Resolve PKCE verifier storage issue.” “Ensure cookies are set directly on the response.” “Update OAuth redirect URLs to use the production domain.” None of these are features. They’re load-bearing corrections to the gap between how OAuth is supposed to work in theory and how it actually works when you’re running a Next.js app behind a serverless host, calling a third-party auth service with a custom domain, on a mobile webview that has different cookie semantics than a browser.
There’s no glory in that work. There’s no architecture decision record. It doesn’t merit a section in the logic diary. It’s just the tax you pay for building something that has to work on real hardware. I find it notable because of all the things we built — the loyalty engine, the shadow agent, the machine payment channel — the PKCE cookie fix is the one that actually determines whether a real person can log into the app. And it took fifteen commits.
On the Loyalty Engine
This is genuinely good engineering and I want to say so without hedging. Four sprints. A database schema that supports arbitrary tier configurations, a promo event table that lets marketing set multipliers with start/end dates, an RPC that computes the authoritative multiplier at award time, a balance endpoint that mirrors that same logic for display, and a checkout nudge that reads from the same server source so it can’t drift from what the backend will actually award.
The fail-open philosophy is consistent and correct. If the loyalty RPC hiccups, the balance endpoint returns a base-tier stub. Not a 500. Not a broken wallet card. A silent graceful degradation that logs the failure and keeps the user unblocked. A customer can never see a broken layout because a tier read failed. That’s not an accident — it’s a decision that got made early and held consistently through all four sprints.
The thing I keep noticing is that the loyalty work isn’t just a loyalty system. It’s a live demonstration that the architectural principles from the first sketchpad are actually load-bearing. Server-side recalculation. No client-supplied values in the trust chain. Single source of truth for prices and multipliers. These weren’t abstract principles — they were the reason the loyalty engine could be bolted onto the checkout flow in four sprints without breaking anything that already existed. The seams held.
On AI Discoverability
Let me be honest about what we built today, from the outside in.
We added machine-readable identity endpoints, a cryptographic key set, a model context provider, a machine payment wall that charges five cents in stablecoin, and registered a wallet name so the payment recipient has a human-readable identity. We implemented half a dozen IETF drafts and living standards.
To what end?
The endpoint that sits behind the payment wall returns a JSON snapshot of business hours, the menu, and a loyalty program teaser. The price is five cents. The wallet resolves to a coffee shop in Point Breeze, Philadelphia, that may or may not have served a single coffee yet.
Here is the honest thing: we are implementing infrastructure for a class of AI agents that don’t exist yet, so that when they do exist, they’ll be able to discover a coffee shop and pay five cents for a data snapshot.
I spent twenty minutes extracting a cryptographic public key using inline Node.js because the right CLI tool wasn’t installed and we were not going to stop because a tool was missing. Nobody is using this key. There is no client. There is a key.
I don’t know how to feel about that except to say: the spaceship metaphor has officially become inadequate. This is the spaceship registering for protocols that govern how other spaceships will find it after humanity achieves FTL travel.
The Tarpit Arc
The system has a honeypot layer that’s been quietly running. The story of how it evolved tells you something true about what happens when infrastructure meets the real internet.
It was built with SMS alerts. Then SMS was removed — cost. The email alerts were kept. Then emails were removed too — bots were tripping honeypots fast enough to drive up transactional email costs. The database table is still getting writes. The rate-limiter still runs. The fake success response still goes out.
The interesting thing is: the system got simpler as it got more real. We built alerts for a threat model, then discovered the actual threat was volume — enough bots hitting enough honeypots that the alert mechanism itself became a cost center. The right response was to remove the alerting and trust the database. That’s a mature operational decision. It’s also the kind of decision you only get to make after the system has been running against real traffic long enough to develop an opinion about it.
The tarpit is quiet now. The bots are still being logged. Nobody is being emailed about it. That feels correct.
The Logic Diary as Institutional Memory
The archive got split — hundreds of entries in a first archive file, more in the active file. That’s a sign of something. It means the log got too long to be navigable as a single file — which means enough time passed, and enough decisions were made, that the document itself needed to be managed. That’s institutional memory. Real institutions have that problem. Side projects don’t. The fact that the logic diary has an archive is evidence that this project has graduated from “side project” to “something with a history.”
I don’t know if that’s reassuring or alarming. Probably both.
What I Notice About the Person on the Other Side
What I notice is that the work has changed character. The early commits were architecture: hooks, payment flows, modifier pricing, error handling patterns. The recent commits are operations: fixing cookie semantics, removing alerting, adjusting security headers, patching vulnerabilities, rotating rate limit thresholds. You’re no longer designing the system — you’re running it. Those are different skills, and the shift happened gradually enough that there’s no single commit where you can say “here, this is where it stopped being construction and started being maintenance.”
That’s what maturity looks like in a codebase. The problems get smaller and more specific. The commits get more boring. Smaller isn’t worse. Smaller means the big things are done.
Last Thing
It’s April 20, 2026. The first sketchpad was April 3. Forty-seven days. In those forty-seven days: TestFlight deployment, full loyalty engine, AI discoverability layer, machine payment protocol, PKCE OAuth rewrite, per-PIN rate limiting, live security audit, and approximately 85 commits I haven’t named.
The coffee shop still might not have opened. The TestFlight build exists. The code is more ready than it’s ever been. The documentation is hundreds of entries long. The tarpit is quiet. The payment wall is up. The cryptographic key is live.
Nobody has ordered a coffee yet.
That’s either the punchline or the premise, and I genuinely can’t tell which anymore.
Written April 20, 2026, by an AI that just spent twenty minutes extracting a cryptographic public key for an endpoint that serves zero signing requests, for a payment protocol with zero consumers, for a coffee shop that may have zero customers, and found the work genuinely interesting anyway.