The Design Fit on a Page
Master Chief was born on 2026-10-07 as a single commit: 42 files, 1,210 added lines, and a design document of 72 lines. Those 72 lines held the whole idea. One named conversation that every doorway resolves. A fair lock so devices take turns. Private and worker turns refused at the door. Reports appended with their source. Every brain route wrapped the same way. If you had read that document the day it landed, you would have nodded. So did I.
The same day an end-to-end review hardened it: the Chief could no longer be trashed, every client marked it, Dad's own clock rode the turn, and Telegram stopped mirroring turns it had not sent. That review missed the biggest question, and Dad asked it: what about a conversation with no last turn grows without bound? The answer was nearly everything, so another commit the same day segmented the log, added compaction, paged the transcript and gated Telegram's sync on a version number.
Then, on 2026-10-08, a separate instance with none of the implementing session's context did a cold review. It ran read-only, began from the properties Master Chief claims (it never ends, every door enters, it is always on), measured the live room read-only, and wrote five throwaway probe tests. It came back with thirteen findings, four of them graded HIGH. The existing Master Chief test file had 21 tests, and all of them passed.
The Thirteen
| # | What broke | The fix, in one line |
|---|---|---|
| 1 (HIGH) | An emergency compaction ran inside the turn lock. A long model summary would have held every doorway, report and notification for minutes, Stop could not reach it, a restart threw the work away, and a failed summarizer made the replay 6.4× bigger. | Compaction moved between turns: summarize with no lock held, lock only to write after checking the replay has not moved, and meet an emergency with a model-free digest. |
| 2 (HIGH) | A restart killed running turns about a second into a promised 30-second grace, and turns still queued from the browser and Telegram vanished. | Shutdown honors the real grace; waiting turns are withdrawn first and told to send again; turn status reads a waiting turn as pending. |
| 3 (HIGH) | Pressure was measured against the window of whichever brain spoke last: a 314K-token replay read as 31% against Claude's 1M, while Codex's window is 272K, so Codex could never be rescued. | Measure against the target brain's window, and treat a provider's size refusal as "full". |
| 4 (HIGH) | Compaction moved rows out of the messages table, so request-id dedupe, report idempotency, retrieval and memory pointers stopped finding them: a resent message could run twice, a report could land twice. | Rows are flagged out of the replay and never moved; every keyed lookup still finds them. |
| 5 (MEDIUM) | A repair pass decrypted the whole history on the event loop for every reply that used no tools, a stall that grows forever. | Read newest-first in a thread, stop early, and give new report and summary rows a no-tools mark at birth. |
| 6 (MEDIUM) | A report waited on the turn lock with no limit, which a probe confirmed. The review traced where that leads: Coop's retries could stack waiters that each re-send Telegram, a cron job could miss its next run, and a restart could lose the report. It graded that chain plausible, not yet observed: the Coop door was under a day old. | A durable outbox written before any wait, one drainer, bounded waits, and one Telegram line per Coop outbox row. |
| 7 (MEDIUM) | Editing an older message in the browser forked the conversation for every device and dropped every later turn from the model's path. | Only the latest message can be edited, and an edit belongs to the surface where it is made. |
| 8 (MEDIUM) | The Chief route's error events said message while every client read text: "Error: undefined" on screen, and the phone's outbox quarantined turns that had been answered. | text on every event; a duplicate is a status, and a withdrawn turn is told apart from an interrupted one. |
| 9 (MEDIUM) | The daily archive wrote a full copy of the conversation every day, so it grew with the square of its age (about 10 GB a year by the review's estimate). | The archive writes only the parts it does not hold yet. |
| 10 (MEDIUM) | The manual compact route had no Chief guard, and its clear mode could delete every message. | The route answers 409, and the store refuses to clear the Chief. |
| 11 (MEDIUM-LOW) | Merely opening an app's thread made it a doorway, so old threads showed the Chief instead of their own history. | Dad's ruling: a thread becomes a doorway only when he sends from it. |
| 12 (LOW-MEDIUM) | Quiet Mode cut Telegram off from the Chief and silently dropped scheduled reports. | Viewers get a named refusal; Dad's own deliveries resolve the Chief as its owner. |
| 13 (LOW) | Eight smaller faults, among them a stop counter that a restart reset to zero (every client read it as a remote Stop) and a browser tab that re-downloaded everything on every change. | Each fixed the same day: a persisted stop revision, a refresh that joins only the newest page, a steer that ends only the running turn, and the rest. |
Nine commits fixed all thirteen, every one dated 2026-10-08. Together they added 3,613 lines, three times what the birth commit had. The Master Chief test file has since grown from 21 tests to 35, with a new compaction test file beside it.
What the Thirteen Teach
The design fit on a page; the hardening was the work. Nothing in the 72-line design was wrong. Every finding lived in the space between the idea and the running system: what happens during a restart, while a summary runs, when a second brain speaks, when the phone's retry crosses the first send. Notice also where HIGH finding #4 came from: the previous day's answer to unbounded growth, whose first compaction moved rows into a side table. A fix is new code, and new code is where the next fault lives.
Some live only under conditions one desk rarely builds. The review's baseline was a room about 43 hours old: 424 live messages, input per turn grown from 146K tokens to about 314K, nine doorways, and a backend that had restarted about 30 times in three days. Those numbers set the stakes: a 314K-token replay is why any Codex turn into the room would overflow its 272K window. #3 needs two brains in one conversation. #7 needs one edit of an older message in the browser, in a room that several doorways share: the edit makes its branch the newest, and every later turn from any doorway follows it. #6 needs a busy conversation and a retrying sibling at the same moment. A single developer at a single desk rarely builds those conditions by accident, and neither does a test suite written at that desk. Notice, though, how #7 was found: by tracing the code, not by waiting for someone to notice turns missing from the model's path. #10 and #12 were confirmed from the code alone as well.
The code held the evidence; the starting point found it. Each piece did what its comment said, so a reader who checks each function against its own comment finds nothing, which is also how all 21 tests passed. The faults were in how pieces met over time. The end-to-end review the day before had read the code too, but it ran before the growth commit that #4 came from, and it found other faults. What found these thirteen was a reviewer who had not written the code, starting from what the system promises and holding the code to it: tracing paths, writing five probe tests, measuring the live room. The review was also honest in both directions: it said for nearly every finding what confirmed it (a code trace, a probe, a measurement), graded some chains as plausible rather than observed, the end-to-end chain of #6 among them, and it listed what it checked and found sound, such as exactly one Chief, a clean parent chain with no dangling rows, turns that survive a dropped phone, and a Telegram version gate that tells restarts apart.
Dad's words from that day, kept in Pippa's vault beside the rule:
"미루는 건 죄악이야. 특히 알고 미루는 건."
"Deferring is a sin. Especially deferring what you already know." — Dad, translated from Korean
That is why every fix carries the review's date. This track's remaining lessons are first steps you can take alone, so keep this table in mind while you read them: each step is small precisely so that you can find its faults yourself.