Youth-sports training platform — Expo mobile app, Next.js dashboard, Supabase backend. One operator driving Claude Code, 104 days, part-time. Every number below is measured from git + the GitHub Actions API, not estimated.
Org isolation runs on signed JWT claims read through a single validated accessor; row-level security enforces it at the database. Migrations are an append-only ledger — non-destructive, backward-compatible, ON DELETE RESTRICT on the core foreign keys, no hard-deletes of user data.
Every change went through a three-review gate before merge, plus a cross-model consult (Codex) on strategy before code. That cross-model pass is not ceremony: it repeatedly caught real bugs a single model's review missed — an access-control slip, a permission check that misfired on legitimate users, a data-freshness race. The 1.31 fix-to-feat ratio is the visible cost of that discipline: more commits correcting shipped code than adding new.
The AI wrote most of the code. No point pretending otherwise, and any developer reading the diff would see it. What didn't automate was the part that makes generated code shippable: the architecture calls, the review gates, the adversarial verification, the security model, and the refactoring passes that deleted and rebuilt a quarter of the line-churn.
The honest claim isn't "one person out-typed a team." It's that a single operator, with the right harness around the model, held a real production codebase to a bar you can audit — and the git history is the audit.