I build production web systems, and the hardware they talk to.

A rebuild with a launch date attached. First commit on 9 June; Stripe subscriptions were taking real payments on 20 June. Eleven days from empty repository to revenue.

What went in during that window: tiered memberships billed as Stripe subscriptions, a member dashboard on Supabase, transactional confirmations through Resend, Calendly and Zoom for consultation booking, and a clinical article library rendered from markdown with proper table support. British English throughout — the brand is UK, and American spellings were the first thing the client caught.

The bug that cost a day was environment variables. The Supabase client worked locally and failed in production with credentials that looked byte-identical in both places. They weren't: the values carried trailing whitespace, and Vercel's build cache was serving stale copies on top of that. It's the kind of bug where everything looks correct in both places and only the behaviour disagrees.

Paper punch cards cost money to print, get lost, and tell the business nothing. JamLoyalty replaces them with three connected surfaces: a merchant dashboard for building campaigns and branding, a staff terminal that scans, and a customer wallet that saves to the phone's home screen and tracks stamps live over database subscriptions.

The problem worth solving was fraud. A loyalty stamp has cash value, so a static QR code is an open invitation — photograph it once and self-stamp forever. Codes are signed with HMAC-SHA256, rotate every fifteen seconds, and are checked server-side against replay, so a screenshot is worthless almost immediately. Staff reach the scanner through a per-location code issued from the merchant dashboard, so a leaked link doesn't become a leaked till.

Customers sign in by phone OTP through Twilio rather than email, because email isn't the default identity in this market. Passes can be added to Google Wallet, generated by a serverless function. Each merchant carries their own branding and is isolated from every other merchant by Postgres row-level security.

Legal case files are the kind of data where a permissions bug is a professional liability, not a bug report. Access control lives in Postgres row-level security rather than in application code, so a mistake in a React component cannot expose another member's matters.

Two pieces removed real manual work. Scheduled jobs fire a staged reminder cascade three days, one day and one hour before every court date and deadline. A docket generator compiles current database state into a print-ready PDF on demand, replacing a copy-and-paste ritual that used to happen before every hearing.

The lab tracked components and consumables on paper, which meant nobody knew what was in stock until they went looking for something and didn't find it. I built the replacement, and I'm also the person who uses it every week — the fastest feedback loop I've had on anything I've written.

Campus connectivity drops constantly, so the app writes locally first and reconciles on reconnect rather than blocking on the network. Students check equipment in and out by QR scan.