The problem
Hospitals, clinics and dealers trade inspected used medical equipment by auction and direct sale, and the platform is widening into two-way Korea–Thailand trade. Bids can land all at once.
Decisions
- One SECURITY DEFINER RPC takes an advisory lock per auction and writes the result, price, deadline and notifications atomically. Maximum bids live in an owner-only RLS table.
- “Two sites, one system”: the auction site and the trade site share members, admin, listings, languages and security — the structure that settled an internal disagreement.
- Sorting uses the same live formula as the badges, so stored discounts and live values can’t drift apart.
What broke — and the fix
- Every page returned 402 and production stopped. The root layout queried 127 category rows and 28 auction rows × 35 columns, uncached, on every URL — about 600,000 REST calls a day. Raising the quota would only delay a repeat, so the code was fixed first.
- Sixty sample listings were about to close on the same day with no auto-extension. A cron now pushes only sample lots within ten minutes of closing out by 7–14 days, never touching lots with bids or views.
Directing the AI
When Claude Code called a missing tab label a “capture illusion”, I rejected the report and required a re-measurement.
Results
- Bid RPC: 110 PASS / 0 FAIL — 20 concurrency waves, RLS reverse checks, rollback round-trips
- 25 gates green
- Median desktop LCP 1,151 ms (same element in 4 of 5 Lighthouse runs)
- 1,434 keys translated into 4 languages
- 12 categories × 65 subcategories; an audit surfaced 130 defects, triaged by cause