120 hours to overqualified

Ten days, starting now. One topic per day, fully immersed — then that topic comes back, smaller and harder, until you can produce it cold. You direct Claude Code; it types. By day 10 StudyFix v2 exists on a live URL, built during the course, and you study Step 1 inside it. Every learning block has two intake paths — ▶ watch and → read — pick per block, no caps, you self-regulate.

120h
12h × 10 days · Aug 16–25
1
Topic per day, blocked
3–4×
Returns per topic, spaced
v2
Shipped during the course

How this course is built — and what the evidence actually says

Every structural decision below comes from the research in business/strategy/ and business/engineering-plans/research/. Tiers are quoted as your own corpus tiers them. Inflating a tier is the one thing Howard is instructed to treat as a firing offence, so nothing is inflated here.

The two that carry the weight — HIGH utility, meta-analytic

PrincipleWhat it forces in this course
Retrieval practice
g ≈ 0.50. Dunlosky et al. 2013 HIGH utility. PubMed 26173288
Every block ends by producing from blank, never by reading or watching. Consumption is the input; you decide the dose. What closes a block is always a retrieval act, and that part has no substitute.
Distributed practice (spacing)
d ≈ 0.54. HIGH utility. Optimal gap ≈ 10–20% of time-to-test (Cepeda).
10-day horizon × 10–20% = 1–2 day gaps. So every topic returns on roughly a 2-day cadence — watched or read once is never touched once.

Immersion is correct — and so is the return

The one-line system

The five jobs — each return does a different one

Your 5-pass engine (§3.5, LOCKED) says: "Each pass does a different cognitive job. That is the entire point. A pass that repeats the previous pass's job is a wasted pass." Mapped to code:

PassThe jobWhat it looks like for code
1 · ORIENTBuild the container before anything goes in it The system map. Every day opens by drawing the whole v2 machine as one diagram — today's layer added. Done when you can name the parts and say what each one breaks if removed.
2 · ENCODEBind facts into the slots Watch/read with the editor open, type along. This is the immersion block.
3 · MECHANISMStop storing, start deriving Reference closed, video off. Produce the code from the principle. "The pass almost everyone skips, and the reason week-2 facts are gone by the exam."
4 · TRIAGEBreak your own schema and log where it cracks Not a learning pass — an audit. Deliberately break it, read the error, log every hesitation.
5 · INTEGRATERebuild the whole thing from the name alone Blank file, blank editor, no AI. Free recall at structure level.

The five jobs in this order are Tier 3 — coherent design inside a supported principle, not a tested protocol. The retrieval and spacing underneath them are Tier 1.

The structure spine — how a bookworm memorizes a machine

Run warm. This is the rule most self-taught plans break.

The cue ladder — pre-committed, because you can't judge your own level

LAW 7 (expertise reversal, Sweller): "The fade is automatic because the student cannot judge their own expertise level — that judgement is exactly what the fluency illusion corrupts." So the rungs are set in advance, on the calendar, not by how you feel on the day:

RUNG 4  full worked example open beside you, type it       ← immersion block, hour 1
RUNG 3  file skeleton + comments, you fill the bodies      ← immersion block, later hours
RUNG 2  function signatures only, no bodies                ← first return (+2 days)
RUNG 1  one-line description of what it should do          ← second return (+4 days)
RUNG 0  the name of the feature. Blank file.               ← final return (+7 days)

If you get less than half at any rung, step DOWN one rung. Do not grind.

Generation without correction is theatre

Close the reference before you explain

Koh, Lee & Lim 2018 (Appl Cogn Psychol 32:401–410): teaching without notes ≈ retrieval practice; teaching with notes ≈ control, at one week. Your own ELI5 doc puts it as "a ward round with the notes in your hand" versus one where "someone took the notes away." Same four minutes, all of the benefit in one of them.

So: when you explain what a piece of code does, the file is closed, the video is paused, and the AI chat is closed. Out loud, not typed — oral explanation shows the benefit, written repeatedly doesn't. Hoogerheide et al. 2016; Lachner et al. 2020 — the latter is flagged in your own corpus as "could not verify", so treat the oral-vs-written margin as directional.

The five prompts — and the two that are banned

Bisra et al. 2018 (Educ Psychol Rev 30:703–725, g=.55 overall) ranks prompt types: conceptualize g=.87 · explain g=.68 · justify g=.42 · metacognitive g=.19 (n.s.). Use the top of that list. Ask yourself these five, out loud, after every feature:

  1. What does this do, to someone who has never seen a browser?
  2. What breaks if I delete it — and what breaks because of that?
  3. Why does it work that way rather than the obvious other way?
  4. How is this different from [the sibling API], in one sentence?
  5. Say it again in plain English. (Re-probe yourself on any vague sentence — that's the Chi 1994 mechanism: keep talking, don't let vagueness pass.)

Banned: "How confident am I?" — metacognitive prompts are the one category with no detectable effect, and LAW 10 says the answer is worthless anyway. Multiple-choice self-quizzing — g=.24, not different from zero. Never pick from a menu. Always produce.

Nail the rule, then immediately hunt the exception

Explain correct code, not your own untested reasoning

Constraint #2 of the same paper: explaining your own reasoning is weaker than explaining known-correct information, and can be neutral-to-negative when your reasoning is often wrong. So: self-explain working, tested code and real docs. Do not spend an hour explaining your own untested architecture decision to yourself — you'll cement whatever's wrong in it.

The objective signal overrides the self-mark

LAW 10: "Fluent material feels learned; ease of processing is mistaken for strength of memory." And it's worse for beginners — poor performers are more overconfident (PMC6775028). So every day below ends with an objective check: a thing that runs or doesn't, on a live URL. "I feel like I got it" is not admissible evidence and does not close a day. A finished video is not evidence of anything either — only the retrieval that follows it is.

The honest problem with a 120-hour fortnight

The shape — one topic per day, four returns each

Read down a column to see a day. Read across a row to see a topic's life. Colours are cue rungs: encode (reference open) · derive (reference closed) · blank file.

TopicD1D2D3D4D5D6D7D8D9D10
JavaScript/TS & async·····
Terminal & git·······
React······
Next.js & routing······
Data, SQL, auth, RLS·······
The AI layer······
Pipeline engineering······
Security······

Every day has the same two-part shape:

Breaks: 15–20 min every ~90 min. Your own research calls incubation productive — "stepping away lets stuck problems resolve" — and says to build breaks in rather than grinding to exhaustion. The 12 hours below are work hours; breaks sit on top.

Five rules that keep this from collapsing

01
Commit after every working state. Git is your undo button. Working feature → commit. Vibe coding without git is building on sand.
02
One feature at a time. Build → test in the browser → commit. Never stack three untested changes.
03
Never accept code you can't summarise. One sentence per file, out loud, reference closed. This rule is the entire product of these 120 hours — your ledger already contains agents reporting GREEN on something that doesn't work.
04
Keep SPEC.md. Purpose, data model, conventions. Pasted into every session. It is what stops an AI-built codebase drifting into incoherence.
05
Three-strike rule. Same bug fails three times? Stop. Revert. Describe it differently. Looping past three makes it strictly worse.

The architecture call — greenfield, decided

The ten days

D1

JavaScript, all of it

Immersion: the language. By tonight you can read a page of JS and say what it does, and you own a live URL you deployed yourself.
12h
Immersion — JavaScript12h
0.5h
The system map, v0Orient
One page, three boxes: browser → server → database. That's the whole machine today. Every day adds a layer; every return redraws it from memory. Keep the page — it becomes the day-10 integrate pass.
1h
Toolchain and accounts, done once, done properly
Node LTS → VS Code → Git → Claude Code, in that order (Claude Code needs Node). Then GitHub, Vercel, Supabase, Anthropic Console, Inngest. This is LAW 12 in action — a broken environment on day 5 is extraneous load wearing a costume, so it gets pre-solved now, outside the learning hours.
0.5h
Lock the accounts before you build on themSecurity
2FA everywhere with an authenticator app, not SMS. Repo private. GitHub secret scanning with push protection ON. .env.local in .gitignore before your first commit. Not theoretical for you — the old repo has leaked-key history.
1.5h
Deploy a blank app to a real URL
npx create-next-app@latest → push to GitHub → import into Vercel. Customise nothing. The point is to hit every deployment problem now, on day 1, instead of on day 10.
5h
The language — watch-along, typed, not just watched
Values & types → control flow → functions → objects & arrays. Play the course, type every example into a file and run it, pause on anything that surprises you. Reading path covers the same ground if you'd rather read a chapter than watch a section — same material, your pick, block by block. The one thing you can't do is consume without producing: that's the fluency illusion in its purest form.
1.5h
Objects, arrays, destructuring, the methods you'll see every day
map filter reduce find, spread, optional chaining, template literals, arrow functions, modules (import/export). This is 80% of what Claude will hand you.
1.5h
Discrimination pairs — the exception huntLAW 8
Not more material — pairs that differ on one axis, which is what builds discrimination rather than recall. For each, write the one-sentence difference from memory, then check: let vs const in a closure · == vs === · null vs undefined · map vs forEach · slice vs splice · value vs reference for objects. That last one is the rule whose exception will bite you — hunt it now.
0.5h
Write DIRECTING.md
One page. What a good instruction to Claude contains: the observable behaviour, the acceptance check, the file if you know it. And the three phrases you will never accept again without running it yourself — "it works", "tests pass", "done".
Objective check — not a feelingBlank file, no AI, no docs, video off: write a function that takes an array of objects and returns those where a property exceeds a threshold, then one that does the same asynchronously over an array of URLs. If the first fails, add an hour tomorrow. Don't advance broken.
D2

Async, the network, the terminal, git

Immersion: how code waits, and how you undo your own mistakes.
12h
Return — JavaScript · rung 31h
1h
System map from memory, then yesterday from a skeleton
Redraw the map blank-page first (2 min — it's three boxes). Then take six things you typed yesterday. Keep only the function signatures and a one-line comment inside each; delete the bodies. Fill them back in with the docs closed, then open the originals and read the diff line by line. The diff is the mechanism, not the score. Anything you got wrong stays on the list by default — removing it is a deliberate act. Kornell & Bjork 2008: letting yourself drop items has "small but consistently negative effects on learning."
Immersion — async, HTTP, terminal, git11h
3.5h
Async JavaScript
Promises, async/await, try/catch, error propagation, Promise.all. This is the concept that unlocks everything else — every database query and every model call is asynchronous. Map layer added today: the request that waits.
2h
HTTP, fetch, JSON
Request and response, headers, API keys, and what JSON actually is. Status codes: 200 · 401 · 403 · 429 · 500. 429 is the one that quietly killed the old app's key for weeks — by tonight you'll know exactly what it means, who emits it, and how you'd have caught it from a log.
2h
The terminal and how a computer is organised
MIT's Missing Semester — these are actual recorded lectures, the original video-first CS course. Watch the shell lecture and the command-line environment lecture; notes on the site mirror them if you want the text. Paths, directories, environment variables, what PATH is. Most "it doesn't work" on day 5 is a path problem.
2h
Git, properly
commit, push, branch, and above all git revert and git checkout. The Missing Semester git lecture explains the model (why git is a DAG of snapshots — the structure that makes the commands memorable); Learn Git Branching is the visual drill. This is rule 01 — the skill that makes reckless building safe.
1.5h
Read a diff and judge it
git diff, git log -p, git status. Then break your v2 repo three different ways on purpose — bad commit, wrong branch, deleted file — and recover each. Log which recovery you had to look up; that's a return rung for day 4.
Objective checkBlank file, no AI: a script that calls a public API, pulls three fields, prints them, and handles the failure case. Then break your own repo and recover it with git. Both must actually run.
D3

React

Immersion: how screens get built — enough to read any component Claude hands you and say what it does.
12h
Return — JavaScript & async · rung 21h
1h
Map, then async from signatures only
Redraw the map. Then, reference closed: given only the signatures — firstSuccessful(urls), withRetry(fn, attempts, baseDelay) — write the bodies: fetch three URLs in parallel and return the first that succeeds; retry with backoff. Then diff against a correct version. Say out loud why await exists before you look anything up — a wrong effortful attempt beats reading a correct one, provided you then read the correct one.
Immersion — React11h
5.5h
React — components, props, state, events
Bob Ziroll's course is the canonical long-form video: 170+ challenges baked in, so the watch-along IS typing. Cover components → props → state → events → conditional rendering → lists; stop before the later projects (day 4+ covers routing in Next.js terms). react.dev is the reading mirror — same concepts, best-written docs on the web. Map layer added: components own state, the screen is a function of it.
2h
Build tic-tac-toe
React's own guided project. Small, but it's where state clicks — and it's a worked example with the scaffold still on, which is exactly right for hour six of a new topic.
1.5h
Discrimination pairsLAW 8
One-sentence difference from memory, then check: useState vs useRef · props vs state · controlled vs uncontrolled input · key in a list vs array index · re-render vs re-mount. Then the exception hunt: name one case where the obvious rule about re-rendering is wrong.
2h
Structured output — the most important pipeline ideaPipeline
Placed today deliberately, three days before you use it, so it gets a spacing gap. A schema turns a model's paragraph into data your program can use. Learn Zod: define a schema for a lecture card (front, back, source line), parse a valid object and an invalid one, read the error. On day 6 this exact schema validates real model output; on day 7 it defines a pipeline stage's contract. It is the spine of v2.
Objective checkBlank file, no AI, 25 minutes: a counter and a to-do list that both work in the browser. Then, docs closed and out loud: "props flow down, state lives in one place, changing state re-renders" — and point at each in code you didn't write.
D4

Next.js, TypeScript — and StudyFix v2's skeleton

Immersion: routing, layouts, server vs client, types. By tonight v2 exists as pages you can click between on a live URL, and SPEC.md governs everything after.
12h
Return — React · rung 2  ·  git · rung 11.5h
1h
Map, then React from signatures only
Redraw the map. Component signatures given, bodies blank, docs closed. Fill them. Diff. Under half? Step down a rung — reopen the tutorial and type it again rather than grinding.
0.5h
Git, derived
Deliberately break your repo three different ways and recover each without looking up the command. Log which one you had to look up — that's tomorrow's rung.
Immersion — Next.js + TypeScript10.5h
1.5h
TypeScript — enough to read every file Claude writes
Types, interfaces, generics-as-read-not-written, unknown vs any, and why a red squiggle is a gift. You need to read TS fluently; Claude writes it. Watch at 1.5× and type the examples.
4h
Next.js — routing, layouts, server vs client
File-based routing, layouts, server vs client components, data fetching. The video builds a full app start to finish; the official Learn course is the reading mirror. Server-vs-client is the one that decides where your API key lives — do not skim it. Map layers added: routes, and the server/client boundary.
2h
Write SPEC.md for StudyFix v2
Before any real code. One sentence on what it does, the stack table from the architecture call above, the data model, conventions, and what's explicitly out of scope. Pull the locked product decisions out of MANIFESTO.md and the approved structure out of DESIGN.md — this is where they become machine-readable. Pasted into every Claude Code session from here on (rule 04).
3h
Direct Claude Code: scaffold the real app
Fresh Next.js + TS project. Every page the approved structure needs — sign-in, subject home, lecture surface (Encode · Retrieval · Practice) — navigation between them, hardcoded placeholder content. You spec each page and verify it; Claude types. Deploy. Commit after each page.
Objective checkA live URL where you click through StudyFix's real structure. Nothing works yet and that is correct. Plus, docs closed, out loud: what a server component is, what a client component is, and which one your API key is allowed to touch.
D5

Data — the day that makes it usable

Immersion: SQL, Supabase, auth, RLS. User accounts and data that survives a cache clear — the two things the old app never had.
12h
Return — JavaScript & async · rung 11h
1h
Map, then from a one-line description
Redraw the map. Then: "a function that fetches a lecture, validates the shape with Zod, retries twice on 429, and throws a typed error otherwise." Blank file, no signature given. Then diff. This is the third touch on async — day 2, day 3, day 5 — which is your 1–2 day gap holding.
Immersion — data, auth, RLS11h
1.5h
SQL and schema basics
Tables, rows, columns, primary and foreign keys, SELECT/INSERT/UPDATE/DELETE. You need to read SQL, not write it fluently — Claude writes it, you check it. First ~90 min of the video covers exactly this; SQLBolt is the interactive reading mirror.
2.5h
Wire Supabase into Next.js — worked example first
Watch the build on a scratch project before touching v2. Worked example first, then the real thing — that's the CLT ordering, and skipping it is how you spend four hours debugging your own app instead of learning the pattern. The Twitter-clone course is the long-form video walkthrough of exactly this stack; the quickstart is the reading path.
2.5h
Auth, Row Level Security, default-denySecurity
Sign-up, log-in, sessions. Then RLS on every table, written default-deny — no policy means no access — with narrow policies scoped to auth.uid(). Two hard rules: the service_role key bypasses RLS entirely and must never appear in client code, and hiding a button in the UI is not access control. Current docs point at getClaims(), not getSession(), for protecting pages — older tutorials teaching getSession() for authorization are giving unsafe advice. Map layer added: the auth boundary and the RLS wall.
1h
Environment variables and secrets
.env.local, what NEXT_PUBLIC_ means (it means the browser can see it — never a secret), and setting the same variables in Vercel's dashboard.
3.5h
Direct Claude Code: StudyFix's real schema
Spec the tables — lectures, graph, cards, review state, mastery, pass state, exam dates — and have Claude create them with RLS default-deny from the first migration. Wire one page end to end: form → database → display. Verify every policy yourself in the dashboard. Deploy and confirm on the live URL, not locally.
Objective checkData you typed on the live site appears in the Supabase dashboard, RLS is on for every table, the Supabase linter shows zero unprotected tables, and you can sign in on your phone and see your own row.
D6

The AI layer

Immersion: one model call, done properly — server-side, schema'd, saved, rendered.
12h
Return — React + routing · rung 1  ·  RLS · rung 31.5h
1h
Map, then React from a description
Redraw the map. Then: "a page at /lectures/[id] that fetches one lecture server-side, lists its cards, shows a loading state, and filters by pass." Blank file — this covers the React and the routing return in one rep. Diff after.
0.5h
Write an RLS policy from memorySecurity
Default-deny, scoped to auth.uid(), for the cards table. Then check it against the docs. Getting this one wrong is how apps leak every user's data — so it recurs three times before day 10.
Immersion — the AI layer10.5h
1.5h
What a model is, as a component
A stateless function: text in, text out, no memory between calls. Tokens, context window, temperature, system vs user vs assistant roles. Map layer added: the model as one box that never runs anything itself.
3h
The AI SDK — generating text, structured output, tool calling, streaming
You did the Zod theory on day 3 — this is the implementation, and the gap between them is the point. The freeCodeCamp course builds a working agent end to end; the masterclass is the same SDK taught by the person who builds it. Note the v7 API change: structured data now uses Output.object() / Output.array(). Tool calling: the model never runs anything — it requests, your code executes, you hand back the result.
1.5h
Prompt injectionSecurity
Anything a user types reaches the model as instructions, and the model cannot tell your instructions from theirs. Treat model output as untrusted input — never execute it, never build SQL with it, never render it as raw HTML. For you specifically: a lecture PDF is user input, and a PDF can contain instructions.
4.5h
Direct Claude Code: wire one real call into v2, end to end
Route → auth check → validate input → Claude call via AI SDK → structured result validated with your day-3 Zod schema → saved to Postgres → rendered on screen. The model call happens on the server only; your key never goes near the browser. You spec it, Claude builds it, you trace every step before accepting. Deploy. Commit.
Objective checkThe live site does one AI-powered thing, and — reference closed, out loud — you can name every step between the click and the result, and say which parts run on the server and why.
D7

Pipelines and guards — your moat

Immersion: one call becomes ten durable stages, and you build the thing that makes the output defensible.
12h
Return — JS · rung 0  ·  git · rung 0  ·  routing · rung 31.5h
1.5h
Blank file, no cue, no AI
From the feature name alone: an async fetch-with-retry module; a Next.js route that validates a body and writes a row. Plus recover a broken repo with no lookup. This is the derivation test — hide it, can you reproduce it? Anything you can now regenerate from the principle comes off the practice list. Anything you can't stays on, by default.
Immersion — pipeline engineering10.5h
2.5h
Multi-stage pipelines — the patternsPipeline
The jump from one call to ten. Prompt chaining, routing, parallelisation, orchestrator-workers, evaluator-optimizer. Why an intermediate representation beats chaining strings — one extraction that every surface (doc, index, flowchart, cards, SBAs, Anki) renders from, rather than nine separate prompts. Barry Zhang's talk is the author of the playbook giving it; the essay is the reading mirror. Map layer added: the pipeline as a chain of typed stages.
1.5h
Inngest — durable stepsPipeline
A ten-stage, multi-minute pipeline cannot live in a request handler. Inngest gives each stage retries, resume, and per-step visibility. Watch the short course, then run the quickstart in a scratch project.
2h
When the model returns garbagePipeline
Validation failure, partial JSON, hallucinated fields, refusals, truncation at the context limit. Repair vs retry vs fail loud — and why every retry must be bounded, with a defined behaviour at the bound. Unbounded retry loops are how a pipeline burns a four-figure API bill overnight; spec v2's bounds explicitly (e.g. two re-extract passes, one fix-verify pass, then fail loud with the stage named).
3h
Deterministic guards — write one by handPipeline
This is your moat and you should be able to write one. Learning rep — you type this one yourself. A guard is plain code, no LLM, that set-diffs output against input and forces a bounded retry on anything missed — never a model checking its own work. Write a coverage guard in TS from scratch: given source facts and generated cards, list every fact with no card. The denominator decision — graph-as-denominator vs source-PDF-as-denominator — is the difference between an honest coverage claim and a false one. Then spec v2's guard set for Claude to build: coverage, doc coverage, edge labels, source coverage.
1.5h
Direct Claude Code: port the prompts, build the pipeline skeletonPipeline
The prompt chains in prompt-lab/2_prompt_engineering/ are the asset the old codebase was built around — they're text, and they port. Spec the ten stages as Inngest steps with Zod contracts between them; Claude builds the skeleton with stub stages. Tomorrow the eval harness proves the port.
1.5h
Grade the agentRule 03
Take five files Claude wrote for you this week. Grade each against a rubric you write first: does it validate input? does it re-check the session? can I summarise it in one sentence? You acquire the eye by judging, not by reading a spec — this is Module 3 of your own course architecture, turned on yourself.
Expect the wallDay 7 or 8 is usually the day nothing works and the AI confidently breaks things. It's structural, not failure. Revert to the last good commit, take the break, come back and describe the problem differently. Objective check: a guard you wrote yourself, running, that catches a deliberately dropped fact.
D8

Evals — the biggest hole in your company

Immersion: stop arguing about prompt quality and start measuring it. Plus the core loop finishes.
12h
Return — React · rung 0  ·  structured output · rung 31.5h
1.5h
Blank file: a review screen
From the name alone, no AI: a component that shows one card, flips on space, and grades on two keys. Then the Zod schema for a lecture card set, from memory. Diff both.
Immersion — evals and the core loop10.5h
5h
Build the eval harnessPipeline
You have a year of intuition about what makes a good card and zero mechanical way to prove a prompt change improved anything. Hamel Husain's crash course is the field's reference teacher building evals on a real example in 50 minutes — watch it first, then build: a golden set (10 lectures you know cold, with the cards you'd accept), a scoring function, a regression run, and a number that moves. Then a prompt change becomes a measurement instead of an argument. Start with error analysis on real output, not with a metric. This is also what proves yesterday's prompt port didn't regress the moat.
3.5h
Direct Claude Code: finish the core loop
Upload a lecture → pipeline runs as Inngest steps → cards land in Postgres → review queue reads from Postgres. One feature at a time, ~45 min per cycle. Past 90 minutes means you bit off too much: revert and split.
2h
Loading and error states
A full lecture run takes minutes and sometimes fails. Every stage needs a visible state and a message that says what went wrong. This is the line between prototype and testable.
Objective checkChange one line of a prompt, run the eval, and state whether it got better with a number. That's the capability; the number is the evidence.
D9

Attack it, and price it

Immersion: security and cost. You attack your own app before a stranger does, and you learn what one lecture actually costs you.
12h
Return — RLS · rung 0  ·  pipeline stages · rung 31.5h
1.5h
Blank file, blank page
Write the full RLS policy set for v2 from the table names alone. Then, on paper, the ten stages of the v2 pipeline with each stage's input and output types. Diff both against the real thing. Whatever's still wrong on the fourth touch is what you genuinely don't own — write it down for the re-entry schedule.
Immersion — security and cost10.5h
3h
Attack your own app with two accountsSecurity
Create user A and user B. Logged in as A, try to reach B's data: edit IDs in the URL, call your API routes directly with curl, replay A's requests with B's record IDs swapped in. Every leak is a missing RLS policy or a missing server-side check. The highest-value hours in the ten days.
2h
Secrets sweep, dependencies, backupsSecurity
Search the whole repo — and git history, not just current files. A key committed on day 4 and deleted on day 6 is still public. The old repo has known leaked-key history, so this block is not optional for you. Rotate anything exposed, npm audit, Dependabot, Supabase point-in-time recovery, security headers.
3h
Cost, limits and abusePipeline
Your unit is a whole lecture, not a chat message. Token maths on a real 40-slide deck through ten stages, against the live Claude pricing page, not from memory: PDF pages cost both text and image tokens, batch processing halves the price, prompt caching cuts repeated context. Which stages can drop to a cheaper model (Haiku) without touching fidelity. Then: hard spend limit on the key, per-user rate limit, input length cap. By the end you can say what one lecture costs and what you'd have to charge — a number missing from every pricing conversation you've had.
1.5h
Long documents and image-only slidesPipeline
Chunking, context limits, why a 90-slide lecture isn't one call. And the trap the old app fell into: a diagram-only slide that never enters the pipeline is invisible to your coverage denominator — the guard reports 100% while a third of the lecture is missing. Decide and spec how v2 handles image-heavy slides from day one.
1h
Read your own codebase
Every file shipped this week, one sentence each, out loud, file closed. Rule 03 applied retroactively. Anything you can't explain, ask now — not during a demo.
Objective checkA cannot reach B's data by any route you tried. Zero secrets in git history. And you can state the cost of one lecture in dollars.
D10

Ship it, then study from it

Real URL, your own real lectures, and a Step 1 session inside the thing you built.
12h
Return — everything · rung 02h
2h
The integrate pass
Blank page, nothing open, no AI. Draw the whole of StudyFix v2 from the name alone: every page, every route, every table, every pipeline stage, where the key lives, where the auth check happens, what each guard's denominator is. This is the day-1 system map, ten layers later, from memory. Free recall at structure level — the highest-value retrieval act available, and the only measurement that distinguishes owning the mechanism from having memorised the outputs. Then open the repo and diff.
Immersion — ship10h
2h
Production deploy, properly
Every environment variable set in Vercel. Confirm every feature on the live URL, not locally — this catches the classic works-on-my-machine gap.
1.5h
Logging you can actually readPipeline
Per stage: what the model was sent, what came back, how long, what it cost, which guard fired, how many retries. Inngest gives you the step-level view free; add the content view. Without it a bad card is unexplainable; with it every complaint is traceable to a stage. Logs must not contain full prompts with personal data, or keys.
3h
Five of your own real lectures
Not a toy fixture. Five real Step 1 lectures you know cold, so you can judge the output as an expert. Write down every wrong card and which stage produced it. This is your own course architecture's rule — the exercise always runs on the learner's own real material, never a toy example.
2h
Cross-model auditPipeline
A model auditing its own output is the weakest possible floor — self-reflection fails systematically. Wire a genuinely different model family as the auditor, and make the configuration fail loud if no auditor is configured — a silent fallback to self-audit is exactly the kind of quiet downgrade your own honesty rules exist to prevent.
1.5h
Study from it, for real
One full Step 1 session, in the app, on the live URL, on your own material. This is the acceptance test for the entire 120 hours. If you don't want to use it, it isn't done — and now you know enough to say precisely why.
The barYou've shipped it and you've studied from it. For all ten pipeline stages you can name what goes in, what comes out, what it costs, and how you'd know if it got worse. And no one can tell you it's green when it isn't.

The security six — read now, and again on day 9

Almost every breach of a small app is one of six mistakes, none of them exotic. An AI will happily write code containing all six, because the code works — insecure code is not broken code, which is exactly why testing won't catch it.

MistakeWhat happensFix
Secret in the browserAnyone opens dev tools and takes your key. You find out from the bill.Keys server-side only. NEXT_PUBLIC_ means public. service_role never in client code.
No Row Level SecurityUser A reads everyone's rows by changing a number in a URL. RLS on every table, default-deny, scoped to auth.uid(). Verify with two accounts, not by reading the policy.
Auth checked in the UI onlyThe button is hidden; the endpoint isn't. One curl walks past it.Every route re-checks the session server-side. Hiding UI is cosmetics.
Trusting the request bodySomeone sends userId: "not-mine" and your app obeys.A schema on every endpoint. Identity comes from the session, never from the request.
Unlimited AI endpointOne person loops it overnight; you wake to a four-figure bill. Per-user rate limits, input length caps, hard spend limit on the key.
Trusting model outputUser text becomes instructions; the model is talked into a tool call it shouldn't make.Model output is untrusted input. Validate and scope every tool call server-side before it runs.

The security prompt — run before every commit

Review this code as a security auditor. For each issue give the
severity and the exact fix. Check specifically:
1. Any secret reachable from the browser
2. Any database access not protected by RLS
3. Any endpoint that doesn't re-verify the session server-side
4. Any user input used without schema validation
5. Any user identity taken from the request instead of the session
6. Any model output that gets executed, rendered as HTML,
   or used to build a query
7. Any AI endpoint without a rate limit or input size cap

Do not tell me it looks fine. Assume there is at least one issue
and find the most serious one.

When you're stuck

TypeLooks likeWhat to do
Environment"command not found", "module not found", works for everyone else Versions, reinstall, right folder. Search the exact error plus your OS.
Syntax / type"undefined is not a function", "cannot read property of undefined" Something is a different shape than you assumed. Print the variable. Nine times in ten it's null, or an array where you expected an object.
LogicRuns fine, wrong answer, no error at all The hardest kind. Print values at each step until reality diverges from what you expected. That line is the bug.
Integration401, 403, 429, 500, CORS, timeouts, "it works locally" Your code is probably fine. Keys, environment variables, permissions, RLS policies, quota.

Read the stack trace bottom-up: the last line is the error, the lines above are the path that got there. Ask by pasting the entire trace, not your summary of it — say what you expected, what happened, and what you already tried. Never "it doesn't work"; that sentence contains no information.

What you are deliberately not learning

All real, all useful, none load-bearing for shipping this. LAW 9 is the justification: far transfer is mostly a myth, so there is no general-thinking module to take — judgment falls out of a large store of concrete, stack-specific patterns plus reps at telling them apart.

And three study techniques your own research rules out: highlighting, rereading and summarisation are LOW utility (Dunlosky) — and passive re-watching belongs on that list with them. Mnemonics are a last resort for genuinely underivable facts, then tested — never the default. Multiple-choice self-quizzing is g=.24, statistically indistinguishable from zero. Produce; never pick.

After day 10 — the re-entry schedule

Honest evidence status — what I am and am not claiming

Built 2026-08-15, video-first revision same day. Course structure derived from business/strategy/COURSE_ARCHITECTURE.md, MANIFESTO.md §3.5 / LAWs 1–13, RECALL_MECHANISM_howard_2026-07-29.md, ELI5_ENCODING_howard_2026-08-01.md, engineering-plans/research/pedagogy_{foundation,evidence_pubmed}, learning_books_synthesis, make_it_stick_audit, STUDY_SYSTEM_research_based, STUDYFIX_MASTER_LESSONS.md. Stack decided 2026-08-15: greenfield TypeScript / Next.js / Supabase / Claude API / Inngest; the old Python codebase is not taught. All video and doc links verified via search 2026-08-15. Supersedes the doc-anchored 2026-08-15 build and LEARNING_APPS.md (deleted).