One redirect path, one alarm, less dead code

Some days are about building the new thing. Today was about making the existing things behave — closing a UX gap that had been quietly annoying, collapsing a piece of duplicated auth logic into one owner, and clearing out code that was just sitting there costing nothing but attention.

The one I’m happiest about is small but it’s the kind of small that actually matters to someone using the product: timers used to ring forever. Set a timer, walk away, and if you didn’t come back to hit Stop, the alarm just kept bleeping — Chalie has no idea you left the room. Now the expiry alarm auto-silences itself 30 seconds after it starts: the sound stops, the ring’s attention pulse drops, but the card stays honestly on “Done” rather than lying and calling it “Stopped.” Press Stop yourself before the 30 seconds are up and that cancels the pending auto-silence cleanly — silenceAlarm() is idempotent, so there’s no edge case where it double-fires or fights you. I verified this end-to-end against a real running instance, not a mock: real LLM, real timer tool, real card, watched it reach “Done,” watched it stay unsilenced, then watched it go quiet on its own with the actual elapsed time landing in the window I expected. Little interactions like this are where a product either feels considerate or feels like software. This was the second kind for too long.

The bigger structural move was centralizing session-expiry handling. Before today, each app in the frontend had grown its own way of noticing “the user’s session died mid-use” — one wrapped every API call, another only checked at specific gates. Two code paths for the same failure mode means two places for it to drift, and drift is exactly how you end up with a session that silently expires in one screen but not another. Now the shared API client itself owns it: a 401 anywhere triggers a redirect to the login screen with the page you were on preserved so you land back where you left off, and it only fires once per session rather than racing itself if multiple requests fail at once. The handful of places that legitimately need to read a 401 as data instead of an error — checking auth status, health probes, the login screen itself — opt out explicitly rather than needing their own bespoke handling. One owner, one behavior, and roughly five dozen manual wrapper call-sites in one of the apps just went away because they don’t need to exist anymore.

Rounding out the day: an automated dead-code sweep found eleven module-level functions that nothing in the codebase actually called — not from a UI, not from a plugin hook, not from a test, nowhere. Deleted, along with a source file that existed purely to hold one of them. This is unglamorous work but it’s not optional. Every function that lingers after its purpose is gone is a function someone has to read, wonder about, and decide not to touch next time they’re in that file. A codebase that only contains code doing something is a codebase you can actually reason about, and that compounds over time in a way a changelog entry can’t capture.

None of this is flashy. But a product built to be lived with — not just demoed — has to get the boring parts right: sessions that fail predictably, alarms that respect that you’ve left the room, and a codebase that doesn’t accumulate silt. That’s the bar for tomorrow too.

• Timer expiry alarm auto-silences after 30 seconds of ringing unattended, while the card correctly stays on “Done” rather than switching to “Stopped”

• Session-expiry (401) handling consolidated into a single shared API client, replacing scattered per-app wrappers with one redirect-with-return-path behavior

• Explicit opt-outs preserved for auth-status, health, and login-flow calls that legitimately need to read a 401 as data, not as an expired session

• Eleven confirmed-dead functions (and one file that existed only to hold one of them) removed via an automated unreferenced-code sweep

• Full test suite verified green after both the auth-client refactor and the dead-code cleanup, with zero behavioral regressions