elliotjlt/claude-skill-potions/retrospective

## Failed Attempts
 
| Approach | Why It Failed | Time Spent |
|----------|---------------|------------|
| [First thing tried] | [Specific reason] | [Estimate] |
| [Second thing tried] | [Specific reason] | [Estimate] |

## What Worked
 
**Final approach:** [One sentence summary]
 
**Key insight:** [The "aha" moment that unlocked the solution]
 
**Implementation:**
1.[Step 1]
2.[Step 2]
3.[Step 3]

## Learnings
 
**Would do differently:**
-[What you'd change next time]
 
**Surprised by:**
-[Unexpected discoveries]
 
**Reusable patterns:**
-[Anything worth extracting into a skill or snippet]

# Retrospective: [Task Name]
 
## Failed Attempts
 
| Approach | Why It Failed | Time Spent |
|----------|---------------|------------|
| ... | ... | ... |
 
## What Worked
 
**Final approach:** ...
 
**Key insight:** ...
 
**Implementation:**
1....
 
## Learnings
 
**Would do differently:**
-...
 
**Surprised by:**
-...
 
**Reusable patterns:**
-...
 
---
*Generated: [timestamp]*

# Retrospective: Fix Login Race Condition
 
## Failed Attempts
 
| Approach | Why It Failed | Time Spent |
|----------|---------------|------------|
| Added setTimeout delay | Worked locally, flaky in prod | 20 min |
| Moved auth check earlier | Still raced with state hydration | 15 min |
| Added loading state | Masked the bug, didn't fix it | 10 min |
 
## What Worked
 
**Final approach:** Used auth state machine with explicit "initializing" state
 
**Key insight:** The bug wasn't timing - it was a missing state. Auth had
three states (logged-in, logged-out, unknown) but code only handled two.
 
**Implementation:**
1.Added AuthState enum with INITIALIZING state
2.Protected routes check for INITIALIZING, show skeleton
3.Auth callback sets state atomically after validation
 
## Learnings
 
**Would do differently:**
-Check for missing states FIRST before adding timing hacks
 
**Surprised by:**
-The "loading" state we added was actually correct, just incomplete
 
**Reusable patterns:**
-State machines for auth (avoid boolean flags)

# Retrospective: Add CSV Export
 
## Failed Attempts
 
| Approach | Why It Failed | Time Spent |
|----------|---------------|------------|
| Client-side blob generation | Crashed on 10k+ rows | 30 min |
| Streaming response | CORS issues with download | 20 min |
 
## What Worked
 
**Final approach:** Server generates CSV, returns signed URL, client redirects
 
**Key insight:** Don't fight the browser. Redirecting to a file URL is the
native download UX.
 
**Implementation:**
1.POST /api/export triggers server-side generation
2.CSV written to temp storage with 5-min expiry
3.Return signed URL
4.Client does window.location = url
 
## Learnings
 
**Would do differently:**
-Start with server-side for any "export" feature
 
**Surprised by:**
-Signed URLs are trivial with modern cloud storage
 
**Reusable patterns:**
-Export pattern: generate server-side, return URL, redirect