1. The shell must be boring — and that's hard
Keeping the client thin is a discipline, not a default. Every feature wants to leak into the device: screen-off audio capture needed a proper microphone foreground service and wake-lock bridge; biometric login needed a WebAuthn shim for the WebView environment; browser microphone access has different rules than app microphone access. The lesson: a thin client is thick in exactly one place — its contract with the platform — and that contract deserves the same rigor as a public API. When the wake bridge silently version-drifted from the web UI, the fix wasn't code; it was making the UI display the bridge's absence ("NO WAKE") instead of failing silently.
2. Version every write or don't let an AI write
The build engine works because no generation is irreversible: the hub snapshots every file before overwriting it. Rollback turned "the AI broke my portal" from an incident into an undo. The corollary was learned the hard way early: syntax-check generated code before deploying it, because a hot-reloading server will faithfully hot-load a typo.
3. Grounded AI is a sensor problem before it's a reasoning problem
Code Coach's failure modes were almost never "the model is dumb." They were: a vision misread dropped a colon and the coach re-demanded the same fix forever; challenge scaffolding got seeded as if the learner had typed it; a "replace" whose text existed elsewhere was really a "move." Each fix was a grounding rule, not a smarter prompt. Systems that reason against live sensors need no-op guards, stub filters, and idempotent edit semantics — the model is the easy half.
4. State that agents share needs a referee
Once assistants could file appointments and tasks autonomously, shared state became a concurrency problem between humans and AIs. The answer was structural: one calendar both sides read and write, append-only audit journals for agent decisions, and the hard rule that an assistant may never claim an action happened without platform confirmation. Trust in an autonomous system is built out of receipts.
5. Infrastructure fights are the real curriculum
Two services silently fighting over one port caused an evening of crash-loops that looked exactly like application bugs; the fix was declaring a single canonical service. A terminal emulator that stuttered on phone browsers got replaced with a hand-rolled DOM-grid renderer. Streaming, GPU scheduling, and reverse-proxy WebSocket quirks each claimed their evenings. Running the full stack yourself — client, edge, server, GPU — is the fastest systems-engineering education available, because nothing is somebody else's layer.
6. Security has to be a peer feature, not a wrapper
The parts of Lumen that made it trustworthy enough to carry real life were security decisions made early: passkey-only login, capability-scoped device bridges, a documented threat model for device management with signed envelopes, single-use grants, and a local kill switch that outranks the server. The platform hosts a security-monitoring app — but more importantly, it is built like it expects to be attacked, because anything that aggregates your whole life should be.