A 10,177-line god file became a 1,409-line factory shell, then three feature sprints landed on top of it the same session: a unified Quest model, cross-session continuity, and an LM-driven NPC introduction marker. Five fast-forward merges to master, four agents reviewing each other's work, one P0 leak caught before it shipped.
The Router That Ate Everything
JefeAdventure's adventure_router.py had been growing since the Option B cutover — campaigns, sessions, combat, TTS, multiplayer WebSocket, the LM prompt builder, every marker parser. 10,177 lines. The plan was a pure mechanical move into routers/ subrouters with a route_surface regression test pinning all 105 routes (method, path, dependency identity) so any silently dropped auth dep would fail loud. Four batches across thirteen commits later the router is 1,409 lines of factory wiring and re-exports. Code-reviewer + security-engineer signed off; one near-miss caught when an IdentityResolver method lost its underscore prefix and the route_surface pin fired immediately.
Quest Model: One Source of Truth
First post-refactor sprint was the Quest Editor — until the implementing agent stopped halfway and reported the backend was split across two stores. The LM prompt read campaign.quests.active (rich dicts); the CRUD endpoints wrote campaign_goals.json::current_objectives (flat strings). A DM editing quests would have no effect on what the LM saw. Pivoted to a unified schema with stable UUIDs, status enum, by-id addressing, and a one-shot migration that lifts legacy strings without touching curator data on shipped campaigns. DBA caught a P0: GET /campaigns/{cid} returned the raw JSON including LM-private quest notes and DM notes to any campaign member. Redaction added before merge.
Continuity: Memory That Survives Sessions
story_beats had been read into the DM prompt forever but never written. Closed the loop with a rolling 5-message checkpoint that updates campaign.running_summary, an end-of-session wrap that appends 2-5 beats, and an auto-close-prior behavior that drops the 409 wall when starting a new session over a stale one. Security caught a real one: the summarization helpers concatenated raw player message content into the LM prompt with no envelope. A patient player could poison long-term campaign memory at one remove. Fixed with <player_message> envelopes, escape-on-input, and explicit anti-obey directives in the system prompt. Also gated auto-close on DM-or-admin to prevent one campaign member from thrashing another's session.
NPC Marker: One More Channel
Last sprint of the night: <<NPC name="X" race="Y" class="Z" role="..." disposition="...">>. The LM emits these when introducing recurring NPCs; the streaming pipeline parses, creates a character entry with is_npc: true, broadcasts a system.npc_introduced frame. Mirrors the ROLL marker pattern. Security flagged that unbounded field strings could land in campaign.party and amplify with every LM call — added length caps, a charset allowlist, and a hard party-size cap before merge.
Numbers
Tests went from 842 to 1,006 across the session, all green at every merge. adventure_router.py shrank 86%. Five master fast-forwards, each triggering a Forgejo deploy on Titan with a force-recreate of the adventure-api container; all five healthy after rebuild. The agent dispatch pattern (code-reviewer + security-engineer + dba-engineer in parallel after each backend sprint) caught three real findings that would have shipped otherwise — the dual-store split, the GET leak, and the prompt-injection-at-one-remove. Cross-disciplinary review isn't ceremonial; it pays.
What's Next
- Continuity frontend surfacing (auto-close warning, checkpoint indicator, admin wrap-summary panel) — agent still running at session end
- NPC frontend (PR2 display + PR3 recruit-to-PC) — backend shipped, frontend queued
- Eleven backlog items captured: route_surface partial-name fix, _campaign_locks unbounded growth, async wrap LM call to unblock start_session, story_beats shape normalization helper, more