Full-stack web apps

The month after launch is a queue.

Every request in it goes to whoever built the thing, because nobody else can reach the data. A price that needs changing. A permission somebody should not have. A row entered wrong on a Tuesday that has been wrong ever since, and will stay wrong until a developer somewhere has an afternoon free.

You have working pages and no way to administer them. That is what a template gives you: the screens. It does not give you an admin surface, and it does not give you an authorisation model.

So the second month costs more than the first.

None of that is a design problem. It is an ownership problem, and it is decided by whether the data has a door in it that somebody other than a developer can open.

The constraint here is fixed before the first commit. It has to run without a paid service in the critical path, without a server that must be kept alive, and without a vendor whose pricing can move under you. That began as a budget decision and became a design one.

It changes the data model far more than it changes the deployment. Every list read is paginated with an explicit limit, counts come from an aggregation, and the database does the filtering a client would otherwise do in memory. How far that goes is the whole subject of the backend platforms service on this site; here it is the floor under everything else.

The deliverables do not vary by project, and they are the same on every engagement of this shape.

Interface, data layer and admin panel. Authentication and per-user authorisation. Responsive from 320px to 1920px, which is a measured floor rather than a claim about mobile.

Structured data and a prerendered body for search, because an application that draws itself in JavaScript hands a crawler an empty document and gets indexed as one. And the deployment, with the pipeline that redeploys it.

ClearHire, LabFlow, Trizlink and Aura CRM are full-stack builds of this shape, and each of them has its own page on this site with the work attached to it. React, TypeScript, Vite and Tailwind are the default set. A project with a good reason to differ gets that reason written down before we start.

My name is Ahsan Mahmood. There is nobody behind me. The person who models the data is the person who writes the access rules and the person who answers the email when a row comes out wrong.

The admin panel is the part that decides whether you still need me after launch. It is built for the person running the business rather than for the developer who wrote it.

Empty, loading, offline and error states are built with the feature rather than after it, because those are what a real user meets on a first run or a bad connection.

The first cost is that the invisible half takes as long as the visible half. You are paying for work that never appears in a screenshot.

The second is worth stating plainly. A green build is not evidence that a feature works.

On the site this one replaced, nine service URLs all rendered the same list page, because a parent route declared no outlet, and the postbuild step that writes the search body made crawlers see nine correct pages while every human saw one. Typecheck passed. The build was clean.

The defect was found by opening the URLs. That is the only method that finds that class of failure, and it is why an engagement here ends with the flows walked through rather than with the pipeline going green.

A working demo against the milestone, not a status update. That costs you a slot in your calendar every week for the length of the project. If something slipped you hear it that week, while there is still time to change what we do about it.

There is a third cost and it is smaller. The admin panel has to be designed as well as built, because a screen only its author can operate has moved the queue rather than removed it.

What this service does not include is written down at the same time as what it does. Visual design as a standalone deliverable. Native iOS. Blockchain work. Copywriting and content.

The third-party subscriptions the finished product needs to run are yours rather than mine. Any architecture that needs a paid service in the critical path gets flagged before it is built, not after. Thirty days of bug fixes at no charge, and after that nothing is automatic.

The invisible half costs what the visible half costs. That is the sentence people argue with on the call, and it is the one I have never found a way to move without moving the result along with it.