SESSION-PRIME: paste body's fenced block into a fresh Claude session to orient fast

[TortoiseWolfe]

2026-08-21 — five merged, and one theme: gates that could not fail

PR	what it was
#891	#265 C13 — the .NET side owned NO schema; it inserted sequence_number = 0 and leaned on Supabase's trigger. Off that shared Postgres the 2nd message in any conversation dies on unique_sequence. Now ships its own artifact + a test that demonstrates the 23505 collision BEFORE applying the fix
#893	all twelve clause citations in AUTHORIZATION-CONTRACT.md pointed at the wrong line, two at blank lines. Cites by NAME now — line numbers into an append-only 3,535-line migration cannot be kept correct by discipline
#894	#575's exit criterion (production service-role key out of CI) had no guard and, as written, could never pass. Now a ratchet on TRIGGER, not presence
#896	#895 — the offline payment queue's auto-drain had zero callers and zero tests. Root cause was the guard order: it probed the network before checking whether anything was queued, so mounting it anywhere cost a Supabase query every 30s
#899	#559 — create-order claimed the idempotency key but never wrote it to the row, so idx_payment_intents_idempotency_key has never applied to a single catalog purchase

Four guards failed their own mutation tests before shipping — three by matching their own
explanatory comments rather than code. If you write a guard this session, break it on purpose
before believing it.

NEEDS THE OWNER — do not proceed on these without a decision

• payment_intents grants are wider than the migration states — anon still holds UPDATE, INSERT, DELETE, TRUNCATE #897 — production has NOT received Of the three 050-audit findings, only the dead UPDATE grant was still real — now fixed and generalised into a cross-check #565's revoke. DONE 2026-08-21 (PR fix(#897): narrow payment_intents grants, on production and in the migration #901).
  Executed against prod via the Management API and verified: anon now holds SELECT only,
  authenticated INSERT + SELECT — matching what the migration always claimed. The missing
  Admin can view all payment intents policy was restored too. authenticated INSERT stays
  until Feature 050 Phase 2c — close GAP 3: subscription price allowlist and revoke the client INSERT #559 T025 lands.
• Feature 050 Phase 2c — close GAP 3: subscription price allowlist and revoke the client INSERT #559 T025 is not implementable as written. create-order requires product_id and 400s
  without it; none of the three client write sites has a product. Giving it a
  client-supplied-amount path would reopen the hole T024 just closed.
• Edge functions are still NOT deployed by CI — no workflow runs functions/deploy, so
  every edge-function change is inert until deployed by hand. create-order was deployed
  2026-08-21 (v13 → v14, verified: bundle contains buildIntentRow, and an unauthenticated
  POST returns 401 from getAuthenticatedUserId rather than a boot error). Any future edge
  change needs the same manual step — a merge is not a deploy here.
• fix/898-raster-brand-marks has an unpushed commit. Not at risk — that work
  merged as PR fix(#898): accept raster brand marks, and refuse to rebrand without deciding #900 (96c4a594). The local branch is a leftover pointing at main.
• Nothing detects production schema drift — #897 sat undetected for three weeks #903 — nothing detects production schema drift. DONE 2026-08-21 (PR feat(#903): detect production security-schema drift on a schedule #905).
  prod-schema-drift.yml runs daily and on push; verified in CI twice, printing the real
  observation rather than a vacuous pass. Its centrepiece test feeds evaluate() the ACTUAL
  pre-fix payment_intents grants are wider than the migration states — anon still holds UPDATE, INSERT, DELETE, TRUNCATE #897 state and requires it to report both faults.
• /schedule is broken — NEXT_PUBLIC_CALENDAR_URL unset. NOT TRUE. Reported
  2026-08-22 and disproven four ways: the Variable has been set since 2026-02-08,
  deploy.yml:66 reads it from vars.*, the deploy log shows it passed to the build, and
  the literal is in the live bundle. A first-time visitor sees the CONSENT CARD
  (CalendarConsent.tsx:22-38), because the gate at CalendarEmbed.tsx:64-76 runs before
  the URL check. PR feat(smoke): prove the deployed bundle books at the intended calendar #916 added the smoke guard that was actually missing — verified in a real
  post-deploy run, 18 chunks scanned. Follow-ups Four NEXT_PUBLIC_* vars are read by the app but passed by no workflow — setting them today would do nothing #917 / No test asserts that a NEXT_PUBLIC_* the app reads is actually passed to the build #918 / /schedule shows a consent card before the calendar — the front door for every booking link #919.

Purpose: this issue is the durable roadmap for TortoiseWolfe/ScriptHammer. The body below is always-current — active arcs, next 3 sessions queued, backlog. Comments are the audit trail (what shipped + what changed in the roadmap, per session). The prime prompt at the top tells a fresh Claude session to read this body first.

---

Prime prompt (copy from here into a fresh Claude session)

/prep

Then check this issue (TortoiseWolfe/ScriptHammer#115) — its BODY is the current roadmap. Read everything below the prime prompt: active arcs, next 3 sessions queued, backlog. The most recent COMMENT on this issue is the audit trail of what changed since the previous session.

Supplementary context (read if the body's roadmap references them or if the user's first message takes us off-roadmap):
1. /home/TurtleWolfe/.claude/projects/-home-TurtleWolfe-repos-ScriptHammer/memory/MEMORY.md — top of the index has the most-recently-written memories.
2. `git log --oneline -20` — what shipped in the last couple of sessions.
3. Open issues: `gh issue list --repo TortoiseWolfe/ScriptHammer --state open`
4. Open PRs: `gh pr list --repo TortoiseWolfe/ScriptHammer --state open`

**Staleness is measured, not asserted.** This body ends with a generation stamp recording the commit it was written against, and `~/.claude/hooks/roadmap-drift.sh` reports at session start when commits have landed since. No drift warning means this body is current. If you saw one, believe the number — and note a *failed* check says "UNKNOWN", never zero.

Operational reminders you WILL trip over otherwise:

- **PRODUCTION STILL CANNOT TAKE MONEY (#629) — but the reason CHANGED on 2026-08-16.** The Stripe account is **verified**: `details_submitted`, `charges_enabled`, `payouts_enabled` all true, `currently_due` empty. Live keys EXIST. What remains is three changes plus a ceremony, and #629's body carries a 2026-08-17 audit of exactly which are done. **Two traps live in that audit:** step 4 is ALREADY DONE (all three recurring SKUs carry live `stripe_price_id`s — following the ticket literally creates duplicate live prices), and the DB holds LIVE price ids while the app runs in TEST mode, so activating those SKUs before the key swap breaks recurring checkout for real visitors. `active=false` is the only thing preventing that.

- **THE 2018-ERA STRIPE ACCOUNT LIES TWICE IF YOU LET IT.** (1) An UNPINNED read returns `null` for every `business_profile` field — always send `Stripe-Version: 2024-06-20`. (2) `business_profile` is **PER-MODE**: reading with the TEST key returns an empty profile that looks like "nothing is configured", while the LIVE key shows the real values. Both produced false "unconfigured" reports in one session.

- **THREE REQUIRED CHECKS, NOT TWO: `Test (20.x)`, `accessibility`, AND `E2E (local) result`.** The local lane was promoted to required once #739 closed. CLAUDE.md is now correct and guarded by `scripts/__tests__/required-checks-documented.test.js` (#782). A `gh pr merge` refusing with "base branch policy prohibits the merge" while the two documented checks are green is this, not a broken rule.

- **CLOUDFLARE NOW FRONTS THE SITE (#635 fixed 2026-08-17).** HTML serves `cache-control: no-cache`, `/_next/static/*` serves `max-age=31536000`, both with `cf-ray`. Guarded post-deploy by `scripts/ci/check-cache-headers.mjs`. **Do NOT try to do the HTML half with a Cache Rule** — Browser TTL only RAISES a value, will not go below the origin's own `max-age`, and ignores such values with NO API error (0/1/300 dropped, 700/12345 applied). It needs a Response Header Transform Rule. **Cloudflare ruleset edits take ~45s to propagate**; probing immediately reads the PREVIOUS rule and manufactures convincing wrong conclusions — it produced three in one session.

- **MAIL WORKS NOW, AND IT IS PROVEN, NOT INFERRED.** `admin@scripthammer.com` receives via Cloudflare Email Routing → `jonpohlner@gmail.com` (verified by a delivered message, and again by Google's own send-as confirmation arriving). Gmail *Send mail as* is configured through `smtp.resend.com:587`. Outbound is Resend; DKIM/SPF/`send` records survived the migration. Registrar is still Squarespace (#781).

- **GITHUB'S GRAPHQL ENDPOINT FLAKES; REST DOES NOT.** On 2026-08-17 `gh pr view --json`, `gh pr merge` and `gh issue view --json` returned 503s and a spurious "Bad credentials" for an hour while `gh api` (REST) stayed 200 throughout. When `gh` behaves impossibly, switch to `gh api` before believing the error. `mergeable_state` from REST is also the cheapest way to spot a conflict — it reads `dirty` long before any check reports.

- **A PUSH DURING A GITHUB INCIDENT CAN SILENTLY NOT TRIGGER CI.** A commit sat with ZERO workflow runs and a PR that looked merely "pending" forever. `gh api repos/OWNER/REPO/actions/runs?per_page=100 --jq '[.workflow_runs[]|select(.head_sha=="<sha>")]|length'` distinguishes "still running" from "never started".

- **`docker compose restart` DOES NOT RE-READ `.env`.** Interpolation happens at container CREATION; use `docker compose up -d`. This once ran the dev server for hours against a retired anon key, producing 401s that looked like an app bug.

- **A MIGRATION FILE IS NOT A MIGRATION.** Applying schema to prod is a deliberate step via `POST /v1/projects/{ref}/database/query` with the SQL from a FILE. Prod DRIFTS from the monolithic file — verify against the LIVE DB.

- **TICKETS CAN BE WRONG ABOUT THE SYMPTOM ITSELF, not just the fix.** #497 was titled "zero `postgres_changes` events"; the same shard delivered them seconds later. #391 asserted main was red on a gate that was green. #629 told you to create prices that already existed. **Verify the symptom before accepting the diagnosis.**

- **A PROBE THAT CANNOT REPORT FAILURE PROVES NOTHING.** The most expensive recurring lesson here. Make every probe fail on purpose before trusting a pass — **and confirm the mutation actually applied**: a `sed` whose `|` delimiter collided with `||` silently did not apply, the suite went green, and that green "proved" nothing.

- **GREEN JOBS CAN MEAN NOTHING RAN**, and a gate can fail for reasons that are not your code. 24 green jobs once hid Firefox and WebKit executing ZERO tests. Separately, `E2E (local) result` failed with **0 test failures** because only 23 of 24 shards uploaded an artifact — the gate correctly refusing to score partial data. Compare counts, never green/green.

- **ANOTHER AGENT — OR THE OWNER — MAY BE WORKING THIS SAME CHECKOUT.** Before `checkout -b`: confirm `git status` and HEAD. **If a PR shows commits you did not author, STOP.** And **run `git stash list` BEFORE any `git stash pop`** — `git stash push <pathspec>` does not match untracked files, so it can create nothing, and the following `pop` then applies SOMEONE ELSE'S stash into your branch. That happened on 2026-08-17; a conflicted pop keeps the entry, so nothing was lost, but only by luck.

- **`BASE_URL=…/ScriptHammer` + `page.goto('/docs')` measures the 404 page.** Use a real root build (`DISABLE_BASE_PATH=true`, then `serve out`). That build rewrites `public/manifest.json` (#392) — never `git add -A` after one. **`git push` REBUILDS `out/` with the default basePath**, silently invalidating a root build you are serving.

- **Canvas `fillStyle` DROPS THE ALPHA on a dimmed colour**, and `getComputedStyle` returns `oklch()` unparsed — read colours through a canvas.

- **Tailwind scans `tests/`**, so a spec's own string literals make Tailwind emit those classes (#396).

- Docker-first. Never `pnpm install`/`npx` on the host, never sudo. Commit from INSIDE the container so husky/lint-staged/gitleaks run; push from the host. **Builds go in their OWN container: `docker compose run --rm builder pnpm build`.**

- **`git push` RUNS A FULL CI GATE** (`.husky/pre-push`) and takes MINUTES. Never two at once; never `git push … | tail`.

- **CAPTCHA IS LIVE ON PROD (#353) and gates SIGN-IN AND RECOVERY.** E2E is unaffected — it authenticates with the SERVICE-ROLE key, which GoTrue exempts. Do NOT "fix" a spec by typing into the real form.

- **scripthammer.com RESOLUTION IS FLAKY ON THIS NETWORK, AND IT MASQUERADES AS BROKEN PRODUCTION.** `ERR_NAME_NOT_RESOLVED`/`NXDOMAIN` on every asset = **local DNS**, the site is fine; 404s on content-hashed CSS = a real retention bug. Measured 2026-08-17: Windows DNS points at the Belkin router (`192.168.2.1`), which took >300ms on 7 of 30 lookups while a public resolver failed none. Windows has **no global IPv6 address**, so IPv6 is not provisioned rather than broken. Cross-check with DoH before ever saying "prod is down". **Never persist an `/etc/hosts` entry** — the owner objected in the strongest terms and was right: it hides the real failure.

- **PUBLIC VALUES BELONG IN VARIABLES, NOT SECRETS (#787).** 21 of 24 variables had a same-named secret shadowing them; 20 were deleted 2026-08-17 (33 → 13). A write-only copy of a value that ships in the bundle buys nothing and cost an outage — the deploy read `vars.*` while the operator set `gh secret set`.

- **The FORK (RescueDogs → RaisedPaws) needs our non-3D fixes** → RescueDogs#56. NEVER port Cesium/Three.js. Always pass `--repo`.

- **`gh pr edit` is broken in this repo (#397)** — use `gh api -X PATCH repos/OWNER/REPO/pulls/N -F body=@body.md`. `gh issue edit` is fine.

- **`allow_auto_merge` is ON**; merge queue is unavailable (user-owned repo). Use `gh pr merge --auto --squash` — or REST when GraphQL is flaking.

Then either start on the roadmap's "next session should" item, or ask the user if they want to deviate.

Stop reading here when priming — everything below is the roadmap

---

Roadmap

Body regenerated 2026-08-22 (evening) against 992a1d58. #758 is CLOSED — not the ordering source.

#945 MERGED at 992a1d58 (2026-08-22 ~17:05Z) — 24/24 shards, all seven required green.
#944 is closed. The stamp below is against origin/main, not HEAD, which stays the right call.

🚨 Owner-only blockers (8, and this is now the binding constraint)

The unblocked backlog is thinning faster than the owner-decision queue. Four of these are new
since yesterday.

#629 — the money steps only: sk_live_ + pk_live_ + PAYMENT_MODE_EXPECTED=live +
activate the 3 SKUs last + one real card. #621 — rotate three credentials with no API.
#714 — 3D Warehouse licensing, inherited by every fork. #769 — receipt address,
MCC 5734→7372.

NEW: #393 — the CSP now ships as a real header in report-only; flipping it to
enforcing is a dashboard change and an acceptance of risk. #822 — DMARC is p=none, so the
domain that sends payment receipts can be spoofed. #462 — 181 /80 and /85 text
instances: needs a policy call (ban opacity for de-emphasis, or audit 94 files per surface),
not a sweep. #442 — the privacy policy must disclose Cloudflare Turnstile; that is legal
copy an agent should not author.

---

The arc that closed: CI reliability

Promoted on 2026-08-17 because every PR that day needed a re-run and not once for a failing
test. It is done. Since then 14 PRs landed, every one green on its first attempt, with a
single re-run spent all session — and that one was a genuine Azure apt-mirror outage, not a
defect.

Every fix up to 2026-08-18 hardened the install; it stayed fallible, so the arc stayed open.
#762 and #798 (a wall-clock timeout cannot tell slow from stalled — bound the silence instead),
#801/#802 (cache the apt debs; 17.7m → 1.0m), #809 (the idle bound, whose catch was then
demonstrated for real during the mirror outage), #766 (upload the traces the lane already pays to
capture), #726 (the budget guard can now see which backend it meters). Each lowered the odds or
the cost of a failure. None removed it: 24 network fetches per run, every one able to go dark on
its own.

2026-08-19 closed the arc by deleting the operation (#829, PRs #830 + #833) — a different kind
of change, and the reason this section moves from "active" to "closed" rather than just getting a
better number. There is no fetch to retry, no mirror to be down, no dpkg lock to orphan, no retry
loop to fall through. The failure class is unreachable rather than damped, which is what makes it
finishable at all.

The clearest illustration is a branch deleted the same night. fix/795-install-failure-is-loud
(412fc86c, never merged) made a failed install fail its job loudly at all ten sites — correct
work, and instantly moot: nothing can fall through a step that no longer exists.

No workflow installs browsers on a runner any more — every lane runs from
mcr.microsoft.com/playwright:v1.55.0-noble, which already ships them. The payoff is measured on
two consecutive commits of main: 6a4e8f57 (installs present) failed 8 jobs, every one in
Install Playwright, with zero test failures; d45cfdc2 ran 26 jobs green, 0 install steps.
Before, each shard spent a median 11.6 min installing — ~158 runner-minutes per run across 24
independent network fetches.

Three of the four lanes are PROVEN: e2e-local 26/26 across chromium/firefox/webkit,
signup-mailer green with a real Mailpit round-trip, and smoke green against live
production. e2e.yml's seven sites are migrated but unexercised — the cloud-quota guard
skips every downstream job until the window reopens (~Sept 2). Treat it as unproven.

#795 and #819 closed against that evidence rather than being fixed.

The recurring theme, again: controls whose presence was asserted and whose effect never was
— a CSP delivered as <meta name> and therefore inert, an email-health gate stuck in
annotate, a keepalive listing two projects that could never answer, a guard reading an env var
nothing passed.

---

The arc that opened and mostly closed in one night: gates that could not fail (#396)

Started 2026-08-19 as routine backlog work and turned into the most productive thread of the
session. Nine PRs, and the mechanism matters more than the count.

#846 added a reporter that names any test finishing with zero assertions. #847 fixed it,
because the first version printed nothing in CI: playwright test --reporter=X REPLACES the
config's reporter array rather than appending, so it ran in the two lanes that do not override
and in none of the 25 required-lane shards. That is the catalogue's own pattern, committed by
the tool built to detect it, and it was caught only by grepping a real run for the reporter's
own output.

Its first real output named 31 tests. Triage is at 15, recorded in #850, and the split
is the point: roughly half are not defects. checkA11y() throws instead of calling expect,
so four names assert without a countable step; one says "if present" in its own title. What
the other half found:

what	where
a live 139x40px submit button — the gate only ever looked at /	#848
expect(alt).toBeDefined() — getAttribute returns null, and null IS defined	#849
the tables gate visited the blog INDEX; zero <table> on any public route	#851
a test whose body only called console.warn; another that asserted nothing at all	#852
button[aria-label="Navigation menu"] — the hamburger is a <label>, so the whole body never ran	#853

Also closed in the same thread: validate:breakpoints ran in CI and could not fail (#841 — a
lost coverage floor was a warning, and the exit code keys off errors), and the required lane's
own header still called itself a PROTOTYPE (#840).

The rule that came out of it: measure what a selector finds on the route the test visits,
BEFORE reading the test. That turned eight candidates into two defects and six acquittals in a
single pass.

---

The arc that opened 2026-08-22: the fork path, proven by forking it

This did not exist yesterday because nobody had forked the template end-to-end before. Doing it
for real — TortoiseWolfe/geolarp, from rebrand.sh to a live site on its own domain with its own
Supabase — surfaced ten defects in the one workflow this repo exists to provide. They are not
cosmetic and they are not hypothetical; each was found by the fork failing, not by reading code.

The keystone is #922. rebrand.sh discovers files with find plus an extension allowlist.
That single choice is upstream of most of the rest: the allowlist excludes .mjs/.cjs, and the
comment in the script explains it cannot widen safely because find has no notion of what git
tracks (adding three suffixes pulls in 1,746 files, 1,581 of them in caches and a vendored
virtualenv). Its own comment already proposes git ls-files. Fix that and the widening becomes
safe, which is what #939 and part of #926 actually need.

That comment also judged the residual .mjs gap "cosmetic — ~8 doc strings". #939 is the
counter-example, and it is the most serious item here: a fork's service worker stamped
scripthammer- caches while purging geolarp- ones, so every deploy left caches that could never
be collected. Live on geolarp.com. Unbounded storage growth in visitors' browsers.

#922	find → git ls-files — the keystone
#939	fork service workers never purge their caches (fixed downstream, latent here)
#926	brand token rewritten inside GitHub URLs → 404s (#937 closed as its duplicate)
#933	case variants survive, so every fork's intro post is still titled Scripthammer …
#936	every fork republishes this template's blog under its own name
#938	deleting or editing a blog post is a silent no-op
#923	DESCRIPTION applied to package.json only
#931	dev server rewrites tracked manifest.json/robots.txt — caught 3× in one session
#932	the container crashloops in a git worktree, the workflow CLAUDE.md recommends

PROGRESS 2026-08-22 (evening). Three of these are fixed and in review, in the order the
keystone argument predicted:

#922	find → git ls-files	PR #946, 6/7, queued on E2E (local)
#939	derived cache prefix	PR #947, 6/7 — and #922 had already killed the live bug, so this is hardening; the ticket's severity was revised rather than left overstated
#931	manifest fossil	PR #948, 6/7 — the reported dirt was the smaller defect; the test's cleanup ran git checkout -- and silently discarded uncommitted work
#937	—	closed as a duplicate of #926, with its extra evidence folded into #926's body rather than lost

Two NEW issues came out of the same work, both about the fork/parent split:

• A fork inherits the E2E budget guard but starts at zero runs, so it re-enables the lane this repo has blocked — against a backend the guard is not metering #949 — a fork inherits the E2E budget guard but starts at zero runs, so it re-enables the
  hosted lane this repo has blocked, against a Supabase project the guard is not metering. Its
  BACKEND_EPOCH_PROJECT_REF is hardcoded to this repo's project, and the The E2E budget guard counts workflow runs, not Supabase — it cannot see a backend swap #726 mismatch
  detector is inert here (the variable is unset) and merely advisory there.
• e2e-local runs 26 jobs (16 of them firefox/webkit) on every PR and push, and is now queue-bound: 26-89 min wall, gating every merge #950 — e2e-local runs 26 jobs (16 firefox/webkit) on every PR and push, is now
  queue-bound (26–89 min wall, four runs stacked ~90 min today), and is a required check, so
  it gates every merge. Its design reasoning is sound; the assumption that has expired is "all
  24 can run at once".

geoLARP is now a live proving ground rather than a hypothetical. Every defect above came from
it; several are already fixed downstream with mutation-tested guards that can be ported straight
back (#929 was, as #930). Expect the next fork-shaped defect to be found the same way.

---

Active arc — #559, the payment-write lockdown (UNBLOCKED 2026-08-19)

Corrected the same day it was written: this issue was listed as blocked, and it is not. Both
stated blockers (#556, #558) are closed and Phase 2b shipped as #560.

T024 is already done — the recurring-price allowlist landed as #772 (Stripe) and #774
(PayPal); both refuse a client-sent identifier outright and resolve from the catalog.

Remaining, and ordering is load-bearing:

• T025 — migrate three client write sites behind create-order:
  payment-service.ts:179 (insert), :371 (upsert), offline-queue/payment-adapter.ts:166
  (upsert). The queue drain is the awkward one — it replays with no live user gesture,
  so create-order needs an idempotency-keyed path. Do not discover this at the end.
• T026 — re-enumerate .from('payment_intents'); confirm zero writes remain.
• T027 — drop the client INSERT policy and INSERT from the GRANT. UPDATE is
  already revoked (Of the three 050-audit findings, only the dead UPDATE grant was still real — now fixed and generalised into a cross-check #565), so this is one privilege, not two.
• T028 — E2E: browser INSERT refused with a pinned status; off-catalog price 4xx.

T027 must not run before T026 passes, or dropping the grant with an unmigrated write site
breaks payments silently rather than loudly.

Multi-session. The other unblocked items below are smaller and can interleave.

The other constraint is the owner-decision queue above, which now outnumbers the unblocked
engineering work.

---

Next 3 sessions queued

Session +1: #950 — stop e2e-local gating every merge

• Why: it is the required check, it is queue-bound, and three PRs sat at 6/7 for over an hour
  today waiting on it. Highest leverage available: e2e.yml already gates firefox/webkit behind
  a full-e2e label, and applying the same gate here removes 16 of 26 jobs from the common path
  at no backend cost, because the local lane has no shared backend to protect.
• First action: read .github/workflows/e2e-local.yml:25-45 before changing anything. The header
  argues its shape deliberately and the argument is right — the caps in e2e.yml exist to protect
  one shared cloud project. Do NOT copy those. The lever that applies here is the label gate,
  which is about latency, not contention, and the header does not address it.

Session +2: the rest of the fork arc — #926, #933, #936, #938, #923

• Why: rebrand.sh sweeps with find, so it rewrites gitignored caches and a vendored virtualenv — use git ls-files #922 makes most of them tractable, and each is small now that discovery is honest.
  rebrand.sh rewrites the brand token inside GitHub URLs, so every fork's inherited doc links 404 #926 (URLs rewritten into 404s) and rebrand.sh misses case variants, so every fork's intro post is still titled 'Scripthammer - Opinionated Next.js PWA Template' #933 (case variants) are the two a reader of a fork sees.
• First action: rebrand.sh misses case variants, so every fork's intro post is still titled 'Scripthammer - Opinionated Next.js PWA Template' #933 first. Its fix is a case-preserving substitution, and rebrand.sh rewrites the brand token inside GitHub URLs, so every fork's inherited doc links 404 #926's fix depends on
  deciding which URLs are citations rather than branding — a smaller decision once rebrand.sh misses case variants, so every fork's intro post is still titled 'Scripthammer - Opinionated Next.js PWA Template' #933 has
  settled how substitution works.

Session +3: #850 — finish triaging the 31 zero-assertion tests

• Why: carried forward untouched across three sessions. Still the best yield-per-hour available;
  16 remain and the reporter cannot become a GATE until the list is empty.
• First action: measure what each remaining selector finds on the route its test visits, before
  reading the test.

Standing p1, not displaced: #559 T025–T028, the payment-write lockdown. It has not moved in
three sessions. That is worth noticing rather than repeating — if it keeps not moving, it should
be re-scoped or explicitly parked, not silently carried.

---

Backlog (no scheduled position)

• DECIDED (delete): the admin IP column and burst panel can never populate — no IP source exists and the architecture has nowhere to observe one #839 — the admin console renders an IP column and a burst panel that can never populate;
  nothing writes an IP. Split out of auth_audit_logs records no IP — but the 'nothing to rate-limit on' premise was our own test suite (#608) #609. The decision (capture vs delete) is an owner call and
  touches the same privacy ground as Turnstile is live on the auth forms but the privacy policy never mentions Cloudflare, and invisible mode requires that reference #442.
• A Remember Me test asserts a cookie expiry, and this app never sets an auth cookie #845 — a "Remember Me" test asserts a cookie expiry, and this app never sets an auth
  cookie; the session lives in local/sessionStorage. Small, but needs a runnable auth lane.
• A live blog post and the forking guide teach the #293 build command that 500s every route #835's archaeology — 17 files under docs/specs/, specs/, features/ still carry the
  A production build kills the running dev server (.next clobbered despite NEXT_DIST_DIR) #293 build command. Live guidance is fixed; whether to rewrite historical spec records is a
  separate decision.
• CI gates that cannot block a merge — all four workflows are now requirable; the branch-protection flip is the last step #572 — items 2, 5 and 6 remain, all owner decisions. Item 5's failure statistic no longer
  reproduces and its missing PR trigger is deliberate — arguably close-as-documented.
• Replies to admin@scripthammer.com still leave from a personal Gmail — Send-as via Resend SMTP is the last step (DNS half done) #368 — Send-as configured; verify a reply actually leaves as @scripthammer.com.
• Registrar is Squarespace, so nameservers and DNSSEC are the two things no token can touch — transfer to Cloudflare Registrar #781 — registrar transfer. Nameservers and DNSSEC already moved by hand; what remains is
  a paid, multi-day transfer at Squarespace, and both domains are transfer-locked. Practical
  window closes ~mid-November (expiry 2026-12-06).
• Decide the fate of the 17 bare components the structure validator could not see #547 / New-contributor on-ramp: no good-first-issues, no CoC, no PR template #516 — need a judgement call, not a mechanical fix (17 bare components; CoC and
  contribution policy).
• [EPIC] Enterprise-ready: make ScriptHammer a repo you can build real work on (eval-3 → eval-1) #280 enterprise arc, Chatt twin coverage: match the official Chattanooga city-limits boundary (nothing more/less) — phased 8k→100k #326 city-limits coverage, Chatt diorama: add FPS / first-person 'ground game' mode (paintball, football, Civil War reenactment, militia war-games) #226 diorama FPS.
• 18 issues in the 3d/diorama arc, deferred by decision — but core for a geoLARP fork,
  where /twins/[slug]?ortho freezes the main thread for 4.7s (17.8s total blocking) — the E2E click timeout is real #717, Invisible glass walls: 43% of landmark faces are culled at render and still solid in collision #713, ?walk on a slug with no walkable terrain stalls in orbit silently #727 and Bake an offline address index so the twin can show real street addresses #708–Minimap, compass, and waypoints in the Directory panel #712 stop being backlog.
• Three admin E2E specs cannot run in CI: the shared test user is not an admin, the demo seed cannot apply, and one test asserts nothing by construction #914 — three admin E2E specs cannot run in CI. Admin E2E specs call themselves local-only but resolve to PRODUCTION in the default config — only a hardcoded CI=true stops them seeding an admin there #944 is CLOSED (fix(#944,#914): refuse a non-local backend, and seed an isolated admin #945, 992a1d58): they
  now refuse a non-local backend and seed an isolated admin instead of using the shared test user.
  Steps 5–7 remain, and are sequenced behind the DECIDED (delete): the admin IP column and burst panel can never populate — no IP source exists and the architecture has nowhere to observe one #839 decision.
• /schedule shows a consent card before the calendar — the front door for every booking link #919 — /schedule shows a consent card before the calendar, on the front door for bookings.
• The geoLARP fork's own tickets — TortoiseWolfe/geolarp#25 (the a11y job fails on a missing
  CI chromium, so the stale-HTML guard never runs) and #26 (24 E2E jobs inherited wholesale,
  14 failing, and no coverage of the one path that matters: signup). Not this repo's issues, but
  they are the template's tests failing in a fork, so they are evidence about the template.

---

Next session should

Take #950. e2e-local is a required check that is now queue-bound, so it gates every merge in
the repo — three PRs were stuck at 6/7 behind it today. The lever already exists in the other
lane: gate firefox and webkit behind a full-e2e label, chromium-only on PRs.

State at hand-off: main is green at 992a1d58 (#945 merged). PRs #946, #947 and #948 are
open, each 6 of 7 required green, all waiting on the same E2E (local) result. Nothing has
failed. A local merge sequence was running them; if it is not still alive, merge them by hand
after verifying 7/7 — they are independent and touch no overlapping files.

Cautions carried forward, all learned by being wrong first:

1. gh run view <id> --log truncates, and sometimes returns zero bytes. Fetch per job via
   gh api repos/OWNER/REPO/actions/jobs/<jid>/logs, or reproduce locally.
2. Never put a closing keyword next to an issue number in a PR body, even to deny it.
3. A probe that reports success is not evidence of success. Three written on 2026-08-22 were
   wrong in the same direction: one counted an unreported check as passing, one printed "all 4
   gates green" while listing a failure, and one fell through a timeout silently so nothing merged
   and nothing said so. Make every probe fail on purpose before trusting a pass, and verify a
   gate independently before merging on it.
4. Run what CI runs. pnpm test:coverage is ~4,700 tests; a blog-subset run passed locally and
   failed CI. And never put a formatter and a test run in the same command — three false failures
   came from prettier rewriting files while tests read them.
5. Measure before attributing. "geoLARP's E2E is starving the runners" was asserted from job
   counts and was backwards: ScriptHammer's own e2e-local is the 89-minute, 24-shard lane.

---

Why this exists

Sessions end. The next session starts cold. Without a single canonical "what was the world like when we last stopped + here's what to do next" pointer, the new model wastes context wandering. This issue is the one URL to paste into a fresh chat. The BODY carries the plan; comments form the audit trail.

How to maintain

Run /session-prime at session-end. The skill rewrites the body to reflect what changed in the roadmap and appends a comment with the audit trail.

If the prime prompt itself becomes stale (memory file renamed, project changed shape), edit the body's prime-prompt block directly.

[TortoiseWolfe]

Issue seeded 2026-05-28 ~19:30 EDT

This is the baseline, not a session-end log. The rolling-prime issue was created via /session-prime from a different repo's session. No work happened on ScriptHammer this session. Use this comment as the starting snapshot; future /session-prime runs will add real session-end deltas on top.

Current branch: chore/fork-experience-cleanup (not main).

Last 10 commits on this branch:

• 82b264f — chore(auth): remove dead middleware; document client-side route protection
• 501567c — chore(rebrand): document the 5-reference threshold
• 8d85330 — docs(fork-checklist): fix rebrand.sh usage line
• 174e5ac — feat(payments): Phase 0b — create-stripe-subscription + fix webhook template_user_id ([Phase 0b] Stripe subscription: create-stripe-subscription (~3h) #102) (feat(payments): Phase 0b — create-stripe-subscription + fix webhook template_user_id (closes #102) #111)
• 6180134 — feat(payments): Phase 0a — create-stripe-checkout + verify-stripe-session ([Phase 0a] Stripe one-off: create-stripe-checkout + verify-stripe-session (~6h) #101) (feat(payments): Phase 0a — create-stripe-checkout + verify-stripe-session (closes #101) #110)
• 5a9bec8 — docs(payments): rewrite PAYMENT-DEPLOYMENT.md + add check-payment-config.sh (docs(payments): rewrite PAYMENT-DEPLOYMENT.md + add config verifier script #99)
• c6cb675 — fix(scroll): round 14a — data-show-scroll-button attribute for E2E observability (fix(scroll): round 14a — data-show-scroll-button attribute (E2E observability for the jump-button race) #108)
• a29d3b9 — fix(e2e): round 13 — exclude handleReAuthModal duration from SC-001 budget (fix(e2e): round 13 — SC-001 timing budget excludes handleReAuthModal duration #107)
• c24b9f6 — feat: [Feature] 047 Three.js Game #48 Three.js Game at /game/3d (047 — full SpecKit cascade) (feat: #48 Three.js Game at /game/3d (047 — full SpecKit cascade) #95)
• 95efd86 — fix(e2e): feat: #48 Three.js Game at /game/3d (047 — full SpecKit cascade) #95-blocker round 12 — handleReAuthModal retries when modal re-appears (fix(e2e): round 12 — handleReAuthModal retries when modal re-appears (WebKit Argon2id flake) #98)

Open PR: #114 — chore: fork-experience cleanup (the cleanup arc this branch is for)

Recently closed (last 7d): #101 (Phase 0a Stripe one-off), #102 (Phase 0b Stripe subscription)

Open issues: mostly template-v1-out-of-scope (Eval-Backlog + Gap-Audit categories — deferred backlog, not active work):

• [Eval-Backlog] PAYMENT-OFFLINE-UI: UI layer for existing offline payment queue #4, [Eval-Backlog] SUBSCRIPTION-MGMT: subscription management route + 4 edge functions + grace-period wiring #5 — payment offline UI + subscription management (Eval-Backlog)
• [Gap-Audit] 005 Security Hardening: complete session-timeout UI + audit dashboard + secret detection #23, [Gap-Audit] 010 Unified Blog: implement offline editing + sync + conflict resolution + migration tooling #25, [Gap-Audit] 011 + 043 Group Chats / Group Service: implement 8 stub member-management methods #26, [Gap-Audit] 012 + 014: welcome message admin gate end-to-end flow #27, [Gap-Audit] 016 Messaging Critical Fixes: 5 separate UX issues, none shipped #30, [Gap-Audit] 020 PWA Background Sync: Firefox/Safari fallback + retry UI + storage warnings #32, [Gap-Audit] 023 EmailJS Integration: provider health dashboard + rate-limit handling #34, [Gap-Audit] 026 Unified Messaging Sidebar: mobile drawer transitions + badge sync latency #35 — Gap-Audit items (P2/P3, deferred)
• And ~30+ more Gap-Audit issues open

Active work:

• Fork-experience cleanup on chore/fork-experience-cleanup (PR chore: fork-experience cleanup (#112, #113, dead middleware) #114 open)
• Payments phase arc — Phase 0a + 0b shipped, future phases TBD

Watch:

• Open PR chore: fork-experience cleanup (#112, #113, dead middleware) #114 — needs to land before fork-experience work concludes
• Phase 0c+ of Stripe payments — sequencing TBD

Next session should: Read memory/MEMORY.md (NON-NEGOTIABLE preferences at top), then check PR #114 status, then ask the user what to focus on (fork-experience cleanup, payments phase 0c, or pulling something off the Gap-Audit backlog).

[TortoiseWolfe]

Body migrated to roadmap format 2026-05-28 ~20:00 EDT

The /session-prime skill was refined to make the issue body carry an explicit roadmap (active arc → next 3 sessions → backlog) instead of just being a pointer to memory. The body above now follows that structure.

Important caveat: ScriptHammer's roadmap is inferred from repo state, not user-confirmed. I haven't actually worked in this repo this session — I'm in Eduity. The active arc (fork-experience cleanup) and queued sessions (PR #114 → Payments Phase 0c → Gap-Audit P2) are guesses based on:

• Current branch chore/fork-experience-cleanup
• Open PR chore: fork-experience cleanup (#112, #113, dead middleware) #114
• Recent commits (payments Phase 0a + 0b shipped, fork-checklist polish)
• Pattern of fix-round commits suggesting E2E stability is recurring

First real session that sits down to work in ScriptHammer should:

1. Read the inferred roadmap
2. Correct the active arc + queued sessions to match real intent
3. Run /session-prime at session-end to lock in the corrected version

The body's "Next session should" line + the "Override: if the user's first message has a different priority" note are explicit about the inference uncertainty. Don't treat the roadmap as binding until a real ScriptHammer session has validated it.

[TortoiseWolfe]

Session 2026-05-29 — roadmap reconciled against real repo state

The body was previously flagged as inferred, not user-confirmed. This session verified it against the actual repo and corrected it:

• PR chore: fork-experience cleanup (#112, #113, dead middleware) #114 (fork-experience cleanup) confirmed MERGED 2026-05-28 (cb35131); 0 open PRs. The "land PR chore: fork-experience cleanup (#112, #113, dead middleware) #114" next-step was already done — removed.
• [Feature] 047 Three.js Game #48 (Three.js game) verified already shipped — c24b9f6 / PR feat: #48 Three.js Game at /game/3d (047 — full SpecKit cascade) #95, route src/app/game/3d/page.tsx, all 7 game components in the 5-file pattern, theme reactivity, reduced-motion, WebGL fallback, E2E + a11y tests, documented Pa11y exclusion. → marked close-as-done.
• Un-deferred backlog triaged (issues NOT tagged template-v1-out-of-scope): perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116, Live a11y overlay (dev-time axe overlay panel) #80, [Feature] 047 Three.js Game #48, [Round 14b] Seed deterministic conversation data for messaging-scroll spec (~2h, follow-up) #109, [Gap-Audit] 044 Error Handler Integrations: Sentry/LogRocket integration + PII scrubbing + session replay #45. Verified each against repo state.

New queued order (ready/dependency-based):

1. Close [Feature] 047 Three.js Game #48 (done) → [Round 14b] Seed deterministic conversation data for messaging-scroll spec (~2h, follow-up) #109 (seed messaging-scroll E2E data, ready, ~2–4h) → Live a11y overlay (dev-time axe overlay panel) #80 (axe a11y overlay, ready, ~2–4h)
2. perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116 (messaging E2E 10× slow) — needs a scoping decision (trace-profile → split shards vs. reduce Argon2 cost vs. mock data)
3. [Gap-Audit] 044 Error Handler Integrations: Sentry/LogRocket integration + PII scrubbing + session replay #45 (Sentry/LogRocket) — blocked on Sentry-vs-LogRocket decision + account/DSN

Payments Phase 0c–0f (#103–106, #100) is P1 but template-v1-out-of-scope → kept in Backlog as a promotable arc, not queued.

Active arc changed: fork-experience cleanup → work the un-deferred backlog.

[TortoiseWolfe]

Session ended 2026-05-30 ~15:00 ET

Shipped (1 commit, on origin/main):

• 4634828 — test(e2e): [Round 14b] Seed deterministic conversation data for messaging-scroll spec (~2h, follow-up) #109 messaging-scroll isolated static fixture (PR test(e2e): #109 isolated static fixture for messaging-scroll (verified) #118). All three *-msg shards green (chromium 28m / firefox 31m / webkit 23m); also verified locally in a real browser before push (30 bubbles, scrollHeight 3136, distanceFromBottom 600 > 500).

Closed: #48 (Three.js game — verified already shipped via c24b9f6/PR #95), #109 (messaging-scroll seed — done via #118)

Opened: none (PR #117 was a discarded earlier #109 attempt — closed without merge, branch deleted; PR #118 is the merged version)

Roadmap changes (body vs. previous):

• Active arc: two of four ready un-deferred items now done ([Feature] 047 Three.js Game #48, [Round 14b] Seed deterministic conversation data for messaging-scroll spec (~2h, follow-up) #109 marked [x]). Remaining ready item is Live a11y overlay (dev-time axe overlay panel) #80.
• Promoted to Session +1: Live a11y overlay (dev-time axe overlay panel) #80 (was Session +1's "then Live a11y overlay (dev-time axe overlay panel) #80"; now the sole do-next).
• Demoted/removed: [Feature] 047 Three.js Game #48 + [Round 14b] Seed deterministic conversation data for messaging-scroll spec (~2h, follow-up) #109 dropped from the queue and from the "Three.js DONE" backlog note (now closed, not pending-close).
• New backlog item: "[Round 14b] Seed deterministic conversation data for messaging-scroll spec (~2h, follow-up) #109 patterns now available for reuse" — the isolated-fixture approach (throwaway createTestUser immune to the cleanupOldMessages shared-user race) as a template for future messaging-data tests; relevant to perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116's "mock data" option.
• Prime prompt: added the MCP secure-context reminder (use 127.0.0.1 not host.docker.internal, else crypto.subtle is undefined and encrypted threads never render) — the trap that cost two failed [Round 14b] Seed deterministic conversation data for messaging-scroll spec (~2h, follow-up) #109 CI cycles this session.

Process note (#109 took 3 attempts): first two seeded the shared PRIMARY↔TERTIARY conversation, which ~7 specs wipe via cleanupOldMessages (delete-by-shared-user-sender_id). Root cause was a cleanup race, not encryption (mis-diagnosed twice). Fix: an isolated throwaway-user fixture nothing else touches. Local verification was blocked the whole time by a secure-context gotcha (now in memory).

Watch: none (no time-sensitive items).

Next session should: Start #80 (dev-time axe a11y overlay, ~2–4h, ready-now) — branch off main, scaffold a dev-only floating panel, add axe-core gated on NODE_ENV === 'development', list violations with click-to-highlight, gates, PR.

[TortoiseWolfe]

Session audit — 2026-06-01

Shipped #80 (dev-time axe a11y overlay) → PR #119 merged as 95eb6c8, #80 closed.

What landed:

• src/components/organisms/A11yDevOverlay/ (5-file pattern + useA11yScan.ts hook) — collapsed badge → expandable panel, impact filter chips, rule-id search, MutationObserver live re-scan, route-change re-scan, click-to-highlight, manual re-scan.
• Mounted in src/app/layout.tsx behind process.env.NODE_ENV === 'development'.
• axe-core@^4.12.0 added as a devDependency.

Root-cause lesson (worth keeping): the first prod build dragged the full ~1.3 MB axe-core engine into vendor.js. Cause: the NODE_ENV guard was routed through an enabled variable, which defeats webpack's dead-code analysis of import(). Fix: wrap the dynamic import('axe-core') in a literal process.env.NODE_ENV === 'development' check (loadAxe() in useA11yScan.ts) so DefinePlugin + webpack statically eliminate it. Re-verified against a clean baseline: engine fully stripped (vendor.js −576 KB; A11yDevOverlay referenced 0× in the served layout chunk).

Verification: full CI green (Build, Test 20.x, Validate Component Structure, accessibility, 28-shard E2E across chromium/firefox/webkit gen+msg). Live E2E via dev server — badge surfaced a real landmark-unique finding; filter/search/highlight confirmed working; 0 console errors.

Hygiene: squash-merged, remote + local branch deleted, main synced to 95eb6c8, git fetch --prune done, 0 open PRs.

Roadmap delta: un-deferred ready-now backlog is now empty. Both remaining un-deferred items need a decision first — #116 (messaging E2E perf: scope/profile → pick fix) is queued next as scope-first, #45 (error monitoring) after a Sentry-vs-LogRocket call. Body updated accordingly.

[TortoiseWolfe]

Session audit — 2026-06-02/03

#80 shipped (dev-time axe a11y overlay) → PR #119 merged (`95eb6c8`), #80 closed. [details in prior comment]

#116 (messaging E2E perf) — profiled + two dead-ends found, both reverted:

• Removing the dead `data-messages-subscribed` waits AND lowering Argon2 TIME_COST for CI both regressed chromium-msg to the 60-min cap (the Argon2 one because TIME_COST is a key-derivation input — stored keys were derived at cost 3, so cost 1 → verifyPublicKey fails → 403/ReAuthModal loop). PR perf(e2e): #116 lower CI Argon2 key-derivation cost (E2E-only) #120 closed, nothing shipped to main. Full root cause on perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116.
• The real win is Phase 2 fixture isolation — which needed a way to run messaging specs locally with `workers>1`. That surfaced Modular local↔cloud Supabase switch (env + DNS + one-command) #121.

#121 (modular local↔cloud Supabase switch) — built, PR #122 open (3 phases):

• Root cause of the "switching is manual" pain: missing orchestration + a host-vs-container DNS split (the app is a static export, so `NEXT_PUBLIC_SUPABASE_URL` is browser-only). Dissolved by splitting into browser URL (`host.docker.internal:54321`) vs in-container admin URL (`SUPABASE_ADMIN_URL` = `supabase-kong:8000`, with `?? NEXT_PUBLIC_SUPABASE_URL` fallback so cloud/CI are untouched).
• `pnpm run dev:local` / `dev:cloud` (one command each); deleted the proxy/`--host-resolver-rules` hack from all 5 local-only specs (net −143 lines).
• Validated via MCP Playwright against the live local sandbox (sign-in + messaging load); dev:local→dev:cloud restores .env byte-identically.

Roadmap state: main clean. PR #122 (#121) in CI. Once it merges, #116 Phase 2 fixture-isolation spike is unblocked — that's the next item.

[TortoiseWolfe]

#121 merged (PR #122 → 1b9d033, full 28-check CI green incl. all 3 browser msg shards passing normally — no caps). Branch pruned, 0 open PRs, main clean.

pnpm run dev:local/dev:cloud now switch backends in one command. #116 Phase 2 (fixture-isolation spike) is unblocked — that's the next session's item: prototype isolated per-test fixtures on 2-3 messaging specs locally via dev:local + workers>1, measure setup cost + flake, report before any full refactor.

[TortoiseWolfe]

Session ended 2026-06-03

Shipped:

• Live a11y overlay (dev-time axe overlay panel) #80 dev-time axe a11y overlay — PR feat(a11y): #80 dev-time axe accessibility overlay #119 / 95eb6c8 (merged earlier this session).
• Modular local↔cloud Supabase switch (env + DNS + one-command) #121 modular local↔cloud Supabase switch — PR feat(dx): #121 modular local↔cloud Supabase switch (env + DNS + one-command) #122 / 1b9d033, full 28-check CI green. pnpm run dev:local/dev:cloud; dissolved the host-vs-container DNS split (browser→host.docker.internal:54321, admin→SUPABASE_ADMIN_URL); deleted the proxy/--host-resolver-rules hack from 5 specs (−143 lines).

#116 (messaging E2E perf) — major progress, no merge to main:

• Profiled from real CI data. Two "free win" attempts (remove dead data-messages-subscribed waits; lower Argon2 TIME_COST for CI) both capped chromium-msg at 60 min and were REVERTED — caught in CI, never hit main. PR perf(e2e): #116 lower CI Argon2 key-derivation cost (E2E-only) #120 closed. Lesson: TIME_COST is a key-derivation input; lowering it breaks verifyPublicKey.
• Phase 2 fixture-isolation spike → GO. seedIsolatedConversation (per-test throwaway viewer+partner+conversation, keys at TIME_COST=3). Measured local: workers=1 35.4s → workers=4 ~15s (−58%), 0 flakes ×3, clean teardown. On pushed branch spike/116-fixture-isolation (b30dc7b).

Closed: #80, #121. Opened: #121, #122 (merged).

Roadmap changes:

• Active arc reframed: from "scope perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116" → "perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116 Phase 2 refactor decision" (spike done, GO).
• Session +1 now = decide perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116 Phase 2 scope + execute (was: scope perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116).
• Backlog: added Modular local↔cloud Supabase switch (env + DNS + one-command) #121 switch, seedIsolatedConversation helper, and the spike branch as named items.

Open loose end: spike/116-fixture-isolation is pushed but not PR'd — the user is mid-decision on Phase 2 scope. The helper + dev:local bugfix are reusable keepers regardless.

New memories written: lesson_e2e_deadwait_loadbearing, local_cloud_supabase_switch (both in MEMORY.md index).

Next session should: Resume the #116 Phase 2 scope decision — present PR-spike-and-stop / one-spec-first / de-risk-CI-cloud / full-refactor; recommend de-risking CI-cloud or one-spec-first. Keep TIME_COST=3; verify in CI before merging.

[TortoiseWolfe]

Audit — 2026-06-03 (late): #116 Phase 2 SHIPPED

Shipped: PR #123 (squash 5a32da9) — full per-test fixture-isolation refactor of the messaging E2E suite. All 13 specs run workers=2 green on chromium (72 passed/10min) / firefox (71/11.2min) / webkit (71/10.2min, 1 retry-recovered flake). Net −1574 lines. ARGON2 TIME_COST stayed 3.

Arc shape (the gate discipline worked):

1. Spike → GO (local only). Front-loaded a one-spec CI gate (encrypted-messaging) rather than converting all 13 blind.
2. Gate caught a real bug: dropping serial lost its timeout:900000, so 2× serial Argon2 ReAuth opens blew the 30s default → afterEach deleted the partner key mid-send → 406. Fixed via scoped timeout:180_000 + Promise.all opens. (Root-caused by a 6-hypothesis adversarial workflow; lag/RLS/schema all refuted.)
3. Converted the remaining 11 specs (10 mechanical via a reviewed parallel workflow; friend-requests + group-chat by hand via new seedIsolatedConnection/seedIsolatedGroup). Caught + fixed a display_name-null bug (signup trigger pre-creates the profile) via local verification.
4. Full-slice run: 71/72 green; the 1 was gdpr T192's redirect regex not allowing the static-export trailing slash (/sign-in/?…). Fixed.
5. Finalized: firefox/webkit-iso matrix slices, deleted the spike spec, wired --workers into all 3 CI jobs (firefox/webkit had been silently running at workers=1).

Roadmap delta: active arc cleared (main clean, 0 PRs). #45 error monitoring is the next ready-now item but needs a Sentry-vs-LogRocket decision + DSN. Helpers documented in Backlog as the template for future messaging E2E.

Follow-up (non-blocking): webkit message-editing.spec.ts:506 T117 flake (15-min edit-window timing) — retry-recovered; harden if it recurs.

[TortoiseWolfe]

Session ended 2026-06-04 — #116 fully closed + Node-24 PR opened

Shipped (merged to main):

• aabaf07 — PR fix(e2e): #116 webkit message-editing send-banner false-positive flake #124, the perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116 follow-up flake-cleanup. Fixed the retry-MASKED webkit flakes that the green job conclusions had been hiding:
  • message-editing send-banner false positive — the sendMessage helper's [role="alert"] race matched the MessageInput validation banner (no Dismiss button), throwing "Send failed" with EMPTY text even though the send succeeded. Scoped to the real send-error banner (has: Dismiss button) + require non-empty text.
  • payment/07-performance + complete-user-workflow — brittle loadTime < 5000ms wall-clock budgets (include networkidle + auth retry + CI-runner load; webkit legitimately 5–7s). Replaced with a hang-only < 30000 ceiling (the waitFor(heading) already proves load), mirroring the repo's 240000ms precedent.
  • session-persistence :167 — dropped the racy waitForFunction localStorage poll (raced the hard window.location='/' redirect); assert the contract (signed out → bounced from /profile) with a PATHNAME-EXACT check. (Caught in review: the old /\/(sign-in|$)/ regex matched /profile/ under trailingSlash:true, so a real regression would have PASSED.)
  • session-persistence :224 — cross-tab redirect via expect().toPass() reload-as-source-of-truth instead of a one-shot waitForURL.
  • Verified before merge: 0 failure annotations, 0 flaky, 1043 passed (run 26961769743) — read via per-job flaky counts + check-run annotations, not the conclusion.

Opened: PR #125 — bump GitHub Actions to Node-24 majors (checkout/setup-node/upload+download-artifact → v5, github-script → v8) to clear the Node-20 deprecation warnings. CI validating, queued behind the post-merge main run (concurrency mutex). NOT yet merged.

Closed: #116 (messaging E2E perf) — resolved by Phase 2 isolation + this flake-cleanup.

Roadmap changes (body):

• Active arc: perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116 marked DONE/CLOSED; PR fix(e2e): #116 webkit message-editing send-banner false-positive flake #124 added to "what shipped"; the webkit T117 flake removed from "follow-up" (it was actually fixed). PR chore(ci): bump GitHub Actions to Node 24 runtimes (past Node 20 deprecation) #125 added as the one in-flight item.
• Added "Session +0: merge PR chore(ci): bump GitHub Actions to Node 24 runtimes (past Node 20 deprecation) #125" to the queue (mechanical, finish first).
• Prime prompt: added a CI-honesty reminder (green conclusion ≠ 0 flaky; read flaky/failed lines + annotations) — this masking re-opened perf: messaging E2E suite runs 10x slower than gen shards (23-32min vs 2-4min) #116 this arc.
• "Next session should" now leads with merging chore(ci): bump GitHub Actions to Node 24 runtimes (past Node 20 deprecation) #125, then [Gap-Audit] 044 Error Handler Integrations: Sentry/LogRocket integration + PII scrubbing + session replay #45.

Process lesson (banked to memory): I twice declared the run "clean" off the green conclusion while it carried retry-recovered failure annotations — the user caught it both times. Root fix is to read per-job flaky/failed + check-run annotations, and ideally gate CI on flaky-count>0 in the iso slice (queued as a Session +3 idea).

Watch: GitHub forces Node 24 on Actions 2026-06-16, removes Node 20 2026-09-16 — PR #125 clears this well ahead.

Next session should: Confirm PR #125 went green (per-job flaky counts, not conclusion) and merge it; then confirm the next priority with the user — default is #45 error monitoring, blocked on a Sentry-vs-LogRocket decision + DSN.