soldi roadmap

Single source of truth for what's built, what's next, and how we fan the build out. Pairs with BUILD_LOG.md (per-slice ledger) and the docs/SPEC_*.md + docs/DESIGN_SYSTEM.md detail docs.

Last updated: 2026-07-26.

Systemic responsive pass (2026-07-26, merged and hosted-proved): PR #310 normally merged as exact main 2d08757e50c529a9138cd89ccf195d2e4b637743. Protected staging had no pending migration through 0043 and deployed exact source tree 5938674ff07894fe46b418c73783708565e13261 / assets b675c22a95e26ac8d51cbca2075e88d51013f7876d5eed15dc3072fcd2ce9741 as deployment 7a2b8c28-8c8c-4333-9e9f-f1345845ec6b / version cd72c388-bcd4-4c86-8259-f2d2804d4735. Market, My Leads, Territories, Activity, and invoice summaries use cards at and below 768px; Billing/Activity cap at 900px; Territory/refund dialogs cap at 600px; Territory controls are 44px; the tablet balance pill stays visible; and zero Market inventory has a truthful Territory-directed empty state. The phone Share drawer now keeps Call/Text above a full-width Share action. Hosted authenticated proof passed twice over five routes and three widths: 15 / 15 rows with zero overflow, console/API failures, layout-gate failures, or clipping. Public copy delta: New leads are on the way., its empty-Market explanation, and View Territories. Zak has the exact staged demo link for physical-iPhone acceptance; production is untouched.

UI stragglers (2026-07-26, merged and hosted-proved): PR #309 merged as exact main 2ea307d106e04a7a3e9785ad10f57a3c604ab130. Protected staging migration was a no-op through 0043; deployment 58500d27-e0b6-4c7c-9254-7299c9594d49 / version 2fe9909b-7eaf-42d4-bb8e-8ea64ae71703 serves canonical 4bd SFR, retains Forgot password, and removes the logged-out protected-Market loop. Browser proof at 390x844, 768x1024, and 1440x900 found no document overflow, console errors, or failed API responses. Production is untouched.

Staging inventory restoration (2026-07-26, live and hosted-proved): PR #307 normally merged as exact main 82117c664b79c02475669797d00461b3a3686108, and protected staging deployed exact version c576c94b-bd47-47c5-ae68-e5c69c07e6f4 / deployment 8901eb9f-ceb8-45d3-b917-cf1cb08aaade with no pending migration through 0043. The receipt-bound apply preserved every retained economic count while producing exactly nine marketable leads: three Cold, three Warm, three Hot, four situations, and five age dates. Authenticated Market and Territories passed 390x844, 768x900, and 1440x900 with no overflow, console errors, or failed responses. Phone controls remain 44px; the pass confirmed the separately queued 24–30px Territory table controls at tablet/desktop. Production was untouched. Durable receipt: artifacts/soldi-completion-2026-07/shots/m8-staging-inventory-hosted-receipt-20260726.json.

Production Stripe activation audit (2026-07-25, read-only): Soldi's Stripe account acct_1TtjDjPuLV917S5K is currently sandbox-only. A direct live Workbench URL redirected to /test/; the Dashboard showed Sandbox / Test mode, required Verify your business, and had not enabled creation of the live Stripe profile. Cloudflare already has the STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET secret names, so the immediate M9 blocker is provider activation rather than a missing secret binding. Public production remains the legacy Worker (/api/v1/health 200, /api/v1/health/stripe 404). Cam must complete Stripe business verification/live onboarding before live webhook, statement-descriptor, and receipt-email proof can exist. No provider or production mutation occurred.

M8 exact-candidate Stripe acceptance (2026-07-25, protected staging): a fresh non-demo buyer completed one genuine $1,000 hosted Checkout on exact staged application 1c142547, assets 57efda7c…, Worker 6fba2fcd…, deployment ca805c8b…, and sandbox account acct_1TtjDjPuLV917S5K. Signed event evt_1TwzX9PuLV917S5KjpxoMvik credited exactly one immutable purchased-funds ledger row, moving the buyer from $500 promotional to $1,500 total with $1,000 purchased. An explicit Stripe Workbench resend reached the exact staging webhook and returned 200; post-replay D1 retained one event, claim, evidence row, and funding ledger row. This closes the exact-staged Stripe acceptance input only. Production remains HOLD behind the retained-production rehearsal/rollback, production Stripe/webhook configuration, physical-iPhone and signed external acceptance, and post-promotion FHC bridge restoration.

M8 consent truth (2026-07-25, normally merged and protected-staging live): PR #303 normally merged as exact two-parent main 1c142547dec54923d7c154b610fa3e0152011bed. The protected controller applied sole pending 0043_consent_truth.sql under a Time Travel bookmark, preserved all retained counts, and deployed Worker 6fba2fcd-3b21-4fc8-b654-3795bd3f2867 / deployment ca805c8b-7fc6-4555-83d3-da261599a0f7; exact health and test-mode Stripe identity agree. Hosted six-route and Admin QA passed desktop/phone widths. FHC serves the exact checked-disclosure verifier through code version 44fc9887…; live missing/forged probes fail closed, the apex domain and five-minute schedule are provider-proved, and only the bridge secret is deliberately absent while production Soldi remains pre-M8. Real FHC leads continue to persist and alert Cameron while pending forwards do not consume retries. Production remains HOLD behind final-candidate retained-data rehearsal/rollback, production Stripe/webhook configuration, physical-iPhone, signed external acceptance, and post-promotion bridge restoration.

M7 admin financial resolution (2026-07-25, protected staging): PR #301 normally merged source head dd44cd576d9edd8b31019e55ed202595213b2dbe over base 7678d449b97bfd4f440f79363d04907e2e8a4da7 as exact two-parent application authority 53172e598a5539be7d36f3cd9d0178370109dda1. The protected migration applied sole pending 0042_admin_financial_resolution.sql; post-apply pending is empty and the Time Travel bookmark receipt hashes to 616cbef0756295a50dea4597646270f6b64ed8fd11bb36572ead6cdc11a0c8e1. Exact source-tree/assets/migration digests are 52aecf63915f09ee08ac2cb576d324c57f068938, e08c0dc436284e5c351c5a56b2184e9820c0a07b84135b4c56fba6fdd33102ab, and a3f4d17c6f9610b0deb29a54e0c89fe5c29e80399196b37009e30dae1df6779c; Worker 93bf0d59-a716-4460-a521-5add5e8e94d7 / deployment 4e74a35f-6d5d-4944-b8f0-9c46fbb8f016 / tag v60-53172e598a55-92a496717b2e-f0945ce6dc1b42b785b6d4805b1045a1 serve live health and exact Stripe test account acct_1TtjDjPuLV917S5K. Authenticated exact buyer lookup returned immutable ledger/reversal arrays without mutation; the temporary staging demo-admin flag was restored to 0, and total/purchased balances remained 708000 cents with held/promotional 0. Admin visual QA and all six buyer routes passed 1440x900, 390x844, and 320x844 without overflow, signed-out/fatal state, console errors, or failed requests; 24 Admin requests were 2xx/302, and 49 preserved buyer-route requests had zero >=400. This closes the M7 staged apply/readback question, but production remains HOLD for the final-candidate retained-data rehearsal/rollback, live Stripe configuration, and physical iPhone/external acceptance. A later docs-only receipt descendant is not deployed application authority.

Current money-blocker lane (2026-07-24, exact staged hotfix plus production emergency fence): PR #294 normally merged the narrow wallet-race response fix as exact two-parent application authority 003c744fe332594d3f2d6b1619aade3178ab07c8. The protected controller confirmed no migration after 0041 and deployed that exact merge as deployment 5521e77a-ebf0-4aae-8c81-53bc4fd76f8c / Worker e2d5c349-a806-46e6-b6ce-deab9e87592a. Genuine Stripe sandbox funding, full-refund, and fraudulent-dispute events plus repeated signed replays now preserve exactly one economic outcome. The full-refund case pauses a spent buyer and records $2,600 outstanding principal-plus-bonus exposure; the genuine $1,000 dispute pauses a fresh buyer, holds exactly the purchased $1,000, leaves unrelated $500 promotional credit available, and remains one deposit/case/event/hold after four manual signed 200 replays. Refund gaming through client counters/timestamps, ownership bypass, idempotency replay, and six attempts compressed into about 1.4 seconds fails closed with zero refund rows. Hosted recovery, both wallet-race shapes, and pre-purchase seller-PII masking pass. FHC main 6a20c11 is live as Worker e714d690 / deployment e06561d3 with a provider-proved five-minute alert. A production probe found the older static-brand runtime still exposed seeded demo access, so exact-live-source emergency commit f429daa revoked demo credentials/endpoints/query login and both seeded demo sessions before D1. Worker version 12a6b797 / deployment 181a0528 is live with no changed assets, migration, secret, Stripe setting, UI, or copy; a pre-fix session now receives user:null and 401 on buy/admin paths. Historical demo wallet/ledger rows remain inert pending a separate correction decision. The subsequent human pending_review owner/SLA, device QA, terminal dispute resolution, production provider subscription/configuration, final-candidate retained-data rehearsal/rollback, and consent-copy truth remain open; broad production promotion is HOLD.

Current mobile release (2026-07-23, protected staging; not production): PR #286 merged normally as exact staged/main 73153a87ed7f046b91f828e1e07d177332c581cd, preserving the final phone-polish and owned-share line while closing Zak's refund touchpoint gate, full Package commitment copy, and Illinois legal cleanup. Protected staging has no pending migrations through 0039; exact health and test-mode Stripe identity bind the merge to deployment 8df8e4b4-d200-487f-8346-4d1dde0d0334 / Worker b1d8488d-259f-4181-a65e-46670d0ccc6b. Authenticated hosted 320px QA found two bounded CSS seams despite clean width: 42px Package recommendation actions and a crowded Territory control row with flex-compressed steppers plus a leaked desktop Remove cell. The isolated hotfix restores 44px controls, hides Remove with a specificity-safe selector, and stacks bid/cap only at 340px and below; fresh local automation passes 22 route/viewport rows. Exact hotfix merge/staging and Zak's physical-iPhone pass remain next. Apple Pay, post-call prompting, and masked/referral sharing remain post-launch.

Current exact release receipt (2026-07-21, staging; not production): PR #277 merged normally as exact main bc93cbaa0c4da3b5469eaa7ea242aab70ccdbf2f, adding phone account quick access and the compact Territory card above the previously reviewed Package/mobile train. Protected staging applied no migrations and deployed that exact merge as deployment 7c3e3486-d63f-47e8-8b13-34c27de4e5ec, Worker d58a84ff-b799-476b-8640-699e78b51039; exact health and test-mode Stripe identity readback passed after edge propagation. Browser QA then caught one presentation-only specificity defect: the desktop-only spend cell remained visible as an unlabeled $0 on phone cards. A two-line source/test correction is in normal review before the physical-iPhone retest; no pricing, Territory mutation, D1, Stripe, or production behavior changed.

Package readiness v4 (staging-backed): 0039_package_readiness_v4.sql leaves prior v3 evidence untouched and creates wholly new environment-scoped authority. The corrected denominator selects only acquisition_source=ppc, market_price_cents=25000, and vert=investor; malformed timestamps inside that candidate set fail closed while noncandidate PPC rows do not poison supply. Staging retains the reviewed * * * * * scheduler with PACKAGE_READINESS_SCHEDULER_ENABLED=true; production remains literal false. The first real scheduler decision package-reserve-v4:staging:2026-06-22:2026-07-22 is ready=1 / reserve_satisfied with demand/committed 0 and supply 5; no manual readiness row or wallet, Package, or lead mutation occurred. The 39-file / 15-pending control inventory and hostile evidence gates remain intact.

Stripe production boundary (2026-07-21): Fair Home Cash readback distinguishes sandbox acct_1TsllIR34twH5OTZ and live acct_1Tsll8J1YBgaOKuA from staging's older Soldi sandbox acct_1TtjDjPuLV917S5K. The live FHC account remains on Activate your account / Verify your business onboarding; no provider setting was changed. Cameron must complete legal/business onboarding and explicitly confirm the new FHC organization is canonical before any production keys/webhook wiring. Public production health remains legacy (/api/v1/health 200 without SHA/version and /api/v1/health/stripe 404), so it is not release proof. The source-only exact-main production plan receipt, config/assets/diff bindings are recorded in BUILD_LOG.md; it is not authorization or an execution receipt.

Current launch-train receipt (2026-07-17): Zak's approved FHC PR #236 exact head f6647d2958fb8c8bc5cedc68ef03b4120b597f14 merged to main as 6615f94d51757f9afee12f5857e3249e43cf14ae and is preserved additively in the v60 train through normal merge 7c0e4e6ce48bb4e80cdc44c3b92e908b12cc87f8 (parents 4fe5959 and 6615f94). Integrated root 79/725, FHC 547/547, 966-page build/audit, and staging dry-run are green. FHC, Elite, and Soldi staging uploads remain blocked on the named Cloudflare token still returning code 1000; no provider receipt or Soldi promotion is implied.

Train merge receipt (2026-07-16): this branch contains exact train head 7710eed3955a6c3643c67c3a19c2df2d6a859ebb merged normally with exact origin/main PR #223 head 4dc59090b3adbe78abedd20ca31283dc35e8251a. FHC #220/#222/#223 remain source-only evidence; no deployment is implied. Package reserve and bulk owner gates remain as documented below.

Canonical Soldi brand-assets checkpoint (2026-07-16, updated 2026-07-19 hosted proof): app/ carries the immutable supplied soldi-logo.png under SHA-256 30adbc8f75f5bf1377c3f7b1714be1ae505a9d43dc3b9113ff92c805f31bd630, reusable accessible app-mark rendering, deterministic social/icon assets, manifest, and route-agnostic production metadata. The brand audit checks raster dimensions/alpha/opaque requirements, immutable source hashes, source/deploy byte equality, manifest/meta integrity, and the configured app/dist Worker ASSETS path. The July 19 social refresh replaces machine-specific font rendering with reviewed checked-in 1200x630/1200x1200 source composites; builds copy those exact pixels. Exact production-lineage merge 55efa35922e9df2be159e0de28587f8e90ef386b is live as Worker version 36200b71-70b9-411d-b0b0-04f7d9ef4243, deployment a4080af8-9102-4906-a3a1-5f2c33b2f981: provider topology, JS/CSS, health, crawler parity, image bytes, logo/favicon alpha, and desktop/mobile visual proof pass. This static exception did not promote the v60 runtime or satisfy any full-production gate. Public-copy delta remains none.

Protected staging fresh-signup receipt (historical after the 2026-07-21 login-repair source change): exact application authority 008119d88aee92bcd4db6be19c1275ff1ece54c5 is live at staging.soldi.cc as deployment 9e784f30-33a7-4223-89aa-debe717b8682 / Worker version fad2c237-5465-496e-ab67-0d1b6b0db92a, with assets SHA-256 bd215b5b9c8a3621444bf0ba46f0be44e8d480ddbfd57b991a19ab326637240e. It proved a genuinely new account's registration/reload/setup/Settings/Refunds and one sandbox Checkout/typed credit, but it did not cover Zak's existing-account login state. Do not transfer its staging, hosted, physical-iPhone, or Stripe acceptance posture to the next runtime merge. Production remains HOLD.

Mobile Billing acceptance correction (2026-07-19, merged and protected-staging live): an owner-supplied staging screenshot invalidated the preceding page-width-only mobile visual pass. PR #261 moves the closed mobile support launcher into the utility row as a 44px hit target, preserves the full active route label, and reflows funding choices, budget presets, fields, and Save into phone-native grids. Exact merge c579b81 now has local, protected-provider, authenticated Chrome, and independent Terra/high proof at both 390x844 and 375x812: exact page width, zero interactive intersections, all required controls inside the viewport at 44px or larger, zero console errors, and zero failed application requests. The reusable UI validator retains non-vacuous overlap, clipped-text, and center-hit-target assertions. Visible public-copy delta is none; the mobile navigation accessibility name includes the current section. Production gates are unchanged.

Supplied digital brand-pack correction (2026-07-18, merged and live static assets): the exact logo remains unchanged because the new transparent file is byte-identical to the canonical source. The supplied 1024px circular S at SHA-256 104c107fd8333930c74edf267d71792c79826c96baa5b2c9801f341d2b393e6e replaces the detached-dot favicon authority across ICO/PNG/Apple/PWA outputs; conventional root fallbacks plus a versioned discovery URL address browser favicon caching. The mock sheet now yields audited opaque 1200x630 and 1200x1200 share renders using current v60 imagery and the existing approved descriptor. Its stale Probate/old-market copy was not shipped. PR #246 merged the canonical source to main; exact production hotfix 65ec6b06001c6f58d028e7faec127002e7919f7f is live as Worker version 52b0854d-f81c-4b85-aee8-5af39f7c1ec4. Hosted crawler-UA parity, hashes, MIME, dimensions, favicon, manifest, and health pass. The hotfix deliberately preserves the July 9 Worker/JS/CSS because production still has 12 unapplied D1 migrations; full v60 runtime promotion remains open.

Transparent favicon follow-up (2026-07-18, merged and live): the owner-supplied soldi-favicon.zip supersedes only the small-icon portion of PR #246. Its black circular Soldi wordmark and green dot retain transparent outer pixels across ICO/PNG/Apple/PWA outputs. Source-byte bindings, exact source-ICO-to-child-RGBA comparisons, four adversarial fixture tests, standalone deterministic generation, and the full 80-file/730-test gate pass. PR #250 merged as d1bc152; production-lineage hotfix 9baf86f is live as Worker version 62d84152-c5bf-4b8b-adfc-5c49022fed1a, deployment cb1e573b-ffae-48d4-b9e7-6fd387c4370d. Hosted bytes/MIME/dimensions/alpha/crawler parity pass while JS/CSS and provider topology remain unchanged. The generic archive manifest and unsafe maskable claim remain excluded. Public-copy delta is none; no database, payment, or full-promotion gate changed.

Where we are

Zak mobile fidelity pass 2 (2026-07-21, merged/staging checked): PR #275 merged normally as exact main fe6ff71e26f915167db6ba4c89440a53e2af481e after its independent exact review returned READY with no P0–P3 findings. The merged shell keeps real balance/Add funds actions plus five persistent tabs (Market, My Leads, Territories, Activity, Wallet); Market tier prices remain orange/green/amber, My Leads retains dense cards and a per-card phone stage sheet, Territory cards suppress raw IDs, and Wallet preserves funds, Package, invoices, and Stripe behavior. Authenticated fairhomecash Chrome at 1440x900, 390x844, and 320x844 found no document overflow, at-least-44px primary phone controls, five 49px tabs, correct colors, hidden desktop bottom navigation, and Package ready to start copy. The 320px My Leads tier row intentionally has overflow-x:auto (288px client / 319px scroll) so Cold remains reachable. This Chrome evidence does not substitute for exact Stripe/webhook money-path proof or physical-iPhone/Safari acceptance; ordinary UI defects are fix-forward only.

Final social-brand refresh (2026-07-19, merged and live): four owner-supplied visual examples produced four background directions; the selected product-neutral dark marketplace/grid/house signal is retained as audited wide and square source plates. Exact transparent logo and corrected favicon pixels are unchanged. The approved composites preserve Exclusive Seller Lead Marketplace, use cache key v=20260719-2, remain outside public as source authority, and byte-copy to the deployed Open Graph files. Exact static production lineage 55efa35922e9df2be159e0de28587f8e90ef386b is live as version 36200b71-70b9-411d-b0b0-04f7d9ef4243 / deployment a4080af8-9102-4906-a3a1-5f2c33b2f981; hosted crawler and byte proof pass. This static release did not promote the full runtime.

Production-controller evidence hardening (2026-07-21, source-only; action-time correction under review): promotion fails closed unless one exact final candidate has a reusable closed-schema/secret-free schema-3 protected-staging deployment receipt, a separate exact-account Stripe Checkout/signed-webhook/typed-ledger receipt, a separate exact 1440x900 desktop plus physical-390 hosted-QA receipt, and approved-contract physical-iPhone proof. The staging receipt is validated and live-revalidated by the existing staging controller for the exact soldi-staging Worker, isolated D1, candidate tree/assets/migrations, deployment/version, required secret names, schedules, disabled workers.dev/previews, and staging.soldi.cc domain. Stripe requires sandbox acct_1TtjDjPuLV917S5K, immutable provider IDs, integer cents, and replay-safe ledger evidence; hosted QA requires all six named screens with no overflow, console/page errors, or failed requests. Physical QA requires an allowlisted iPhone/iOS and complete six-step checklist plus a closed canonical device-session artifact whose SHA-256 must exactly appear in both receipt digest and device-session://soldi-v60/sha256/<digest> locator; this is inspectable content, not provider attestation. External acceptance schema 3 canonically binds the four receipt digests plus device-session digest and verifies only strict unpadded 64-byte base64url Ed25519 signatures over canonical bytes against the fixed public key/locator/key-id contract. After every receipt validates, exact SOLDI_PRODUCTION_GO_V4 mints a closed maximum-15-minute operator authorization bound to the complete evidence digest and capped by the earliest underlying evidence expiry; it is revalidated inside the maintenance fence before bookmark/migration. acceptance-payload is archive-safe and needs no Git state. This is controller/source proof only: no staging, Stripe, browser, Cloudflare, D1, signing-provider, or production mutation occurred.

Staging migration-controller closure (2026-07-19, implemented; first exact-current-main run recorded above): direct staging D1 migration is now a fixed-target staging:migrate controller that requires freshly fetched normal-merge origin/main, strict fixed account/zone/domain/D1 read-only preflight, one frozen exact-Git snapshot, a fresh Time Travel bookmark, exact ordered migration inventory, retained-data scalar baseline/readback, and a private secret-free receipt. The receipt binds the candidate tree/canonical config/full migration hashes/applied suffix and fixed D1; no-pending runs remain verified receipts. staging:deploy validates the receipt locally, runs authority preflight before snapshot/install/build, and then requires a fresh fixed-target D1 inventory/scalar readback before upload. Recursive-key canonical SHA-256 values for both the local migration receipt and live readback bind the provider release identity; the local receipt is audit binding only, while the live readback is deploy-time safety authority. Extracted source and built app/dist are path-fenced, but installed node_modules is intentionally not recursively fenced because valid dependencies may be symlinked. Migration success is persisted only after cleanup is removed and verified; cleanup failure emits only cleanup-failed. Public copy did not change; production remains HOLD.

Hostile closure (2026-07-19, source-only): schema-2 migration evidence now closes every nested inventory/scalar/hash object, exact parents are recomputed rather than syntax-checked, and the deploy controller proves its frozen Wrangler binary matches the migration receipt before any provider request. A post-bookmark O_EXCL/0600 boundary lives outside the disposable snapshot; failures persist a separate bounded failure receipt with phase/error code and no restore authority. Tests cover parent/toolchain/nested-substitution, all post-bookmark provider phases, and surviving private evidence. No provider, D1, migration, restore, deployment, UI, brand, or public-copy change occurred; production remains HOLD.

Zak buyer-app iteration (2026-07-19, merged to main): PR #254 final head d5be95f8eae34cd9a99b441bd90133fda7c9e191 repaired the five-market/Illinois Package-routing P1 and merged through PR #253 into main as 4b541310b178845af9a62b27b02d1b9521dca037. Real-SQLite proof covers Illinois-only and exact NJ/NY/TX/FL/IL profiles through reservation, completion, delivery, terminal decision, and zero Market fallback; malformed, unsupported, and duplicate profiles fail closed. Focused proof passed 2 files / 42 tests, full app proof 81 files / 740 tests, TypeScript, Vite, final Sol/medium review with no P0–P2, and a fresh isolated true 390x844 touch/iPhone-UA browser pass across eight mobile/desktop journeys with no overflow, console/page errors, or HTTP >=400. A later combined brand/control PR must normally merge before a final candidate exists; all candidate-bound receipts then rerun for that merge SHA. Physical iPhone, protected staging, external acceptance, V3 approval, and production remain HOLD.

Production-controller correction (2026-07-18, source-only): production remains HOLD. The controller now requires freshly fetched origin/main to be the exact normal merge of a reviewed PR head and its exact main base; the authenticated GitHub APPROVED review is bound to that PR head while the candidate is the merge SHA and acts as protected verifier of the external-acceptance digest. Before a maintenance fence or bookmark—and again inside the fence—it strictly reads d1_migrations, accepting only applied 0001–0024 and pending 0025–0036, canonical-digested and V3-bound with every retained-data preflight result. The physical-iPhone and external packet must share a staging version/target and bind exact candidate/assets/checklist/signature/immutable locator; those fields are checked against the GitHub-approved digest before fence and again inside it. Staging and production provider version IDs are explicitly not equal. Direct deploy:app is fail-closed. No production/provider/GitHub mutation occurred; real approval-bound artifacts and a later authorized run remain required. See docs/runbooks/v60-production-control.md.

Staging authority fail-before-upload repair (2026-07-16, source-only): the exact clean ff75918b5f1f336c65d2d7c3648be6765ee7fcc0 candidate was uploaded as Cloudflare Worker version cf78dc65-c0b7-4022-a7a6-676344efad47, but Wrangler then failed its required zone Workers Routes GET for staging.soldi.cc with API code 10000; no provider deployment receipt exists. Public health exact-SHA, served Stripe test account acct_1TtjDjPuLV917S5K, social-card source-hash parity, and manifest/meta presence are hosted observations only: the version remains uploaded-without-receipt and unaccepted. Independent review reversed the name-list preflight because GET /zones?name= would require Zone Read. Workers Scripts Edit + Workers Routes Edit describes only the fixed-zone read-only preflight, which reads GET /zones/22dfb4f39d708e227c63dbc9d344e955, validates exact returned id/name/account, then reads that fixed zone's Workers Routes endpoint and exact staging.soldi.cc / soldi-staging custom-domain attachment. Camo is the authorized Cloudflare and Stripe provider operator. The full staging sequence still separately needs repository-mandated DNS Edit/custom-domain authority and scoped D1 Edit for bookmark, remote migration, and staging data actions; actual execution waits for scoped-token verification and an explicit receipt-bearing run. Any malformed/auth/HTTP/target failure occurs before snapshot/build/config/Wrangler upload. The existing post-upload exact provider readback and private receipt gates remain unchanged. This source-only change made no Cloudflare, D1, Stripe, browser, seed, bookmark, deploy, or production call; final browser, physical iPhone, seed, receipt, hosted acceptance, and production remain open.

Production-control source lane (2026-07-16, not executed): tools/production/ now independently guards canonical Worker soldi, app.soldi.cc, and production D1. It requires a clean exact full SHA, path-fenced private artifacts, current asset/config/migration digests, redacted rendered-config diff, and an externally fetched submitted GitHub APPROVED production-go review from immutable Zak user id 236636852 / killerabbasi on fixed repo camolechowski/soldi; the review must bind exact SHA/config/diff/expiry and cannot be self-issued by the deploy operator. Snapshot upload and complete post-upload provider authority (version/deployment, bindings, secret names, domain, routes, workers.dev, and cron) remain required. The retained-data rehearsal intentionally does not claim D1 Time Travel cloning: every D1 control-plane call is fixed-account fenced; a separately named temporary D1 is account/id-confirmed before private export import; full migration/FK/wallet/NULL+duplicate-key checks, structured restore with previous_bookmark, and exact post-restore readback are required; raw export erasure survives remote delete failure and that failure escalates rather than passing. A production export blocks D1 requests and needs a scheduled acknowledgement. No bookmark, export, temporary D1, migration, restore, deploy, token, or remote cleanup was executed in this source lane; hosted acceptance and production remain held. See docs/runbooks/v60-production-control.md and Cloudflare's Time Travel and import/export docs. Hosted-QA source repair (2026-07-16, local review branch): exact staging source 4578d7ba10a08135cd10bd6fc97dd04c45e2c6c7 exposed a phone-width fixed-support overlap over the Territory primary action and a normal Add-funds /payments/deposit 409 before Checkout. The bounded repair gives both support states a mobile safe-area-aware clearance above the 44px primary action and makes Billing select an authenticated stripe / local_fixture / unavailable capability before mutation. Stripe goes directly to the existing idempotent Checkout path; fixture credit requires only the explicit trusted APP_ENVIRONMENT allow-list (development or test) and never uses Host/request URL as authority. Undefined, unknown, staging, and production funding fixtures fail closed, while capability reads are Cache-Control: no-store with Vary: Cookie. This is local source proof only; an independently reviewed head still needs protected-staging true-390 pointer and clean console/network reruns. No deployment, provider, D1, or production state changed.

Staging-control gate (2026-07-16, deployment in progress): PR #233 merged as exact train 6916b0f after Terra/high approval; PR #234 added the fixed canonical domain and merged as c9ae348. Isolated staging D1 now has 0032–0036 after a fresh Time Travel bookmark; wallet/property/foreign-key checks are clean and nothing is pending. Cloudflare custom-domain id 166ab9a82dc54d854123fb840fc6e3a1ace30de4 remains attached, cron is empty, and workers.dev/previews are disabled. Two upload attempts stopped before mutation: first the domain/subdomain dashboard delta, then Wrangler --strict rejected the intended new full-SHA/account-id vars. A bounded correction removes only --strict; exact fixed snapshot/config/toolchain inputs and immediate unique deployment plus complete edge-state readback remain the receipt authority. Stripe rejects wrong environment/mode and wrong immutable sandbox account; webhook we_1TtjFvPuLV917S5KUEdwTcNV targets canonical staging. This is not yet a successful Worker upload, Access-protected environment, served Stripe Checkout/webhook receipt, hosted acceptance, or production authorization.

Staging demo-data reseed (2026-07-16, Terra P1/P2 repair; not executed): bun run staging:demo-seed is a receipt-bound, literal-staging-only operator command. It needs the exact clean deployment receipt, a deterministic exact-Git rebuild that independently recomputes the asset digest, canonical semantic config validation that tolerates only checkout-local paths, and fresh provider binding revalidation before even a readback; it rejects production/non-staging targets and has no target override. The deterministic set adds nine marker-owned reserved-fictional Investor leads (three each Cold/Warm/Hot, four current situations) and three marker-owned ranked Territories; with the existing canonical three it asserts a 10–12 available-lead demo, positions 1/2/3, and a $250 top bid. Apply and cleanup put their preconditions inside BEGIN IMMEDIATE transactions: a post-preflight lead/Territory collision, competing context, or economic reference writes no fixture residue; cleanup can safely remove an old marker-only partial set while leaving an unmarked colliding record untouched. It never writes wallet/purchase/refund/portfolio truth and preserves a before/after ledger snapshot. A future authorized hosted run still requires a fresh Time Travel bookmark, receipt, dry-run/readback, and explicit execution authority; this repository change is not staging proof.

MVP launch control (updated 2026-07-23 UTC): Zak's consolidated handoff and later item-40 ruling supersede the earlier interpretation. Agent mode is removed for MVP; the verified purchase/transaction flow remains closed-good; refunds use exactly nine shared reasons and every request is unavailable until the purchased portfolio has at least six server-recorded Call/Text attempts spanning three days. Before then the buyer sees Work the lead first: at least 6 contact attempts over 3 days. There are no refund-proof uploads or proof-storage tables/buckets. Realistic seed contacts, quality/payload removal, Territory position/bid admission, seed/ledger reconciliation, budget controls, cap-stop copy, and the light Make offer action remain required deltas. Bulk is not a promotion gate and stays absent/disabled until atomic proof; two-step sign-in is hidden until post-MVP TOTP; auto-reload remains manual until end-to-end Stripe staging proof. The Package comparison must disclose the full commitment as $5,000/mo and 25 Hot leads at $200 each. The canonical current gate/owner/QA/rollback artifact is docs/plans/mvp-build-public-release/CURRENT_MVP_READINESS.md. Production remains held behind exact served SHA, protected staging, Stripe sandbox, retained-data/recovery, hosted acceptance, and rollback proof.

Investor-only closure (2026-07-16, local child): forward migration 0036_investor_only_market.sql normalizes valid retained Agent profiles to Investor and retires marketable Agent inventory. Profile writes and every Market list/direct-buy/server-bulk eligibility path are Investor-only, so an Agent row cannot list or buy even if directly written later. Open Market no longer contains Hot $200/$250 discount/tier-tease language while bulk remains disabled; direct Hot stays $250. Fresh 0001–0036 migration, retained-data/authenticated-negative route coverage, and full local verification passed; this does not prove retained production data, protected staging, or hosted acceptance.

Purchaser-role authority repair (2026-07-16, PR #232 local follow-up): hostile authoritative-D1 review disproved the preceding direct-buy claim: buyer_profile.vertical='agent' could still purchase a valid Investor lead because the handler constrained lead vertical but omitted purchaser role. The repair now reads the persisted purchaser vertical on authenticated Market list/direct/bulk routes, treats missing/malformed/non-Investor data as fail-closed, repeats the Investor predicate inside direct claim/purchase SQL, and uses only the existing empty-list or generic lead_unavailable response so eligibility is not disclosed. Valid retained Investor profiles remain routable even where unrelated legacy preference fields predate the current write schema. SQLite route tests prove drifted Agent direct and bulk requests create zero purchase, batch, claim, wallet, balance, or lead-state residue. Local proof passed frozen install; focused 4 files / 32 tests; full bun run verify 75 files / 685 tests; fresh 0001–0036; docs build; FHC 480/13, 966-page build, and audit; and scoped hygiene scans. This is local source proof only; PR #232 remains held pending its repaired head, protected staging, retained-data preflight, hosted acceptance, and production gates.

V60 six-screen fidelity candidate (2026-07-15, local / exact-head review pending): codex/v60-zak-ui-fidelity ports Zak's pinned f8b192b mock into the shipping app without translating it through the older app theme. The buyer navigation is now exactly Open Market, Payment & Budget, My Leads, Transactions, Territories, and Settings. The older competition, realtime-buyer, CRM, and follow-up surfaces are absent from the buyer router and public API contract; legacy acquisition aliases remain storage-only and canonicalize before buyer payloads or visible/accessibility output. My Leads adds real ownership-scoped event history and persisted notes plus the v60 wholesale calculator. Territories adds real situation-scoped 30-day supply and highest-active-bid context. Local browser proof covers all six screens at 1440×900 and 390×844 with zero horizontal overflow and no retired buyer vocabulary in visible output. Zak's PR #209 locks Package eligibility at committed Hot demand no greater than 60% of trailing 30 complete days of Hot/PPC supply, with each Package counting 25 and missing cold-start days counting zero; activation remains unavailable until that rule is implemented and the exact-SHA staged caller is proven. Transactions Resend and Settings notification/delivery/test-lead actions likewise remain visibly unavailable pending their delivery contracts. Promotion is frozen until exact-head Sol/Terra review, GitHub CI, canonical staging, Stripe test-mode configuration, and hosted acceptance at the exact served SHA.

V60 consolidated frontend handoff (2026-07-15, local source only): the owner-supplied 7/16 handoff supersedes the prior mock/checklist Agent interpretation for MVP. Open Market and Quick setup are investor-only with no legacy-profile interception; buyer quality score/rating UI and locally owned payload fields are removed. My Leads formats US numbers and its calculator pre-fills an editable Make offer amount; the existing authenticated pipeline route atomically persists Offer Out, the exact cents amount, and a durable activity row. Two-step sign-in and bulk controls are absent until their required server contracts exist. Payment & Budget offers the $5,000/$10,000/$20,000 budget presets beside custom amount/reset-day controls and says “buying stops at the cap”; invoices offer only Motivated Seller Leads and Package's unavailable state appears once per card. Auto-reload remains absent until staged Stripe proof; any future UI copy must say “Auto-reload is optional and off by default.” Minimal future delta: a persisted authenticated preference, payment-method authorization, explicit retry/charge/ledger semantics, and failure/cap tests—then a separately approved UI control. This branch is not deployed.

Realtime default-off gate (2026-07-15): committed local-source remediation anchored by 42a5e07 removes the initial gate's settled capability cache, so every new room/topic and reconnect shares only concurrent in-flight health work and requires a fresh literal auctionsEnabled: true before socket construction. Connection state, event history, chat state, drafts, and socket sends are keyed to the exact topic: changing auctions immediately returns Checking/Linking with no old events, cannot send through the old socket, and clears the old room's draft, while same-room capability/socket transitions preserve it. The composer is enabled only for an open enabled socket and clears only after accepted delivery. Fabricated MOCK_TICKER activity is deleted; the marquee renders only verified realtime frames while open, with No auction activity yet. as the connected empty state. Focused proof passed 4 files / 26 tests; full verification passed 58 files / 549 tests, TypeScript, Vite assets/index-CBSuz7Uh.js, docs build, diff hygiene, secret-shape scan, and changed-file line limits. This is committed local-source proof only: it is not staged, deployed, or hosted-proven, and exact-served-SHA staging acceptance remains a later gate.

Persisted Package billing (2026-07-15, branch-local / uncommitted correction after rejected 29e4d7a): codex/v60-persisted-package-billing starts from exact v60 master cf2ec91. Package activation and deterministic UTC renewals debit exactly $5,000 promotional-first for 25 Hot leads; shortfall records immutable payment_required with no entitlement. Cancellation intent fences renewal, and a winning successor settles only its actual unused tail before cancellation. Migration 0030 now persists nullable unique package_cycles.predecessor_cycle_id only for a renewal and keeps it immutable; all three early-settlement runtime predicates and the trigger require that exact predecessor, same user/exact boundary, and the predecessor due at settlement time. This rejects foreign, stale, future, and same-user look-alike cycles. A valid structured old 402 replay remains distinct from later active/cancellation-pending current truth in Billing. Shared lead_fulfillment_claims remains the Market/Territory/Package exclusivity boundary. package_fulfillment_state is empty by default: status reports fulfillmentReady=false, while activation, renewal, delivery, and UI charging stay disabled until the Admin CSV/routing child installs the actual trusted caller. Fresh bootstrap applied migrations 0001–0030; corrected focused proof passed 13 files / 84 tests and full bun run verify passed 54 files / 523 tests, TypeScript, and Vite assets/index-Bwbik46R.js. This branch is not staged or deployed; hosted acceptance remains separate.

Buyer auctions parked for MVP (2026-07-14, branch-local / verify-green): codex/v60-park-auction-mutations starts from exact base b1b8709 and adds one fail-closed AUCTIONS_ENABLED text binding, enabled only by the exact string true. Missing, false, or malformed values make bid and buy-now POSTs return 410 feature_unavailable before browser auth or D1; cron settlement/restock, their exported aliases, new auction/floor WebSocket upgrades, and internal realtime fanout do no D1 or Durable Object work. Read-only auction GETs, schema/tables, realtime classes/bindings, A_MARKET_SENTINEL, direct Market purchase, and Territory allocation remain intact. Health exposes only the resolved boolean auctionsEnabled. Read-only preflight found production at 27 active / 3 discount / 2 ended-sold / 1 archived sentinel, with zero active/discount lots having bids; two users have 21,500 stale held cents but neither is a current leader, and 14 portfolios use the sentinel. Staging has one archived auction, zero bids/holds/sentinel portfolios, but its sentinel lookup returned no row; staging reset/provisioning must restore A_MARKET_SENTINEL before Market/Territory acceptance. Every remote query reported changed_db: false. No cleanup is authorized here: default-off can strand existing leader holds, and re-enable can immediately settle overdue lots, so both require separate operator reconciliation. Focused auction/realtime/Market/Territory proof passed 8 files / 98 tests; full verify passed 44 files / 442 tests, TypeScript, and the production build.

Wallet subledger and exact-refund integrity (2026-07-14, branch-local / verify-green): codex/v60-wallet-refund-integrity starts from exact v60 master 5ae6304 and adds migration 0029. users.balance stays the buyer-visible total while purchased and promotional components become database-enforced; signup and verified funding bonuses are promotional, verified Stripe principal is purchased, and Market/Territory spend promotional funds first while preserving held coverage. Every new debit stores one immutable source split. Exact approved refunds restore that original split once through permanent outcome/completion guards; unresolved legacy provenance cannot mint credit. Historical balances are preserved as purchased/zero promotional and all historical ledger rows are sealed immutable. A schema marker makes owned money mutations return retryable 503 during code-first rollout until the complete schema exists. Real foreign-key-enabled SQLite proof applied migrations 0001–0029, rejected historical ledger UPDATE/DELETE, accepted parent-before-claim refund creation, rolled back a concurrent second pending request, and proved a durably committed Territory debit cannot be deleted before its one guarded seal transition. Focused proof passed 50/50; full verify passed 46 files / 489 tests, TypeScript, and the production build. This is not staged or deployed; persisted $5,000 Package billing is next.

Atomic direct Market purchase (2026-07-14, branch-local / verify-green): codex/v60-atomic-market-purchase starts from exact base f4c9a8e and adds migration 0028_atomic_market_purchases.sql. Canonical acquisition now owns both public list price and charged price (Cold $90, Warm $150, Hot $250); pending/unclassified, every auction-owned/history row, and Territory-owned/in-flight rows do not list. Absence of a Territory claim or explicit open_market is required consistently by list, count, preflight, and transactional claim. A unique lead claim gates one D1 batch covering guarded wallet debit, sold ownership, portfolio/stage, delivery, and ledger, while same-buyer retries return the original outcome and different buyers fail closed. Fresh local migrations applied 0001–0028; read-only production and staging D1 preflights found no duplicate historical Market ledger references. Post-review verification passed the cross-channel suite 42/42, full verify 43 files / 410 tests, TypeScript, docs, and production build. Auction behavior, wallet subledgers/refunds, Package, import, UI, FHC, and deployment remain outside this child slice.

Marketplace v60 MVP boundary (2026-07-13): version-control provenance resolved the apparent mock/handoff conflict. Zak's July 13 PR #161 commit f8b192b is the real v60 visual source and PR #193 is its merged real-app port; the July 5 preview files previously on main were stale. A full sweep of Zak's recent PR bodies, issue comments, reviews, inline comments, and commit chronology found no later marketplace instruction: #161's final v60 supersedes everything above comment and #193 govern, while #160/#162/#168/#176–#179/#194 are FHC-only. The governing model is CHOOSE (Cold $90 / Warm $150 / Hot $250), SUBSCRIBE ($5,000 wallet-funded Package for 25 delivered Hot leads at $200), and OWN ($150 minimum Territory bid that must cover the lead tier). See docs/plans/marketplace-v60-alignment-matrix.md. Confirmed post-MVP/parked work: buyer auction Floor/bid/buy-now/anti-snipe UI, buyer manual lead entry, recurring Package anniversary billing, and refund automation beyond the current request/decision flow. Parking the buyer auction surface does not authorize deleting auction persistence: Market and territory-allocation purchases use auction-backed portfolios and the sentinel auction. The old buyer-facing Standing Orders/auto-buy product stays deleted; the retained allocator currently uses a legacy standing_orders table name. Admin manual/CSV intake remains a required MVP supply path and is not the parked buyer manual-entry feature. Comps and Sequences remain outside this six-screen MVP.

Marketplace v51 foundation (2026-07-12, local only): feat/marketplace-v51-foundation starts from 6a21f4a in an isolated worktree and adds the locked source-based money seam. Shared integer-cent rules cover Cold $90 / Warm $150 / Hot $250, bulk tiers, territory bid eligibility, package shortfalls, deposit bonuses/minimums, and budget treatment of new spend versus prepaid fulfillment. Runtime wiring was deliberately reverted after review found that current FHC source values are page/campaign slugs and cannot distinguish paid ads from organic traffic; partially enforcing the strict vocabulary would hide valid inventory while legacy allocation still charged mutable prices. Not pushed or deployed. Next: define and migrate canonical acquisition attribution, then wire ingest, Admin approval, Open Market, and territories coherently.

FHC production receipt (2026-07-16, live): exact source 100b253a3cefe29fbf482244f603046cfa0a48ba serves on Cloudflare Worker version c5786384-4ba6-4b0b-bf14-979f30b81de4. Supplied live proof: apex 200, www → apex 301, canonical /es direct 200 and self-canonical, /es/ → /es 307, and a Spanish twin 200. Live /es, sitemap.xml, and sitemap-es.xml SHA-256 values match the exact local artifacts; the deployed sitemap holds 957 full URLs and 256 Spanish URLs. This proves routes/artifacts, not Google discovery, crawl, or indexing. The pre-deploy gate was FHC 480/480, zero audit blockers with 12 existing thin-page warnings, provenance 103/103, offline links 8/8, and public-output smoke. Wrangler uploaded/deployed successfully, then route rewrite reported authorization code 10000 because the token lacks Workers Routes permission; issue #230 tracks that follow-up. Existing apex/www routes remained attached and the probes prove the new version is live. No copy/data/FHC-10/provider delta. Freshness enforcement remains deferred pre-September under issue #229, due 2026-08-31; it is not shipped.

FHC #225/#226/#228 current-main reconciliation (2026-07-16, source merged at 100b253; no Soldi deployment): #225 contributes a real accessible /es hub for the 255 existing Spanish twins; #226 emits flat dist/es.html, with local Worker evidence that canonical /es is direct 200 and /es/ redirects to /es; #228 restores docs/shots/funnel-mockup.png as the Soldi funnel image and retains docs/shots/fhc-es-hub-local-20260716.png as a separate local-source capture. The canonical sitemap’s 956→957 count is source route membership only, not a hosted-serving/deployment or Google crawl/indexing claim. The incoming receipt’s source build is 966 generated pages / 255 Spanish twins / 1,193 files / 967 recursive HTML; audit, 103/0 provenance, and 8/8 offline source links passed. The v60/PR #196 CSV path remains fail-closed local-train proof at 6d251c7, not merged to main, hosted, or live. FHC PR #214 is live separately; this Soldi train is neither staging nor production.

Marketplace v60 canonical acquisition (2026-07-13, PR #198 landed in the master train): migration 0026 adds independent leads.acquisition_source (cold | organic | ppc | pending) while retaining leads.source as raw campaign/manual provenance. Historical rows default to explicit pending; only the 18 code-owned v60 fixtures are classified by exact ID, never by a historical campaign slug. FHC/HMAC intake can submit only pending; an approved, priced exact Admin classification now acquires one leased claim and attempts the retained Territory priority allocator before a no-match becomes Open Market inventory. Migration 0027 makes that handoff idempotent and token/CAS guarded across wallet, cap, ledger, portfolio, delivery, and counters; the $150 Territory minimum covers Cold/Warm and Hot requires $250. Pending rows still cannot allocate or complete Market purchase. The train also explicitly reconciles main's PR #161 merge while retaining the same Zak f8b192b preview and PR #193 app contract. Admin CSV import remains a separate follow-up boundary. Next: atomic server-authoritative Market purchase.

Marketplace v60 launch consolidation (2026-07-14): PR #196 is green at 3c997b5 with #197/#198 integrated, but remains locally proven rather than staged or production-deployed. Conflicting PR #180 must not merge directly over Zak's v60 work; it is the verified semantic source for narrow Market transaction, Admin CSV/import-integrity, refund-integrity, exact-SHA health, staging-control, and hosted browser-harness ports. New migrations start after current 0027. Deposit minimum/promotional-credit accounting and the persisted wallet-funded Package lifecycle are genuinely new work; current Package state is device-local. Territory bid enforcement already exists and needs focused closure rather than a rebuild. Release order is: finalize/deploy independent FHC PR #199 at its newest Zak head, merge current main into #196, land the focused backend ports/new economy slices, restore one consolidated launch packet, then require four reset-isolated exact-SHA hosted staging runs before production. Live Comps, Sequences sending, supplier self-service, and seller payouts remain post-MVP.

Marketplace v60 security boundary (2026-07-14, child PR in publication): unsafe cookie-authenticated requests now require exact same-origin intent plus a session-derived CSRF cookie/header; CORS no longer reflects foreign origins. Hosted missing-Stripe deposits and missing-secret FHC ingest fail 503, while their fixtures remain localhost-development-only. Hono is upgraded out of its direct runtime advisory. Full proof passed 41 files / 390 tests, TypeScript, and Vite. This closes the cross-site/fail-open boundary only; atomic Market debit/vertical authorization, wallet purchased/promo subledgers, refund races, and auction concurrency remain separate required slices before staging.

FHC fabricated city-data removal (2026-07-16, PR #219 merged; source-only): #219 removes dormant fabricated social proof at the CityData schema/data/generator boundary and deletes the unused curated testimonial payload. Its strict schema and independent fabricated-claim sentinels guard against restoration while leaving the approved mixed direct-purchase/partner model and real environment-injected review counts intact. Clean pre/post FHC output is unchanged; this merge does not deploy FHC.

FHC Zak reconciliation (2026-07-16, PR #214 merged/live; PR #216 merged): rebuilt the surviving #208/#211 hardening on current main without replaying stale pre-#199 branches. PR #214 (2f5e618) is live and preserves calculator-only framing while adding ordinary-page anti-framing CSP, source links and provenance/link-health gates, corrected Illinois market citations, conditional-offer enforcement, and accessibility heading/contrast repairs. PR #216 retains Zak's freshness/superseded-claims reports with dated current-status context and makes the path-filtered FHC CI job run its 447-test suite before build/audit. FHC may buy qualifying houses directly and may work with partners; offers remain conditional. docs/content/SOURCE_OF_TRUTH.md records the authority order. Future FHC deployment remains independent from Soldi.

Historical snapshot — superseded by the v60 boundary above (2026-06-01). At that time all 7 tabs were live, real-data pages — no disabled tabs, no mock data. Deployed: app at app.soldi.cc (+ workers.dev) on remote D1; interactive deck at docs.soldi.cc/walkthrough; questionnaire at /product-direction. 109 tests green. Done: Auction Floor (geo sub-markets + KPI bar), Lead/Bidding (holds + anti-snipe + buy-it-now), cron settlement, Pipeline kanban, Comps (AI ARV, mock provider), Sequences (seeded), Portfolio/Leaderboard/Activity wired to D1, design-system + closer-v2 reskin. Settlement C3 audit (2026-07-01): cron settlement is covered by worker-level tests for due selection, unsold marking, winner hold-to-charge conversion, wallet charge ledger rows, portfolio creation, and floor sold events. The due-auction query now normalizes D1 timestamps with datetime(...). Market buy C1 fixture proof (2026-07-01): fixed-price Market purchases now create portfolio_stages rows, and migration 0019_market_portfolio_stages.sql backfills old portfolios missing stages. The demo buyer's fixture-funded L_MKT_09 purchase renders in Pipeline with seller contact details; the real Stripe-funded proof landed 2026-07-03 after worker secrets + dashboard webhook were set (see P1/P2 note below). Buyer mockup parity (2026-07-01, shipped via PR #61): the remaining old buyer screens now match the reviewed buyer mockup shape. Market is a masked fixed-price lead table with distress tabs, Grid/Map, Standing Order banner, and Just claimed ticker; My Leads routes to a dedicated owned-leads table; Territories is a PL-style standing-order table with real bid steppers and an Add More Territories modal. docs/content/TESTING_PLAN.md now defines the unit/integration/programmatic/e2e proof gates for app, docs, previews, and FHC surfaces. Live deploy proof: app.soldi.cc serves assets/index--WTSuKDJ.js, and docs /testing-plan, /build-log, and /roadmap render the new entries. Admin refund C2 proof (2026-07-01): the Admin console now has a refund review queue backed by GET /admin/refunds, with buyer/lead context and approve/decline actions wired to the existing refund decision route. A dedicated production admin@soldi.cc account was created through live self-service registration, then elevated through remote D1. Live browser/API proof submitted a demo buyer refund through RefundModal, showed that request plus seeded RR_MKT_03 in Admin, approved the fresh request, credited the wallet, showed buyer Refund Status approved, returned 409 on decision replay, and returned 403 for non-admin access. Walkthrough refresh (2026-07-01): the docs walkthrough buyer section now reflects the fixed-price Market table and has dedicated My Leads and Territories slides with current browser-captured screenshots from the buyer mockup parity work. Adversarial live QA (2026-07-01): hosted browser QA found and patched buyer-parity gaps that bundle/health checks missed. Market no longer presents a fake map when no tile provider is configured; it shows an honest coming-soon map state while keeping the live lead list usable. Territories now has real per-row weekly-cap controls wired through the standing-order update route. Remote D1 migrations are applied through 0019, and the deployed preview scrub still hash-matches the twin local files with no residual non-fixture PII. Final live proof on app Worker version 61ce08a4-0fa6-4596-b859-45fae1a99c4c / bundle assets/index-BzIT9cCX.js recorded zero console/page errors on desktop and 375px mobile while exercising Market filters, Map, Leads dossier, and persisted Territory bid/cap updates. Growth backlog specs (2026-07-01): Zak's parked ads asks are now scoped as PRDs, not implemented: Consent Mode v2 / enhanced conversions, and Google Ads offline conversion imports keyed on lead-quality outcomes. FHC PR #199 newest-Zak-head release (2026-07-14, merged and live): Cameron resolved the engineering identity model as mixed — Fair Home Cash may directly buy some qualifying houses while other transactions may involve partners — so direct first-person money-page language is not categorically dishonest. Zak's newest 43ca26f best-site wave is preserved: 24 total single-question FAQs, a sourced 50-state selling-cost report, full photo self-hosting, calculator embeds, re-indexed state divorce content, six Chicago neighborhood pages, and PNG favicon coverage. The owner-directed correction above it updates About/Privacy/Terms/legitimacy/llms.txt to describe both paths and qualifies unconditional offer results without removing Zak's direct-buy voice or 24-hour aspiration. Sol's reviews also drove fixes for blocked or overbroad third-party embeds, stale embed chrome, missing Illinois-calculator consent forwarding, and the complete FAQ/state/hero/success-state automatic-offer corpus. The attributed ledger is C01-C64/A01-A14. The launch audit applies the mixed-model copy policy recursively to every built HTML artifact. Connector mechanics remain disclosure-only; qualified direct purchases are allowed; universal purchase/offer guarantees and fabricated track record remain blockers across visible, JSON-LD, and meta/OG layers. origin/main at d2d8173 (merged PR #161) remains incorporated through merge commit 9c48345. The corrected tree passed 42 focused FHC/ingest/embed tests, 965 generated pages / 255 Spanish twins, recursive 966-HTML audit at 0 blockers / 0 warnings, root 37 files / 354 tests plus production build, docs build, diff check, immutable-head Sol approval, and GitHub CI. PR #199 merged as 8abfe6b; Worker version 8b16585d-dd35-4f26-acc4-fb26b7f3a488 is live with representative EN/ES page, conditional-copy, www redirect, and calculator-only framing proof. The current route token still returns code 10000 after activation when Wrangler tries to rewrite the existing domain attachment; prior rollback version is 6f180e61-f7bc-4eaa-98e4-8a5605e041e3. The complete attributed ledger is at docs/implementation-notes/fhc-copy-identity-audit-ledger.md. Elite Flippers Meta ads foundation (2026-07-06): a static launch-control artifact lives at /elite-flippers-launch/ on the unlisted growth-ops briefing surface (repo ops/ workspace; moved off preview.soldi.cc 2026-07-07). The official Meta meta-ads CLI is installed locally in an isolated Python 3.13 venv. This is an external client-growth planning lane, not a Soldi app feature; it remains blocked on a dedicated Meta system-user token, Elite Flippers ad account/Page/dataset IDs, and human approval before authenticated reads or paused campaign drafts. Platform completion A0 (2026-07-03): docs/content/prd/SUPPLY_SIDE.md now defines the supply-side plan from Fair Home Cash capture into Soldi: FHC bridge plus admin manual intake, price bands plus admin override, admin-first funnel visibility, and seller payouts parked as spec-only until the lead-marketplace vs principal business-model decision is made. Platform completion A1/A2 (2026-07-03): FHC lead forwarding and a cutoff-safe backlog drain are live-proven into Soldi Admin pending review. Admin pricing, manual lead intake, safe approve-to-Market, and batch discount controls are merged and live-proven. A2's table-backed lead_price_bands correction is also merged, remote-migrated, deployed, and live-proven with PB_IL_COOK_PRE_FORECLOSURE_HIGH resolving an unpriced manual lead before Admin override, approval, discount, audit capture, and cleanup. Platform completion A3 (2026-07-03): Admin now has a live supply-funnel view with captured/scored/priced/reviewed/ listed/sold-expired counts and recent lead drill-in rows for source, consent evidence, quality, review status, current price, and price history. Seller-facing status remains spec-only/PENDING_CAM until the seller business-model decision is resolved. Platform completion G1 (2026-07-03): Settings now has a live-proven hub for profile edits, password changes with session rotation, buyer preference persistence, and Account links to Payment & Budget/sign-out. The saved buyer preferences are consumed by Territories when creating Standing Orders. Live proof on app Worker version e0f655f7-32a5-479a-b05b-cbfff367bf19 covered profile update, old-password 401/new-password 200, D1 persistence, Territories prefill, desktop + 375px screenshots, and zero console errors. Platform completion P3/G2 (2026-07-03): Billing no longer has the decorative card selector or auto-reload checkbox. Add Funds uses amount-only hosted Checkout/demo deposit, card management goes through Stripe's hosted portal, the local demo-token POST /payment-methods route returns 410, and the only low-balance behavior is a real nudge derived from available wallet balance. PR #106 and the follow-up field-name fix in PR #107 are merged and live-proven on app Worker version 36d92928-d55f-463b-b547-0d63bd22a39d with bundle assets/index-Bc0yNyU9.js, desktop + 375px screenshots, clean render console, and portal fixture proof while Stripe secrets remain absent. Platform completion Q (2026-07-03): adversarial live QA is GREEN for the shipped P/A/G surfaces under the parked-Stripe constraint. The pass fixed Admin, Settings, Territories, and D1 status-drift findings via PRs #109-#114, then re-proved Billing, Settings, Territories modal, and Admin supply/pricing/funnel on app Worker version 5eebc802-dc70-4d3c-a3e7-40de88461852 with bundle assets/index-CdT_flXp.js, desktop/375px screenshots, zero console messages, no unnamed form fields, non-admin Admin 403, and remote D1 unpriced_available=0. Platform completion D (2026-07-03): docs/deck refresh is in progress after Q. The walkthrough now has current post-parity buyer screenshots, Payment & Budget cleanup proof, a live Settings slide, separate Admin supply and Admin refund slides, and explicit parked-Stripe wording instead of claiming hosted Checkout evidence before worker secrets exist. SHARE_WITH_ZAK.md has been refreshed as a proof-posture ledger. Final Zak wrap text is not sent until Cam accepts the parked Stripe state or P1/P2 become provable. Platform completion P1/P2 (2026-07-03, recorded 2026-07-06): Stripe went LIVE in production — Cam set STRIPE_SECRET_KEY + STRIPE_WEBHOOK_SECRET on the soldi worker and registered the dashboard webhook to https://app.soldi.cc/api/v1/webhooks/stripe (200 proven, resend included). The full B7 battery is green: hosted Checkout deposit, webhook wallet credit, replay idempotency, Portal customer reuse, and a Stripe-funded lead buy (artifacts/soldi-completion-2026-07/COMPLETION_TRACKER.md). Earlier "parked-Stripe" wording above is historical. The single open P2 item is Cam's delete-or-accept decision on a historical duplicate test-mode Stripe Customer for demo@soldi.cc (pre-PR#123 artifact). Mobile buyer shell + beta-readiness (2026-07-06): the last open MVP code gap is closed on main — commit 46b14dc adds app/src/layouts/MobileNav.tsx (≤640px grouped drawer), a one-row 52px TopNav phone chrome, and a one-line ScoreboardBar strip; sandbox-copy verify green (30 files / 245 tests + build) and in-repo tsc -b green. Not deployed — browser screenshot proof needs a mac session, and the next app deploy deliberately also applies Realtime Wave 3's DO migration (below). A 21/21 non-destructive live QA battery passed the same day (bundle assets/index-CXgZFR3a.js, zero 5xx). The authoritative beta-release spec — testable "beta-ready" criteria B1–B15, the deploy runbook, rollback notes, tester onboarding, and all open decisions with safe defaults — is docs/plans/mvp-build-public-release/BETA_READINESS.md. The Zak "Text 2" wrap is drafted in SHARE_WITH_ZAK.md (gated on P2 + the shell proof/deploy). Post-beta engineering is specced to implementation-ready: Sequences send engine (SPEC_SEQUENCES.md §Implementation plan) and Comps live provider (SPEC_COMPS.md §Implementation plan). Zak mockup port lane B2 (2026-07-07, branch-local / verify-green): the buyer shell now has one Refunds destination, /reports redirects into Billing, Payment & Budget is compacted to Add funds + Monthly budget + Account status + embedded Invoices, the mounted command palette/⌘K affordance is gone, and live-transfer UI copy has been removed from the buyer-facing dossier. This is code-complete in port/nav-simplify with bun run verify green; deploy/browser-walkthrough proof still waits on merge approval and the usual screenshot refresh. Buyer segmentation + setup quiz DONE and DEPLOYED (2026-07-07/08, PRs #157/#158/#159 merged to main, polish commit 20125b7): Market now enforces a server-side buyer-vertical firewall — investors see distressed inventory, agents see listing inventory, guests default to investor — via new leads.vert/ leads.source columns (migration 0024_buyer_segmentation.sql, applied to remote D1). A first-visit setup quiz on /market (vertical, markets, monthly volume) builds users.buyer_profile JSON; it's fully dismissable (✕, Escape, backdrop, "Skip for now") with dismissal/completion persisted in localStorage so it never re-nags, and completed profiles save server-side. "Retake setup" lives in Settings for re-segmenting later. Nav consolidation (lane B2, above) and a make-it-sexy/make-it-simpler polish pass across Market/Billing/Settings/Refunds shipped alongside. Live on app.soldi.cc; walkthrough deck and this roadmap entry are the owed docs refresh from the 2026-07-07 entry above.

Wave 3 — realtime (2026-06-02, built locally; app deploy HELD). A RealtimeRoom Durable Object now powers live bid echoes (sub-second, layered over the surviving poll), a live floor ticker, per-auction chat + presence, and dedicated sub-market "Auction House" pages (/market/:id); CountdownTimer moved to one shared ticker. All local-verified (109 tests) + WS-smoke-proven — not yet deployed: the next soldi-worker deploy applies the DO migration v1, which is what makes realtime live on app.soldi.cc. Remaining: that owner-approved deploy (+ deck-shot refresh) — now coupled with the mobile shell, runbook in docs/plans/mvp-build-public-release/BETA_READINESS.md §2 — plus post-beta Sequences send-engine and Comps live provider (payments went live 2026-07-03; see above).

Built & locally verified (earlier slices):

• Marketplace feed from D1 (auctions list/detail, mappers, Zod).
• Auth/identity (register/login/logout, PBKDF2, signed session cookie, useSession).
• Bidding — POST /auctions/:id/bid: $5-or-5% increments, balance holds + outbid release, 2-min anti-snipe (max 5 ext), wallet transactions, live bid UI with polling + toasts. 62 tests green.
• Wallet funding — Billing keeps instant demo deposits when Stripe is absent and routes Stripe-configured deposits through hosted Stripe Checkout. Production Stripe is live (secrets set 2026-07-03) and webhook credit, replay idempotency, and portal reuse are proven; see artifacts/soldi-completion-2026-07/COMPLETION_TRACKER.md.

Direction change (2026-06-01)

The closer — v2 prototype (reference/closer/public/v2/index.html) sets a new design language and expands scope from "auction house" to all-in-one acquisition desk: one tab replaces PropStream (comps), REsimpli (pipeline), and Follow Up Boss (sequences). We adopt the design system wholesale and add three new pages. We do not rip out working marketplace/auth/bidding logic — this is reskin + additive features.

IA = 5 tabs: Market (The Floor) · Comps (AI) · Pipeline · Sequences · Portfolio.

Decisions:

• Product name (2026-06-01): "soldi" everywhere — name, worker/package, and the wordmark all stay "soldi". We adopt closer-v2's visual system (palette, type, components) but the wordmark text reads "soldi" (Instrument Serif italic).
• Routing model: keep React Router routes (recommended) vs. single-shell tab switching. Plan assumes routes + a shared shell/TopNav with tab styling.

Backlog → prioritized slices

Each slice is one thin end-to-end increment (migration → Hono+Zod route → frontend wiring replacing mock data → tests → local smoke), shippable in a day.

Foundation (must land first):

1. Design-system migration — port tokens/type/components into index.css + index.html, restyle TopNav/LiveTicker/Marketplace/LeadDetail/Portfolio. No data changes. See DESIGN_SYSTEM.md. Blocks the visual layer of all new pages.

New pages (each: read/visual slice first, then live backend): 2. Pipeline — board (read): portfolio_stages/portfolio_actions migration

• seed, GET /pipeline, kanban UI from real D1. (SPEC_PIPELINE.md)

3. Pipeline — moves: PUT /portfolios/:id/stage, actions log, drag-drop, KPIs, filters. Emits stage-change event.
4. Comps — UI + mock provider: comp tables/migration, POST /comps/run against a deterministic seeded provider, full ARV/offer/deal-read UI. (SPEC_COMPS.md)
5. Comps — live provider: swap in ATTOM + Anthropic behind the same contract; cost/latency tracking; streamed deal-read.
6. Sequences — read: sequences/steps/enrollments/messages migration + seed, list + detail timeline UI. (SPEC_SEQUENCES.md)
7. Sequences — engine: enroll → schedule → cron dispatch (email via @velli/email-relay) → engagement status; trigger off pipeline events.

Marketplace/auction completion (interleave as the floor gets restyled): 8. Buy-it-now (POST /auctions/:id/buy-now) + wallet charge + portfolio row. 9. Wallet + transactions page/API; auto-reload settings. 10. Cron auction resolution (60s): settle past-end_time auctions, charge winner hold, create portfolio row, release losers, discount re-list unsold. 11. Portfolio real KPIs + spend/revenue chart + recent wins (assignment fee column for ROI). 12. Leaderboard weekly from D1; gamification (confetti, streaks, badges). 13. Admin / supply side lead ingest bridge, manual intake, quality scoring, price bands, price overrides, supply-funnel visibility, and discount batches. (prd/SUPPLY_SIDE.md) 14. Hardening: optimistic-concurrency on bids (Durable Objects later), test coverage, a11y (drawer/tablist ARIA), mobile, perf (sparkline memoization).

v60 import and Package routing checkpoint — 2026-07-15 (final exact-review remediation locally ready)

Unapplied 0031 adds immutable Admin import/routing receipts and application-owned canonical keys while leaving merged 0030 byte-for-byte unchanged. Package reservation and completion match a validated buyer market only to persisted leads.territory_state_key; the raw route argument and raw leads.state are not eligibility inputs. One shared Territory exclusion still governs Package reservation/completion and Market fallback with textual placeholder order encoded by bind helpers. Every current lead ingress writes the same injective NFKC/case property identity as a compact JSON array, and a partial unique index on every non-null key is the global concurrency fence across FHC, manual, and CSV writers. Signed FHC events have explicit processing/completed state plus an immutable, trigger-guarded completion generation: a superseded worker that resumes after 10-minute lease takeover aborts its entire lead/consent/audit batch instead of committing on a zero-change completion update. Completed-lead replay, after-commit ambiguity, exact cleanup, bounded stale recovery, and completed-orphan reclaim remain intact; orphan reclaim retains old completion proof and records a new (event, lead) generation. Expired Territory recovery now carries persisted acquisition_source into source-filter matching, so PPC/organic leads satisfy inbound filters before Package/Market fallback. Migration property backfill still admits only the provably equivalent printable ASCII subset and aborts on duplicates; unsafe history remains null and blocks Admin import. The production/staging property gate remains read-only duplicate preflight, 0031, application-owned NFKC backfill under the unique fence, conflict resolution, then zero nulls. Expired Territory finalizing claims still revalidate current economics while debited/committing recovery remains protected. Final exact-head local proof passes 7 files / 69 tests and full verification passes 64 files / 615 tests, TypeScript, and Vite assets/index-DawYam7T.js. Local Admin desktop/mobile interaction remains the latest visual proof; the merged default-off realtime remediation closes the earlier client-socket 410 source issue, while hosted exact-SHA acceptance remains unrun. This is local-only: no deploy occurred, package_fulfillment_state remains empty, and fulfillment still waits on implementation plus exact-SHA staged proof of Zak's locked 60% / 30-complete-day / cold-start-zero reserve rule.

Dependencies: 1 → everything visual. 2 → 3. 4 → 5. 6 → 7. 3 emits the event 7 consumes. 10 feeds 11/12.

v60 mobile-primary acceptance follow-up — 2026-07-16 (local source/browser proof)

Zak's current acceptance order is phone first at 390px, then desktop f8b192b parity. The nine gates are now recorded in docs/plans/V60_PARITY_CHECKLIST.md and implemented locally across fund, individual buy, refund, territory bid, Package, stage change, and five-word note paths: <=3-tap buy; bottom-thumb Buy/call/stage reach; bottom sheets; direct phone/email anchors; one-tap stage pills; 44px targets/sticky confirms/swipeable chips; direct lead deep links; and no required horizontal scroll or hover. Open Market now uses true mobile cards and the owned-lead bottom sheet has sticky Call seller plus stage controls. The populated local Territory receipt proves the sheet/context and its unobscured sticky confirmation at 390/390 width. A later physical-iPhone source follow-up keeps the five-tab rail primary while giving the phone account menu explicit My Leads, Transactions, and Refunds access, and replaces the tall Territory row with labeled bid/cap transaction groups; it remains local until normally merged and staged. The original local staging binding correctly rejects cross-origin Vite mutation; a process-only APP_ENVIRONMENT=development CLI override then proved the same UI submit reaches local 201. That override is harness-only and does not replace protected same-origin hosted acceptance. Route lazy loading reduces initial JavaScript to 422.60 kB / 133.95 kB gzip (Leaflet remains deferred). This has no hosted acceptance, deployment, Stripe, PR, or promotion implication.

Zak photo-reference mobile hierarchy pass — 2026-07-22 (local candidate)

Zak's four physical-iPhone photos temporarily govern density and hierarchy for My Leads, Territories, Transactions, and Payment & Budget until his final mocks arrive. The bounded real-app pass restores My Leads title/count/export and structured cards, compacts Territory county/status/bid/cap/remove controls without inventing current-week metrics, turns Transactions into a compact two-column ledger, and gives Billing a real available-balance hero plus dense existing fund/budget/channel controls. The three ways to buy stay expanded by default on phones while Invoices stays collapsible. Shared phone navigation, account access, support access, Stripe/wallet/budget behavior, Package semantics, lead-stage and Territory mutations, 44px targets, and desktop layouts remain intact. Authenticated local-Worker Chrome proof at 320×844, 390×844, and 1440×900 found zero document overflow across all four pages, no undersized visible primary phone controls in the checked selector set, no console errors, and only successful application fetches. Four 390px viewport captures plus a full-page Billing capture are retained in docs/shots/. This is not hosted staging or physical-iPhone acceptance; normal review/merge, exact-main staging deployment, and Zak's device pass remain next.

Package reserve and atomic Market batch candidate — 2026-07-16 (local only)

Merged backend integrity owns 0032_v60_data_integrity.sql; immutable 0033_package_readiness_and_market_batches.sql is superseded for new authority by forward-only 0035_package_reserve_v2.sql. The locked v2 owner wording is preserved verbatim in Package reserve handoff. The scheduled staging caller writes an auditable immutable package-reserve-v2 decision for the preceding 30 complete UTC dates; Package fulfillment is possible only with literal APP_ENVIRONMENT=staging, literal scheduler enablement, and that attested staged-ready row. Undefined, unknown, test, development, and production all fail closed. Every active/cancel-at-period-end Package contributes 25; each qualifying active Hot Territory contributes 6 * weekly_cap, while zero/unbounded cap fails closed. PPC supply is created in-window regardless of market status. The scheduler decision and paid activation/renewal transaction remain enforcement gates; Territory create/raise is deliberately one-sided and can stop new Package sales without blocking the Territory. A v2 trigger rejects a paid transition without a v2 reservation. The direct-Market batch endpoint owns 2–25 leads in one D1 transaction, with immutable idempotency, one market_batch wallet debit, canonical source prices, all-or-nothing fulfillment/portfolio/delivery state, and trigger-backed concurrent ownership fencing. Cold/Warm use only the existing documented 3+/5+/10+ aggregate ladder; Hot stays $250 and no per-lead discounted allocation is invented. Bulk controls remain unavailable pending reset-isolated hosted batch proof. Separately, literal f8b192b Package hero, recommendation, Hot-buy-modal, and unlocked-lead delivery/action copy render only after current server status reports fulfillmentReady=true for that same authenticated user; false, loading, error, same-user revalidation, anonymous, and cross-user cached state expose none. Status revalidates after purchase and on visible-window return with immediate fail-closed clearing and coalesced resume transport. Package reserve remains the promotion gate.

Concurrent build workflow (how we fan out)

Run as Workflow invocations, one phase per turn, so we stay in the loop and verify between phases. Within a phase, agents own disjoint files to avoid conflicts; agents that mutate the same tree run in isolation: 'worktree'.

Phase A — Foundation (serialize, 1 agent + verify). Design-system migration (slice 1). Everything downstream paints against it, so it lands alone first. Verify: typecheck/build/test + screenshot diff vs prototype.

Phase B — New-page scaffolds, fan out 3-wide (parallel, worktree-isolated). Three independent verticals, each its own migration + route + page, no shared files except the router and index.css (already settled in A):

• Agent 1 → Pipeline read (slice 2)
• Agent 2 → Comps UI + mock provider (slice 4)
• Agent 3 → Sequences read (slice 6) Each returns a structured report; a verifier agent runs typecheck/build/test + curl smoke per vertical. Merge worktrees sequentially; re-run the full suite.

Phase C — Make them live, fan out (parallel).

• Pipeline moves + events (slice 3)
• Comps live provider (slice 5)
• Sequences engine + cron (slice 7) Plus an adversarial verify agent per vertical (refute the "it works" claim with real smoke evidence).

Phase D — Auction completion + polish (parallel where disjoint). Buy-it-now, wallet, cron resolution, portfolio KPIs, leaderboard/gamification, admin — grouped so no two agents touch the same files in one wave.

Pattern per phase: fan out implementers → adversarial verifier per slice → synthesize + update BUILD_LOG. No slice is "done" without pasted typecheck/build/test output and an observed local smoke (curl + screenshot). Never deploy.

Definition of done

Every tab works locally against real D1, styled like the prototype, proven by local smoke tests: Market feed + 24h anti-snipe auctions + bidding/holds + buy-it-now, Comps (AI ARV/offer), Pipeline (stage board + actions), Sequences (drip engine), Portfolio (KPIs/ROI), wallet, leaderboard, gamification, admin ingest + scoring, cron resolution. Then daily runs shift to hardening/coverage/polish.

Payments status (updated 2026-07-06): hosted Stripe funding is LIVE and proven — worker secrets + dashboard webhook were set 2026-07-03 and the full B7 battery (checkout deposit, webhook credit, replay idempotency, portal customer reuse, Stripe-funded buy) is green per the completion tracker. The one open Stripe item is Cam's delete-or-accept decision on a historical duplicate test-mode Customer for demo@soldi.cc. Still true: Comps use a deterministic provider, Sequences lack a send engine, and seller payouts/status promises remain parked on the business-model decision (Decision #0). Live refund approval is proven with a dedicated production admin account.

2026-07-15 — v60 backend/data integrity follow-up

Forward migration 0032 is the current local-only data integrity candidate. It replaces placeholder fixture contacts with archived synthetic records, introduces a reconciled fictional investor demo account, canonicalizes the four buyer situations, and removes retired buyer payload fields from worker output. Territory admission is tied to the requested Cold/Warm/Hot threshold and ranked position is available in the Territory API. This is not deployment proof: retained production data still requires the normal preflight and hosted acceptance gates.