ELP - What Shipped, What Needs You

Shipped · live now

Five things are live in production. Nothing else is.

The ready items were tangled among 96 commits that also carried held work. A normal promotion would have shipped the held Coach Console, the held Public API, and an explicitly-refused reminder feature straight to John's clients. Instead, a promotion branch was cut off production and only the ready commits were cherry-picked onto it, merged via PR #221.

Highest priority

Cross-tenant security fix. The weekly-triangle route was silently redirecting instead of blocking when someone tried to view another tenant's data, because a generic not-found handler swallowed the real error. It now refuses properly.

Data entry

Empty-field typing fix. Every empty field accepted focus but ate every keystroke on live staging — a bug real users would hit constantly.

Export menu popover anchor. The toolbar Export dropdown now anchors to its own button instead of floating in the wrong spot.

Cleanup

Admin who's-online poll removed when the flag is off, stopping an unnecessary network call.

Hygiene

Git-hook and CI hygiene, five commits, no user-facing effect.

Proof it's actually serving

Railway's deploy branch was confirmed as main by querying Railway's deployment list directly — this had been an open unknown the whole promotion depended on.

The served bundle hash advanced from app-DWg9KO_z.js to app-B-5XBe6W.js. A class introduced by the export-menu fix, export-menu-actions, is present in the new bundle and absent from the old one — that negative control is what makes this proof, not a guess.

Deployment 7f98807909 on main reported SUCCESS at 20:39 UTC; the prior deployment is now removed.

Revert recipe, ready before the promotion: revert merge commit 7f98807909 on main and push — Railway auto-redeploys. Pre-promotion production commit was c2cf4ea8.

One conflict was resolved, not forced: the security fix also carried an email route belonging to held reminder work. The security fix was taken and the email route omitted, then verified absent. Some staging-infrastructure commits riding in the same batch were deliberately left behind — they're staging infra, not the "test and CI hygiene" this report classified ready.

Waiting on you

Six things need your call.

Nothing here was decided for you.

Marketing copy for the public API and CLI was never drafted. Nothing was published, which is correct — it needs a GTM pass and your eyes before anything promised to a customer goes live.
Three billing/Stripe branches and six calendar/Drive branches are roughly 500 commits stale. The two biggest "someone might still want this" chunks. They need an explicit keep-or-drop call, not silent deletion.
A client-document recovery branch, share-docs-version-control, is the only remaining copy of work whose own commit message says it "vanished once already." Relates to John Anderson client docs. Recommendation: revive.
A merged branch is holding uncommitted work. fix/coach-greeting-correctness is fully merged, but its worktree has uncommitted edits to the brain's context module and its test. Deleting it on merge-status alone would destroy the only copy.
Editable reminder send-times stays held. Its own history records "REFUTED: 0 block, 3 major." No feature flag or tier assigned.
The integration branch doesn't yet contain production's merge commit. Doctrine says it must. Small follow-up, deliberately not done because that branch's checkout had an uncommitted edit — not safe to touch a dirty tree on a production-adjacent branch.

Branch analysis

183 branches, 61 live worktrees, one honest audit.

Full audit written to .planning/branch-audit-2026-08-11.md on the desktop.

183

branches total

fully merged, safe to delete

102

open

worktrees with real uncommitted work

stale, prunable worktrees

~130

recommended abandon

~130 branches recommended abandon: build-phase scaffolding, agent worktrees, May-era prototypes, April WIP snapshots. None hold uncommitted worktree content.

Active and current: the organizations/multi-tenancy branch and a Super Productivity port branch, both committed today.

Weekly email

Tested end to end without ever sending a real email.

A rolled-back database transaction on staging drove real factories, real PDF generation, and the real mail template through an in-memory transport that renders the full pipeline but never opens a socket.

Captured message: subject "Your Weekly Triangle, week of Aug 10 2026", attachment weekly-triangle-2026-08-10.pdf, 24,285 bytes with valid PDF magic bytes.

Honest limit: this proves the template and attachment are correct. It does not prove the SMTP hop — no mail catcher exists on staging yet. Named follow-up, not a silent gap.

Twelve settings have no user-facing surface. All four reminder schedule slots (each with an enabled toggle and a time), plus a reminder timezone and three reminder-settings keys. Confirmed by searching the entire frontend: zero references. Every one belongs to the held editable-send-times feature.

Settings that do have a surface: cadence intervals and the in-app channel, as real checkboxes. Email and calendar channels are deliberately disabled with a "coming soon" tooltip, and that reason is recorded in code.

A guard now prevents this from recurring, proven by sabotage in both directions: removing a setting made the build fail naming that setting; stripping a written reason made it fail naming that setting. Both reverted clean. Landed on the integration branch.

Public API and CLI

Verified live against staging, with real proof.

A real token was minted, documents listed, and a document updated with the change confirmed in the database itself, not just echoed back by the response.

Failure modes genuinely exercised: no token gives 401. Another tenant's document gives 403. A nonexistent document gives 404, so not-authorized and not-found stay distinguishable. A revoked token stops working immediately. The rate limit was observed firing live, not read from config.

Not exercised: the expired-token path. Stated rather than glossed.

The cross-auth leak now has a guard with proven teeth. The original defect let a web session authenticate API requests with no token at all. Sabotage by swapping the route group to session auth produced a literal failure, Expected 401 but received 200. Reverted, re-verified, diff-confirmed clean.

A correction worth stating: the documentation already existed. The work was dispatched on the assumption it did not. The API reference, CLI usage guide, and overview were spot-checked as accurate against live behavior. No documentation work was needed.

Not production-ready, for three reasons: the expired-token path is unverified, marketing copy is undrafted, and it wasn't confirmed whether its commit falls inside the promotion window.

Not reached

Three things weren't touched, and one contradiction is worth naming.

Not started
The organization model was not started. Now the top priority — the biggest blocker to a first warm-org demo, with a Farbman engagement targeted for October. Confirmed today: migrations for organizations, memberships, and row-level security exist on their branch and were committed today, but no Organization model exists on the integration branch at all. A reachable owner was created for it; the work itself hasn't begun.
Still broken
Production PDF export is still broken and was not fixed. It crashes on Railway, so a demo that exports a Legacy Map fails today. An owner was created. Open contradiction worth naming: staging generates PDFs successfully while production fails — itself a staging/production divergence.
New owners
Four owner agents were created during this run for surfaces that had no reachable owner: the public API and CLI, the weekly email system, organizations, and PDF export.