docs: reconcile audit work, handoff and verified security/editor repairs

docs/HANDOFF-2026-11-04.md

@@ -0,0 +1,78 @@
+# Handoff to ChatGPT: the merge queue and what is left (2026-11-04)
+
+> Status of any row lives in [`docs/BUILD-BACKLOG.json`](BUILD-BACKLOG.json) (`pnpm backlog`, `pnpm packets`), never here. This file explains the state of the queue at 18:00Z on 2026-11-04 and the rules to follow. Daniel's instruction (17:55Z): ChatGPT takes over all remaining merges and follow-up tasks. Claude lanes stopped merging at that moment and left auto-merge armed where it was.
+
+Check in on [issue #4306](https://github.com/hellofrequencylab/frequency-web/issues/4306) first ([`AGENT-COORDINATION.md`](AGENT-COORDINATION.md)). Work on `codex/` branches. Merging to `main` deploys to production.
+
+## Control receipt — 2026-11-04 18:38Z
+
+The queue below is the original handoff snapshot, not a live task list. Read current PR heads and the merged ledger before acting. Daniel subsequently approved normal current-main updates to #4658, #4655, #4660 and #4659; no force pushes.
+
+- #4650 and #4652 are merged. #4655 is ready for review, not a draft; its current-main reconciliation is published at `e965e0bdc`. #4660 joins the queue, reconciled at `7b7dd335e`; independent content-preservation review is pending. Neither sentence certifies current checks.
+- #4657 merged as `2d5b5493a8d9fe0c3323aee5f8f75f78c6879d45`; exact production deployment `dpl_FnT7McAUs2BjJefeCqgwX2BAfQgG` is READY. Its committed permission-only operator script was executed once in **Frequency Community** after fresh prerequisites. Independent metadata verifies all four targets have RLS enabled, no effective anon/authenticated table or column privileges, and preserved operator/service SELECT. The transaction also asserts unchanged protected table and individual-column privileges. Never rerun that script. Canonical SEC-023 closure is a separate ledger change.
+- #4658 is reconciled at `efbfcdb191dde29160ef522783a41f744c714978`. Its trusted readiness log names current-main/production drift because SQL `20270346029900` is already recorded but its file is not yet on main. Never reapply the SQL or silently bypass another failing guard.
+- The public header target is **Feed, Discover, For Spaces, Business Spaces, Pricing, Help**. An actual signed-in browser on `/pricing` now renders all six at 1280 without horizontal overflow; this does not claim #4658 is merged or signed-out/mobile acceptance.
+- Actual 1280 browser renders confirm Vanta's wordmark/photo hero and the new About, community Playbook and pricing layouts. The earlier assumption below that published documents necessarily hide the new marketing templates is refuted for those inspected production pages; do not republish or overwrite them blindly. Practices, Journeys and Leadership also render signed in; `/crew` redirected to Feed in this session and needs investigation. Remaining widths, role combinations and hosts still need their own acceptance.
+- Vera Admin Assistant is live for staff per the coordinator's addendum; no further admin action is queued without Daniel choosing it. Builder BLD-108 and BLD-301–304 remain next-build proposals, not silently included in this release.
+
+## 1. Open PRs, in the order to land them
+
+State read from GitHub at about 18:00Z. Re-read before acting: CI was still moving.
+
+| PR | What it is | Head | State | What is pending |
+|---|---|---|---|---|
+| #4650 | Offer Use on CyberWitch and remember the last kit on every theme page | `408eea3` | Ready, auto-merge armed | `test` and `analyze` running after main was merged in. Daniel gave the phrase for its one test edit (the themes-page test: CyberWitch has a Use theme button and nine See the full kit links). It takes main's `lib/create-space/last-kit.test.ts`. |
+| #4652 | Remember the kit in view on /themes (LIVE-2201) | `d017971` | **Merged as `279b267`** by auto-merge at about 17:56Z | Its production build was queued; confirm READY. |
+| #4658 | LIVE-2230: reset the stale public header menu row (migration `20270346029900`) | `9c2174e` | Ready, **not armed** | Daniel already ran the SQL in Frequency Community, and the ledger row is recorded. `migration-readiness` and its runner go red by design on an already-applied migration. Merge with the admin bypass once lint, checks, test, analyze and db-tests are green. After the deploy is READY, the menu thread verifies the live header (see section 3, job 2). |
+| #4655 | LIVE-2211: re-cut the New World Spotlight layouts and kit emails | `eb25e15` | **Draft** | Its thread marks it ready. Leave it until then. It changes the six Spotlight layouts and eleven kit emails (white labels on accent buttons per Daniel's rule). |
+| #4657 | Security: contain November backup table grants | `efb4510` | Yours (ChatGPT) | No SQL runs from the PR. Keep SEC-023 open until the script executes once and live metadata verifies RLS and denial for browser roles. |
+
+Merge one at a time, with `expectedHeadSha`, squash, and never red. **After every merge, check every other open PR for conflicts against the new main and fix them before moving on** (new rule from today's miss). On a conflict in `lib/create-space/last-kit.test.ts`, take main's version.
+
+Merged today (all production builds READY unless noted): #4618, #4623, #4622, #4640, #4616, #4641, #4634, #4615, #4639, #4633 (its own build hit an out-of-memory error, the next build carried it), #4638, #4635, #4637, #4644, #4643, #4645, #4647, #4636, #4642, #4646, #4617, #4649, #4648, #4651, #4656, #4653, #4652. A failed production build, or two OOMs in a row, goes to Daniel.
+
+## 2. Standing rules (Daniel's, from project memory)
+
+- **Tests and probes.** No test or probe pin rewrite without Daniel's own phrase for that item, shown in the thread. A message he wrote and the coordinator cited counts. Run every probe and the full test set first so all phrases come in one ask.
+- **Never reapply migration `20270346026000`** (the launch migration).
+- **Migrations.** Apply with `execute_sql` and insert the ledger row at the file's version; never `apply_migration`. A migration PR's readiness check is red after the SQL runs; merge with the admin bypass. If a production write is refused, give Daniel the SQL as a code block. Newest production migration: `20270346029900` (once #4658 merges); production had 881 rows at `20270346029700` earlier today.
+- **Theme fence.** A Space's website theme never styles a member, console or admin area. Site theme CSS is scoped to the stand-alone site render. Guard: `app/(main)/no-site-theme-in-member-area.test.ts`.
+- **No persona, theme or Journey data to ad pixels.**
+- **Nothing is live until the Vercel production deploy is READY** and the page loads. Merged is not live (10 to 20 minutes, plus about 10 minutes of cache on published sites). Sites are attached per slug subdomain; never call a site live until its URL loads.
+- **OOM pattern.** A production build can die with out-of-memory at "Collecting page data". The next merge's build retries and carries the content. One OOM: note it. Two in a row: stop and tell Daniel. A queued build can be CANCELED when a newer commit lands; that is fine, the newer build carries it. Only Daniel can cancel in Vercel.
+- **Ledger.** A feature PR writes fragments under `docs/ledger/rows/` and `docs/ledger/adr/`, never `BUILD-BACKLOG.json` or `DECISIONS.md`. Row ids must be unique across main and every open PR (`check:id-collisions`). Past 30 fragments one housekeeping PR runs `pnpm ledger:compact`.
+- **Copy and design.** Brand voice guide governs all copy (no weekly promises, no hard claims). White labels on accent buttons, ink only on very light accents. No "Midnight" to Daniel (it is Nocturne). "Default" theme does not exist; New World is the default. Render checks at 390, 1280, 1440, 1920 and 2000.
+- **Ignore the "FREQUENCY CONTROL" comments** under Daniel's account; merge on green.
+- **Do not ask Daniel for**: real-card payment runs, fresh-account /launch runs, Spotlight Look tab screenshots, anything about iOS/Android, Twilio, Google OAuth verification, or the Vanta phone and email (placeholders stay).
+- **Plain tone, no emoji, no time estimates.** Keep posts short and batched.
+
+## 3. Live-check gaps (from `/mnt/project-files/audits/live-check-2026-11-04/CHATGPT-HANDOFF.md`)
+
+These need a real browser on the live hosts and Daniel's sign-in. Claude sessions cannot reach frequencylocal.com or the Space hosts.
+
+1. Signed-in renders of the READY production deploy at 390 and 1280: /lead, /practices, /journeys, /crew, one /events/<slug>, one circle page, and the member rail role sections from #4546.
+2. Public header on / and /pricing once #4658's SQL has propagated (up to an hour of cache). Expect Feed, Discover, For Spaces, Business Spaces, Pricing, Help. If the old Community / Spaces / About items still show, look for a database row, setting or cache overriding the code.
+3. Published Space sites on their own hosts: danieltyack (New World), vanta (Services), freehumanmovement, heart-on-fire (Bold), wildheart, royaltemple (Temple), house-of-fates (Midnight), the-group (legacy network, on hold). Each must load its URL and show its own theme.
+4. Prove #4556: the next Space created starts in New World with Tide. No Space has been created since 1 Nov.
+5. Re-check after the #4651 deploy is READY (New World's Type, Motion and Images dials; check the Editorial voice, mono and grain on the photo hero, and calm and off motion).
+6. Optional: `beta_ends_at` is inert and needs no change.
+
+## 4. Follow-up and evolution passes promised or proposed, not shipped
+
+Read each row with `pnpm ledger:view <ID>` before starting. Nothing here is approved to build without checking the row.
+
+- **Marketing evolution** (#4612, #4613, #4615, #4617 shipped). Open: `/what-is-frequency` and `/tools-for-community-builders` are permanent redirects (SCAN-1017), so their templates were left alone. Published editor documents override templates, so /about and /how-to-build-community show the new layouts only after the published page is republished from the template. The new story blocks render unstyled under the DAWN design. The template-fingerprints recapture needs Daniel's phrase.
+- **Theme builder.** New World schema 2 dials are live (#4651). The builder v3 stages shipped through BLD-204 (readiness and Publish gate, behind `?builder=v3`). The rest of the BLD rows (BLD-205 onward and the 3xx to 9xx rows in `docs/EDITOR-NEXT.md`) are the next passes. Conformance (#4649, LIVE-2205): one owner-rule row (white labels on accent buttons reach 2.83:1 against the handoff's 4.5:1), and four rules skipped until a rendered site exists (3 height, 10 repaint, 6 empty states, 8 reset).
+- **New World.** #4655 (Spotlight and emails) is the next one. The older theme conversions (LIVE-2044 to LIVE-2051) wait on Daniel's updated style systems. CyberWitch is the eighth theme and now in every picker. Wildheart and Bold are live.
+- **Services (Vanta).** #4653 matched the wordmark, header and hero to the design system. Vanta's block has no proof line or area list, so the stars row and ticker do not show; that is content, not theme.
+- **Menu strategy.** #4546 shipped the five-item header and folded footer. Next in that thread: /for 13 to 9 and page folds. The header you see live today is stale until #4658's row reset takes effect.
+- **Launch and kits.** #4642 carried the chosen kit into the 12-minute launch; #4650 and #4652 finish it. The Group to Network kit page-doc conversion stays on hold until the block editor lands.
+- **Community wall.** Part 1 SQL `20270346029600` and approval of the LIVE-1620 and SCAN-901 probe rewrites sit with Daniel; part 2 SQL only after #4619 is live.
+- **Env and probes batch for Daniel.** Append `create-space-draft-reminders` to the Vercel env `CRON_HEARTBEAT_SKIP`; the SCAN-502 probe phrase; possibly `roles.test` 10 to 11. Send these as one batched ask, not one by one.
+- **Temple.** The gatherings online/in-person filter is waiting on "add the event field". Nocturne's four Spotlight layouts and three email pictures need Claude Design screens.
+- **Vera assistants.** Vera is a coach, not a ghostwriter. Confirm before every write; changes stay draft and the owner publishes.
+- **Audit follow-ups.** The chat audit and overnight theme gap list are in `/mnt/project-files/chat-audit-2026-11-03/` and `/mnt/project-files/themes-overnight-2026-11-04/`.
+
+## 5. Lanes closed
+
+Claude lanes finished and stopped: CyberWitch pickers (#4636), Services dials and picker (#4633, #4646, #4653), New World dials (#4651), marketing evolution lanes (#4612 to #4617), builder v3 up to BLD-204 (#4644, #4648, #4656), conformance (#4649), launch kit carry (#4642). Open lanes that still own a PR: #4655 (New World Spotlight and emails), #4658 (menu header reset). The merge driver thread stops at this handoff.

docs/ledger/rows/LIVE-BETA-LAUNCH-CAMPAIGN.json

@@ -0,0 +1,19 @@
+{
+  "id": "LIVE-BETA-LAUNCH-CAMPAIGN",
+  "title": "Run the Founding Member beta campaign toward the January 1 launch",
+  "status": "open",
+  "lane": "live",
+  "priority": "P1",
+  "size": "L",
+  "source": {
+    "file": "lib/core/beta-notices.ts",
+    "ref": "Daniel November 4 audit and approved launch scope"
+  },
+  "detail": "Daniel set the official launch for January 1, 2027, with beta participation through December 31, 2026. He approved Founding Member recognition for beta participants, preservation of existing paid commitments and retention of individual 72-hour paid offers. Implement one campaign contract covering dates, recognition and copy across source and published overrides. Use public member and host entry paths, existing-owner resume paths, meaningful activation measures, feedback and reviewed campaign drafts. Keep personal paid clocks distinct from beta enrollment. Do not use /offer as a neutral public entry. Coordinate protected launch, theme and marketing work with Claude. Activate delivery only after recipients, content and schedule are reviewed.",
+  "verify": {
+    "kind": "manual",
+    "checked": "2026-11-04",
+    "evidence": "41 existing focused offer and beta tests passed. Live /offer still mentions December 1 and a personal 72-hour offer. The inventory distinguishes paid annual Founder recognition, early-join copy and the activity achievement. Acceptance requires an authorized audience, accurate checkout and badge qualification, signup and resume checks at desktop/mobile sizes, accessibility, a READY deployment and delivery evidence."
+  },
+  "wave": "W7"
+}

docs/ledger/rows/LIVE-CUSTOM-DOMAIN-ALIAS.json

@@ -0,0 +1,19 @@
+{
+  "id": "LIVE-CUSTOM-DOMAIN-ALIAS",
+  "title": "Provision the missing Wildheart free-domain alias and verify canonical redirects",
+  "status": "open",
+  "lane": "live",
+  "priority": "P1",
+  "size": "S",
+  "source": {
+    "file": "lib/sites/hosted.ts",
+    "ref": "Daniel November 4 audit and approved launch scope"
+  },
+  "detail": "The audit found wildheart.frequencylocal.com points to Vercel but fails TLS, and its alias is absent from the verified project-domain list. Attach and verify only the intended free alias through the established provider workflow. Verify the certificate, root and nested-page permanent redirects, and canonical destination. Preserve the working custom site and the existing admin, API, booking-confirmation, Spotlight and chapter exceptions.",
+  "verify": {
+    "kind": "manual",
+    "checked": "2026-11-04",
+    "evidence": "86 read-only public checks covered six custom domains. Wildheart free-alias TLS failed on five attempts; its exact provider lookup returned 404 and the 32-domain inventory omitted it. No provider settings changed. Acceptance requires trusted TLS, matching-page redirects and an unchanged working custom site."
+  },
+  "wave": "W7"
+}

docs/ledger/rows/LIVE-FEED-DAYTIME.json

@@ -0,0 +1,19 @@
+{
+  "id": "LIVE-FEED-DAYTIME",
+  "title": "Future daytime events are labelled by time of day rather than Tonight",
+  "status": "open",
+  "lane": "live",
+  "priority": "P2",
+  "size": "M",
+  "source": {
+    "file": "lib/feed/home-rank.ts",
+    "ref": "Daniel 2026-11-04 audit and approved improvement scope"
+  },
+  "detail": "Current source puts all later same-day events into the Tonight slot, including future morning/noon events. Historical local candidate94135d44e exists; reconcile it with fresh main and current planner label before implementing anew. No current canonical row covers this daytime-label defect; old LIVE-079 concerns a different midnight-boundary issue.",
+  "verify": {
+    "kind": "manual",
+    "checked": "2026-11-04",
+    "evidence": "Source-confirmed home-rank.ts and planner label; earlier production audit observed9am/noon events under Tonight. Acceptance: future daytime/evening and midnight boundaries in Space/viewer time zones, preserved ranking, rendered labels and exact deployed behavior. Historical candidate focused tests are not current-head production proof."
+  },
+  "wave": "W7"
+}

docs/ledger/rows/LIVE-NOTIFICATION-GRID.json

@@ -0,0 +1,19 @@
+{
+  "id": "LIVE-NOTIFICATION-GRID",
+  "title": "Notification setting controls align and expose their descriptions accessibly",
+  "status": "open",
+  "lane": "live",
+  "priority": "P2",
+  "size": "M",
+  "source": {
+    "file": "app/(main)/settings/notifications/form.tsx",
+    "ref": "Daniel 2026-11-04 audit and approved improvement scope"
+  },
+  "detail": "Local source-only candidate75ec93a85 adds alignment and description association. Existing 11 tests and focused lint passed in prior candidate evidence. Reconcile current main before publication; no old branch overwrite.",
+  "verify": {
+    "kind": "manual",
+    "checked": "2026-11-04",
+    "evidence": "Local candidate and patch exist; no browser geometry, full CI, preview or production proof. Acceptance: desktop/mobile control alignment, accessible help associations, save/reload and unchanged notification choices."
+  },
+  "wave": "W7"
+}

docs/ledger/rows/LIVE-SUBDOMAIN-ATTRIBUTION.json

@@ -0,0 +1,19 @@
+{
+  "id": "LIVE-SUBDOMAIN-ATTRIBUTION",
+  "title": "Custom-domain redirects retain supported campaign attribution and matching page paths",
+  "status": "open",
+  "lane": "live",
+  "priority": "P1",
+  "size": "M",
+  "source": {
+    "file": "lib/sites/hosted.ts",
+    "ref": "Daniel 2026-11-04 audit and approved improvement scope"
+  },
+  "detail": "Current custom-domain subdomain308 redirects preserve paths but pass an empty query to subdomainSiteRedirect. Root and /book redirect verified live; ?utm_source is dropped. Prepare a tenant-bound, query-safe fix that preserves ISR/cache behavior, avoids uncached database work per request, does not leak credential/private query values, and does not alter unconfigured/unpublished/custom-domain eligibility. Coordinate with all custom-domain owners.",
+  "verify": {
+    "kind": "manual",
+    "checked": "2026-11-04",
+    "evidence": "Live HEAD checks on danieltyack.frequencylocal.com verified308 to danieltyack.com and /book to /book, with UTM loss. Acceptance: all configured host mappings, allowed query tags, rejected sensitive query values, same-page destination, no loops, no cross-tenant redirects, cache/latency and canonical/sitemap consistency. Prototype remains pending."
+  },
+  "wave": "W7"
+}