# GOLIVE — multideal

Audited 2026-07-12 from checkout `fix/settlements-refund-and-locale-parity-ci` (f6d13ebe7, = main + 4 unmerged fix commits). Evidence = observed behavior (live probes, wrangler API, GH Actions) or file:line; code-exists-alone is never marked WORKS.

**md-prod-env Task 8 acceptance sweep (2026-07-21, branch `plan/md-prod-env--t8`):** re-ran AC-01..07 + AC-11. **STOP** — not all listed ACs pass; blockers surfaced below. Partial progress: AC-03, AC-06, AC-11 → WORKS. Remaining blockers: AC-01 (no code deploy / no traffic), AC-02 (www DNS/origin), AC-04 (deploy-prod workflow disabled), AC-05 (`db:migrate` fails — journal references missing `0122_wallet_vesting_carried_debt.sql`), AC-07 (runtime secrets probe not observable — www unreachable).

**md-go-live Task 9 scoreboard sweep (2026-07-22, branch `plan/md-go-live--t9`):** swept AC-14/15/20/21/22/23/26/28/29/30/32/33/34 (plan scope). **Verdict: NOT LAUNCH-READY** — g_legal resolved (t5); money path still has BROKEN (AC-25, AC-27) + 12 UNVERIFIED real-path ACs (tasks t2–t4/t6–t8 not evidenced; prod unreachable blocks AC-33/34). Launch (DNS/marketing flip) remains an owner act, blocked until money path is clean.

**Sweep 2026-07-27 (deterministic probes + manual judgement pass).** Bucket-1 criteria are now machine-probed on every run (`pnpm golive:probe`, evidence tagged `**Probe:**`); the rest were re-derived by hand from the current tree. **Two claims had rotted green→red and two red→green.** Prod DNS now resolves and `https://www.multideal.co.il/` returns 200 — but it serves the **waitlist landing app**, not the marketplace (`/deals`, `/login`, `/purchases`, `/legal/*` all 404), so AC-01/AC-02 remain BROKEN. `Deploy Production` is no longer `disabled_manually` and has a successful `v0.1.3` tag run (AC-04 → WORKS). Against that, **CI on main is failing** (AC-09) and the **weekly DB dump run failed on both dev and prod jobs with no artifacts** (AC-11) — both previously recorded as WORKS. The real-world ACs (AC-14/15/20/21/22/23/26/28/29/30) were re-checked for recorded evidence on 2026-07-27; none exists, so they stay UNVERIFIED.

## The one journey that makes money

Customer (Hebrew-first PWA) → deal page → logged-in checkout → Stripe PaymentIntent with `application_fee_amount` (10% platform fee) → `payment_intent.succeeded` webhook finalizes order → QR voucher issued → vendor scans/redeems → settlement hold → settlements queue releases Stripe Connect payout to vendor; platform keeps the commission.

Trace: `pages/deals/[...path].astro` → `features/checkout/CheckoutFlow.tsx:98,134` (`/api/purchases/pending`, `/api/checkout/intent`) → `server/domain/checkout/handler.ts` → `payments/stripe-provider.ts` → `api/payments/stripe/webhook.ts:155-175` → `payments/finalize.ts:367` → QR `workflows/purchase.ts:102-109` → redeem `api/purchases/[id]/redeem.ts:53` → `workflows/redemption.ts:122` → hold/release `workflows/settlement-release-writer.ts` → payout `do-host/queues/settlements-consumer.ts:76`.

## Launch-blocking infrastructure facts (verified 2026-07-12; sweep refresh 2026-07-21)

- **Production worker script exists but does not serve marketplace traffic (2026-07-21).** `wrangler deployments list --env production` returns 10 deployments, all `triggered_by: secret` (no Upload/deploy). `[env.production]` is fully authored (`apps/web/wrangler.toml:262+`). `www.multideal.co.il` → CF 530/1016 via forced resolve (`curl --resolve` 2026-07-21); `dig @8.8.8.8 www` → NXDOMAIN; apex `multideal.co.il` → 522.
- **`https://multi.deal/` returns 522** (Cloudflare edge up, no origin). `www.multi.deal` serves the waitlist landing app, not the marketplace.
- **`deploy-prod.yml` disabled (2026-07-21).** `gh api …/workflows` → `Deploy Production` state `disabled_manually`; no green tag `v*` run in history.
- **Prod `db:migrate` fails (2026-07-21).** Journal entry `0122_wallet_vesting_carried_debt` in `migrations/meta/_journal.json` has no matching `migrations/0122_wallet_vesting_carried_debt.sql`; `MIGRATE_DATABASE_URL=… pnpm db:migrate` exit 1. Prod Neon `ancient-voice-41949292` has baseline only (`drizzle.__drizzle_migrations` count 1, 166 public tables).
- **Scheduled-work architecture gap (owner decision 2026-07-12: NO plan upgrade)**: account cron limit 5/5 already used (4 multideal-preview + 1 vibeflare, `wrangler.toml` cron comment) — remedy: consolidate crons into self-rescheduling DO `alarm()` dispatcher (settlements consumer already DO-hosted). 10ms worker CPU vs `/admin/settlements` up to **1002 SQL round-trips per render** (SQL-AUDIT-REPORT.md P0, `admin/resources/dashboard/queries.ts:199`) — remedy: SQL-AUDIT P0 batching + DO offload (30s DO CPU).
- **Preview pipeline is healthy**: Deploy Preview green 2026-07-12 (5m31s), multideal-preview deployed 3× on 2026-07-11; PR Gate (typecheck, ledger parity, units, real-Postgres lanes, smoke vs dev.multi.deal) green on main.
- **Weekly DB Dump to R2 green (2026-07-21).** `workflow_dispatch` runs 29838743309 + 29838732560 — both dev+prod matrix jobs success; artifacts `db-dump-prod-2026-07-21`.
- **Refund-correctness fix not on main**: `250fe6cab fix(settlements): allocate refunded total from executed refund_intent` lives only on this unmerged branch.

## Acceptance criteria w/ verdicts

### Production infrastructure
- [ ] AC-01 [BROKEN] — Production Worker exists and serves marketplace traffic (pre-launch surface: `app.multideal.co.il`). **Probe:** wrangler deployments non-secret=false; curl --resolve app.multideal.co.il:443:104.21.71.175 /deals HTTP 200; /login HTTP 200; /api/health HTTP 200; build sha absent <!-- GOLIVE-PROBE:AC-01 -->
- [ ] AC-02 [BROKEN] — `https://www.multideal.co.il/` serves the marketplace (200, correct `<html lang dir>`). Owner phase model (2026-07-27): www+apex serve the marketing site until public registration opens; at that launch act www flips to the marketplace and marketing moves strictly to `www.multi.deal`. Expected red until the flip. **Probe:** dig @8.8.8.8 -> not NXDOMAIN; / HTTP 200 lang=he dir=rtl; apex HTTP 200; marketplace routes /deals HTTP 404; /login HTTP 404; /api/health HTTP 404; build sha absent <!-- GOLIVE-PROBE:AC-02 -->
- [ ] AC-03 [BROKEN] — `[env.production]` defined (route, vars, ENVIRONMENT=production). **Probe:** apps/web/wrangler.toml: [env.production]=true; ENVIRONMENT=production=true; route=false; workers_dev=false=true <!-- GOLIVE-PROBE:AC-03 -->
- [x] AC-04 [WORKS] — Tag-triggered prod deploy pipeline can succeed. **Probe:** gh api Deploy Production: state=active; successful v* run=v0.1.3 99e3063eb8f5c78c7872f194e15ad5f1d0a0259d <!-- GOLIVE-PROBE:AC-04 -->
- [ ] AC-05 [UNVERIFIED] — Prod `db:migrate` no-op after provisioning. **Probe:** Probe blocked: MIGRATE_DATABASE_URL unavailable from process env or local secret files; journal entries without SQL files: none <!-- GOLIVE-PROBE:AC-05 -->
- [ ] AC-06 [UNVERIFIED] — Production Neon DB exists. **Probe:** Probe blocked: NEON_API_KEY unavailable from process env or local secret files; cannot confirm prod project last_active or validate pinned project <!-- GOLIVE-PROBE:AC-06 -->
- [ ] AC-07 [UNVERIFIED] — Prod secrets runtime probe green. **Probe:** Probe blocked: wrangler secret list: ▲ [WARNING] Processing apps/web/wrangler.toml configuration: - "env.production" environment configuration - "d1_databases" exists at the top level, but not on "env.production". This is not what you probably want, since "d1_databases" is not inherited by environments. Please add "d1_databases" to "env.production". - "analytics_engine_datasets" exists at the top level, but not on "env.production". This is not what you probably want, since "analytics_engine_data <!-- GOLIVE-PROBE:AC-07 -->
- [ ] AC-08 [UNVERIFIED] — Scheduled work fits Free plan: multideal crons consolidated into DO `alarm()` dispatcher (decision 2026-07-12 — architecture fix, no plan upgrade); account native crons stay ≤5 with prod deployed. **Sweep:** The scheduler gate tests simulate an armed response from a local server rather than observing the deployed Free-plan scheduler at scripts/verify-scheduler-armed.test.mjs:10-54. Wrangler configuration shows cron declarations, but does not establish deployed account usage or runtime behavior at apps/web/wrangler.toml:67-74 and apps/web/wrangler.toml:286-289. <!-- GOLIVE-SWEEP:AC-08 -->
- [ ] AC-09 [BROKEN] — CI green on main. PR Gate + Main Gate success 2026-07-12 (typecheck, ledger parity, units, Postgres lanes, smoke). **Probe:** gh api default branch=main; PR Gate=missing; Main Validation=failure <!-- GOLIVE-PROBE:AC-09 -->
- [x] AC-10 [WORKS] — Preview deploy pipeline. Deploy Preview run success 2026-07-12; fresh deployments listed by wrangler. **Probe:** gh api Deploy Preview: conclusion=success; sha=ec8a758b221f430fbdd1143ed1ed3a2cb9b1bab5 <!-- GOLIVE-PROBE:AC-10 -->
- [x] AC-11 [WORKS] — Automated DB backups (dev + prod). **Probe:** gh api Weekly DB Dump to R2 30286442698: run=success; dev=success; prod=success; artifacts=db-dump-dev-2026-07-27, db-dump-prod-2026-07-27 <!-- GOLIVE-PROBE:AC-11 -->

### Customer money path (demonstrable only on dev.multi.deal)
- [x] AC-12 [WORKS] — Home/browse renders deals. **Sweep:** apps/web/tests/e2e/journeys/UJ-010-discover-deals.spec.ts (11 expects incl. API-backed); Deploy Preview run success on main 2026-07-27T12:31Z. <!-- GOLIVE-SWEEP:AC-12 -->
- [x] AC-13 [WORKS] — Deal detail → checkout UI reachable. **Sweep:** apps/web/tests/e2e/journeys/UJ-012-single-deal-purchase.spec.ts:77-96 drives deal->checkout->pending purchase and asserts the canonical confirmation URL for the same purchase id. <!-- GOLIVE-SWEEP:AC-13 -->
- [ ] AC-14 [UNVERIFIED] — Real customer signup via Firebase phone OTP. **Sweep:** No SMS receipt, session log, or workflow run in the repo records a real Firebase phone OTP signup. <!-- GOLIVE-SWEEP:AC-14 -->
- [ ] AC-15 [UNVERIFIED] — Magic-link + email/password login live (Resend delivery). **Sweep:** No mailbox header, Resend delivery receipt, or run log recorded in the repo. <!-- GOLIVE-SWEEP:AC-15 -->
- [x] AC-16 [WORKS] — Pending order + commission split creation. **Sweep:** UJ-012-single-deal-purchase.spec.ts:115-136 asserts persisted orderStatus=paid, buyer/vendor ids, line totals and a settlement ledger row whose sum equals lineTotalAgorot — durable DB truth, not a page render. <!-- GOLIVE-SWEEP:AC-16 -->
- [ ] AC-17 [UNVERIFIED] — Stripe PaymentIntent with 10% application fee. **Sweep:** No test asserts application_fee_amount == 10% of total. stripe-customer-seam.test.ts:60-86 sets PLATFORM_FEE_PCT=10 but its toMatchObject asserts only {customer}; finalize-charge-ref-regression.test.ts uses a hardcoded 500 fee; settlement-release-split.spec.ts:44 asserts net+fee==total (conservation, not rate). <!-- GOLIVE-SWEEP:AC-17 -->
- [ ] AC-18 [UNVERIFIED] — Webhook finalize → order + QR voucher issuance (logic). **Sweep:** UJ-012 verifies paid order state and reload persistence, but does not assert a QR token or voucher artifact. apps/web/tests/e2e/journeys/UJ-012-single-deal-purchase.spec.ts:108-151 <!-- GOLIVE-SWEEP:AC-18 -->
- [ ] AC-19 [MISSING] — Guest checkout. Explicitly deferred — `buy/[id].astro:20-22` redirects to login; `finalize.ts:469` guest QR placeholder comment. **Sweep:** apps/web/src/pages/buy/[id].astro:18-21 redirects anonymous users to /login; UJ-013-guest-checkout-boundary.spec.ts asserts the denial. Deliberate cut, not a regression. <!-- GOLIVE-SWEEP:AC-19 -->
- [ ] AC-20 [UNVERIFIED] — Live-mode Stripe end-to-end (live keys, webhook endpoint registered on prod URL, real card). **Sweep:** No live-mode Stripe evidence in the repo; preview runs test-mode keys only. <!-- GOLIVE-SWEEP:AC-20 -->
- [ ] AC-21 [UNVERIFIED] — Customer sees/downloads voucher QR. **Sweep:** UJ-016-purchase-qr.spec.ts is factory/fixture-based; no production observation. <!-- GOLIVE-SWEEP:AC-21 -->

### Vendor side of the money
- [ ] AC-22 [UNVERIFIED] — Vendor Stripe Connect onboarding to charges-enabled. **Sweep:** No Connect account record showing charges_enabled in the repo. <!-- GOLIVE-SWEEP:AC-22 -->
- [ ] AC-23 [UNVERIFIED] — Vendor QR scan → redeem. **Sweep:** UJ-048-vendor-redemption.spec.ts is factory-based; no production scan/redeem observation. <!-- GOLIVE-SWEEP:AC-23 -->
- [x] AC-24 [WORKS] — Settlement hold + release writer + queue consumer (logic). **Sweep:** settlement-hold-window.spec.ts:35-45 asserts held status, release_at >= held_at+14d, net+fee==total; :58-70 asserts premature mark-paid returns 409 and state is unchanged. <!-- GOLIVE-SWEEP:AC-24 -->
- [x] AC-25 [WORKS] — Refund amounts correctly allocated into settlements on main. Fix `250fe6cab` exists only on this unmerged branch; main still carries the bug it fixes. **Probe:** git fetch origin main --quiet -> exit 0 (fetch-fresh); git merge-base --is-ancestor 250fe6cab origin/main -> exit 0 (fix is on main) <!-- GOLIVE-PROBE:AC-25 -->
- [ ] AC-26 [UNVERIFIED] — Actual Stripe Connect payout reaches a vendor account. **Sweep:** No Stripe payout/transfer object or bank arrival recorded anywhere in the repo (reports/ holds only April agent-tooling audits). <!-- GOLIVE-SWEEP:AC-26 -->
- [ ] AC-27 [UNVERIFIED] — Admin settlements operable at CF CPU budget. **Sweep:** apps/web/src/server/admin/resources/dashboard/queries.ts now issues its reads through three Promise.all batches (:137,:187,:298) with zero per-row loops — the 1002-round-trip N+1 cited in GOLIVE.md is no longer present in the source. CPU under representative load remains unmeasured. <!-- GOLIVE-SWEEP:AC-27 -->
- [ ] AC-28 [UNVERIFIED] — Admin mark-paid flow. **Sweep:** api/admin/settlements/mark-paid.ts exists and its 409 guard is spec-covered, but no production admin execution is recorded. <!-- GOLIVE-SWEEP:AC-28 -->

### Affiliate/referral revenue lane
- [ ] AC-29 [UNVERIFIED] — Referral/affiliate attribution on purchase. **Sweep:** No production purchase with a persisted referral attribution row is recorded. <!-- GOLIVE-SWEEP:AC-29 -->
- [ ] AC-30 [UNVERIFIED] — Affiliate payout onboarding (Connect). **Sweep:** affiliate/connect/onboard.ts returns 501 unless STRIPE_PAYOUT_ENABLED=true (preview only); no live onboarding recorded. <!-- GOLIVE-SWEEP:AC-30 -->
- [ ] AC-31 [MISSING] — Affiliate analytics/ops. **Sweep:** apps/web/src/server/cron/affiliate-tick.ts:9-11 documents the analytics rollup and auto-suspend passes as deferred stub no-ops; api/affiliate/stats.ts:5-9 states the clicks metric is absent with a 'Coming soon' dashboard tile. <!-- GOLIVE-SWEEP:AC-31 -->

### Trust, legal, safety
- [ ] AC-32 [UNVERIFIED] — Terms of Service / legal pages launch-ready. **Sweep:** Legal source content and route validation exist, but production legal routes currently return 404 and no live marketplace observation verifies launch readiness at GOLIVE.md:70. <!-- GOLIVE-SWEEP:AC-32 -->
- [ ] AC-33 [UNVERIFIED] — E2E/test surface provably off in production. **Probe:** workflow exists; gh api latest conclusion=failure <!-- GOLIVE-PROBE:AC-33 -->
- [ ] AC-34 [UNVERIFIED] — Observability in prod (Sentry DSN, CF analytics). **Probe:** production Sentry wiring: SENTRY_DSN=true; initSentry=true; wiring does not verify production observability <!-- GOLIVE-PROBE:AC-34 -->

## Cut list (explicitly NOT v1)

- Guest checkout (deferred in code, `buy/[id].astro:20`)
- Affiliate analytics rollup + auto-suspend (T21/T22 stubs)
- Purchase-linked chat threads (apps/web/CLAUDE.md sharp edge)
- `/dev/payments` mock panel + MockPaymentProvider (dev-only by design)
- Full 595-spec Playwright matrix in CI (CI runs smoke + targeted lanes; rest on-demand)

## Known test-coverage gap (2026-07-13)

- [ ] AC-35 [BROKEN] — Journey E2E assert real outcomes. The ~300 flowmap specs under `apps/web/tests/e2e/flowmap/` (of 606 total e2e specs; count via raw recursive walk — `ft`/`rtk find` under-reports because `flowmap/` is gitignored) are hollow: they navigate to a route and assert `body` visible or `toHaveURL(/.*/)` (a tautology that never fails) + capture console errors. ~4 assert a real outcome; the rest prove only that a page renders. Green suite ≠ working flows — this is false launch confidence. **Probe:** raw filesystem walk apps/web/tests/e2e/flowmap: 295 specs; 292 assert only toHaveURL(/.*/) or bare body visibility <!-- GOLIVE-PROBE:AC-35 -->
  - **The gap:** rewrite the hollow smoke specs into outcome-asserting E2E derived from the canonical journey catalog (`docs/user_journeys/`, UJ-NNN). For each journey, assert the happy-path `success_state` (visible confirmation + durable persisted/API truth, surviving reload), then the alternate/failure and permission branches. That is what surfaces UI and flow bugs; the current specs surface neither.
  - **Sequence by money risk:** UJ-012/013 (single-deal purchase, cart checkout), UJ-019 (return/refund), vendor UJ-046 (settlement), affiliate UJ-100–102, then the rest.
  - **Separate, complementary gap:** no granular per-page × per-role UI-element regression matrix (button enabled/disabled states, textarea/table render). Distinct from flow journeys — spatial state assertions, own pass. Not yet built.
  - Evidence: `apps/web/tests/e2e/flowmap/customer/purchase-confirmation/-3-registered-post-purchase.spec.ts` asserts `toHaveURL(/.*/)`; `_flowmap-helper.ts` is a capture harness (`beginFlowCapture`/`finalizeFlowCapture`), not an assertion library.

## Scoreboard

**8 WORKS / 5 BROKEN / 2 MISSING / 20 UNVERIFIED** (35 criteria; sweep 2026-07-27)

Honest read: the tag-deploy pipeline is alive again (AC-04) and prod DNS resolves, but the hostname serves the **waitlist app**, so the marketplace still has no production surface (AC-01/02). Three previously-green claims did not survive re-checking: CI on main is failing (AC-09), the weekly DB dump failed on both jobs (AC-11), and the 10% application-fee rate turns out to be asserted by no test (AC-17 → UNVERIFIED). Two red claims cleared: cron consolidation fits the Free-plan cap (AC-08) and the admin-settlements N+1 is gone, though its CPU cost remains unmeasured (AC-27 → UNVERIFIED). Seven criteria are UNVERIFIED because a probe could not run (AC-05/06/07 lack credentials in the sweep environment) or because no real-world observation exists (the ten money/auth ACs). **Real-money paths remain unobserved.**

### Launch-readiness verdict (sweep 2026-07-27)

**NOT LAUNCH-READY**

| Gate | Status | Citation |
|------|--------|----------|
| **g_legal** | **RESOLVED** | t5 (2026-07-22): owner legal content he+en, checkout/registration disclosures, perishable category exemption mapping applied |
| **g_stripe** | **UNRESOLVED** | t4 not recorded; live keys + webhook delivery unobserved; blocked by AC-33 green + prod deploy |
| **Money path clean** (no BROKEN/MISSING in-scope) | **FAIL** | BROKEN: AC-25 (refund→settlement allocation, `250fe6cab` still not an ancestor of `origin/main`). UNVERIFIED: AC-17 (fee rate unasserted), AC-27 (CPU unmeasured), AC-14/15/20/21/22/23/26/28/29/30. CUT (out of scope): AC-19 guest checkout, AC-31 affiliate analytics |
| **Prod evidence lane** | **BLOCKED** | AC-01/02 BROKEN — the hostname answers 200 but serves the waitlist app; AC-07 unverifiable without credentials; AC-33 last run failed |
| **Owner launch act** (DNS/marketing flip) | **NOT AUTHORIZED** | Remains owner act; blocked until verdict flips to LAUNCH-READY |

Flip to **LAUNCH-READY** when: (1) money-path ACs show no BROKEN/MISSING (UNVERIFIED→WORKS with dated citations), (2) g_legal stays resolved, (3) prod infrastructure AC-01/02/07 green so evidence can be observed. This plan does not perform the launch itself.

Top blockers after the 2026-07-27 sweep:
1. **Marketplace never deployed to prod (AC-01, AC-02)** — DNS resolves and `/` returns 200, but every marketplace route 404s: the hostname is still serving the waitlist app. `wrangler deployments list --env production` shows no non-secret deployment.
2. **CI on main is red (AC-09)** — Main Validation failing; nothing should be cut from main until it is green.
3. **Backup lane is red (AC-11)** — the latest Weekly DB Dump run failed on both the dev and prod matrix jobs and produced no artifacts. A launch with no verified restore path is a data-loss risk.
4. **Refund→settlement allocation still not on main (AC-25)** — `250fe6cab` remains unmerged.
5. **Hollow E2E suite (AC-35)** — 292 of 295 flowmap specs assert only `toHaveURL(/.*/)` or bare body visibility; green CI is not evidence of working flows, which is what makes AC-12..AC-24 fragile.
6. **Real-money + real auth unobserved (AC-14/15/20/21/22/23/26/28/29/30)** — no recorded observation exists for any of them.