Tomorrow's first 30 minutes
- Review + merge 9 queued PRs in order: #57 security → #60 fire drill → #59 bugs → #56 design → #58 env → #53 waitlist → #54 chips → #55 variant A (#48 Sentry stays deferred)
- Verify SendGrid env vars in Railway (SENDGRID_FROM_EMAIL, SENDGRID_CASHEM_API_KEY) — 2 min, P0 silent-failure risk
- Investigate /api/sets?game=ufc 503 — net-new P0 launch-blocker, found tonight via Chrome
- Sign in and visit /binder — confirm PR #59 fix holds for signed-in users
- Decide Pro per-grade price ($75 final?) — blocks 95-ref pricing copy sweep
- Clarify pro_founder accounts — alexbeckman@gmail.com + alex@alexbeckman.com both have it, intentional or revoke one?
Open PRs · review tomorrow morning
For Review
PR #57 · Security batch (April audit, 3 P0 fixes)
2 files, +20/-7. Shell injection (break-processor.ts), seller email leak (routes.ts:8815), filename injection (routes.ts:10683). IDOR already resolved. MERGE FIRST.
PR #60 · Failure mode audit fire drill (7 of 8 fixes)
7 files, +56/-27. Stripe client error, RevenueCat webhook 500, RevenueCat client sync, deck wizard timeout + safe parse, AI cache warmer try/catch, Discord reconnect, JSON.parse safety in TCGdex/Scrydex. Fix 8 (gradeCard) verified already resolved.
PR #59 · Bug debug batch + UFC home boundary
4 files, +36/-6. Binder auth guard (enabled: !!user), UFC home boundary (interim), 404 unicode fix, /search route.
PR #56 · Design should-fix batch (4 of 5)
4 files, +25/-4. Empty states polish, photo upload toast, slab overflow, scanner error inline. Pick'em celebration deferred.
PR #58 · .env.example completeness (32 vars)
10 required uncommented, 30 optional commented with context. 11 sections. Docs-only, fast-merge.
PR #53 · Charter waitlist system
7 files, +320/-4. Migration 0039 + schema + 5 storage methods + email service + 2 endpoints + UI. Re-cut clean from PR #52 collision.
PR #54 · Home hero game switcher chips
1 file, +22/-3. VISIBLE_GAMES as translucent chips below hero search pill.
PR #55 · Charter pop Variant A lock
1 file, +4/-93. Removes Variants B and C + URL toggle. Keeps Gold Card (#001 CHARTER FOUNDING MEMBER).
PR #48 · Sentry observability (deferred Week 3)
Not for June 1. Do May 26-31.
Decisions locked
Decided
Launch date · June 1, 2026
Shifted from May 15 given Ben on board. UFC fight night June 20.
D1 · pro_founder has iOS users (B)
5 users grandfathered, all iOS/RevenueCat-billed, no Stripe customer IDs
D2 · Live in App Store (version iteration not first submit)
D3 · Charter pop Variant A locked (Gold Card)
D4 · Sentry under existing Moonshot OS org (deferred Week 3)
D5 · Hard close Charter at 1,000 + waitlist for v1.0.1 perks
D6 · iOS + web together June 1
D7 · Alex primary, Jimmy backup
Slab budget · $5k working assumption
UFC fight-week activation spec · drafted, ready to fire CC
docs/ufc-fight-week-activation.md · 3 surfaces (home featured card, Pick'em, countdown banner) · two-phase build pattern (scaffold without Hyder's picks, then 5-min fill-in)
Shipped today · 9 PRs in flight + recovery + 3 audits + admin dashboard
Done
PR #14 merged · UFC theming + SGC grader
PR #16 merged · Photo bucket startup warning fix
PR #41 merged · Production runbook (575 lines)
PR #45 merged · P0 audit batch (pool 50, webhook dedup, 8 indexes, structured logging)
PR #47 merged · ADDING-A-SPORT.md
PR #49 merged · RevenueCat tier mapping fix
PR #50 merged · Home search 0-width bug · VERIFIED LIVE
PR #51 merged · Design polish batch (3 P0 must-fixes)
PR #52 closed · Frankenstein recovery successful
Migration 0038 applied to production Neon
UFC catalog · 500 cards, 5 sets imported
5 pro_founder users grandfathered
Design completeness audit (12 surfaces, 85%+ complete)
Documentation completeness audit (7 areas, 6 P0 net-new found)
Failure mode audit (11 services, 10 P0 fire-drill items found)
UFC theming verified live on production
Neon DB password rotated
UFC production smoke (Chrome live API checks)
Hyder Amil confirmed: 20 cards in 2026 Topps Chrome UFC Autograph. Topuria: 20 cards including $65 Image Variation. Legacy fighters (McGregor, Pereira, Jones) only return 1 result each — coverage gap noted for v1.0.1.
UFC fight-week activation spec written
3 surfaces, file paths, API contracts, schema, copy decisions, acceptance criteria, activation windows, kill switch all defined. CC-fireable.
Admin dashboard deployed
moonshotos-admin.vercel.app live with passphrase gate. admin.moonshotos.ai DNS pending. 4 cards: Launch Tracker, Founder State, Cash'em Bible, Travel Bible.
Founder state nightly handoff infrastructure
founder-state.md (source of truth) + founder-state.html (rendered via marked.js). Daily edit workflow: update .md, vercel --prod, done.
External dependencies · Alex action
Critical Path
Hyder Amil hero/Pick'em/slab picks — TEXTED, awaiting response
Catalog has 20 cards already. He just needs to pick 3-4 specific cards. 5-min response from him unlocks the full fight-week activation.
Confirm Ben slab design status (May 15 lock)
Verify SENDGRID_FROM_EMAIL + SENDGRID_CASHEM_API_KEY in Railway
P0 silent failure if missing. 2-minute dashboard check.
Decide Pro per-grade price ($75 final?)
Blocks pricing copy sweep across 95 refs
Clarify 2-of-5 pro_founder accounts (both Alex's emails)
Verify Jimmy Railway access
Verify Jimmy Stripe access
Add CNAME admin → cname.vercel-dns.com at moonshotos.ai DNS host
5-30 min DNS propagation. Cloudflare? Leave proxy off (gray cloud) during SSL provision.
5 pro_founder user IDs identified + migrated
Slab budget · $5k working assumption set
Neon password rotated
Audit findings · P0 net-new items not yet in PRs
P0
/api/sets?game=ufc returns 503 — net-new P0 from live UFC smoke
Hard 503 in production. Binder filter, set browser, browse-by-set all broken in UFC mode. Not in any static audit because both were code reads, not live API hits. CC investigation: feature flag, local catalog read path, or config mismatch.
CSP enablement (security.ts:124)
P1 from docs audit. Touches every page-load behavior — dedicated session.
aiUsageMap memory leak pruning
Graceful shutdown SIGTERM hook
Request correlation IDs middleware
BetterUptime monitoring
Supabase Storage timeout for photo uploads
Charter Stripe webhook atomicity (handleCharterSubscriptionActivated)
If membership creation partially fails, user charged $250 without seat
Stripe customer ID atomicity (routes.ts:5833)
If DB write fails after customer create, Stripe ID lost, manual fix per user
UFC for June 20 · Hyder Amil fight
P0
UFC catalog imported (500 cards, 5 sets)
UFC theming + chip verified live
Hyder Amil confirmed in catalog (20 cards · 2026 Topps Chrome UFC Autograph)
Goldmine set. Refractor + Geometric Refractor variants. Card #BAV-HA. Fight-week activation fully unblocked on data side.
Fight-week activation spec drafted (3 surfaces)
docs/ufc-fight-week-activation.md · home featured card + Pick'em + countdown banner · activation windows + kill switch + two-phase build pattern
Fire Phase 1 CC build (scaffold without Hyder's picks)
Shared utility + countdown banner + home featured card scaffold + Pick'em schema/API/cron. Placeholders for card IDs. Can fire any time, doesn't wait for Hyder.
Fire Phase 2 CC build (fill in Hyder's 3 card IDs)
5-min prompt. Fires the moment Hyder responds.
Fight-week countdown banner (covered by Phase 1)
Featured Hyder card on Home (covered by Phase 1+2)
UFC Pick'em for the fight (covered by Phase 1+2)
Remove BETA badge from UFC surfaces before fight week
Root-cause UFC home crash (boundary is interim)
Needs live debugging session to find actual throw point
Activation checklist morning of June 14
Cards verified, migration applied, cron registered, all 3 surfaces verified on staging, mobile tested
iOS · App Store
P0
Verify native scanner plugin in next build
Cut iOS build with native scanner
TestFlight internal smoke (Alex, Jimmy, Ben, Leo, 3 days)
App Store screenshots refresh (6-screen)
App Store metadata refresh
Apple Sign In verified on TestFlight
RevenueCat IAP verified on TestFlight
Push notifications verified on TestFlight
Deep link smoke test
Submit to Apple Review by May 27
Monitor Apple review status daily
Smoke testing + QA
P0
E2E · signup → charter → scan → seal → grade → R/Y/G
E2E · re-scan dedup (60s silent + different-copy modal)
E2E · Charter Stripe checkout end-to-end
E2E · grading credits buy + spend
E2E · Charter waitlist submission + confirmation email (after PR #53)
On-device slab QA (iPhone 13/14/15/16 + SE)
Scanner field test (varied lighting/finishes)
Seal ID format spot check
Public /s/:sealId page anonymous render
Deferred · v1.0.1 and beyond
Defer
v1.0.1 · Clean up 15 remaining elite/master refs
v1.0.1 P0 · RevenueCat must not downgrade pro_founder/charter to pro
v1.0.1 · Charter A/B/C variants (data-driven test)
v1.0.1 · Public R/Y/G recommendation toggle
v1.0.1 · Pick'em 30-day reveal celebration (deferred Fix 5)
v1.0.1 · Retry 3 failed UFC sets with backoff
v1.0.1 · UFC catalog full pagination
v1.0.1 · Map 20 unknown UFC rarity strings
v1.0.1 · club-join onError defensive String() for nested errors
v1.0.1 · Expand UFC catalog depth for top fighters (McGregor, Khabib, GSP, Silva, Rousey, Jones, Pereira)
Live smoke found only 1 result for many legacy fighters. Hyder+Topuria have 20 each. Backfill needed.
Post-launch · Moonshot Travel failure mode audit (same methodology)
v1.1 · UFC custom illustrations (replace emoji icons)
v1.1 · UFC fighter metadata in card detail
v1.1 · UFC-specific empty states
v1.1 · First-scan guided tutorial
v1.2 · Foil v1 AI authenticity verification
v1.1 · Real-time AR card identify in viewfinder
v1.1 · Public profiles at /u/:handle
v2.0 · Multi-TCG (MTG, Yu-Gi-Oh, One Piece)
v2.0 · Full sports cards (NFL, NBA, NHL, Soccer)
v2.0 · Cash'em Intelligence B2B layer