From 247e96644641e0817b0c7c8dcf3922268abf438a Mon Sep 17 00:00:00 2001 From: Moheeb Zara Date: Mon, 18 May 2026 17:21:48 -0700 Subject: [PATCH] =?UTF-8?q?docs:=20HANDOFF=20pass-49=20=E2=80=94=20Phase?= =?UTF-8?q?=203=20P0=20fixes=20deployed=20(run=2026068281306)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/HANDOFF.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 29c68d1..e1bad65 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -16,8 +16,9 @@ Branch `main`. Phase 3 shipped (pass 48) without a dedicated pre-deploy audit; r - Audit PASS (no change): `getMyPayments` caller-scoping, the tab refactor (no data dropped), `proxy.ts` gate, R1 credential-loss/recursion paths, comma-split profile fields. ### State -- **Fix committed locally (f2df287), NOT deployed.** Prod still runs pass-48 with the 2 P0s — deploy this promptly. Commits ahead of origin: pass-48 deploy-state (c8842c3) + this (f2df287) + pass-49. -- Email change still also needs the Supabase project config from pass-48 to function at all. +- **DEPLOYED** (run 26068281306, HEAD 997e2e1, success). Smoke clean: `/auth/confirm?type=recovery&token_hash=x` -> safe 307 (invalid token rejected, query type no longer honored); `/auth/confirm` no-token 307; `/auth/callback` 307; `/me` 307; `/` `/login` 200; Stripe webhook 400 (no regression). The 2 P0s are closed in prod. +- This deploy-state edit is the only commit ahead of origin (docs-only, held per pattern; rides the next deploy). +- Email change still needs the Supabase project config from pass-48 (template + redirect allowlist + Secure email change) to function at all; until then the action sends a link that won't land. The P0/P1 fixes harden the path for when it is enabled. ---