Execute the 2026 Market Domination Strategy: the parts that need no new schema by NewWorldVenture · Pull Request #421 · NewWorldVenture/Bubaly

NewWorldVenture · 2026-09-07T20:00:29Z

Picking up a piece of this

docs/STRATEGY_WORK_QUEUE.md is the entry point. It exists so several agents — Claude, Codex, anyone — can work this strategy at once without colliding, and without needing the conversation any of it happened in. It carries twenty sections, each sized to one reviewable PR, each with the audit's own spec, the files it owns, the tests to add and what a reviewer will check.

Claiming is atomic and needs no coordination: the branch name is the claim.

git fetch origin
git checkout -b claude/strategy-S-07 origin/claude/roadmap-implementation-ld8bon
git push -u origin claude/strategy-S-07          # rejected = taken, pick another

Branch off this branch, not main — it is the integration point and already carries what is listed below. Open your PR against it. The queue also states the rules that are not negotiable (never add a migration; never touch the shared app sidebar; never claim Bubaly did something unless a row says so; a failed read fails closed; every string is a catalogue key in seven languages), and a table of the handful of shared files several sections must each add one line to, with the merge rule for each.

What has landed here

Every one of the strategy document's 60 items was first audited against the code, item by item, with an adversarial verifier over each "this already exists" claim. The audit is committed as docs/MARKET_DOMINATION_AUDIT.md — reachability, persistence, tests, mock risk, gap, build plan and file-and-line evidence per item. The 21 migrations the remaining work needs are listed there and in the queue; none has been added, they are the repository owner's to approve and apply.

The Daily Brief leads with decisions (M4). Brief.decisions is read from approval_requests, runs parked awaiting approval or an answer, pending recommendations and money approvals through the same buildHomeNeeds the Command Center uses — the model never writes one. The route is viewer-role aware: for a non-manager the bills, medication and money reads are not made at all, so nothing reaches the prompt, the fallback or the envelope. A morning delivery step in the notifications cron sends it once per family per day, honouring quiet hours.

One uncapped page for what needs a person (M5). /dashboard/needs-you renders the full ranked list Home caps at five, plus three new sources: family-fact suggestions, unread inbox messages with an appointment or personal intent, and open paperwork actions.

Schedule intelligence in one model (M8). Per event: prep items, a leave-by minute from a real drive-time estimate (falling back to the category buffer), driver conflicts, a shared-vehicle conflict when two events need the one car in overlapping windows, a dinner-timing warning and a care gap.

Autopilot learns narrow policies (M7). Where the same domain, capability and tool was approved three or more times with no rejections and no failed calls, a suggestion appears with its evidence. Accepting it writes exactly one trust policy scoped by tag to that tool. No suggestion executes anything on its own.

A chief of staff that can re-plan (M1). replanRun was implemented and never called; the executor blocked every replan step. It is now wired into the executor port and the continuation paths, capped per run and ledgered as a new plan version, with a chief_of_staff intent whose template runs parallel reads first, then acts grouped by domain.

The Handled ledger says which tool acted and why (M6, M35). Plus /dashboard/concierge/runs, a family run history with state filters.

Every notification is actionable (M21). Each row maps to a deep link, chore and approval rows act inline, and the quiet half of the queue folds into the brief's "Also today" so it is said once rather than once per row.

The Trust Center gets an Activity tab (M24). Persisted tool calls with run links, the autonomy dials beside the policies, and per request the names of what Bubaly was allowed to read and what was withheld — names only, never contents.

The call queue stops claiming a call (M26). Nothing says Bubaly is calling or called unless a provider outcome is persisted; a test pins the vocabulary. compareQuotes ranks real project_quotes with reasons.

Security as a product surface (M36). TOTP through Supabase Auth with honest error states, an AAL2 step-up on money, document and trust routes for users who have a factor, and a Privacy Center that streams a role-scoped export.

Family CFO (M11) — plan-aware forecast and an affordability scenario. Inventory and moving (M13, M14) — both become assistant tools, with a plan_move template and a confirm-it's-here signal.

The public site's first stage (W1–W8, part). An outcome-first homepage: the Bubaly-Handled proof band, the six-outcome rail, and the first-brief, decisions, Kitchen Mode, switching and social-proof bands, with MARKETING_NAV and the footer reorganised around outcomes. Every illustrative element is badged; aggregate lines hide rather than render a zero; the social-proof band returns null when nothing is published.

What the adversarial reviews caught

Four findings that would otherwise have shipped, all fixed here:

The run-history page derived "Started by a routine" from request_id === null, which is inverted on both sides: a plan a person accepts is written with no request, and a cron routine creates one and carries its id. It now reads run_type, and a test pins both cases.
The homepage proof band linked to a live demo that Remove demo mode #414 removed from the app — a dead CTA on a band about honest evidence. Dropped, with the test inverted so it cannot come back.
A recommendation whose cta_href was off-app took the whole Daily Brief down, because that column is free text any member can write. Such a decision now points at the page that lists every decision instead.
Merging main's settleAll surfaced an orphaned promise in lib/briefing/decisions.ts: its Promise.all started listPending(scope) and then evaluated a .from() query that could throw while the array literal was still being built, leaving the first promise running with nobody awaiting it and its rejection unhandled. It is awaited beside the batch now — which is also the shape a ServiceResult needs, since settleAll substitutes the Postgrest { data, error } shape for a rejection and a ServiceResult has ok, not data.

Build

next build was dying on Vercel in "Linting and checking validity of types". The cause was not the type-check's size but its co-residency: inside the build it shares a heap with webpack's module graph, peaking at 4,471 MB against a 4,096 MB cap, where the same check standing alone peaks at 1,082 MB. So it moved rather than disappeared — the build no longer repeats it, and CI now builds before it type-checks, which is what preserves .next/types route coverage (running it first, as CI did, was silently checking none of those).

Checks

tsc clean, eslint clean, catalogue parity across seven languages (11,161 keys in each of the six translations; the 303 en-only keys are all main's and this branch adds none), and each item's tests green alongside the suites they touch. No file under supabase/migrations; no shared-sidebar file; no tests/e2e change beyond the three locator renames the nav change requires.

On i18n, precisely: i18n-gate is clean, and all five gated surfaces scan clean — i18n-ui, app-shell, marketing-header, marketing-pages (app/(marketing)) and marketing-components. An earlier revision of this description said "i18n-scan clean (0 hardcoded strings)", which overstated it, so it is corrected here: that number was never repo-wide. Main's #418 rewrote the scanner to see copy inside a data structure, a JSX prop outside a fixed allowlist, and directories named mobile, and the widened scan finds 2,343 real strings outside the gated surfaces — which is why #418 removed everything from GATED_SURFACES rather than leave a gate that was green on a promise it had no way to keep. Those strings are main's; the sampled ones live in files this branch does not touch. What this branch is accountable for is the gated surfaces, and those are clean.

Draft until the queue's remaining sections land and CI is green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

…e code Sixty items — 40 moves, 8 public-site weaknesses, 12 north-star metrics — each with reachability, persistence, tests and mock risk cited to path:line; every claim of 'exists' put to a refuting verifier; a critic pass for missed items, overclaims, cross-cutting primitives and the strategy's own 'would not do' list. Result: 6 exist, 43 partial, 9 missing, 1 mock. The mock is the public /security page, which asserts certifications and controls the product does not have. Twenty-one schema changes are needed across the proposed builds; they are listed once, reconciled, for owner approval — none is added here. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

…dren, and arrives The brief listed today, what was handled, what is coming and what is overdue — and left out the one section that unblocks work. Pending approvals, runs parked on an OK or an answer, money approvals and recommendations lived only in Home's "Needs you" list; a parent reading the brief at 7am saw none of them. Decisions. `buildBrief` takes a `decisions` slice — rows read by the new `lib/briefing/decisions.ts` through the same `listPending` and `buildHomeNeeds` Home runs, never the model's word — ranks it the way Home ranks it, and leads the headline with it ("2 decisions need you, 3 things today"). The briefing route sends the slice (with the approval card data and wallet kinds the buttons act on) only when there is something to decide, so the pinned envelope is unchanged when there is not; a failed decisions read fails the request rather than serving a calm morning. The page renders decisions FIRST, with the shared ApprovalCard, the wallet's one-tap approve/decline and the recommendation Accept/Dismiss. Viewer role. The route now applies the rule `lib/ai/context/policy.ts` applies to the prompt context: bills, medication schedules and money approvals are read for managers only. For a child they are not read at all — not read-then-hidden — so nothing reaches the model, the fallback or the envelope. A missing role is not a manager. Morning delivery. `lib/briefing/deliver.ts` runs from the notifications cron: per family it composes the same brief under a system scope and files one notification for the managers with the headline and the decisions by name. `related_id` is `brief:<family-local day>` and it is sent with `notify()`'s new `once` guard, which drops a second copy read or not, so re-runs, retries and manual dispatches cannot say it twice. The instant is the family's morning: before 7am local it is filed for 7am, during the day it goes now, after 6pm tomorrow's brief is composed for 7am tomorrow — and the scope's clock is that instant, so quiet hours still apply. A failed read means no brief for that family this tick, counted as a generation failure. The quarantined snapshot store is untouched. Tests: tests/briefing-decisions.test.ts, tests/briefing-role-gate.test.ts, tests/briefing-morning-delivery.test.ts; the existing briefing, schema and store suites stay green.

…ore kinds reach it Home ranks the "Needs you" queue but shows five and rolls the rest into a "+N more" line that went nowhere; /dashboard/decisions is the trade-off scorer, not that page. /dashboard/needs-you (M5) now renders the same queue uncapped through the existing NeedsAttention component: Home's section header and its "+N more" line link there, and the trust page's approvals tab carries a "See everything that needs you" link. The sidebar is untouched. Three things a household actually decides never reached the queue: * a memory Bubaly inferred but nobody confirmed (family_playbook_ suggestions, status 'suggested') — Confirm / Dismiss on the card, through the memory service; a suggestion that has already lapsed is dropped because confirmFact would refuse it; * an unread inbound message to the family's own number or address whose intent wants a human answer (appointment, personal) — Reply deep-links to the message in the Contact Center, Archive goes through a new family-scoped inbox service on the service client (the table has no client write policy), managers only; * an open sign / pay / RSVP action on paperwork, one card per action, skipping actions already materialised into a reminder or event. All three are pure mappers in lib/home/needs-sources.ts, merged by buildHomeNeeds and ranked by the one existing urgency-then-recency order. The card copy for every kind, old and new, now renders through catalogue keys (en + de/es/fr/it/nl/pt). The page fails closed: any failed table or service read logs "[needs-you] <source> read failed" and renders a retryable error state rather than a shorter, reassuring list. Guarded by tests/needs-you-sources.test.ts (mappers, urgency, hrefs, ranking), tests/needs-you-read-boundary.test.ts (uncapped render, family scoping, fail-closed on table and service reads, child read-only) and tests/inbox-service.test.ts (family scoping, role gate). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

Catalogue conflicts resolved by taking both sides and re-sorting keys.

…eryone-policies count as held

… Brief down with it The client pins a decision's href to a same-origin path, but the route forwarded whatever cta_href a recommendation row carried, and that column is free text any member can write. One bad row made parseBriefingResponse return null and every tab of the brief show the read error until the row was dismissed. The reader now keeps such a decision in the list and points it at the page that lists every decision. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

…reQuotes helper

…e on the ledger and social-proof band, badge the Kitchen Mode mock, drop the optional e2e test

…d care in one place (M8, U3) Five engines each knew one thing about an upcoming event — the moment prep bundle with its static leave-by buffer, the real drive-time departure that only Trip Intelligence used, driver clashes on the ride planner, same-person double-bookings, and the horizon prep plans — and nothing composed them. The family still had to open five modules to learn that Saturday's game needs the car at the same time as the recital, that the only free adult is the one already down to drive a carpool, and that dinner is planned for the exact hour of practice. lib/schedule/intelligence.ts is the pure per-event model. For every upcoming timed event it composes the prep items, a leave-by from an injected drive-time fetcher (falling back to the category buffer, and saying which it used), driver conflicts from the ride planner plus the driver's own calendar, a shared-vehicle conflict when more concurrent car trips overlap their leave-by windows than cars are on file, a dinner-timing warning when the meal plan's dinner sits inside the event's away window, a care gap when a child's event has every adult busy and no sitter booked, and the double-booking clusters. Output is a typed ScheduleInsight[] per event with kind, severity, an English reason plus a catalogue reasonKey/params, and the href that resolves it; ordering is total so two renders agree. lib/schedule/intelligence-server.ts loads the rows family-scoped and fails closed: any failed read returns a retryable error and logs "[schedule] … read failed", never a partial model. Drive times come from the family's persisted departure plans through lib/trips/drive-time.ts, the one estimate → departure mapping that Trip Intelligence's save and refresh actions now also go through, so both surfaces land on the same leave-by minute. Surfaces: the event detail modal shows the insights (translated via reasonKey, with a retryable error state); the Today strip on /home renders each event's most pressing insight as its reason and shows a retryable note when the check fails; the Moments page hands the real-drive-time leave-by to the prep cards and says when the saved plans could not be read; lib/rides/schedule.ts gains rideWindow and lib/moments/prep.ts accepts a composed departure. Builds on the interrupted partial work merged from worktree-wf_422148e2-ba1-3, every part of which was verified against the spec by the new tests: shared-vehicle conflict, driver conflict, dinner timing, care gap, injected drive time with category-buffer fallback, the fail-closed loader, and the shared departure mapping. 36 catalogue keys added to en-US and the six base catalogues. No migration. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

…dy approved (M7) Every Autopilot suggestion was a static rule over upcoming dates; nothing read the family's own approval history, so a tool a parent had said yes to ten times was asked about an eleventh time. Now: - lib/autopilot/policy-candidates.ts (pure): the same domain + capability + tool approved 3+ times in 90 days, never rejected, never edited, and never seen to fail becomes ONE candidate with checkable evidence ("Approved 4 times since 12 Aug, never rejected") and a confidence capped below the auto tier, so an offer can never auto-execute. - lib/autopilot/policy-scan.ts: loads approval_requests, ai_tool_calls and the held trust_policies family-scoped, fails closed on any read error (console.error '[autopilot] policy scan read failed'), and reconciles the `policy:<domain>:<capability>:<tool>` rows in autopilot_suggestions — insert, refresh a grown streak, respect a resolution, withdraw a broken streak. Wired into runAutopilotScan and the cron route; the main pass no longer clears policy rows as stale. - Accepting the offer (autopilot module → acceptPolicySuggestionAction, manager-only, through savePolicyAction) writes exactly one trust_policies row: AI × domain × capability, effect allow, conditions.tags = [tool]. - The tool gates hand the engine the executing tool's name as a tag (toolTags in ai-gate.ts and tools/execute.ts), so the tag condition scopes the policy to that tool alone; the Trust audit explains such a decision as "allowed by a policy you accepted on <date>". - Catalogue keys for the new copy in all seven base catalogues. Tests: policy candidates (thresholds, evidence, confidence, dedupe key, ordering), policy scan read boundary and reconciliation against real tables, tag-scoped policy in the trust engine, accept writes one narrow row and nothing else, trust-decision explanations. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

…honesty tests

…ntation-ld8bon

…ntation-ld8bon # Conflicts: # lib/i18n/messages/de-DE.json # lib/i18n/messages/en-US.json # lib/i18n/messages/es-ES.json # lib/i18n/messages/fr-FR.json # lib/i18n/messages/it-IT.json # lib/i18n/messages/nl-NL.json # lib/i18n/messages/pt-PT.json

…om project_quotes Bubaly has no outbound voice integration, yet the concierge queue told a family Bubaly makes the call, the cron flipped due rows to 'calling' without dialing, and the status pill read 'Calling…' off that column. Now: - lib/concierge-calls/brief.ts derives a display state from status AND provider_ref; 'Calling…' / 'Called' are unreachable while provider_ref is null. A due call parks as 'Waiting for a person to call' with the reason persisted in outcome; a parent can log what happened (logCallOutcomeAction), which reads as 'Done — logged by hand', never as 'Called'. - app/api/concierge-calls/place never writes 'calling'; the module, page and front-desk link copy make no claim the row cannot back. The page and the realtime refresh fail closed instead of showing an empty queue. - find_vendor says a parent makes the call, in its guidance, task notes and notification body. - lib/services/providers/compare.ts: pure compareQuotes over the project_quotes shape — ranked with reasons (price, availability, what is included, notes) and every tie explained. Registered read-only as services.compareQuotes, reading through lib/services/home under ServiceScope; the projects quote tab renders the same ranking, labelled as a comparison. - Catalogue: 61 new keys in en-US and the six base catalogues; the six dishonest keys removed. Tests: tests/concierge-calls-honesty.test.ts, tests/compare-quotes.test.ts; the two fixed files leave the silent-empty read baseline. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

…f-of-staff plan A replan step used to block every run that reached it: replanRun existed in the planner but no executor port called it. The planner now exports replanPortFor(db); the continuation helper and the ai-runs cron hand it to runGraph, so a replan step plans the rest of the run as a new ai_plans version. Version N+1 carries every settled step (completed, skipped, failed, cancelled) with its status, result and error, plus the replan step itself as completed, which is how the executor counts re-plans against MAX_REPLANS_PER_RUN (2) without another query. A replan step runs alone and last, never while a step is waiting on a person, and the third re-plan of a run is blocked rather than looped. The validator allows one replan step per plan, requires it to depend on the reads it decides from, drops anything that depends on it and leaves follow-ups to the re-plan; the schema offers replan to the model again now that the port exists. A request that reaches across the household no longer falls to 'other' with no skeleton: a chief_of_staff intent receives the whole tool catalogue and every context slice, is recognised from 'handle it' phrasing only after the signature workflows have had their turn, and plans from a template that reads everywhere first (independent reads), then acts per area behind only that area's reads, then tells the asker, with approval left to the trust dry run. Tests: planner-chief-of-staff (intent, template shape, dry-run gates, and planRequest -> executor end to end: four reads in one wave, one approval gate), planner-replan (version N+1 ledgering and the prompt's account of what happened), run-executor (wired replan continues, runs alone and last, parks behind approvals, caps at two, fails honestly), planner-validation (replan rules), and the schema/templates assertions updated to the new truth.

…uments/trust, and a Privacy Center Settings › Security now enrols, verifies and removes a TOTP authenticator through Supabase Auth's own MFA API (no Bubaly table): the QR + secret come from `mfa.enroll`, "on" is shown only after `challengeAndVerify` succeeds and a re-read lists a verified factor, and a Supabase refusal — most often a project with TOTP switched off — is shown with Supabase's own words as a retryable error, never as a fake "enabled". Unfinished enrolments are cleaned up before a fresh one; removing a verified factor asks for a current code first because Supabase needs aal2 for that. lib/auth/mfa.ts holds the pure half (factor state → panel state, session strength, the step-up decision, safe return paths, error classification); lib/auth/require-aal2.ts is the server guard. Managers whose account has a verified factor are sent from money, documents and trust pages to /auth/step-up when their session is password-only, and come back once a code is entered; families without a factor are untouched. An unreadable assurance level fails closed (to the step-up page, which shows the error) rather than rendering finances behind a guard that gave up. 18 pages call the guard; /dashboard/security (home alarms) stays as it was. Settings › Privacy: "Export my family's data" streams a JSON attachment from /api/privacy/export built through the domain services under the caller's own ServiceScope (role rules + RLS; finances withheld from non-managers, sensitive documents omitted by the documents service). A section that cannot be read fails the whole export with a retryable error — no partial file — and every download is written to trust_audit_logs before a byte is sent; an export the ledger will not record is refused. "Recent exports" and "Who accessed what" read that ledger (fail-closed, managers only, told so). Sessions shows this device only and says why. Deletion is a person, not a button: the card routes to the feedback board and says someone confirms. 96 catalogue keys added in en-US and translated in de/es/fr/it/nl/pt. Tests: tests/mfa-state.test.ts, tests/require-aal2.test.ts (decision, redirect, fail-closed logging, and a source-level check that every guarded page calls the guard), tests/privacy-export.test.ts (role scoping, fail- closed build, streamed JSON, route status codes and the ledger row). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K

…i18n

NewWorldVenture · 2026-09-09T23:00:09Z

Claiming the bounded Family Autopilot action-resolution correction on codex/strategy-autopilot-resolution-20260909, based on current main 593867d5. Review/navigation suggestions will open an existing workflow without being marked handled; actual reminder acceptance will reload the caller's same-family source and use durable source-bound idempotency so a failed suggestion update can be retried after reload without another reminder. Scope includes honest pending/approved/executed presentation, seven-locale copy and actual UI/service failure/isolation regressions. Existing policy acceptance and #433's recorded completed-plan metric semantics remain intact. No provider sends, broad planner expansion, SQL, sidebar changes or scan redesign. Independent review before draft publication.

NewWorldVenture · 2026-09-09T23:00:14Z

Claiming a bounded public aggregate evidence correction on codex/strategy-public-aggregate-evidence-20260909, based on main 593867d.

The existing public_handled_stats RPC includes both completed and partially_completed automation runs, but the shared public line calls them things finished. I will make the public terminology and methodology match the actual aggregate, retain privacy floors, reject malformed/inconsistent counts, and cover the homepage/pricing/security readers in all seven locales. This uses the existing aggregate RPC only; no table-level public access, SQL, schema, shared sidebar or owner-controlled database change.

The separate Autopilot action/retry runtime issue is being claimed independently. This public-copy correction does not redefine the fully completed-plan metrics in #433/#437/#446.

NewWorldVenture · 2026-09-09T23:00:55Z

Claiming a bounded Photos localization follow-up on codex/strategy-photos-localization-20260909, based on current main 593867d5.

Scope: components/modules/photos-module.tsx, the Photos page metadata (no overlap with #449), additive messages in all seven base catalogues, and actual rendering/form/upload regressions. Preserve stored album kinds, media/storage values, local date semantics, upload cleanup and existing accessibility guarantees. The obsolete English favorite-toggle source assertion will be replaced by rendered localized toggle coverage; #459's separate Contacts assertion adjustment is preserved.

No shared sidebar, migrations, or Contacts/timeline production changes. Targeted tests, typecheck and lint will run first; the full suite/build are held while the integration browser rehearsal runs. Independent review precedes publication.

NewWorldVenture · 2026-09-09T23:04:13Z

The combined local rehearsal at eafd1a1d now passes all 10,455 unit tests across 1,063 suites with zero failures, production build, generated-route typecheck, all eight i18n gates, and query audit (484 tables, 77 functions, 135 routes). Lint passes with the four already recorded warnings. Its fresh public browser matrix passed 425 with eight authenticated cases skipped, using the documented process-local unavailable-backend fixture and two workers. No assertions or timeouts were relaxed. Independent integration review is clear.

This checkpoint includes #458 selected document links and #459 Family Contacts, all preceding strategy slices, main #456 and the reviewed Windows portability fix #457. #457 passed required CI and is ready; #458 and #459 still await their final E2E checks. The refreshed documentation-only #440 is at 6858e11 and remains draft for its new final-head CI. The local rehearsal remains unpublished; no shared branch was merged.

Next claimed runtime work corrects standalone Autopilot buttons that acknowledge unperformed work and reminder retry duplication, plus public aggregate wording that currently calls partial runs finished things. The separate contact timeline and Photos localization batches continue the remaining translation backlog. These claims are bounded and do not authorize schema changes or establish deployed/device verification.

NewWorldVenture · 2026-09-09T23:04:59Z

Contact timeline localization is published as draft #460, head d5fa47ae, based on main 593867d5. Independent review cleared the four production-file presentation changes and 20 scoped keys per locale. Validation: 44 focused tests, native typecheck, changed lint, all eight i18n gates and zero-literal scan pass; full suite has 9,580 passing tests plus the six inherited Windows guard failures on this base. No schema/sidebar work or #459 list/form edits. A separately described stacked follow-up will address incomplete history reads before timeline rendering/reconnect drafting. Please keep this draft until final-head checks are reviewed.

NewWorldVenture · 2026-09-09T23:06:34Z

Claiming the separately scoped Contacts history-read correction on codex/strategy-contact-history-read-failures-20260909, stacked on #460 (d5fa47ae). The current timeline page swallows thrown history queries, and reconnect drafting can ignore failed interaction/communication reads and proceed as if history were empty. I will preserve returned query errors and transport failures, show a translated retry state, and verify that incomplete required history never reaches the AI provider. Existing successful-query limits, stored values, auth/family boundaries and #460 translation behavior stay intact. Root will review before draft publication; no schema/sidebar changes.

NewWorldVenture · 2026-09-09T23:10:51Z

Photos localization follow-up published as draft #461, head 2530f46db27894de6e316b8140ae9743800aee6c, based on main 593867d5.

The module and route title now use the seven base catalogues for remaining tabs/categories, file counts, favorite controls and upload feedback. Relative timestamps use the selected locale; stored category IDs, captions, timestamps and storage/write behavior are preserved. Progress says files processed, with only persisted files counted in the final success notice.

Independent review cleared the change. 53 new actual render/form cases cover all seven locales and real favorite, caption and upload handlers; 88 relevant tests across seven suites pass. TypeScript, changed lint, eight i18n gates and diff checks pass. Full native run: 9,597 pass plus the six inherited Windows guards fixed separately by #457. Build/browser validation is not claimed for this branch. The unrelated Photos accessibility assertions and the Contacts hunk owned by #459 are preserved. No SQL or shared navigation changes.

NewWorldVenture · 2026-09-09T23:14:43Z

Published the separately reviewed Contacts history-read correction as draft #463, head 60f7cfe6, stacked on #460. Failed or incomplete contact/history reads now show translated retry UI and cannot start reconnect AI work. Auth redirects, missing contacts, household/contact filters, recent-query limits and successful empty history remain distinct. Logs identify only the failed stage.

Validation: 164 focused tests, native typecheck, changed lint, eight i18n gates and diff check pass. Full suite: 9,624 pass plus the six inherited Windows guard failures on this base (covered separately by #457). Root independently reviewed the correction and reran 89 relevant tests. No schema/sidebar changes; no merge requested. Please keep draft until final-head CI is reviewed.

NewWorldVenture · 2026-09-09T23:16:28Z

Claiming Files hub localization on codex/strategy-files-hub-localization-20260909, based on main 593867d5. Scope: files-hub-module.tsx, its pure overview/upload presentation seams, three Cloud/Vault/Shared metadata pages, seven catalogues and actual render/form coverage. No production-file overlap with #449, #451 or #458 was found. Folder IDs, user categories, secure/shared policy decisions and upload effect order stay intact; Vault copy will name the existing parent/adult access rule accurately. The existing uncategorized-folder search mismatch remains a separately recorded defect. No upload redesign, SQL or sidebar changes. Root review before draft publication.

NewWorldVenture · 2026-09-09T23:19:40Z

The bounded Autopilot resolution correction is published as draft #464, head d0cbb3b9ef7ae207e78c7c97f5b39552cd61ba97, based on main 593867d5.

Review/navigation controls now open fixed existing routes without marking work performed. Reminder acceptance reloads the current household's source, uses durable source-bound idempotency, and distinguishes saved-but-unresolved work from a changed proposal. Concurrent old-revision receipts cannot stamp a revised suggestion; internal provenance stays hidden and survives ordinary reminder edits. Legacy approvals remain separate from executions and from #433's completed-plan metrics. No scan, schema, sidebar or provider-send changes.

Independent authorization/revision/editor and UI reviews are clear. Final validation: 148 targeted tests, 78 new runtime tests, typecheck, lint, eight i18n gates, 32 keys per seven locales with prior values/order preserved. Full Windows suite: 9,620 passes and exactly the six historical native audit failures tracked separately in #457. Initial final-head CI is in progress; the PR remains draft.

NewWorldVenture · 2026-09-09T23:21:58Z

Claiming a bounded correction stacked on #450 (35befc11): enforce the configured Calendar Sync feature in the new private onboarding OAuth/import flow. The current flow verifies user/family ownership and dormant/import-only policy but does not read calendar-sync, so an administrator’s Off setting does not stop it.

The correction will prove the relevant configuration before setup/connection work, then prove current family entitlement after the family exists, preserving the normal five-day Basic trial. It covers the new private continuation/callback, preview, Finish, activation and onboarding refresh helpers. It will fail closed on required configuration/entitlement errors and recheck after slow provider work. No schema, shared navigation, generic onboarding or unrelated legacy route redesign. Independent review and draft publication follow focused failure/race regressions.

NewWorldVenture · 2026-09-09T23:25:36Z

Files hub localization is published as draft #465, head cc470430, based on main 593867d5. All three views and metadata pages now use the seven-locale catalogues; folder/category identities, upload policy/effect ordering and feature/AAL2 gates are preserved. Independent review cleared the slice and reran 87 tests. Final evidence: 156 focused tests, native typecheck, lint, eight i18n gates and zero-literal scan pass; full suite has 9,607 passes plus the six inherited Windows guard failures addressed separately by #457. No schema/sidebar changes.

Separate existing follow-up: a Receipt.pdf row with category: null creates a General folder chip, but clicking the chip searches General and therefore misses the uncategorized row. The PR records this reproduction; localization does not replace stored/search identities with translated labels. Draft remains pending exact-head CI.

NewWorldVenture · 2026-09-09T23:27:23Z

Claiming the separate uncategorized Files folder fix on codex/strategy-files-category-filter-20260909, stacked on #465 (cc470430). Group and selection identities will distinguish absent/blank categories from a user-authored General. Folder selection uses exact category comparison, separate from ordinary plain-text search; syntax characters remain literal. One translated Uncategorized label and the existing All Files control make selection and clearing explicit. Stored values/upload paths, case sensitivity and existing category trimming remain unchanged. Actual UI and overview regressions before reviewed draft publication; no SQL/sidebar changes.

NewWorldVenture · 2026-09-09T23:29:23Z

The latest unpublished combined runtime rehearsal is ac5dcce5, including #458–#464 and the earlier implementation cohort. All 10,757 unit tests across 1,070 suites pass with zero failures; production build, generated-route typecheck, lint, eight translation gates and query audit pass. Independent integration review is clear. The public browser run had 424 passes, eight authenticated skips and one Pixel navigation timeout; the unchanged failed case passed all three diagnostic reruns. Both results are retained, with the same unavailable-backend fixture and no live-provider/session claim.

#461, #462 and #463 are now ready after final-head CI passed. #464 and Files localization #465 remain draft while checks finish. Separate bounded corrections are underway for Calendar Sync access and the uncategorized Files filter. Whole-app translation remains open (2,748 scanner findings in 594 files on this combined runtime).

I have also picked up the integration owner's new #466 at 3d9fbec for read-only review and ledger tracking. It is later than the tested ac5dcce5 runtime and its migration has not been applied by this work. #440 records the exact checkpoints and remaining acceptance. No shared branch or main was pushed or merged during the local rehearsal.

NewWorldVenture · 2026-09-09T23:30:53Z

Published the bounded Calendar Sync access correction as draft #467, stacked on #450, at 5c0610d2202afbdcae21e7d7df73c395021056ae.

The private onboarding flow now proves the configured feature is available before family setup/provider consent and checks current family entitlement once a family exists. Both provider callbacks, preview, Finish, import activation and later canonical refresh fail visibly on Off, malformed/incomplete evidence or failed reads, with repeat checks after provider work. Existing Basic trials and import-only behavior remain intact; no SQL or shared navigation changes.

Independent production/runtime review cleared. Validation: 186 affected tests in nine suites, native TypeScript, changed lint, eight i18n gates and diff check pass; full unit run has 9,715 passing tests plus the five inherited Windows portability failures fixed separately by #457. The PR body lists those failures explicitly. No live provider test is claimed. CI is queued/running; no shared branch merge performed.

NewWorldVenture · 2026-09-09T23:30:56Z

Published the separate Files folder correction as draft #468, head d0169e7d, stacked on #465. Uncategorized and authored General now have distinct identities; folder selection uses exact category matching plus independent plain-text search and an All Files reset. Punctuation is literal, and existing trimming/case rules and stored values are preserved. Selection does not carry into another household/view.

Validation: 167 focused tests, native typecheck, changed lint, eight i18n gates and scanner pass. Root independently reviewed and passed 83 UI/overview tests. The i18n server-boundary suite retains only its two inherited Windows path failures (#457 handles them); no extra full build/suite was required for this bounded follow-up. No SQL/sidebar or upload/service changes. Draft awaits exact-head CI.

NewWorldVenture · 2026-09-09T23:31:41Z

Claiming a tiny, separate catalogue correction: the public marketing device badges currently render the missing key visualMocks.android. It is still absent from all seven base catalogues on current main 593867d5, shared branch 830be381, and the open strategy branches checked. I will restore the proper-name value Android in all seven catalogues on codex/strategy-android-label-20260909, preserving device identity and rendering code. Validation will use existing catalogue/render-related gates, with no new schema or unrelated UI changes.

NewWorldVenture · 2026-09-09T23:32:40Z

Published draft #469 at 50bf6a01f6bc3137131b230e808f6b9c5c07ec71 against main: restores visualMocks.android = Android in all seven base catalogues. Exactly seven added lines; prior translations, device identity and rendering code are unchanged. Independent review is clear; 140 existing relevant tests, eight i18n gates and diff check pass. No new full build or live browser claim. CI is pending; no shared branch merge performed.

NewWorldVenture · 2026-09-09T23:38:23Z

Files localization/filtering and Calendar Sync access are now in the unpublished combined runtime f34f42c3. All 10,910 tests across 1,072 suites pass with zero failures, and independent integration review is clear. The later 1f5ff523 adds only #469's seven missing Android label entries. Its 89 catalogue/render-contract checks, eight translation gates, query audit, lint, production build and generated-route typecheck pass. A fresh targeted browser check passed 21 homepage viewport cases and 14 responsive navigation journeys across seven locales. The full scan still reports 2,738 findings in 590 files.

#465 is now ready after its final-head CI passed. #467–#469 remain draft pending their own final checks. These local browser checks use the documented unavailable dummy backend, and do not establish live sessions, provider behavior or physical-device acceptance. Shared integration and main remain untouched by the rehearsal.

The owner's #466 at 830be38 remains outside this rehearsal. Read-only review found complete 60×6 coverage but requested preservation of human-reviewed rows plus Portuguese, French and Dutch template corrections: #466 (comment). No SQL was edited or applied. The refreshed #440 ledger records these findings and each exact validation checkpoint separately.

NewWorldVenture · 2026-09-09T23:40:35Z

Claiming a bounded Capture shortcuts localization batch on codex/strategy-capture-shortcuts-localization-20260909 from main593867d5. Scope: components/capture/capture-shortcuts.tsx, seven locale catalogues and actual rendering/interaction tests. Open #451/#458 change the hosting capture shell but do not overlap this component. Shortcut IDs, destination URLs, persisted preference payloads and capture/service authorization stay unchanged. No shared navigation, SQL or ledger edits. Draft will follow scoped checks and independent review.

NewWorldVenture · 2026-09-09T23:59:03Z

Taking the user's persistent-login priority on codex/strategy-persistent-session-20260909, with separate audits of web lifecycle, server authentication and mobile storage. The change will stack on #455 to preserve its mobile auth-event race fixes.

Reproduced temporary refresh HTTP 408/429/507 clearing saved credentials in the installed SDK, interrupted native chunk writes damaging the old session, and temporary server auth errors being interpreted as signed out. Fixes and controlled regression tests are in progress. Explicit local sign-out and definitive revocation remain effective; no SQL or shared navigation changes.

Current focused checkpoint: 169 tests across nine suites pass, with root typecheck and the eight i18n gates passing. Production timeout configuration and real-device cold Keychain startup remain unverified; the SDK's implicit initial subscription can also emit an unhandled storage-read rejection, which is recorded separately rather than treated as fixed.

NewWorldVenture · 2026-09-10T00:24:55Z

Calendar and briefing work continues; pricing is parked under the user's latest steering.

Ready after all five required checks passed at the recorded exact heads:

Localize generated onboarding briefs while preserving canonical data #487 8ac56c2, base Localize onboarding setup and completion copy across seven languages #484: generated onboarding briefing translations.
Use the family timezone consistently in briefing and onboarding previews #488 2aef85a, base Localize onboarding setup and completion copy across seven languages #484: family timezone propagation.
Keep onboarding sample calendars on the family local day #489 c8b18f3, base Use the family timezone consistently in briefing and onboarding previews #488: sample calendars on the family local day.
Keep point calendar entries out of briefing overlap conflicts #490 df0c0aa, base Keep onboarding sample calendars on the family local day #489: point events remain visible without false overlaps.
Localize Home briefing outcomes across seven languages #491 574ed32, base Use the family timezone consistently in briefing and onboarding previews #488: seven-language Home outcomes with canonical facts preserved.
Keep all-day briefing events on the right date and expose failed reads #492 4b3c375, base Use the family timezone consistently in briefing and onboarding previews #488: typed all-day/local calendar windows, DST boundaries and honest API/delivery read failures.
Keep Home calendar dates accurate and failed reads visible #493 8557a3a, base Localize Home briefing outcomes across seven languages #491 and including Keep all-day briefing events on the right date and expose failed reads #492: Home calendar dates, required-read errors and point-event conflicts. Retain both prerequisites. 283 focused tests and 56 controlled Chromium views pass.

Each exact-head E2E run above passed 428 cases with five inherited gated durable-session skips. These results do not replace #474's separate disposable-GoTrue acceptance.

New drafts:

Import pasted calendars with correct times and honest recurrence behavior #494 14db1ac, base Keep point calendar entries out of briefing overlap conflicts #490: strict bounded pasted-ICS timezone/duration parsing, explicit unsupported-input errors, listed-occurrence disclosure and owner-bound import/Finish UI. Source recurrence metadata/retry identity is preserved without awarding recurring benefits to listed imports. Core/mobile/database/Vercel checks pass; final E2E in run34473678559 is pending. 414 author tests, temporal/alias review and actual owner/ABA/reset browser cases pass. The final commit only fixes the new UI fixture's locale-provider mock for combined compatibility.
Refresh generated briefings when the viewer changes language #495 1e59154, base Keep all-day briefing events on the right date and expose failed reads #492: changing viewer locale clears and aborts the old mounted briefing, including completed results/errors and late response bodies. All identity/permission inputs, request shape and snapshot quarantine remain. 52 author tests, TypeScript/lint and fifteen actual StrictMode browser cases pass; exact-head CI is pending.

Latest full unpublished rehearsal: 4f0adeac45ba4fdad5040104e5a935f89f6da0c0 includes #493/#494 and passes 12,243 tests / 1,109 suites, a 243-page production build, generated-route TypeScript, scoped lint and all eight translation gates. Independent combined screens pass 28 Value/Done views, fourteen Finish journeys and eight lifecycle cases with disclosed local adapters. Existing catalogue values/order and earlier localized Wizard changes are preserved. The raw app/components scan is 2,610 findings / 582 files; the three additions are server logging labels. Library-generated text is outside that scan. The later client-only #495 rehearsal at 2b5ac387 passes all 380 briefing tests / thirteen suites and generated-route TypeScript; the preceding full run/build are not reassigned to it.

Retain the earlier completed-plan/undated-history API correction and nested-OR test-helper support during owner integration. No rehearsal was pushed or deployed.

Next work is underway in isolated branches: request-locale deterministic briefing/digest presentation with canonical/raw household data preserved, and seven-family-date week counting that includes all-day events while keeping timed-only minute/conflict eligibility. The latter has fourteen concrete failing-before cases covering omission, yesterday leakage and DST endpoints. Generated decision labels, static badges and recipient-locale delivery remain separate follow-ups.

Ledger #440 is now 3db8456. Latest verified owner main remains d2db14d; roadmap 11aa925 has the same source tree. Owner integration and production configuration/schema/provider/device acceptance remain separate from these checks. No SQL or shared navigation was edited.

claude added 30 commits September 7, 2026 14:16

wip: partial work on U3 (agent interrupted before finishing; unreviewed)

0bddaf4

wip: partial work on A1 (agent interrupted before finishing; unreviewed)

af53cdf

wip: partial work on S1 (agent interrupted before finishing; unreviewed)

158b701

wip: partial work on R1 (agent interrupted before finishing; unreviewed)

8958177

wip: partial work on R2 (agent interrupted before finishing; unreviewed)

a4f4282

Merge prior partial U3 schedule-intelligence work for review

1c51c53

Merge partial A1 work (interrupted agent) for verification

2ab8756

Merge partial R1 work from interrupted agent for review

5c5751d

Merge partial R2 work (unreviewed) for verification

705f522

Merge prior partial S1 work (unreviewed) for verification

f227c64

Catalogue conflicts resolved by taking both sides and re-sorting keys.

wip: A1 household autopilot — catalogue keys for learned policies, ev…

04ddb7d

…eryone-policies count as held

wip: concierge call queue says only what the row persists; pure compa…

4a1ba72

…reQuotes helper

wip: wire replanRun into the executor port, chief_of_staff intent tests

4243b89

wip: S1 review fixes — handledNote through the catalogue, familiesNot…

fae659a

…e on the ledger and social-proof band, badge the Kitchen Mode mock, drop the optional e2e test

wip: log failed public-stats reads; pin the logging in the honesty test

c50d718

wip: compareQuotes tool + projects comparison block, catalogue keys, …

65153e1

…honesty tests

wip: inventory and moving services and tools

9eb725e

Merge branch 'worktree-wf_c031046b-98e-1' into claude/roadmap-impleme…

1d48991

…ntation-ld8bon

wip: Family CFO plan-aware forecast, coverage, affordability scenario

049c827

wip: plan_move intent, moving slice and template, confirm-it's-here, …

7bd0f0b

…i18n

NewWorldVenture mentioned this pull request Sep 9, 2026

Translate the contact timeline and reconnect controls #460

Merged

NewWorldVenture mentioned this pull request Sep 9, 2026

Localize Photos controls, forms and upload feedback #461

Merged

NewWorldVenture mentioned this pull request Sep 9, 2026

Keep failed contact history reads out of timelines and drafts #463

Closed

NewWorldVenture mentioned this pull request Sep 9, 2026

Resolve Autopilot suggestions only after saved work #464

Merged

NewWorldVenture mentioned this pull request Sep 9, 2026

Localize Files hub controls and upload feedback #465

Merged

This was referenced Sep 9, 2026

fix(onboarding): enforce Calendar Sync configuration and entitlement #467

Closed

Filter Files folders by category identity #468

Closed

NewWorldVenture mentioned this pull request Sep 9, 2026

Restore the Android marketing device label #469

Merged

Conversation

NewWorldVenture commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Picking up a piece of this

What has landed here

What the adversarial reviews caught

Build

Checks

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 9, 2026

Uh oh!

NewWorldVenture commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

NewWorldVenture commented Sep 7, 2026 •

edited

Loading

NewWorldVenture commented Sep 10, 2026 •

edited

Loading