Page audit B12 re-crawl, a malformed id is not-found (P-23), and a pause during a concierge apply stands (CONC-002)

[NewWorldVenture]

What this is

Three changes.

1. B12: every public page re-crawled on production after today's merges

• 1,092 pages were crawled at 1280 and 390 px on production 1180c77d.
• Every flag was one of three things:
  • an intended 404;
  • a sandbox egress 502, which is not the site;
  • one real defect: /f/no-such-page answered 500. This is P-23 below.
• The B7 fixes are live. For example, /kid-login in German reads "PIN anzeigen".
• finalaudit.md gets a "B12 — post-release production re-crawl" section, and the B12 row is marked done.

2. P-23: a malformed id is not-found, not a crash

/f/[id] passed any path segment straight to a uuid column. Postgres rejected the cast, and the page threw a 500 instead of a 404. Three signed-in pages had the same shape:

• /dashboard/social/posts/[id]
• /kids/submit/[assignmentId]
• /marketplace/creators/[id]

Each page now checks isUuid (lib/utils/validation.ts) before its first read and answers not-found. tests/a-malformed-form-link-is-not-found.test.ts renders the public form page with a malformed id, and checks on all four pages that the guard comes before the first read.

3. CONC-002: a pause made while a concierge plan applies is not overwritten

This was found by the owner's review of #586. executeQueuedRunAction claims a run (status = 'approved', state = 'executing', approved_at), applies the plan, then either stamps the run executed or hands it back.

The bug:

• The stamp matched status alone.
• The hand-back did not match state.
• pauseRun keeps status = 'approved' and changes only state. So a pause made during the apply was replaced by completed, or by awaiting_approval.
• An older action also finalized a newer claim.

The fix: both writes now match status, state and this action's approved_at.

tests/a-paused-run-stays-paused-while-its-plan-applies.test.ts holds the materializer and applies every .eq to the row. It fails 4 of 7 on the previous code, which are the owner's four cases. The ai_tool_calls attempt predicate from the same review was already on main (lib/ai/tools/execute.ts).

Checks

• The merge of origin/main at 1a63a8d3 (Next 16) had one conflict, in finalaudit.md's batch table. It keeps B12 as done and adds B13.
• tsc is clean. Lint shows 15 warnings, all pre-existing (the budget is 15).
• Full unit suite on the merged tree: 1,710 files, 21,448 tests passed.
• After the concierge fix, the 14 test files that drive or read the action pass.
• No migrations.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DXw2nu25BjyRfA6Fg3YiMS

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
bubaly	Ignored		Sep 27, 2026 10:44pm UTC