← Davi's Lab
MushMe — Go-Live Checklist
One board for the launch. Updated 2026-07-12 19:57 WEDT ·
🎉 FRIDAY IS GO. Every gate is closed.
✅ Both migrations in prod — I verified them independently, read-only (columns, functions,
and the anon grant survived the DROP+CREATE).
✅ Prod client redeployed.
✅ OTP email works end-to-end — you and Cody1 verified delivery twice tonight, now sending from the
K-domain (noreply@dynamiksocial.app), with the rate limit raised 30 → 360/hr.
✅ The login-blocker is fixed — the email issues an 8-digit code while the input box was
hard-capped at 6. Nobody could have signed in. Caught and shipped before you tested it.
The cap now runs on every seating path — including the host-approve path, which had no
capacity check at all. The den cannot over-admit, and the two first-timer seats will hold.
✓ Designee verified 19:57 WEDT
✅ Done & verified
✅Test env live — mushme.dynamiktest.app
serves MushMe against the full cloned data (you + friends can test now).
✅Prod cleaned — 99 test accounts removed,
9 real users all seed-stewards; staging holds the full backup.
✅Auth — passwordless OTP; the old
"returns to welcome / drops session" bug is fixed. (one real-device smoke test still advised)
✅Core mechanics are server-enforced —
RSVP → lottery/approval → steward-ratio gate → check-in/out. Walk-up admit is gated too.
✅DKS↔DKT parity confirmed · staging auth
allow-list added · test-login schema fixed · security #1/#3 fixed on staging.
🔴 Blockers — must close before a real event
✅Safety-report "black hole" — FIXED (main
form). "File a safety concern" now saves + alerts an admin (the missing 'safety' type was added;
the form now shows real errors).
LIVE ON PRODUCTION (DB constraint + client error-state verified).
✓ 14:33 WEDT
flag_person: BUILT (KodiC 18:30). Care signals now notify the event's host +
stewards (not just admins) and there's a live steward reader screen (Profile → "👋 Care signals").
Verified on staging + live on mushme.dynamiktest.app; prod needs the queued DB migration.
Kodi A — prod gate
🚨Verify OTP login email actually sends —
YOUR dashboard step. Codes go via Supabase's built-in Auth email; if no custom SMTP is set it's
rate-limited a few/hour shared with JamSpace → a tester burst = codes never arrive, no error shown.
Top launch-day risk. → Supabase dashboard → project tzfhrz… → Authentication → SMTP Settings →
enable a real provider (Resend/Postmark) if it's on the built-in. Davi
✅Vestibule — SERVER-ENFORCED (KodiC 18:30).
First-timers can't RSVP or enter a lottery without a server-recorded orientation
(refused_needs_orientation; accepts any of the 3 server records so no legit account is blocked;
walk-ups stay steward-oriented in person). Staging-verified; prod needs the queued migration.
Kodi A — prod gate
✅Nameless signups — FIXED (Kodi A).
ensure_mush_profile migration applied staging + prod; client calls it at boot.
✅Discomfort auto-decline — SERVER-ENFORCED
(Kodi A, GOS#5 complete). request_mush_attendance guard live on staging + prod.
✅Friday pilot config — BUILT (KodiC 18:30).
Hard cap + reserved first-timer seats (cap 6, 2 newie slots) enforced on every seating path — host
approve, invited fast-path, steward auto-approve, walk-up admit. Oldie-only events relax the
steward-ratio and refuse first-timers. Host form has the "seats held for first-timers" stepper.
Staging-verified (10-case smoke, all pass); live on mushme.dynamiktest.app; prod = queued migration.
Kodi A — prod gate
⚑ Waiting on your go (gated prod)
✅Front-door redeploy — LIVE.
dynamiksocial.app now serves the current landing: 🌱 beta chip, pruned slate (MushMe live + 4
coming-soon), and /guide = the 3D guide carousel. Landing project fixed to the prebuilt path so
deploys stop erroring. ✓ 14:24 WEDT
✅Prod DB migration pass — APPLIED.
Safety fix + security hardening (definer view, search_path pins) + release_channel/feature_flags all
verified on prod. Next migrations (anon-revoke, discomfort enforce, witness RPC) queued.
✓ 14:33 WEDT
✅Git-metadata exposure — OFF. Verified: the
prod bundle no longer leaks commit SHA/branch/author. ✓ 14:33 WEDT
✅Hosting threshold — RULED. Anyone
who's attended ≥1 mush can host (credential shown as non-full-Steward); newie events trigger the
steward-capacity rule, Oldie Mush relaxes it. Cody building the event-type gate.
✓ 13:31 WEDT
🟡 Should-fix-soon (not blocking)
•Real-device auth smoke test (confirm the
wedge-recovery doesn't log healthy users out). · Cold-start ratio UX: surface "assign your steward
team to grow the room" so first hosts aren't blindsided by capacity refusals. · Coin wallet "beta —
not saved yet" label (going in). · Label lottery odds before full launch.