Marketing admin auth extracted
Shared marketing write auth moved out of the route body, with header-only posture guarded by tests.
This is the public proof page for the work: a sharper homepage, new sales and recap surfaces, hardened admin boundaries, production-safe copy, asset-backed demos, passing tests, and a clear list of external gates that still need real accounts or devices.
The overnight work now has a concrete, customer-facing trail. The homepage sells the premium money-board story, the sales overview gives a demo script, the final/operator pages show build posture, commercial code now enforces free casual rounds versus the $149 paid-event tier, and the Worker keeps moving out of a single route monolith.
First screen now pushes demos, pricing posture, buyer contexts, and premium visual proof.
Sales overview, final overview, operator overview, and this overnight recap are wired into smoke coverage.
Support modules now include marketing auth, affiliate admin auth, route policy, and commercial config boundaries.
All checked-in HTML entrypoints and public index routes return valid production HTML with cache and CSP checks.
Use these links as the demo table of contents. They are not placeholder blanks: each page is backed by checked-in HTML, production route policy, and regression coverage.
Premium sales positioning, stronger CTAs, no blank sections, and direct paths into the product demos.
A clean demo script for the money-board story, scramble event story, and final settlement story.
Operator recap with deploy status, public smoke status, demo path, and remaining external gates.
Build posture, route sweeps, Worker split baseline, and the difference between shipped work and outside gates.
Shipped demos, regression status, deploy proof, and the product boundaries in one place.
The visible surface is backed by real hardening work. These are the build changes that make the public sales story more credible instead of just prettier.
Shared marketing write auth moved out of the route body, with header-only posture guarded by tests.
Affiliate payout/admin access now uses a shared helper and same-site JSON headers.
The drip cron path no longer relies on query-token access for normal authenticated runs.
Homepage, share-card, settlement-lounge, and trip-shell plates give the product a tangible first impression.
This page is reserved in route policy, indexed in the sitemap, smoke-tested, and linked from the homepage.
Trip and outing checkout paths are set to zero, bypass Stripe, block zero-dollar resume sessions, and no longer fall back to stale casual paid pricing.
The page is intentionally strict about what is still unproven. These items need live accounts, payment platforms, devices, or partner setup before stronger launch claims.
Needs real-mode account validation and reconciliation evidence.
Create, invite, score, finalize, settle, and share need iOS and Android device validation.
Venmo, Cash App, and Zelle links need platform validation with real saved handles.
Production sender/domain values, course keys, conversion IDs, and live Stripe keys still require real credentials.