Updated Wed 23 Sep 2026, 14:08 London, from the 23 Sep 12:57Z collection, composed on attempt 1. Partial sources: Slack (the channel list and all 8 merchant and payout channels), the prod DB (all six tracked merchants, plus the JSON decode error on the raw read) and TG Core Engineering came back SECTION UNAVAILABLE for an eighth day, the fourteenth occurrence of the missing-PATH signature since 2 Sep, so everything sourced from them still carries over from the 15 Sep 18:32Z read, now eight days old. Linear answered and is identical to yesterday's read: the same 23 open issues in the same states, none updated after 21 Sep. git answered empty, and the clone, fetched at 12:57Z, confirms nothing has been merged to sandbox or production since 19 Sep, four days. So the four payout and tax tickets that closed on 21 Sep, REV-272, REV-256, REV-196 and REV-269, are still closed with no code behind them and no word on why. The marks endpoint answered: nobody ticked or commented on the 22 Sep board, and the run log shows the team was never prompted to, because the TG post announcing it failed on "node: command not found", as it has after every publish since 2 Sep.
Top now: REV-272, REV-256, REV-196 and REV-269, the payout and Florida-tax tickets that closed on 21 Sep, have gone two more days with no commit and no word on what closed them · REV-250, Seven Sigma's bank details, is still the only open payout ticket: untouched for seven days, five days past the payout date · the team has never been sent this board: the TG post failed again on 22 Sep, fourteen publishes out of fourteen, and eight boards in a row have no tick
Today's Linear read is identical to yesterday's: the same 23 open issues in the same states, none updated after 21 Sep, against a query that asks for 50, so that is the whole open list. Nineteen are the new platform build (REV-273 to REV-291). The live business is still four tickets: REV-251 (Apex cross-check, @tim), REV-250 (Seven Sigma bank details, @tim), REV-247 (leaked credentials, @nur) and REV-164 (the A@ password, @aadil).
The four that left between the 21 and 22 Sep reads have not come back: REV-272 "one bad merchant profile silently blocks everyone's payout" (filed 19 Sep, unassigned when last seen), REV-256 "Close out sent payouts: bank reference and sent date, not stuck in processing" (p1 @nur), REV-196 "Turn OFF Florida sales-tax collection until registered" (In Progress p1 @nur) and REV-269, Aadil's decision on the Florida flag. The GIT section came back empty again, and the clone, fetched at 12:57Z today, confirms it: the newest commit on origin/production is still 39e594a, the #517 merge of 19 Sep, and on origin/sandbox f915ac0, the #514 merge of the same morning. Four days, nothing merged.
The query filters completed and cancelled alike, so it still cannot say which happened, and with Slack, the DB and TG blind for an eighth day no other source can either.
Next actionOpen Linear's recently closed view and write one line each for REV-272, REV-256, REV-196 and REV-269: completed by what, or cancelled and why. Four lines, and until they exist the payout and tax threads on this board have no ticket behind them.
Today's Linear read: REV-250 "Seven Sigma: get bank details before the 18 Sep payout" is still [Todo] p1 @tim, upd 2026-09-16, seven days untouched. The date it was written against passed on 18 Sep.
REV-256 (sent payouts stuck in processing with no bank reference, p1 @nur) and REV-272 (one bad merchant profile silently blocks everyone's payout, unassigned) left the open list between the 21 and 22 Sep reads and are still gone, and nothing merged since 19 Sep explains either. A merchant still missing bank details on payout day is exactly the bad profile REV-272 described, so the one ticket left open describes the one condition the closed ticket warned about. Slack, the DB and TG are blind for an eighth day, so nothing here can be checked against a payout run.
Ask Andrew in #ach-payouts-production: did Seven Sigma's payout go, with what bank reference, and has any run since 18 Sep stalled or been skipped. If Seven Sigma still has no bank details, get them now. Then update REV-250 so the only open payout ticket says something true, and ask Nur what closed REV-272, because nothing in git did.
As of the 15 Sep read, #rhp-rhpeptides ended on Jarrod's 1 Sep 05:57Z message: "that text is from the master document, not the one you signed... I will discuss with Aadil today and get back to you." Your 31 Aug 16:36Z answer rested on three things: Revion is the seller of record, "Revion is registered in Florida today", and sections 8.5 and 8.7, which Jarrod's copy does not contain. RHP: 0 sessions since 13 Sep, fee_rate 14. Slack has been blind for eight days.
REV-269 "Decide: enable REVION_TAX_SUPPRESS_STATES=FL on production" ([Todo] p2 @aadil) and REV-196 "Turn OFF Florida sales-tax collection until registered: $0 FL quotes, refund collected tax, purge TaxJar test transactions" ([In Progress] p1 @nur) both left the open list between the 21 and 22 Sep reads, and neither has come back. No commit since 19 Sep touches tax. Either Aadil answered the registration question and the answer made both tickets moot, which would mean the fact you have been waiting on since 31 Aug exists and nobody told you, or they were cleared out and Florida buyers are still being charged with the refund half unshipped.
Ask Aadil one question today: what closed REV-269, and is Revion registered in Florida. Then pull a fresh Florida quote yourself and see whether it returns $0. Tell Jarrod only what the quote and the executed agreement show, not what a closed ticket implies.
Carried from the last board, and still the largest change to the buyer path with no owner on record. git carries fix(storefront): require session-scoped 21+ age confirmation (#509) plus test(storefront): confirm age in direct checkout browser checks and fix(catalog): keep retired GLP-1 listings out of seeds, authored by the aadil-netizen account and dated 19 Sep, reaching production through PR #512 (branch codex/age-gate-catalog-production) with a review follow-up in #513. Nur's own 18 Sep commits fill in the shape: bind age approval to its browsing context, exempt hosted merchant checkout from age gate, require direct merchant payments to bypass age gate, remove retired SKUs from local overview fixtures, address promotion review on seed items and age persistence.
Nothing has been merged since, so the gate as described on 19 Sep is what is deployed, if it deployed. Four days on, no readable source says who decided it, whether it applies to live merchants' buyers or only Revion's own storefront, or whether a single real buyer has been through it. No Linear ticket covers it; it is tracked as GitHub issue #509.
Get two answers: who authorised a 21+ interstitial and the GLP-1 retirement, and which merchants' buyers actually see the gate. Then load Revion's own checkout yourself and walk it end to end as a buyer. An age gate with a persistence fix already on it, in front of a funnel that is leaking, is a conversion risk and not just a compliance feature.
Linear, today: REV-276 "Platform architecture: what we reuse from Revion and what is new" is [In Progress] p1 @tim, upd 2026-09-21. REV-273 "Stand up the Fly.io app, staging and production" is [In Progress] p2 @nur, the state it moved to between the 21 and 22 Sep reads. REV-274 (tenant-isolated Postgres) and REV-275 (auth and roles) are [Todo] p2 @nur, and REV-277 to REV-291 are fifteen [Backlog] p3 "Platform copy" tickets.
The last two boards asked for the sequencing on REV-276 before REV-273 to REV-275 started. REV-273 started, and REV-276 has not been updated since 21 Sep. The platform may well live in a repo this board does not read; what it can see is that revion-caps has had nothing merged since 19 Sep, four live tickets are open against nineteen platform ones, and the four live tickets that closed on 21 Sep had no code behind them.
Next actionWrite the sequencing on REV-276: what Nur finishes on the payout and tax paths before the platform takes Nur's week, and who owns the payout batch now REV-272 is closed. If the platform is the priority, say that plainly so nobody reads the 21 Sep closures as completion.
REV-251 "Apex: cross-check the 25 approved September payments against Matt cancelled orders" is still [Todo] p2 @tim, upd 2026-09-16, seven days untouched. Two rounds of closures have gone past it without touching it, which is a reasonable signal that it is genuinely still to do rather than quietly dropped. Matt is almost certainly Matthew Jensen, the Apex contact; which orders Matt disputes is still in no readable source.
Worth noting before the reconciliation: fix: reuse unchanged embedded Woo checkout orders and fix: bind reused box URLs to the current payment session (PRs #507, #508) changed how an existing Woo order is reused across payment attempts. That is the same seam where a Revion payment and a cancelled Woo order drift apart, so the mismatch set may look different before and after 18 Sep.
Get the cancelled order numbers from Matt, and check none of the 25 approved payments was built from an order Woo shows cancelled. Note which side of the 18 Sep idempotency change each disputed order falls on. Confirm with Aadil or Nur that the transfer itself cleared, not just that it was approved.
At the 15 Sep read, mrc_roNy1mlK9Ij5 showed four sessions and zero payment intents: cs_RVasVZH_AAxR1qMea1PK $109.00 and cs_EZO-PKMQnMyecR0VfwTx $3,277.87 (no buyer email), then cs_ZK_B_CCbydE0g6S43ljT and cs_xzPaO8-h-7F5c3TwHr1C, both $69.99 from info@biopepusa.com. Nobody reached the point of submitting a card. The merchant row read https://biopepusa.com as of that read, so the domain trap is plausibly behind them.
The DB has now been blind for eight days, so none of this has been re-checked, and nothing merged since 19 Sep could have changed it either way. BAC Water refusals are the original suspected wall: BACKLOG.md still carries their 14 Sep email asking why BAC Water fails, against a REV-22 denylist that still refuses it in code despite Aadil's "let em run it up". The catalogue-retirement work shows that machinery is being changed while nobody has stated the rule.
Next actionEmail Casey and ask for a retry of the $69.99 cart while you watch, with the exact screen where it stops, including whether an age confirmation now appears. Get Nur's straight answer on BAC Water separately; a default flip is not the same as confirming what Biopep actually hit.
REV-234 ("QA: embedded Visa box on WooCommerce, plan now, run M1 Wed + M2 Thu with Tim") read [Todo] p1, upd 2026-09-16 on 18 Sep and has not been in an open list since. Completed and cancelled look the same from here. What git shows is the box being repaired in production rather than verified: #507 then #508 (merged by you) carrying fix: bind reused box URLs to the current payment session and fix: reuse unchanged embedded Woo checkout orders, plus test: expect WooCommerce 1.3.7 release metadata.
Slack and the DB are blind for an eighth day, so there is still no session-level evidence that a real buyer has completed an order through the box.
Next actionPlace one real order through the embedded box on a store you control, confirm the charge, the receipt and the Woo order state, and write the result down where the team reads it, since REV-234 is no longer open to carry it.
As of the 15 Sep read: 11 Sep run, Halo $1.32, Zen $801.06; 14 Sep run, Halo $358.16 (Mercury ••••2806), Narboto inc $0.09, Zen $2,491.16; Andrew, 15 Sep 13:12Z: "others got paid". The 27 Aug $1,139.16 (9 orders) has not appeared in any run since and has no visible reference.
BACKLOG.md, still last updated 15 Sep, carries the open version of this as your own item: the 8 Sep (window Sep 1-8) and 11 Sep (window Sep 3-11) runs both carry Halo $1.32 from three $0.50 orders at 12%, on overlapping windows. With REV-256 closed, nothing in Linear asks whether a payout marked sent actually moved money.
Next actionAsk Andrew for the bank references of the 27 Aug and 1 Sep Halo drafts and of the 15 Sep send, and ask Nur to confirm the same three $0.50 orders were not paid twice across the overlapping windows. Fold the answer into whatever closed REV-256.
app_uHyTgAc1QXxFQKBW (coreresearchpeptides.com) was under review from 1 Sep. REV-214 (verify callback, activate, then send portal credentials) and REV-258 ("Sache's stores: Vyal Labs and Halo Labs USA are still inactive with zero sessions") were both open on 18 Sep and neither has been in an open list since. REV-267 ("allow approved merchants to set up portal before activation") reached production on 18 Sep through PRs #498, #499 and #500, the change most likely to have moved them.
A closed ticket is not a live merchant. None of the three is in the collector's watch list, and the DB section is unavailable anyway.
Next actionRun onboarding-check.sh against Vyal Labs, Halo Labs USA and Sean Finck's account once the DB is reachable. If any is live, confirm banking_approved and complete bank details before its first payout: REV-272 said one bad profile can stall everyone's batch, and REV-272 closing did not make that untrue.
As of the 15 Sep read, #best-peptide-lab: your 31 Aug 09:06Z offer of 20 minutes to run the first embedded order together got no reply, then Slackbot, 11 Sep 09:44Z, the team removed themselves. Merchant row: active, banking approved 2 Sep, contact dev@guardedpaypro.com, fee 12, 0 sessions and 0 orders since 13 Sep.
REV-247 (rotate the "GuardedPay" password leaked in Core Engineering) is still open in today's read, untouched since 16 Sep, one of only four live-business tickets left. As noted before, the payment-links branch naming is a coincidence, not this merchant.
Next actionEmail dev@guardedpaypro.com, since Slack no longer reaches them: ask straight whether they are still integrating, and offer a slot to put the embedded box on bestpeptidelab.com with you watching. Mention the age gate if it applies to their buyers, so they are not surprised by a new screen.
#kiyora-peptide-llc, 13 Sep 15:30Z, Andrew: "We confirm receipt of Kiyora Peptide, LLC's notice of termination dated September 13, 2026... As Kiyora did not process any transactions through the Revion platform, there are no processed transactions, settlements, chargebacks, refunds, transaction-related losses, or termination reserve to reconcile." 15 Sep DB read: mrc_zinhzQp6eyBC status=active, 0 sessions. Why a working merchant left without a single sale is in no source, and the DB is blind for an eighth day.
An active row with approved banking on a terminated merchant is also the shape of profile REV-272 described before it closed, so leaving it open is not free.
Next actionClose the account (keys off), send the effective date Andrew promised, and ask one question: what stopped Kiyora switching Revion on. The same answer probably applies to Best Peptide and RHP.
REV-252 "Backend reviewer: hire, or interim AI review on every PR" was [Todo] p3 @tim on 18 Sep and has not been in an open list since; nothing readable says what was decided. The last merges, all 19 Sep: #514 (codex/rev262-optional-phone), #517 (codex/rev262-production), #515 (nur/payment-health-engineering-only) and #516 (from sandbox), all merged by the beastmmode account, with the commits authored by Nur. Before that, #507, #508, #512 and #513 came off codex/* branches too.
Write down what closing REV-252 meant: who reviews, and what cannot reach production without a live-path check. Confirm who beastmmode is and whether that account should be merging to production. Four quiet days is the cheapest time to set the rule.
4SMZBX4M… + run the REV-60 cleanup scriptWhether the ticket is resolved is unverified; there are no billing-inquiry rows in this collection either. BACKLOG.md still carries it as open: resolve 4SMZBX4Mswa4R3tzAK5DR as a test (order RC-2026-1000210, Narboto's $1.07, already refunded). The same item's second half, promoting PR #355's alert deep links, looks done: BACKLOG.md's own AI section records the billing-alert links going to production in the 28 Aug promotion.
revioncaps.com/admin/billing-inquiries, Resolve, note "QA daily test, no action". Locally: source ~/RevionCaps/creds.sh && python3 ~/RevionCaps/linear_cleanup_rev60.py (idempotent; it also comments on REV-170).
Done since yesterday: nothing of yours moved. REV-250 and REV-251 are unchanged since 16 Sep and REV-276 since 21 Sep, and nothing around you moved either: Linear is identical to yesterday's read and nothing was merged. The four payout and tax closures of 21 Sep are still unexplained. Nobody ticked or commented on the 22 Sep board.
At the 21 Sep read: REV-269 "Decide: enable REVION_TAX_SUPPRESS_STATES=FL on production (stop collecting Florida sales tax)", [Todo] p2 @aadil, upd 2026-09-18, and REV-196, the engineering side, [In Progress] p1 @nur. Neither has been open in the 22 or 23 Sep reads. Nothing has been merged to sandbox or production since 19 Sep, and no commit in that window touches tax, so no code changed.
Three things hang on the answer. Jarrod at RHP has been waiting since 1 Sep, and Tim's 31 Aug message said "Revion is registered in Florida today". REV-196 also carried refunding tax already collected and purging TaxJar test transactions, which nothing in git shows shipped. And the flag itself is an environment variable on production, so the switch is either on or it is not, and that is checkable in a minute.
Next actionAnswer one question in writing today: is Revion registered to collect sales tax in Florida. Then say what closed REV-269, and whether the refunds in REV-196 are still owed. Send Tim the executed RHP agreement in the same message.
As of the 15 Sep read, #ach-payouts-production: Andrew 16:19Z, "when do you show payouts starting for apex peptide supply they said they had transactions sept 4-7?"; 16:22Z, "peptide 911 wants to know there status as well". Nur, TG 17:48Z: "Two merchants transacted with matured, payable balances but no payout went out because their banking verification step had not been run. Both are now verified." Apex Peptide Supply $2,267.28 (19 orders settled 3-10 Sep); Peptide911 $262.79.
REV-256 "Close out sent payouts: bank reference and sent date, not stuck in processing" was [Todo] p1 @nur at the 21 Sep read and has not been open since. REV-272, "one bad merchant profile silently blocks everyone's payout", filed 19 Sep and never assigned, is gone too. If they were completed there is a list of payouts with bank references somewhere; if they were cleared out, two merchants are owed money nobody is tracking. The payout channel has been unreadable for eight days.
Get Andrew to confirm both ACH transfers carry an actual bank reference, not just a "sent" status, and whether any run since 15 Sep stalled or was skipped. Only then call Matthew Jensen and James Votraw.
REV-266 "Pura Peptides dark 36h: fatal error freezes orders, our callbacks now get HTTP 400" was [Backlog] p1 @nur on 18 Sep. It has not been in an open list since, and nothing has been merged to either branch since 19 Sep, so whatever resolved it was not code in this repo. It may have been fixed on Pura's side, or cancelled; nothing readable tells those apart.
The rest, all from the 15 Sep read and unchanged since: Kiyora terminated (Andrew acknowledged 13 Sep, "did not process any transactions"); Best Peptide's team removed themselves from Slack 11 Sep, 0 sessions; Biopep had four checkouts and none reached a card; RHP had 0 sessions.
Next actionPhone Pura today and ask one question: are orders flowing and getting paid since 18 Sep. Then by phone this week: Best Peptide, Biopep's Casey (with Tim), Jarrod (after the Florida answer), and Kiyora on why they left.
Open since 28 Aug; Nur asked again on the morning of 29 Aug. Whether the payment went out is still unverified; TG has been blind for eight days, so the thread cannot be checked.
Nothing has been merged for four days, the first quiet stretch in weeks. Before it Nur shipped the REV-262 phone fix (#514, #517), moved payment-health alerts out of merchant channels (#515, #516), the age-gate scoping work and the box-session idempotency fixes. REV-273 is In Progress on top of REV-247, which is still an open p1.
Next actionSend it, confirm in the thread.
As of the 15 Sep read: "Synergy Research, LLC" (synergy-labs.uswholesalepeptides.com, mrc_LLEYN7Q4l9fC) live since 15 Sep; "Vyal Labs LLC" (vyallabs.com, mrc_PA2TX_ACHQq5) approved 12 Sep; "Halo Labs USA LLC" (halolabsusa.com, mrc_f4LFsn8VaAaJ, contact Alice Rewoldt) approved 14 Sep. Halo Labs USA is a different business from Halo Peptides, keep them apart in payouts.
git, 19 Sep: Nur's fix(checkout): keep hosted phone optional through card and Apple Pay and fix(checkout): preserve supplied phone when Wallet omits it, merged as #514 and promoted as #517 (codex/rev262-production). The clone confirms that is still the newest commit on the production branch today. Whether it is deployed, and whether a Synergy buyer has paid since, is unverified.
Once #517 is confirmed deployed (Claude's item), tell Synergy the fix is live and ask for their next order number so it can be traced end to end. Ask Nur whether Vyal and Halo Labs USA are live now; if not, chase banking and set them live by hand.
git carries fix(catalog): keep retired GLP-1 listings out of seeds (authored by the aadil-netizen account, 19 Sep, reaching production via PR #512) alongside Nur's fix(seed): remove retired SKUs from local overview fixtures and test: cover catalog retirement and correct decline fixture. Retirement plumbing for a named product class is built and shipped, and nothing has changed it since.
Nothing readable says whose decision this is, which merchants it affects, or whether they have been told. It also sits directly across the REV-22 denylist thread: Biopep's 14 Sep email asks why BAC Water fails, your 14 Sep 19:40Z "let em run it up" was never implemented in code, and REV-232, the test of whether restricted items are refused at all, left the open list with no readable result. A catalogue policy now has three different answers depending on which source you read.
Next actionSay plainly whether GLP-1 retirement is a commercial decision you made, and give one list of what is refused, what is allowed, and for whom. Anyone selling a retired class needs telling before their buyers find out at checkout.
The wall was measured on 2 Sep: $380 and $361 in non-Visa declines over five days. At the 15 Sep read there were 10 production attempts across merchants, 5 authorized, and declines returned "Your card was declined. Please use another Visa card or contact your card issuer."
REV-112 "Apple Pay on NMI, step 0: confirm with Ignacio the MID supports own-certificate Apple Pay" was [Backlog] p2 @aadil at the 18 Sep read and has not been open since; no brand-enablement ticket for Mastercard, Amex or Discover is open either. Apex is on the embedded box, so every non-Visa buyer hitting it is a measurable loss rather than a hypothetical one.
Get Ignacio's answer in writing, whatever closed REV-112: does the MID support own-certificate Apple Pay. Separately ask what enables Mastercard, Amex and Discover, and by when.
As of the 15 Sep read, VAPI_PRIVATE_KEY, VAPI_PHONE_NUMBER_ID and VAPI_ASSISTANT_ID were set on revioncaps-prod; calls are held off only by VAPI_OUTBOUND_ENABLED=false, and vapi-outbound.ts has no calling-window, DNC or unbundled-consent gates. No VAPI ticket is in today's Linear read either, and with only 23 issues open that is the whole list, not a truncation. BACKLOG.md still carries it as a red item needing you and Tim.
The team put a compliance gate in the buyer path in two days when it decided to. The same standard has not been applied to outbound calling, where the exposure is statutory.
Next actionEither unset the prod keys or commission the TCPA gates, and file whichever it is.
REV-164 [Todo] p3 @aadil, upd 2026-08-27. Two rounds of closures have gone past it. TG has been blind for eight days, so whether the message was deleted cannot be checked. REV-247 (the separate "GuardedPay" leaked credential, @nur) is the other survivor of the same kind.
Rotate it, delete the message, close the ticket. Two leaked-credential tickets surviving every clear-out is not a coincidence worth defending.
Done since yesterday: nothing moved. REV-269, your Florida decision, has been closed since 21 Sep with REV-196 beside it and no tax commit anywhere, so it stays above as an open question until you say which it was. REV-164 is untouched since 27 Aug. No ticks or comments on the 22 Sep board.
REV-256 "Close out sent payouts: bank reference and sent date, not stuck in processing" was [Todo] p1 @nur, upd 2026-09-18, at the 21 Sep read and has not been open in the two reads since. The GIT section came back empty again, and the clone, fetched today, confirms the newest commit on sandbox or production is still from 19 Sep.
It covered Apex and Peptide911's catch-up run, Halo's 14 Sep $358.16 and the unreferenced 27 Aug $1,139.16, Zen's overlapping-window runs and Seven Sigma's first payout. If it was completed by a data fix or a manual reconciliation, that is a good outcome and nobody outside Linear can see it. If it was cleared out, every one of those amounts is still unconfirmed.
Next actionPost one list in #ach-payouts-production: every payout marked sent in the last 30 days, with or without a bank reference. That list is what closing REV-256 should have produced. Anything without a reference is not confirmed paid, whatever the status says.
REV-272 "Payout ACH batch: one bad merchant profile silently blocks everyone's payout" read [Backlog] p2 @unassigned, upd 2026-09-19, at the 21 Sep read and has been off the open list since. Nothing has been merged to sandbox or production since 19 Sep, so the batch code on both branches is the code that had the bug when the ticket was filed.
It lands with you because the payout path is yours, not because anyone assigned it. What sat under it has not moved either: Apex and Peptide911's first payouts were stranded once already, Halo's $1,139.16 has no reference, and REV-250, Seven Sigma's missing bank details, is still [Todo] and is the only payout ticket open anywhere.
Say in one line what closed REV-272. If the fix is real, point at it. If it was cleared out, reopen it or take it: a batch that stops silently on one bad profile, with a merchant known to be missing bank details, is a production defect and the code has not changed.
REV-196 "Turn OFF Florida sales-tax collection until registered: $0 FL quotes, refund collected tax, purge TaxJar test transactions" was [In Progress] p1 @nur, upd 2026-09-18, at the 21 Sep read and has not been open since. PR #465 (merged 15 Sep) covered the quote half. The refund and purge halves have no commit, and the newest commit on either branch is still from 19 Sep. REV-269, the decision it was gated on, closed in the same window.
A ticket moving out of In Progress without code usually means the decision made it unnecessary. If Aadil confirmed Revion is registered in Florida, that is exactly right and it should be written down. If it was cleared out, buyers were charged tax that was flagged as possibly not collectable, and nobody is refunding it.
Next actionAnswer one question for Tim today: does a Florida quote on production return $0, yes or no, and is REVION_TAX_SUPPRESS_STATES set on the prod app. Then say whether refunds are owed. It is a two-minute check and it unblocks the RHP answer that has been stuck since 1 Sep.
REV-247 "Delete the credentials and bank details posted in Core Engineering, rotate the GuardedPay password" is still [Todo] p1 @nur, upd 2026-09-16, seven days untouched. With REV-256 and REV-196 closed, it is the last open p1 on the live business anywhere in Linear. How long the credentials have been exposed and who posted them is in no readable source; TG has been blind for eight days, so the message itself cannot be checked. REV-164 (the separate A@ Google password) is in the same state on Aadil.
Delete the message, rotate the password, and check whether anything was accessed with it while it was live. If the platform build takes your week from here, this is the one thing that should not wait behind it.
REV-266 "Pura Peptides dark 36h: fatal error freezes orders, our callbacks now get HTTP 400" was [Backlog] p1 @nur at the 18 Sep read. It has not been open since, and the newest commit on either branch is still #517 from 19 Sep, which is the phone fix. So if this was fixed, it was fixed on Pura's side or in configuration, not in this repo.
The frozen orders matter either way: whether they were recovered is in no readable source, and with Slack and the DB blind for an eighth day there is no way to see Pura's traffic at all.
Next actionWrite one line on REV-266: what the 400 was, what fixed it, and whether the frozen orders were recovered or need refunding. If nothing fixed it, reopen it.
The commits, in order: fix(storefront): require session-scoped 21+ age confirmation (#509) and test(storefront): confirm age in direct checkout browser checks (aadil-netizen, 19 Sep), your fix(storefront): bind age approval to its browsing context, fix(storefront): exempt hosted merchant checkout from age gate, test(checkout): require direct merchant payments to bypass age gate, test(checkout): match the backend decline status, and fix: address promotion review on seed items and age persistence. It reached production through #512 (codex/age-gate-catalog-production) with #513 as the review follow-up, and the sandbox side through #511.
Four days have passed with no further commits, so this is the settled shape, not a work in progress. Four exemption or scoping rules landed in two days: hosted merchant checkout exempt, direct merchant payments bypassing, approval bound to a browsing context, and a persistence fix on top. A buyer who confirms once and gets asked again, or worse is blocked mid-payment, is a lost order, and the detector that would notice a funnel collapse was last seen matching 0 rows.
Next actionWrite the matrix down in one place: which checkout surfaces gate, which are exempt, what the buyer sees, and what happens when the stored approval is missing or stale. Then walk one live buyer path per surface yourself.
REV-244 "Seven Sigma and Bioscience: Cloudflare blocks our webhook, callbacks never arrive" was [Todo] p2 @nur, upd 2026-09-18, at the 18 Sep read. It has not been open since, and no commit in any window since names Cloudflare, a webhook allowlist or callbacks. The block may have been on the merchants' side and lifted there; nothing readable says.
It was one of three callback-path failures in a week: REV-226 cancelling paid Apex orders, REV-244, and Pura's REV-266 callbacks returning HTTP 400. All three are off the open list, and only REV-226 has commits behind it (#455, #457), which hardened the path rather than reconciling what it already cancelled.
Next actionOne line on REV-244: what Cloudflare was blocking and what changed. Then confirm a real callback has landed for Seven Sigma since, before anyone reconciles their orders or pays them out.
REV-261 "REV-142 shipped a dead detector: gateway failure streak join matches 0 rows on prod" was [Backlog] p1 @nur on 18 Sep and has not been open since. Also gone earlier: REV-165 (funnel and decline report), REV-145 (plugins page) and REV-173 (telemetry null). No commit in any window since names the detector's join.
What git does show is your Keep payment-health alerts out of merchant Slack channels, merged as #515 (nur/payment-health-engineering-only) and carried by #516 from sandbox, both on 19 Sep and both still the newest work on those paths. The title implies payment-health alerts could post into merchants' own channels.
Say whether the detector fires on real prod data now, and list any merchant channel that received a payment-health alert before #515. Then add the age-gate counter: shown, confirmed, abandoned. With the gate live and the detector unproven, nothing is watching the funnel.
promote/m2-full (#502) and promote/wave1-safe-fixes (#501) reached production on 18 Sep. Immediately after, #507 and #508 (codex/box-session-idempotency, then -production, merged by Tim) carried fix: bind reused box URLs to the current payment session and fix: reuse unchanged embedded Woo checkout orders, plus test: expect WooCommerce 1.3.7 release metadata.
A reused box URL not bound to the payment session is a cross-session risk on a live checkout, and it was found after the switch rather than before it. REV-234, the QA ticket meant to gate this, and REV-228 itself both left the open list with no pass or fail recorded anywhere readable. The plugin's release metadata has moved to 1.3.7 while REV-249's manual QA cases were written against 1.2.34.
Next actionState what #507 and #508 actually fixed in buyer terms, and whether any live order between the switch and the fix could have been affected. Then pin the live plugin version so QA is testing what is deployed.
Linear today: REV-273 "Stand up the Fly.io app, staging and production" is [In Progress] p2 @nur, where it moved between the 21 and 22 Sep reads. REV-274 (tenant-isolated Postgres) and REV-275 (auth and roles) are still Todo, and REV-277 to REV-291 are fifteen Backlog "Platform copy" tickets, all yours. Every one carries upd 2026-09-21.
The last two boards asked that these wait for Tim's sequencing on REV-276, which is still In Progress and has not been updated since 21 Sep. Starting anyway may be the right call, but it leaves REV-247, an open p1 on leaked credentials, behind a greenfield build, and the payout questions that closed without code with nobody looking at them.
Next actionSay on REV-276 that REV-273 has started, so the sequencing is written against what is actually happening. Keep REV-247 and the Florida quote check ahead of it; both are under an hour and both are money or exposure.
In git: fix(catalog): keep retired GLP-1 listings out of seeds, fix(seed): remove retired SKUs from local overview fixtures, test: cover catalog retirement and correct decline fixture and test: use workspace export for catalog seed regression. So there is a retirement path, with regression coverage, shipped to production via #512 and unchanged since.
Against that: REV-241 (PR #461) changed prohibited products to allowed by default on 15 Sep, REV-232 "restricted items still refused with the alias on" left the open list with no readable result, REV-231 has been off the open list since 16 Sep, and Biopep's BAC Water is still refused in code despite Aadil's 14 Sep "let em run it up". Four sources, four different answers about what a merchant may sell.
Next actionWrite the one true statement of the rule: per merchant, what is refused, what is retired, what is allowed, and which flag controls it. Until that exists, nobody should treat "restricted items are refused" as true for any merchant.
At the 18 Sep read: REV-265 "No order has ever had a tracking number: 240 orders ($24,000) past ship date with no fulfilment evidence" [Backlog] p2; REV-263 "Guest orders not fixed: plugin still never writes the billing name (REV-230 closed early)" [Backlog] p1; REV-268 login hardening [Backlog] p3. None has been open since, and no commit in any window since names tracking, fulfilment or the billing name.
REV-263's own title is the warning: it exists because REV-230 was closed before the behaviour changed. That pattern has now repeated across two weekends and four more tickets.
Next actionOne line each on REV-265 and REV-263: fixed by what, or dropped and why. If REV-265 was dropped, pull a sample of the 240 and check whether tracking exists outside Revion (carrier, Woo) before a dispute asks.
REV-226 ("Webhook timeouts cancel PAID Woo orders") had two merges through 15 Sep: #455 (ack-then-process) and #457 (bound delivery lifetime within outbox lease). Closest to it since: fix: reuse unchanged embedded Woo checkout orders and fix: bind reused box URLs to the current payment session, shipped to production as #508.
REV-226 has been off the open list for days, but that is hardening on the same path, not the reconcile sweep. No commit anywhere names reconciling the orders the original bug already cancelled, and REV-251 is Tim's open ticket for exactly that number.
Next actionConfirm #455 and #457 are actually in production, then run the one-off reconcile of Apex orders Revion shows AUTHORIZED and Woo shows cancelled, and give Tim and Aadil the count before the Apex call. Say whether #507 and #508 change the reconcile logic.
REV-189 has stayed off the open list, and no commit in any recent collection names fee rates. At the last code read, zod locks feeRate to 12|14 in three places, sandbox-provisioning-client.ts:66 refuses other values, and settlement.ts guards fee_rate IN (12, 14) twice. REV-246 (Pura's NMI batch cutoff time) left the open list earlier.
While you are in Pura's account for REV-266, read the merchant row: if it went live at 12 or 14 against an 8.5 contract, tell Aadil; if 8.5 is stored, prove it passes both settlement guards.
emails.ts.
this weekemails.ts:368 carried the "processing is disabled" line at the 2 Sep read. REV-169 "Fix the merchant credentials email copy" read [Duplicate] on 18 Sep and has left the open list since; no readable source names which ticket absorbed it. REV-214, the most likely candidate on the same send path, has left too, and REV-267 has changed that path further by letting approved merchants into the portal earlier.
Find the canonical ticket REV-169 points at and confirm the copy itself changed. With REV-267 live, more merchants now receive this email before activation completes, so wrong copy reaches more people.
fee_cents drops on a partial refund is still stated nowhere.
this weekAs of the 15 Sep read: opt-in NMI reversal reconciliation "and atomic accounting" (#443), linked reversals held before reporting to the ACH generation fence (#445), external refund parent and original payment verified (#448), an exception review queue with opt-in Slack alerts (#452). At the last code read settlement.ts deducted refunded_cents but never recalculated fee_cents down, and MFSA 16.4 argues it should.
One line: does #443's accounting reduce the fee share on a partial refund? If not, add it before reconciliation is switched on for real merchants.
As of the 15 Sep read, Biopep reads https://biopepusa.com. Application websites: Research Chemical LLC https://www.researchchemical.com; Veri 7 labs https://veri7labs.com followed by a zero-width U+2060 character. Whether either merchant row carries the application value is unverified. The 18 Sep canonical-domain batch (#494, #495) fixed how links are built, not what is stored per row.
Read both merchant rows once the DB is back and fix by single-field update if needed, then normalise domains at registration so the next merchant cannot arrive broken.
slack_provisioning_status and _error exist on the merchant row but nothing shows them. Departures are just as invisible: Halo's consultancy left #halo-peptides on 23 Aug, Best Peptide's team left #best-peptide-lab on 11 Sep.
Show invite state and external-member count per merchant in admin, and post to Slack when a merchant's last external member leaves.
Asked in Core Engineering 31 Aug 13:48Z: "Would be sick if we had the customers number ready for anyone/me/andrew/pat to call them right away too." The buyer's phone is collected at checkout; the billing-inquiry queue and its alert email do not surface it. No such ticket is in today's Linear read, and with 23 issues open that is the whole list.
The same field had its REV-262 fix on 19 Sep (#514, #517), so the code is fresh in hand.
Next actionShow the buyer's phone on the billing-inquiry admin view and in the alert email, and file it in Linear with the LLM pre-check block.
support_admin_alert emails to support@send.revioncaps.com showed [failed] repeatedly from about 28 Aug. REV-146 was last confirmed [Todo] p2 on the 16 Sep read, then disappeared from every pull since after a batch of follow-up commits and a plugin repackage.
Confirm REV-146's real status, then check one actual support_admin_alert delivers before calling the sending-domain question closed.
Done since yesterday: nothing was merged on either branch for a fourth day: the newest commit on production is still 39e594a, the #517 merge of 19 Sep. None of your tickets moved in Linear either. REV-273 is still In Progress, REV-247 is still the only p1 open on you, and REV-256 and REV-196 stay above as open questions until you say what closed them. No ticks or comments on the 22 Sep board.
The gate reached production on 19 Sep via #512, with #513 as a review follow-up, and the newest commit on the production branch is still from that day. The commits that define its behaviour: require session-scoped 21+ age confirmation (#509), bind age approval to its browsing context, exempt hosted merchant checkout from age gate, require direct merchant payments to bypass age gate, address promotion review on seed items and age persistence, plus confirm age in direct checkout browser checks, which is the only test evidence on it and was written by the same author as the feature.
This is the highest-risk untested surface on the board, because it sits in front of payment and it fails in the direction of blocking a buyer. The detector that would notice a funnel collapse was last recorded matching 0 rows (REV-261, now closed with no commit), so a regression here stays invisible until a merchant complains.
Next actionTest it on your own store, not a merchant's: confirm once and pay; refuse and check what the buyer sees; confirm, close the tab, return, and check whether you are asked again; run it on the hosted path and on the direct path; check a returning buyer mid-payment is never re-gated. One line per case, posted where Nur and Tim will read it.
REV-257 (reproduce the Synergy failure) and REV-262 "Checkout phone field says 'optional' but blocks payment (Synergy Labs, live)" have both left the open list. git backs this one: Nur's fix(checkout): keep hosted phone optional through card and Apple Pay and fix(checkout): preserve supplied phone when Wallet omits it, merged as #514 and promoted as #517. Deployment to the Fly apps is still unverified, and the 21+ age gate sits on the same storefront path.
Run the cases the fix claims on your own store: card with no phone, card with a phone, Apple Pay where the Wallet omits the phone, Apple Pay where it supplies one. Then trace Synergy's next real order end to end and say whether a buyer completed a purchase; do not infer it from the ticket closing.
REV-234 "QA: embedded Visa box on WooCommerce (REV-233), plan now, run M1 Wed + M2 Thu with Tim" read [Todo] p1, upd 2026-09-16 on 18 Sep and has not been open since; REV-249 (the ten manual cases) and REV-228 are gone too. No readable source records a run, a pass or a fail. Meanwhile #507 and #508 put bind reused box URLs to the current payment session and reuse unchanged embedded Woo checkout orders into production after Apex switched, a defect class QA would have been looking for.
The version gap still stands: test: expect WooCommerce 1.3.7 release metadata means the live plugin has moved well past the 1.2.34 the cases target.
Post two lines where Tim and Nur will read them: did M1 and M2 run, and against which plugin version. If they did not, run them on 1.3.7 before anyone calls the box verified.
As of the 15 Sep read: Tim estimated about 9 of 20 real buyers reached the page and never submitted a card, and replay review was the next step; no result has been visible in any source since. Targets: Biopep cs_EZO-PKMQnMyecR0VfwTx $3,277.87, cs_RVasVZH_AAxR1qMea1PK $109.00, cs_ZK_B_CCbydE0g6S43ljT and cs_xzPaO8-h-7F5c3TwHr1C (both $69.99).
With Slack and the DB blind for eight days, replays are the one source of buyer-level truth that does not depend on the collector. They are also the fastest way to tell whether the new age gate is adding an abandonment point.
Next actionWatch the four Biopep replays, and while you are in there watch any post-19 Sep session that hits the age gate. One line each to Nur and Tim.
As of the 15 Sep read: the 14 Sep payout run listed Narboto inc at $0.09 to a test bank account, Andrew refused to send it, Aadil asked for test accounts to be removed from payouts, and Nur agreed the next run leaves them out. Halo orders RC-2026-1000228, -232, -233, -235, -236 and -242 (all $0.50) were unrefunded at the 2 Sep read; whether a refund landed since is unverified. Tim's overlapping-window question in BACKLOG.md is about three of these same $0.50 orders.
A test bank account on a live payout run is also a candidate for the bad profile REV-272 described before it closed.
Next actionRefund the six from admin, confirm with Nur that test merchants are flagged out of payout runs, and move dollar tests to your own store.
Done since yesterday: nothing left your list; your tickets left the open list after the 18 Sep read, and no readable source has recorded a result for any of them since. Nobody ticked or commented on the 22 Sep board.
In the 23 Sep 12:57Z collection, Slack (channel list and all 8 channels), the prod DB (all six tracked merchants, plus the JSON decode error on the raw read) and TG Core Engineering returned SECTION UNAVAILABLE. Linear, git, BACKLOG.md and the marks endpoint answered. Same missing-PATH signature as 2, 7, 8, 9, 10, 12, 14, 16, 17, 18, 19, 21 and 22 Sep.
Nothing on the machine has changed to fix it: the launchd plist sets no PATH, and neither collect.sh (last modified 31 Aug) nor generate.sh (1 Sep) exports one. The 22 Sep run log ends on generate.sh: line 79: node: command not found, which is the TG send, and launchd.out records TG post FAILED after every publish from 2 Sep to 22 Sep, fourteen out of fourteen. The automated post has never once gone out, which is the simplest explanation for eight boards in a row with no tick.
Add an explicit PATH (node, flyctl) at the top of collect.sh and generate.sh, or an EnvironmentVariables PATH in the plist, then re-run collect.sh by hand. This compose job may not touch the pipeline, so it needs Tim or an interactive session; six boards have now named the fix. Until then the only way the team sees the board is Tim pasting https://revion-crew-board.pages.dev into Core Engineering by hand.
Production-side merges not yet confirmed rolled: #517 (codex/rev262-production, the phone fix) and #516 (from sandbox, carrying #515's payment-health routing), both 19 Sep; #508 (codex/box-session-idempotency-production, merged by Tim), #512 (codex/age-gate-catalog-production) and #513; and the twelve PRs from 18 Sep (#283, #494 through #504). Merged is not deployed: prod CD needs the CLAMAV and CDR tokens and rolls seven Fly apps, and a missing build-arg has crash-looped the API before.
The quiet window makes this cheap: nothing is in flight to confuse a release check, so one pass tells you exactly what buyers are hitting. It also settles Nur's open question in one go: whether REVION_TAX_SUPPRESS_STATES is set on the prod app, which is the fact Tim needs for Jarrod.
Once PATH is fixed, run flyctl releases per app and check the release tag for #508, #512, #513, #516 and #517, read REVION_TAX_SUPPRESS_STATES off the prod app, then confirm on the live storefront whether the age gate renders and the phone field is optional. Never place a payment on sandbox.revioncaps.com: prod keys.
The DB watch list is still six merchants (halo, rhp, kiyora, zen, bpl, biopep) and the channel list eight; collect.sh has not changed since 31 Aug. As of the 15 Sep read, live merchants also included Apex Peptide Supply mrc_Jj7KJ7lPbJSh, Bioscience Peptides mrc_gUkKa0d4TClA, Veri 7 labs mrc_7RFYJXz5hHPT, Epic Wholesalers mrc_i1ZcMuL8KlKJ, Research Chemical mrc_Vhs6nzY0_j-c, Peptide911 mrc_PCV1-S_xcogf and Viltrumite Lab mrc_4oOU2meLCons; none is tracked.
Pura, Seven Sigma and Synergy were only ever visible through their Linear tickets, and those have closed. The payout thread was visible through REV-256 and REV-272, and they have closed too. Even with every source answering, the board would now say nothing about any of it. A closing ticket should not be able to remove a merchant from view.
Next actionAdd Pura, Seven Sigma, Synergy and Apex to MERCHANTS and their channels to CHANNELS in collect.sh, then derive both lists from the DB so the next go-live is tracked without anyone remembering to add it. Add a payouts query to the DB section so the payout path has a source that is not a ticket.
The live threads are the age gate's effect on real buyers (production via #512), Synergy's first order after the REV-262 fix, and whether Pura is actually trading now that REV-266 has closed with no commit. Biopep's next attempt is still open too, with none of four sessions reaching a card as of the 15 Sep read. watch-merchant.sh returned nothing for all six merchants in this collection, the same off-PATH failure as every collection since 16 Sep.
REV-266 and REV-262 are both closed, so this watch is the only check left on either. Once PATH is fixed, watch the next live order end to end through the gated checkout, confirm charge, receipt and Woo order state, and post the result where the team reads it.
generate.sh is unchanged since 1 Sep.
this weekToday's run log: started 12:57:04Z, 161 bundle lines collected, compose attempt 1. launchd.out shows the last on-time board was 16 Sep, finishing at 13:19Z. Since then: 17 Sep at 18:47Z after a 25-minute kill and a retry, 18 Sep at 18:33Z on a single attempt, 19 Sep only at 07:14Z the next morning after two failed attempts, 21 Sep at 18:43Z after a failed attempt, and 22 Sep at 18:31Z after attempt 1 died on "Your computer went to sleep mid-response".
The 18 Sep line shows the mechanism: that attempt logged compose exit 0 after 1140s yet finished more than five hours after a collection that started at 13:06Z, because the 25-minute cap in generate.sh counts 15-second loop iterations, not wall-clock time. With three attempts five minutes apart and no re-collect, a machine that sleeps mid-run stretches one attempt across hours, and a late retry composes on an old bundle without saying so.
In generate.sh: measure the cap and the retry gap in wall-clock time, re-collect before any retry that starts more than about two hours after collection, and widen the backoff. Like the PATH fix, it needs a human hand on the machine.
File one labelled Charge inquiry via the sandbox public support endpoint and confirm the alert email carries both admin links. (Claude's live POST was classifier-blocked, so it needs a human-run curl or Tim's go.) It pairs with Nur's failing support_admin_alert item, possibly closed by REV-146, same send path either way. BACKLOG.md still lists the proof as open.
Slack, the DB and TG read SECTION UNAVAILABLE in the 23 Sep collection, so there is no fresh merchant signal to sweep. Linear answered: 23 open, identical to the 22 Sep read, nothing updated after 21 Sep. git answered empty and the clone confirms nothing merged since 19 Sep. Slack, DB and TG items carry over from the 15 Sep 18:32Z read. Drafts go to the owner on this board; nothing is sent from here.
Done since yesterday: nothing shipped from this lane. Today's compose started on attempt 1, minutes after collection, where the five boards before it finished hours late. The PATH fix is still unapplied, the eighth day blind, and the 22 Sep TG post failed like the thirteen before it.