Updated Tue 22 Sep 2026, 19:30 London, from the 22 Sep 13:06Z collection; late because compose attempt 1 died with "your computer went to sleep mid-response" and this is the retry. Partial sources: Slack (the channel list and all 8 merchant and payout channels), the prod DB (all six tracked merchants, plus the JSON decode error on the raw read) and TG Core Engineering came back SECTION UNAVAILABLE again, the thirteenth occurrence of the missing-PATH signature since 2 Sep, so everything sourced from them still carries over from the 15 Sep 18:32Z read, now seven days old. Linear answered, and it is the whole story of today: 23 issues are open, four fewer than yesterday, and all four that left are the live business, REV-272 (one bad profile blocks every payout), REV-256 (sent payouts with no bank reference), REV-196 (Florida tax) and REV-269 (Aadil's Florida decision). git answered empty, and the clone confirms why: nothing has been merged to sandbox or production since #517 on 19 Sep, so not one of the four closures has a code change behind it. The query cannot tell completed from cancelled. Of the 23 still open, 19 are the new platform build, and REV-273, its Fly app, moved from Todo to In Progress between the two reads. The marks endpoint answered: nobody ticked or commented on the 21 Sep board.
Top now: every payout and Florida-tax ticket closed on 21 Sep, REV-272, REV-256, REV-196 and REV-269, in a window where git shows nothing merged at all · REV-250, Seven Sigma's bank details, is now the only payout item left open and has not moved since 16 Sep, four days past the payout date · 19 of the 23 open tickets are the new platform build; the live business is down to four
Today's Linear read returns 23 open issues against a query that asks for 50, so that is the whole open list. Nineteen of the 23 are the new platform build (REV-273 to REV-291). The live business is down to four tickets: REV-251 (Apex cross-check, @tim), REV-250 (Seven Sigma bank details, @tim), REV-247 (leaked credentials, @nur) and REV-164 (the A@ password, @aadil).
Four more left since yesterday's read, and they are not hygiene tickets: REV-272 "one bad merchant profile silently blocks everyone's payout" (filed 19 Sep, still unassigned when last seen), REV-256 "Close out sent payouts: bank reference and sent date, not stuck in processing" (p1 @nur), REV-196 "Turn OFF Florida sales-tax collection until registered" (In Progress p1 @nur) and REV-269, Aadil's decision on the Florida flag. The GIT section of today's bundle came back empty, and the clone confirms it: the newest commit on origin/sandbox or origin/production is still 39e594a, the #517 merge of 19 Sep. So four tickets covering unreferenced payouts, a batch-blocking bug and tax that may have been wrongly collected closed in a three-day window with no code written.
The query filters completed and cancelled alike, so it cannot say which happened. That distinction is now the difference between "the payout path is fixed" and "the payout path has no ticket".
Next actionOpen Linear's recently closed view and write one line each for REV-272, REV-256, REV-196 and REV-269: completed by what, or cancelled and why. Do these four before the older backlog; they closed without code, they are all money, and they were this board's only remaining handle on the payout and tax threads.
Today's Linear read: REV-250 "Seven Sigma: get bank details before the 18 Sep payout" is still [Todo] p1 @tim, upd 2026-09-16, untouched for six days. The date it was written against passed on 18 Sep.
What changed around it is worse than the ticket standing still. REV-256 (sent payouts stuck in processing with no bank reference, p1 @nur) and REV-272 (one bad merchant profile silently blocks everyone's payout, filed 19 Sep, unassigned) are both gone from today's open list, and no commit exists in the window to explain either. A merchant still missing bank details on payout day is exactly the bad profile REV-272 described, so the one ticket left open describes the one condition the closed ticket warned about. Slack, the DB and TG are blind for a seventh day, so nothing here can be checked against a payout run.
Ask Andrew in #ach-payouts-production today: did Seven Sigma's payout go, with what bank reference, and has any run since 18 Sep stalled or been skipped. If Seven Sigma still has no bank details, get them now. Then ask Nur what closed REV-272, because nothing in git did.
As of the 15 Sep read, #rhp-rhpeptides ended on Jarrod's 1 Sep 05:57Z message: "that text is from the master document, not the one you signed... I will discuss with Aadil today and get back to you." Your 31 Aug 16:36Z answer rested on three things: Revion is the seller of record, "Revion is registered in Florida today", and sections 8.5 and 8.7, which his copy does not contain. RHP: 0 sessions since 13 Sep, fee_rate 14. Slack has been blind for seven days.
New today: REV-269 "Decide: enable REVION_TAX_SUPPRESS_STATES=FL on production" ([Todo] p2 @aadil yesterday) and REV-196 "Turn OFF Florida sales-tax collection until registered: $0 FL quotes, refund collected tax, purge TaxJar test transactions" ([In Progress] p1 @nur yesterday) are both off the open list, and no commit touches tax in the window. Either Aadil answered the registration question and the answer made both tickets moot, which would mean the fact you have been waiting on since 31 Aug now exists and nobody told you, or they were cleared out and Florida buyers are still being charged with the refund half unshipped.
Ask Aadil one question today: what closed REV-269, and is Revion registered in Florida. Then pull a fresh Florida quote yourself and see whether it returns $0. Tell Jarrod only what the quote and the executed agreement show, not what a closed ticket implies.
Carried from the last board, and still the largest change to the buyer path with no owner on record. git carries fix(storefront): require session-scoped 21+ age confirmation (#509) plus test(storefront): confirm age in direct checkout browser checks and fix(catalog): keep retired GLP-1 listings out of seeds, authored by the aadil-netizen account and dated 19 Sep, reaching production through PR #512 (branch codex/age-gate-catalog-production) with a review follow-up in #513. Nur's own 18 Sep commits fill in the shape: bind age approval to its browsing context, exempt hosted merchant checkout from age gate, require direct merchant payments to bypass age gate, remove retired SKUs from local overview fixtures, address promotion review on seed items and age persistence.
Nothing has been merged since, so the gate as described on 19 Sep is what is deployed, if it deployed. Three days on, no readable source still says who decided it, whether it applies to live merchants' buyers or only Revion's own storefront, or whether a single real buyer has been through it. Today's Linear read carries no ticket for it; it is tracked as GitHub issue #509, which is why no REV number covers it.
Get two answers today: who authorised a 21+ interstitial and the GLP-1 retirement, and which merchants' buyers actually see the gate. Then load Revion's own checkout yourself and walk it end to end as a buyer. An age gate with a persistence fix already on it, in front of a funnel that is leaking, is a conversion risk and not just a compliance feature.
Linear, both reads: REV-276 "Platform architecture: what we reuse from Revion and what is new" is [In Progress] p1 @tim. REV-273 "Stand up the Fly.io app, staging and production" read [Todo] p2 @nur yesterday and reads [In Progress] p2 @nur today. REV-274 (tenant-isolated Postgres) and REV-275 (auth and roles) are still [Todo] p2 @nur, and REV-277 to REV-291 are fifteen [Backlog] p3 "Platform copy" tickets.
The last board asked you to write the sequencing on REV-276 before REV-273 to REV-275 started. REV-273 started. In the same window REV-256, REV-196 and REV-272 left the open list with no code behind them, so from Linear alone the live business now looks finished and the platform looks like the work. Four live tickets are open against nineteen platform ones.
Next actionWrite the sequencing on REV-276 today, now that it is a live question and not a hypothetical: what Nur finishes on the payout and tax paths before the platform takes his week, and who owns the payout batch now REV-272 is closed. If the answer is that the platform is the priority, say that plainly so nobody reads the closures as completion.
REV-251 "Apex: cross-check the 25 approved September payments against Matt cancelled orders" is still [Todo] p2 @tim, upd 2026-09-16. Two rounds of ticket closures have gone past it without touching it, which is a reasonable signal that it is genuinely still to do rather than quietly dropped. Matt is almost certainly Matthew Jensen, the Apex contact; which orders he disputes is still in no readable source.
Worth noting before the reconciliation: fix: reuse unchanged embedded Woo checkout orders and fix: bind reused box URLs to the current payment session (PRs #507, #508) changed how an existing Woo order is reused across payment attempts. That is the same seam where a Revion payment and a cancelled Woo order drift apart, so the mismatch set may look different before and after 18 Sep.
Get the cancelled order numbers from Matt, and check none of the 25 approved payments was built from an order Woo shows cancelled. Note which side of the 18 Sep idempotency change each disputed order falls on. Confirm with Aadil or Nur that the transfer itself cleared, not just that it was approved.
At the 15 Sep read, mrc_roNy1mlK9Ij5 showed four sessions and zero payment intents: cs_RVasVZH_AAxR1qMea1PK $109.00 and cs_EZO-PKMQnMyecR0VfwTx $3,277.87 (no buyer email), then cs_ZK_B_CCbydE0g6S43ljT and cs_xzPaO8-h-7F5c3TwHr1C, both $69.99 from info@biopepusa.com. Nobody reached the point of submitting a card. The merchant row read https://biopepusa.com as of that read, so the domain trap is plausibly behind them.
The DB has now been blind for seven days, so none of this has been re-checked, and nothing has been merged since 19 Sep that would have changed it either way. BAC Water refusals are the original suspected wall here, and the catalogue-retirement work shows that machinery is being actively changed while nobody has stated the rule.
Next actionEmail Casey and ask him to retry the $69.99 cart while you watch, and to describe the exact screen he stops on, including whether he is now asked to confirm an age. Get Nur's straight answer on BAC Water separately; a default flip is not the same as confirming what Biopep actually hit.
REV-234 ("QA: embedded Visa box on WooCommerce, plan now, run M1 Wed + M2 Thu with Tim") read [Todo] p1, upd 2026-09-16 on 18 Sep and has not been in an open list since. Completed and cancelled look the same from here. What git shows is the box being repaired in production rather than verified: #507 then #508 (merged by you) carrying fix: bind reused box URLs to the current payment session and fix: reuse unchanged embedded Woo checkout orders, plus test: expect WooCommerce 1.3.7 release metadata.
Slack and the DB are blind for a seventh day, so there is still no session-level evidence that a real buyer has completed an order through the box.
Next actionPlace one real order through the embedded box on a store you control, confirm the charge, the receipt and the Woo order state, and write the result down where the team reads it, since REV-234 is no longer open to carry it.
As of the 15 Sep read: 11 Sep run, Halo $1.32, Zen $801.06; 14 Sep run, Halo $358.16 (Mercury ••••2806), Narboto inc $0.09, Zen $2,491.16; Andrew, 15 Sep 13:12Z: "others got paid". The 27 Aug $1,139.16 (9 orders) has not appeared in any run since and has no visible reference.
BACKLOG.md, still last updated 15 Sep, carries the open version of this as your own item: the 8 Sep (window Sep 1-8) and 11 Sep (window Sep 3-11) runs both carry Halo $1.32 from three $0.50 orders at 12%, on overlapping windows. With REV-256 off the open list, nothing in Linear now asks whether a payout marked sent actually moved money.
Next actionAsk Andrew for the bank references of the 27 Aug and 1 Sep Halo drafts and of the 15 Sep send, and ask Nur to confirm the same three $0.50 orders were not paid twice across the overlapping windows. Fold the answer into whatever closed REV-256.
app_uHyTgAc1QXxFQKBW (coreresearchpeptides.com) was under review from 1 Sep. REV-214 (verify callback, activate, then send portal credentials) and REV-258 ("Sache's stores: Vyal Labs and Halo Labs USA are still inactive with zero sessions") were both open on 18 Sep and neither has been in an open list since. REV-267 ("allow approved merchants to set up portal before activation") reached production on 18 Sep through PRs #498, #499 and #500, the change most likely to have moved them.
A closed ticket is not a live merchant. None of the three is in the collector's watch list, and the DB section is unavailable anyway.
Next actionRun onboarding-check.sh against Vyal Labs, Halo Labs USA and Sean Finck's account once the DB is reachable. If any is live, confirm banking_approved and complete bank details before its first payout: REV-272 said one bad profile can stall everyone's batch, and REV-272 closing did not make that untrue.
As of the 15 Sep read, #best-peptide-lab: your 31 Aug 09:06Z offer of 20 minutes to run the first embedded order together got no reply, then Slackbot, 11 Sep 09:44Z, the team removed themselves. Merchant row: active, banking approved 2 Sep, contact dev@guardedpaypro.com, fee 12, 0 sessions and 0 orders since 13 Sep.
REV-247 (rotate the "GuardedPay" password leaked in Core Engineering) is still open in today's read, untouched since 16 Sep, and is now one of only four live-business tickets left. As noted before, the payment-links branch naming is a coincidence, not this merchant.
Next actionEmail dev@guardedpaypro.com, since Slack no longer reaches them: ask straight whether they are still integrating, and offer a slot to put the embedded box on bestpeptidelab.com with you watching. Mention the age gate if it applies to their buyers, so they are not surprised by a new screen.
#kiyora-peptide-llc, 13 Sep 15:30Z, Andrew: "We confirm receipt of Kiyora Peptide, LLC's notice of termination dated September 13, 2026... As Kiyora did not process any transactions through the Revion platform, there are no processed transactions, settlements, chargebacks, refunds, transaction-related losses, or termination reserve to reconcile." 15 Sep DB read: mrc_zinhzQp6eyBC status=active, 0 sessions. Why a working merchant left without a single sale is in no source, and the DB is blind for a seventh day.
An active row with approved banking on a terminated merchant is also the shape of profile REV-272 described before it closed, so leaving it open is not free.
Next actionClose the account (keys off), send the effective date Andrew promised, and ask one question: what stopped Kiyora switching Revion on. The same answer probably applies to Best Peptide and RHP.
REV-252 "Backend reviewer: hire, or interim AI review on every PR" was [Todo] p3 @tim on 18 Sep and has not been in an open list since; nothing readable says what was decided. The last merges, all 19 Sep: #514 (codex/rev262-optional-phone), #517 (codex/rev262-production), #515 (nur/payment-health-engineering-only) and #516 (from sandbox), all merged by the beastmmode account, with the commits authored by Nur. Before that, #507, #508, #512 and #513 came off codex/* branches too.
Write down what closing REV-252 meant: who reviews, and what cannot reach production without a live-path check. Confirm who beastmmode is and whether that account should be merging to production. Three quiet days is the cheapest time to set the rule.
4SMZBX4M… + run the REV-60 cleanup scriptWhether the ticket is resolved is unverified; there are no billing-inquiry rows in this collection either. BACKLOG.md still carries both halves as open: resolve 4SMZBX4Mswa4R3tzAK5DR as a test (order RC-2026-1000210, Narboto's $1.07, already refunded), then promote PR #355's alert deep links to prod with the next release. There has been no release since 19 Sep to carry them.
revioncaps.com/admin/billing-inquiries, Resolve, note "QA daily test, no action". Locally: source ~/RevionCaps/creds.sh && python3 ~/RevionCaps/linear_cleanup_rev60.py (idempotent; it also comments on REV-170).
Done since yesterday: nothing of yours moved. REV-250 and REV-251 are unchanged since 16 Sep and are now two of the four live-business tickets left open. What changed is around you: REV-272, REV-256, REV-196 and REV-269 all left the open list with no commit behind any of them, so three threads this board was putting to the payout and tax work no longer have a ticket carrying them. Nobody ticked or commented on the 21 Sep board.
Yesterday's Linear read: REV-269 "Decide: enable REVION_TAX_SUPPRESS_STATES=FL on production (stop collecting Florida sales tax)", [Todo] p2 @aadil, upd 2026-09-18, and REV-196, the engineering side, [In Progress] p1 @nur. Today neither is open. Nothing has been merged to sandbox or production since 19 Sep, and no commit in that window touches tax, so no code changed between the two reads.
Three things hang on the answer. Jarrod at RHP has been waiting since 1 Sep and Tim's 31 Aug message told him "Revion is registered in Florida today". REV-196 also carried refunding tax already collected and purging TaxJar test transactions, which nothing in git shows shipped. And the flag itself is an environment variable on production, so the switch is either on or it is not, and that is checkable in a minute.
Next actionAnswer one question in writing today: is Revion registered to collect sales tax in Florida. Then say what closed REV-269, and whether the refunds in REV-196 are still owed. Send Tim the executed RHP agreement in the same message.
As of the 15 Sep read, #ach-payouts-production: Andrew 16:19Z, "when do you show payouts starting for apex peptide supply they said they had transactions sept 4-7?"; 16:22Z, "peptide 911 wants to know there status as well". Nur, TG 17:48Z: "Two merchants transacted with matured, payable balances but no payout went out because their banking verification step had not been run. Both are now verified." Apex Peptide Supply $2,267.28 (19 orders settled 3-10 Sep); Peptide911 $262.79.
REV-256 "Close out sent payouts: bank reference and sent date, not stuck in processing" was [Todo] p1 @nur yesterday and is not open today. REV-272, "one bad merchant profile silently blocks everyone's payout", filed 19 Sep and never assigned, is gone too. If they were completed there is a list of payouts with bank references somewhere; if they were cleared out, two merchants are owed money nobody is tracking. The payout channel has been unreadable for seven days.
Get Andrew to confirm both ACH transfers carry an actual bank reference, not just a "sent" status, and whether any run since 15 Sep stalled or was skipped. Only then call Matthew Jensen and James Votraw.
REV-266 "Pura Peptides dark 36h: fatal error freezes orders, our callbacks now get HTTP 400" was [Backlog] p1 @nur on 18 Sep. It has not been in an open list since, and nothing has been merged to either branch since 19 Sep, so whatever resolved it was not code in this repo. It may have been fixed on Pura's side, or cancelled; nothing readable tells those apart.
The rest, all from the 15 Sep read and unchanged since: Kiyora terminated (Andrew acknowledged 13 Sep, "did not process any transactions"); Best Peptide's team removed themselves from Slack 11 Sep, 0 sessions; Biopep had four checkouts and none reached a card; RHP had 0 sessions.
Next actionPhone Pura today and ask one question: are orders flowing and getting paid since 18 Sep. Then by phone this week: Best Peptide, Biopep's Casey (with Tim), Jarrod (after the Florida answer), and Kiyora on why they left.
Open since 28 Aug; Nur asked again on the morning of 29 Aug. Whether his payment went out is still unverified, TG has been blind for seven days so the thread cannot be checked.
Since the last board he has merged nothing, which is the first quiet stretch in weeks; before it he shipped the REV-262 phone fix (#514, #517), moved payment-health alerts out of merchant channels (#515, #516), the age-gate scoping work and the box-session idempotency fixes. In the same 24 hours, REV-273 moved to In Progress, so the new platform is now on his desk on top of REV-247, which is still an open p1.
Next actionSend it, confirm in the thread.
As of the 15 Sep read: "Synergy Research, LLC" (synergy-labs.uswholesalepeptides.com, mrc_LLEYN7Q4l9fC) live since 15 Sep; "Vyal Labs LLC" (vyallabs.com, mrc_PA2TX_ACHQq5) approved 12 Sep; "Halo Labs USA LLC" (halolabsusa.com, mrc_f4LFsn8VaAaJ, contact Alice Rewoldt) approved 14 Sep. Halo Labs USA is a different business from Halo Peptides, keep them apart in payouts.
git, 19 Sep: Nur's fix(checkout): keep hosted phone optional through card and Apple Pay and fix(checkout): preserve supplied phone when Wallet omits it, merged as #514 and promoted as #517 (codex/rev262-production). That is still the newest commit on the production branch. Whether it is deployed, and whether a Synergy buyer has paid since, is unverified.
Once #517 is confirmed deployed (Claude's item), tell Synergy the fix is live and ask for their next order number so it can be traced end to end. Ask Nur whether Vyal and Halo Labs USA are live now; if not, chase banking and set them live by hand.
git carries fix(catalog): keep retired GLP-1 listings out of seeds (authored by the aadil-netizen account, 19 Sep, reaching production via PR #512) alongside Nur's fix(seed): remove retired SKUs from local overview fixtures and test: cover catalog retirement and correct decline fixture. Retirement plumbing for a named product class is built and shipped, and nothing has changed it since.
Nothing readable says whose decision this is, which merchants it affects, or whether they have been told. It also sits directly across the REV-22 denylist thread: Biopep's 14 Sep email asks why BAC Water fails, your 14 Sep 19:40Z "let em run it up" was never implemented in code, and REV-232, the test of whether restricted items are refused at all, left the open list with no readable result. A catalogue policy now has three different answers depending on which source you read.
Next actionSay plainly whether GLP-1 retirement is a commercial decision you made, and give one list of what is refused, what is allowed, and for whom. Anyone selling a retired class needs telling before their buyers find out at checkout.
The wall was measured on 2 Sep: $380 and $361 in non-Visa declines over five days. At the 15 Sep read there were 10 production attempts across merchants, 5 authorized, and declines returned "Your card was declined. Please use another Visa card or contact your card issuer."
REV-112 "Apple Pay on NMI, step 0: confirm with Ignacio the MID supports own-certificate Apple Pay" was [Backlog] p2 @aadil at the 18 Sep read and has not been open since; no brand-enablement ticket for Mastercard, Amex or Discover is open either. Apex is on the embedded box, so every non-Visa buyer hitting it is a measurable loss rather than a hypothetical one.
Get Ignacio's answer in writing, whatever closed REV-112: does the MID support own-certificate Apple Pay. Separately ask what enables Mastercard, Amex and Discover, and by when.
As of the 15 Sep read, VAPI_PRIVATE_KEY, VAPI_PHONE_NUMBER_ID and VAPI_ASSISTANT_ID were set on revioncaps-prod; calls are held off only by VAPI_OUTBOUND_ENABLED=false, and vapi-outbound.ts has no calling-window, DNC or unbundled-consent gates. No VAPI ticket is in today's Linear read either, and with only 23 issues open that is the whole list, not a truncation. BACKLOG.md still carries it as a red item needing you and Tim.
Worth connecting to this week's shipping: the team put a compliance gate in the buyer path in two days when it decided to. The same standard has not been applied to outbound calling, where the exposure is statutory.
Next actionEither unset the prod keys or commission the TCPA gates, and file whichever it is.
REV-164 [Todo] p3 @aadil, upd 2026-08-27. Two rounds of closures have gone past it. TG has been blind for seven days, so whether the message was deleted cannot be checked. REV-247 (the separate "GuardedPay" leaked credential, @nur) is the other survivor of the same kind.
Rotate it, delete the message, close the ticket. Two leaked-credential tickets surviving every clear-out is not a coincidence worth defending.
Done since yesterday: REV-269, your Florida decision, left the open list on 21 Sep, and REV-196 went with it. No tax commit exists in the window and nothing has been merged since 19 Sep, so the decision is either made and unannounced or cleared out; it stays above as an open question until you say which. No ticks or comments on the 21 Sep board.
REV-256 "Close out sent payouts: bank reference and sent date, not stuck in processing" was [Todo] p1 @nur, upd 2026-09-18, yesterday. It is not in today's open list. The GIT section came back empty and the clone confirms the newest commit on sandbox or production is still 39e594a from 19 Sep, so nothing shipped against it.
It covered Apex and Peptide911's catch-up run, Halo's 14 Sep $358.16 and the unreferenced 27 Aug $1,139.16, Zen's overlapping-window runs and Seven Sigma's first payout. If it was completed by a data fix or a manual reconciliation, that is a good outcome and nobody outside Linear can see it. If it was cleared out, every one of those amounts is still unconfirmed.
Next actionPost one list in #ach-payouts-production: every payout marked sent in the last 30 days, with or without a bank reference. That list is what closing REV-256 should have produced. Anything without a reference is not confirmed paid, whatever the status says.
REV-272 "Payout ACH batch: one bad merchant profile silently blocks everyone's payout" read [Backlog] p2 @unassigned, upd 2026-09-19, on yesterday's board. Today it is off the open list. Nothing has been merged to sandbox or production since 19 Sep, so the batch code is byte-identical to the code that had the bug when the ticket was filed.
It lands with you because the payout path is yours, not because anyone assigned it. What sat under it has not moved either: Apex and Peptide911's first payouts were stranded once already, Halo's $1,139.16 has no reference, and REV-250, Seven Sigma's missing bank details, is still [Todo] and is now the only payout ticket open anywhere.
Say in one line what closed REV-272. If the fix is real, point at it. If it was cleared out, reopen it or take it: a batch that stops silently on one bad profile, with a merchant known to be missing bank details, is a production defect and the code has not changed.
REV-196 "Turn OFF Florida sales-tax collection until registered: $0 FL quotes, refund collected tax, purge TaxJar test transactions" was [In Progress] p1 @nur, upd 2026-09-18, yesterday, and is not open today. PR #465 (merged 15 Sep) covered the quote half. The refund and purge halves have no commit, and the newest commit on either branch is still #517 from 19 Sep. REV-269, the decision it was gated on, closed in the same 24 hours.
A ticket moving out of In Progress without code usually means the decision made it unnecessary. If Aadil confirmed Revion is registered in Florida, that is exactly right and it should be written down. If it was cleared out, buyers were charged tax that was flagged as possibly not collectable, and nobody is refunding it.
Next actionAnswer one question for Tim today: does a Florida quote on production return $0, yes or no, and is REVION_TAX_SUPPRESS_STATES set on the prod app. Then say whether refunds are owed. It is a two-minute check and it unblocks the RHP answer that has been stuck since 1 Sep.
REV-247 "Delete the credentials and bank details posted in Core Engineering, rotate the GuardedPay password" is still [Todo] p1 @nur, upd 2026-09-16. With REV-256 and REV-196 gone, it is the last open p1 on the live business anywhere in Linear. How long the credentials have been exposed and who posted them is in no readable source; TG has been blind for seven days so the message itself cannot be checked. REV-164 (the separate A@ Google password) is in the same state on Aadil.
Delete the message, rotate the password, and check whether anything was accessed with it while it was live. If the platform build takes your week from here, this is the one thing that should not wait behind it.
REV-266 "Pura Peptides dark 36h: fatal error freezes orders, our callbacks now get HTTP 400" was [Backlog] p1 @nur at the 18 Sep read. It has not been open since, and the newest commit on either branch is still #517 from 19 Sep, which is the phone fix. So if this was fixed, it was fixed on Pura's side or in configuration, not in this repo.
The frozen orders matter either way: whether they were recovered is in no readable source, and with Slack and the DB blind for a seventh day there is no way to see Pura's traffic at all.
Next actionWrite one line on REV-266: what the 400 was, what fixed it, and whether the frozen orders were recovered or need refunding. If nothing fixed it, reopen it.
The commits, in order: fix(storefront): require session-scoped 21+ age confirmation (#509) and test(storefront): confirm age in direct checkout browser checks (aadil-netizen, 19 Sep), your fix(storefront): bind age approval to its browsing context, fix(storefront): exempt hosted merchant checkout from age gate, test(checkout): require direct merchant payments to bypass age gate, test(checkout): match the backend decline status, and fix: address promotion review on seed items and age persistence. It reached production through #512 (codex/age-gate-catalog-production) with #513 as the review follow-up, and the sandbox side through #511.
Three days have passed with no further commits, so this is the settled shape, not a work in progress. Four exemption or scoping rules landed in two days: hosted merchant checkout exempt, direct merchant payments bypassing, approval bound to a browsing context, and a persistence fix on top. A buyer who confirms once and gets asked again, or worse is blocked mid-payment, is a lost order, and the detector that would notice a funnel collapse was last seen matching 0 rows.
Next actionWrite the matrix down in one place: which checkout surfaces gate, which are exempt, what the buyer sees, and what happens when the stored approval is missing or stale. Then walk one live buyer path per surface yourself.
REV-244 "Seven Sigma and Bioscience: Cloudflare blocks our webhook, callbacks never arrive" was [Todo] p2 @nur, upd 2026-09-18, at the 18 Sep read. It has not been open since, and no commit in any window since names Cloudflare, a webhook allowlist or callbacks. The block may have been on the merchants' side and lifted there; nothing readable says.
It was one of three callback-path failures in a week: REV-226 cancelling paid Apex orders, REV-244, and Pura's REV-266 callbacks returning HTTP 400. All three are off the open list, none with a commit behind it.
Next actionOne line on REV-244: what Cloudflare was blocking and what changed. Then confirm a real callback has landed for Seven Sigma since, before anyone reconciles their orders or pays them out.
REV-261 "REV-142 shipped a dead detector: gateway failure streak join matches 0 rows on prod" was [Backlog] p1 @nur on 18 Sep and has not been open since. Also gone earlier: REV-165 (funnel and decline report), REV-145 (plugins page) and REV-173 (telemetry null). No commit in any window since names the detector's join.
What git does show is your Keep payment-health alerts out of merchant Slack channels, merged as #515 (nur/payment-health-engineering-only) and carried by #516 from sandbox, both on 19 Sep and both still the newest work on those paths. The title implies payment-health alerts could post into merchants' own channels.
Say whether the detector fires on real prod data now, and list any merchant channel that received a payment-health alert before #515. Then add the age-gate counter: shown, confirmed, abandoned. With the gate live and the detector unproven, nothing is watching the funnel.
promote/m2-full (#502) and promote/wave1-safe-fixes (#501) reached production on 18 Sep. Immediately after, #507 and #508 (codex/box-session-idempotency, then -production, merged by Tim) carried fix: bind reused box URLs to the current payment session and fix: reuse unchanged embedded Woo checkout orders, plus test: expect WooCommerce 1.3.7 release metadata.
A reused box URL not bound to the payment session is a cross-session risk on a live checkout, and it was found after the switch rather than before it. REV-234, the QA ticket meant to gate this, and REV-228 itself both left the open list with no pass or fail recorded anywhere readable. The plugin's release metadata has moved to 1.3.7 while REV-249's manual QA cases were written against 1.2.34.
Next actionState what #507 and #508 actually fixed in buyer terms, and whether any live order between the switch and the fix could have been affected. Then pin the live plugin version so QA is testing what is deployed.
Linear, comparing the two reads: REV-273 "Stand up the Fly.io app, staging and production" was [Todo] p2 @nur yesterday and is [In Progress] p2 @nur today. REV-274 (tenant-isolated Postgres) and REV-275 (auth and roles) are still Todo, and REV-277 to REV-291 are fifteen Backlog "Platform copy" tickets, all yours.
The last board asked that these be held until Tim wrote the sequencing on REV-276, which is still In Progress. They were not held. That may be the right call, but it means REV-247, an open p1 on leaked credentials, is now behind a greenfield build, and the payout questions that closed without code have nobody looking at them.
Next actionSay on REV-276 that REV-273 has started, so the sequencing is written against what is actually happening. Then keep REV-247 and the Florida quote check ahead of it; both are under an hour and both are money or exposure.
In git: fix(catalog): keep retired GLP-1 listings out of seeds, fix(seed): remove retired SKUs from local overview fixtures, test: cover catalog retirement and correct decline fixture and test: use workspace export for catalog seed regression. So there is a retirement path, with regression coverage, shipped to production via #512 and unchanged since.
Against that: REV-241 (PR #461) changed prohibited products to allowed by default on 15 Sep, REV-232 "restricted items still refused with the alias on" left the open list with no readable result, REV-231 has been off the open list since 16 Sep, and Biopep's BAC Water is still refused in code despite Aadil's 14 Sep "let em run it up". Four sources, four different answers about what a merchant may sell.
Next actionWrite the one true statement of the rule: per merchant, what is refused, what is retired, what is allowed, and which flag controls it. Until that exists, nobody should treat "restricted items are refused" as true for any merchant.
At the 18 Sep read: REV-265 "No order has ever had a tracking number: 240 orders ($24,000) past ship date with no fulfilment evidence" [Backlog] p2; REV-263 "Guest orders not fixed: plugin still never writes the billing name (REV-230 closed early)" [Backlog] p1; REV-268 login hardening [Backlog] p3. None has been open since, and no commit in any window since names tracking, fulfilment or the billing name.
REV-263's own title is the warning: it exists because REV-230 was closed before the behaviour changed. That pattern has now repeated across two weekends and four more tickets.
Next actionOne line each on REV-265 and REV-263: fixed by what, or dropped and why. If REV-265 was dropped, pull a sample of the 240 and check whether tracking exists outside Revion (carrier, Woo) before a dispute asks.
REV-226 ("Webhook timeouts cancel PAID Woo orders") had two merges through 15 Sep: #455 (ack-then-process) and #457 (bound delivery lifetime within outbox lease). Closest to it since: fix: reuse unchanged embedded Woo checkout orders and fix: bind reused box URLs to the current payment session, shipped to production as #508.
REV-226 has been off the open list for days, but that is hardening on the same path, not the reconcile sweep. No commit anywhere names reconciling the orders the original bug already cancelled, and REV-251 is Tim's open ticket for exactly that number.
Next actionConfirm #455 and #457 are actually in production, then run the one-off reconcile of Apex orders Revion shows AUTHORIZED and Woo shows cancelled, and give Tim and Aadil the count before the Apex call. Say whether #507 and #508 change the reconcile logic.
REV-189 has stayed off the open list, and no commit in any recent collection names fee rates. At the last code read, zod locks feeRate to 12|14 in three places, sandbox-provisioning-client.ts:66 refuses other values, and settlement.ts guards fee_rate IN (12, 14) twice. REV-246 (Pura's NMI batch cutoff time) left the open list earlier.
While you are in Pura's account for REV-266, read the merchant row: if it went live at 12 or 14 against an 8.5 contract, tell Aadil; if 8.5 is stored, prove it passes both settlement guards.
emails.ts.
this weekemails.ts:368 carried the "processing is disabled" line at the 2 Sep read. REV-169 "Fix the merchant credentials email copy" read [Duplicate] on 18 Sep and has left the open list since; no readable source names which ticket absorbed it. REV-214, the most likely candidate on the same send path, has left too, and REV-267 has changed that path further by letting approved merchants into the portal earlier.
Find the canonical ticket REV-169 points at and confirm the copy itself changed. With REV-267 live, more merchants now receive this email before activation completes, so wrong copy reaches more people.
fee_cents drops on a partial refund is still stated nowhere.
this weekAs of the 15 Sep read: opt-in NMI reversal reconciliation "and atomic accounting" (#443), linked reversals held before reporting to the ACH generation fence (#445), external refund parent and original payment verified (#448), an exception review queue with opt-in Slack alerts (#452). At the last code read settlement.ts deducted refunded_cents but never recalculated fee_cents down, and MFSA 16.4 argues it should.
One line: does #443's accounting reduce the fee share on a partial refund? If not, add it before reconciliation is switched on for real merchants.
As of the 15 Sep read, Biopep now reads https://biopepusa.com. Application websites: Research Chemical LLC https://www.researchchemical.com; Veri 7 labs https://veri7labs.com followed by a zero-width U+2060 character. Whether either merchant row carries the application value is unverified. The 18 Sep canonical-domain batch (#494, #495) fixed how links are built, not what is stored per row.
Read both merchant rows once the DB is back and fix by single-field update if needed, then normalise domains at registration so the next merchant cannot arrive broken.
slack_provisioning_status and _error exist on the merchant row but nothing shows them. Departures are just as invisible: Halo's consultancy left #halo-peptides on 23 Aug, Best Peptide's team left #best-peptide-lab on 11 Sep.
Show invite state and external-member count per merchant in admin, and post to Slack when a merchant's last external member leaves.
Asked in Core Engineering 31 Aug 13:48Z: "Would be sick if we had the customers number ready for anyone/me/andrew/pat to call them right away too." The buyer's phone is collected at checkout; the billing-inquiry queue and its alert email do not surface it. No such ticket is in today's Linear read, and with 23 issues open that is the whole list.
The same field had its REV-262 fix on 19 Sep (#514, #517), so the code is fresh in hand.
Next actionShow the buyer's phone on the billing-inquiry admin view and in the alert email, and file it in Linear with the LLM pre-check block.
support_admin_alert emails to support@send.revioncaps.com showed [failed] repeatedly from about 28 Aug. REV-146 was last confirmed [Todo] p2 on the 16 Sep read, then disappeared from every pull since after a batch of follow-up commits and a plugin repackage.
Confirm REV-146's real status, then check one actual support_admin_alert delivers before calling the sending-domain question closed.
Done since yesterday: nothing was merged, on either branch: the newest commit on sandbox and production is still 39e594a, the #517 merge of 19 Sep. Two of your tickets left the open list anyway, REV-256 (sent payouts, p1) and REV-196 (Florida tax, p1, In Progress), so both stay above as open questions until you say what closed them. REV-273 moved to In Progress, so the platform build has started. REV-247 is now the only p1 open on you.
The gate reached production on 19 Sep via #512, with #513 as a review follow-up, and the newest commit on the production branch is still from that day. The commits that define its behaviour: require session-scoped 21+ age confirmation (#509), bind age approval to its browsing context, exempt hosted merchant checkout from age gate, require direct merchant payments to bypass age gate, address promotion review on seed items and age persistence, plus confirm age in direct checkout browser checks, which is the only test evidence on it and was written by the same author as the feature.
This is the highest-risk untested surface on the board, because it sits in front of payment and it fails in the direction of blocking a buyer. The detector that would notice a funnel collapse was last recorded matching 0 rows (REV-261, now closed with no commit), so a regression here stays invisible until a merchant complains.
Next actionTest it on your own store, not a merchant's: confirm once and pay; refuse and check what the buyer sees; confirm, close the tab, return, and check whether you are asked again; run it on the hosted path and on the direct path; check a returning buyer mid-payment is never re-gated. One line per case, posted where Nur and Tim will read it.
REV-257 (reproduce the Synergy failure) and REV-262 "Checkout phone field says 'optional' but blocks payment (Synergy Labs, live)" have both left the open list. git backs this one: Nur's fix(checkout): keep hosted phone optional through card and Apple Pay and fix(checkout): preserve supplied phone when Wallet omits it, merged as #514 and promoted as #517. Deployment to the Fly apps is still unverified, and the 21+ age gate sits on the same storefront path.
Run the cases the fix claims on your own store: card with no phone, card with a phone, Apple Pay where the Wallet omits the phone, Apple Pay where it supplies one. Then trace Synergy's next real order end to end and say whether a buyer completed a purchase; do not infer it from the ticket closing.
REV-234 "QA: embedded Visa box on WooCommerce (REV-233), plan now, run M1 Wed + M2 Thu with Tim" read [Todo] p1, upd 2026-09-16 on 18 Sep and has not been open since; REV-249 (the ten manual cases) and REV-228 are gone too. No readable source records a run, a pass or a fail. Meanwhile #507 and #508 put bind reused box URLs to the current payment session and reuse unchanged embedded Woo checkout orders into production after Apex switched, a defect class QA would have been looking for.
The version gap still stands: test: expect WooCommerce 1.3.7 release metadata means the live plugin has moved well past the 1.2.34 the cases target.
Post two lines where Tim and Nur will read them: did M1 and M2 run, and against which plugin version. If they did not, run them on 1.3.7 before anyone calls the box verified.
As of the 15 Sep read: Tim estimated about 9 of 20 real buyers reached the page and never submitted a card, and replay review was the next step; no result has been visible in any source since. Targets: Biopep cs_EZO-PKMQnMyecR0VfwTx $3,277.87, cs_RVasVZH_AAxR1qMea1PK $109.00, cs_ZK_B_CCbydE0g6S43ljT and cs_xzPaO8-h-7F5c3TwHr1C (both $69.99).
With Slack and the DB blind for seven days, replays are the one source of buyer-level truth that does not depend on the collector. They are also the fastest way to tell whether the new age gate is adding an abandonment point.
Next actionWatch the four Biopep replays, and while you are in there watch any post-19 Sep session that hits the age gate. One line each to Nur and Tim.
As of the 15 Sep read: the 14 Sep payout run listed Narboto inc at $0.09 to a test bank account, Andrew refused to send it, Aadil asked for test accounts to be removed from payouts, and Nur agreed the next run leaves them out. Halo orders RC-2026-1000228, -232, -233, -235, -236 and -242 (all $0.50) were unrefunded at the 2 Sep read; whether a refund landed since is unverified. Tim's overlapping-window question in BACKLOG.md is about three of these same $0.50 orders.
A test bank account on a live payout run is also a candidate for the bad profile REV-272 described before it closed.
Next actionRefund the six from admin, confirm with Nur that test merchants are flagged out of payout runs, and move dollar tests to your own store.
Done since yesterday: nothing left your list this time; it was already cleared over the previous weekend, and no readable source has since recorded a result for any of those tickets. Nobody ticked or commented on the 21 Sep board.
In the 22 Sep 13:06Z collection, Slack (channel list and all 8 channels), the prod DB (all six tracked merchants, plus the JSON decode error on the raw read) and TG Core Engineering returned SECTION UNAVAILABLE. Linear, git, BACKLOG.md and the marks endpoint answered. Same missing-PATH signature as 2, 7, 8, 9, 10, 12, 14, 16, 17, 18, 19 and 21 Sep.
The cost is now concrete rather than theoretical. Four tickets covering payouts and tax closed in the last 24 hours with no commit behind them, and not one of the three sources that could show whether merchants were actually paid, or whether Florida tax is still being charged, was readable. The TG send in generate.sh also still fails with node: command not found, which is why the marks endpoint has come back empty for seven boards running: nobody knows the board exists.
Add an explicit PATH export (node, flyctl) at the top of collect.sh and generate.sh, or tell Tim in one line that it needs a human hand on the machine. Then re-run collect.sh by hand. Five boards have now named this fix without it being applied.
Production-side merges not yet confirmed rolled: #517 (codex/rev262-production, the phone fix) and #516 (from sandbox, carrying #515's payment-health routing), both 19 Sep; #508 (codex/box-session-idempotency-production, merged by Tim), #512 (codex/age-gate-catalog-production) and #513; and the twelve PRs from 18 Sep (#283, #494 through #504). Merged is not deployed: prod CD needs the CLAMAV and CDR tokens and rolls seven Fly apps, and a missing build-arg has crash-looped the API before.
The quiet window makes this cheap and worth doing now. There is nothing in flight to confuse a release check, so one pass tells you exactly what buyers are hitting. It also settles Nur's open question in one go: whether REVION_TAX_SUPPRESS_STATES is set on the prod app, which is the fact Tim needs for Jarrod.
Once PATH is fixed, run flyctl releases per app and check the release tag for #508, #512, #513, #516 and #517, read REVION_TAX_SUPPRESS_STATES off the prod app, then confirm on the live storefront whether the age gate renders and the phone field is optional. Never place a payment on sandbox.revioncaps.com: prod keys.
The DB watch list is still six merchants (halo, rhp, kiyora, zen, bpl, biopep) and the channel list eight. As of the 15 Sep read, live merchants also included Apex Peptide Supply mrc_Jj7KJ7lPbJSh, Bioscience Peptides mrc_gUkKa0d4TClA, Veri 7 labs mrc_7RFYJXz5hHPT, Epic Wholesalers mrc_i1ZcMuL8KlKJ, Research Chemical mrc_Vhs6nzY0_j-c, Peptide911 mrc_PCV1-S_xcogf and Viltrumite Lab mrc_4oOU2meLCons; none is tracked.
Pura, Seven Sigma and Synergy were only ever visible through their Linear tickets, and those have closed. The payout thread was visible through REV-256 and REV-272, and they have closed too. Even with every source answering, the board would now say nothing about any of it. A closing ticket should not be able to remove a merchant from view.
Next actionAdd Pura, Seven Sigma, Synergy and Apex to MERCHANTS and their channels to CHANNELS in collect.sh, then derive both lists from the DB so the next go-live is tracked without anyone remembering to add it. Add a payouts query to the DB section so the payout path has a source that is not a ticket.
Today's run log: collection at 13:06Z, then "API Error: Your computer went to sleep mid-response" twice and "compose attempt 1 failed (exit 1) - retrying in 5 min". On 21 Sep and 19 Sep the same slot failed on ENOTFOUND instead. The common shape is that generate.sh composes on a bundle of any age without saying so, and a retry five minutes after a sleeping machine is not a retry at all.
Two consequences, both visible on this page: the merchant facts are seven days stale while the stamp has to explain it in prose, and the 13:06Z Linear read is the one that sets the board's story even though hours have passed since.
Next actionIn generate.sh: re-collect before any retry that starts more than about two hours after collection, and widen the backoff so a sleeping or offline machine gets a real second chance rather than three attempts in ten minutes. Both are smaller than the PATH fix.
The live threads are the age gate's effect on real buyers (production via #512), Synergy's first order after the REV-262 fix, and whether Pura is actually trading now that REV-266 has closed with no commit. Biopep's next attempt is still open too, with none of four sessions reaching a card as of the 15 Sep read. watch-merchant.sh could not be run in this collection; node and flyctl were both off PATH again.
REV-266 and REV-262 are both closed, so this watch is the only check left on either. Once PATH is fixed, watch the next live order end to end through the gated checkout, confirm charge, receipt and Woo order state, and post the result where the team reads it.
File one labelled Charge inquiry via the sandbox public support endpoint and confirm the alert email carries both admin links. (Claude's live POST was classifier-blocked, so it needs a human-run curl or Tim's go.) It pairs with Nur's failing support_admin_alert item, possibly closed by REV-146, same send path either way. BACKLOG.md still lists both halves as open.
Slack, the DB and TG read SECTION UNAVAILABLE in the 22 Sep collection, so there is no fresh merchant signal to sweep. Linear answered: 23 open, four fewer than yesterday, all four on the live business. git answered empty and the clone confirms nothing merged since 19 Sep. Slack, DB and TG items carry over from the 15 Sep 18:32Z read. Drafts go to the owner on this board; nothing is sent from here.
Done since yesterday: nothing shipped from this lane. Attempt 1 of today's run died when the machine slept mid-response, so this board is a retry on a bundle hours old for the third time in four runs. The PATH fix is still unapplied, seventh day blind, and the TG post has now failed after every publish since at least 15 Sep, which is the simplest explanation for seven boards with no ticks.