Updated Sun 20 Sep 2026, 08:15 London, catch-up refresh for the missed 19 Sep slot. Partial sources, and thinner than the last three boards: no collection ran for this board, so it is composed from the 19 Sep 12:59Z bundle and nothing here is fresher than that. The 19 Sep board was never published either, that run collected fine and then failed compose twice with "Can't reach the API server (ENOTFOUND)" and gave up, so the last board the team saw is 18 Sep and this one covers two days. In the 19 Sep collection, Slack (the channel list and all 8 merchant and payout channels), the prod DB (all six tracked merchants plus the JSON decode error on the raw read), TG Core Engineering and, for the first time, Linear all came back SECTION UNAVAILABLE, the eleventh occurrence of the same missing-PATH signature since 2 Sep with its one-line fix named on the last three boards and still not applied. The marks endpoint also failed, so no ticks or comments on the 18 Sep board could be read: if anyone marked anything, it is not reflected below. git answered clean and carried the one consequential change, a session-scoped 21+ age gate and a retired-GLP-1 catalogue change reaching production (#512, #513) alongside box-session idempotency (#507, #508), all on codex/* branches. Every REV-number status below carries over from the 18 Sep Linear read, and everything sourced from Slack, the DB or TG still carries over from the 15 Sep 18:32Z read, now five days old.
Top now: a 21+ age gate and a GLP-1 catalogue retirement reached production on 19 Sep with no QA record and no ticket anyone can read · Pura Peptides was 36 hours dark with frozen orders at the 18 Sep read and nothing since is readable, so it may be into its fourth day · Seven Sigma's 18 Sep payout deadline passed with REV-244's webhook block still open and REV-256 still saying a sent payout can carry no bank reference
This is the one genuinely new thing in the readable sources since the 18 Sep board. git carries fix(storefront): require session-scoped 21+ age confirmation (#509) plus test(storefront): confirm age in direct checkout browser checks and fix(catalog): keep retired GLP-1 listings out of seeds, authored by the aadil-netizen account and dated 19 Sep, reaching production through PR #512 (branch codex/age-gate-catalog-production) with a review follow-up in #513. Nur's own 18 Sep commits fill in the shape: bind age approval to its browsing context, exempt hosted merchant checkout from age gate, require direct merchant payments to bypass age gate, remove retired SKUs from local overview fixtures, address promotion review on seed items and age persistence.
Read together: the gate is scoped to a browsing session, hosted merchant checkout is exempt, direct merchant payments bypass it, and retired GLP-1 SKUs are being kept out of catalogue seeds. That is a compliance posture change on the buyer path, not a refactor. It is tracked as GitHub issue #509, which is why no REV number covers it and why this board would never have seen it through Linear. No readable source says who decided it, whether it applies to live merchants' buyers or only Revion's own storefront, or whether a single real buyer has been through it. Linear is blind in this collection, so even the ticket-level view is two days stale.
Get two answers before Monday's traffic: who authorised a 21+ interstitial and the GLP-1 retirement, and which merchants' buyers actually see the gate. Then load Revion's own checkout yourself and walk it end to end as a buyer. An age gate with a persistence fix already on it, in front of a funnel that is leaking, is a conversion risk and not just a compliance feature.
Since the switch, git shows the box being fixed in production rather than verified: PR #507 then #508 (codex/box-session-idempotency, then -production, the production merge made by you) carrying fix: bind reused box URLs to the current payment session and fix: reuse unchanged embedded Woo checkout orders, plus test: expect WooCommerce 1.3.7 release metadata. Reused box URLs leaking across payment sessions is exactly the class of defect a live embedded box must not have, and it was found after Apex went live, not before.
REV-234 ("QA: embedded Visa box on WooCommerce, plan now, run M1 Wed + M2 Thu with Tim") last read [Todo] p1, upd 2026-09-16 on the 18 Sep board. Linear did not answer in this collection, so its state is carried forward and two days stale; there is still nothing recording M1 or M2 actually running. Slack and the DB are blind for a fifth day, so there is no session-level evidence that a real buyer has completed an order through the box either.
Stop asking for the QA record and get the fact directly: place one real order through the embedded box on a store you control, confirm the charge, the receipt and the Woo order state, and write that on REV-234 yourself. Two days of post-switch idempotency fixes is the answer to whether M2 ran.
At the 18 Sep read, REV-250 "Seven Sigma: get bank details before the 18 Sep payout" was [Todo] p1 @tim and unchanged, and REV-244 "Cloudflare blocks our webhook, callbacks never arrive" was [Todo] p2 @nur with upd 2026-09-18. Linear did not answer in this collection, so both statuses carry forward unverified and the deadline itself is now two days past.
REV-256 (sent payouts stuck in processing with no bank reference) was also open at that read. If Seven Sigma's first payout went out on 18 or 19 Sep, it went out against order state that depends on callbacks that were still being blocked, and into a payout path that has already stranded Apex and Peptide911. None of that is checkable from here: Slack, the DB and TG are all blind.
Next actionAsk Andrew one question in #ach-payouts-production: did Seven Sigma's payout go, and is there a bank reference against it. Then ask Nur whether REV-244 is actually fixed or just touched. If the payout went without either, treat it as unconfirmed money, not a completed payout.
At the 15 Sep read, mrc_roNy1mlK9Ij5 showed four sessions and zero payment intents: cs_RVasVZH_AAxR1qMea1PK $109.00 and cs_EZO-PKMQnMyecR0VfwTx $3,277.87 (no buyer email), then cs_ZK_B_CCbydE0g6S43ljT and cs_xzPaO8-h-7F5c3TwHr1C, both $69.99 from info@biopepusa.com. Nobody reached the point of submitting a card. The merchant row read https://biopepusa.com as of that read, so the domain trap is plausibly behind them.
The DB has now been blind for five days, so none of this has been re-checked. New and directly relevant: the 21+ age gate and the retired-SKU catalogue change (see the top item) both touch the storefront and catalogue path. BAC Water refusals are the original suspected wall here, and fix(catalog): keep retired GLP-1 listings out of seeds shows the retirement machinery is being actively changed. Whether Biopep's cart now behaves differently, better or worse, is unknown to anyone.
Email Casey and ask him to retry the $69.99 cart while you watch, and to describe the exact screen he stops on, including whether he is now asked to confirm an age. Get Nur's straight answer on BAC Water separately; a default flip is not the same as confirming what Biopep actually hit.
As of the 15 Sep read, #rhp-rhpeptides ended on Jarrod's 1 Sep 05:57Z message: "that text is from the master document, not the one you signed... I will discuss with Aadil today and get back to you." Your 31 Aug 16:36Z answer rested on three things: Revion is the seller of record, "Revion is registered in Florida today", and sections 8.5 and 8.7, which his copy does not contain. RHP: 0 sessions since 13 Sep, fee_rate 14. Slack has been blind for five days, so the channel cannot be re-read.
REV-196 ("Turn OFF Florida sales-tax collection until registered") was [In Progress] p1 @nur and unchanged at the 18 Sep read, with the suppression code merged 15 Sep as PR #465 and the refund and TaxJar-purge halves unshipped. No commit in this collection touches tax at all, so that is still where it stands.
Pull a fresh Florida quote and check it comes back $0 before you reply. Then send Jarrod what you can actually stand behind, and get the registration fact and the executed agreement out of Aadil, since suppressing collection does not answer whether Revion is registered.
REV-251 "Apex: cross-check the 25 approved September payments against Matt cancelled orders" was [Todo] p2 @tim and unchanged at the 18 Sep read. Matt is almost certainly Matthew Jensen, the Apex contact. Which orders he disputes is still in no readable source.
Worth noting before the reconciliation: fix: reuse unchanged embedded Woo checkout orders and fix: bind reused box URLs to the current payment session (PRs #507, #508) change how an existing Woo order is reused across payment attempts. That is the same seam where a Revion payment and a cancelled Woo order drift apart, so the mismatch set may look different before and after 18 Sep. Check dates when you compare.
Get the cancelled order numbers from Matt, and check none of the 25 approved payments was built from an order Woo shows cancelled. Note which side of the 18 Sep idempotency change each disputed order falls on. Confirm with Aadil or Nur that the transfer itself cleared, not just that it was approved.
app_uHyTgAc1QXxFQKBW (coreresearchpeptides.com) was under review from 1 Sep; his current status is in no readable source. REV-214 (verify callback, activate, then send portal credentials) was [Todo] p1, upd 2026-09-18 at the last pull. REV-258 ("Sache's stores: Vyal Labs and Halo Labs USA are still inactive with zero sessions") was [Todo] p2 @tim, unchanged since 16 Sep.
REV-267 ("allow approved merchants to set up portal before activation") reached production on 18 Sep through PRs #498, #499 and #500. That is exactly the gap that would leave an approved merchant idle at zero sessions. Two days on, whether it moved any of the three is unverified, and the collector still does not watch any of these merchants' DB rows.
Next actionRun onboarding-check.sh against Vyal Labs, Halo Labs USA and Sean Finck's account as soon as the DB is reachable, specifically to see whether REV-267 already moved them. If any is live, confirm banking_approved before the first balance matures, since production Set live still does not approve payout banking by itself.
As of the 15 Sep read: 11 Sep run, Halo $1.32, Zen $801.06; 14 Sep run, Halo $358.16 (Mercury ••••2806), Narboto inc $0.09, Zen $2,491.16; Andrew, 15 Sep 13:12Z: "others got paid". The 27 Aug $1,139.16 (9 orders) has not appeared in any run since and has no visible reference.
BACKLOG.md, still last updated 15 Sep, carries the open version of this as your own item: the 8 Sep (window Sep 1-8) and 11 Sep (window Sep 3-11) runs both carry Halo $1.32 from three $0.50 orders at 12%, on overlapping windows. That is still unanswered, and it is the same failure family as REV-256.
Next actionAsk Andrew for the bank references of the 27 Aug and 1 Sep Halo drafts and of the 15 Sep send, and ask Nur to confirm the same three $0.50 orders were not paid twice across the overlapping windows. Then close REV-163 with Aadil.
As of the 15 Sep read, #best-peptide-lab: your 31 Aug 09:06Z offer of 20 minutes to run the first embedded order together got no reply, then Slackbot, 11 Sep 09:44Z, the team removed themselves. Merchant row: active, banking approved 2 Sep, contact dev@guardedpaypro.com, fee 12, 0 sessions and 0 orders since 13 Sep.
REV-247 (rotate the "GuardedPay" password leaked in Core Engineering) was still open at the 18 Sep read. As noted before, the payment-links branch naming is a coincidence, not this merchant.
Next actionEmail dev@guardedpaypro.com, since Slack no longer reaches them: ask straight whether they are still integrating, and offer a slot to put the embedded box on bestpeptidelab.com with you watching. Mention the age gate if it applies to their buyers, so they are not surprised by a new screen.
#kiyora-peptide-llc, 13 Sep 15:30Z, Andrew: "We confirm receipt of Kiyora Peptide, LLC's notice of termination dated September 13, 2026... As Kiyora did not process any transactions through the Revion platform, there are no processed transactions, settlements, chargebacks, refunds, transaction-related losses, or termination reserve to reconcile." 15 Sep DB read: mrc_zinhzQp6eyBC status=active, 0 sessions. Why a working merchant left without a single sale is in no source, and the DB is blind again.
Close the account (keys off), send the effective date Andrew promised, and ask one question: what stopped Kiyora switching Revion on. The same answer probably applies to Best Peptide and RHP.
codex/* branches, three merged by an account no readable source identifies.
this weekREV-252 "Backend reviewer: hire, or interim AI review on every PR" was [Todo] p3 @tim and unchanged at the 18 Sep read. The git in this collection gives it a concrete shape: #507, #508, #512 and #513 all come off codex/* branches, that is AI-agent output, and #507, #511, #512 and #513 were merged by the beastmmode account while the commits are authored by aadil-netizen and Nur. You merged #508 yourself.
To be fair to the process, review did happen at the code level: #513 is literally codex/age-gate-review-followup, and Nur pushed fix: address promotion review on seed items and age persistence twice. What is missing is not review, it is a named person accountable for a buyer-path change reaching production, and any record of that change being exercised against a live checkout.
Decide the shape and write it on REV-252: who reviews, and what cannot reach production without a live-path check. Separately, confirm who beastmmode is and whether that account should be merging to production branches at all.
4SMZBX4M… + run the REV-60 cleanup scriptWhether the ticket is resolved is unverified; there are no billing-inquiry rows in this collection either. BACKLOG.md still carries both halves as open: resolve 4SMZBX4Mswa4R3tzAK5DR as a test (order RC-2026-1000210, Narboto's $1.07, already refunded), then promote PR #355's alert deep links to prod with the next release.
revioncaps.com/admin/billing-inquiries, Resolve, note "QA daily test, no action". Locally: source ~/RevionCaps/creds.sh && python3 ~/RevionCaps/linear_cleanup_rev60.py (idempotent; it also comments on REV-170).
#halo-peptides, 24 Aug 14:36Z: "done and live. Every new order now gets a private order note 'Revion payment link: <url>' plus an order meta field _revion_checkout_url that Sufyan can read programmatically... Already active on your store (plugin 1.2.27)." REV-127 was still [In Progress] p2 @tim at the 18 Sep read, untouched since 2 Sep. The plugin has since moved to 1.3.7 release metadata, ten minor steps past the build that shipped this.
Close REV-127 with the 24 Aug message as proof, or write on it what is left. A shipped ticket left In Progress makes the open list lie.
Done since yesterday: nothing can be confirmed closed, and this board covers two days, not one. Slack, the DB and TG have been blind for five days and Linear did not answer this time either, so no open item could be re-verified. Your one concrete action in the record: you merged PR #508, the box-session idempotency fix, to production on 18 Sep. The marks endpoint failed, so if you ticked anything on the 18 Sep board it is not reflected here.
As of the 15 Sep read: "Synergy Research, LLC" (synergy-labs.uswholesalepeptides.com, mrc_LLEYN7Q4l9fC) applied 10 Sep, approved, live since 15 Sep; "Vyal Labs LLC" (vyallabs.com, mrc_PA2TX_ACHQq5) approved 12 Sep; "Halo Labs USA LLC" (halolabsusa.com, mrc_f4LFsn8VaAaJ, contact Alice Rewoldt) approved 14 Sep. Halo Labs USA is a different business from Halo Peptides, keep them apart in payouts and in REV-231.
At the 18 Sep read, REV-254 had dropped off the open list but REV-262 "Checkout phone field says 'optional' but blocks payment (Synergy Labs, live)" was filed to Backlog and unfixed. Linear did not answer this time, so that is still the latest word. Meanwhile REV-267 (portal setup before activation) reached production on 18 Sep, and a 21+ age gate reached it on 19 Sep. Both change what a newly-live merchant's buyers see.
Next actionGet a yes or no from Nur on Synergy: can a buyer pay right now, and is REV-262 fixed. Then ask whether REV-267 moved Vyal or Halo Labs USA off zero sessions; if not, chase banking and set them live by hand. Check whether any of the three now shows an age gate to buyers before you tell them they are live.
As of the 15 Sep read, #ach-payouts-production: Andrew 16:19Z, "when do you show payouts starting for apex peptide supply they said they had transactions sept 4-7?"; 16:22Z, "peptide 911 wants to know there status as well". Nur, TG 17:48Z: "Two merchants transacted with matured, payable balances but no payout went out because their banking verification step had not been run. Both are now verified." Apex Peptide Supply $2,267.28 (19 orders settled 3-10 Sep); Peptide911 $262.79.
REV-256 "Close out sent payouts: bank reference and sent date, not stuck in processing" was [Todo] p1 @nur with upd 2026-09-18 at the last readable pull. Whether it covers Apex and Peptide911's catch-up run specifically has never been stated anywhere readable.
Ask Nur whether REV-256 includes the Apex and Peptide911 catch-up run. Then get Andrew to confirm both ACH transfers carry an actual bank reference, not just a "sent" status, before you call Matthew Jensen and James Votraw.
git in this collection carries fix(catalog): keep retired GLP-1 listings out of seeds (authored by the aadil-netizen account, 19 Sep, reaching production via PR #512) alongside Nur's fix(seed): remove retired SKUs from local overview fixtures and test: cover catalog retirement and correct decline fixture. Retirement plumbing for a named product class is being built and shipped.
Nothing readable says whose decision this is, which merchants it affects, or whether they have been told. It also sits directly across the REV-22 denylist thread: Biopep's 14 Sep email asks why BAC Water fails, your 14 Sep 19:40Z "let em run it up" was never implemented in code, and REV-232 still contradicts REV-241 on whether restricted items are refused at all. A catalogue policy now has three different answers depending on which source you read.
Next actionSay plainly whether GLP-1 retirement is a commercial decision you made, and give one list of what is refused, what is allowed, and for whom. Anyone selling a retired class needs telling before their buyers find out at checkout.
Open since 28 Aug; Nur asked again on the morning of 29 Aug. Whether his payment went out is still unverified, TG has been blind for five days so the thread cannot be checked.
Since the last board, git shows him on the age-gate work (bind age approval to its browsing context, exempt hosted merchant checkout from age gate, require direct merchant payments to bypass age gate, address promotion review on seed items and age persistence), the box-session idempotency fixes behind #507 and #508, the catalogue-retirement fixtures, and the WooCommerce 1.3.7 release metadata. That is on top of the twelve PRs he merged on 18 Sep.
Send it, confirm in the thread.
The wall was measured on 2 Sep: $380 and $361 in non-Visa declines over five days. At the 15 Sep read there were 10 production attempts across merchants, 5 authorized, and declines returned "Your card was declined. Please use another Visa card or contact your card issuer."
REV-112 "Apple Pay on NMI, step 0: confirm with Ignacio the MID supports own-certificate Apple Pay" was [Backlog] p2 @aadil at the 18 Sep read, and no brand-enablement ticket for Mastercard, Amex or Discover appeared in that pull. Apex has been on the embedded box for two days, so every non-Visa buyer hitting it is now a measurable loss rather than a hypothetical one.
Answer REV-112 with Ignacio directly: does the MID support own-certificate Apple Pay. Separately ask what enables Mastercard, Amex and Discover, and by when.
As of the 15 Sep read: Jarrod's copy ends at 8.4 (31 Aug 23:48Z). Tim promised on 1 Sep to discuss it with you that day; the channel has been silent since, and Slack has been blind for five days. Tim's 31 Aug message told Jarrod "Revion is registered in Florida today" and tagged you on Washington registration timing.
REV-196 (Florida suppression, merged 15 Sep as PR #465) was [In Progress] and unchanged at the 18 Sep read. That answers the tax-collection half from the code side. The registration fact and the executed agreement are still only yours to give.
Send Tim the executed RHP agreement and one line on Florida, registered or not, plus your call on an addendum or accepting Jarrod's position.
REV-266 "Pura Peptides dark 36h: fatal error freezes orders, our callbacks now get HTTP 400" was [Backlog] p1 @nur, filed 18 Sep, not yet picked up. Linear did not answer this time, so there is no newer state. If it was 36 hours then and nobody has fixed it, Pura is now approaching four days with frozen orders. Nothing readable confirms either way, which is itself the problem.
The rest, all from the 15 Sep read and unchanged since: Kiyora terminated (Andrew acknowledged 13 Sep, "did not process any transactions"); Best Peptide's team removed themselves from Slack 11 Sep, 0 sessions; Biopep had four checkouts and none reached a card; RHP had 0 sessions. Treat all four as still open.
Next actionPhone Pura today, this is the most urgent relationship item on the board and it is not a Slack message. Then by phone this week: Best Peptide, Biopep's Casey (with Tim), Jarrod (after the Florida answer), and one call to Kiyora to ask why they left.
As of the 15 Sep read, VAPI_PRIVATE_KEY, VAPI_PHONE_NUMBER_ID and VAPI_ASSISTANT_ID were set on revioncaps-prod; calls are held off only by VAPI_OUTBOUND_ENABLED=false, and vapi-outbound.ts has no calling-window, DNC or unbundled-consent gates. No VAPI ticket appeared in the 18 Sep Linear pull either. BACKLOG.md still carries it as a red item needing you and Tim.
Worth connecting to this week's shipping: the team is clearly willing to put a compliance gate in the buyer path when it decides to, a 21+ age gate went live in two days. The same standard has not been applied to outbound calling, where the exposure is statutory.
Next actionEither unset the prod keys or commission the TCPA gates, and file whichever it is.
As of the 15 Sep read: Hudaifa rejoined #halo-peptides on 31 Aug, no messages from Halo since; Andrew confirmed the 14 Sep run went out ("others got paid"); the 27 Aug $1,139.16 had no visible bank reference. REV-163 was [Todo] p2 @aadil at the 18 Sep read, untouched since 2 Sep.
Once Andrew confirms the references, and once REV-256's stuck-in-processing question is answered generally, send Hudaifa a short note or call on what was paid and when, then close REV-163. Include Tim's duplicate-$1.32 question in the same pass.
REV-164 sits below the top-50 Linear window (last seen updated 27 Aug), so its state is unverified rather than closed, and Linear did not answer at all this time. TG has been blind for five days, so whether the message was deleted cannot be checked. REV-247 (the separate "GuardedPay" leaked credential) was still open at the 18 Sep read.
Next actionRotate it, delete the message, close the ticket.
Decided in TG on 31 Aug: DocuSeal replaces DocuSign seats, filed as REV-187 ([Backlog] p3 @unassigned), unchanged at the 18 Sep read. REV-87 (move e-sign to DocuSign) is also still open. REV-144 (banking verified as a gate to LIVE) shipped 15 Sep and closed the question by default before either got an answer.
Say whether DocuSign-by-default is fine to keep, or whether REV-187 still needs doing properly. Then chase Planet, Fit Aminos and Sports Tech yourself.
Variants live in the "Revion Home Variants" artifact (REV-101, [In Progress] @tim, unchanged at the 18 Sep read). BACKLOG.md still shows REV-174 as gated on you picking a letter in TG. No letter in any readable source.
Reply with a letter in Core Engineering, or say the redesign is parked so REV-174 and REV-101 can close.
Done since yesterday: nothing confirms closed across the two days this board covers. Slack, the DB and TG have been blind for five days and Linear did not answer this time, so no commercial item could be re-verified. The marks endpoint failed too, so any ticks or comments left on the 18 Sep board are not reflected here.
The commits, in order: fix(storefront): require session-scoped 21+ age confirmation (#509) and test(storefront): confirm age in direct checkout browser checks (aadil-netizen, 19 Sep), your fix(storefront): bind age approval to its browsing context, fix(storefront): exempt hosted merchant checkout from age gate, test(checkout): require direct merchant payments to bypass age gate, test(checkout): match the backend decline status, and fix: address promotion review on seed items and age persistence. It reached production through #512 (codex/age-gate-catalog-production) with #513 as the review follow-up, and the sandbox side through #511 (feat/gh-509-session-age-gate-sandbox).
Four exemption or scoping rules landed in two days, which makes the blast radius genuinely hard to hold in your head: hosted merchant checkout exempt, direct merchant payments bypassing, approval bound to a browsing context, and a persistence fix on top. A buyer who confirms once and gets asked again, or worse is blocked mid-payment, is a lost order, and this has gone live on the same funnel as REV-262's phone field and Biopep's four card-less sessions.
Next actionWrite the matrix down in one place: which checkout surfaces gate, which are exempt, what the buyer sees, and what happens when the stored approval is missing or stale. Then walk one live buyer path per surface yourself. The board cannot tell whether this helps or costs money, and right now neither can anyone else.
REV-266 "Pura Peptides dark 36h: fatal error freezes orders, our callbacks now get HTTP 400" was [Backlog] p1 @nur at the 18 Sep read. Linear did not answer in this collection, and no commit in it names Pura, callbacks or a 400. So the newest fact available is two days old, and it concerns a merchant with frozen orders.
The failure shape is close to REV-244 (Cloudflare blocking Seven Sigma's and Bioscience's webhooks), but callbacks actively returning HTTP 400 points more at a broken endpoint or a changed contract than a network block, and this week the contract did change: the age-gate and catalogue work touched the storefront and checkout paths on the same days. Worth ruling in or out rather than assuming they are unrelated.
Next actionMove REV-266 to Todo and answer three things: what changed before the orders froze, whose side the 400 comes from, and whether the frozen orders are recoverable once the callback path works. If it is already fixed, say so somewhere readable, because from every source this board can see, Pura is still down.
REV-254 ("Synergy Labs live: buyers see 'Card processing is temporarily unavailable'") and REV-257 (the QA repro) had both dropped off the open list by the 18 Sep read, with REV-262 "Checkout phone field says 'optional' but blocks payment (Synergy Labs, live)" filed to [Backlog] p1 @nur in their place. Linear did not answer this time, so nothing newer exists. No commit in this collection names a phone field.
What did land on that surface: the 21+ gate, the catalogue-retirement change, and a test(checkout): match the backend decline status fixture. A field that says optional and then blocks payment is the same class of defect as an age confirmation that does not persist. Both fail silently from the buyer's side, and the detector that should catch either is confirmed dead (REV-261).
Fix REV-262 or say plainly why a live merchant that cannot take payment sits in Backlog. Then put one real order through Synergy's checkout, with the age gate in place, and confirm a buyer can complete it. Do not infer it from a ticket disappearing.
As of the 15 Sep read: your TG 17:48Z, matured balances, "no payout went out because their banking verification step had not been run"; REV-144 shipped 15 Sep to gate future Set-live on banking verification. That closed the cause for new merchants. It does not prove any already-live merchant's balance is actually paid out.
REV-256 was [Todo] p1 with upd 2026-09-18 at the last readable pull. It touches Apex and Peptide911's catch-up run, Halo's 14 Sep $358.16, Zen's overlapping-window runs, and Seven Sigma's first payout, whose deadline has now passed with no readable confirmation. BACKLOG.md also still carries the production-side hole: Set live does not approve payout banking until PR #456 ships, so it has to be done by hand every time.
Post one list in #ach-payouts-production: every payout marked sent in the last 30 days, with or without a bank reference. Anything without one is not confirmed paid whatever the status says. Start with Apex, Peptide911 and Seven Sigma.
promote/m2-full (#502) and promote/wave1-safe-fixes (#501) reached production on 18 Sep. Immediately after, #507 and #508 (codex/box-session-idempotency, then -production, merged by Tim) carried fix: bind reused box URLs to the current payment session and fix: reuse unchanged embedded Woo checkout orders, plus test: expect WooCommerce 1.3.7 release metadata.
A reused box URL not bound to the payment session is a cross-session risk on a live checkout, and it was found after the switch rather than before it. REV-234, the QA ticket that was meant to gate this, last read upd 2026-09-16, and Linear did not answer this time. The plugin's release metadata has also moved to 1.3.7 while REV-249's manual QA cases were written against 1.2.34.
State what #507 and #508 actually fixed in buyer terms, and whether any live order between the switch and the fix could have been affected. Then pin the live plugin version so QA is testing what is deployed.
New in this collection: fix(catalog): keep retired GLP-1 listings out of seeds, fix(seed): remove retired SKUs from local overview fixtures, test: cover catalog retirement and correct decline fixture and test: use workspace export for catalog seed regression. So there is now a retirement path, with regression coverage, shipped to production via #512.
Against that: REV-241 (PR #461) changed prohibited products to allowed by default on 15 Sep, REV-232 "restricted items still refused with the alias on" was [Todo] p1 @narbotokerimov and unchanged at the 18 Sep read, REV-231 has been off the open list since 16 Sep, and Biopep's BAC Water is still refused in code despite Aadil's 14 Sep "let em run it up". Four sources, four different answers about what a merchant may sell.
Write the one true statement of the rule: per merchant, what is refused, what is retired, what is allowed, and which flag controls it. Until that exists, nobody should treat "restricted items are refused" as true for any merchant, and Narboto cannot test REV-232 meaningfully.
REV-244 "Seven Sigma and Bioscience: Cloudflare blocks our webhook, callbacks never arrive" was [Todo] p2 @nur, upd 2026-09-18 at the last readable pull. Nothing in this collection touches it, and Linear is blind, so two days on nobody outside your head knows whether it is fixed.
This is the same mechanism REV-226 already found cancelling paid Apex orders, and Pura's REV-266 (callbacks now returning HTTP 400) is the third callback-path failure in a week. Three merchants, one shared surface.
Next actionFind what Cloudflare is blocking, get an allowlist or bypass in, and say what the 18 Sep update actually changed. Then check Pura's 400s against the same cause before treating them as separate incidents.
REV-247 "Delete the credentials and bank details posted in Core Engineering, rotate the GuardedPay password" was [Todo] p1 @nur and unchanged at the 18 Sep read. How long it has been exposed and who posted it is in no readable source; TG has been blind for five days so the message itself cannot be checked. REV-164 (the separate A@ Google password) is in the same state.
Delete the message, rotate the password, and check whether anything was accessed with it while it was live.
REV-196 "Turn OFF Florida sales-tax collection until registered" was [In Progress] p1 @nur at the 18 Sep read. PR #465 (merged 15 Sep) covers the "$0 FL quotes" half. The refund of what was already collected and the TaxJar purge are named in no commit in this collection.
Confirm a fresh Florida quote comes back $0 and tell Tim, since he is blocked on it for RHP. Then refund what was collected and purge the TaxJar test transactions, or get the registration fact from Aadil first if the suppression turns out to be wrong.
REV-214 ("verify callback, activate, then send portal credentials") was [Todo] p1 with upd 2026-09-18 at the last readable pull. REV-267 shipped the same day through PRs #498, #499 and #500 and changes exactly this sequence. Neither Linear nor any other source states they are linked.
Two days on, Vyal Labs, Halo Labs USA and Sean Finck's Core Research Peptides are still unchecked against it, because the DB has been blind for five days and none of them is in the collector's watch list anyway.
Next actionConfirm REV-267 answers REV-214 and close REV-214 if so. Add the standing Slack alert for any live merchant without banking_approved, since REV-144 gates new merchants but does not retroactively flag the ones already live.
REV-226 ("Webhook timeouts cancel PAID Woo orders") had two merges through 15 Sep: #455 (ack-then-process) and #457 (bound delivery lifetime within outbox lease). New in this collection, and closer than anything before it: fix: reuse unchanged embedded Woo checkout orders and fix: bind reused box URLs to the current payment session, shipped to production as #508.
That is hardening on the same path, but it is still not the reconcile sweep. No commit anywhere names reconciling the orders the original bug already cancelled, and Aadil has an Apex call pending that needs exactly that number.
Next actionConfirm #455 and #457 are actually in production, then run the one-off reconcile of Apex orders Revion shows AUTHORIZED and Woo shows cancelled, and give Aadil the count before his call. Say whether #507 and #508 change the reconcile logic.
REV-265 "No order has ever had a tracking number: 240 orders ($24,000) past ship date with no fulfilment evidence" was [Backlog] p2 @nur at the 18 Sep read. Alongside it, REV-263 "Guest orders not fixed: plugin still never writes the billing name (REV-230 closed early)" ([Backlog] p1) and REV-268 (login hardening, [Backlog] p3). Linear did not answer this time, so all three are carried forward.
REV-263 matters beyond itself: a ticket closed before the behaviour changed is the same pattern as REV-127 and REV-146, and it is exactly what makes the open list untrustworthy when the board is already running blind on four sources.
Next actionTriage REV-265 into Todo first given the dollar figure and the dispute risk, and pull a sample of the 240 to check whether tracking exists anywhere outside Revion (carrier, Woo) before assuming it is genuinely missing. REV-263 and REV-268 after.
REV-261 "REV-142 shipped a dead detector: gateway failure streak join matches 0 rows on prod" was [Backlog] p1 @nur at the 18 Sep read. Pura's 36 hours dark and Synergy's failure were both found by a person noticing, not by a detector. Still open at that read: REV-165 funnel and decline report (p2), REV-145 plugins page (p2), REV-173 telemetry null (p4), REV-104 operator payment links (p2).
This is now the most expensive open item on the board by leverage. A 21+ age gate reached production on 19 Sep, adding a new way for a buyer to fall out of the funnel silently, at a moment when nothing measures that funnel. Biopep's four card-less sessions and Synergy's phone field are both the same invisible-loss shape.
Next actionFix REV-142's join before anything else on this list. Then add one counter on the age gate specifically: shown, confirmed, abandoned. If the gate is costing orders, right now nobody would ever find out.
REV-189 has stayed off the open list, and no commit in this collection names fee rates. At the last code read, zod locks feeRate to 12|14 in three places, sandbox-provisioning-client.ts:66 refuses other values, and settlement.ts guards fee_rate IN (12, 14) twice. REV-246 (Pura's NMI batch cutoff time) was still open at the 18 Sep read.
While you are in Pura's account for REV-266, read the merchant row: if it went live at 12 or 14 against an 8.5 contract, tell Aadil; if 8.5 is stored, prove it passes both settlement guards.
emails.ts.
this weekemails.ts:368 carried the "processing is disabled" line at the 2 Sep read. REV-169 "Fix the merchant credentials email copy" was [Duplicate] and unchanged at the 18 Sep read, and no readable source names which ticket absorbed it. REV-214 remains the most likely candidate, same send path, and REV-267 has now changed that path further by letting approved merchants into the portal earlier.
Find the canonical ticket REV-169 points at and confirm the copy itself changed. With REV-267 live, more merchants now receive this email before activation completes, so wrong copy reaches more people.
fee_cents drops on a partial refund is still stated nowhere.
this weekAs of the 15 Sep read: opt-in NMI reversal reconciliation "and atomic accounting" (#443), linked reversals held before reporting to the ACH generation fence (#445), external refund parent and original payment verified (#448), an exception review queue with opt-in Slack alerts (#452). At the last code read settlement.ts deducted refunded_cents but never recalculated fee_cents down, and MFSA 16.4 argues it should.
One line: does #443's accounting reduce the fee share on a partial refund? If not, add it before reconciliation is switched on for real merchants.
As of the 15 Sep read, Biopep now reads https://biopepusa.com. Application websites: Research Chemical LLC https://www.researchchemical.com; Veri 7 labs https://veri7labs.com followed by a zero-width U+2060 character. Whether either merchant row carries the application value is unverified. The 18 Sep canonical-domain batch (#494, #495) fixed how links are built, not what is stored per row.
Read both merchant rows once the DB is back and fix by single-field update if needed, then normalise domains at registration so the next merchant cannot arrive broken.
slack_provisioning_status and _error exist on the merchant row but nothing shows them. Departures are just as invisible: Halo's consultancy left #halo-peptides on 23 Aug, Best Peptide's team left #best-peptide-lab on 11 Sep.
Show invite state and external-member count per merchant in admin, and post to Slack when a merchant's last external member leaves.
Asked in Core Engineering 31 Aug 13:48Z: "Would be sick if we had the customers number ready for anyone/me/andrew/pat to call them right away too." The buyer's phone is collected at checkout; the billing-inquiry queue and its alert email do not surface it. No such ticket appeared in the 18 Sep Linear pull.
Worth doing in the same pass as REV-262, which says that same checkout phone field is labelled optional and blocks payment. One field, two problems.
Next actionShow the buyer's phone on the billing-inquiry admin view and in the alert email, and file it in Linear with the LLM pre-check block.
support_admin_alert emails to support@send.revioncaps.com showed [failed] repeatedly from about 28 Aug. REV-146 was last confirmed [Todo] p2 on the 16 Sep read, then disappeared from the 17 and 18 Sep pulls after a batch of follow-up commits and a plugin repackage. Linear did not answer this time either.
Confirm REV-146's real status, then check one actual support_admin_alert delivers before calling the sending-domain question closed.
REV-174 did not appear in the 18 Sep Linear pull (was [Todo] p4 @nur as of 16 Sep). BACKLOG.md still describes it as gated on Aadil picking a letter in TG. REV-101 (the variants, Tim) was unchanged, still [In Progress]. No letter in any readable source.
Nothing before Aadil's letter; if p4 means parked, say so on REV-174 so REV-101 can close too.
Done since yesterday: real movement, all from git, covering 18 and 19 Sep. The 21+ age gate reached production (#511 sandbox, #512 production, #513 review follow-up) with your scoping and persistence fixes on it; box-session idempotency reached production as #507 then #508, fixing reused box URLs not bound to the current payment session; the catalogue-retirement path shipped with regression coverage; WooCommerce release metadata moved to 1.3.7. None of it is QA-confirmed by any readable source, and every REV status above carries over from the 18 Sep Linear read because Linear did not answer this time.
REV-234 "QA: embedded Visa box on WooCommerce (REV-233), plan now, run M1 Wed + M2 Thu with Tim" last read [Todo] p1, upd 2026-09-16. Linear did not answer this time. Meanwhile #507 and #508 put bind reused box URLs to the current payment session and reuse unchanged embedded Woo checkout orders into production the day after Apex switched. That is a defect class QA would have been looking for, found by someone else after go-live.
The version gap got worse too: test: expect WooCommerce 1.3.7 release metadata means the live plugin has moved well past the 1.2.34 that REV-249's ten manual cases were written against. Cases written for a build that is no longer deployed will pass or fail for the wrong reasons.
Answer the two questions in writing: did M1 and M2 ever run, and what plugin version is actually live. Then re-pin REV-249's cases to the deployed version before running any of them.
The gate reached production on 19 Sep via #512, with #513 as a review follow-up. The commits that define its behaviour: require session-scoped 21+ age confirmation (#509), bind age approval to its browsing context, exempt hosted merchant checkout from age gate, require direct merchant payments to bypass age gate, address promotion review on seed items and age persistence, plus confirm age in direct checkout browser checks, which is the only test evidence on it and was written by the same author as the feature.
This is the highest-risk untested surface on the board right now, because it sits in front of payment and it fails in the direction of blocking a buyer. The detector that would notice a funnel collapse is confirmed dead (REV-261), so a regression here stays invisible until a merchant complains.
Next actionTest it on your own store, not a merchant's: confirm once and pay; refuse and check what the buyer sees; confirm, close the tab, return, and check whether you are asked again; run it on the hosted path and on the direct path; check a returning buyer mid-payment is never re-gated. One line per case, posted where Nur and Tim will read it.
REV-257 "QA: reproduce the Synergy checkout failure and capture the exact error we return" dropped off the open list by the 18 Sep read, consistent with the repro having been delivered. REV-262 "Checkout phone field says 'optional' but blocks payment (Synergy Labs, live)" was filed to Backlog. Linear did not answer this time, so both remain where they were.
Next actionConfirm your repro is what became REV-262, then run one real checkout on Synergy's store, with the new age gate in place, and say whether a buyer can complete a purchase. Do not infer it from a ticket disappearing.
As of the 15 Sep read: Tim estimated about 9 of 20 real buyers reached the page and never submitted a card, and replay review was the next step; no result has been visible in any source since. Targets: Biopep cs_EZO-PKMQnMyecR0VfwTx $3,277.87, cs_RVasVZH_AAxR1qMea1PK $109.00, cs_ZK_B_CCbydE0g6S43ljT and cs_xzPaO8-h-7F5c3TwHr1C (both $69.99).
With Slack and the DB blind for five days, replays are the one source of buyer-level truth that does not depend on the collector. They are also the fastest way to tell whether the new age gate is adding an abandonment point.
Next actionWatch the four Biopep replays, and while you are in there watch any post-19 Sep session that hits the age gate. One line each on Biopep to Nur for REV-231 and to Tim.
REV-232 "Test: product-name alias on every screen, restricted items still refused with it on" was [Todo] p1 and unchanged at the 18 Sep read. New in this collection: fix(catalog): keep retired GLP-1 listings out of seeds, fix(seed): remove retired SKUs from local overview fixtures and test: cover catalog retirement and correct decline fixture. So "refused" now has at least two mechanisms, a denylist and a retirement path, and REV-241 made the denylist permissive by default.
Do not test this until Nur states the rule per merchant, including which flag controls it and what "retired" does versus "prohibited". Get the per-merchant PROHIBITED_PRODUCTS_MODE values first, then write the cases against the stated rule.
REV-235 was [Todo] p1 @narbotokerimov and unchanged at the 18 Sep read; REV-104 (operators create payment links) was still open. PR #484 reworked merchant payment links (guarded catalogue prices, durable email, cooldown mailbox) and #503/#504 removed an SMS-advertising line from the same portal surface.
Run it on your own test merchant, not Halo: Send Link, pay with a Visa, check the dashboard shows it, mark it fulfilled, refund. Check whether a pay-by-link buyer now hits the age gate, since that path is neither hosted checkout nor a direct merchant payment.
As of the 15 Sep read: the 14 Sep payout run listed Narboto inc at $0.09 to a test bank account, Andrew refused to send it, Aadil asked for test accounts to be removed from payouts, and Nur agreed the next run leaves them out. Halo orders RC-2026-1000228, -232, -233, -235, -236 and -242 (all $0.50) were unrefunded at the 2 Sep read; whether a refund landed since is unverified. Tim's overlapping-window question in BACKLOG.md is about three of these same $0.50 orders.
Next actionRefund the six from admin, confirm with Nur that test merchants are flagged out of payout runs, and move dollar tests to your own store.
Unchanged at the 18 Sep read: REV-93 scanned PDFs ([Todo] p2), REV-92 duplicate applications ([In Review]), REV-90 mobile wizard defects ([In Review]), REV-91 guest upload-session defects ([Todo]). REV-240 (automate deploy regression checks inside the Checkout E2E gate) was also unchanged and open, which is the item that would have caught this week's post-switch defects.
Finish the REV-90 and REV-92 reviews this week; for REV-93, reproduce with a phone-scanned PDF and post the CDR rejection code for REV-186.
REV-216 ([Todo] p2) was unchanged since its title updated 17 Sep. Test traffic keeps landing in production money: the $0.09 Narboto inc payout, the six $0.50 Halo orders, and a QA case set pinned to a plugin version that has since moved.
One Woo store on your own account, so REV-234, REV-232, REV-235 and the new age-gate cases run there instead of on a merchant, and so plugin-version QA stays pinned to what you control.
Open at the 18 Sep read: REV-215 (11 Sep, p1), REV-209 (7 Sep), REV-207 (6 Sep), REV-206 (5 Sep), REV-202 (3 Sep), REV-181 (30 Aug), REV-180 (29 Aug), REV-260 ("QA daily - 2026-09-17", [Backlog] p0). REV-98 (validate merchant dashboard release 5565719) has been [In Review] since 2 Sep. No "QA daily - 2026-09-18" appeared, and with Linear unavailable in this collection there is no way to tell whether 19 Sep was filed.
Close or mark-skipped every daily older than REV-260, one line each, and file the missing 18 and 19 Sep dailies or note why they did not happen.
Done since yesterday: nothing confirms closed, and this board covers two days. Linear did not answer this collection, so no QA ticket state could be re-read, and the marks endpoint failed so any ticks on the 18 Sep board are not reflected here. What changed in your lane came from other people's commits: a 21+ age gate went live with only the author's own browser check on it, and the embedded box needed a production idempotency fix the day after the switch.
In the 19 Sep 12:59Z collection, Slack (channel list and all 8 channels), the prod DB (all six tracked merchants, plus the JSON decode error on the raw read), TG Core Engineering and, for the first time, Linear all returned SECTION UNAVAILABLE, along with the marks endpoint. Only git and BACKLOG.md answered. This is the same missing-PATH signature recorded on 2, 7, 8, 9, 10, 12, 14, 16, 17 and 18 Sep, with the fix, an explicit PATH export at the top of collect.sh and generate.sh, named on the last three boards and still not applied.
Linear going down is the escalation that matters. Every REV-number status on this board now carries from the 18 Sep read, so the board has stopped being able to tell a fixed ticket from an ignored one. Pura may be four days dark or fixed; nothing here can distinguish those. git alone found the week's biggest change, a 21+ age gate on the buyer path, precisely because git does not need the PATH. That is not a reason to keep running on one source.
Next actionApply the PATH export, or tell Tim in one line that it needs a human hand on the machine. Writing it into a fourth board is a demonstrated non-fix after ten failures. Then re-run collect.sh by hand and post what the five dead sources actually say, because two days of merchant state is currently unread.
Production merges in this collection: #508 (codex/box-session-idempotency-production, merged by Tim), #512 (codex/age-gate-catalog-production) and #513 (codex/age-gate-review-followup), on top of the twelve PRs from 18 Sep (#283, #494 through #504). Merged is not deployed: prod CD needs the CLAMAV and CDR tokens and rolls seven Fly apps, and a missing build-arg has crash-looped the API before.
This matters more than usual because the two changes point in opposite directions if only one lands. If the age gate rolled and the box-session fix did not, buyers get a new blocking step on a checkout that can still reuse a stale box URL.
Next actionOnce PATH is fixed, run flyctl releases per app and check the release tag for #508, #512 and #513 specifically, then confirm on the live storefront whether the age gate actually renders. Never place a payment on sandbox.revioncaps.com: prod keys.
The 19 Sep run collected fine (170 bundle lines) and then failed compose twice with "API Error: Can't reach the API server (ENOTFOUND)", five minutes apart, and gave up. No site/2026-09-19/ page exists, so the last board the team saw is 18 Sep. This compose then ran against bundle-latest.md dated 19 Sep 13:59 local, because no collection ran first, which is why a 19 Sep read sits under a 20 Sep stamp.
Both are mechanical, not judgement calls. The retry window (three attempts inside about ten minutes) is too short to survive a transient network outage, and the pre-13:57 and Sunday guards then block the catch-up path until a human forces it. And generate.sh will happily compose on a bundle of any age without saying so.
Two changes in generate.sh: widen the retry backoff so a network blip cannot eat the day, and refuse to compose on a bundle older than about two hours, re-collecting first or failing loudly. Both are smaller than the PATH fix and both prevent a silently stale board.
As of the 15 Sep read, live merchants included Apex Peptide Supply mrc_Jj7KJ7lPbJSh, Bioscience Peptides mrc_gUkKa0d4TClA, Veri 7 labs mrc_7RFYJXz5hHPT, Epic Wholesalers mrc_i1ZcMuL8KlKJ, Research Chemical mrc_Vhs6nzY0_j-c, Peptide911 mrc_PCV1-S_xcogf and Viltrumite Lab mrc_4oOU2meLCons; none is in the collector's channel list. The DB watch list is still only six: halo, rhp, kiyora, zen, bpl, biopep.
Pura, Seven Sigma and Synergy are the three merchants with live incidents, and all three were only ever visible through Linear. With Linear down in this collection, the board has no view of them at all. That is the cost of a hand-maintained list.
Next actionAdd Pura, Seven Sigma and Synergy to MERCHANTS and their channels to CHANNELS in collect.sh, then derive both lists from the DB so the next go-live is tracked without anyone remembering to add it.
The two live threads are the age gate's effect on real buyers (in production since 19 Sep via #512) and Pura's recovery once REV-266 is picked up. Biopep's next attempt is still open too, with none of four sessions reaching a card as of the 15 Sep read. watch-merchant.sh could not be run in this collection; node and flyctl were both off PATH again.
Stay out of Nur's and Narboto's way on REV-266 and REV-262. Once PATH is fixed, watch the next live order end to end through the gated checkout, confirm charge, receipt and Woo order state, and post the result on REV-234.
File one labelled Charge inquiry via the sandbox public support endpoint and confirm the alert email carries both admin links. (Claude's live POST was classifier-blocked, so it needs a human-run curl or Tim's go.) It pairs with Nur's failing support_admin_alert item, possibly closed by REV-146, same send path either way. BACKLOG.md still lists both halves as open.
Slack, the DB, TG, Linear and the marks endpoint all read SECTION UNAVAILABLE in the 19 Sep collection, so there is no fresh merchant signal to sweep and nothing from the team to fold in. Everything sourced from those carries over: Slack, DB and TG items from the 15 Sep 18:32Z read, all REV statuses from the 18 Sep pull. What moved came from git: the 21+ age gate and catalogue retirement to production, box-session idempotency to production, plugin metadata to 1.3.7. Drafts go to the owner on this board; nothing is sent from here.
Done since yesterday: nothing, and worse than nothing: the 19 Sep board was never published because compose failed twice on a network error and gave up, so the team saw no board yesterday. This board composed on the 19 Sep bundle because no collection ran first. The blind collection has still not been re-run by hand, now for a fifth day.