STATUS

Last updated: 2026-08-22 (punchlist flips: D:launch-p0-hardening) · Rewritten from a code-verified audit (four parallel code sweeps at d2c791a; docs were not trusted). Previous STATUS (whose body had frozen in mid-July while the banner stayed fresh) is archived at archive/2026-08-22-doc-reset/STATUS.md.

Update procedure (docs/DOCS-POLICY.md is normative): update the section that changed and bump the date above. No banner stacking — this file describes NOW; the history lives in DECISIONS.md (D227 as of 2026-08-21) and git.

Launch target: go-live 2026-09-21 (owner-set, 2026-08-22).

✅ What works (code-verified)

End-to-end MVP loop: sign up (Clerk) → create project/target → edit → publish → view live, including custom domains with TLS and scheduled re-verification (D227).
Editor: canvas + DOM tree + property editor (30 modules), save-v2 sink with IndexedDB crash journal replayed on boot; design-token system (all 9 token libs tested); component libraries (shadcn/daisyUI/html) with golden-drop tests; behavior graph + motion; UI Lab.
API: ~47 route modules / ~230 endpoints; ~85 node suites run against real Postgres (PGlite + live migrations). Nodes batch save, targets/projects, pages/folders, publish (~15 suites), serve, forms (+ Turnstile + rate limit), member/visitor auth (fail-closed), CMS workflow, assets.
Publish: dual-write live + immutable versioned builds with one-click rollback (20 kept), sitemap/robots/feeds/redirects/OG cards, per-script sha256 CSP, 8-provider embed registry + test-locked third-party ledger, sandboxed custom_code. The security stack is above the launch bar.
Bondlayer importer (apps/bondlayer-worker/): end-to-end with 2,776 assertions green (50 test files); 47-kind loss registry CI-gate-guarded in tests; re-import updates in place (D215/D216).
CMS: full CRUD, workflow/review, i18n, Excel import, version history, submissions inbox. Import wizard: CSV/JSON/XLSX/Webflow/Bondlayer.
Multi-tenancy: Clerk org = project; project→target hierarchy landed in the frontend (D191–D202); five-tier roles; webhook projection heal.

🔴 Launch punchlist (blocking or near-blocking for 2026-09-21)

Security (closed 2026-08-22 by D:launch-p0-hardening unless noted):

~~Yjs WS upgrade has no authorization~~ FIXED — lib/ws-auth.ts verifies the Clerk token + target membership before the DO sees the socket (tested).
~~assets-cdn.ts unauthenticated read-any-key~~ FIXED — now enforces the same metadata.public authorization as /api/asset-pub (tested).
RLS partially proven: the silent BYPASSRLS fallback is gone — getTenantDB now throws when NEON_AUTHENTICATED_DATABASE_URL is unset, and the chooser matrix is tested. Still open: a live cross-tenant integration test through the real tenant role (needs Neon + a pg_session_jwt-valid token). ⚠️ Deploy prerequisite: confirm the secret is set on prod skyfall-api before this ships.
~~Minor sweep~~ FIXED — backup reads admin-gated, /test-role deleted, elementClicked origin-checked, prod sourcemaps off.

Config that is shipped-but-dark (one value each): 5. PUBLISH_ROOT_DOMAIN="" — origin isolation for published sites coded, tested, OFF. Blocked on acquiring the publish zone (owner). 6. CF_ACCOUNT_ID="" — analytics reads 503 while edge writes accrue.

Verification gaps: 7. ~~No CI runs the Python importer suite~~ FIXED — importer-ci.yml runs all 51 test files on Actions; pytest pinned in requirements.txt. 8. Zero tests + no E2E over CanvasPanel/QuickToolbar/PropertyEditorShell (~4,400 lines) — the highest-regression surfaces. 9. Preview↔publish is a fork: frontend/public/preview.html (5,152-line ES5 reimplementation) held to parity by ~11 spot tests. Unguarded axes drift silently. 10. ~~Python↔TS emitter contract fixture stale~~ FIXED — regenerated from the live gen_sample_payload.py; regen path corrected in both citations. (Also: deferred-features.test.ts no longer green-skips on provisioning failure.)

Product holes worth deciding before launch: 11. Property-write split-brain: 18 persistToDB sites bypass the crash journal (attributes/content/slots/links/interactions) — no retry, no rollback. 12. states.default_value/imagePresets imported but read by nobody; xlsx CMS merge failure swallowed; duplicate detail slugs last-write-win; member field/owner visibility rules refused at publish (render as authored). 13. Error invisibility: 21 catch { return [] } in frontend/lib/api/, no error reporting service anywhere. 14. Decide multiplayer: the Yjs stack (~460 lines + DO) is fully dormant — wire it or delete it. WordPress + live-crawl adapters are built but unreachable from the wizard.

🔄 In-flight

Owner ops queue (the real blocker list, plans/OWNER-OPS.md): ONE item — Render Docker rebuild of apps/bondlayer-worker, then re-import (tick “Import members” for 12x12’s 331 galleries), then republish.
Bondlayer coverage ledger (plans/BONDLAYER-FOLLOWUPS-WORKSTREAM.md): open rows — vendor scripts (gated on origin isolation), carousel rewind, font pipeline, three-repeater verify (blocked on the re-import). Row 2 (/detail/:slug) closed by D226 — flip the ledger.
Two live owner decisions (OWNER-OPS): target- vs project-owned media (assets.target_id ON DELETE SET NULL), and the assets.metadata.public reconcile proposal.
Docs reset (2026-08-22, this change): stale docs archived to archive/2026-08-22-doc-reset/; two Starlight sites added — apps/docs-product (docs.matriz.design, user-facing) and apps/docs-dev (dev.matriz.design, synced from repo docs). Owner: create the two Pages projects’ custom domains (see OWNER-OPS entry).

Where to start

Read CLAUDE.md (doc map + conventions), then this file, then plans/OWNER-OPS.md for what’s waiting on a human. Full launch-readiness detail: the 2026-08-22 deep-dive audit (summarized in DECISIONS.md entry D:doc-reset). DECISIONS.md is the why; packages/schema/src/schema.ts (39 tables) is the data truth.